@fern-api/replay 0.15.2 → 0.16.1

package/dist/index.js

@@ -499,9 +499,22 @@ function isGenerationCommit(commit) {
   const hasGenerationMarker = commit.message.startsWith("[fern-generated]") || commit.message.startsWith("[fern-replay]") || commit.message.startsWith("[fern-autoversion]") || commit.message.includes("Generated by Fern") || commit.message.includes("\u{1F916} Generated with Fern") || // Squash merge of a Fern-generated PR uses the PR title as commit message.
   // The default PR title is "SDK Generation" (from GithubStep's commitMessage default).
   // GitHub appends "(#N)" for the PR number, e.g. "SDK Generation (#70)".
-  commit.message.startsWith("SDK Generation");
+  commit.message.startsWith("SDK Generation") || // Merge commit (GitHub's "Create a merge commit" option) of a fern-bot
+  // regen PR. First-parent walking lands on this commit, not on the
+  // generation commit on the side branch, so the classifier must treat
+  // it as a generation boundary. GitHub's default subject is
+  // "Merge pull request #N from <owner>/<branch>"; fern-bot branches are
+  // named "<owner>/fern-bot/<...>".
+  /^Merge pull request #\d+ from [^/]+\/fern-bot\//.test(commit.message);
   return isBotAuthor || hasGenerationMarker;
 }
+function isGenerationBoundary(commit) {
+  const isFernSupport = FERN_SUPPORT_NAMES.includes(commit.authorName);
+  const isBotAuthor = !isFernSupport && (commit.authorLogin === FERN_BOT_LOGIN || commit.authorEmail === FERN_BOT_EMAIL || commit.authorName === FERN_BOT_NAME);
+  const isAutoversion = commit.message.startsWith("[fern-autoversion]");
+  const hasBoundaryMarker = commit.message.startsWith("[fern-generated]") || commit.message.startsWith("[fern-replay]") || commit.message.includes("Generated by Fern") || commit.message.includes("\u{1F916} Generated with Fern") || commit.message.startsWith("SDK Generation");
+  return isBotAuthor && !isAutoversion || hasBoundaryMarker;
+}
 function isReplayCommit(commit) {
   return commit.message.startsWith("[fern-replay]");
 }
@@ -520,6 +533,7 @@ function parseRevertedMessage(subject) {
 // src/LockfileManager.ts
 import { readFileSync, writeFileSync, existsSync, mkdirSync, renameSync } from "fs";
 import { join, dirname } from "path";
+import { minimatch } from "minimatch";
 import { stringify, parse } from "yaml";
 var LOCKFILE_HEADER = "# DO NOT EDIT MANUALLY - Managed by Fern Replay\n";
 var LockfileNotFoundError = class extends Error {
@@ -531,10 +545,23 @@ var LockfileNotFoundError = class extends Error {
 var LockfileManager = class {
   outputDir;
   lock = null;
+  fernignorePatterns = [];
   warnings = [];
   constructor(outputDir) {
     this.outputDir = outputDir;
   }
+  /**
+   * Inform the lockfile of the customer's `.fernignore` patterns so that
+   * `save()` can suppress its "Patch X removed from lockfile" warning when
+   * every file in the stripped patch is already `.fernignore`-protected.
+   * The strip itself still happens (credentials never persist); only the
+   * customer-visible warning is suppressed in that case, because the
+   * protected files survive the generator wipe regardless of whether the
+   * lockfile tracks them, so there's nothing for the customer to action.
+   */
+  setFernignorePatterns(patterns) {
+    this.fernignorePatterns = patterns;
+  }
   get lockfilePath() {
     return join(this.outputDir, ".fern", "replay.lock");
   }
@@ -603,9 +630,14 @@ var LockfileManager = class {
         if (sensitiveFiles.length > 0) {
           reasons.push(`sensitive files: ${sensitiveFiles.join(", ")}`);
         }
-        this.warnings.push(
-          `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+        const allProtected = patch.files.length > 0 && patch.files.every(
+          (f) => this.fernignorePatterns.some((p) => f === p || minimatch(f, p))
         );
+        if (!allProtected) {
+          this.warnings.push(
+            `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+          );
+        }
       } else {
         cleanPatches.push(patch);
       }
@@ -829,8 +861,48 @@ var ReplayDetector = class {
     this.lockManager = lockManager;
     this.sdkOutputDir = sdkOutputDir;
   }
+  /**
+   * Derive the previous-generation SHA from git history instead of trusting
+   * `lock.current_generation`.
