@fern-api/fern-api-dev 4.75.0 → 4.76.0-1-g4629aee782f

package/cli.cjs

@@ -345167,6 +345167,7 @@ var require_GithubStep = __commonJS({
     exports2.GithubStep = void 0;
     exports2.enrichPrBodyForAutomation = enrichPrBodyForAutomation;
     exports2.shouldEnableAutomerge = shouldEnableAutomerge;
+    exports2.shouldPushGenerationBaseTag = shouldPushGenerationBaseTag;
     exports2.resolveBranchAction = resolveBranchAction;
     var core_utils_1 = (init_lib4(), __toCommonJS(lib_exports));
     var github_1 = (init_lib7(), __toCommonJS(lib_exports3));
@@ -345246,7 +345247,11 @@ var require_GithubStep = __commonJS({
         });
         switch (branchAction) {
           case "replay-branch":
-            generationBaseSha = await (0, createReplayBranch_1.createReplayBranch)(repository, prBranch, this.config.commitMessage, replayConflictInfo, this.logger);
+            if (shouldPushGenerationBaseTag(replayResult)) {
+              generationBaseSha = await (0, createReplayBranch_1.createReplayBranch)(repository, prBranch, this.config.commitMessage, replayConflictInfo, this.logger);
+            } else {
+              await repository.createBranchFromHead(prBranch);
+            }
             break;
           case "create-from-head":
             await repository.createBranchFromHead(prBranch);
@@ -345444,6 +345449,9 @@ _Fern Run ID: \`${config5.runId}\`_`;
     function shouldEnableAutomerge(config5) {
       return config5.automationMode === true && config5.autoMerge === true && config5.hasBreakingChanges !== true;
     }
+    function shouldPushGenerationBaseTag(replayResult) {
+      return (replayResult?.patchesWithConflicts ?? 0) > 0;
+    }
     function resolveBranchAction({ automationMode, skipCommit, existingPR }) {
       if (skipCommit) {
         return "replay-branch";
@@ -350912,9 +350920,9 @@ var require_diff3 = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/@fern-api+replay@0.10.4/node_modules/@fern-api/replay/dist/index.cjs
+// ../../../node_modules/.pnpm/@fern-api+replay@0.11.0/node_modules/@fern-api/replay/dist/index.cjs
 var require_dist14 = __commonJS({
-  "../../../node_modules/.pnpm/@fern-api+replay@0.10.4/node_modules/@fern-api/replay/dist/index.cjs"(exports2, module4) {
+  "../../../node_modules/.pnpm/@fern-api+replay@0.11.0/node_modules/@fern-api/replay/dist/index.cjs"(exports2, module4) {
     "use strict";
     var __defProp4 = Object.defineProperty;
     var __getOwnPropDesc4 = Object.getOwnPropertyDescriptor;
@@ -351005,13 +351013,30 @@ var require_dist14 = __commonJS({
             const output2 = await this.exec(["rev-parse", `${commitSha}^@`]);
             return output2.trim().split("\n").filter(Boolean);
           }
+          /**
+           * Detects renames and copies between two trees.
+           *
+           * Both `R` (rename) and `C` (copy) entries are returned as `{from, to}` pairs.
+           * Copies are treated as rename-equivalent because the generator may produce the
+           * new path while the old path remains in the tree (e.g., imperfect cleanup,
+           * customer edits at the old path, or test helpers that only write new files).
+           * Callers that care about "is the source still present" should verify via
+           * `showFile(toTree, from)`.
+           */
           async detectRenames(fromTree, toTree) {
             try {
-              const output2 = await this.exec(["diff", "--find-renames", "--name-status", fromTree, toTree]);
+              const output2 = await this.exec([
+                "diff",
+                "--find-renames",
+                "--find-copies",
+                "--name-status",
+                fromTree,
+                toTree
+              ]);
               const renames = [];
               for (const line of output2.trim().split("\n")) {
                 if (!line) continue;
-                if (line.startsWith("R")) {
+                if (line.startsWith("R") || line.startsWith("C")) {
                   const parts = line.split("	");
                   if (parts.length >= 3) {
                     renames.push({ from: parts[1], to: parts[2] });
@@ -351305,6 +351330,7 @@ var require_dist14 = __commonJS({
     });
     var index_exports = {};
     __export4(index_exports, {
+      CREDENTIAL_PATTERNS: () => CREDENTIAL_PATTERNS,
       FERN_BOT_EMAIL: () => FERN_BOT_EMAIL,
       FERN_BOT_LOGIN: () => FERN_BOT_LOGIN,
       FERN_BOT_NAME: () => FERN_BOT_NAME,
@@ -351316,19 +351342,53 @@ var require_dist14 = __commonJS({
       ReplayCommitter: () => ReplayCommitter,
       ReplayDetector: () => ReplayDetector,
       ReplayService: () => ReplayService,
+      SENSITIVE_FILE_PATTERNS: () => SENSITIVE_FILE_PATTERNS,
       bootstrap: () => bootstrap,
       forget: () => forget,
       isGenerationCommit: () => isGenerationCommit,
       isReplayCommit: () => isReplayCommit,
       isRevertCommit: () => isRevertCommit,
+      isSensitiveFile: () => isSensitiveFile,
       parseRevertedMessage: () => parseRevertedMessage,
       parseRevertedSha: () => parseRevertedSha,
       reset: () => reset2,
       resolve: () => resolve13,
+      scanForCredentials: () => scanForCredentials,
       status: () => status,
       threeWayMerge: () => threeWayMerge
     });
     module4.exports = __toCommonJS3(index_exports);
+    var CREDENTIAL_PATTERNS = [
+      { name: "PRIVATE KEY block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+      { name: "OPENSSH key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/ },
+      { name: "RSA key", re: /-----BEGIN RSA PRIVATE KEY-----/ },
+      { name: "CERTIFICATE", re: /-----BEGIN CERTIFICATE-----/ },
+      { name: "TOKEN=", re: /\bTOKEN\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/ },
+      { name: "api_key=", re: /\bapi[_-]?key\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/i },
+      { name: "password=", re: /\bpassword\s*=\s*["']?[^\s"']{6,}/i },
+      { name: "AWS_SECRET_ACCESS_KEY", re: /AWS_SECRET_ACCESS_KEY/ },
+      { name: "JWT (eyJ...)", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ }
+    ];
+    var SENSITIVE_FILE_PATTERNS = [
+      /(^|\/)\.env(\.[^/]+)?$/,
+      /\.pem$/,
+      /\.key$/,
+      /\.pkce_state\.json$/,
+      /(^|\/)id_rsa$/,
+      /(^|\/)id_ed25519$/
+    ];
+    function isSensitiveFile(filePath) {
+      return SENSITIVE_FILE_PATTERNS.some((re17) => re17.test(filePath));
+    }
+    function scanForCredentials(content5) {
+      const matches2 = [];
+      for (const { name: name2, re: re17 } of CREDENTIAL_PATTERNS) {
+        if (re17.test(content5)) {
+          matches2.push(name2);
+        }
+      }
+      return matches2;
+    }
     init_GitClient();
     var FERN_BOT_NAME = "fern-api";
     var FERN_BOT_EMAIL = "115122769+fern-api[bot]@users.noreply.github.com";
@@ -351370,6 +351430,7 @@ var require_dist14 = __commonJS({
     var LockfileManager = class {
       outputDir;
       lock = null;
+      warnings = [];
       constructor(outputDir) {
         this.outputDir = outputDir;
       }
@@ -351418,6 +351479,27 @@ var require_dist14 = __commonJS({
         if (!this.lock) {
           throw new Error("No lockfile data to save. Call read() or initialize() first.");
         }
+        this.warnings.length = 0;
+        const cleanPatches = [];
+        for (const patch5 of this.lock.patches) {
+          const credentialMatches = scanForCredentials(patch5.patch_content);
+          const sensitiveFiles = patch5.files.filter((f10) => isSensitiveFile(f10));
+          if (credentialMatches.length > 0 || sensitiveFiles.length > 0) {
+            const reasons = [];
+            if (credentialMatches.length > 0) {
