1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
//! Command handler modules for the `tm` binary.
//!
//! Why: splitting each subcommand group into its own file keeps every handler
//! file well under the 500-line cap and makes the handler surface easy to
//! navigate.
//! What: re-exports handler modules — `auth`, `compress`, `daemon`,
//! `hook_rewrite`, `install`, `launch`, `managed`, `managed_route`, `meta`,
//! `misc`, `project`, `services`, `session`, `slack`, `supervisor`, `telegram`.
//! Three client-side `tm doctor` probes also live here rather than in the daemon's
//! `run_doctor`, because each needs state the responding daemon cannot report on
//! itself: `doctor_stale` (this binary's own `CARGO_PKG_VERSION`, #2332) and
//! `doctor_orphan` (whether launchd owns the process that answered, #4230), and
//! `doctor_daemon_row` (whether a daemon answered at all, #6336).
//! Test: each module has its own unit tests; integration coverage lives in
//! `tests.rs`.
// #6497: `tm session adopt-worktree` — the explicit ownership transfer for a
// tree whose owning session or agent is provably dead.
pub(crate) mod adopt_worktree;
pub(crate) mod agent;
pub(crate) mod auth;
// #6274: `tm` in a plain directory initializes a repository there instead of
// refusing; both the guided default and `tm launch` call it before detection.
pub(crate) mod auto_git_init;
pub(crate) mod banner;
pub(crate) mod commit_trailers;
pub(crate) mod compress;
pub(crate) mod daemon;
pub(crate) mod delete;
// #6887: the bulk-read diversion hook and its cheap worker.
pub(crate) mod divert;
pub(crate) mod divert_check;
pub(crate) mod divert_worker;
// #4230: the client-side orphan-daemon check — the daemon's own `run_doctor`
// cannot detect that the process answering it is the unsupervised one.
// #6892: the machine-wide builder-slot row — holders, the cap, and a Warn
// for a lease only the TTL could have ended.
pub(crate) mod doctor_builder_cap;
// #6336: the standalone `tm doctor` — the battery runs in-process and the
// daemon is one appended reachability row, never a precondition.
pub(crate) mod doctor_daemon_row;
// #6649: `--fix-agents`, the agent mirror of `--fix-skills`.
pub(crate) mod doctor_fix_agents;
// #8236: `--fix-launchd-secrets`, the credential strip without the other repairs.
pub(crate) mod doctor_fix_launchd_secrets;
pub(crate) mod doctor_fix_skills;
pub(crate) mod doctor_local;
pub(crate) mod doctor_orphan;
// #4948: the `tm doctor --fix` driver — dry-run by default, `--yes` to write.
pub(crate) mod doctor_repair;
pub(crate) mod doctor_stale;
pub(crate) mod first_run;
pub(crate) mod generate;
// #6483: `tm gui` — split out of main.rs when the TUI view routing pushed that
// file past the 500-SLOC cap.
pub(crate) mod gui;
pub(crate) mod guided;
pub(crate) mod guided_autostart;
pub(crate) mod guided_inplace;
pub(crate) mod guided_launch;
pub(crate) mod guided_outside_git;
pub(crate) mod guided_protected;
pub(crate) mod guided_resolver;
pub(crate) mod guided_resume;
pub(crate) mod hook_payload;
// #6556: the retry-plus-log delivery, and the disk park, of the SubagentStop POST.
pub(crate) mod hook_post;
pub(crate) mod hook_rewrite;
// #7975: the stdin payload read that names its failure, so a guard can deny on it.
pub(crate) mod hook_stdin;
pub(crate) mod hooks;
pub(crate) mod install;
// #4605: the unmanaged-bundled-skill reporter and `--reconcile-skills` path,
// split out of `install` for the 500-SLOC production cap.
pub(crate) mod install_skills;
pub(crate) mod issue;
pub(crate) mod launch;
pub(crate) mod launchd_probe;
pub(crate) mod managed;
// #2919: merged-PR reclaim-pass rendering, split out of `managed` for the cap.
pub(crate) mod managed_merged_prs;
/// The `tm ls` table renderer, split out of `managed` for the SLOC cap.
pub(crate) mod managed_render;
pub(crate) mod managed_root;
pub(crate) mod managed_route;
pub(crate) mod managed_workspace;
pub(crate) mod manager;
pub(crate) mod mcp;
pub(crate) mod memory;
// #7685: `tm memory import-auto-memory`, in its own file beside the dispatcher.
pub(crate) mod memory_auto_import;
// #8352: `tm memory recall|remember|note` — the no-MCP palace verbs, in their
// own file so the dispatcher stays a translation layer and stays under cap.
