@bridge4dev/runner 0.11.0

package/dist/gitops.js

@@ -0,0 +1,596 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { sanitizeBranch } from './git.js';
+import { isSecretPath, maskString } from './policy.js';
+const execFileAsync = promisify(execFile);
+const GIT_TIMEOUT_MS = 30_000;
+const MERGE_TIMEOUT_MS = 60_000;
+const DIFF_CAP_BYTES = 200_000;
+/**
+ * Global git switches every call in this module needs.
+ *
+ * `--literal-pathspecs` is a security control, not a nicety: `--` stops git
+ * from reading an argument as an OPTION, but it does not stop it from reading
+ * it as a PATTERN. `git show <sha> -- '*'` or `-- ':(glob)**'` prints the whole
+ * commit — including the `.env` the file list carefully marked as protected.
+ * With this flag a path is a path (QA-105 MAJOR-1; the same hole had been open
+ * in `gitDiff` since session 4).
+ *
+ * `core.quotePath=false` keeps non-ASCII file names readable: by default git
+ * returns `"\321\204..."`, which is both unreadable in the panel and unusable
+ * as the path of the follow-up diff request.
+ */
+const GIT_GLOBAL_ARGS = ['--literal-pathspecs', '-c', 'core.quotePath=false'];
+async function git(cwd, ...args) {
+    const { stdout } = await execFileAsync('git', [...GIT_GLOBAL_ARGS, ...args], {
+        cwd,
+        timeout: GIT_TIMEOUT_MS,
+        maxBuffer: 8 * 1024 * 1024,
+    });
+    return stdout.replace(/\n$/, '');
+}
+/** Pathspec magic characters — refused outright, belt to the flag's braces. */
+const PATHSPEC_MAGIC = /[*?[\]]|^:/;
+function shortError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return maskString(message).slice(0, 500);
+}
+/**
+ * True only for a genuine content conflict. `git merge --squash` also exits
+ * non-zero for a dirty index, a refused overwrite or a failing hook — those
+ * must not be reported as "conflict" (which auto-tasks the agent).
+ */
+function isMergeConflict(error) {
+    const text = error instanceof Error ? `${error.message}` : String(error);
+    const output = `${text} ${String(error?.stdout ?? '')} ${String(error?.stderr ?? '')}`;
+    return /CONFLICT \(|Automatic merge failed|fix conflicts/i.test(output);
+}
+/**
+ * The base the session will be applied onto: the branch the workspace repo is
+ * currently on (its HEAD commit is what merge-base is computed against). If
+ * the workspace somehow sits on the session branch itself, fall back to
+ * main/master.
+ */
+async function resolveBase(workspacePath, sessionBranch) {
+    const current = await git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD');
+    if (current !== sessionBranch && current !== 'HEAD') {
+        return { baseBranch: current, baseRef: current };
+    }
+    for (const candidate of ['main', 'master']) {
+        const exists = await git(workspacePath, 'rev-parse', '--verify', '--quiet', candidate)
+            .then(() => true)
+            .catch(() => false);
+        if (exists)
+            return { baseBranch: candidate, baseRef: candidate };
+    }
+    throw new Error(`Cannot determine the base branch (workspace is on ${current})`);
+}
+/** Merge-base of the session worktree against the workspace's base branch. */
+async function mergeBase(worktreePath, baseRef) {
+    return git(worktreePath, 'merge-base', 'HEAD', baseRef);
+}
+export async function gitStatus(worktreePath, workspacePath, sessionBranch) {
+    const { baseBranch, baseRef } = await resolveBase(workspacePath, sessionBranch);
+    const base = await mergeBase(worktreePath, baseRef);
+    // One diff of the working tree against the merge-base covers both committed
+    // and uncommitted changes — exactly what «Применить» would bring to main.