+              reasons.push(`credential patterns: ${credentialMatches.join(", ")}`);
+            }
+            if (sensitiveFiles.length > 0) {
+              reasons.push(`sensitive files: ${sensitiveFiles.join(", ")}`);
+            }
+            this.warnings.push(
+              `Patch ${patch5.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+            );
+          } else {
+            cleanPatches.push(patch5);
+          }
+        }
+        this.lock.patches = cleanPatches;
         const dir = (0, import_node_path41.dirname)(this.lockfilePath);
         if (!(0, import_node_fs32.existsSync)(dir)) {
           (0, import_node_fs32.mkdirSync)(dir, { recursive: true });
@@ -351520,6 +351602,37 @@ var require_dist14 = __commonJS({
     };
     var import_node_crypto7 = require("crypto");
     var INFRASTRUCTURE_FILES = /* @__PURE__ */ new Set([".fernignore"]);
+    function parsePatchFileHeaders(patchContent) {
+      const results = [];
+      let currentPath = null;
+      let currentIsCreate = false;
+      let currentIsDelete = false;
+      const flush2 = () => {
+        if (currentPath !== null) {
+          results.push({ path: currentPath, isCreate: currentIsCreate, isDelete: currentIsDelete });
+        }
+      };
+      for (const line of patchContent.split("\n")) {
+        if (line.startsWith("diff --git ")) {
+          flush2();
+          currentPath = null;
+          currentIsCreate = false;
+          currentIsDelete = false;
+          const match3 = line.match(/^diff --git a\/(.+?) b\/(.+?)$/);
+          if (match3) {
+            currentPath = match3[2] ?? null;
+          }
+        } else if (currentPath !== null) {
+          if (line.startsWith("new file mode ")) {
+            currentIsCreate = true;
+          } else if (line.startsWith("deleted file mode ")) {
+            currentIsDelete = true;
+          }
+        }
+      }
+      flush2();
+      return results;
+    }
     var ReplayDetector = class {
       git;
       lockManager;
@@ -351598,12 +351711,31 @@ var require_dist14 = __commonJS({
             );
             continue;
           }
-          const contentHash = this.computeContentHash(patchContent);
+          let contentHash = this.computeContentHash(patchContent);
           if (lock.patches.find((p10) => p10.content_hash === contentHash) || forgottenHashes.has(contentHash)) {
             continue;
           }
           const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-          const files = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10));
+          const allFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10)).filter((f10) => !f10.startsWith(".fern/"));
+          const sensitiveFiles = allFiles.filter((f10) => isSensitiveFile(f10));
+          const files = allFiles.filter((f10) => !isSensitiveFile(f10));
+          if (sensitiveFiles.length > 0) {
+            this.warnings.push(
+              `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
+            );
+            if (files.length > 0) {
+              const parentSha = parents[0];
+              if (parentSha) {
+                try {
+                  patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
+                } catch {
+                  continue;
+                }
+                if (!patchContent.trim()) continue;
+                contentHash = this.computeContentHash(patchContent);
+              }
+            }
+          }
           if (files.length === 0) {
             continue;
           }
@@ -351615,14 +351747,16 @@ var require_dist14 = __commonJS({
             original_author: `${commit.authorName} <${commit.authorEmail}>`,
             base_generation: lastGen.commit_sha,
             files,
-            patch_content: patchContent
+            patch_content: patchContent,
+            ...this.isCreationOnlyPatch(patchContent) ? { user_owned: true } : {}
           });
         }
-        newPatches.reverse();
+        const survivingPatches = await this.collapseNetZeroFiles(newPatches);
+        survivingPatches.reverse();
         const revertedPatchIdSet = /* @__PURE__ */ new Set();
         const revertIndicesToRemove = /* @__PURE__ */ new Set();
-        for (let i11 = 0; i11 < newPatches.length; i11++) {
-          const patch5 = newPatches[i11];
+        for (let i11 = 0; i11 < survivingPatches.length; i11++) {
+          const patch5 = survivingPatches[i11];
           if (!isRevertCommit(patch5.original_message)) continue;
           let body = "";
           try {
@@ -351651,7 +351785,7 @@ var require_dist14 = __commonJS({
           if (matchedExisting) continue;
           let matchedNew = false;
           if (revertedSha) {
-            const idx = newPatches.findIndex(
+            const idx = survivingPatches.findIndex(
               (p10, j16) => j16 !== i11 && !revertIndicesToRemove.has(j16) && p10.original_commit === revertedSha
             );
             if (idx !== -1) {
@@ -351661,7 +351795,7 @@ var require_dist14 = __commonJS({
             }
           }
           if (!matchedNew && revertedMessage) {
-            const idx = newPatches.findIndex(
+            const idx = survivingPatches.findIndex(
               (p10, j16) => j16 !== i11 && !revertIndicesToRemove.has(j16) && p10.original_message === revertedMessage
             );
             if (idx !== -1) {
@@ -351673,18 +351807,107 @@ var require_dist14 = __commonJS({
             revertIndicesToRemove.add(i11);
           }
         }
-        const filteredPatches = newPatches.filter((_16, i11) => !revertIndicesToRemove.has(i11));
+        const filteredPatches = survivingPatches.filter((_16, i11) => !revertIndicesToRemove.has(i11));
         return { patches: filteredPatches, revertedPatchIds: [...revertedPatchIdSet] };
       }
       /**
        * Compute content hash for deduplication.
-       * Removes commit SHA line and index lines before hashing,
-       * so rebased commits with same content produce the same hash.
+       *
+       * Produces a format-agnostic hash so both `git format-patch` output
+       * (email-wrapped) and plain `git diff` output hash to the same value
+       * when the underlying diff hunks are identical.
+       *
+       * Normalization:
+       *   1. Strip email wrapper: everything before the first `diff --git` line
+       *      (From:, Subject:, Date:, diffstat, blank separators).
+       *   2. Strip `index` lines (blob SHA pairs change across rebases).
+       *   3. Strip trailing git version marker (`-- \n<version>`).
+       *
+       * This ensures content hashes match across the no-patches and normal-
+       * regeneration flows, which store formatPatch and git-diff formats
+       * respectively (FER-9850, D5-D9).
        */
       computeContentHash(patchContent) {
-        const normalized = patchContent.split("\n").filter((line) => !line.startsWith("From ") && !line.startsWith("index ") && !line.startsWith("Date: ")).join("\n");
+        const lines = patchContent.split("\n");
+        const diffStart = lines.findIndex((l14) => l14.startsWith("diff --git "));
+        const relevantLines = diffStart > 0 ? lines.slice(diffStart) : lines;
+        const normalized = relevantLines.filter((line) => !line.startsWith("index ")).join("\n").replace(/\n-- \n[\d]+\.[\d]+[^\n]*\s*$/, "");
         return `sha256:${(0, import_node_crypto7.createHash)("sha256").update(normalized).digest("hex")}`;
       }
+      /**
+       * FER-9805 — Drop patches whose files were transiently created and then
+       * deleted within the current linear detection window, and are absent from
+       * HEAD at the end of the window.