+   *
+   * Walks `git log HEAD --first-parent` and returns the SHA of the most recent
+   * commit that `isGenerationBoundary` classifies as a customization-baseline
+   * boundary, or null if no such commit is reachable from HEAD on the mainline.
+   *
+   * `isGenerationBoundary` is intentionally narrower than `isGenerationCommit`:
+   * it excludes `[fern-autoversion]` (lightweight bumps that don't reset the
+   * baseline) and the GitHub merge-commit subject for fern-bot regen PRs
+   * (which sits on first-parent but where the customer fix-up commits live
+   * on second-parent — stopping at the merge would hide them).
+   *
+   * See docs/adr/0001-derived-scan-boundary.md.
+   */
+  async findPreviousGenerationFromHistory() {
+    let log;
+    try {
+      log = await this.git.exec([
+        "log",
+        "--first-parent",
+        "--format=%H%x00%an%x00%ae%x00%s",
+        "HEAD"
+      ]);
+    } catch {
+      return null;
+    }
+    for (const commit of this.parseGitLog(log)) {
+      if (isGenerationBoundary(commit)) {
+        return commit.sha;
+      }
+    }
+    return null;
+  }
   async detectNewPatches() {
     const lock = this.lockManager.read();
+    const derivedSha = await this.findPreviousGenerationFromHistory();
+    if (derivedSha !== null) {
+      const derivedRecord = await this.synthesizeGenerationRecord(derivedSha);
+      return this.detectPatchesInRange(derivedSha, derivedRecord, lock);
+    }
     const lastGen = this.getLastGeneration(lock);
     if (!lastGen) {
       return { patches: [], revertedPatchIds: [] };
@@ -838,7 +910,7 @@ var ReplayDetector = class {
     const exists = await this.git.commitExists(lastGen.commit_sha);
     if (!exists) {
       this.warnings.push(
-        `Generation commit ${lastGen.commit_sha.slice(0, 7)} not found in git history. Falling back to alternate detection.`
+        `Generation commit ${lastGen.commit_sha.slice(0, 7)} not found in git history. Falling back to tree-diff detection (likely a shallow clone).`
       );
       return this.detectPatchesViaTreeDiff(
         lastGen,
@@ -846,44 +918,8 @@ var ReplayDetector = class {
         true
       );
     }
-    const isAncestor = await this.git.isAncestor(lastGen.commit_sha, "HEAD");
-    if (!isAncestor) {
-      return this.detectPatchesViaMergeBase(lastGen, lock);
-    }
     return this.detectPatchesInRange(lastGen.commit_sha, lastGen, lock);
   }
-  /**
-   * Non-linear-history detection via `merge-base(prevGen, HEAD)`.
-   *
-   * After a squash-merge of a Fern-bot PR, `lastGen.commit_sha` (the previous
-   * `[fern-generated]`) is orphaned but still in git's object database. The
-   * merge-base is the commit on main from which the bot's branch was created —
-   * a reachable ancestor of HEAD. Walking that range and classifying each
-   * commit via `isGenerationCommit` mirrors the linear path and eliminates
-   * the bug class where pipeline-driven changes (autoversion, replay,
-   * generation) get bundled as customer customizations.
-   *
-   * Falls through to the legacy composite path when no common ancestor exists
-   * (truly disjoint history — orphan branches with no shared root).