+    const [numstatRaw, nameStatusRaw, porcelainRaw, commitCountRaw] = await Promise.all([
+        git(worktreePath, 'diff', '--numstat', '-M', base),
+        git(worktreePath, 'diff', '--name-status', '-M', base),
+        git(worktreePath, 'status', '--porcelain'),
+        git(worktreePath, 'rev-list', '--count', `${base}..HEAD`),
+    ]);
+    const numstat = new Map();
+    for (const line of numstatRaw.split('\n').filter(Boolean)) {
+        const [add, del, ...rest] = line.split('\t');
+        const path = normalizeNumstatPath(rest.join('\t'));
+        if (!path)
+            continue;
+        numstat.set(path, {
+            additions: add === '-' ? null : Number(add),
+            deletions: del === '-' ? null : Number(del),
+        });
+    }
+    const uncommittedPaths = new Set();
+    const untracked = [];
+    for (const line of porcelainRaw.split('\n').filter(Boolean)) {
+        const state = line.slice(0, 2);
+        // Rename entries look like "R  old -> new" — track the new path.
+        const rawPath = line.slice(3);
+        const path = rawPath.includes(' -> ') ? (rawPath.split(' -> ')[1] ?? rawPath) : rawPath;
+        uncommittedPaths.add(path);
+        if (state === '??')
+            untracked.push(path);
+    }
+    const files = [];
+    for (const line of nameStatusRaw.split('\n').filter(Boolean)) {
+        const [status, ...rest] = line.split('\t');
+        if (!status)
+            continue;
+        const path = rest[rest.length - 1] ?? '';
+        const stats = numstat.get(path) ?? { additions: null, deletions: null };
+        files.push({
+            path,
+            status: status.charAt(0),
+            additions: stats.additions,
+            deletions: stats.deletions,
+            uncommitted: uncommittedPaths.has(path),
+        });
+    }
+    // Untracked files never show up in a diff against the base.
+    for (const path of untracked) {
+        if (!files.some((f) => f.path === path)) {
+            files.push({ path, status: 'A', additions: null, deletions: null, uncommitted: true });
+        }
+    }
+    files.sort((a, b) => a.path.localeCompare(b.path));
+    return {
+        branch: sessionBranch,
+        baseBranch,
+        files,
+        additions: files.reduce((sum, f) => sum + (f.additions ?? 0), 0),
+        deletions: files.reduce((sum, f) => sum + (f.deletions ?? 0), 0),
+        agentCommits: Number(commitCountRaw) || 0,
+        uncommittedFiles: uncommittedPaths.size,
+    };
+}
+/**
+ * Constrain a user-supplied diff path to a relative path inside the worktree
+ * that is not on the secret denylist (QA-98 F1: the `--no-index` fallback
+ * would otherwise read ANY file — .env included — verbatim).
+ */
+function safeDiffPath(worktreePath, filePath) {
+    if (path.isAbsolute(filePath) || filePath.split(/[\\/]/).includes('..')) {
+        throw new Error('Diff path must be relative to the worktree');
+    }
+    if (PATHSPEC_MAGIC.test(filePath)) {
+        throw new Error('Diff path must name one file, not a pattern');
+    }
+    const resolved = path.resolve(worktreePath, filePath);
+    const rel = path.relative(path.resolve(worktreePath), resolved);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+        throw new Error('Diff path escapes the worktree');
+    }
+    if (rel.split(path.sep).includes('.git')) {
+        throw new Error('Diff path is protected by runner policy');
+    }
+    // Symlinks must not smuggle a read outside the worktree or into a secret.
+    let real = resolved;
+    try {
+        real = fs.realpathSync(resolved);
+    }
+    catch {
+        // Deleted file — lexical checks above are all we can do.
+    }
+    const realRel = path.relative(fs.realpathSync(worktreePath), real);
+    if (realRel.startsWith('..') || path.isAbsolute(realRel)) {
+        throw new Error('Diff path escapes the worktree');
+    }
+    if (isSecretPath(resolved) || isSecretPath(real)) {
+        throw new Error('Diff path is protected by runner policy');
+    }
+    // A directory pathspec matches everything under it, denylisted files
+    // included — the panel asks for one file at a time and gets one file.
