rail_verdict 1.0.0

data/lib/rail_verdict/doctor.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require "pathname"
+
+module RailVerdict
+  module Doctor
+    Outcome = Struct.new(:report, :exit_code, keyword_init: true)
+
+    module_function
+
+    def execute(repository_root:, config_path:, runner: ProcessRunner, rubocop_command_resolver: nil)
+      root = File.realpath(repository_root)
+      resolved_config = resolve_config_path(root, config_path)
+      configuration = Configuration.load(resolved_config)
+      probes = {}
+      configuration.analyzers.each do |name, selection|
+        next unless selection.fetch("enabled")
+
+        adapter = build_adapter(name, rubocop_command_resolver)
+        next unless adapter
+
+        probes[name] = adapter.probe(root, runner: runner)
+      end
+      analyzer_versions = probes.transform_values(&:version)
+      context = RunContext.build(
+        repository_root: root,
+        configuration: configuration,
+        analyzer_versions: analyzer_versions,
+        revision_resolver: ->(_root) { nil }
+      )
+      analyzers_report = {}
+      configuration.analyzers.each do |name, selection|
+        probe = probes[name]
+        analyzers_report[name] = {
+          "enabled" => selection.fetch("enabled"),
+          "required" => selection.fetch("required"),
+          "status" => probe&.status || "disabled",
+          "version" => probe&.version
+        }
+      end
+      hints = {}
+      configuration.analyzers.each do |name, sel|
+        probe = probes[name]
+        status = probe&.status || "disabled"
+        next if %w[succeeded disabled].include?(status)
+
+        hints[name] = doctor_hint(name, probe)
+      end
+      baseline_hint = nil
+      if configuration.mode == "no_new_debt"
+        baseline_path = Baseline.resolve_path(repository_root: root, configuration: configuration)
+        baseline_hint = File.file?(baseline_path) ? nil : "baseline missing for no_new_debt; run `railverdict baseline create`"
+      end
+      report = {
+        "doctor" => "1.0",
+        "ruby_version" => context.ruby_version,
+        "target_ruby_version" => context.target_ruby_version,
+        "rails_version" => context.rails_version,
+        "configuration" => {
+          "path" => relative_path(resolved_config, root),
+          "valid" => true,
+          "mode" => configuration.mode,
+          "digest" => configuration.digest
+        },
+        "analyzers" => analyzers_report,
+        "hints" => hints,
+        "baseline_hint" => baseline_hint
+      }.compact
+      Outcome.new(report: report, exit_code: 0)
+    rescue ConfigurationError => error
+      Outcome.new(
+        report: {
+          "doctor" => "1.0",
+          "configuration" => { "valid" => false, "error" => error.message },
+          "analyzers" => {}
+        },
+        exit_code: 2
+      )
+    rescue RailVerdict::Error, SystemCallError => error
+      Outcome.new(
+        report: { "doctor" => "1.0", "configuration" => { "valid" => false, "error" => error.message }, "analyzers" => {} },
+        exit_code: 2
+      )
+    end
+
+    def resolve_config_path(root, config_path)
+      path = config_path.to_s
+      Pathname.new(path).absolute? ? path : File.expand_path(path, root)
+    end
+    private_class_method :resolve_config_path
+
+    def build_adapter(name, rubocop_command_resolver)
+      case name
+      when "rubocop"
+        RailVerdict::Analyzers::RuboCop.new(command_resolver: rubocop_command_resolver)
+      when "minitest"
+        RailVerdict::Analyzers::Minitest.new
+      when "rspec"
+        RailVerdict::Analyzers::RSpec.new
+      when "simplecov"
+        RailVerdict::Analyzers::SimpleCov.new
+      when "bundler_audit"
+        RailVerdict::Analyzers::BundlerAudit.new
+      end
+    end
+    private_class_method :build_adapter
+
+    def doctor_hint(name, probe)
+      msg = probe&.message.to_s
+      case name
+      when "rspec"
+        "Add `rspec` to the target application's bundle and run bundle install. (#{msg})"
+      when "minitest"
+        "Add `minitest` to the target bundle or ensure tests load. (#{msg})"
+      when "rubocop"
+        "Add `rubocop` to the target bundle and run bundle install. (#{msg})"
+      when "simplecov"
+        "Generate coverage at coverage/coverage.json (SimpleCov JSON formatter) before check. (#{msg})"
+      when "bundler_audit"
+        "Add `bundler-audit` to the bundle; run `bundle exec bundler-audit update` separately. (#{msg})"
+      else
+        msg
+      end
+    end
+    private_class_method :doctor_hint
+
+    def relative_path(path, root)
+      Pathname.new(path).relative_path_from(Pathname.new(root)).to_s
+    end
+    private_class_method :relative_path
+  end
+end

data/lib/rail_verdict/errors.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  class Error < StandardError; end
+
+  class UsageError < Error; end
+
+  class ConfigurationError < Error
+    attr_reader :source_path, :property_path
+
+    def initialize(message, source_path: nil, property_path: nil)
+      super(message)
+      @source_path = source_path
+      @property_path = property_path
+    end
+  end
+end

data/lib/rail_verdict/findings_command.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module FindingsCommand
+    module_function
+
+    def document(outcome)
+      {
+        "schema_version" => "1.0",
+        "findings" => outcome.findings.sort_by(&:sort_key).map(&:to_schema_h)
+      }
+    end
+
+    def console(outcome)
+      return "No findings.\n" if outcome.findings.empty?