-   */
-  async detectPatchesViaMergeBase(lastGen, lock) {
-    let mergeBase = "";
-    try {
-      mergeBase = (await this.git.exec(["merge-base", lastGen.commit_sha, "HEAD"])).trim();
-    } catch {
-    }
-    if (!mergeBase) {
-      this.warnings.push(
-        `No common ancestor between previous generation ${lastGen.commit_sha.slice(0, 7)} and HEAD. Falling back to composite tree-diff detection.`
-      );
-      return this.detectPatchesViaTreeDiff(
-        lastGen,
-        /* commitKnownMissing */
-        false
-      );
-    }
-    return this.detectPatchesInRange(mergeBase, lastGen, lock);
-  }
   /**
    * Walk `${rangeStart}..HEAD`, classify each commit, emit one
    * `StoredPatch` per customer commit. Body shared by the linear path
@@ -1319,6 +1355,26 @@ var ReplayDetector = class {
   getLastGeneration(lock) {
     return lock.generations.find((g) => g.commit_sha === lock.current_generation);
   }
+  /**
+   * Build a transient `GenerationRecord` from a SHA derived by walking git
+   * history. Only `commit_sha` (and `tree_hash` when needed downstream) is
+   * load-bearing here; the rest are filled with defensible placeholders.
+   * This record is consumed by `detectPatchesInRange` and is never persisted.
+   */
+  async synthesizeGenerationRecord(sha) {
+    let tree_hash = "";
+    try {
+      tree_hash = await this.git.getTreeHash(sha);
+    } catch {
+    }
+    return {
+      commit_sha: sha,
+      tree_hash,
+      timestamp: (/* @__PURE__ */ new Date(0)).toISOString(),
+      cli_version: "",
+      generator_versions: {}
+    };
+  }
 };
 
 // src/ThreeWayMerge.ts
@@ -1464,7 +1520,7 @@ function applyBothPatches(baseLines, oursPatches, theirsPatches) {
 import { mkdir as mkdir2, mkdtemp, readFile as readFile2, rm, unlink, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
 import { dirname as dirname3, join as join3 } from "path";
-import { minimatch } from "minimatch";
+import { minimatch as minimatch2 } from "minimatch";
 
 // src/accumulator/MergeAccumulator.ts
 var MergeAccumulator = class {
@@ -2180,13 +2236,13 @@ var ReplayApplicator = class {
   isExcluded(patch) {
     const config = this.lockManager.getCustomizationsConfig();
     if (!config.exclude) return false;
-    return patch.files.some((file) => config.exclude.some((pattern) => minimatch(file, pattern)));
+    return patch.files.some((file) => config.exclude.some((pattern) => minimatch2(file, pattern)));
   }
   async resolveFilePath(filePath, baseTreeHash, currentTreeHash) {
     const config = this.lockManager.getCustomizationsConfig();
     if (config.moves) {
       for (const move of config.moves) {
-        if (minimatch(filePath, move.from) || filePath === move.from) {
+        if (minimatch2(filePath, move.from) || filePath === move.from) {
           if (filePath === move.from) {
             return move.to;
           }
@@ -2458,8 +2514,7 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
       tree_hash: treeHash,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       cli_version: options?.cliVersion ?? "unknown",
-      generator_versions: options?.generatorVersions ?? {},
-      base_branch_head: options?.baseBranchHead
+      generator_versions: options?.generatorVersions ?? {}
     };
   }
   async stageAll() {
@@ -2478,7 +2533,7 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { readFile as readFileAsync } from "fs/promises";
 import { join as join6 } from "path";
-import { minimatch as minimatch3 } from "minimatch";
+import { minimatch as minimatch4 } from "minimatch";
 init_GitClient();
 
 // src/PatchRegionDiff.ts
@@ -2589,12 +2644,23 @@ async function computePerPatchDiff(patch, getCurrentGenContent, getWorkingTreeCo
       unlocatableFiles.push(file);
       continue;
     }
-    const locInCurrentGen = locInCurrentGenRaw.map(
-      (l) => resolveSpan(l, currentGenLines, "old")
-    );
-    const locInWorkingTree = locInWorkingTreeRaw.map(
-      (l) => resolveSpan(l, workingTreeLines, "new")
-    );
+    const locInCurrentGen = [];
+    const locInWorkingTree = [];
+    let spanResolutionFailed = false;
+    for (let i = 0; i < locInCurrentGenRaw.length; i++) {
+      const cg = resolveSpan(locInCurrentGenRaw[i], currentGenLines, "old");
