@fern-api/replay 0.10.4 → 0.11.0

package/dist/index.js

@@ -77,13 +77,30 @@ var init_GitClient = __esm({
         const output = await this.exec(["rev-parse", `${commitSha}^@`]);
         return output.trim().split("\n").filter(Boolean);
       }
+      /**
+       * Detects renames and copies between two trees.
+       *
+       * Both `R` (rename) and `C` (copy) entries are returned as `{from, to}` pairs.
+       * Copies are treated as rename-equivalent because the generator may produce the
+       * new path while the old path remains in the tree (e.g., imperfect cleanup,
+       * customer edits at the old path, or test helpers that only write new files).
+       * Callers that care about "is the source still present" should verify via
+       * `showFile(toTree, from)`.
+       */
       async detectRenames(fromTree, toTree) {
         try {
-          const output = await this.exec(["diff", "--find-renames", "--name-status", fromTree, toTree]);
+          const output = await this.exec([
+            "diff",
+            "--find-renames",
+            "--find-copies",
+            "--name-status",
+            fromTree,
+            toTree
+          ]);
           const renames = [];
           for (const line of output.trim().split("\n")) {
             if (!line) continue;
-            if (line.startsWith("R")) {
+            if (line.startsWith("R") || line.startsWith("C")) {
               const parts = line.split("	");
               if (parts.length >= 3) {
                 renames.push({ from: parts[1], to: parts[2] });
@@ -378,6 +395,39 @@ var init_HybridReconstruction = __esm({
   }
 });
 
+// src/credentials.ts
+var CREDENTIAL_PATTERNS = [
+  { name: "PRIVATE KEY block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "OPENSSH key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/ },
+  { name: "RSA key", re: /-----BEGIN RSA PRIVATE KEY-----/ },
+  { name: "CERTIFICATE", re: /-----BEGIN CERTIFICATE-----/ },
+  { name: "TOKEN=", re: /\bTOKEN\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/ },
+  { name: "api_key=", re: /\bapi[_-]?key\s*=\s*["']?[A-Za-z0-9._\-+/=]{10,}/i },
+  { name: "password=", re: /\bpassword\s*=\s*["']?[^\s"']{6,}/i },
+  { name: "AWS_SECRET_ACCESS_KEY", re: /AWS_SECRET_ACCESS_KEY/ },
+  { name: "JWT (eyJ...)", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ }
+];
+var SENSITIVE_FILE_PATTERNS = [
+  /(^|\/)\.env(\.[^/]+)?$/,
+  /\.pem$/,
+  /\.key$/,
+  /\.pkce_state\.json$/,
+  /(^|\/)id_rsa$/,
+  /(^|\/)id_ed25519$/
+];
+function isSensitiveFile(filePath) {
+  return SENSITIVE_FILE_PATTERNS.some((re) => re.test(filePath));
+}
+function scanForCredentials(content) {
+  const matches = [];
+  for (const { name, re } of CREDENTIAL_PATTERNS) {
+    if (re.test(content)) {
+      matches.push(name);
+    }
+  }
+  return matches;
+}
+
 // src/index.ts
 init_GitClient();
 
@@ -424,6 +474,7 @@ var LockfileNotFoundError = class extends Error {
 var LockfileManager = class {
   outputDir;
   lock = null;
+  warnings = [];
   constructor(outputDir) {
     this.outputDir = outputDir;
   }
@@ -472,6 +523,27 @@ var LockfileManager = class {
     if (!this.lock) {
       throw new Error("No lockfile data to save. Call read() or initialize() first.");
     }
+    this.warnings.length = 0;
+    const cleanPatches = [];
+    for (const patch of this.lock.patches) {
+      const credentialMatches = scanForCredentials(patch.patch_content);
+      const sensitiveFiles = patch.files.filter((f) => isSensitiveFile(f));
+      if (credentialMatches.length > 0 || sensitiveFiles.length > 0) {
+        const reasons = [];
+        if (credentialMatches.length > 0) {
+          reasons.push(`credential patterns: ${credentialMatches.join(", ")}`);
+        }
+        if (sensitiveFiles.length > 0) {
+          reasons.push(`sensitive files: ${sensitiveFiles.join(", ")}`);
+        }
+        this.warnings.push(
+          `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+        );
+      } else {
+        cleanPatches.push(patch);
+      }
+    }
+    this.lock.patches = cleanPatches;
     const dir = dirname(this.lockfilePath);
     if (!existsSync(dir)) {
       mkdirSync(dir, { recursive: true });
@@ -576,6 +648,37 @@ var LockfileManager = class {
 // src/ReplayDetector.ts
 import { createHash } from "crypto";
 var INFRASTRUCTURE_FILES = /* @__PURE__ */ new Set([".fernignore"]);
+function parsePatchFileHeaders(patchContent) {
+  const results = [];
+  let currentPath = null;
+  let currentIsCreate = false;
+  let currentIsDelete = false;
+  const flush = () => {
+    if (currentPath !== null) {
+      results.push({ path: currentPath, isCreate: currentIsCreate, isDelete: currentIsDelete });
+    }
+  };
+  for (const line of patchContent.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      flush();
+      currentPath = null;
+      currentIsCreate = false;
+      currentIsDelete = false;
+      const match = line.match(/^diff --git a\/(.+?) b\/(.+?)$/);
+      if (match) {
+        currentPath = match[2] ?? null;
+      }
+    } else if (currentPath !== null) {
+      if (line.startsWith("new file mode ")) {
+        currentIsCreate = true;
+      } else if (line.startsWith("deleted file mode ")) {
+        currentIsDelete = true;
+      }
+    }
+  }
+  flush();
+  return results;
+}
 var ReplayDetector = class {
   git;
   lockManager;
@@ -654,12 +757,31 @@ var ReplayDetector = class {
         );
         continue;
       }
-      const contentHash = this.computeContentHash(patchContent);
+      let contentHash = this.computeContentHash(patchContent);
       if (lock.patches.find((p) => p.content_hash === contentHash) || forgottenHashes.has(contentHash)) {
         continue;
       }
       const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-      const files = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f));
+      const allFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
