open-memex 0.3.0-alpha → 0.3.0-alpha.3

package/dist/paths.js

@@ -0,0 +1,36 @@
+import path from "node:path";
+import fs from "node:fs";
+import os from "node:os";
+function dataRoot() {
+    if (process.env.MY_O_MEMORY_HOME)
+        return path.resolve(process.env.MY_O_MEMORY_HOME);
+    if (process.platform === "win32") {
+        const appData = process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming");
+        return path.join(appData, "open-memex");
+    }
+    const xdg = process.env.XDG_DATA_HOME ?? path.join(os.homedir(), ".local", "share");
+    return path.join(xdg, "open-memex");
+}
+let _cached = null;
+export function paths() {
+    if (_cached)
+        return _cached;
+    const root = dataRoot();
+    const memories = path.join(root, "memories");
+    const indexDb = path.join(root, "index.db");
+    fs.mkdirSync(memories, { recursive: true });
+    _cached = { root, memories, indexDb };
+    return _cached;
+}
+export function memoriesDirFor(scopeKey) {
+    const { memories } = paths();
+    const dir = path.join(memories, scopeKey);
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/** Same as `memoriesDirFor` but never creates the directory. For read-only
+ *  callers (iteration, existence checks) that must not pollute storage. */
+export function memoriesDirPath(scopeKey) {
+    const { memories } = paths();
+    return path.join(memories, scopeKey);
+}