+      const wt = resolveSpan(locInWorkingTreeRaw[i], workingTreeLines, "new");
+      if (cg === null || wt === null) {
+        spanResolutionFailed = true;
+        break;
+      }
+      locInCurrentGen.push(cg);
+      locInWorkingTree.push(wt);
+    }
+    if (spanResolutionFailed) {
+      unlocatableFiles.push(file);
+      continue;
+    }
     const overlay = overlayRegions(
       currentGenLines,
       locInCurrentGen,
@@ -2656,11 +2722,11 @@ function resolveSpan(loc, oursLines, prefer) {
   if (prefer === "old") {
     if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
     if (newFits) return { ...loc, oursSpan: hunk.newCount };
-  } else {
-    if (newFits) return { ...loc, oursSpan: hunk.newCount };
-    if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+    return loc;
   }
-  return loc;
+  if (newFits) return { ...loc, oursSpan: hunk.newCount };
+  if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+  return null;
 }
 function sequenceMatches(needle, haystack, offset) {
   if (offset + needle.length > haystack.length) return false;
@@ -2774,7 +2840,7 @@ function synthesizeDeleteFileDiff(file, content) {
 }
 
 // src/classifier/FileOwnership.ts
-import { minimatch as minimatch2 } from "minimatch";
+import { minimatch as minimatch3 } from "minimatch";
 var FileOwnership = class {
   constructor(git) {
     this.git = git;
@@ -2798,7 +2864,7 @@ var FileOwnership = class {
     const { file, originalFileName, patch, currentGenSha, fernignorePatterns, warnedGens, warnings } = ctx;
     if (patch.user_owned) return true;
     if (file === ".fernignore") return true;
-    if (fernignorePatterns.some((p) => file === p || minimatch2(file, p))) return true;
+    if (fernignorePatterns.some((p) => file === p || minimatch3(file, p))) return true;
     if (fileIsCreationInPatchContent(patch.patch_content, originalFileName ?? file)) {
       return true;
     }
@@ -2846,7 +2912,6 @@ var FirstGenerationFlow = class {
         flow: "first-generation",
         previousGenerationSha: null,
         currentGenerationSha: headSha,
-        baseBranchHead: options.baseBranchHead ?? null,
         _prepared: {
           kind: "terminal",
           flow: "first-generation",
@@ -2856,8 +2921,7 @@ var FirstGenerationFlow = class {
     }
     const commitOpts = options ? {
       cliVersion: options.cliVersion ?? "unknown",
-      generatorVersions: options.generatorVersions ?? {},
-      baseBranchHead: options.baseBranchHead
+      generatorVersions: options.generatorVersions ?? {}
     } : void 0;
     await this.service.committer.commitGeneration("Initial SDK generation", commitOpts);
     const genRecord = await this.service.committer.createGenerationRecord(commitOpts);
@@ -2866,7 +2930,6 @@ var FirstGenerationFlow = class {
       flow: "first-generation",
       previousGenerationSha: null,
       currentGenerationSha: genRecord.commit_sha,
-      baseBranchHead: options?.baseBranchHead ?? null,
       _prepared: {
         kind: "active",
         flow: "first-generation",
@@ -2880,6 +2943,7 @@ var FirstGenerationFlow = class {
     };
   }
   async apply(_prep) {
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     return firstGenerationReport();
   }
@@ -2903,8 +2967,7 @@ var SkipApplicationFlow = class {
   async prepare(options) {
     const commitOpts = options ? {
       cliVersion: options.cliVersion ?? "unknown",
-      generatorVersions: options.generatorVersions ?? {},
-      baseBranchHead: options.baseBranchHead
+      generatorVersions: options.generatorVersions ?? {}
     } : void 0;
     await this.service.committer.commitGeneration("Update SDK (replay skipped)", commitOpts);
     await this.service.cleanupStaleConflictMarkers();
@@ -2926,7 +2989,6 @@ var SkipApplicationFlow = class {
       flow: "skip-application",
       previousGenerationSha,
       currentGenerationSha: genRecord.commit_sha,
-      baseBranchHead: options?.baseBranchHead ?? null,
       _prepared: {
         kind: "active",
         flow: "skip-application",
@@ -2940,6 +3002,7 @@ var SkipApplicationFlow = class {
     };
   }
   async apply(_prep, options) {
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     const credentialWarnings = [...this.service.lockManager.warnings];
     if (!options?.stageOnly) {
