@0xcraft/powershot 1.0.0

package/dist/config.js

@@ -0,0 +1,130 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { git } from './git.js';
+import { SEVERITIES } from './types.js';
+const DEFAULTS = {
+    provider: 'anthropic',
+    model: 'claude-sonnet-5',
+    verifiers: ['*'],
+    // security may duplicate SAST; convention needs repository idioms in the diff
+    judges: ['plausible-logic', 'test-adequacy', 'intent'],
+    minSeverity: 'low',
+    // findings in vendored trees are not decisions made by this repository
+    ignore: [
+        '**/node_modules/**', '**/dist/**', '**/build/**', '**/*.generated.*', '**/*.min.js',
+        '**/vendor/**', '**/vendored/**', '**/third_party/**', '**/Pods/**',
+        '**/.venv/**', '**/venv/**', '**/site-packages/**', '**/target/debug/**', '**/target/release/**',
+    ],
+    promptCache: true,
+};
+const FILE = 'powershot.config.json';
+function atRef(root, ref) {
+    try {
+        return git(root, ['show', ref + ':' + FILE], true);
+    }
+    catch {
+        return undefined; // no policy at that ref is the same as the default one
+    }
+}
+export function policyChanged(root, baseRef) {
+    const path = join(root, FILE);
+    const head = existsSync(path) ? readFileSync(path, 'utf8') : undefined;
+    return (atRef(root, baseRef) ?? '') !== (head ?? '');
+}
+const KEYS = new Set([...Object.keys(DEFAULTS), 'checks']);
+const PROVIDERS = new Set(['anthropic', 'openai', 'gemini']);
+/** A misspelled name in the config is the quietest way to get a clean review. */
+export function validateConfig(raw, known) {
+    const problems = [];
+    const suggest = (name, from) => {
+        const near = from.find((k) => k.startsWith(name.slice(0, 4)) || name.startsWith(k.slice(0, 4)));
+        return near ? ' — did you mean ' + near + '?' : ' — known: ' + from.join(', ');
+    };
+    for (const key of Object.keys(raw)) {
+        if (!KEYS.has(key))
+            problems.push('unknown setting "' + key + '"' + suggest(key, [...KEYS]));
+    }
+    if (raw.provider !== undefined && !PROVIDERS.has(String(raw.provider))) {
+        problems.push('provider "' + String(raw.provider) + '" is not one of: ' + [...PROVIDERS].join(', '));
+    }
+    if (raw.minSeverity !== undefined && !SEVERITIES.includes(raw.minSeverity)) {
+        problems.push('minSeverity "' + String(raw.minSeverity) + '" is not one of: ' + SEVERITIES.join(', '));
+    }
+    for (const [field, names] of [['verifiers', known.verifiers], ['judges', known.judges]]) {
+        const value = raw[field];
+        if (value === undefined)
+            continue;
+        // a bare string reaches `enabled()` as a string, whose `includes` matches
+        // substrings — so "security" would quietly enable a judge named "secur"
+        const list = Array.isArray(value) ? value : value?.enable;
+        if (!Array.isArray(list)) {
+            problems.push(field + ' must be a list of names, or { "enable": [...] }');
+            continue;
+        }
+        for (const name of list) {
+            if (name !== '*' && !names.includes(String(name))) {
+                problems.push('no ' + field.slice(0, -1) + ' named "' + String(name) + '"' + suggest(String(name), names));
+            }
+        }
+    }
+    return problems;
+}
+/**
+ * The policy a review is judged under.
+ *
+ * `baseRef` is what stops a change from relaxing the gate that is judging it. The
+ * config is a file in the repository, so a pull request can set `ignore: ["**"]`,
+ * empty the check list, or raise `minSeverity`, and obtain a clean required check
+ * from its own edit. Read from the base instead, a policy change takes effect once
+ * it has been reviewed — like every other change. Workspace runs pass no base.