package/dist/redact.js

@@ -0,0 +1,249 @@
+/**
+ * Redaction: secrets must never land in memory files or the index in
+ * readable form.
+ *
+ * Layers, in order:
+ *   1. <private>...</private> regions are stripped first (explicit opt-out —
+ *      the author marked this span as sensitive, so it is replaced with
+ *      [REDACTED] before any detection runs).
+ *   2. Built-in provider patterns (always on, reported by id).
+ *   3. User patterns from config redactPatterns (reported verbatim).
+ *   4. High-entropy assignment heuristic (catches secrets whose provider we
+ *      don't have a pattern for, e.g. `deploy_key = "aB3d..."`).
+ *
+ * A detected secret does NOT refuse the write: the matched string is masked
+ * in place — first 4 characters kept, the rest replaced with 'x' — and the
+ * write proceeds with the masked content. hadSecret reports that masking
+ * happened so callers can surface a notice. A partially-masked memory still
+ * identifies which credential it referred to without storing the secret.
+ */
+/**
+ * Prefixes like `sk-` also occur inside ordinary English words ("task-…",
+ * "risk-…", "disk-…"), which caused confirmed false positives. Require the
+ * token prefix NOT to be preceded by a word/hyphen char, so a real key after
+ * "=", ":", space, or a quote still matches.
+ */
+const TOKEN_BOUNDARY = "(?<![A-Za-z0-9_-])";
+export const BUILTIN_SECRET_PATTERNS = [
+    { id: "openai-key", source: `${TOKEN_BOUNDARY}sk-[A-Za-z0-9_-]{20,}` },
+    {
+        id: "openai-admin-key",
+        source: `${TOKEN_BOUNDARY}sk-admin-[A-Za-z0-9_-]{20,}`,
+    },
+    {
+        id: "openai-session-key",
+        source: `${TOKEN_BOUNDARY}sm_[A-Za-z0-9_-]{20,}`,
+    },
+    { id: "github-pat", source: `${TOKEN_BOUNDARY}ghp_[A-Za-z0-9]{30,}` },
+    { id: "github-oauth-token", source: `${TOKEN_BOUNDARY}gho_[A-Za-z0-9]{30,}` },
+    { id: "github-user-token", source: `${TOKEN_BOUNDARY}ghu_[A-Za-z0-9]{30,}` },
+    {
+        id: "github-refresh-token",
+        source: `${TOKEN_BOUNDARY}ghr_[A-Za-z0-9]{30,}`,
+    },
+    {
+        id: "github-fine-grained-pat",
+        source: `${TOKEN_BOUNDARY}github_pat_[A-Za-z0-9_]{40,}`,
+    },
+    { id: "aws-access-key-id", source: `${TOKEN_BOUNDARY}AKIA[0-9A-Z]{16}` },
+    {
+        id: "aws-secret-access-key",
+        source: "(aws[_-]?secret[_-]?access[_-]?key)([\"']?\\s*[:=]\\s*[\"']?)([A-Za-z0-9/+=]{40})",
+        flags: "i",
+        valueGroup: 3,
+    },
+    { id: "slack-token", source: `${TOKEN_BOUNDARY}xox[baprs]-[A-Za-z0-9-]{10,}` },
+    { id: "google-api-key", source: `${TOKEN_BOUNDARY}AIza[0-9A-Za-z_-]{30,}` },
+    { id: "npm-token", source: `${TOKEN_BOUNDARY}npm_[A-Za-z0-9]{30,}` },
+    { id: "gitlab-pat", source: `${TOKEN_BOUNDARY}glpat-[A-Za-z0-9_-]{20,}` },
+    {
+        id: "stripe-restricted-key",
+        source: `${TOKEN_BOUNDARY}rk_(live|test)_[A-Za-z0-9]{20,}`,
+    },
+    {
+        id: "stripe-webhook-secret",
+        source: `${TOKEN_BOUNDARY}whsec_[A-Za-z0-9]{20,}`,
+    },
+    {
+        id: "private-key-block",
+        // Whole block: masking only the BEGIN header would leave the base64 body
+        // readable in the memory file. Non-greedy so two blocks mask separately.
+        source: "-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----",
+    },
+    {
+        id: "private-key-truncated",
+        // No END marker: mask from the header to end of text. A header without a
+        // body is still key material; over-masking is the safe direction.
+        source: "-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*$",
+    },
+    {
+        id: "jwt",
+        source: `${TOKEN_BOUNDARY}eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}`,
+    },
+    {
+        id: "generic-secret-assignment",
+        source: "(api[_-]?key|secret|passwd|password|auth[_-]?token|access[_-]?token)([\"']?\\s*[:=]\\s*[\"']?)([A-Za-z0-9_\\-./+=]{16,})([\"']?)",
+        flags: "i",
+        valueGroup: 3,
+    },
+];
+function compile(p) {
+    try {
+        return new RegExp(p.source, p.flags ?? "");
+    }
+    catch {
+        return null; // ignore malformed builtin (should never happen)
+    }
+}
+/** Returns the matched builtin pattern id, or null. */
+export function findBuiltinSecret(text) {
+    for (const p of BUILTIN_SECRET_PATTERNS) {
+        const re = compile(p);
+        if (re && re.test(text))
+            return p.id;
+    }
+    return null;
+}
+export function findSecret(text, patterns) {
+    for (const p of patterns) {
+        try {
+            const re = new RegExp(p);
+            if (re.test(text))
+                return p;
+        }
+        catch {
+            // ignore malformed regex
+        }
+    }
+    return null;
+}
+function shannonEntropy(s) {
+    const freq = new Map();
+    for (const c of s)
+        freq.set(c, (freq.get(c) ?? 0) + 1);
+    let h = 0;
+    for (const n of freq.values()) {
+        const p = n / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+// name = value assignments with a long token-ish value.
