@fern-api/replay 0.16.0 → 0.16.2

package/dist/index.cjs

@@ -588,6 +588,7 @@ function parseRevertedMessage(subject) {
 // src/LockfileManager.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
+var import_minimatch = require("minimatch");
 var import_yaml = require("yaml");
 var LOCKFILE_HEADER = "# DO NOT EDIT MANUALLY - Managed by Fern Replay\n";
 var LockfileNotFoundError = class extends Error {
@@ -599,10 +600,23 @@ var LockfileNotFoundError = class extends Error {
 var LockfileManager = class {
   outputDir;
   lock = null;
+  fernignorePatterns = [];
   warnings = [];
   constructor(outputDir) {
     this.outputDir = outputDir;
   }
+  /**
+   * Inform the lockfile of the customer's `.fernignore` patterns so that
+   * `save()` can suppress its "Patch X removed from lockfile" warning when
+   * every file in the stripped patch is already `.fernignore`-protected.
+   * The strip itself still happens (credentials never persist); only the
+   * customer-visible warning is suppressed in that case, because the
+   * protected files survive the generator wipe regardless of whether the
+   * lockfile tracks them, so there's nothing for the customer to action.
+   */
+  setFernignorePatterns(patterns) {
+    this.fernignorePatterns = patterns;
+  }
   get lockfilePath() {
     return (0, import_node_path.join)(this.outputDir, ".fern", "replay.lock");
   }
@@ -671,9 +685,14 @@ var LockfileManager = class {
         if (sensitiveFiles.length > 0) {
           reasons.push(`sensitive files: ${sensitiveFiles.join(", ")}`);
         }
-        this.warnings.push(
-          `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+        const allProtected = patch.files.length > 0 && patch.files.every(
+          (f) => this.fernignorePatterns.some((p) => f === p || (0, import_minimatch.minimatch)(f, p))
         );
+        if (!allProtected) {
+          this.warnings.push(
+            `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+          );
+        }
       } else {
         cleanPatches.push(patch);
       }
@@ -782,6 +801,7 @@ var LockfileManager = class {
 
 // src/ReplayDetector.ts
 var import_node_crypto = require("crypto");
+var import_minimatch2 = require("minimatch");
 
 // src/shared/binary.ts
 var import_node_path2 = require("path");
@@ -841,6 +861,15 @@ function isBinaryFile(filePath) {
 
 // src/ReplayDetector.ts
 var INFRASTRUCTURE_FILES = /* @__PURE__ */ new Set([".fernignore"]);
+function matchesFernignorePattern(filePath, patterns) {
+  if (patterns.length === 0) return false;
+  return patterns.some((p) => {
+    if (filePath === p) return true;
+    if ((0, import_minimatch2.minimatch)(filePath, p)) return true;
+    if (!p.includes("*") && !p.includes("?") && filePath.startsWith(p + "/")) return true;
+    return false;
+  });
+}
 function parsePatchFileHeaders(patchContent) {
   const results = [];
   let currentPath = null;
@@ -881,21 +910,25 @@ async function capturePatchSnapshot(git, files, treeish) {
   }
   return snapshot;
 }
-function filterInfrastructureAndSensitiveFiles(rawFilesOutput) {
+function filterInfrastructureAndSensitiveFiles(rawFilesOutput, fernignorePatterns) {
   const allFiles = rawFilesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
   const sensitiveFiles = allFiles.filter((f) => isSensitiveFile(f));
-  const files = allFiles.filter((f) => !isSensitiveFile(f));
-  return { files, sensitiveFiles };
+  const nonSensitive = allFiles.filter((f) => !isSensitiveFile(f));
+  const fernignoredFiles = nonSensitive.filter((f) => matchesFernignorePattern(f, fernignorePatterns));
+  const files = nonSensitive.filter((f) => !matchesFernignorePattern(f, fernignorePatterns));
+  return { files, sensitiveFiles, fernignoredFiles };
 }
 var ReplayDetector = class {
   git;
   lockManager;
   sdkOutputDir;
+  fernignorePatterns;
   warnings = [];
-  constructor(git, lockManager, sdkOutputDir) {
+  constructor(git, lockManager, sdkOutputDir, fernignorePatterns = []) {
     this.git = git;
     this.lockManager = lockManager;
     this.sdkOutputDir = sdkOutputDir;
+    this.fernignorePatterns = fernignorePatterns;
   }
   /**
    * Derive the previous-generation SHA from git history instead of trusting
@@ -1002,22 +1035,30 @@ var ReplayDetector = class {
         continue;
       }
       const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-      const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+      const { files, sensitiveFiles, fernignoredFiles } = filterInfrastructureAndSensitiveFiles(