+      const sensitiveFiles = allFiles.filter((f) => isSensitiveFile(f));
+      const files = allFiles.filter((f) => !isSensitiveFile(f));
+      if (sensitiveFiles.length > 0) {
+        this.warnings.push(
+          `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
+        );
+        if (files.length > 0) {
+          const parentSha = parents[0];
+          if (parentSha) {
+            try {
+              patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
+            } catch {
+              continue;
+            }
+            if (!patchContent.trim()) continue;
+            contentHash = this.computeContentHash(patchContent);
+          }
+        }
+      }
       if (files.length === 0) {
         continue;
       }
@@ -671,14 +793,16 @@ var ReplayDetector = class {
         original_author: `${commit.authorName} <${commit.authorEmail}>`,
         base_generation: lastGen.commit_sha,
         files,
-        patch_content: patchContent
+        patch_content: patchContent,
+        ...this.isCreationOnlyPatch(patchContent) ? { user_owned: true } : {}
       });
     }
-    newPatches.reverse();
+    const survivingPatches = await this.collapseNetZeroFiles(newPatches);
+    survivingPatches.reverse();
     const revertedPatchIdSet = /* @__PURE__ */ new Set();
     const revertIndicesToRemove = /* @__PURE__ */ new Set();
-    for (let i = 0; i < newPatches.length; i++) {
-      const patch = newPatches[i];
+    for (let i = 0; i < survivingPatches.length; i++) {
+      const patch = survivingPatches[i];
       if (!isRevertCommit(patch.original_message)) continue;
       let body = "";
       try {
@@ -707,7 +831,7 @@ var ReplayDetector = class {
       if (matchedExisting) continue;
       let matchedNew = false;
       if (revertedSha) {
-        const idx = newPatches.findIndex(
+        const idx = survivingPatches.findIndex(
           (p, j) => j !== i && !revertIndicesToRemove.has(j) && p.original_commit === revertedSha
         );
         if (idx !== -1) {
@@ -717,7 +841,7 @@ var ReplayDetector = class {
         }
       }
       if (!matchedNew && revertedMessage) {
-        const idx = newPatches.findIndex(
+        const idx = survivingPatches.findIndex(
           (p, j) => j !== i && !revertIndicesToRemove.has(j) && p.original_message === revertedMessage
         );
         if (idx !== -1) {
@@ -729,18 +853,107 @@ var ReplayDetector = class {
         revertIndicesToRemove.add(i);
       }
     }
-    const filteredPatches = newPatches.filter((_, i) => !revertIndicesToRemove.has(i));
+    const filteredPatches = survivingPatches.filter((_, i) => !revertIndicesToRemove.has(i));
     return { patches: filteredPatches, revertedPatchIds: [...revertedPatchIdSet] };
   }
   /**
    * Compute content hash for deduplication.
-   * Removes commit SHA line and index lines before hashing,
-   * so rebased commits with same content produce the same hash.
+   *
+   * Produces a format-agnostic hash so both `git format-patch` output
+   * (email-wrapped) and plain `git diff` output hash to the same value
+   * when the underlying diff hunks are identical.
+   *
+   * Normalization:
+   *   1. Strip email wrapper: everything before the first `diff --git` line
+   *      (From:, Subject:, Date:, diffstat, blank separators).
+   *   2. Strip `index` lines (blob SHA pairs change across rebases).
+   *   3. Strip trailing git version marker (`-- \n<version>`).
+   *
+   * This ensures content hashes match across the no-patches and normal-
+   * regeneration flows, which store formatPatch and git-diff formats
+   * respectively (FER-9850, D5-D9).
    */
   computeContentHash(patchContent) {
-    const normalized = patchContent.split("\n").filter((line) => !line.startsWith("From ") && !line.startsWith("index ") && !line.startsWith("Date: ")).join("\n");
+    const lines = patchContent.split("\n");
+    const diffStart = lines.findIndex((l) => l.startsWith("diff --git "));
+    const relevantLines = diffStart > 0 ? lines.slice(diffStart) : lines;
+    const normalized = relevantLines.filter((line) => !line.startsWith("index ")).join("\n").replace(/\n-- \n[\d]+\.[\d]+[^\n]*\s*$/, "");
     return `sha256:${createHash("sha256").update(normalized).digest("hex")}`;
   }
+  /**
+   * FER-9805 — Drop patches whose files were transiently created and then
+   * deleted within the current linear detection window, and are absent from
+   * HEAD at the end of the window.
+   *
+   * Rationale: on a merge commit, createMergeCompositePatch already diffs
+   * firstParent..mergeCommit so net-zero files never enter the composite. On
+   * linear history each commit becomes its own patch, so a file that was
+   * briefly added and later removed survives as a create+delete pair whose
+   * cumulative diff is empty. We drop such patches before they reach the
+   * lockfile.
+   *
+   * A file is "transient" when:
+   *   1. some patch in the window sets `new file mode` for it (a creation), AND
+   *   2. some patch in the window sets `deleted file mode` for it (a deletion), AND
+   *   3. it is absent from HEAD's tree.
+   *
+   * The HEAD guard (#3) prevents false positives when a file is deleted
+   * and then recreated with different content — the cumulative diff of
+   * such a pair is non-empty and must be preserved.
+   *
+   * This only drops patches whose `files` are a subset of the transient
+   * set. A partial-transient patch (one that touches a transient file
+   * alongside a persistent one) is left unmodified; surgical stripping of
+   * single files from a multi-file patch would require a follow-up that
+   * regenerates the patch content via `git format-patch -- <files>`. No
+   * current failing test exercises this, and leaving the patch intact
+   * preserves today's behaviour. TODO(FER-9805): revisit if a future
+   * adversarial test demands per-file stripping.