@@ -2987,7 +3050,6 @@ var NoPatchesFlow = class {
         flow: "no-patches",
         previousGenerationSha,
         currentGenerationSha: headSha,
-        baseBranchHead: options.baseBranchHead ?? null,
         _prepared: {
           kind: "terminal",
           flow: "no-patches",
@@ -3019,8 +3081,7 @@ var NoPatchesFlow = class {
     }
     const commitOpts = options ? {
       cliVersion: options.cliVersion ?? "unknown",
-      generatorVersions: options.generatorVersions ?? {},
-      baseBranchHead: options.baseBranchHead
+      generatorVersions: options.generatorVersions ?? {}
     } : void 0;
     await this.service.committer.commitGeneration("Update SDK", commitOpts);
     await this.service.cleanupStaleConflictMarkers();
@@ -3030,7 +3091,6 @@ var NoPatchesFlow = class {
       flow: "no-patches",
       previousGenerationSha,
       currentGenerationSha: genRecord.commit_sha,
-      baseBranchHead: options?.baseBranchHead ?? null,
       _prepared: {
         kind: "active",
         flow: "no-patches",
@@ -3066,6 +3126,7 @@ var NoPatchesFlow = class {
         this.service.lockManager.addPatch(patch);
       }
     }
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     this.service.warnings.push(...this.service.lockManager.warnings);
     if (newPatches.length > 0) {
@@ -3120,7 +3181,6 @@ var NormalRegenerationFlow = class {
         flow: "normal-regeneration",
         previousGenerationSha,
         currentGenerationSha: headSha,
-        baseBranchHead: options.baseBranchHead ?? null,
         _prepared: {
           kind: "terminal",
           flow: "normal-regeneration",
@@ -3138,14 +3198,16 @@ var NormalRegenerationFlow = class {
     existingPatches = this.service.lockManager.getPatches();
     const seenHashes = /* @__PURE__ */ new Map();
     for (const p of existingPatches) {
-      const priorPatchId = seenHashes.get(p.content_hash);
-      if (priorPatchId !== void 0) {
-        this.service.lockManager.removePatch(p.id);
-        this.service.warnings.push(
-          `Consolidated patch ${p.id} (commit ${(p.original_commit || "<missing>").slice(0, 7)}) into prior patch ${priorPatchId}: byte-identical patch_content. Per-commit attribution preserved in git log; lockfile collapsed to avoid duplicate-apply corruption on next regen.`
-        );
-      } else {
-        seenHashes.set(p.content_hash, p.id);
+      if (!p.original_commit || p.original_commit === "") {
+        const priorPatchId = seenHashes.get(p.content_hash);
+        if (priorPatchId !== void 0) {
+          this.service.lockManager.removePatch(p.id);
+          this.service.warnings.push(
+            `Consolidated patch ${p.id} into prior patch ${priorPatchId}: byte-identical patch_content. Lockfile collapsed to avoid duplicate-apply corruption on next regen.`
+          );
+        } else {
+          seenHashes.set(p.content_hash, p.id);
+        }
       }
     }
     existingPatches = this.service.lockManager.getPatches();
@@ -3174,8 +3236,7 @@ var NormalRegenerationFlow = class {
     const allPatches = [...existingPatches, ...newPatches];
     const commitOpts = options ? {
       cliVersion: options.cliVersion ?? "unknown",
-      generatorVersions: options.generatorVersions ?? {},
-      baseBranchHead: options.baseBranchHead
+      generatorVersions: options.generatorVersions ?? {}
     } : void 0;
     await this.service.committer.commitGeneration("Update SDK", commitOpts);
     await this.service.cleanupStaleConflictMarkers();
@@ -3185,7 +3246,6 @@ var NormalRegenerationFlow = class {
       flow: "normal-regeneration",
       previousGenerationSha,
       currentGenerationSha: genRecord.commit_sha,
-      baseBranchHead: options?.baseBranchHead ?? null,
       _prepared: {
         kind: "active",
         flow: "normal-regeneration",
@@ -3229,6 +3289,7 @@ var NormalRegenerationFlow = class {
         }
       }
     }
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     this.service.warnings.push(...this.service.lockManager.warnings);
     if (options?.stageOnly) {
@@ -3378,68 +3439,6 @@ var ReplayService = class {
     const prep = await this.prepareReplay(options);
     return this.applyPreparedReplay(prep, options);
   }
-  /**
-   * Sync the lockfile after a divergent PR was squash-merged.