+    try {
+        if (fs.statSync(real).isDirectory()) {
+            throw new Error('Diff path must name one file, not a directory');
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('not a directory'))
+            throw error;
+        // Deleted file — nothing to stat; the header check in capDiff still applies.
+    }
+    return rel;
+}
+/**
+ * `maxBuffer` is a hard wall BEFORE our own caps get a chance to trim: a
+ * commit that vendors a whole tree makes execFile reject with ENOBUFS, and the
+ * dashboard used to show the raw node error. Say the true thing instead.
+ */
+function isOutputTooLarge(error) {
+    const code = error?.code;
+    const message = error instanceof Error ? error.message : String(error);
+    return code === 'ENOBUFS' || /maxBuffer length exceeded/i.test(message);
+}
+/** Turn a maxBuffer overflow into a sentence the panel can show. */
+async function tooLargeAware(work) {
+    try {
+        return await work;
+    }
+    catch (error) {
+        if (isOutputTooLarge(error)) {
+            throw new Error('This commit is too large to display', { cause: error });
+        }
+        throw error;
+    }
+}
+/**
+ * The last line of defence: refuse a diff that ended up containing a protected
+ * file, whatever pathspec produced it.
+ *
+ * Path validation alone is not enough, and QA-105 proved it twice. `--` stops
+ * git reading an argument as an option but not as a pattern; `--literal-pathspecs`
+ * stops the pattern but not the fact that a literal DIRECTORY pathspec matches
+ * everything beneath it — `-- svc` returns `svc/.env`. Rather than keep guessing
+ * which pathspec forms exist, this checks the ANSWER: every `diff --git a/X b/Y`
+ * header goes through the same denylist as the file list.
+ */
+function assertNoProtectedFiles(diff) {
+    for (const match of diff.matchAll(/^diff --git a\/(.+?) b\/(.+)$/gm)) {
+        const before = match[1] ?? '';
+        const after = match[2] ?? '';
+        if (isSecretPath(before) || isSecretPath(after)) {
+            throw new Error('Diff path is protected by runner policy');
+        }
+    }
+}
+/** Exposed for tests: the header check is the control worth pinning directly. */
+export function capDiffForTest(diff) {
+    return capDiff(diff);
+}
+function capDiff(diff) {
+    assertNoProtectedFiles(diff);
+    // Mask FIRST, then cap — a secret straddling the cap boundary must not
+    // survive half-masked (QA-98 F6).
+    const masked = maskString(diff);
+    const truncated = masked.length > DIFF_CAP_BYTES;
+    return { diff: truncated ? masked.slice(0, DIFF_CAP_BYTES) : masked, truncated };
+}
+export async function gitDiff(worktreePath, workspacePath, sessionBranch, filePath) {
+    const relPath = safeDiffPath(worktreePath, filePath);
+    const { baseRef } = await resolveBase(workspacePath, sessionBranch);
+    const base = await mergeBase(worktreePath, baseRef);
+    const diff = await git(worktreePath, 'diff', '-M', base, '--', relPath);
+    if (diff)
+        return capDiff(diff);
+    // No diff against the base. The /dev/null fallback shows file CONTENT, so
+    // it is allowed only for genuinely UNTRACKED files (status `??`) — never
+    // for unchanged tracked files and never for gitignored ones (QA-98 F1).
+    const porcelain = await git(worktreePath, 'status', '--porcelain', '--', relPath);
+    if (!porcelain.startsWith('??'))