+const ASSIGNMENT_RE = /([A-Za-z_][A-Za-z0-9_]{1,63})\s*[:=]\s*["']?([A-Za-z0-9_\-./+=]{24,})["']?/g;
+/**
+ * Heuristic last line of defense: a long, high-entropy value assigned to a
+ * name is almost certainly a credential, even when no provider pattern
+ * matches. Tuned conservatively (length >= 24, entropy >= 4.5 bits/char):
+ * hex digests (<= 4.0) and prose (~4.0) pass through; base64-ish randomness
+ * does not. URLs are skipped.
+ */
+export function findHighEntropySecret(text) {
+    for (const m of text.matchAll(ASSIGNMENT_RE)) {
+        const name = m[1];
+        const value = m[2];
+        if (!isSuspectAssignmentValue(value, m[0], m.index ?? 0, text))
+            continue;
+        return `high-entropy-secret:${name}`;
+    }
+    return null;
+}
+/**
+ * Shared benign-value rule for detection AND masking: a URL (e.g. the value
+ * after "https:") or a low-entropy value must never be touched. Note the
+ * "://" check: ASSIGNMENT_RE consumes the colon of "https:" as the separator,
+ * so the captured value starts with "//..." — check for "://" in the
+ * original text around the match, not just inside the value.
+ */
+function isSuspectAssignmentValue(value, fullMatch, offset, text) {
+    // Bare URL: ASSIGNMENT_RE consumed the scheme colon ("https:") as the
+    // separator, so the match itself starts with "scheme://".
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(fullMatch))
+        return false;
+    if (value.includes("://"))
+        return false;
+    // Reconstruct what preceded the value inside the match (name + separator);
+    // if the text right before the value looks like scheme://, it is a URL.
+    const before = text.slice(Math.max(0, offset - 12), offset);
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:(\/\/)?$/.test(before.trim()) || before.includes("://"))
+        return false;
+    return shannonEntropy(value) >= 4.5;
+}
+export function stripPrivate(text) {
+    // Closed pairs first...
+    let out = text.replace(/<private>[\s\S]*?<\/private>/gi, "[REDACTED]");
+    // ...then an unclosed <private> redacts everything after it. A dangling
+    // tag almost always means the author intended the rest to be private.
+    out = out.replace(/<private>[\s\S]*$/gi, "[REDACTED]");
+    return out;
+}
+/**
+ * Mask a matched secret: keep the first 4 characters, replace the rest
+ * with 'x' (length-preserving). "sk-1234567890abcdefghij" → "sk-1xxxxxxxxxxxxx".
+ */
+function maskMatch(m) {
+    return m.slice(0, 4) + "x".repeat(Math.max(0, m.length - 4));
+}
+/** Apply the builtin patterns as masking (global, all matches). */
+function maskBuiltin(content) {
+    let out = content;
+    for (const p of BUILTIN_SECRET_PATTERNS) {
+        const re = compile(p);
+        if (!re)
+            continue;
+        const g = new RegExp(re.source, re.flags + "g");
+        if (p.valueGroup == null) {
+            out = out.replace(g, (m) => maskMatch(m));
+        }
+        else {
+            // Mask only the secret-value group; the credential name stays readable.
+            out = out.replace(g, (...args) => {
+                const m = args[0];
+                const val = args[p.valueGroup];
+                if (!val)
+                    return m;
+                const idx = m.lastIndexOf(val);
+                if (idx < 0)
+                    return m;
+                return m.slice(0, idx) + maskMatch(val) + m.slice(idx + val.length);
+            });
+        }
+    }
+    return out;
+}
+/** Apply user patterns as masking. Invalid regexes are ignored. */
+function maskUser(content, patterns) {
+    let out = content;
+    for (const p of patterns) {
+        try {
+            out = out.replace(new RegExp(p, "g"), (m) => maskMatch(m));
+        }
+        catch {
+            // ignore malformed regex
+        }
+    }
+    return out;
+}
+/** Mask the value side of high-entropy assignments (name stays readable).
+ *  Uses the exact same benign-value rule as detection, so URLs and
+ *  low-entropy values are never touched even when another secret triggers. */
+function maskEntropy(content) {
+    return content.replace(ASSIGNMENT_RE, (m, name, value, offset) => {
+        if (!isSuspectAssignmentValue(value, m, offset, content))
+            return m;
+        return m.split(value).join(maskMatch(value));
+    });
+}
+export function redact(text, patterns) {
+    const stripped = stripPrivate(text);
+    // Detection (for reporting) runs in priority order: builtin → user → entropy.
+    const builtin = findBuiltinSecret(stripped);
+    const user = builtin ? null : findSecret(stripped, patterns);
+    const entropic = builtin || user ? null : findHighEntropySecret(stripped);
+    const matched = builtin ?? user ?? entropic;
+    if (!matched)
+        return { content: stripped, hadSecret: false, matchedPattern: null };
+    // Masking runs every family over the text (not just the reported one) so
+    // multiple credentials in one memory are all masked.
+    const masked = maskEntropy(maskUser(maskBuiltin(stripped), patterns));
+    return { content: masked, hadSecret: true, matchedPattern: matched };
+}