+
+      outcome.findings.sort_by(&:sort_key).map do |finding|
+        location = finding.location
+        line = location["start_line"] ? ":#{location['start_line']}" : ""
+        "#{location.fetch('path')}#{line} [#{finding.severity}] #{finding.analyzer}/#{finding.rule_id}: #{finding.message}"
+      end.join("\n") + "\n"
+    end
+  end
+end

data/lib/rail_verdict/fingerprint.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module RailVerdict
+  module Fingerprint
+    VERSION = 1
+    ALGORITHM = "sha256"
+    PAYLOAD_SCHEMA = "https://railverdict.dev/fingerprint-payload/v1"
+    LEGACY_PAYLOAD_SCHEMA = "https://railverdict.dev/fingerprint-payload/v0.1"
+    FINGERPRINT_PATTERN = /\Asha256:[0-9a-f]{64}\z/
+
+    class IncompatibleError < RailVerdict::Error; end
+
+    module_function
+
+    def canonical_payload(analyzer:, rule_id:, path:, message:)
+      analyzer = normalize_field(analyzer, "analyzer")
+      rule_id = normalize_field(rule_id, "rule_id")
+      path = normalize_path(path)
+      message = normalize_message(message)
+      {
+        "payload_schema" => PAYLOAD_SCHEMA,
+        "fingerprint_version" => VERSION,
+        "algorithm" => ALGORITHM,
+        "analyzer" => analyzer,
+        "rule_id" => rule_id,
+        "path" => path,
+        "message" => message
+      }
+    end
+
+    def canonical_json(analyzer:, rule_id:, path:, message:)
+      payload = canonical_payload(analyzer: analyzer, rule_id: rule_id, path: path, message: message)
+      sorted = payload.keys.sort.to_h { |key| [key, payload.fetch(key)] }
+      JSON.generate(sorted)
+    end
+
+    def hexdigest(analyzer:, rule_id:, path:, message:)
+      "sha256:#{Digest::SHA256.hexdigest(canonical_json(analyzer: analyzer, rule_id: rule_id, path: path, message: message))}"
+    end
+
+    def valid?(fingerprint)
+      fingerprint.is_a?(String) && fingerprint.match?(FINGERPRINT_PATTERN)
+    end
+
+    def normalize_field(value, _name)
+      value.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").strip
+    end
+    private_class_method :normalize_field
+
+    def normalize_path(path)
+      raw = path.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").strip
+      raw = raw.delete_prefix("./")
+      raw = raw.delete_prefix("/")
+      raw = raw.unicode_normalize(:nfc) if raw.respond_to?(:unicode_normalize)
+      raw
+    end
+    private_class_method :normalize_path
+
+    def normalize_message(message)
+      raw = message.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").strip
+      raw = raw.gsub(/\s+/, " ")
+      raw = raw.unicode_normalize(:nfc) if raw.respond_to?(:unicode_normalize)
+      raw = raw[0, 4096] if raw.bytesize > 4096
+      raw = raw.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?")