-   * Call this BEFORE runReplay() when the CLI detects a merged divergent PR.
-   *
-   * After updating the generation record, re-detects customer patches via
-   * tree diff between the generation tag (pure generation tree) and HEAD
-   * (which includes customer customizations after squash merge). This ensures
-   * patches survive the squash merge → regenerate cycle even when the lockfile
-   * was restored from the base branch during conflict PR creation.
-   */
-  async syncFromDivergentMerge(generationCommitSha, options) {
-    const treeHash = await this.git.getTreeHash(generationCommitSha);
-    const timestamp = (await this.git.exec(["log", "-1", "--format=%aI", generationCommitSha])).trim();
-    const record = {
-      commit_sha: generationCommitSha,
-      tree_hash: treeHash,
-      timestamp,
-      cli_version: options?.cliVersion ?? "unknown",
-      generator_versions: options?.generatorVersions ?? {},
-      base_branch_head: options?.baseBranchHead
-    };
-    let resolvedPatches;
-    if (!this.lockManager.exists()) {
-      this.lockManager.initializeInMemory(record);
-    } else {
-      this.lockManager.read();
-      const unresolvedPatches = [
-        ...this.lockManager.getUnresolvedPatches(),
-        ...this.lockManager.getResolvingPatches()
-      ];
-      resolvedPatches = this.lockManager.getPatches().filter((p) => p.status == null);
-      this.lockManager.addGeneration(record);
-      this.lockManager.clearPatches();
-      for (const patch of unresolvedPatches) {
-        this.lockManager.addPatch(patch);
-      }
-    }
-    try {
-      const { patches: redetectedPatches } = await this.detector.detectNewPatches();
-      if (redetectedPatches.length > 0) {
-        const redetectedFiles = new Set(redetectedPatches.flatMap((p) => p.files));
-        const currentPatches = this.lockManager.getPatches();
-        for (const patch of currentPatches) {
-          if (patch.status != null && patch.files.some((f) => redetectedFiles.has(f))) {
-            this.lockManager.removePatch(patch.id);
-          }
-        }
-        for (const patch of redetectedPatches) {
-          this.lockManager.addPatch(patch);
-        }
-      }
-    } catch (error) {
-      for (const patch of resolvedPatches ?? []) {
-        this.lockManager.addPatch(patch);
-      }
-      this.detector.warnings.push(
-        `Patch re-detection failed after divergent merge sync. ${(resolvedPatches ?? []).length} previously resolved patch(es) preserved. Error: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    this.lockManager.save();
-    this.detector.warnings.push(...this.lockManager.warnings);
-  }
   determineFlow() {
     try {
       const lock = this.lockManager.read();
@@ -3524,7 +3523,7 @@ var ReplayService = class {
           )
         );
         const hasProtectedFiles = patch.files.some(
-          (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch3(file, p))
+          (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch4(file, p))
         );
         const allUserOwned = isUserOwnedPerFile.every(Boolean);
         if (allUserOwned && patch.files.length > 0) {
@@ -3964,7 +3963,7 @@ var ReplayService = class {
             );
             if (snapHasStaleMarkers) continue;
             const isProtectedSnap = patch.files.some(
-              (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch3(file, p))
+              (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch4(file, p))
             );
             if (isProtectedSnap) continue;
             const snapHash = this.detector.computeContentHash(snapshotDiff);
@@ -3984,6 +3983,11 @@ var ReplayService = class {
             (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
           );
           if (ppResult === null) continue;
+          if (ppResult.hadFallback) {
+            this.warnings.push(
+              `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+            );
+          }
           const diff = ppResult.diff;
           if (!diff.trim()) {
             if (await allPatchFilesUserOwned(patch)) continue;