+   */
+  async collapseNetZeroFiles(patches) {
+    if (patches.length === 0) return patches;
+    const stateByFile = /* @__PURE__ */ new Map();
+    for (const patch of patches) {
+      for (const header of parsePatchFileHeaders(patch.patch_content)) {
+        if (!header.isCreate && !header.isDelete) continue;
+        const prior = stateByFile.get(header.path) ?? { created: false, deleted: false };
+        if (header.isCreate) prior.created = true;
+        if (header.isDelete) prior.deleted = true;
+        stateByFile.set(header.path, prior);
+      }
+    }
+    let anyCandidate = false;
+    for (const state of stateByFile.values()) {
+      if (state.created && state.deleted) {
+        anyCandidate = true;
+        break;
+      }
+    }
+    if (!anyCandidate) return patches;
+    const headFiles = await this.listHeadFiles();
+    const transient = /* @__PURE__ */ new Set();
+    for (const [file, state] of stateByFile) {
+      if (state.created && state.deleted && !headFiles.has(file)) {
+        transient.add(file);
+      }
+    }
+    if (transient.size === 0) return patches;
+    return patches.filter((patch) => !patch.files.every((f) => transient.has(f)));
+  }
+  /**
+   * List every tracked path at HEAD (one `git ls-tree -r` invocation).
+   * Returns an empty Set if HEAD is unborn or the invocation fails — the
+   * caller then treats every candidate as "not in HEAD" and may collapse
+   * more aggressively. On typical SDK repos this is a single sub-10ms call.
+   */
+  async listHeadFiles() {
+    try {
+      const out = await this.git.exec(["ls-tree", "-r", "--name-only", "HEAD"]);
+      return new Set(out.split("\n").map((l) => l.trim()).filter(Boolean));
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+  }
   /**
    * Create a single composite patch for a merge commit by diffing the merge
    * commit against its first parent. This captures the net change of the
@@ -756,7 +969,14 @@ var ReplayDetector = class {
       firstParent,
       mergeCommit.sha
     ]);
-    const files = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
+    const allMergeFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
+    const sensitiveMergeFiles = allMergeFiles.filter((f) => isSensitiveFile(f));
+    const files = allMergeFiles.filter((f) => !isSensitiveFile(f));
+    if (sensitiveMergeFiles.length > 0) {
+      this.warnings.push(
+        `Sensitive file(s) excluded from merge patch for commit ${mergeCommit.sha.slice(0, 7)}: ${sensitiveMergeFiles.join(", ")}. These files will not be tracked by replay.`
+      );
+    }
     if (files.length === 0) return null;
     const diff = await this.git.exec([
       "diff",
@@ -778,7 +998,8 @@ var ReplayDetector = class {
       original_author: `${mergeCommit.authorName} <${mergeCommit.authorEmail}>`,
       base_generation: lastGen.commit_sha,
       files,
-      patch_content: diff
+      patch_content: diff,
+      ...this.isCreationOnlyPatch(diff) ? { user_owned: true } : {}
     };
   }
   /**
@@ -792,7 +1013,14 @@ var ReplayDetector = class {
       return this.detectPatchesViaCommitScan();
     }
     const filesOutput = await this.git.exec(["diff", "--name-only", diffBase, "HEAD"]);
-    const files = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
+    const allTreeFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
+    const sensitiveTreeFiles = allTreeFiles.filter((f) => isSensitiveFile(f));
+    const files = allTreeFiles.filter((f) => !isSensitiveFile(f));
+    if (sensitiveTreeFiles.length > 0) {
+      this.warnings.push(
+        `Sensitive file(s) excluded from composite patch: ${sensitiveTreeFiles.join(", ")}. These files will not be tracked by replay.`
+      );
+    }
     if (files.length === 0) return { patches: [], revertedPatchIds: [] };
     const diff = await this.git.exec(["diff", diffBase, "HEAD", "--", ...files]);
     if (!diff.trim()) return { patches: [], revertedPatchIds: [] };
@@ -812,7 +1040,8 @@ var ReplayDetector = class {
       // reference to find base file content. diffBase may be the tree_hash.
       base_generation: commitKnownMissing ? diffBase : lastGen.commit_sha,
       files,
-      patch_content: diff
+      patch_content: diff,
+      ...this.isCreationOnlyPatch(diff) ? { user_owned: true } : {}
     };
     return { patches: [compositePatch], revertedPatchIds: [] };
   }
@@ -859,7 +1088,7 @@ var ReplayDetector = class {
       } catch {
         continue;
       }
-      const contentHash = this.computeContentHash(patchContent);
+      let contentHash = this.computeContentHash(patchContent);
       if (existingHashes.has(contentHash) || forgottenHashes.has(contentHash)) {
         continue;
       }
@@ -867,7 +1096,26 @@ var ReplayDetector = class {
         continue;
       }
       const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-      const files = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f));
+      const allScanFiles = filesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f));
+      const sensitiveScanFiles = allScanFiles.filter((f) => isSensitiveFile(f));
+      const files = allScanFiles.filter((f) => !isSensitiveFile(f));
+      if (sensitiveScanFiles.length > 0) {
+        this.warnings.push(
+          `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveScanFiles.join(", ")}. These files will not be tracked by replay.`
+        );
+        if (files.length > 0) {
+          if (parents.length === 0) {
+            continue;
+          }
+          try {
+            patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
+          } catch {
+            continue;
+          }
+          if (!patchContent.trim()) continue;
+          contentHash = this.computeContentHash(patchContent);
+        }
+      }
       if (files.length === 0) {
         continue;
       }
@@ -1199,6 +1447,20 @@ var ReplayApplicator = class {
   resetAccumulator() {
     this.fileTheirsAccumulator.clear();
   }
+  /**
+   * @internal Test-only.