+      raw.bytesize > 4096 ? raw.byteslice(0, 4096).encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?") : raw
+    end
+    private_class_method :normalize_message
+  end
+end

data/lib/rail_verdict/git/command.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module RailVerdict
+  module Git
+    module Command
+      module_function
+
+      GIT_EXECUTABLE = "git"
+
+      def run(argv, chdir:, timeout_seconds: 5.0, max_stdout_bytes: 524288, max_stderr_bytes: 65536, runner: ProcessRunner)
+        argv.each do |element|
+          raise ArgumentError, "git argv elements must be strings" unless element.is_a?(String)
+          raise ArgumentError, "git argv elements cannot contain NUL bytes" if element.include?("\0")
+        end
+        runner.run(GIT_EXECUTABLE, argv, chdir: chdir, timeout_seconds: timeout_seconds, max_stdout_bytes: max_stdout_bytes, max_stderr_bytes: max_stderr_bytes)
+      end
+
+      def interpret(result, chdir:)
+        case result.status
+        when :spawn_failed
+          raise Git::Unavailable, "git is not available: #{result.detail}"
+        when :timed_out
+          raise Git::Timeout, "git operation timed out"
+        when :truncated
+          raise Git::Truncated, "git output was truncated"
+        when :signaled
+          raise Git::Error, "git terminated by signal #{result.signal}"
+        when :exited
+          result
+        else
+          raise Git::Error, "unexpected git result: #{result.status}"
+        end
+        if result.stdout_truncated || result.stderr_truncated
+          raise Git::Truncated, "git output was truncated"
+        end
+        result
+      end
+
+      def require_success(result, context_message: "git command failed")
+        return if result.exit_code == 0
+
+        stderr = result.stderr.to_s.strip
+        suffix = stderr.empty? ? "" : " (#{stderr[0, 1024]})"
+        raise Git::Error, "#{context_message}: exit #{result.exit_code}#{suffix}"
+      end
+    end
+  end
+end

data/lib/rail_verdict/git/context.rb

@@ -0,0 +1,361 @@
+# frozen_string_literal: true
+
+require "set"
+require "pathname"
+
+module RailVerdict
+  module Git
+    class ChangedFile
+      attr_reader :status, :path, :old_path, :new_path, :score
+      attr_accessor :binary
+
+      def initialize(status:, path:, old_path:, new_path:, score:, binary: false)
+        @status = status
+        @path = path
+        @old_path = old_path
+        @new_path = new_path
+        @score = score
+        @binary = binary
+        freeze
+      end
+
+      def to_h
+        { "status" => status.to_s, "path" => path, "old_path" => old_path, "new_path" => new_path, "score" => score, "binary" => binary }
+      end
+    end
+
+    class Context
+      attr_reader :repository_root, :head, :base, :merge_base, :changed_files, :changed_line_set, :binary_paths, :conflicted_paths
+
+      def initialize(repository_root:, head:, base:, merge_base:, changed_files:, changed_line_set:, binary_paths:, conflicted_paths:)
+        @repository_root = repository_root.dup.freeze
+        @head = head.dup.freeze
+        @base = base.dup.freeze
+        @merge_base = merge_base.dup.freeze
+        @changed_files = changed_files.map(&:freeze).freeze
+        @changed_line_set = deep_freeze_line_set(changed_line_set)
+        @binary_paths = binary_paths.dup.freeze
+        @conflicted_paths = conflicted_paths.dup.freeze
+        freeze
+      end
+
+      def to_h
+        {
+          "repository_root" => repository_root,
+          "head" => head,
+          "base" => base,
+          "merge_base" => merge_base,
+          "changed_files" => changed_files.map(&:to_h),
+          "changed_line_set" => changed_line_set,
+          "binary_paths" => binary_paths.sort,
+          "conflicted_paths" => conflicted_paths.sort
+        }
+      end
+
+      def rename_map
+        map = {}
+        changed_files.each do |file|
+          next unless file.status == :renamed
+
+          map[file.new_path] = file.old_path if file.new_path && file.old_path
+        end
+        map.freeze
+      end
+
+      def self.build(repository_root:, base_override:, configuration:, runner: ProcessRunner)
+        root = File.realpath(repository_root)
+        raise Git::NotARepository, "repository root does not exist: #{repository_root}" unless File.directory?(root)
+
+        git_root = resolve_git_root(root, runner: runner)
+        unless Pathname.new(git_root) == Pathname.new(root) || root.start_with?(git_root + File::SEPARATOR) || git_root == root
+          git_root = root if File.directory?(File.join(root, ".git"))
+        end
+        unless Dir.exist?(File.join(git_root, ".git")) || File.file?(File.join(git_root, ".git"))
+          toplevel = git_toplevel(root, runner: runner)
+          if toplevel && File.directory?(toplevel)
+            git_root = toplevel
+          end
+        end
+        repository_root = git_root
+
+        head = resolve_head(repository_root, runner: runner)
+        base_raw = resolve_base_raw(base_override, configuration)
+        if base_raw.nil? || base_raw.strip.empty?
