项目真源侦探｜接手不走错目录

Determine what the project is, which copy is authoritative, and what is actually running before recommending any continuation point.

Keep four layers separate

Never collapse these into one claim:

1. Physical directory: a folder that exists.
2. Project identity: the product or codebase that folder represents.
3. Repository lineage: Git root, remote, branch, HEAD, worktree, clone, archive, or extracted ZIP relationship.
4. Live surface: the process, listener, build output, deployed URL, or app currently serving users.

downloaded, copied, enabled, running, deployed, and continued from are different states.

Safety boundary

• Start read-only. Do not modify files or Git state.
• Do not read or print .env, tokens, cookies, keychains, private databases, session stores, or user data.
• Do not run git pull, checkout, reset, clean, install commands, process restarts, or deployment actions.
• Restrict discovery to the explicit target and the smallest relevant parent or sibling set. Do not recursively scan a home directory or disk by default.
• Preserve dirty worktrees and unknown files. Report them; do not clean them.

Audit sequence

1. Resolve the exact target path and scope. If the user names several similar copies, keep them separate until evidence proves a relationship.
2. Read authority files in order when present: current user instruction, SOURCE_OF_TRUTH.md, recent status or handoff, AGENTS.md, README, package metadata, then code and runtime evidence. If root markers do not settle the question, search only likely documentation locations inside the target for focused names such as handoff, status, target-install, source, or deploy; do not crawl unrelated trees.
3. Run the bundled read-only snapshot:

python3 scripts/inspect_project.py /absolute/path/to/project

4. Verify Git lineage with root, remotes, branch, HEAD, upstream, shallow state, worktrees, submodules, and dirty status. A matching name is not proof of shared lineage.
5. Identify source/build/deploy boundaries. Treat dist, build, out, exported static pages, archives, and generated folders as outputs unless current evidence proves otherwise.
6. If runtime matters, inspect the listener and its process command line. Match the actual executable arguments and working/source path to a candidate directory; do not infer from the browser URL alone.
7. Compare suspected duplicates using remote URL, commit ancestry, project markers, recent timestamps, and small targeted hashes. Do not compare entire disks.
8. Classify each claim as verified, inferred, conflicting, or unknown.
9. Classify each candidate directory as authoritative source, active feature worktree, clone, copied snapshot, generated output, archive, or unknown. Use copied snapshot only when targeted content evidence or explicit source-to-target documentation establishes the direction.

Read references/evidence-matrix.md when multiple copies, worktrees, builds, or live processes are involved. Read references/report-template.md before answering.

Decision rules

• Prefer explicit current authority documents and current runtime evidence over README prose or an old cached page.
• A directory inside a Git repo is not automatically the repo root.
• A worktree is part of one repository lineage, not a new project identity by itself.
• An extracted ZIP or old clone is a separate physical copy until history and remotes prove lineage.
• A clean worktree does not prove it is current; compare HEAD and remote only when network access is authorized and necessary.
• A local remote-tracking ref such as origin/main proves only the last fetched state. Say live remote verified only after an authorized network refresh.
• When the main worktree and an unmerged feature worktree both exist, give two decisions when relevant: the general project entry point and the feature-specific continuation point. Do not collapse them into one winner.
• A successful build does not prove the built artifact is the live surface.
• If evidence conflicts, report the conflict and the smallest next read-only check. Do not select a winner by intuition.

Answer contract

Lead with one takeover decision:

Continue from: <exact path or unable to confirm>
Why: <strongest evidence>
Do not continue from: <stale/duplicate/output path and reason>

Then show the identity map, evidence, risks, and next safe action. Use 无法确认 when proof is missing. Do not turn an audit request into implementation.