+        return { diff: '', truncated: false };
+    const fallback = await execFileAsync('git', [...GIT_GLOBAL_ARGS, 'diff', '--no-index', '--', '/dev/null', relPath], { cwd: worktreePath, timeout: GIT_TIMEOUT_MS, maxBuffer: 8 * 1024 * 1024 })
+        .then((r) => r.stdout)
+        .catch((error) => error?.code === 1 && typeof error.stdout === 'string' ? error.stdout : '');
+    return capDiff(fallback);
+}
+export async function gitCommit(worktreePath, message) {
+    const porcelain = await git(worktreePath, 'status', '--porcelain');
+    if (!porcelain)
+        return { committed: false, reason: 'nothing-to-commit' };
+    await git(worktreePath, 'add', '-A');
+    await git(worktreePath, 'commit', '-m', message);
+    return { committed: true, sha: await git(worktreePath, 'rev-parse', 'HEAD') };
+}
+export async function applySession(workspacePath, worktreePath, sessionBranch, message) {
+    const workspaceDirty = await git(workspacePath, 'status', '--porcelain');
+    if (workspaceDirty) {
+        return {
+            applied: false,
+            error: 'The workspace working copy has uncommitted changes — commit or stash them on the server first',
+        };
+    }
+    const workspaceBranch = await git(workspacePath, 'rev-parse', '--abbrev-ref', 'HEAD');
+    if (workspaceBranch === sessionBranch) {
+        return { applied: false, error: 'The workspace is checked out on the session branch itself' };
+    }
+    // Fold whatever the agent left uncommitted into the branch first, so
+    // «Применить» always takes exactly what the user reviewed.
+    const worktreeDirty = await git(worktreePath, 'status', '--porcelain');
+    if (worktreeDirty) {
+        await git(worktreePath, 'add', '-A');
+        await git(worktreePath, 'commit', '-m', 'chore(devbridge): изменения сессии перед применением');
+    }
+    const base = await git(workspacePath, 'merge-base', 'HEAD', sessionBranch);
+    const commits = Number(await git(workspacePath, 'rev-list', '--count', `${base}..${sessionBranch}`));
+    if (!commits)
+        return { applied: false, error: 'The session branch has no changes to apply' };
+    try {
+        await execFileAsync('git', [...GIT_GLOBAL_ARGS, 'merge', '--squash', sessionBranch], {
+            cwd: workspacePath,
+            timeout: MERGE_TIMEOUT_MS,
+            maxBuffer: 8 * 1024 * 1024,
+        });
+    }
+    catch (error) {
+        // Restore a pristine workspace either way.
+        await git(workspacePath, 'reset', '--merge').catch(() => undefined);
+        // Only a real content conflict is worth handing back to the agent — a
+        // dirty index or a failing hook would send it on a pointless rebase
+        // errand (QA-99 MINOR-7).
+        if (isMergeConflict(error)) {
+            return { applied: false, conflict: true, baseBranch: workspaceBranch };
+        }
+        return { applied: false, error: `Merge failed: ${shortError(error)}` };
+    }
+    try {
+        await git(workspacePath, 'commit', '-m', message);
+    }
+    catch (error) {
+        await git(workspacePath, 'reset', '--merge').catch(() => undefined);
+        return { applied: false, error: `Commit failed: ${shortError(error)}` };
+    }
+    return { applied: true, commitSha: await git(workspacePath, 'rev-parse', 'HEAD') };
+}
+const LOG_FORMAT = '%H%x00%P%x00%an%x00%aI%x00%D%x00%s';
+const SHOW_META_FORMAT = '%H%x00%P%x00%an%x00%ae%x00%aI%x00%D%x00%s%x00%b';
+const MAX_LOG_LIMIT = 200;
+const MAX_COMMIT_FILES = 500;
+const SUBJECT_CAP = 500;
+const BODY_CAP = 4_000;
+/** A full or abbreviated commit hash — never a ref name, never an option. */
+export function isCommitSha(value) {
+    return /^[0-9a-f]{7,64}$/i.test(value);
+}
+/**
+ * A ref that came out of git itself (the workspace's current branch). It still
+ * must not be read as an option — every call also ends with `--`, but a lone
+ * `-f` reaching `git log` would be a bug worth failing on rather than passing.