+   * Returns a defensive copy of the inter-patch accumulator. Used by the
+   * adversarial test suite (FER-9791) to assert invariant I2: after every
+   * applied patch, the accumulator has an entry for each file the patch
+   * touched, and the entry's content matches on-disk.
+   */
+  getAccumulatorSnapshot() {
+    const snapshot = /* @__PURE__ */ new Map();
+    for (const [path, entry] of this.fileTheirsAccumulator) {
+      snapshot.set(path, { content: entry.content, baseGeneration: entry.baseGeneration });
+    }
+    return snapshot;
+  }
   /**
    * Apply all patches, returning results for each.
    * Skips patches that match exclude patterns in replay.yml
@@ -1264,7 +1526,7 @@ var ReplayApplicator = class {
         const base = await this.git.showFile(baseGen.tree_hash, filePath);
         const theirs = await this.applyPatchToContent(base, patch.patch_content, filePath, tempGit, tempDir);
         const effectiveTheirs = theirs ?? await readFile(join2(this.outputDir, resolvedPath), "utf-8").catch(() => null);
-        if (effectiveTheirs) {
+        if (effectiveTheirs != null) {
           this.fileTheirsAccumulator.set(resolvedPath, {
             content: effectiveTheirs,
             baseGeneration: patch.base_generation
@@ -1288,16 +1550,20 @@ var ReplayApplicator = class {
         return this.fileTheirsAccumulator.has(resolved);
       })
     ).then((results) => results.some(Boolean));
-    if (!needsAccumulation) {
+    const resolvedFiles = {};
+    for (const filePath of patch.files) {
+      const resolvedPath = baseGen ? await this.resolveFilePath(filePath, baseGen.tree_hash, currentTreeHash) : filePath;
+      if (resolvedPath !== filePath) {
+        resolvedFiles[filePath] = resolvedPath;
+      }
+    }
+    const patchIsRenameAware = /^rename from /m.test(patch.patch_content);
+    const hasGeneratorRename = Object.keys(resolvedFiles).length > 0 && !patchIsRenameAware;
+    if (!needsAccumulation && !hasGeneratorRename) {
       const snapshots = /* @__PURE__ */ new Map();
-      const resolvedFiles = {};
       for (const filePath of patch.files) {
-        const resolvedPath = baseGen ? await this.resolveFilePath(filePath, baseGen.tree_hash, currentTreeHash) : filePath;
-        if (resolvedPath !== filePath) {
-          resolvedFiles[filePath] = resolvedPath;
-        }
-        const fullPath = join2(this.outputDir, resolvedPath);
-        snapshots.set(resolvedPath, await readFile(fullPath, "utf-8").catch(() => null));
+        const fullPath = join2(this.outputDir, filePath);
+        snapshots.set(filePath, await readFile(fullPath, "utf-8").catch(() => null));
       }
       try {
         await this.git.execWithInput(["apply", "--3way"], patch.patch_content);
@@ -1309,8 +1575,8 @@ var ReplayApplicator = class {
           ...Object.keys(resolvedFiles).length > 0 && { resolvedFiles }
         };
       } catch {
-        for (const [resolvedPath, content] of snapshots) {
-          const fullPath = join2(this.outputDir, resolvedPath);
+        for (const [filePath, content] of snapshots) {
+          const fullPath = join2(this.outputDir, filePath);
           if (content != null) {
             await writeFile(fullPath, content);
           } else {
@@ -1430,7 +1696,7 @@ var ReplayApplicator = class {
       }
       let useAccumulatorAsMergeBase = false;
       const accumulatorEntry = this.fileTheirsAccumulator.get(resolvedPath);
-      if (accumulatorEntry && (!theirs || base == null)) {
+      if (accumulatorEntry && (theirs == null || base == null)) {
         theirs = await this.applyPatchToContent(
           accumulatorEntry.content,
           patch.patch_content,
@@ -1438,7 +1704,16 @@ var ReplayApplicator = class {
           tempGit,
           tempDir
         );
-        if (theirs) {
+        if (theirs != null) {
+          useAccumulatorAsMergeBase = true;
+        } else if (await this.isPatchAlreadyApplied(
+          patch.patch_content,
+          filePath,
+          accumulatorEntry.content,
+          tempGit,
+          tempDir
+        )) {
+          theirs = accumulatorEntry.content;
           useAccumulatorAsMergeBase = true;
         }
       }
@@ -1455,7 +1730,7 @@ var ReplayApplicator = class {
       }
       let effective_theirs = theirs;
       let baseMismatchSkipped = false;
-      if (theirs && base && !useAccumulatorAsMergeBase) {
+      if (theirs != null && base != null && !useAccumulatorAsMergeBase) {
         if (accumulatorEntry && accumulatorEntry.baseGeneration === patch.base_generation) {
           try {
             const preMerged = threeWayMerge(base, accumulatorEntry.content, theirs);
@@ -1471,7 +1746,7 @@ var ReplayApplicator = class {
           baseMismatchSkipped = true;
         }
       }
-      if (base == null && !ours && effective_theirs) {
+      if (base == null && ours == null && effective_theirs != null) {
         this.fileTheirsAccumulator.set(resolvedPath, {
           content: effective_theirs,
           baseGeneration: patch.base_generation
@@ -1481,7 +1756,7 @@ var ReplayApplicator = class {
         await writeFile(oursPath, effective_theirs);
         return { file: resolvedPath, status: "merged", reason: "new-file" };
       }
-      if (base == null && ours && effective_theirs && !useAccumulatorAsMergeBase) {
+      if (base == null && ours != null && effective_theirs != null && !useAccumulatorAsMergeBase) {
         const merged2 = threeWayMerge("", ours, effective_theirs);
         const outDir2 = dirname2(oursPath);
         await mkdir(outDir2, { recursive: true });
@@ -1495,16 +1770,20 @@ var ReplayApplicator = class {
             conflictMetadata: metadata
           };
         }
+        this.fileTheirsAccumulator.set(resolvedPath, {
+          content: merged2.content,
+          baseGeneration: patch.base_generation
+        });
         return { file: resolvedPath, status: "merged" };
       }
-      if (!effective_theirs) {
+      if (effective_theirs == null) {
         return {
           file: resolvedPath,
           status: "skipped",
           reason: "missing-content"
         };
       }
-      if (base == null && !useAccumulatorAsMergeBase || !ours) {
+      if (base == null && !useAccumulatorAsMergeBase || ours == null) {
         return {
           file: resolvedPath,
           status: "skipped",
@@ -1523,7 +1802,7 @@ var ReplayApplicator = class {
       const outDir = dirname2(oursPath);
       await mkdir(outDir, { recursive: true });
       await writeFile(oursPath, merged.content);
-      if (effective_theirs && !merged.hasConflicts) {
+      if (effective_theirs != null && !merged.hasConflicts) {
         this.fileTheirsAccumulator.set(resolvedPath, {
           content: effective_theirs,
           baseGeneration: patch.base_generation
@@ -1621,6 +1900,28 @@ var ReplayApplicator = class {
       return null;
     }
   }
+  /**
+   * Detects whether a patch's additions are already present in `content`.