+        filesOutput,
+        this.fernignorePatterns
+      );
       if (sensitiveFiles.length > 0) {
         this.warnings.push(
           `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
         );
-        if (files.length > 0) {
-          const parentSha = parents[0];
-          if (parentSha) {
-            try {
-              patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
-            } catch {
-              continue;
-            }
-            if (!patchContent.trim()) continue;
-            contentHash = this.computeContentHash(patchContent);
+      }
+      if (fernignoredFiles.length > 0) {
+        this.warnings.push(
+          `.fernignore-protected file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${fernignoredFiles.join(", ")}. These files are managed by .fernignore, not Replay.`
+        );
+      }
+      if ((sensitiveFiles.length > 0 || fernignoredFiles.length > 0) && files.length > 0) {
+        const parentSha = parents[0];
+        if (parentSha) {
+          try {
+            patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
+          } catch {
+            continue;
           }
+          if (!patchContent.trim()) continue;
+          contentHash = this.computeContentHash(patchContent);
         }
       }
       if (files.length === 0) {
@@ -1216,12 +1257,20 @@ var ReplayDetector = class {
       resolvedBaseGeneration = fallback;
     }
     const filesOutput = await this.git.exec(["diff", "--name-only", diffBase, "HEAD"]);
-    const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+    const { files, sensitiveFiles, fernignoredFiles } = filterInfrastructureAndSensitiveFiles(
+      filesOutput,
+      this.fernignorePatterns
+    );
     if (sensitiveFiles.length > 0) {
       this.warnings.push(
         `Sensitive file(s) excluded from composite patch: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
       );
     }
+    if (fernignoredFiles.length > 0) {
+      this.warnings.push(
+        `.fernignore-protected file(s) excluded from composite patch: ${fernignoredFiles.join(", ")}. These files are managed by .fernignore, not Replay.`
+      );
+    }
     if (files.length === 0) return { patches: [], revertedPatchIds: [] };
     const diff = await this.git.exec(["diff", diffBase, "HEAD", "--", ...files]);
     if (!diff.trim()) return { patches: [], revertedPatchIds: [] };
@@ -1304,23 +1353,31 @@ var ReplayDetector = class {
         continue;
       }
       const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-      const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+      const { files, sensitiveFiles, fernignoredFiles } = filterInfrastructureAndSensitiveFiles(
+        filesOutput,
+        this.fernignorePatterns
+      );
       if (sensitiveFiles.length > 0) {
         this.warnings.push(
           `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
         );
-        if (files.length > 0) {
-          if (parents.length === 0) {
-            continue;
-          }
-          try {
-            patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
-          } catch {
-            continue;
-          }
-          if (!patchContent.trim()) continue;
-          contentHash = this.computeContentHash(patchContent);
+      }
+      if (fernignoredFiles.length > 0) {
+        this.warnings.push(
+          `.fernignore-protected file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${fernignoredFiles.join(", ")}. These files are managed by .fernignore, not Replay.`
+        );
+      }
+      if ((sensitiveFiles.length > 0 || fernignoredFiles.length > 0) && files.length > 0) {
+        if (parents.length === 0) {
+          continue;
+        }
+        try {
+          patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
+        } catch {
+          continue;
         }
+        if (!patchContent.trim()) continue;
+        contentHash = this.computeContentHash(patchContent);
       }
       if (files.length === 0) {
         continue;
@@ -1556,7 +1613,7 @@ function applyBothPatches(baseLines, oursPatches, theirsPatches) {
 var import_promises3 = require("fs/promises");
 var import_node_os = require("os");
 var import_node_path5 = require("path");
-var import_minimatch = require("minimatch");
+var import_minimatch3 = require("minimatch");
 