+       *
+       * Rationale: on a merge commit, createMergeCompositePatch already diffs
+       * firstParent..mergeCommit so net-zero files never enter the composite. On
+       * linear history each commit becomes its own patch, so a file that was
+       * briefly added and later removed survives as a create+delete pair whose
+       * cumulative diff is empty. We drop such patches before they reach the
+       * lockfile.
+       *
+       * A file is "transient" when:
+       *   1. some patch in the window sets `new file mode` for it (a creation), AND
+       *   2. some patch in the window sets `deleted file mode` for it (a deletion), AND
+       *   3. it is absent from HEAD's tree.
+       *
+       * The HEAD guard (#3) prevents false positives when a file is deleted
+       * and then recreated with different content — the cumulative diff of
+       * such a pair is non-empty and must be preserved.
+       *
+       * This only drops patches whose `files` are a subset of the transient
+       * set. A partial-transient patch (one that touches a transient file
+       * alongside a persistent one) is left unmodified; surgical stripping of
+       * single files from a multi-file patch would require a follow-up that
+       * regenerates the patch content via `git format-patch -- <files>`. No
+       * current failing test exercises this, and leaving the patch intact
+       * preserves today's behaviour. TODO(FER-9805): revisit if a future
+       * adversarial test demands per-file stripping.
+       */
+      async collapseNetZeroFiles(patches) {
+        if (patches.length === 0) return patches;
+        const stateByFile = /* @__PURE__ */ new Map();
+        for (const patch5 of patches) {
+          for (const header of parsePatchFileHeaders(patch5.patch_content)) {
+            if (!header.isCreate && !header.isDelete) continue;
+            const prior = stateByFile.get(header.path) ?? { created: false, deleted: false };
+            if (header.isCreate) prior.created = true;
+            if (header.isDelete) prior.deleted = true;
+            stateByFile.set(header.path, prior);
+          }
+        }
+        let anyCandidate = false;
+        for (const state of stateByFile.values()) {
+          if (state.created && state.deleted) {
+            anyCandidate = true;
+            break;
+          }
+        }
+        if (!anyCandidate) return patches;
+        const headFiles = await this.listHeadFiles();
+        const transient = /* @__PURE__ */ new Set();
+        for (const [file4, state] of stateByFile) {
+          if (state.created && state.deleted && !headFiles.has(file4)) {
+            transient.add(file4);
+          }
+        }
+        if (transient.size === 0) return patches;
+        return patches.filter((patch5) => !patch5.files.every((f10) => transient.has(f10)));
+      }
+      /**
+       * List every tracked path at HEAD (one `git ls-tree -r` invocation).
+       * Returns an empty Set if HEAD is unborn or the invocation fails — the
+       * caller then treats every candidate as "not in HEAD" and may collapse
+       * more aggressively. On typical SDK repos this is a single sub-10ms call.
+       */
+      async listHeadFiles() {
+        try {
+          const out = await this.git.exec(["ls-tree", "-r", "--name-only", "HEAD"]);
+          return new Set(out.split("\n").map((l14) => l14.trim()).filter(Boolean));
+        } catch {
+          return /* @__PURE__ */ new Set();
+        }
+      }
       /**
        * Create a single composite patch for a merge commit by diffing the merge
        * commit against its first parent. This captures the net change of the
@@ -351700,7 +351923,14 @@ var require_dist14 = __commonJS({
           firstParent,
           mergeCommit.sha
         ]);
-        const files = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10)).filter((f10) => !f10.startsWith(".fern/"));
+        const allMergeFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10)).filter((f10) => !f10.startsWith(".fern/"));
+        const sensitiveMergeFiles = allMergeFiles.filter((f10) => isSensitiveFile(f10));
+        const files = allMergeFiles.filter((f10) => !isSensitiveFile(f10));
+        if (sensitiveMergeFiles.length > 0) {
+          this.warnings.push(
+            `Sensitive file(s) excluded from merge patch for commit ${mergeCommit.sha.slice(0, 7)}: ${sensitiveMergeFiles.join(", ")}. These files will not be tracked by replay.`
+          );
+        }
         if (files.length === 0) return null;
         const diff2 = await this.git.exec([
           "diff",
@@ -351722,7 +351952,8 @@ var require_dist14 = __commonJS({
           original_author: `${mergeCommit.authorName} <${mergeCommit.authorEmail}>`,
           base_generation: lastGen.commit_sha,
           files,
-          patch_content: diff2
+          patch_content: diff2,
+          ...this.isCreationOnlyPatch(diff2) ? { user_owned: true } : {}
         };
       }
       /**
@@ -351736,7 +351967,14 @@ var require_dist14 = __commonJS({
           return this.detectPatchesViaCommitScan();
         }
         const filesOutput = await this.git.exec(["diff", "--name-only", diffBase, "HEAD"]);
-        const files = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10)).filter((f10) => !f10.startsWith(".fern/"));
+        const allTreeFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10)).filter((f10) => !f10.startsWith(".fern/"));
+        const sensitiveTreeFiles = allTreeFiles.filter((f10) => isSensitiveFile(f10));
+        const files = allTreeFiles.filter((f10) => !isSensitiveFile(f10));
+        if (sensitiveTreeFiles.length > 0) {
+          this.warnings.push(
+            `Sensitive file(s) excluded from composite patch: ${sensitiveTreeFiles.join(", ")}. These files will not be tracked by replay.`
+          );
+        }
         if (files.length === 0) return { patches: [], revertedPatchIds: [] };
         const diff2 = await this.git.exec(["diff", diffBase, "HEAD", "--", ...files]);
         if (!diff2.trim()) return { patches: [], revertedPatchIds: [] };
@@ -351756,7 +351994,8 @@ var require_dist14 = __commonJS({
           // reference to find base file content. diffBase may be the tree_hash.
           base_generation: commitKnownMissing ? diffBase : lastGen.commit_sha,
           files,
-          patch_content: diff2
+          patch_content: diff2,
+          ...this.isCreationOnlyPatch(diff2) ? { user_owned: true } : {}
         };
         return { patches: [compositePatch], revertedPatchIds: [] };
       }
@@ -351803,7 +352042,7 @@ var require_dist14 = __commonJS({
           } catch {
             continue;
           }
-          const contentHash = this.computeContentHash(patchContent);
+          let contentHash = this.computeContentHash(patchContent);
           if (existingHashes.has(contentHash) || forgottenHashes.has(contentHash)) {
             continue;
           }
@@ -351811,7 +352050,26 @@ var require_dist14 = __commonJS({
             continue;
           }
           const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-          const files = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10));
+          const allScanFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f10) => !INFRASTRUCTURE_FILES.has(f10));
+          const sensitiveScanFiles = allScanFiles.filter((f10) => isSensitiveFile(f10));
+          const files = allScanFiles.filter((f10) => !isSensitiveFile(f10));
+          if (sensitiveScanFiles.length > 0) {
+            this.warnings.push(
+              `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveScanFiles.join(", ")}. These files will not be tracked by replay.`
+            );
+            if (files.length > 0) {
+              if (parents.length === 0) {
+                continue;
+              }
+              try {
+                patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
+              } catch {
+                continue;
+              }
+              if (!patchContent.trim()) continue;
+              contentHash = this.computeContentHash(patchContent);
+            }
+          }
           if (files.length === 0) {
             continue;
           }
@@ -352135,6 +352393,20 @@ var require_dist14 = __commonJS({
       resetAccumulator() {
         this.fileTheirsAccumulator.clear();
       }
+      /**
+       * @internal Test-only.
+       * Returns a defensive copy of the inter-patch accumulator. Used by the
+       * adversarial test suite (FER-9791) to assert invariant I2: after every
+       * applied patch, the accumulator has an entry for each file the patch
+       * touched, and the entry's content matches on-disk.