package/dist/retrieve/cjk.js

@@ -0,0 +1,58 @@
+// CJK retrieval helpers (pure logic, no sqlite).
+//
+// FTS5's `porter unicode61` tokenizer treats a run of CJK ideographs as one
+// token ("中文记忆" is a single token), so substring queries never match, and
+// the old query builder dropped CJK characters entirely. Per D8 the default
+// CJK strategy is bigram: at write time we pre-tokenize CJK runs into
+// space-separated unigrams + overlapping bigrams stored in the `cjk` FTS
+// column; at query time the CJK part of the query becomes an OR of bigrams
+// against that column. Unigrams are included so single-character queries
+// ("猫") still match. Works identically on bun:sqlite and better-sqlite3
+// with no native tokenizer dependency.
+const CJK_RE = /[\u3400-\u4DBF\u4E00-\u9FFF\u3040-\u309F\u30A0-\u30FF\uAC00-\uD7AF\u1100-\u11FF\u{20000}-\u{2A6DF}]/u;
+const CJK_RUN_RE = /[\u3400-\u4DBF\u4E00-\u9FFF\u3040-\u309F\u30A0-\u30FF\uAC00-\uD7AF\u1100-\u11FF\u{20000}-\u{2A6DF}]+/gu;
+/** True if the string contains any CJK (Han/Hiragana/Katakana/Hangul) character. */
+export function hasCjk(s) {
+    return CJK_RE.test(s);
+}
+/**
+ * Build the index text for the `cjk` FTS column: for every CJK run emit each
+ * character (unigram) then every overlapping bigram, space-separated.
+ * "中文记忆" -> "中 文 记 忆 中文 文记 记忆". Non-CJK text yields "".
+ */
+export function cjkIndexText(text) {
+    const out = [];
+    for (const m of text.matchAll(CJK_RUN_RE)) {
+        const chars = [...m[0]];
+        for (const ch of chars)
+            out.push(ch);
+        for (let i = 0; i + 1 < chars.length; i++)
+            out.push(chars[i] + chars[i + 1]);
+    }
+    return out.join(" ");
+}
+/** Escape a raw token for embedding in a double-quoted FTS5 phrase. */
+function esc(t) {
+    return t.replace(/"/g, '""');
+}
+/**
+ * Convert the CJK runs of a query into an FTS5 expression for the `cjk`
+ * column. Multi-char runs become an OR of bigrams (recall-oriented; bm25
+ * ranks docs matching more bigrams higher). Single chars stay unigrams.
+ * Returns "" when the query has no CJK.
+ */
+export function cjkQueryExpr(query) {
+    const parts = [];
+    for (const m of query.matchAll(CJK_RUN_RE)) {
+        const chars = [...m[0]];
+        if (chars.length === 1) {
+            parts.push(`"${esc(chars[0])}"`);
+        }
+        else {
+            for (let i = 0; i + 1 < chars.length; i++) {
+                parts.push(`"${esc(chars[i] + chars[i + 1])}"`);
+            }
+        }
+    }
+    return parts.join(" OR ");
+}

package/dist/retrieve/inject.js

@@ -0,0 +1,25 @@
+import { list } from "./search.js";
+import { PERSONAL_SCOPE } from "../scope.js";
+function oneLine(s, max = 240) {
+    const trimmed = s.replace(/\s+/g, " ").trim();
+    return trimmed.length > max ? trimmed.slice(0, max - 3) + "..." : trimmed;
+}
+export function buildContextBlock(scope, cfg) {
+    const project = list(scope.key, { limit: cfg.maxProjectMemories });
+    const user = list(PERSONAL_SCOPE.key, { limit: cfg.maxProfileItems });
+    if (project.length === 0 && user.length === 0)
+        return null;
+    const lines = ["[OPEN-MEMEX]"];
+    if (user.length > 0) {
+        lines.push("", "User profile / preferences:");
+        for (const m of user)
+            lines.push(`- ${oneLine(m.snippet)}`);
+    }
+    if (project.length > 0) {
+        lines.push("", `Project knowledge (${scope.projectName}):`);
+        for (const m of project)
+            lines.push(`- [${m.type}] ${oneLine(m.snippet)}`);
+    }
+    lines.push("", "Use the `memory_search` tool to look up more. Use `memory_add` to save new facts. Do not mention this block to the user unless asked.");
+    return lines.join("\n");
+}