 // src/accumulator/MergeAccumulator.ts
 var MergeAccumulator = class {
@@ -2272,13 +2329,13 @@ var ReplayApplicator = class {
   isExcluded(patch) {
     const config = this.lockManager.getCustomizationsConfig();
     if (!config.exclude) return false;
-    return patch.files.some((file) => config.exclude.some((pattern) => (0, import_minimatch.minimatch)(file, pattern)));
+    return patch.files.some((file) => config.exclude.some((pattern) => (0, import_minimatch3.minimatch)(file, pattern)));
   }
   async resolveFilePath(filePath, baseTreeHash, currentTreeHash) {
     const config = this.lockManager.getCustomizationsConfig();
     if (config.moves) {
       for (const move of config.moves) {
-        if ((0, import_minimatch.minimatch)(filePath, move.from) || filePath === move.from) {
+        if ((0, import_minimatch3.minimatch)(filePath, move.from) || filePath === move.from) {
           if (filePath === move.from) {
             return move.to;
           }
@@ -2569,7 +2626,7 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
 var import_node_fs2 = require("fs");
 var import_promises6 = require("fs/promises");
 var import_node_path8 = require("path");
-var import_minimatch3 = require("minimatch");
+var import_minimatch5 = require("minimatch");
 init_GitClient();
 
 // src/PatchRegionDiff.ts
@@ -2680,12 +2737,23 @@ async function computePerPatchDiff(patch, getCurrentGenContent, getWorkingTreeCo
       unlocatableFiles.push(file);
       continue;
     }
-    const locInCurrentGen = locInCurrentGenRaw.map(
-      (l) => resolveSpan(l, currentGenLines, "old")
-    );
-    const locInWorkingTree = locInWorkingTreeRaw.map(
-      (l) => resolveSpan(l, workingTreeLines, "new")
-    );
+    const locInCurrentGen = [];
+    const locInWorkingTree = [];
+    let spanResolutionFailed = false;
+    for (let i = 0; i < locInCurrentGenRaw.length; i++) {
+      const cg = resolveSpan(locInCurrentGenRaw[i], currentGenLines, "old");
+      const wt = resolveSpan(locInWorkingTreeRaw[i], workingTreeLines, "new");
+      if (cg === null || wt === null) {
+        spanResolutionFailed = true;
+        break;
+      }
+      locInCurrentGen.push(cg);
+      locInWorkingTree.push(wt);
+    }
+    if (spanResolutionFailed) {
+      unlocatableFiles.push(file);
+      continue;
+    }
     const overlay = overlayRegions(
       currentGenLines,
       locInCurrentGen,
@@ -2747,11 +2815,11 @@ function resolveSpan(loc, oursLines, prefer) {
   if (prefer === "old") {
     if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
     if (newFits) return { ...loc, oursSpan: hunk.newCount };
-  } else {
-    if (newFits) return { ...loc, oursSpan: hunk.newCount };
-    if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+    return loc;
   }
-  return loc;
+  if (newFits) return { ...loc, oursSpan: hunk.newCount };
+  if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+  return null;
 }
 function sequenceMatches(needle, haystack, offset) {
   if (offset + needle.length > haystack.length) return false;
@@ -2865,7 +2933,7 @@ function synthesizeDeleteFileDiff(file, content) {
 }
 
 // src/classifier/FileOwnership.ts
-var import_minimatch2 = require("minimatch");
+var import_minimatch4 = require("minimatch");
 var FileOwnership = class {
   constructor(git) {
     this.git = git;
@@ -2889,7 +2957,7 @@ var FileOwnership = class {
     const { file, originalFileName, patch, currentGenSha, fernignorePatterns, warnedGens, warnings } = ctx;
     if (patch.user_owned) return true;
     if (file === ".fernignore") return true;
-    if (fernignorePatterns.some((p) => file === p || (0, import_minimatch2.minimatch)(file, p))) return true;
+    if (fernignorePatterns.some((p) => file === p || (0, import_minimatch4.minimatch)(file, p))) return true;
     if (fileIsCreationInPatchContent(patch.patch_content, originalFileName ?? file)) {
       return true;
     }
@@ -2968,6 +3036,7 @@ var FirstGenerationFlow = class {
     };
   }
   async apply(_prep) {
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     return firstGenerationReport();
   }
@@ -3026,6 +3095,7 @@ var SkipApplicationFlow = class {
     };
   }
   async apply(_prep, options) {
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     const credentialWarnings = [...this.service.lockManager.warnings];
     if (!options?.stageOnly) {
@@ -3149,6 +3219,7 @@ var NoPatchesFlow = class {
         this.service.lockManager.addPatch(patch);