+       */
+      getAccumulatorSnapshot() {
+        const snapshot = /* @__PURE__ */ new Map();
+        for (const [path98, entry] of this.fileTheirsAccumulator) {
+          snapshot.set(path98, { content: entry.content, baseGeneration: entry.baseGeneration });
+        }
+        return snapshot;
+      }
       /**
        * Apply all patches, returning results for each.
        * Skips patches that match exclude patterns in replay.yml
@@ -352200,7 +352472,7 @@ var require_dist14 = __commonJS({
             const base4 = await this.git.showFile(baseGen.tree_hash, filePath);
             const theirs = await this.applyPatchToContent(base4, patch5.patch_content, filePath, tempGit, tempDir2);
             const effectiveTheirs = theirs ?? await (0, import_promises183.readFile)((0, import_node_path210.join)(this.outputDir, resolvedPath), "utf-8").catch(() => null);
-            if (effectiveTheirs) {
+            if (effectiveTheirs != null) {
               this.fileTheirsAccumulator.set(resolvedPath, {
                 content: effectiveTheirs,
                 baseGeneration: patch5.base_generation
@@ -352224,16 +352496,20 @@ var require_dist14 = __commonJS({
             return this.fileTheirsAccumulator.has(resolved);
           })
         ).then((results) => results.some(Boolean));
-        if (!needsAccumulation) {
+        const resolvedFiles = {};
+        for (const filePath of patch5.files) {
+          const resolvedPath = baseGen ? await this.resolveFilePath(filePath, baseGen.tree_hash, currentTreeHash) : filePath;
+          if (resolvedPath !== filePath) {
+            resolvedFiles[filePath] = resolvedPath;
+          }
+        }
+        const patchIsRenameAware = /^rename from /m.test(patch5.patch_content);
+        const hasGeneratorRename = Object.keys(resolvedFiles).length > 0 && !patchIsRenameAware;
+        if (!needsAccumulation && !hasGeneratorRename) {
           const snapshots = /* @__PURE__ */ new Map();
-          const resolvedFiles = {};
           for (const filePath of patch5.files) {
-            const resolvedPath = baseGen ? await this.resolveFilePath(filePath, baseGen.tree_hash, currentTreeHash) : filePath;
-            if (resolvedPath !== filePath) {
-              resolvedFiles[filePath] = resolvedPath;
-            }
-            const fullPath = (0, import_node_path210.join)(this.outputDir, resolvedPath);
-            snapshots.set(resolvedPath, await (0, import_promises183.readFile)(fullPath, "utf-8").catch(() => null));
+            const fullPath = (0, import_node_path210.join)(this.outputDir, filePath);
+            snapshots.set(filePath, await (0, import_promises183.readFile)(fullPath, "utf-8").catch(() => null));
           }
           try {
             await this.git.execWithInput(["apply", "--3way"], patch5.patch_content);
@@ -352245,8 +352521,8 @@ var require_dist14 = __commonJS({
               ...Object.keys(resolvedFiles).length > 0 && { resolvedFiles }
             };
           } catch {
-            for (const [resolvedPath, content5] of snapshots) {
-              const fullPath = (0, import_node_path210.join)(this.outputDir, resolvedPath);
+            for (const [filePath, content5] of snapshots) {
+              const fullPath = (0, import_node_path210.join)(this.outputDir, filePath);
               if (content5 != null) {
                 await (0, import_promises183.writeFile)(fullPath, content5);
               } else {
@@ -352366,7 +352642,7 @@ var require_dist14 = __commonJS({
           }
           let useAccumulatorAsMergeBase = false;
           const accumulatorEntry = this.fileTheirsAccumulator.get(resolvedPath);
-          if (accumulatorEntry && (!theirs || base4 == null)) {
+          if (accumulatorEntry && (theirs == null || base4 == null)) {
             theirs = await this.applyPatchToContent(
               accumulatorEntry.content,
               patch5.patch_content,
@@ -352374,7 +352650,16 @@ var require_dist14 = __commonJS({
               tempGit,
               tempDir2
             );
-            if (theirs) {
+            if (theirs != null) {
+              useAccumulatorAsMergeBase = true;
+            } else if (await this.isPatchAlreadyApplied(
+              patch5.patch_content,
+              filePath,
+              accumulatorEntry.content,
+              tempGit,
+              tempDir2
+            )) {
+              theirs = accumulatorEntry.content;
               useAccumulatorAsMergeBase = true;
             }
           }
@@ -352391,7 +352676,7 @@ var require_dist14 = __commonJS({
           }
           let effective_theirs = theirs;
           let baseMismatchSkipped = false;
-          if (theirs && base4 && !useAccumulatorAsMergeBase) {
+          if (theirs != null && base4 != null && !useAccumulatorAsMergeBase) {
             if (accumulatorEntry && accumulatorEntry.baseGeneration === patch5.base_generation) {
               try {
                 const preMerged = threeWayMerge(base4, accumulatorEntry.content, theirs);
@@ -352407,7 +352692,7 @@ var require_dist14 = __commonJS({
               baseMismatchSkipped = true;
             }
           }
-          if (base4 == null && !ours && effective_theirs) {
+          if (base4 == null && ours == null && effective_theirs != null) {
             this.fileTheirsAccumulator.set(resolvedPath, {
               content: effective_theirs,
               baseGeneration: patch5.base_generation
@@ -352417,7 +352702,7 @@ var require_dist14 = __commonJS({
             await (0, import_promises183.writeFile)(oursPath, effective_theirs);
             return { file: resolvedPath, status: "merged", reason: "new-file" };
           }
-          if (base4 == null && ours && effective_theirs && !useAccumulatorAsMergeBase) {
+          if (base4 == null && ours != null && effective_theirs != null && !useAccumulatorAsMergeBase) {
             const merged2 = threeWayMerge("", ours, effective_theirs);
             const outDir2 = (0, import_node_path210.dirname)(oursPath);
             await (0, import_promises183.mkdir)(outDir2, { recursive: true });
@@ -352431,16 +352716,20 @@ var require_dist14 = __commonJS({
                 conflictMetadata: metadata
               };
             }
+            this.fileTheirsAccumulator.set(resolvedPath, {
+              content: merged2.content,
+              baseGeneration: patch5.base_generation
+            });
             return { file: resolvedPath, status: "merged" };
           }
-          if (!effective_theirs) {
+          if (effective_theirs == null) {
             return {
               file: resolvedPath,
               status: "skipped",
               reason: "missing-content"
             };
           }
-          if (base4 == null && !useAccumulatorAsMergeBase || !ours) {
+          if (base4 == null && !useAccumulatorAsMergeBase || ours == null) {
             return {
               file: resolvedPath,
               status: "skipped",
@@ -352459,7 +352748,7 @@ var require_dist14 = __commonJS({
           const outDir = (0, import_node_path210.dirname)(oursPath);
           await (0, import_promises183.mkdir)(outDir, { recursive: true });
           await (0, import_promises183.writeFile)(oursPath, merged.content);
-          if (effective_theirs && !merged.hasConflicts) {
+          if (effective_theirs != null && !merged.hasConflicts) {
             this.fileTheirsAccumulator.set(resolvedPath, {
               content: effective_theirs,
               baseGeneration: patch5.base_generation
@@ -352557,6 +352846,28 @@ var require_dist14 = __commonJS({
           return null;
         }
       }
+      /**
+       * Detects whether a patch's additions are already present in `content`.