+ */
+function assertRefArgument(ref) {
+    if (!ref || ref.startsWith('-'))
+        throw new Error('Invalid git ref');
+    return ref;
+}
+/** The session branch, as strictly as `git worktree add -b` accepted it. */
+function requireSessionBranch(branch) {
+    const safe = sanitizeBranch(branch);
+    if (!safe)
+        throw new Error('Invalid branch name');
+    return safe;
+}
+/**
+ * Constrain a path from an old commit. Deliberately lexical: the file may have
+ * been deleted since, so `safeDiffPath`'s `realpathSync` — which is what makes
+ * it safe against symlinks in the *working tree* — has nothing to resolve. That
+ * is not a weakness here: git reads the blob out of the object store by path,
+ * so there is no symlink to follow in the first place.
+ */
+function safeHistoryPath(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    if (!normalized)
+        throw new Error('Diff path is required');
+    if (path.isAbsolute(normalized) || normalized.split('/').includes('..')) {
+        throw new Error('Diff path must be relative to the repository');
+    }
+    if (PATHSPEC_MAGIC.test(normalized)) {
+        throw new Error('Diff path must name one file, not a pattern');
+    }
+    // `.`, `./` and a trailing slash all name a directory, and a directory
+    // pathspec matches everything under it (QA-105 security round).
+    if (normalized === '.' || normalized.endsWith('/') || normalized.split('/').includes('.')) {
+        throw new Error('Diff path must name one file, not a directory');
+    }
+    if (normalized.split('/').includes('.git')) {
+        throw new Error('Diff path is protected by runner policy');
+    }
+    if (isSecretPath(normalized)) {
+        throw new Error('Diff path is protected by runner policy');
+    }
+    return normalized;
+}
+function parseRefs(decoration) {
+    return decoration
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => (entry.startsWith('HEAD -> ') ? entry.slice('HEAD -> '.length) : entry))
+        .filter((entry) => entry !== 'HEAD')
+        .slice(0, 10)
+        .map((entry) => entry.slice(0, 200));
+}
+/**
+ * `--numstat` names a rename as `old => new` (or `dir/{old => new}/file`),
+ * while `--name-status` gives the plain new path. Keying the two maps by
+ * different strings is why every renamed file showed `null` additions.
+ */
+export function normalizeNumstatPath(raw) {
+    const braced = /^(.*)\{(.*) => (.*)\}(.*)$/.exec(raw);
+    if (braced) {
+        return `${braced[1] ?? ''}${braced[3] ?? ''}${braced[4] ?? ''}`.replace(/\/{2,}/g, '/');
+    }
+    const arrow = raw.split(' => ');
+    return (arrow.length > 1 ? arrow[arrow.length - 1] : raw) ?? raw;
+}
+function parseParents(raw) {
+    return raw.split(' ').filter(Boolean).slice(0, 16);
+}
+async function branchExists(workspacePath, ref) {
+    return git(workspacePath, 'rev-parse', '--verify', '--quiet', `${ref}^{commit}`)
+        .then(() => true)
+        .catch(() => false);
+}
+export async function gitLog(input) {
+    const branch = requireSessionBranch(input.branch);
+    const { baseBranch, baseRef } = await resolveBase(input.workspacePath, branch);
+    assertRefArgument(baseRef);
+    if (!(await branchExists(input.workspacePath, branch))) {
+        throw new Error(`Branch ${branch} no longer exists in this repository`);
+    }
+    // Between the BRANCH and the base — not between the workspace's HEAD and the
+    // base, which is what `mergeBase()` computes for the Changes panel from
+    // inside the worktree. A base branch that is gone (or a repo with a single
+    // commit) leaves the marker missing, not the whole panel failing.
+    const base = await git(input.workspacePath, 'merge-base', branch, baseRef).catch(() => null);
+    const limit = Math.min(Math.max(Math.trunc(input.limit ?? 50), 1), MAX_LOG_LIMIT);
+    const skip = Math.min(Math.max(Math.trunc(input.skip ?? 0), 0), 100_000);
+    const scope = input.scope ?? 'all';
+    // `branch --not baseRef` is exactly `base..branch`, but it does not depend on
+    // merge-base succeeding: a repository where the two histories never met would
+    // otherwise silently fall back to the WHOLE branch while the UI still said
+    // «only what the agent committed» (QA-105).