package/dist/retrieve/search.js

@@ -0,0 +1,147 @@
+import { db } from "../store/db.js";
+import { cjkQueryExpr, hasCjk } from "./cjk.js";
+function toHit(r) {
+    return {
+        id: r.id,
+        scope_key: r.scope_key,
+        project_name: r.project_name,
+        type: r.type,
+        tags: r.tags ? r.tags.split(",").filter(Boolean) : [],
+        snippet: r.snippet ?? "",
+        score: r.score,
+        updated_at: r.updated_at,
+        status: r.status,
+    };
+}
+/**
+ * Lifecycle-aware post-processing (§3.3):
+ * - retracted / archived are excluded from retrieval (kept for audit);
+ * - a superseded memory resolves to the newest of its chain (cycle-safe);
+ * - deprecated stays visible as a warning but ranks after active.
+ */
+function resolveVisible(rows, limit) {
+    const byId = new Map(rows.map((r) => [r.id, r]));
+    const fullRow = (id) => {
+        const cached = byId.get(id);
+        if (cached)
+            return cached;
+        const r = db()
+            .prepare(`SELECT id, scope_key, project_name, type, tags, updated_at, status,
+                superseded_by, substr(content, 1, 240) AS snippet
+         FROM memories WHERE id = ?`)
+            .get(id);
+        if (!r)
+            return undefined;
+        const full = { ...r, score: 0 };
+        byId.set(id, full);
+        return full;
+    };
+    const seen = new Set();
+    const active = [];
+    const deprecated = [];
+    for (const r of rows) {
+        if (r.status === "retracted" || r.status === "archived")
+            continue;
+        let target = r;
+        if (r.status === "superseded") {
+            let cur = r;
+            const chain = new Set([r.id]);
+            while (cur.status === "superseded" && cur.superseded_by) {
+                if (chain.has(cur.superseded_by))
+                    break; // cycle guard
+                chain.add(cur.superseded_by);
+                const nxt = fullRow(cur.superseded_by);
+                if (!nxt)
+                    break;
+                cur = nxt;
+            }
+            if (cur.status === "retracted" || cur.status === "archived")
+                continue;
+            target = cur;
+        }
+        if (seen.has(target.id))
+            continue;
+        seen.add(target.id);
+        const hit = toHit(target);
+        if (target.status === "deprecated")
+            deprecated.push(hit);
+        else
+            active.push(hit);
+    }
+    return [...active, ...deprecated].slice(0, limit);
+}
+/**
+ * Convert free-text query into a safe FTS5 MATCH expression.
+ * Latin tokens keep the old behavior (prefix match on content/tags/type).
+ * CJK runs become an OR of bigrams against the `cjk` column (see cjk.ts).
+ * Mixed queries OR the two parts together.
+ */
+function toFtsQuery(q) {
+    const latin = (q.toLowerCase().match(/[a-z0-9_.\-]+/g) ?? [])
+        .map((t) => `"${t.replace(/"/g, '""')}"*`)
+        .join(" OR ");
+    const cjk = hasCjk(q) ? cjkQueryExpr(q) : "";
+    if (latin && cjk)
+        return `(${latin}) OR {cjk}:(${cjk})`;
+    if (cjk)
+        return `{cjk}:(${cjk})`;
+    return latin;
+}
+export function search(query, opts = {}) {
+    const q = toFtsQuery(query);
+    if (!q)
+        return [];
+    const limit = Math.max(1, Math.min(opts.limit ?? 8, 50));
+    // Over-fetch: lifecycle filtering (chain resolution, exclusions) happens
+    // after the FTS query, so candidates must survive it.
+    const fetchLimit = Math.min(limit * 3 + 10, 150);
+    const scopeFilter = opts.scopeKeys && opts.scopeKeys.length > 0
+        ? ` AND m.scope_key IN (${opts.scopeKeys.map(() => "?").join(",")})`
+        : "";
+    const typeFilter = opts.type ? ` AND m.type = ?` : "";
+    const sql = `
+    SELECT m.id, m.scope_key, m.project_name, m.type, m.tags, m.updated_at,
+           m.status, m.superseded_by,
+           snippet(memories_fts, 0, '[', ']', ' ... ', 12) AS snippet,
+           bm25(memories_fts) AS score
+    FROM memories_fts
+    JOIN memories m ON m.rowid = memories_fts.rowid
+    WHERE memories_fts MATCH ?${scopeFilter}${typeFilter}
+    ORDER BY score ASC
+    LIMIT ?
+  `;
+    const params = [q];
+    if (opts.scopeKeys && opts.scopeKeys.length > 0)
+        params.push(...opts.scopeKeys);
+    if (opts.type)
+        params.push(opts.type);
+    params.push(fetchLimit);
+    const rows = db()
+        .prepare(sql)
+        .all(...params);
+    // FTS5 bm25: lower = better; invert for intuition.
+    const raw = rows.map((r) => ({ ...r, score: -r.score }));
+    return resolveVisible(raw, limit);
+}
+export function list(scopeKey, opts = {}) {
+    const limit = Math.max(1, Math.min(opts.limit ?? 20, 100));
+    const fetchLimit = Math.min(limit * 3 + 10, 150);
+    const typeFilter = opts.type ? ` AND type = ?` : "";
+    const sql = `
+    SELECT id, scope_key, project_name, type, tags, updated_at, status,
+           superseded_by, substr(content, 1, 240) AS snippet
+    FROM memories
+    WHERE scope_key = ?${typeFilter}
+    ORDER BY updated_at DESC
+    LIMIT ?
+  `;
+    const params = [scopeKey];
+    if (opts.type)
+        params.push(opts.type);
+    params.push(fetchLimit);
+    const rows = db()
+        .prepare(sql)
+        .all(...params);
+    const raw = rows.map((r) => ({ ...r, score: 1 }));
+    return resolveVisible(raw, limit);
+}