+       * Uses `git apply --reverse --check` — if the reverse patch applies cleanly,
+       * the forward patch is effectively a no-op (its +lines are already there and
+       * its -lines are already gone). Used to distinguish "patch already applied"
+       * from "patch base mismatch" after a forward-apply fails.
+       */
+      async isPatchAlreadyApplied(patchContent, filePath, content5, tempGit, tempDir2) {
+        const fileDiff = this.extractFileDiff(patchContent, filePath);
+        if (!fileDiff) return false;
+        try {
+          const tempFilePath = (0, import_node_path210.join)(tempDir2, filePath);
+          await (0, import_promises183.mkdir)((0, import_node_path210.dirname)(tempFilePath), { recursive: true });
+          await (0, import_promises183.writeFile)(tempFilePath, content5);
+          await tempGit.exec(["add", filePath]);
+          await tempGit.exec(["commit", "-m", `check already-applied ${filePath}`, "--allow-empty"]);
+          await tempGit.execWithInput(["apply", "--reverse", "--check", "--allow-empty"], fileDiff);
+          return true;
+        } catch {
+          return false;
+        }
+      }
       extractFileDiff(patchContent, filePath) {
         const lines = patchContent.split("\n");
         const diffLines = [];
@@ -352721,6 +353032,33 @@ CLI Version: ${options2.cliVersion}`;
       committer;
       lockManager;
       outputDir;
+      /** @internal Test-only. Captures the last ReplayResult[] returned from applicator.applyPatches(). */
+      _lastApplyResults = [];
+      /**
+       * Service-level warnings accumulated during a single runReplay() call.
+       * Merged with `detector.warnings` into `ReplayReport.warnings` by each flow handler.
+       * Populated by `isFileUserOwned` when a patch's base generation tree is unreachable
+       * (shallow clone / aggressive `git gc --prune`) and we fall back to a conservative
+       * heuristic. Cleared at the top of `runReplay()`.
+       */
+      warnings = [];
+      /**
+       * @internal Test-only accessor.
+       * Returns the ReplayApplicator instance used for the last run. Tests use this
+       * to inspect the inter-patch accumulator after runReplay() completes (FER-9791, I2).
+       */
+      get applicatorRef() {
+        return this.applicator;
+      }
+      /**
+       * @internal Test-only accessor.
+       * Returns the ReplayResult[] from the most recent applyPatches() call. Tests use
+       * this to filter applied-vs-conflicted-vs-absorbed patches for invariant assertions
+       * (FER-9791). Returns an empty array if no patches have been applied yet.
+       */
+      getLastResults() {
+        return this._lastApplyResults;
+      }
       constructor(outputDir, _config) {
         const git = new GitClient2(outputDir);
         this.git = git;
@@ -352731,6 +353069,7 @@ CLI Version: ${options2.cliVersion}`;
         this.committer = new ReplayCommitter(git, outputDir);
       }
       async runReplay(options2) {
+        this.warnings = [];
         if (options2?.skipApplication) {
           return this.handleSkipApplication(options2);
         }
@@ -352804,6 +353143,7 @@ CLI Version: ${options2.cliVersion}`;
           );
         }
         this.lockManager.save();
+        this.detector.warnings.push(...this.lockManager.warnings);
       }
       determineFlow() {
         try {
@@ -352870,6 +353210,7 @@ CLI Version: ${options2.cliVersion}`;
         }
         this.lockManager.setReplaySkippedAt((/* @__PURE__ */ new Date()).toISOString());
         this.lockManager.save();
+        const credentialWarnings = [...this.lockManager.warnings];
         if (!options2?.stageOnly) {
           await this.committer.commitReplay(0);
         } else {
@@ -352881,13 +353222,15 @@ CLI Version: ${options2.cliVersion}`;
           patchesApplied: 0,
           patchesWithConflicts: 0,
           patchesSkipped: 0,
-          conflicts: []
+          conflicts: [],
+          warnings: credentialWarnings.length > 0 ? credentialWarnings : void 0
         };
       }
       async handleNoPatchesRegeneration(options2) {
-        const { patches: newPatches, revertedPatchIds } = await this.detector.detectNewPatches();
-        const warnings = [...this.detector.warnings];
+        let { patches: newPatches, revertedPatchIds } = await this.detector.detectNewPatches();
+        const detectorWarnings = [...this.detector.warnings];
         if (options2?.dryRun) {
+          const dryRunWarnings = [...detectorWarnings, ...this.warnings];
           return {
             flow: "no-patches",
             patchesDetected: newPatches.length,
@@ -352897,9 +353240,26 @@ CLI Version: ${options2.cliVersion}`;
             patchesReverted: revertedPatchIds.length,
             conflicts: [],
             wouldApply: newPatches,
-            warnings: warnings.length > 0 ? warnings : void 0
+            warnings: dryRunWarnings.length > 0 ? dryRunWarnings : void 0
           };
         }
+        {
+          const preLock = this.lockManager.read();
+          const preCurrentGen = preLock.current_generation;
+          const uniqueFiles = [...new Set(newPatches.flatMap((p10) => p10.files))];
+          const absorbedFiles = /* @__PURE__ */ new Set();
+          for (const file4 of uniqueFiles) {
+            const diff2 = await this.git.exec(["diff", preCurrentGen, "HEAD", "--", file4]).catch(() => null);
+            if (diff2 !== null && !diff2.trim()) {
+              absorbedFiles.add(file4);
+            }
+          }
+          if (absorbedFiles.size > 0) {
+            newPatches = newPatches.filter(
+              (p10) => p10.files.length === 0 || !p10.files.every((f10) => absorbedFiles.has(f10))
+            );
+          }
+        }
         for (const id2 of revertedPatchIds) {
           try {
             this.lockManager.removePatch(id2);
@@ -352918,6 +353278,7 @@ CLI Version: ${options2.cliVersion}`;
         let results = [];
         if (newPatches.length > 0) {
           results = await this.applicator.applyPatches(newPatches);
+          this._lastApplyResults = results;
           this.revertConflictingFiles(results);
           for (const result of results) {
             if (result.status === "conflict") {
@@ -352932,6 +353293,7 @@ CLI Version: ${options2.cliVersion}`;
           }
         }
         this.lockManager.save();
+        this.warnings.push(...this.lockManager.warnings);
         if (newPatches.length > 0) {
           if (!options2?.stageOnly) {
             const appliedCount = results.filter((r23) => r23.status === "applied").length;
@@ -352940,13 +353302,14 @@ CLI Version: ${options2.cliVersion}`;
             await this.committer.stageAll();
           }
         }
+        const warnings = [...detectorWarnings, ...this.warnings];
         return this.buildReport("no-patches", newPatches, results, options2, warnings, rebaseCounts, void 0, revertedPatchIds.length);
       }
       async handleNormalRegeneration(options2) {
         if (options2?.dryRun) {
           const existingPatches2 = this.lockManager.getPatches();
           const { patches: newPatches2, revertedPatchIds: dryRunReverted } = await this.detector.detectNewPatches();
-          const warnings2 = [...this.detector.warnings];
+          const warnings2 = [...this.detector.warnings, ...this.warnings];
           const allPatches2 = [...existingPatches2, ...newPatches2];
           return {
             flow: "normal-regeneration",
@@ -352978,7 +353341,7 @@ CLI Version: ${options2.cliVersion}`;
         }
         existingPatches = this.lockManager.getPatches();
         let { patches: newPatches, revertedPatchIds } = await this.detector.detectNewPatches();
-        const warnings = [...this.detector.warnings];
+        const detectorWarnings = [...this.detector.warnings];
         if (removedByPreRebase.length > 0) {
           const removedOriginalCommits = new Set(removedByPreRebase.map((p10) => p10.original_commit));
           const removedOriginalMessages = new Set(removedByPreRebase.map((p10) => p10.original_message));
@@ -353010,6 +353373,7 @@ CLI Version: ${options2.cliVersion}`;
