feat: delete CoDev-authored configs on restore, gated on authorship#202
Merged
Merged
Conversation
`restoreKind`'s no-backup branch left every live config in place (`kept-live`), so a fresh install — where CoDev wrote the config and there was nothing to back up — left its own config behind after `codevhub remove`, pointing at a deleted ~/.codev-hub. This deletes those files, but only when we can show they're ours. #196 moved this the other way (delete -> keep) because "deleting a config we can't prove predated CoDev is destructive". That objection was right: the code it removed deleted unconditionally, on the theory that a file with no backup must be CoDev-authored. That theory is false, because restore *consumes* the backup (renameSync) — "no backup + live file" also describes a second restore whose live file is the pristine original the first run just reinstated, and a hand-written config for a tool CoDev never configured (both `remove` and the bare `restore` sweep visit every tool). Rather than revert #196, this proves authorship instead of assuming it. - `configure.ts`: add `deleted` to RestoreStatus and gate the no-backup branch on a new `isCodevAuthored(kind)`, which dispatches to the per-kind marker detectors `codevhub model` already uses. Each returns false for a missing or unparseable file, so anything unattributable stays `kept-live`. - The two Claude auth files have no marker key: `claude-json` is matched by whole-file shape (`isCodevClaudeJsonStub` — exactly the `{hasCompletedOnboarding: true}` stub resetClaudeAuth writes, so a file with real projects/history survives), and `claude-credentials` is always ours since CoDev never writes it, only removes it. No cross-kind inference: settings.json restores first and would erase its own marker, making results order-dependent. - `restore.ts`: report deletes, count them as action in the sweep (a delete-only sweep would otherwise exit 1 with "No backups found"), and add a `never` default — that switch returns void, so a missing case printed nothing instead of failing to compile. - `remove.ts` / `RemoveApp`: report deletes in the aggregated step, and reword the kept-files hint. "Delete manually for a clean state" is now wrong advice: a file is kept precisely because it's the user's, not CoDev's. - Tests: every "keeps the live CoDev config" test seeded fake marker content no detector recognizes, so all of them would still pass while silently testing the user-authored branch. Split each into a CoDev case and a user case, with CoDev fixtures built by the real writers so the gate and writers can't drift. Adds coverage for restore-twice and never-configured-tool. - AGENTS.md: document the four states and the gate; correct two stale claims in the same section (runRestore's exit code, the missing `continue` alias). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
`codevhub restore [agent] --force` and `codevhub remove --force` delete a
backup-less live config whoever wrote it, skipping the authorship check that
normally preserves the user's own files. Deliberately absent from help.ts, the
README, and all UI copy — an escape hatch discoverable only from source, and
nothing invokes it on the user's behalf.
Scope is the gate only. A `*.backup` still wins and is still restored: that file
is the user's pre-CoDev original and reinstating it is the point of the command,
so force has no business overriding it.
- `force = false` threads through restoreKind / restoreTool / runRestore /
runRestoreAll / runRemove / RemoveApp. Long form only — no `-f` alias, so the
reflex `-f` from `upload`/`login` can't unconditionally delete configs.
- `restore` now finds its agent arg with `.find(a => !a.startsWith("-"))`;
`args[0]` would have read `--force` as the agent name and errored on the sweep.
- Reporting stays honest: restoreKind evaluates isCodevAuthored even when
forcing and sets `RestoreResult.forced = !authored`. The default delete message
asserts "CoDev wrote it", which is a false claim about a user's own file, so
forced deletes get their own wording. remove counts them separately
(`deleted 2 files (no backup, 1 forced)`) and the NDJSON log carries `forced`.
- Fixes a latent bug in restoreTool: `CLAUDE_RESTORE_KINDS.map(restoreKind)`
passes the array index into `force`, so .claude.json and .credentials.json
(indices 1 and 2) would be force-deleted on every run. Now
`.map((kind) => restoreKind(kind, force))`, pinned by a regression test that
was confirmed to fail against the old form.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
restoreKind's no-backup branch left every live config in place (kept-live). So a fresh install — where CoDev wrote the config and there was nothing to back up — left its own config behind aftercodevhub remove, still pointing at a now-deleted~/.codev-hub, with the user told to clean it up by hand.This deletes those files, but only when we can actually show they're ours.
Relationship to #196
#196 moved this in the opposite direction (delete → keep), on the grounds that "deleting a config we can't prove predated CoDev is destructive." That objection was correct, and this PR doesn't revert it.
The code #196 removed deleted unconditionally, on the stated theory that "a file present without a backup must be CoDev-authored." That theory is false, because restore consumes the backup (
renameSync). "No backup + live file" equally describes:removeand the barerestoresweep visit every tool.Cases 2 and 3 are real data-loss paths, and they're why #196 was right to stop the bleeding. This PR proves authorship instead of assuming it, so case 1 is deleted and 2/3 are still kept.
How
The gate is
isCodevAuthored(kind), which dispatches to the per-kind marker detectorscodevhub modelalready uses — no new parsing logic. Each returnsfalsefor a missing or unparseable file, so anything unattributable stayskept-live.The two Claude auth files have no marker key of their own:
~/.claude.json— matched by whole-file shape: exactly the{hasCompletedOnboarding: true}stubresetClaudeAuthwrites. A file carrying real projects/history/mcpServers survives.~/.claude/.credentials.json— always ours, since CoDev never writes this file, only removes it; a live one can only postdate CoDev. Accepted trade-off: someone who never configured Claude via CoDev gets logged out. Recoverable by re-authenticating, no data lost.No cross-kind inference (e.g. reading
settings.jsonto decide the credentials' fate) —settings.jsonrestores first and erases its own marker, which would make results order-dependent.Notes for review
Two things worth a look beyond the core diff:
The tests would have lied. Every test named "keeps the live CoDev config when no backup exists" seeded fake content (
'{"marker":"codev-live"}') that no real detector recognizes. Under marker-gating they all still pass — while silently exercising the user-authored branch their names claim not to cover. Each is split into a CoDev case and a user case, with CoDev fixtures built by calling the real writers (configureClaudeCode,configureCodex, …) so the gate and the writers can't drift apart. New coverage for restore-twice and never-configured-tool.One hint had to be reworded, not tweaked.
RemoveApp's "Delete manually for a clean state" becomes actively wrong advice: a file is now kept precisely because it's the user's own.Also corrects two stale claims in the same AGENTS.md section (
runRestore's exit code, and the missingcontinuealias).Verification
dist/index.jswas also driven against a scratchHOME:🤖 Generated with Claude Code