+ */
+export function loadConfig(root, known, baseRef) {
+    const path = join(root, FILE);
+    const text = baseRef === undefined ? (existsSync(path) ? readFileSync(path, 'utf8') : undefined) : atRef(root, baseRef);
+    if (text === undefined)
+        return DEFAULTS;
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (e) {
+        throw new Error('powershot.config.json is not valid JSON: ' + e.message);
+    }
+    if (known) {
+        const problems = validateConfig(raw, known);
+        if (problems.length > 0) {
+            throw new Error('powershot.config.json:\n  ' + problems.join('\n  '));
+        }
+    }
+    return {
+        ...DEFAULTS,
+        ...raw,
+        verifiers: raw.verifiers?.enable ?? raw.verifiers ?? DEFAULTS.verifiers,
+        judges: raw.judges?.enable ?? raw.judges ?? DEFAULTS.judges,
+    };
+}
+export function enabled(list, name) {
+    return list.includes('*') || list.includes(name);
+}
+/**
+ * Minimal glob: `**` and `*` only, which is all an ignore pattern needs.
+ *
+ * A globstar before a slash matches zero directories as well as many, the way every
+ * other glob reads it. Without that, a globstar-slash-vendor pattern covered a nested
+ * vendor tree and missed one at the repository root, which is where most of them are.
+ */
+export function matchesAny(path, patterns) {
+    return patterns.some((p) => {
+        const source = '^' +
+            p
+                .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+                .replace(/\*\*\//g, '<<dirs>>')
+                .replace(/\*\*/g, '<<any>>')
+                .replace(/\*/g, '[^/]*')
+                .replace(/<<dirs>>/g, '(?:[^/]*\\/)*')
+                .replace(/<<any>>/g, '.*') +
+            '$';
+        return new RegExp(source).test(path);
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/delegate.js

@@ -0,0 +1,84 @@
+import { bundle, bundleName } from './bundle.js';
+import { renderChanges } from './judges/judge.js';
+import { COMMON, JUDGES } from './judges/prompts.js';
+import { enabled } from './config.js';
+export function delegateBrief(g, cfg, opts) {
+    const units = bundle(g, opts.maxBundleLines ?? 1200);
+    const judges = JUDGES.filter((j) => opts.checks ? opts.checks.includes(j.name) : enabled(cfg.judges, j.name));
+    const out = [
+        '# PowerShot review brief',
+        '',
+        'The deterministic checks have already run; what follows is the judgement work.',
+        'Act as each judge below over each review unit, then reply with a single JSON array',
+        'combining every finding. Add nothing outside the array.',
+        '',
+        '## Output contract',
+        '',
+        '```json',
+        '[{"file":"src/a.ts","line":12,"severity":"high","confidence":"firm",',
+        '  "check":"plausible-logic","title":"…","why":"…","fix":"…"}]',
+        '```',
+        '',
+        'Return `[]` when a judge finds nothing. An empty array is a success, not a failure.',
+        '',
+        '## Ground rules',
+        '',
+        COMMON,
+        '',
+    ];
+    for (const judge of judges) {
+        out.push('## Judge: ' + judge.name, '', judge.brief, '');
+        if (judge.needsIntent) {
+            out.push(opts.intent
+                ? 'This change states that it does the following:\n\n> ' + opts.intent.split('\n').join('\n> ')
+                : '_No stated intent available (no commit in range) — skip this judge._', '');
+        }
+    }
+    out.push('## Review units', '');
+    units.forEach((unit, i) => {
+        out.push('### Unit ' + (i + 1) + ' — ' + bundleName(unit, g.root), '', '```', renderChanges(unit.files), '```', '');
+    });
+    return out.join('\n');
+}
+export function absorbDelegated(json) {
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch (error) {
+        throw new Error('delegated findings are not valid JSON: ' + error.message);
+    }
+    if (!Array.isArray(parsed))
+        throw new Error('delegated findings must be a JSON array');
+    const out = [];
+    for (const [index, value] of parsed.entries()) {
+        if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+            throw new Error('delegated finding ' + (index + 1) + ' must be an object');
+        }
+        const item = value;
+        if (typeof item.file !== 'string' || item.file.trim() === '' ||
+            typeof item.line !== 'number' || !Number.isInteger(item.line) || item.line < 1 ||
+            typeof item.title !== 'string' || item.title.trim() === '') {
+            throw new Error('delegated finding ' + (index + 1) + ' needs a file, positive integer line, and title');
+        }