+          raise Git::BaseUnresolvable, "changed scope requires an explicit base: supply --base <revision> or set git.base in .railverdict.yml"
+        end
+        base = resolve_base_commit(base_raw.strip, repository_root, runner: runner)
+        merge_base = resolve_merge_base(base, head, repository_root, runner: runner)
+        changed_files, binary_set = resolve_changed_files(merge_base, head, repository_root, runner: runner)
+        changed_line_set = resolve_changed_line_set(merge_base, head, changed_files, repository_root, runner: runner)
+        conflicted = resolve_conflicts(repository_root, runner: runner)
+        binary_paths = (binary_set.to_a + changed_line_set.select { |_, v| v.nil? }.keys).uniq.sort.freeze
+        filtered_line_set = changed_line_set.reject { |_, v| v.nil? }
+
+        new(
+          repository_root: repository_root,
+          head: head,
+          base: base,
+          merge_base: merge_base,
+          changed_files: changed_files,
+          changed_line_set: filtered_line_set,
+          binary_paths: binary_paths,
+          conflicted_paths: conflicted
+        )
+      end
+
+      def self.resolve_git_root(root, runner:)
+        result = Command.run(["rev-parse", "--show-toplevel"], chdir: root, runner: runner)
+        interpreted = begin
+          Command.interpret(result, chdir: root)
+        rescue Git::Error
+          return root
+        end
+        return root unless interpreted.exit_code == 0
+
+        toplevel = interpreted.stdout.to_s.strip
+        toplevel = toplevel.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").strip
+        toplevel = toplevel.unicode_normalize(:nfc) if toplevel.respond_to?(:unicode_normalize)
+        toplevel.empty? ? root : File.realpath(toplevel)
+      rescue Errno::ENOENT, Errno::EACCES
+        root
+      end
+      private_class_method :resolve_git_root
+
+      def self.git_toplevel(root, runner:)
+        result = Command.run(["rev-parse", "--show-toplevel"], chdir: root, runner: runner)
+        interpreted = begin
+          Command.interpret(result, chdir: root)
+        rescue Git::Error
+          return nil
+        end
+        return nil unless interpreted.exit_code == 0
+
+        out = interpreted.stdout.to_s.strip
+        out.empty? ? nil : out
+      end
+      private_class_method :git_toplevel
+
+      def self.resolve_head(root, runner:)
+        result = Command.run(["rev-parse", "HEAD"], chdir: root, runner: runner)
+        interpreted = Command.interpret(result, chdir: root)
+        unless interpreted.exit_code == 0
+          raise Git::Error, "cannot resolve HEAD: #{interpreted.stderr.to_s.strip[0, 512]}"
+        end
+        sha = interpreted.stdout.to_s.strip
+        unless sha.match?(/\A[0-9a-f]{7,64}\z/)
+          raise Git::Error, "HEAD is not a valid commit SHA: #{sha.inspect}"
+        end
+        full = resolve_full_sha(sha, root, runner: runner)
+        full || sha
+      end
+      private_class_method :resolve_head
+
+      def self.resolve_full_sha(sha, root, runner:)
+        result = Command.run(["rev-parse", sha], chdir: root, runner: runner)
+        interpreted = begin
+          Command.interpret(result, chdir: root)
+        rescue Git::Error
+          return nil
+        end
+        return nil unless interpreted.exit_code == 0
+
+        out = interpreted.stdout.to_s.strip
+        out.match?(/\A[0-9a-f]{40,64}\z/) ? out : nil
+      end
+      private_class_method :resolve_full_sha
+
+      def self.resolve_base_raw(base_override, configuration)
+        if base_override && !base_override.to_s.strip.empty?