pub(crate) mod memory_verbs;
pub(crate) mod meta;
pub(crate) mod misc;
// #6276: the one decision about a repository's origin remote — a local-only
// repository proceeds to a session in its own checkout instead of refusing.
pub(crate) mod origin_plan;
pub(crate) mod pane_identity;
pub(crate) mod picker_delete;
pub(crate) mod picker_delete_glob;
pub(crate) mod picker_launch_new;
// #7688: the `tm prompt-feedback` read-back and the capture hook behind it.
pub(crate) mod prompt_feedback_cli;
pub(crate) mod prompt_feedback_hook;
pub(crate) mod pm_guard;
pub(crate) mod pm_guard_bash;
pub(crate) mod pm_guard_budget;
// #6892: the machine-wide concurrent-builder denial. Fails CLOSED, unlike its
// #4480 sibling — see its module doc.
pub(crate) mod pm_guard_builder_cap;
pub(crate) mod pm_guard_cost;
pub(crate) mod pm_guard_deny_by_default;
pub(crate) mod pm_guard_dispatch;
pub(crate) mod pm_guard_dispatch_deny;
// #8257: `tm repair delegation --list`.
pub(crate) mod repair_delegation_list;
// #7172: a worktree-pinned agent's `EnterWorktree` switch, refused rather than
// left to succeed and wedge the agent — see its module doc for why the pin it
// names belongs to the harness and cannot be moved from here.
// #8547: which `subagent_type` names are known, and the refusal for the rest.
pub(crate) mod pm_guard_dispatch_type;
pub(crate) mod pm_guard_enter_worktree;
pub(crate) mod pm_guard_fanout;
pub(crate) mod pm_guard_response;
pub(crate) mod pm_guard_routing;
// #7266: a line-range or partial READ of a secret-bearing file, refused for
// every caller — the sibling `pm_guard_bash::secret_file_copy` screens only a
// `cp`/`mv` of one, so nothing stopped `sed -n '38,46p' terraform.tfvars`.
pub(crate) mod pm_guard_secret_read;
// #7414: the "which words of this text could be a path?" layer, split out of
// `pm_guard_secret_read` when the brace-literal fix pushed it over the cap.
pub(crate) mod pm_guard_secret_words;
pub(crate) mod pm_guard_worktree_grant;
pub(crate) mod pm_guard_write_boundary;
// #6653: `tm pr` — the deterministic PR-open and merge-queue gates.
pub(crate) mod pr;
pub(crate) mod project;
pub(crate) mod projects;
pub(crate) mod prune;
pub(crate) mod push_guard;
pub(crate) mod reconcile_worktrees;
// #4912: `tm register` positional resolution — URL first, alias optional, with
// the legacy alias-first order still accepted.
pub(crate) mod register_args;
pub(crate) mod reinstall;
pub(crate) mod rename;
pub(crate) mod repair;
// #7569: `tm repair savings-ledger` — quarantine the ledger rows #7514 let
// unit tests append to the operator's own savings ledger.
pub(crate) mod repair_savings_ledger;
// #5007: `tm repair session-store` — back up and truncate a corrupt
// `sessions.json` so a wedged store no longer needs a human editing JSON.
pub(crate) mod repair_session_store;
pub(crate) mod run_target;
pub(crate) mod serve_stdio;
pub(crate) mod services;
pub(crate) mod sessctl;
pub(crate) mod session;
// #7313: `tm session disk` — the shell view of the per-session disk
// attribution slice 1 added to the `disk_survey` tool.
pub(crate) mod session_disk;
pub(crate) mod session_ls_connector;
pub(crate) mod session_picker;
pub(crate) mod session_picker_filter;
pub(crate) mod session_picker_order;
pub(crate) mod session_picker_prune;
pub(crate) mod session_picker_rename;
pub(crate) mod session_picker_render;
pub(crate) mod session_picker_view;
pub(crate) mod session_tui;
// The `tm shell-init` wrapper emitter — print-only; it never writes an rc file.
pub(crate) mod shell_init;
pub(crate) mod slack;
pub(crate) mod sm_serve;
pub(crate) mod spawn_disclaimed;
pub(crate) mod standalone;
// #8025: `tm status`'s daemon line, derived from the SAME `/health` probe
// `tm doctor` uses — see its module doc for why the two disagreed.
pub(crate) mod status_daemon;
pub(crate) mod statusline;
pub(crate) mod supervisor;
pub(crate) mod sync_assets;
pub(crate) mod telegram;
pub(crate) mod ticket;
pub(crate) mod tmux_attach;
// #5843: the condition-poll wait primitive that replaces backgrounding.
pub(crate) mod wait;
pub(crate) mod watch;