+        out.push({
+            id: '',
+            class: 'judged',
+            check: typeof item.check === 'string' ? item.check : 'delegated',
+            severity: ['critical', 'high', 'medium', 'low', 'info'].includes(item.severity)
+                ? item.severity
+                : 'medium',
+            confidence: item.confidence === 'firm' ? 'firm' : 'tentative',
+            file: item.file,
+            line: item.line,
+            title: item.title,
+            evidence: typeof item.why === 'string' ? { oracle: 'delegated agent', detail: item.why } : undefined,
+            fix: typeof item.fix === 'string' ? item.fix : undefined,
+            suggestion: typeof item.suggestion === 'string' && item.suggestion.trim() !== '' && !item.suggestion.includes('\n')
+                ? item.suggestion
+                : undefined,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=delegate.js.map

package/dist/dismissed.js

@@ -0,0 +1,130 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { git } from './git.js';
+const FILE = '.powershot/dismissed.json';
+/**
+ * Committed, unlike the judge cache: a dismissal is a team decision, not an
+ * optimisation. Keyed on the line's code rather than its position, so it survives
+ * code growing above it and lapses when that line itself changes.
+ */
+export class Dismissals {
+    file;
+    entries;
+    constructor(file, entries) {
+        this.file = file;
+        this.entries = entries;
+    }
+    /** `baseRef` is what stops a change from waving through its own findings. */
+    static open(root, baseRef) {
+        const file = join(root, FILE);
+        return new Dismissals(file, parse(baseRef === undefined ? fromTree(file) : fromRef(root, baseRef)));
+    }
+    /**
+     * Fingerprints this change adds to the list, which are deliberately not in force
+     * yet. Reported rather than applied: a diff that suppresses findings is a thing a
+     * reviewer should be told about, not a thing that quietly succeeds.
+     */
+    static pendingIn(root, baseRef) {
+        const inBase = new Set(parse(fromRef(root, baseRef)).map((d) => d.fingerprint));
+        return parse(fromTree(join(root, FILE))).filter((d) => !inBase.has(d.fingerprint)).length;
+    }
+    /**
+     * What a dismissal is about: this check, on this file, against this line of code.
+     * The line number is not part of it — code above a defect grows all the time, and a
+     * decision about a line should not expire because something unrelated moved it.
+     */
+    static fingerprint(f) {
+        const code = codeOf(f);
+        return createHash('sha256')
+            .update(f.check)
+            .update(' ')
+            .update(f.file)
+            .update(' ')
+            .update(code)
+            .digest('hex')
+            .slice(0, 24);
+    }
+    has(f) {
+        const fp = Dismissals.fingerprint(f);
+        return this.entries.some((d) => d.fingerprint === fp);
+    }
+    add(f, reason, at) {
+        const fingerprint = Dismissals.fingerprint(f);
+        if (this.entries.some((d) => d.fingerprint === fingerprint))
+            return false;
+        this.entries.push({ fingerprint, check: f.check, file: f.file, code: codeOf(f), title: f.title, reason, at });
+        this.save();
+        return true;
+    }
+    remove(fingerprint) {
+        const before = this.entries.length;
+        this.entries = this.entries.filter((d) => !d.fingerprint.startsWith(fingerprint));
+        if (this.entries.length === before)
+            return false;
+        this.save();
+        return true;
+    }
+    list() {
+        return this.entries;
+    }
+    save() {
+        mkdirSync(join(this.file, '..'), { recursive: true });
+        // written readably, because this file is committed and people read diffs of it
+        writeFileSync(this.file, JSON.stringify(this.entries, null, 2) + '\n');
+    }
+}
+function fromTree(file) {
+    try {
+        return existsSync(file) ? readFileSync(file, 'utf8') : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function fromRef(root, ref) {
+    try {
+        return git(root, ['show', ref + ':' + FILE], true);
+    }
+    catch {
+        return undefined; // no list at that ref, which is the same as an empty one
+    }
+}
+function parse(text) {
+    if (text === undefined)
+        return [];
+    try {
+        const value = JSON.parse(text);
+        return Array.isArray(value) ? value : [];
+    }
+    catch {
+        return []; // an unreadable list must hide nothing rather than everything
+    }
+}
+const LAST = '.powershot/last-report.json';