+    const range = scope === 'session'
+        ? [branch, '--not', baseRef]
+        : scope === 'branch'
+            ? [branch]
+            : [branch, baseRef];
+    // `--topo-order` is not cosmetic: the lane layout on the dashboard assumes a
+    // parent never appears before its child, and the default (date order) breaks
+    // exactly that on branches committed out of order.
+    const raw = await git(input.workspacePath, 'log', '--topo-order', `--max-count=${limit + 1}`, `--skip=${skip}`, `--format=${LOG_FORMAT}`, ...range, '--');
+    const lines = raw.split('\n').filter((line) => line.length > 0);
+    const hasMore = lines.length > limit;
+    const commits = [];
+    for (const line of lines.slice(0, limit)) {
+        const [sha, parents, author, date, decoration, subject] = line.split('\0');
+        if (!sha)
+            continue;
+        commits.push({
+            sha,
+            parents: parseParents(parents ?? ''),
+            author: maskString(author ?? '').slice(0, 200),
+            date: (date ?? '').slice(0, 40),
+            subject: maskString(subject ?? '').slice(0, SUBJECT_CAP),
+            refs: parseRefs(decoration ?? ''),
+        });
+    }
+    return { branch, baseBranch, mergeBase: base, commits, hasMore };
+}
+/**
+ * A path in a commit must name a FILE. A directory pathspec matches everything
+ * beneath it, denylisted files included (`-- svc` returns `svc/.env`), which is
+ * how the second half of QA-105 MAJOR-1 got through the first fix.
+ *
+ * `git cat-file -t` answers this from the object store, so it works for a file
+ * that no longer exists in the working copy; the parent is consulted as well so
+ * a deletion still opens.
+ */
+async function assertPathIsBlob(workspacePath, sha, relPath) {
+    for (const rev of [sha, `${sha}^`]) {
+        const type = await git(workspacePath, 'cat-file', '-t', `${rev}:${relPath}`).catch(() => null);
+        if (type === 'blob')
+            return;
+        if (type === 'tree')
+            throw new Error('Diff path must name one file, not a directory');
+    }
+    throw new Error('That file is not part of this commit');
+}
+/**
+ * Only history this session can legitimately see.
+ *
+ * Without it any object in the repository is readable through a session
+ * endpoint by naming its sha — including a commit the user believed they had
+ * thrown away with `reset --hard`, which is still in the object store
+ * (QA-105 security round).
+ */
+async function assertCommitIsVisible(workspacePath, sha, branch) {
+    const safeBranch = sanitizeBranch(branch);
+    if (!safeBranch)
+        throw new Error('Invalid branch name');
+    const { baseRef } = await resolveBase(workspacePath, safeBranch);
+    for (const ref of [safeBranch, assertRefArgument(baseRef)]) {
+        const reachable = await git(workspacePath, 'merge-base', '--is-ancestor', sha, ref)
+            .then(() => true)
+            .catch(() => false);
+        if (reachable)
+            return;
+    }
+    throw new Error('That commit is not part of this session history');
+}
+/**
+ * One commit: its metadata and the files it touched, or — when `filePath` is
+ * given — the diff of that one file.
+ *
+ * `--diff-merges=first-parent` on purpose: without it `git show` renders a
+ * merge as a combined diff that hides everything already present in one of the
+ * parents, and the answer to "what did this merge bring onto my branch" comes
+ * out empty. For an ordinary commit the flag changes nothing.
