Defer bundle writes until all validations pass

[exo-nikita]

Summary

Refactor the stasis add command to defer all file writes until after validating the entire input set. This ensures that if validation fails, the project remains untouched rather than left in a partially-updated state. Additionally, implement auto-exclusion filtering for directory sweeps to prevent unintended capture of type declarations, secrets, and stasis's own outputs.

Key Changes

• Deferred writes: Rename addToBundleFile → prepareBundleFile and updateLockfile → prepareLockfile to return write thunks instead of executing immediately. All merges are computed first, then writes execute only after all validations pass.

• Four-step pipeline: Restructure addCommand into distinct phases:

  1. GLOB: Expand directories into files using fs.globSync, tracking which paths were swept vs. explicitly named
  2. FILTER: Drop auto-excluded files from swept results (but not explicitly named ones)
  3. VALIDATE: Check entire set for missing files, undeclared types, and non-UTF-8 content before touching any target
  4. ADD: Compute all merges, then execute writes

• Auto-exclusion rules: New isAutoExcludedFile() function filters out:

  • Type declarations (.d.ts, .d.mts, .d.cts)
  • Secrets files (.env, .env.*, *.env)
  • Stasis artifacts (stasis.lock.json, *.stasis.*.br)
  • Generated sidecars (*.map, *.js.flow) unless opted into via resources config

• Improved error reporting: Collect all validation failures (missing files, undeclared types, non-UTF-8 content) into a single error message rather than failing on the first offender. Directory sweeps that match only auto-excluded files report what was filtered.

• Explicit override: Files named explicitly on the command line bypass the auto-exclusion filter, allowing stasis add .env to work even though .env is auto-excluded from stasis add .

• Repeatable operations: stasis add . now never attests the bundle or lockfile it's writing, making the operation idempotent across runs.

Notable Implementation Details

• expandDirectories() now returns a Map<rel, { swept, stats }> to distinguish between explicitly named paths and those found by glob expansion
• validateFiles() collects errors across the entire set before throwing, enabling comprehensive error messages
• Configured bundle targets are tracked in a Set to prevent self-reference during sweeps
• The glob step reuses filesystem stats to avoid re-probing the same inodes during validation

https://claude.ai/code/session_01KrgpYdYarjgv8ur9kpBpia