+/** The findings the most recent review reported, so `dismiss F2` knows what F2 was. */
+export function rememberReport(root, findings) {
+    try {
+        mkdirSync(join(root, '.powershot'), { recursive: true, mode: 0o700 });
+        // holds source frames from the reviewed tree, so not world-readable
+        writeFileSync(join(root, LAST), JSON.stringify(findings), { mode: 0o600 });
+    }
+    catch {
+        // being unable to remember the last report must not fail the review itself
+    }
+}
+export function lastReport(root) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(root, LAST), 'utf8'));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** The line the finding is about, as it read at the time. */
+function codeOf(f) {
+    const line = f.frame ? f.frame.lines[f.line - f.frame.firstLine] : undefined;
+    return (line ?? f.title).trim();
+}
+//# sourceMappingURL=dismissed.js.map

package/dist/fspolicy.js

@@ -0,0 +1,62 @@
+import { lstatSync, realpathSync } from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+const DENIED_SEGMENT = /^(\.env(\..+)?|\.git|\.ssh|id_rsa|id_ed25519|\.npmrc|\.netrc|\.pypirc)$/i;
+const DENIED_FILE = /\.(pem|key|p12|pfx|jks|keystore|kdbx)$/i;
+const ENV_TEMPLATE = /^\.env\.(example|sample|template|defaults|dist)$/i;
+export function deniedPath(path) {
+    const segments = path.split(/[\\/]/);
+    return segments.some((s) => !ENV_TEMPLATE.test(s) && DENIED_SEGMENT.test(s)) ||
+        DENIED_FILE.test(segments[segments.length - 1] ?? '');
+}
+function contained(root, path) {
+    const rel = relative(root, path);
+    return rel === '' || (rel !== '..' && !rel.startsWith('..' + sep) && !isAbsolute(rel));
+}
+/** Stable repository path for manifests, findings, filters, and machine output. */
+export function repoPath(root, path) {
+    const slash = (value) => value.replace(/\\/g, '/');
+    const base = slash(root).replace(/\/+$/, '') || '/';
+    const file = slash(path);
+    const fold = (value) => process.platform === 'win32' ? value.toLowerCase() : value;
+    if (fold(file) === fold(base))
+        return '';
+    if (fold(file).startsWith(fold(base) + '/'))
+        return file.slice(base.length + 1);
+    if (!isAbsolute(path) && !/^[A-Za-z]:\//.test(file))
+        return file.replace(/^\.\/+/, '');
+    return slash(relative(root, path));
+}
+/** The absolute path to read, or undefined when reading it would leave the repository. */
+export function insideRepo(root, path) {
+    const base = resolve(root);
+    const abs = resolve(base, path);
+    if (!contained(base, abs))
+        return undefined;
+    if (deniedPath(abs))
+        return undefined;
+    let real;
+    try {
+        real = realpathSync(abs);
+    }
+    catch {
+        return abs; // does not exist yet; nothing to follow, and the read will fail plainly
+    }
+    const realRoot = (() => {
+        try {
+            return realpathSync(base);
+        }
+        catch {
+            return base;
+        }
+    })();
+    if (!contained(realRoot, real))
+        return undefined;
+    if (deniedPath(real))
+        return undefined;
+    return abs;
+}
+/** True for a link, whether or not it points anywhere legitimate. */
+export function isSymlink(abs) {
+    return lstatSync(abs, { throwIfNoEntry: false })?.isSymbolicLink() ?? false;
+}
+//# sourceMappingURL=fspolicy.js.map

package/dist/git.js

@@ -0,0 +1,238 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { decode, lines, stripCR } from './text.js';
+import { insideRepo, isSymlink } from './fspolicy.js';
+export function git(root, args, quiet = false) {
+    try {
+        const out = execFileSync('git', args, {
+            cwd: root,
+            maxBuffer: 64 * 1024 * 1024,
+            stdio: ['ignore', 'pipe', quiet ? 'ignore' : 'pipe'],
+        });
+        return decode(out);
+    }
+    catch (e) {
+        const err = e;
+        const detail = err.stderr ? decode(err.stderr).trim() : '';
+        throw new Error(detail || err.message || 'git ' + args[0] + ' failed');
+    }
+}
+export function repoRoot(cwd) {
+    return git(cwd, ['rev-parse', '--show-toplevel']).trim();
+}
+function fileAtRef(root, ref, path) {
+    try {
+        const record = git(root, ['ls-tree', '-z', ref, '--', ':(literal)' + path], true).split('\0')[0];
+        const header = record?.slice(0, record.indexOf('\t')).split(' ');
+        const oid = header?.[2];
+        if (!oid || header?.[1] !== 'blob')
+            return undefined;
+        return git(root, ['cat-file', 'blob', oid], true);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Added/modified line numbers per file, parsed from a zero-context diff.