         const genRecord = await this.committer.createGenerationRecord(commitOpts);
         this.lockManager.addGeneration(genRecord);
         const results = await this.applicator.applyPatches(allPatches);
+        this._lastApplyResults = results;
         this.revertConflictingFiles(results);
         for (const result of results) {
           if (result.status === "conflict") {
@@ -353031,12 +353395,14 @@ CLI Version: ${options2.cliVersion}`;
           }
         }
         this.lockManager.save();
+        this.warnings.push(...this.lockManager.warnings);
         if (options2?.stageOnly) {
           await this.committer.stageAll();
         } else {
           const appliedCount = results.filter((r23) => r23.status === "applied").length;
           await this.committer.commitReplay(appliedCount, allPatches);
         }
+        const warnings = [...detectorWarnings, ...this.warnings];
         return this.buildReport(
           "normal-regeneration",
           allPatches,
@@ -353060,6 +353426,7 @@ CLI Version: ${options2.cliVersion}`;
         let keptAsUserOwned = 0;
         const seenContentHashes = /* @__PURE__ */ new Set();
         const absorbedPatchIds = /* @__PURE__ */ new Set();
+        const fernignorePatterns = this.readFernignorePatterns();
         for (const result of results) {
           if (result.resolvedFiles && Object.keys(result.resolvedFiles).length > 0) {
             const patch5 = result.patch;
@@ -353080,34 +353447,78 @@ CLI Version: ${options2.cliVersion}`;
           const patch5 = result.patch;
           if (patch5.base_generation === currentGenSha) continue;
           try {
-            const fernignorePatterns = this.readFernignorePatterns();
-            const isUserOwned = await Promise.all(
+            const originalByResolved = {};
+            if (result.resolvedFiles) {
+              for (const [orig, resolved] of Object.entries(result.resolvedFiles)) {
+                originalByResolved[resolved] = orig;
+              }
+            }
+            const isUserOwnedPerFile = await Promise.all(
               patch5.files.map(async (file4) => {
-                if (file4 === ".fernignore") {
+                if (file4 === ".fernignore") return true;
+                if (fernignorePatterns.some((p10) => file4 === p10 || (0, import_minimatch22.minimatch)(file4, p10))) {
                   return true;
                 }
-                if (fernignorePatterns.some((p10) => file4 === p10 || (0, import_minimatch22.minimatch)(file4, p10))) {
+                if (patch5.user_owned) return true;
+                if (this.fileIsCreationInPatchContent(patch5.patch_content, originalByResolved[file4] ?? file4)) {
                   return true;
                 }
                 const content5 = await this.git.showFile(currentGenSha, file4);
                 return content5 === null;
               })
             );
-            const hasUserOwnedFiles = isUserOwned.some(Boolean);
-            if (hasUserOwnedFiles) {
-              this.lockManager.updatePatch(patch5.id, {
-                base_generation: currentGenSha
-              });
+            const hasProtectedFiles = patch5.files.some(
+              (file4) => file4 === ".fernignore" || fernignorePatterns.some((p10) => file4 === p10 || (0, import_minimatch22.minimatch)(file4, p10))
+            );
+            const allUserOwned = isUserOwnedPerFile.every(Boolean);
+            if (allUserOwned && patch5.files.length > 0) {
+              const baseChanged = patch5.base_generation !== currentGenSha;
+              const userDiff = await this.git.exec(["diff", currentGenSha, "--", ...patch5.files]).catch(() => null);
+              if (userDiff != null && userDiff.trim()) {
+                const newHash = this.detector.computeContentHash(userDiff);
+                patch5.patch_content = userDiff;
+                patch5.content_hash = newHash;
+              }
+              patch5.base_generation = currentGenSha;
+              try {
+                this.lockManager.updatePatch(patch5.id, {
+                  base_generation: currentGenSha,
+                  ...!patch5.user_owned ? { user_owned: true } : {},
+                  ...userDiff != null && userDiff.trim() ? { patch_content: patch5.patch_content, content_hash: patch5.content_hash } : {}
+                });
+              } catch {
+              }
+              patch5.user_owned = true;
               keptAsUserOwned++;
+              if (baseChanged) repointed++;
               continue;
             }
             const diff2 = await this.git.exec(["diff", currentGenSha, "--", ...patch5.files]).catch(() => null);
-            if (!diff2 || !diff2.trim()) {
+            if (diff2 === null) continue;
+            if (!diff2.trim()) {
+              if (hasProtectedFiles) {
+                patch5.base_generation = currentGenSha;
+                try {
+                  this.lockManager.updatePatch(patch5.id, { base_generation: currentGenSha });
+                } catch {
+                }
+                keptAsUserOwned++;
+                continue;
+              }
               this.lockManager.removePatch(patch5.id);
               absorbedPatchIds.add(patch5.id);
               absorbed++;
               continue;
             }
+            if (hasProtectedFiles) {
+              patch5.base_generation = currentGenSha;
+              try {
+                this.lockManager.updatePatch(patch5.id, { base_generation: currentGenSha });
+              } catch {
+              }
+              keptAsUserOwned++;
+              continue;
+            }
             const newContentHash = this.detector.computeContentHash(diff2);
             if (seenContentHashes.has(newContentHash)) {
               this.lockManager.removePatch(patch5.id);
@@ -353116,17 +353527,89 @@ CLI Version: ${options2.cliVersion}`;
               continue;
             }
             seenContentHashes.add(newContentHash);
-            this.lockManager.updatePatch(patch5.id, {
-              base_generation: currentGenSha,
-              patch_content: diff2,
-              content_hash: newContentHash
-            });
+            patch5.base_generation = currentGenSha;
+            patch5.patch_content = diff2;
+            patch5.content_hash = newContentHash;
+            try {
+              this.lockManager.updatePatch(patch5.id, {
+                base_generation: currentGenSha,
+                patch_content: diff2,
+                content_hash: newContentHash
+              });
+            } catch {
+            }
             contentRebased++;
           } catch {
           }
         }
         return { absorbed, repointed, contentRebased, keptAsUserOwned, absorbedPatchIds };
       }
+      /**
+       * Determine whether `file` is user-owned (never produced by the generator).
+       *
+       * Resolution order (first match wins):
+       *  1. `patch.user_owned === true` — authoritative, persisted across cycles.
+       *  2. `.fernignore` itself, or file matches a .fernignore pattern.
+       *  3. Legacy-safe signal: `patch_content` shows this file as a `--- /dev/null`
+       *     creation. Works for patches that predate the `user_owned` field or
+       *     whose flag was lost. Immune to rename tricks — relies on raw patch text.
+       *  4. Tree-based check against `patch.base_generation` when it is reachable
+       *     AND distinct from `currentGenSha`. If the base tree is unreachable
+       *     (shallow clone / aggressive `git gc --prune`), emit a one-time
+       *     customer-actionable warning (deduplicated via warnedGens) and
+       *     conservatively treat as user-owned — strictly safer than silent
+       *     absorption (FER-9809).
+       *  5. Final fallback — check `currentGenSha` when there is no usable base
+       *     (legacy one-gen lockfile). Preserves pre-fix behavior for that edge.
+       *
+       * `originalFileName` is the pre-rename path when the generator moved the
+       * file between the patch's base and the current generation. Tree lookups
+       * at ancestor generations use the original path — that's where the
+       * generator produced the content.