+   * Uses `git apply --reverse --check` — if the reverse patch applies cleanly,
+   * the forward patch is effectively a no-op (its +lines are already there and
+   * its -lines are already gone). Used to distinguish "patch already applied"
+   * from "patch base mismatch" after a forward-apply fails.
+   */
+  async isPatchAlreadyApplied(patchContent, filePath, content, tempGit, tempDir) {
+    const fileDiff = this.extractFileDiff(patchContent, filePath);
+    if (!fileDiff) return false;
+    try {
+      const tempFilePath = join2(tempDir, filePath);
+      await mkdir(dirname2(tempFilePath), { recursive: true });
+      await writeFile(tempFilePath, content);
+      await tempGit.exec(["add", filePath]);
+      await tempGit.exec(["commit", "-m", `check already-applied ${filePath}`, "--allow-empty"]);
+      await tempGit.execWithInput(["apply", "--reverse", "--check", "--allow-empty"], fileDiff);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   extractFileDiff(patchContent, filePath) {
     const lines = patchContent.split("\n");
     const diffLines = [];
@@ -1789,6 +2090,33 @@ var ReplayService = class {
   committer;
   lockManager;
   outputDir;
+  /** @internal Test-only. Captures the last ReplayResult[] returned from applicator.applyPatches(). */
+  _lastApplyResults = [];
+  /**
+   * Service-level warnings accumulated during a single runReplay() call.
+   * Merged with `detector.warnings` into `ReplayReport.warnings` by each flow handler.
+   * Populated by `isFileUserOwned` when a patch's base generation tree is unreachable
+   * (shallow clone / aggressive `git gc --prune`) and we fall back to a conservative
+   * heuristic. Cleared at the top of `runReplay()`.
+   */
+  warnings = [];
+  /**
+   * @internal Test-only accessor.
+   * Returns the ReplayApplicator instance used for the last run. Tests use this
+   * to inspect the inter-patch accumulator after runReplay() completes (FER-9791, I2).
+   */
+  get applicatorRef() {
+    return this.applicator;
+  }
+  /**
+   * @internal Test-only accessor.
+   * Returns the ReplayResult[] from the most recent applyPatches() call. Tests use
+   * this to filter applied-vs-conflicted-vs-absorbed patches for invariant assertions
+   * (FER-9791). Returns an empty array if no patches have been applied yet.
+   */
+  getLastResults() {
+    return this._lastApplyResults;
+  }
   constructor(outputDir, _config) {
     const git = new GitClient(outputDir);
     this.git = git;
@@ -1799,6 +2127,7 @@ var ReplayService = class {
     this.committer = new ReplayCommitter(git, outputDir);
   }
   async runReplay(options) {
+    this.warnings = [];
     if (options?.skipApplication) {
       return this.handleSkipApplication(options);
     }
@@ -1872,6 +2201,7 @@ var ReplayService = class {
       );
     }
     this.lockManager.save();
+    this.detector.warnings.push(...this.lockManager.warnings);
   }
   determineFlow() {
     try {
@@ -1938,6 +2268,7 @@ var ReplayService = class {
     }
     this.lockManager.setReplaySkippedAt((/* @__PURE__ */ new Date()).toISOString());
     this.lockManager.save();
+    const credentialWarnings = [...this.lockManager.warnings];
     if (!options?.stageOnly) {
       await this.committer.commitReplay(0);
     } else {
@@ -1949,13 +2280,15 @@ var ReplayService = class {
       patchesApplied: 0,
       patchesWithConflicts: 0,
       patchesSkipped: 0,
-      conflicts: []
+      conflicts: [],
+      warnings: credentialWarnings.length > 0 ? credentialWarnings : void 0
     };
   }
   async handleNoPatchesRegeneration(options) {
-    const { patches: newPatches, revertedPatchIds } = await this.detector.detectNewPatches();
-    const warnings = [...this.detector.warnings];
+    let { patches: newPatches, revertedPatchIds } = await this.detector.detectNewPatches();
+    const detectorWarnings = [...this.detector.warnings];
     if (options?.dryRun) {
+      const dryRunWarnings = [...detectorWarnings, ...this.warnings];
       return {
         flow: "no-patches",
         patchesDetected: newPatches.length,
@@ -1965,9 +2298,26 @@ var ReplayService = class {
         patchesReverted: revertedPatchIds.length,
         conflicts: [],
         wouldApply: newPatches,
-        warnings: warnings.length > 0 ? warnings : void 0
+        warnings: dryRunWarnings.length > 0 ? dryRunWarnings : void 0
       };
     }
+    {
+      const preLock = this.lockManager.read();
+      const preCurrentGen = preLock.current_generation;
+      const uniqueFiles = [...new Set(newPatches.flatMap((p) => p.files))];
+      const absorbedFiles = /* @__PURE__ */ new Set();
+      for (const file of uniqueFiles) {
+        const diff = await this.git.exec(["diff", preCurrentGen, "HEAD", "--", file]).catch(() => null);
+        if (diff !== null && !diff.trim()) {
+          absorbedFiles.add(file);
+        }
+      }
+      if (absorbedFiles.size > 0) {
+        newPatches = newPatches.filter(
+          (p) => p.files.length === 0 || !p.files.every((f) => absorbedFiles.has(f))
+        );
+      }
+    }
     for (const id of revertedPatchIds) {
       try {
         this.lockManager.removePatch(id);
@@ -1986,6 +2336,7 @@ var ReplayService = class {
     let results = [];
     if (newPatches.length > 0) {
       results = await this.applicator.applyPatches(newPatches);
+      this._lastApplyResults = results;
       this.revertConflictingFiles(results);
       for (const result of results) {
         if (result.status === "conflict") {
@@ -2000,6 +2351,7 @@ var ReplayService = class {