@@ -3999,7 +4003,7 @@ var ReplayService = class {
             continue;
           }
           const isProtected = patch.files.some(
-            (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch3(file, p))
+            (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || minimatch4(file, p))
           );
           if (isProtected) {
             continue;
@@ -4071,6 +4075,11 @@ var ReplayService = class {
           (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
         );
         if (ppResult === null) continue;
+        if (ppResult.hadFallback) {
+          this.warnings.push(
+            `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+          );
+        }
         const diff = ppResult.diff;
         if (!diff.trim()) {
           if (await allPatchFilesUserOwned(patch)) {
@@ -4158,13 +4167,14 @@ If you want to keep these lines, restore them in a follow-up commit and re-run r
     if (files.length === 0) return;
     const fernignorePatterns = this.readFernignorePatterns();
     for (const file of files) {
-      if (fernignorePatterns.some((pattern) => minimatch3(file, pattern))) continue;
+      if (fernignorePatterns.some((pattern) => minimatch4(file, pattern))) continue;
       try {
         await this.git.exec(["checkout", "HEAD", "--", file]);
       } catch {
       }
     }
   }
+  /** @internal Used by Flow implementations in `src/flows/`. */
   readFernignorePatterns() {
     const fernignorePath = join6(this.outputDir, ".fernignore");
     if (!existsSync2(fernignorePath)) return [];
@@ -4247,7 +4257,7 @@ function computeCommitBuckets(results, absorbedPatchIds, patchesPassedToCommit)
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, statSync, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname5, join as join7 } from "path";
-import { minimatch as minimatch4 } from "minimatch";
+import { minimatch as minimatch5 } from "minimatch";
 import { parse as parse2, stringify as stringify2 } from "yaml";
 var FernignoreMigrator = class {
   git;
@@ -4279,7 +4289,7 @@ var FernignoreMigrator = class {
     const commitsOnly = [];
     const syntheticPatches = [];
     for (const pattern of patterns) {
-      const matchingPatch = patches.find((p) => p.files.some((f) => minimatch4(f, pattern) || f === pattern));
+      const matchingPatch = patches.find((p) => p.files.some((f) => minimatch5(f, pattern) || f === pattern));
       if (matchingPatch) {
         trackedByBoth.push({
           file: pattern,
@@ -4352,7 +4362,7 @@ var FernignoreMigrator = class {
       fernignoreOnly.push(...remainingFernignoreOnly);
     }
     for (const patch of patches) {
-      const hasUnprotectedFiles = patch.files.some((f) => !patterns.some((p) => minimatch4(f, p) || f === p));
+      const hasUnprotectedFiles = patch.files.some((f) => !patterns.some((p) => minimatch5(f, p) || f === p));
       if (hasUnprotectedFiles) {
         commitsOnly.push(patch);
       }
@@ -4364,7 +4374,7 @@ var FernignoreMigrator = class {
     const results = [];
     for (const pattern of patterns) {
       const matching = allFiles.filter(
-        (f) => minimatch4(f, pattern) || f === pattern || f.startsWith(pattern + "/")
+        (f) => minimatch5(f, pattern) || f === pattern || f.startsWith(pattern + "/")
       );
       results.push({ pattern, files: matching.length > 0 ? matching : [pattern] });
     }
@@ -4677,7 +4687,7 @@ function computeContentHash(patchContent) {
 }
 
 // src/commands/forget.ts
-import { minimatch as minimatch5 } from "minimatch";
+import { minimatch as minimatch6 } from "minimatch";
 function parseDiffStat(patchContent) {
   let additions = 0;
   let deletions = 0;
@@ -4707,7 +4717,7 @@ function toMatchedPatch(patch) {
 }
 function matchesPatch(patch, pattern) {
   const fileMatch = patch.files.some(
-    (file) => file === pattern || minimatch5(file, pattern)
+    (file) => file === pattern || minimatch6(file, pattern)
   );
   if (fileMatch) return true;
   return patch.original_message.toLowerCase().includes(pattern.toLowerCase());