+       */
+      async isFileUserOwned(file4, patch5, currentGenSha, fernignorePatterns, warnedGens, originalFileName) {
+        if (patch5.user_owned) return true;
+        if (file4 === ".fernignore") return true;
+        if (fernignorePatterns.some((p10) => file4 === p10 || (0, import_minimatch22.minimatch)(file4, p10))) return true;
+        if (this.fileIsCreationInPatchContent(patch5.patch_content, originalFileName ?? file4)) {
+          return true;
+        }
+        const base4 = patch5.base_generation;
+        if (base4 && base4 !== currentGenSha) {
+          const reachable = await this.git.commitExists(base4) || await this.git.treeExists(base4);
+          if (!reachable) {
+            if (!warnedGens.has(base4)) {
+              warnedGens.add(base4);
+              this.warnings.push(
+                `Base generation ${base4.slice(0, 7)} is unreachable (shallow clone or pruned history). Treating affected files as user-owned to avoid silent data loss. Run \`git fetch --unshallow\` or avoid \`git gc --prune\` to restore full history.`
+              );
+            }
+            return true;
+          }
+          return await this.git.showFile(base4, originalFileName ?? file4) === null;
+        }
+        return await this.git.showFile(currentGenSha, originalFileName ?? file4) === null;
+      }
+      /**
+       * Returns true if `file`'s diff section in `patchContent` starts with
+       * `--- /dev/null`, meaning this file was introduced by the patch (user
+       * creation). Used as a legacy-safe fallback when `patch.user_owned` is
+       * absent or cleared.
+       */
+      fileIsCreationInPatchContent(patchContent, file4) {
+        const lines = patchContent.split("\n");
+        let inFileSection = false;
+        for (const line of lines) {
+          if (line.startsWith("diff --git ")) {
+            inFileSection = line.includes(` b/${file4}`) || line.endsWith(` b/${file4}`);
+            continue;
+          }
+          if (inFileSection && line.startsWith("--- ")) {
+            return line === "--- /dev/null";
+          }
+        }
+        return false;
+      }
       /**
        * For conflict patches with mixed results (some files merged, some conflicted),
        * check if the cleanly merged files were absorbed by the generator (empty diff).
@@ -353140,13 +353623,14 @@ CLI Version: ${options2.cliVersion}`;
         const cleanFiles = result.fileResults.filter((f10) => f10.status === "merged").map((f10) => f10.file);
         if (cleanFiles.length === 0) return;
         const patch5 = result.patch;
+        if (patch5.user_owned) return;
         const fernignorePatterns = this.readFernignorePatterns();
+        const warnedGens = /* @__PURE__ */ new Set();
         const generatorCleanFiles = [];
         for (const file4 of cleanFiles) {
-          if (file4 === ".fernignore") continue;
-          if (fernignorePatterns.some((p10) => file4 === p10 || (0, import_minimatch22.minimatch)(file4, p10))) continue;
-          const content5 = await this.git.showFile(currentGenSha, file4);
-          if (content5 === null) continue;
+          if (await this.isFileUserOwned(file4, patch5, currentGenSha, fernignorePatterns, warnedGens)) {
+            continue;
+          }
           generatorCleanFiles.push(file4);
         }
         if (generatorCleanFiles.length === 0) return;
@@ -353183,7 +353667,35 @@ CLI Version: ${options2.cliVersion}`;
         let conflictResolved = 0;
         let conflictAbsorbed = 0;
         let contentRefreshed = 0;
+        const fernignorePatterns = this.readFernignorePatterns();
+        const warnedGens = /* @__PURE__ */ new Set();
+        const reachabilityCache = /* @__PURE__ */ new Map();
+        const isReachable = async (sha) => {
+          const cached2 = reachabilityCache.get(sha);
+          if (cached2 !== void 0) return cached2;
+          const reachable = await this.git.commitExists(sha) || await this.git.treeExists(sha);
+          reachabilityCache.set(sha, reachable);
+          return reachable;
+        };
+        const allPatchFilesUserOwned = async (patch5) => {
+          if (patch5.user_owned) return true;
+          if (patch5.files.length === 0) return false;
+          for (const file4 of patch5.files) {
+            if (!await this.isFileUserOwned(file4, patch5, currentGen, fernignorePatterns, warnedGens)) {
+              return false;
+            }
+          }
+          return true;
+        };
         for (const patch5 of patches) {
+          if (patch5.base_generation && patch5.base_generation !== currentGen && !warnedGens.has(patch5.base_generation)) {
+            if (!await isReachable(patch5.base_generation)) {
+              warnedGens.add(patch5.base_generation);
+              this.warnings.push(
+                `Base generation ${patch5.base_generation.slice(0, 7)} is unreachable (shallow clone or pruned history). Treating affected files as user-owned to avoid silent data loss. Run \`git fetch --unshallow\` or avoid \`git gc --prune\` to restore full history.`
+              );
+            }
+          }
           if (patch5.status != null) {
             delete patch5.status;
             continue;
@@ -353193,6 +353705,7 @@ CLI Version: ${options2.cliVersion}`;
               const diff2 = await this.git.exec(["diff", currentGen, "HEAD", "--", ...patch5.files]).catch(() => null);
               if (diff2 === null) continue;
               if (!diff2.trim()) {
+                if (await allPatchFilesUserOwned(patch5)) continue;
                 this.lockManager.removePatch(patch5.id);
                 contentRefreshed++;
                 continue;
@@ -353204,6 +353717,12 @@ CLI Version: ${options2.cliVersion}`;
               if (hasStaleMarkers) {
                 continue;
               }
+              const isProtected = patch5.files.some(
+                (file4) => file4 === ".fernignore" || fernignorePatterns.some((p10) => file4 === p10 || (0, import_minimatch22.minimatch)(file4, p10))
+              );
+              if (isProtected) {
+                continue;
+              }
               const newContentHash = this.detector.computeContentHash(diff2);
               if (newContentHash !== patch5.content_hash) {
                 const filesOutput = await this.git.exec(["diff", "--name-only", currentGen, "HEAD", "--", ...patch5.files]).catch(() => null);
@@ -353229,6 +353748,13 @@ CLI Version: ${options2.cliVersion}`;
             const diff2 = await this.git.exec(["diff", currentGen, "HEAD", "--", ...patch5.files]).catch(() => null);
             if (diff2 === null) continue;
             if (!diff2.trim()) {
+              if (await allPatchFilesUserOwned(patch5)) {
+                try {
+                  this.lockManager.updatePatch(patch5.id, { base_generation: currentGen });
+                } catch {
+                }
+                continue;
+              }
               this.lockManager.removePatch(patch5.id);
               conflictAbsorbed++;
               continue;
@@ -353736,7 +354262,10 @@ CLI Version: ${options2.cliVersion}`;
       (0, import_node_fs42.writeFileSync)(gitattributesPath, content5, "utf-8");
     }
     function computeContentHash(patchContent) {
-      const normalized = patchContent.split("\n").filter((line) => !line.startsWith("From ") && !line.startsWith("index ") && !line.startsWith("Date: ")).join("\n");
+      const lines = patchContent.split("\n");
+      const diffStart = lines.findIndex((l14) => l14.startsWith("diff --git "));