       }
     }
     this.lockManager.save();
+    this.warnings.push(...this.lockManager.warnings);
     if (newPatches.length > 0) {
       if (!options?.stageOnly) {
         const appliedCount = results.filter((r) => r.status === "applied").length;
@@ -2008,13 +2360,14 @@ var ReplayService = class {
         await this.committer.stageAll();
       }
     }
+    const warnings = [...detectorWarnings, ...this.warnings];
     return this.buildReport("no-patches", newPatches, results, options, warnings, rebaseCounts, void 0, revertedPatchIds.length);
   }
   async handleNormalRegeneration(options) {
     if (options?.dryRun) {
       const existingPatches2 = this.lockManager.getPatches();
       const { patches: newPatches2, revertedPatchIds: dryRunReverted } = await this.detector.detectNewPatches();
-      const warnings2 = [...this.detector.warnings];
+      const warnings2 = [...this.detector.warnings, ...this.warnings];
       const allPatches2 = [...existingPatches2, ...newPatches2];
       return {
         flow: "normal-regeneration",
@@ -2046,7 +2399,7 @@ var ReplayService = class {
     }
     existingPatches = this.lockManager.getPatches();
     let { patches: newPatches, revertedPatchIds } = await this.detector.detectNewPatches();
-    const warnings = [...this.detector.warnings];
+    const detectorWarnings = [...this.detector.warnings];
     if (removedByPreRebase.length > 0) {
       const removedOriginalCommits = new Set(removedByPreRebase.map((p) => p.original_commit));
       const removedOriginalMessages = new Set(removedByPreRebase.map((p) => p.original_message));
@@ -2078,6 +2431,7 @@ var ReplayService = class {
     const genRecord = await this.committer.createGenerationRecord(commitOpts);
     this.lockManager.addGeneration(genRecord);
     const results = await this.applicator.applyPatches(allPatches);
+    this._lastApplyResults = results;
     this.revertConflictingFiles(results);
     for (const result of results) {
       if (result.status === "conflict") {
@@ -2099,12 +2453,14 @@ var ReplayService = class {
       }
     }
     this.lockManager.save();
+    this.warnings.push(...this.lockManager.warnings);
     if (options?.stageOnly) {
       await this.committer.stageAll();
     } else {
       const appliedCount = results.filter((r) => r.status === "applied").length;
       await this.committer.commitReplay(appliedCount, allPatches);
     }
+    const warnings = [...detectorWarnings, ...this.warnings];
     return this.buildReport(
       "normal-regeneration",
       allPatches,
@@ -2128,6 +2484,7 @@ var ReplayService = class {
     let keptAsUserOwned = 0;
     const seenContentHashes = /* @__PURE__ */ new Set();
     const absorbedPatchIds = /* @__PURE__ */ new Set();
+    const fernignorePatterns = this.readFernignorePatterns();
     for (const result of results) {
       if (result.resolvedFiles && Object.keys(result.resolvedFiles).length > 0) {
         const patch = result.patch;
@@ -2148,34 +2505,78 @@ var ReplayService = class {
       const patch = result.patch;
       if (patch.base_generation === currentGenSha) continue;
       try {
-        const fernignorePatterns = this.readFernignorePatterns();
-        const isUserOwned = await Promise.all(
+        const originalByResolved = {};
+        if (result.resolvedFiles) {
+          for (const [orig, resolved] of Object.entries(result.resolvedFiles)) {
+            originalByResolved[resolved] = orig;
+          }
+        }
+        const isUserOwnedPerFile = await Promise.all(
           patch.files.map(async (file) => {
-            if (file === ".fernignore") {
+            if (file === ".fernignore") return true;
+            if (fernignorePatterns.some((p) => file === p || minimatch2(file, p))) {
               return true;
             }
-            if (fernignorePatterns.some((p) => file === p || minimatch2(file, p))) {
+            if (patch.user_owned) return true;
+            if (this.fileIsCreationInPatchContent(patch.patch_content, originalByResolved[file] ?? file)) {
               return true;
             }
             const content = await this.git.showFile(currentGenSha, file);
             return content === null;
           })
         );
-        const hasUserOwnedFiles = isUserOwned.some(Boolean);
-        if (hasUserOwnedFiles) {
-          this.lockManager.updatePatch(patch.id, {
-            base_generation: currentGenSha
-          });
+        const hasProtectedFiles = patch.files.some(
+          (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch2(file, p))
+        );
+        const allUserOwned = isUserOwnedPerFile.every(Boolean);
+        if (allUserOwned && patch.files.length > 0) {
+          const baseChanged = patch.base_generation !== currentGenSha;
+          const userDiff = await this.git.exec(["diff", currentGenSha, "--", ...patch.files]).catch(() => null);
+          if (userDiff != null && userDiff.trim()) {
+            const newHash = this.detector.computeContentHash(userDiff);
+            patch.patch_content = userDiff;
+            patch.content_hash = newHash;
+          }
+          patch.base_generation = currentGenSha;
+          try {
+            this.lockManager.updatePatch(patch.id, {
+              base_generation: currentGenSha,
+              ...!patch.user_owned ? { user_owned: true } : {},
+              ...userDiff != null && userDiff.trim() ? { patch_content: patch.patch_content, content_hash: patch.content_hash } : {}
+            });
+          } catch {
+          }