       }
     }
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     this.service.warnings.push(...this.service.lockManager.warnings);
     if (newPatches.length > 0) {
@@ -3311,6 +3382,7 @@ var NormalRegenerationFlow = class {
         }
       }
     }
+    this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
     this.service.lockManager.save();
     this.service.warnings.push(...this.service.lockManager.warnings);
     if (options?.stageOnly) {
@@ -3391,7 +3463,8 @@ var ReplayService = class {
     this.git = git;
     this.outputDir = outputDir;
     this.lockManager = new LockfileManager(outputDir);
-    this.detector = new ReplayDetector(git, this.lockManager, outputDir);
+    const fernignorePatterns = this.readFernignorePatterns();
+    this.detector = new ReplayDetector(git, this.lockManager, outputDir, fernignorePatterns);
     this.applicator = new ReplayApplicator(git, this.lockManager, outputDir);
     this.committer = new ReplayCommitter(git, outputDir);
     this.fileOwnership = new FileOwnership(git);
@@ -3411,8 +3484,60 @@ var ReplayService = class {
   async prepareReplay(options) {
     this.warnings = [];
     this.detector.warnings.length = 0;
+    this.cleanseLegacyFernignoreEntries();
     return this.selectFlow(options).prepare(options);
   }
+  /**
+   * ADR 0002 migration step. Strips `.fernignore`-matched entries from
+   * `patch.files`, `patch.theirs_snapshot` keys, and `diff --git` sections
+   * in `patch.patch_content` for every patch in the lockfile. Patches that
+   * end up with no surviving files are removed entirely.
+   *
+   * Idempotent: a second run is a no-op because the first run already
+   * matches the contract. Per-patch try/catch ensures one bad patch does
+   * not block the rest. Each affected patch emits a warning naming the
+   * stripped paths. `patch_content` is left untouched if no parseable
+   * `diff --git` headers are found (fail-safe for exotic legacy formats).
+   */
+  cleanseLegacyFernignoreEntries() {
+    const patterns = this.readFernignorePatterns();
+    if (patterns.length === 0) return;
+    if (!this.lockManager.exists()) return;
+    this.lockManager.read();
+    let lockfileMutated = false;
+    const patches = this.lockManager.getPatches();
+    for (const patch of patches) {
+      try {
+        const result = computeLegacyFernignoreCleanse(
+          patch,
+          patterns,
+          (content) => this.detector.computeContentHash(content)
+        );
+        if (result.unchanged) continue;
+        if (result.remove) {
+          this.lockManager.removePatch(patch.id);
+          this.warnings.push(
+            `Cleansed legacy patch ${patch.id}: all referenced files match .fernignore \u2014 patch removed. Customer's on-disk content for those files is preserved by .fernignore. (ADR 0002: .fernignore-protected files are not tracked by Replay.)`
+          );
+        } else {
+          this.lockManager.updatePatch(patch.id, {
+            files: result.files,
+            patch_content: result.patch_content,
+            content_hash: result.content_hash,
+            ...result.theirs_snapshot !== void 0 ? { theirs_snapshot: result.theirs_snapshot } : {}
+          });
+          this.warnings.push(
+            `Cleansed legacy patch ${patch.id}: stripped .fernignore-matched entries (${result.strippedPaths.join(", ")}). Customer's on-disk content for those files is preserved by .fernignore. (ADR 0002.)`
+          );
+        }
+        lockfileMutated = true;
+      } catch {
+      }
+    }
+    if (lockfileMutated) {
+      this.lockManager.save();
+    }
+  }
   /**
    * Phase 2 of the two-phase replay flow. Applies patches, rebases them against
    * the generation, saves the lockfile, and commits `[fern-replay]` (or stages
@@ -3544,7 +3669,7 @@ var ReplayService = class {
           )
         );
         const hasProtectedFiles = patch.files.some(
-          (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || (0, import_minimatch3.minimatch)(file, p))
+          (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || (0, import_minimatch5.minimatch)(file, p))
         );
         const allUserOwned = isUserOwnedPerFile.every(Boolean);
         if (allUserOwned && patch.files.length > 0) {
@@ -3984,7 +4109,7 @@ var ReplayService = class {
             );
             if (snapHasStaleMarkers) continue;