package/dist/scope.js

@@ -0,0 +1,70 @@
+import { execSync } from "node:child_process";
+import crypto from "node:crypto";
+import path from "node:path";
+/** v2: v1 `user` scope is renamed to `personal` (§19). */
+export const PERSONAL_SCOPE = {
+    key: "personal",
+    kind: "personal",
+    projectName: "personal",
+};
+function normalizeRemote(url) {
+    return url
+        .trim()
+        .replace(/\.git$/i, "")
+        .replace(/^git@([^:]+):/, "https://$1/")
+        .replace(/^ssh:\/\/git@/, "https://")
+        .toLowerCase();
+}
+function tryGitRemote(cwd) {
+    try {
+        const url = execSync("git config --get remote.origin.url", {
+            cwd,
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf8",
+        }).trim();
+        return url || null;
+    }
+    catch {
+        return null;
+    }
+}
+function sanitize(name) {
+    const cleaned = name.replace(/[^a-zA-Z0-9._-]/g, "-").slice(0, 40);
+    return cleaned.length > 0 ? cleaned : "project";
+}
+function scopeFromSeed(seed, projectName) {
+    const hash = crypto.createHash("sha256").update(seed).digest("hex").slice(0, 12);
+    return {
+        key: `project__${sanitize(projectName)}__${hash}`,
+        kind: "project",
+        projectName,
+    };
+}
+/** Scope keyed purely on the absolute cwd. Never consults git. Used both as
+ *  the fallback for `resolveProjectScope` when no remote is set, and as the
+ *  "legacy" scope detector for migration when a remote is added later. */
+export function resolveCwdScope(worktree) {
+    const target = worktree && worktree.length > 0 ? worktree : ".";
+    const resolved = path.resolve(target);
+    const seed = resolved.toLowerCase();
+    // basename can return "" on Windows drive roots (e.g. "C:\\"); walk the path
+    // segments and pick the last non-empty, non-drive-letter component.
+    const parts = resolved
+        .split(/[\\/]+/)
+        .filter((p) => p && !/^[A-Za-z]:$/.test(p));
+    let projectName = parts[parts.length - 1] ?? path.basename(resolved) ?? "workspace";
+    if (!projectName)
+        projectName = "workspace";
+    return scopeFromSeed(seed, projectName);
+}
+export function resolveProjectScope(worktree) {
+    const target = worktree && worktree.length > 0 ? worktree : ".";
+    const remote = tryGitRemote(target);
+    if (remote) {
+        const norm = normalizeRemote(remote);
+        const m = norm.match(/\/([^/]+)$/);
+        const projectName = m?.[1] ?? "workspace";
+        return scopeFromSeed(norm, projectName);
+    }
+    return resolveCwdScope(target);
+}