+ */
+export async function gitShow(workspacePath, sha, filePath, branch) {
+    if (!isCommitSha(sha))
+        throw new Error('Invalid commit sha');
+    if (branch !== undefined)
+        await assertCommitIsVisible(workspacePath, sha, branch);
+    if (filePath !== undefined) {
+        const relPath = safeHistoryPath(filePath);
+        await assertPathIsBlob(workspacePath, sha, relPath);
+        const diff = await git(workspacePath, 'show', '--format=', '-M', '--diff-merges=first-parent', sha, '--', relPath).catch((error) => {
+            if (isOutputTooLarge(error)) {
+                throw new Error('This diff is too large to display', { cause: error });
+            }
+            throw error;
+        });
+        return { kind: 'diff', ...capDiff(diff) };
+    }
+    const [metaRaw, numstatRaw, nameStatusRaw] = await tooLargeAware(Promise.all([
+        git(workspacePath, 'show', '-s', `--format=${SHOW_META_FORMAT}`, sha, '--'),
+        git(workspacePath, 'show', '--format=', '--numstat', '-M', '--diff-merges=first-parent', sha, '--'),
+        git(workspacePath, 'show', '--format=', '--name-status', '-M', '--diff-merges=first-parent', sha, '--'),
+    ]));
+    const [fullSha, parents, author, email, date, decoration, subject, ...bodyParts] = metaRaw.split('\0');
+    if (!fullSha)
+        throw new Error('Commit not found');
+    const numstat = new Map();
+    for (const line of numstatRaw.split('\n').filter(Boolean)) {
+        const [add, del, ...rest] = line.split('\t');
+        const entryPath = normalizeNumstatPath(rest[rest.length - 1] ?? '');
+        if (!entryPath)
+            continue;
+        numstat.set(entryPath, {
+            additions: add === '-' ? null : Number(add),
+            deletions: del === '-' ? null : Number(del),
+        });
+    }
+    const nameStatusLines = nameStatusRaw.split('\n').filter(Boolean);
+    const truncated = nameStatusLines.length > MAX_COMMIT_FILES;
+    const files = [];
+    for (const line of nameStatusLines.slice(0, MAX_COMMIT_FILES)) {
+        const [status, ...rest] = line.split('\t');
+        if (!status)
+            continue;
+        const entryPath = rest[rest.length - 1] ?? '';
+        if (!entryPath)
+            continue;
+        const stats = numstat.get(entryPath) ?? { additions: null, deletions: null };
+        files.push({
+            path: entryPath.slice(0, 1_000),
+            status: status.charAt(0),
+            additions: stats.additions,
+            deletions: stats.deletions,
+            protected: isSecretPath(entryPath),
+        });
+    }
+    return {
+        kind: 'commit',
+        sha: fullSha,
+        parents: parseParents(parents ?? ''),
+        author: maskString(author ?? '').slice(0, 200),
+        authorEmail: maskString(email ?? '').slice(0, 200),
+        date: (date ?? '').slice(0, 40),
+        subject: maskString(subject ?? '').slice(0, SUBJECT_CAP),
+        // The body may itself contain NULs' worth of sections — everything after
+        // the seventh separator belongs to it.
+        body: maskString(bodyParts.join('\0')).slice(0, BODY_CAP).trimEnd(),
+        refs: parseRefs(decoration ?? ''),
+        files,
+        truncated,
+    };
+}
+export async function revertApply(workspacePath, commitSha) {
+    if (!/^[0-9a-f]{7,64}$/i.test(commitSha)) {
+        return { reverted: false, error: 'Invalid commit sha' };
+    }
+    const dirty = await git(workspacePath, 'status', '--porcelain');
+    if (dirty) {
+        return {
+            reverted: false,
+            error: 'The workspace working copy has uncommitted changes — commit or stash them on the server first',
+        };
+    }
+    try {
+        await execFileAsync('git', [...GIT_GLOBAL_ARGS, 'revert', '--no-edit', commitSha], {
+            cwd: workspacePath,
+            timeout: MERGE_TIMEOUT_MS,
+            maxBuffer: 8 * 1024 * 1024,
+        });
+    }
+    catch {
+        await git(workspacePath, 'revert', '--abort').catch(() => undefined);
+        return { reverted: false, conflict: true };
+    }
+    return { reverted: true, revertSha: await git(workspacePath, 'rev-parse', 'HEAD') };
+}
+//# sourceMappingURL=gitops.js.map

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map