+          patch.user_owned = true;
           keptAsUserOwned++;
+          if (baseChanged) repointed++;
           continue;
         }
         const diff = await this.git.exec(["diff", currentGenSha, "--", ...patch.files]).catch(() => null);
-        if (!diff || !diff.trim()) {
+        if (diff === null) continue;
+        if (!diff.trim()) {
+          if (hasProtectedFiles) {
+            patch.base_generation = currentGenSha;
+            try {
+              this.lockManager.updatePatch(patch.id, { base_generation: currentGenSha });
+            } catch {
+            }
+            keptAsUserOwned++;
+            continue;
+          }
           this.lockManager.removePatch(patch.id);
           absorbedPatchIds.add(patch.id);
           absorbed++;
           continue;
         }
+        if (hasProtectedFiles) {
+          patch.base_generation = currentGenSha;
+          try {
+            this.lockManager.updatePatch(patch.id, { base_generation: currentGenSha });
+          } catch {
+          }
+          keptAsUserOwned++;
+          continue;
+        }
         const newContentHash = this.detector.computeContentHash(diff);
         if (seenContentHashes.has(newContentHash)) {
           this.lockManager.removePatch(patch.id);
@@ -2184,17 +2585,89 @@ var ReplayService = class {
           continue;
         }
         seenContentHashes.add(newContentHash);
-        this.lockManager.updatePatch(patch.id, {
-          base_generation: currentGenSha,
-          patch_content: diff,
-          content_hash: newContentHash
-        });
+        patch.base_generation = currentGenSha;
+        patch.patch_content = diff;
+        patch.content_hash = newContentHash;
+        try {
+          this.lockManager.updatePatch(patch.id, {
+            base_generation: currentGenSha,
+            patch_content: diff,
+            content_hash: newContentHash
+          });
+        } catch {
+        }
         contentRebased++;
       } catch {
       }
     }
     return { absorbed, repointed, contentRebased, keptAsUserOwned, absorbedPatchIds };
   }
+  /**
+   * Determine whether `file` is user-owned (never produced by the generator).
+   *
+   * Resolution order (first match wins):
+   *  1. `patch.user_owned === true` — authoritative, persisted across cycles.
+   *  2. `.fernignore` itself, or file matches a .fernignore pattern.
+   *  3. Legacy-safe signal: `patch_content` shows this file as a `--- /dev/null`
+   *     creation. Works for patches that predate the `user_owned` field or
+   *     whose flag was lost. Immune to rename tricks — relies on raw patch text.
+   *  4. Tree-based check against `patch.base_generation` when it is reachable
+   *     AND distinct from `currentGenSha`. If the base tree is unreachable
+   *     (shallow clone / aggressive `git gc --prune`), emit a one-time
+   *     customer-actionable warning (deduplicated via warnedGens) and
+   *     conservatively treat as user-owned — strictly safer than silent
+   *     absorption (FER-9809).
+   *  5. Final fallback — check `currentGenSha` when there is no usable base
+   *     (legacy one-gen lockfile). Preserves pre-fix behavior for that edge.
+   *
+   * `originalFileName` is the pre-rename path when the generator moved the
+   * file between the patch's base and the current generation. Tree lookups
+   * at ancestor generations use the original path — that's where the
+   * generator produced the content.
+   */
+  async isFileUserOwned(file, patch, currentGenSha, fernignorePatterns, warnedGens, originalFileName) {
+    if (patch.user_owned) return true;
+    if (file === ".fernignore") return true;
+    if (fernignorePatterns.some((p) => file === p || minimatch2(file, p))) return true;
+    if (this.fileIsCreationInPatchContent(patch.patch_content, originalFileName ?? file)) {
+      return true;
+    }
+    const base = patch.base_generation;
+    if (base && base !== currentGenSha) {
+      const reachable = await this.git.commitExists(base) || await this.git.treeExists(base);
+      if (!reachable) {
+        if (!warnedGens.has(base)) {
+          warnedGens.add(base);
+          this.warnings.push(
+            `Base generation ${base.slice(0, 7)} is unreachable (shallow clone or pruned history). Treating affected files as user-owned to avoid silent data loss. Run \`git fetch --unshallow\` or avoid \`git gc --prune\` to restore full history.`
+          );
+        }
+        return true;
+      }
+      return await this.git.showFile(base, originalFileName ?? file) === null;
+    }
+    return await this.git.showFile(currentGenSha, originalFileName ?? file) === null;
+  }
+  /**
+   * Returns true if `file`'s diff section in `patchContent` starts with
+   * `--- /dev/null`, meaning this file was introduced by the patch (user
+   * creation). Used as a legacy-safe fallback when `patch.user_owned` is
+   * absent or cleared.
+   */
+  fileIsCreationInPatchContent(patchContent, file) {
+    const lines = patchContent.split("\n");
+    let inFileSection = false;
+    for (const line of lines) {
+      if (line.startsWith("diff --git ")) {
+        inFileSection = line.includes(` b/${file}`) || line.endsWith(` b/${file}`);
+        continue;
+      }
+      if (inFileSection && line.startsWith("--- ")) {
+        return line === "--- /dev/null";
+      }
+    }
+    return false;
+  }
   /**
    * For conflict patches with mixed results (some files merged, some conflicted),
    * check if the cleanly merged files were absorbed by the generator (empty diff).