+ * Only new-side ranges matter: we review what the change introduced.
+ */
+export function parseAddedLines(diff) {
+    const out = new Map();
+    let current;
+    // a CRLF diff would otherwise put `\r` inside every captured path, and nothing
+    // would ever match a real file
+    for (const raw of diff.split('\n')) {
+        const line = stripCR(raw);
+        const file = /^\+\+\+ b\/(.+)$/.exec(line);
+        if (file && file[1]) {
+            current = new Set();
+            out.set(file[1], current);
+            continue;
+        }
+        const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+        if (hunk && current) {
+            const start = Number(hunk[1]);
+            const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+            for (let i = 0; i < count; i++)
+                current.add(start + i);
+        }
+    }
+    return out;
+}
+function addedLinesInPatch(diff) {
+    const added = new Set();
+    for (const raw of diff.split('\n')) {
+        const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(stripCR(raw));
+        if (!hunk)
+            continue;
+        const start = Number(hunk[1]);
+        const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+        for (let i = 0; i < count; i++)
+            added.add(start + i);
+    }
+    return added;
+}
+function changedPaths(raw) {
+    const fields = raw.split('\0');
+    const out = [];
+    for (let i = 0; i < fields.length;) {
+        const status = fields[i++];
+        if (!status)
+            continue;
+        if (status.startsWith('R') || status.startsWith('C')) {
+            const beforePath = fields[i++];
+            const path = fields[i++];
+            if (beforePath && path)
+                out.push({ path, beforePath });
+            continue;
+        }
+        const path = fields[i++];
+        if (path)
+            out.push({ path, beforePath: status === 'A' ? undefined : path });
+    }
+    return out;
+}
+/**
+ * A ref is an argument only once it is proven to be one.
+ *
+ * `execFileSync` stops the shell from interpreting a ref, but not git: an argument
+ * beginning with `-` is an option, so `--from=--output=/tmp/x` makes `git diff` write
+ * a file and report nothing — an arbitrary write behind a clean exit code. Resolving
+ * the ref also turns a name that does not exist into an error rather than an empty
+ * diff, which is the same clean-looking nothing by a different route.
+ */
+export function resolveRef(root, value, flag) {
+    if (value.startsWith('-'))
+        throw new Error(flag + ' looks like an option, not a ref: ' + value);
+    if (/[\0-\x1f\x7f]/.test(value))
+        throw new Error(flag + ' contains a control character');
+    try {
+        return git(root, ['rev-parse', '--verify', '--quiet', value + '^{commit}'], true).trim();
+    }
+    catch {
+        throw new Error(flag + ' is not a commit in this repository: ' + value);
+    }
+}
+export function checkRange(root, range) {
+    if (range.commit !== undefined)
+        resolveRef(root, range.commit, '--commit');
+    if (range.from !== undefined)
+        resolveRef(root, range.from, '--from');
+    if (range.to !== undefined)
+        resolveRef(root, range.to, '--to');
+}
+export function mergeBase(root, from, to) {
+    try {
+        return git(root, ['merge-base', from, to]).trim() || from;
+    }
+    catch {
+        return from; // unrelated histories: the tip is the only base there is
+    }
+}
+export function baseRefOf(root, range) {
+    if (range.commit)
+        return range.commit + '^';
+    if (range.from && range.to)
+        return mergeBase(root, range.from, range.to);
+    if (range.from)
+        return range.from;
+    return 'HEAD';
+}
+/**
+ * What the change says it does, taken from commit subjects. Workspace mode has no
+ * commit yet, so it has no stated intent — the intent judge simply does not run.