+      const relevantLines = diffStart > 0 ? lines.slice(diffStart) : lines;
+      const normalized = relevantLines.filter((line) => !line.startsWith("index ")).join("\n").replace(/\n-- \n[\d]+\.[\d]+[^\n]*\s*$/, "");
       return `sha256:${(0, import_node_crypto32.createHash)("sha256").update(normalized).digest("hex")}`;
     }
     var import_minimatch42 = require_commonjs3();
@@ -354121,6 +354650,7 @@ var require_replay_run = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.replayRun = replayRun;
+    exports2.isTagMergedIntoHead = isTagMergedIntoHead;
     var replay_1 = require_dist14();
     var child_process_1 = require("child_process");
     var fs_1 = require("fs");
@@ -354165,18 +354695,22 @@ var require_replay_run = __commonJS({
           }
         }
         if (shouldSync && tagSha != null) {
-          const syncService = new replay_1.ReplayService(outputDir, { enabled: true });
-          await syncService.syncFromDivergentMerge(tagSha, {
-            cliVersion,
-            generatorVersions,
-            baseBranchHead: baseBranchHead ?? void 0
-          });
-          try {
-            const freshLockManager = new replay_1.LockfileManager(outputDir);
-            if (freshLockManager.exists()) {
-              previousGenerationSha = freshLockManager.read().current_generation;
+          if (!isTagMergedIntoHead(outputDir, tagSha)) {
+            logger4?.warn(`fern-generation-base tag ${tagSha} is not reachable from HEAD \u2014 skipping divergent-merge sync. The tag likely points at an unmerged generation (PR closed without merge).`);
+          } else {
+            const syncService = new replay_1.ReplayService(outputDir, { enabled: true });
+            await syncService.syncFromDivergentMerge(tagSha, {
+              cliVersion,
+              generatorVersions,
+              baseBranchHead: baseBranchHead ?? void 0
+            });
+            try {
+              const freshLockManager = new replay_1.LockfileManager(outputDir);
+              if (freshLockManager.exists()) {
+                previousGenerationSha = freshLockManager.read().current_generation;
+              }
+            } catch {
             }
-          } catch {
           }
         }
       }
@@ -354226,6 +354760,30 @@ var require_replay_run = __commonJS({
         baseBranchHead: resolvedBaseBranchHead
       };
     }
+    function isTagMergedIntoHead(cwd2, tagSha) {
+      try {
+        (0, child_process_1.execFileSync)("git", ["merge-base", "--is-ancestor", tagSha, "HEAD"], {
+          cwd: cwd2,
+          stdio: "pipe"
+        });
+        return true;
+      } catch {
+      }
+      const tagTree = gitRevParse(cwd2, `${tagSha}^{tree}`);
+      if (tagTree == null) {
+        return false;
+      }
+      try {
+        const trees = (0, child_process_1.execFileSync)("git", ["log", "HEAD", "--format=%T", "--max-count=500"], {
+          cwd: cwd2,
+          encoding: "utf-8",
+          stdio: "pipe"
+        });
+        return trees.split("\n").some((t3) => t3.trim() === tagTree);
+      } catch {
+        return false;
+      }
+    }
     function gitRevParse(cwd2, rev) {
       try {
         return (0, child_process_1.execFileSync)("git", ["rev-parse", "--verify", rev], {
@@ -621394,7 +621952,7 @@ var AccessTokenPosthogManager = class {
         properties: {
           ...event,
           ...event.properties,
-          version: "4.75.0",
+          version: "4.76.0-1-g4629aee782f",
           usingAccessToken: true
         }
       });
@@ -621448,7 +622006,7 @@ var UserPosthogManager = class {
       distinctId: this.userId ?? await this.getPersistedDistinctId(),
       event: "CLI",
       properties: {
-        version: "4.75.0",
+        version: "4.76.0-1-g4629aee782f",
         ...event,
         ...event.properties,
         usingAccessToken: false,
@@ -838658,7 +839216,7 @@ var LOCAL_STORAGE_FOLDER4 = ".fern-dev";
 var LOGS_FOLDER_NAME = "logs";
 var MAX_LOGS_DIR_SIZE_BYTES = 100 * 1024 * 1024;
 function getCliSource() {
-  const version7 = "4.75.0";
+  const version7 = "4.76.0-1-g4629aee782f";
   return `cli@${version7}`;
 }
 var DebugLogger = class {
@@ -839024,7 +839582,7 @@ function isWithinOutputDir(resolvedPath, outputDir) {
   const rel2 = import_path55.default.relative(outputDir, resolvedPath);
   return !rel2.startsWith("..") && !import_path55.default.isAbsolute(rel2);
 }
-function resolveWindowsSymlinks(outputDir, symlinks, logger4) {
+function resolveWindowsSymlinks(outputDir, symlinks, logger4, onProgress) {
   if (symlinks.length === 0) {
     return;
   }
@@ -839094,6 +839652,7 @@ function resolveWindowsSymlinks(outputDir, symlinks, logger4) {
       logger4.debug(`Failed to resolve symlink ${symlinkPath}: ${error50}`);
       failed++;
     }
+    onProgress?.(junctions + copies + alreadyExisted + failed, symlinks.length);
   }
   logger4.debug(`Symlink resolution: ${junctions} junctions, ${copies} file copies, ${alreadyExisted} pre-existing, ${failed} failed (${fallbackUsed} via fallback) out of ${symlinks.length}`);
   const standaloneNM = import_path55.default.join(outputDir, "standalone", "node_modules");
@@ -839232,7 +839791,7 @@ async function downloadBundle({ bucketUrl, logger: logger4, preferCached, app =
         hideCursor: true
       });
       unzipProgressBar.start(100, 0);
-      const UNZIP_DURATION_MS = 3e4;
+      const UNZIP_DURATION_MS = PLATFORM_IS_WINDOWS ? 6e4 : 3e4;
       const startTime = Date.now();
       unzipInterval = setInterval(() => {
         const elapsed = Date.now() - startTime;
@@ -839269,7 +839828,21 @@ async function downloadBundle({ bucketUrl, logger: logger4, preferCached, app =
       }
     }
     if (PLATFORM_IS_WINDOWS && collectedSymlinks.length > 0) {
-      resolveWindowsSymlinks(absolutePathToBundleFolder, collectedSymlinks, logger4);
+      let symlinkProgressBar;
+      if (app) {
+        symlinkProgressBar = new import_cli_progress.default.SingleBar({
+          format: `${DOCS_PREFIX} ${formatProgressLabel("Patching symlinks")} [{bar}] {percentage}% | {value}/{total}`,
+          barCompleteChar: "\u2588",
+          barIncompleteChar: "\u2591",
+          hideCursor: true
+        });
+        symlinkProgressBar.start(collectedSymlinks.length, 0);
+      }
+      resolveWindowsSymlinks(absolutePathToBundleFolder, collectedSymlinks, logger4, symlinkProgressBar ? (resolved, total) => symlinkProgressBar?.update(resolved) : void 0);
+      if (symlinkProgressBar) {
+        symlinkProgressBar.update(collectedSymlinks.length);
+        symlinkProgressBar.stop();
+      }
     }
     await (0, import_promises78.writeFile)(eTagFilepath, eTag);
     logger4.debug(`Downloaded bundle to ${absolutePathToBundleFolder}`);
@@ -849958,7 +850531,7 @@ var LegacyDocsPublisher = class {
         previewId,
         disableTemplates: void 0,
         skipUpload,
-        cliVersion: "4.75.0"
+        cliVersion: "4.76.0-1-g4629aee782f"
       });
       if (taskContext.getResult() === TaskResult.Failure) {
         return { success: false };
@@ -924416,7 +924989,7 @@ var CliContext = class _CliContext {
     if (false) {
       this.logger.error("CLI_VERSION is not defined");
     }
-    return "4.75.0";
+    return "4.76.0-1-g4629aee782f";
   }
   getCliName() {
     if (false) {

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "4.75.0",
+  "version": "4.76.0-1-g4629aee782f",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fern-api/fern.git",