@@ -2208,13 +2681,14 @@ var ReplayService = class {
     const cleanFiles = result.fileResults.filter((f) => f.status === "merged").map((f) => f.file);
     if (cleanFiles.length === 0) return;
     const patch = result.patch;
+    if (patch.user_owned) return;
     const fernignorePatterns = this.readFernignorePatterns();
+    const warnedGens = /* @__PURE__ */ new Set();
     const generatorCleanFiles = [];
     for (const file of cleanFiles) {
-      if (file === ".fernignore") continue;
-      if (fernignorePatterns.some((p) => file === p || minimatch2(file, p))) continue;
-      const content = await this.git.showFile(currentGenSha, file);
-      if (content === null) continue;
+      if (await this.isFileUserOwned(file, patch, currentGenSha, fernignorePatterns, warnedGens)) {
+        continue;
+      }
       generatorCleanFiles.push(file);
     }
     if (generatorCleanFiles.length === 0) return;
@@ -2251,7 +2725,35 @@ var ReplayService = class {
     let conflictResolved = 0;
     let conflictAbsorbed = 0;
     let contentRefreshed = 0;
+    const fernignorePatterns = this.readFernignorePatterns();
+    const warnedGens = /* @__PURE__ */ new Set();
+    const reachabilityCache = /* @__PURE__ */ new Map();
+    const isReachable = async (sha) => {
+      const cached = reachabilityCache.get(sha);
+      if (cached !== void 0) return cached;
+      const reachable = await this.git.commitExists(sha) || await this.git.treeExists(sha);
+      reachabilityCache.set(sha, reachable);
+      return reachable;
+    };
+    const allPatchFilesUserOwned = async (patch) => {
+      if (patch.user_owned) return true;
+      if (patch.files.length === 0) return false;
+      for (const file of patch.files) {
+        if (!await this.isFileUserOwned(file, patch, currentGen, fernignorePatterns, warnedGens)) {
+          return false;
+        }
+      }
+      return true;
+    };
     for (const patch of patches) {
+      if (patch.base_generation && patch.base_generation !== currentGen && !warnedGens.has(patch.base_generation)) {
+        if (!await isReachable(patch.base_generation)) {
+          warnedGens.add(patch.base_generation);
+          this.warnings.push(
+            `Base generation ${patch.base_generation.slice(0, 7)} is unreachable (shallow clone or pruned history). Treating affected files as user-owned to avoid silent data loss. Run \`git fetch --unshallow\` or avoid \`git gc --prune\` to restore full history.`
+          );
+        }
+      }
       if (patch.status != null) {
         delete patch.status;
         continue;
@@ -2261,6 +2763,7 @@ var ReplayService = class {
           const diff = await this.git.exec(["diff", currentGen, "HEAD", "--", ...patch.files]).catch(() => null);
           if (diff === null) continue;
           if (!diff.trim()) {
+            if (await allPatchFilesUserOwned(patch)) continue;
             this.lockManager.removePatch(patch.id);
             contentRefreshed++;
             continue;
@@ -2272,6 +2775,12 @@ var ReplayService = class {
           if (hasStaleMarkers) {
             continue;
           }
+          const isProtected = patch.files.some(
+            (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch2(file, p))
+          );
+          if (isProtected) {
+            continue;
+          }
           const newContentHash = this.detector.computeContentHash(diff);
           if (newContentHash !== patch.content_hash) {
             const filesOutput = await this.git.exec(["diff", "--name-only", currentGen, "HEAD", "--", ...patch.files]).catch(() => null);
@@ -2297,6 +2806,13 @@ var ReplayService = class {
         const diff = await this.git.exec(["diff", currentGen, "HEAD", "--", ...patch.files]).catch(() => null);
         if (diff === null) continue;
         if (!diff.trim()) {
+          if (await allPatchFilesUserOwned(patch)) {
+            try {
+              this.lockManager.updatePatch(patch.id, { base_generation: currentGen });
+            } catch {
+            }
+            continue;
+          }
           this.lockManager.removePatch(patch.id);
           conflictAbsorbed++;
           continue;
@@ -2808,7 +3324,10 @@ function ensureGitattributesEntries(outputDir) {
   writeFileSync4(gitattributesPath, content, "utf-8");
 }
 function computeContentHash(patchContent) {
-  const normalized = patchContent.split("\n").filter((line) => !line.startsWith("From ") && !line.startsWith("index ") && !line.startsWith("Date: ")).join("\n");
+  const lines = patchContent.split("\n");
+  const diffStart = lines.findIndex((l) => l.startsWith("diff --git "));
+  const relevantLines = diffStart > 0 ? lines.slice(diffStart) : lines;
+  const normalized = relevantLines.filter((line) => !line.startsWith("index ")).join("\n").replace(/\n-- \n[\d]+\.[\d]+[^\n]*\s*$/, "");
   return `sha256:${createHash3("sha256").update(normalized).digest("hex")}`;
 }
 
@@ -3119,6 +3638,7 @@ function status(outputDir) {
   };
 }
 export {
+  CREDENTIAL_PATTERNS,
   FERN_BOT_EMAIL,
   FERN_BOT_LOGIN,
   FERN_BOT_NAME,
@@ -3130,15 +3650,18 @@ export {
   ReplayCommitter,
   ReplayDetector,
   ReplayService,
+  SENSITIVE_FILE_PATTERNS,
   bootstrap,
   forget,
   isGenerationCommit,
   isReplayCommit,
   isRevertCommit,
+  isSensitiveFile,
   parseRevertedMessage,
   parseRevertedSha,
   reset,
   resolve,
+  scanForCredentials,
   status,
   threeWayMerge
 };