+ */
+export function statedIntent(root, range) {
+    try {
+        if (range.commit)
+            return git(root, ['log', '-1', '--pretty=%B', range.commit]).trim() || undefined;
+        if (range.from && range.to) {
+            return git(root, ['log', '--pretty=- %s', range.from + '..' + range.to]).trim() || undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+export function collectChanges(root, range) {
+    checkRange(root, range);
+    // An unborn repository has no HEAD to diff against. Every present file is new, so
+    // reading the index and working tree directly is both simpler and more accurate
+    // than inventing a base commit (including for staged files edited again afterwards).
+    if (!range.commit && !range.from && !shaOf(root, 'HEAD')) {
+        const paths = new Set([
+            ...git(root, ['ls-files', '-z', '--cached']).split('\0').filter(Boolean),
+            ...git(root, ['ls-files', '-z', '--others', '--exclude-standard']).split('\0').filter(Boolean),
+        ]);
+        const files = [];
+        for (const path of paths) {
+            const abs = insideRepo(root, path);
+            if (!abs || isSymlink(abs) || !existsSync(abs))
+                continue;
+            const count = lines(decode(readFileSync(abs))).length;
+            files.push({ path, added: new Set(Array.from({ length: count }, (_, i) => i + 1)), before: undefined });
+        }
+        return files;
+    }
+    let diffArgs;
+    let baseRef;
+    if (range.commit) {
+        baseRef = range.commit + '^';
+        diffArgs = [range.commit + '^', range.commit];
+    }
+    else if (range.from && range.to) {
+        // `diff A...B` is measured from the merge base, so the base content has to come
+        // from there too. Reading it from the branch tip instead lines up new-side line
+        // numbers with a version of the file the diff never looked at.
+        baseRef = mergeBase(root, range.from, range.to);
+        diffArgs = [range.from + '...' + range.to];
+    }
+    else {
+        baseRef = 'HEAD';
+        diffArgs = ['HEAD'];
+    }
+    const files = [];
+    const tracked = changedPaths(git(root, [
+        'diff', '--name-status', '-z', '--diff-filter=ACMRT', '--find-renames', ...diffArgs,
+    ]));
+    for (const { path, beforePath } of tracked) {
+        const pathspecs = beforePath && beforePath !== path
+            ? [':(literal)' + beforePath, ':(literal)' + path]
+            : [':(literal)' + path];
+        const patch = git(root, [
+            'diff', '--unified=0', '--no-color', '--no-ext-diff', '--find-renames',
+            ...diffArgs, '--', ...pathspecs,
+        ]);
+        files.push({
+            path,
+            added: addedLinesInPatch(patch),
+            before: beforePath === undefined ? undefined : fileAtRef(root, baseRef, beforePath),
+        });
+    }
+    if (!range.commit && !range.from) {
+        const untracked = git(root, ['ls-files', '-z', '--others', '--exclude-standard']).split('\0').filter(Boolean);
+        for (const path of untracked) {
+            // an untracked symlink can point anywhere, and what a review reads it can send
+            const abs = insideRepo(root, path);
+            if (!abs || isSymlink(abs) || !existsSync(abs))
+                continue;
+            const count = lines(decode(readFileSync(abs))).length;
+            files.push({ path, added: new Set(Array.from({ length: count }, (_, i) => i + 1)), before: undefined });
+        }
+    }
+    return files;
+}
+export function shaOf(root, ref) {
+    try {
+        return git(root, ['rev-parse', '--verify', '--quiet', ref + '^{commit}'], true).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function headSha(root) {
+    return shaOf(root, 'HEAD');
+}
+//# sourceMappingURL=git.js.map