+          return base_override.to_s.strip
+        end
+        if configuration.respond_to?(:git_base) && configuration.git_base && !configuration.git_base.to_s.strip.empty?
+          return configuration.git_base.to_s.strip
+        end
+        nil
+      end
+      private_class_method :resolve_base_raw
+
+      def self.resolve_base_commit(base_raw, root, runner:)
+        result = Command.run(["rev-parse", "--verify", "#{base_raw}^{commit}"], chdir: root, runner: runner)
+        interpreted = begin
+          Command.interpret(result, chdir: root)
+        rescue Git::Unavailable, Git::Timeout, Git::Truncated => error
+          raise error
+        rescue Git::Error
+          raise Git::BaseUnresolvable, "base revision is not resolvable: #{base_raw.inspect}"
+        end
+        unless interpreted.exit_code == 0
+          message = interpreted.stderr.to_s.strip
+          if message.include?("not a valid object name") || message.include?("needed a single revision")
+            raise Git::BaseUnresolvable, "base revision is not resolvable: #{base_raw.inspect}"
+          end
+          raise Git::BaseUnresolvable, "base revision is not resolvable: #{base_raw.inspect} (#{message[0, 512]})"
+        end
+        sha = interpreted.stdout.to_s.strip
+        unless sha.match?(/\A[0-9a-f]{7,64}\z/)
+          raise Git::BaseUnresolvable, "base did not resolve to a commit: #{base_raw.inspect}"
+        end
+        sha
+      end
+      private_class_method :resolve_base_commit
+
+      def self.resolve_merge_base(base, head, root, runner:)
+        result = Command.run(["merge-base", base, head], chdir: root, runner: runner)
+        interpreted = begin
+          Command.interpret(result, chdir: root)
+        rescue Git::Unavailable, Git::Timeout, Git::Truncated => error
+          raise error
+        rescue Git::Error => error
+          raise Git::MergeBaseFailure, "cannot resolve merge-base for #{base.inspect} and #{head.inspect}: #{error.message}"
+        end
+        unless interpreted.exit_code == 0
+          stderr = interpreted.stderr.to_s.strip
+          if stderr.include?("not a valid object name") || stderr.include?("no merge base")
+            raise Git::MergeBaseFailure, "cannot resolve merge-base: history is incomplete or base is unrelated (#{stderr[0, 512]})"
+          end
+          raise Git::MergeBaseFailure, "cannot resolve merge-base: #{stderr[0, 512]}"
+        end
+        sha = interpreted.stdout.to_s.strip
+        unless sha.match?(/\A[0-9a-f]{7,64}\z/)
+          raise Git::MergeBaseFailure, "merge-base did not resolve to a commit"
+        end
+        sha
+      end
+      private_class_method :resolve_merge_base
+
+      def self.resolve_changed_files(merge_base, head, root, runner:)
+        name_status_raw = run_diff_or_raise(["diff", "--name-status", "-z", "--find-renames", "--diff-filter=ADMR", merge_base, head], root, runner: runner, context: "name-status")
+        files = DiffParser.parse_name_status_nul(name_status_raw)
+
+        numstat_raw = run_diff_or_raise(["diff", "--numstat", "-z", "--find-renames", merge_base, head], root, runner: runner, context: "numstat")
+        numstat = DiffParser.parse_numstat_rename_nul(numstat_raw)
+
+        binary_set = Set.new
+        enriched = files.map do |file|
+          key = file.path || file.old_path
+          info = numstat[key] if key
+          is_binary = !!(info && info[:binary])
+          binary_set.add(key) if is_binary
+          ChangedFile.new(status: file.status, path: file.path, old_path: file.old_path, new_path: file.new_path, score: file.score, binary: is_binary)
+        end
+
+        changed = enriched.reject { |file| file.status == :deleted }.sort_by { |file| file.path.to_s }
+        [changed, binary_set]
+      end
+      private_class_method :resolve_changed_files
+
+      def self.run_diff_or_raise(argv, root, runner:, context:)
+        result = Command.run(argv, chdir: root, timeout_seconds: 10.0, max_stdout_bytes: 4 * 1024 * 1024, runner: runner)
+        interpreted = Command.interpret(result, chdir: root)
+        unless interpreted.exit_code == 0
+          raise Git::DiffFailure, "git diff #{context} failed: #{interpreted.stderr.to_s.strip[0, 1024]}"
+        end
+        interpreted.stdout.dup.force_encoding(Encoding::BINARY)
+      end
+      private_class_method :run_diff_or_raise
+
+      def self.resolve_changed_line_set(merge_base, head, changed_files, root, runner:)
+        return {} if changed_files.empty?
+
+        raw = begin
+          run_diff_or_raise(["diff", "-U0", "--no-color", "-z", "--find-renames", merge_base, head], root, runner: runner, context: "unified")
+        rescue Git::DiffFailure
+          ""
+        end
+        raw = raw.dup.force_encoding(Encoding::BINARY) if raw
+        binary_paths = changed_files.select { |file| file.binary }.map { |file| file.path }.compact
+        binary_set = Set.new(binary_paths)
+        segments = DiffParser.split_unified_by_nul(raw || "")
+        line_set = {}
+        segments.each do |path, diff_text|
+          normalized = normalize_path_for_lines(path.to_s)
+          next if binary_set.include?(normalized)
+
+          exists = changed_files.any? { |file| file.path == normalized }
+          next unless exists || changed_files.any? { |file| file.new_path == normalized }
+
+          text = diff_text.to_s
+          next if text.empty?
+
+          lines = extract_added_lines(text)
+          line_set[normalized] = lines.sort.freeze unless lines.empty?
+        end
+        line_set.transform_values(&:freeze).freeze
+      end
+      private_class_method :resolve_changed_line_set
+
+      def self.extract_added_lines(diff_text)
+        lines = []
+        new_line = nil
+        diff_text.each_line do |raw_line|
+          if raw_line.start_with?("@@ ")
+            match = raw_line.match(/\A@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/)
+            new_line = match ? match[1].to_i : nil
+            next
+          end
+          next if new_line.nil?
+          next if raw_line.start_with?("diff --git") || raw_line.start_with?("index ") || raw_line.start_with?("--- ") || raw_line.start_with?("+++ ")
+
+          if raw_line.start_with?("+")
+            next if raw_line.start_with?("+++ ")
+
+            lines << new_line
+            new_line += 1
+          elsif raw_line.start_with?("-")
+            next
+          elsif raw_line.start_with?(" ") || raw_line.start_with?("\\")
+            new_line += 1 if raw_line.start_with?(" ")
+          end
+        end
+        lines
+      end
+      private_class_method :extract_added_lines
+
+      def self.normalize_path_for_lines(path)
+        raw = path.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").strip
+        raw = raw.delete_prefix("./")
+        raw = raw.delete_prefix("/")
+        raw = raw.unicode_normalize(:nfc) if raw.respond_to?(:unicode_normalize)
+        raw
+      end
+      private_class_method :normalize_path_for_lines
+
+      def self.resolve_conflicts(root, runner:)
+        result = Command.run(["ls-files", "-u", "-z"], chdir: root, runner: runner)
+        interpreted = begin
+          Command.interpret(result, chdir: root)
+        rescue Git::Error
+          return [].freeze
+        end
+        return [].freeze unless interpreted.exit_code == 0
+
+        raw = interpreted.stdout.to_s
+        return [].freeze if raw.strip.empty?
+
+        parts = raw.split("\0")
+        paths = Set.new
+        parts.each do |entry|
+          next if entry.strip.empty?
+
+          tab_index = entry.index("\t")
+          path = tab_index ? entry[(tab_index + 1)..] : entry
+          next if path.nil? || path.strip.empty?
+
+          paths.add(normalize_path_for_lines(path))
+        end
+        paths.to_a.sort.freeze
+      end
+      private_class_method :resolve_conflicts
+
+      private
+
+      def deep_freeze_line_set(line_set)
+        frozen = {}
+        line_set.each do |path, lines|
+          frozen[path.dup.freeze] = lines.sort.freeze
+        end
+        frozen.freeze
+      end
+    end
+  end
+end