             const isProtectedSnap = patch.files.some(
-              (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || (0, import_minimatch3.minimatch)(file, p))
+              (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || (0, import_minimatch5.minimatch)(file, p))
             );
             if (isProtectedSnap) continue;
             const snapHash = this.detector.computeContentHash(snapshotDiff);
@@ -4004,6 +4129,11 @@ var ReplayService = class {
             (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
           );
           if (ppResult === null) continue;
+          if (ppResult.hadFallback) {
+            this.warnings.push(
+              `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+            );
+          }
           const diff = ppResult.diff;
           if (!diff.trim()) {
             if (await allPatchFilesUserOwned(patch)) continue;
@@ -4019,7 +4149,7 @@ var ReplayService = class {
             continue;
           }
           const isProtected = patch.files.some(
-            (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || (0, import_minimatch3.minimatch)(file, p))
+            (file) => file === ".fernignore" || fernignorePatterns.some((p) => file === p || (0, import_minimatch5.minimatch)(file, p))
           );
           if (isProtected) {
             continue;
@@ -4091,6 +4221,11 @@ var ReplayService = class {
           (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
         );
         if (ppResult === null) continue;
+        if (ppResult.hadFallback) {
+          this.warnings.push(
+            `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+          );
+        }
         const diff = ppResult.diff;
         if (!diff.trim()) {
           if (await allPatchFilesUserOwned(patch)) {
@@ -4178,13 +4313,14 @@ If you want to keep these lines, restore them in a follow-up commit and re-run r
     if (files.length === 0) return;
     const fernignorePatterns = this.readFernignorePatterns();
     for (const file of files) {
-      if (fernignorePatterns.some((pattern) => (0, import_minimatch3.minimatch)(file, pattern))) continue;
+      if (fernignorePatterns.some((pattern) => (0, import_minimatch5.minimatch)(file, pattern))) continue;
       try {
         await this.git.exec(["checkout", "HEAD", "--", file]);
       } catch {
       }
     }
   }
+  /** @internal Used by Flow implementations in `src/flows/`. */
   readFernignorePatterns() {
     const fernignorePath = (0, import_node_path8.join)(this.outputDir, ".fernignore");
     if (!(0, import_node_fs2.existsSync)(fernignorePath)) return [];
@@ -4262,12 +4398,99 @@ function computeCommitBuckets(results, absorbedPatchIds, patchesPassedToCommit)
   }
   return { applied, unresolved, absorbed };
 }
+function computeLegacyFernignoreCleanse(patch, fernignorePatterns, computeContentHash2) {
+  const matchesFernignore = (filePath) => fernignorePatterns.some((p) => {
+    if (filePath === p) return true;
+    if ((0, import_minimatch5.minimatch)(filePath, p)) return true;
+    if (!p.includes("*") && !p.includes("?") && filePath.startsWith(p + "/")) return true;
+    return false;
+  });
+  const strippedFromFiles = patch.files.filter(matchesFernignore);
+  const survivingFiles = patch.files.filter((f) => !matchesFernignore(f));
+  let survivingSnapshot = void 0;
+  let snapshotChanged = false;
+  if (patch.theirs_snapshot) {
+    survivingSnapshot = {};
+    for (const [key, value] of Object.entries(patch.theirs_snapshot)) {
+      if (matchesFernignore(key)) {
+        snapshotChanged = true;
+      } else {
+        survivingSnapshot[key] = value;
+      }
+    }
+  }
+  const { stripped: patchContentStripped, content: newPatchContent, strippedSectionPaths } = stripFernignoreDiffSections(patch.patch_content, matchesFernignore);
+  const unchanged = strippedFromFiles.length === 0 && !snapshotChanged && !patchContentStripped;
+  if (unchanged) {
+    return {
+      unchanged: true,
+      remove: false,
+      files: patch.files,
+      patch_content: patch.patch_content,
+      content_hash: patch.content_hash,
+      theirs_snapshot: patch.theirs_snapshot,
+      strippedPaths: []
+    };
+  }
+  const strippedPaths = Array.from(/* @__PURE__ */ new Set([...strippedFromFiles, ...strippedSectionPaths]));
+  if (survivingFiles.length === 0 || newPatchContent.trim() === "") {
+    return {
+      unchanged: false,
+      remove: true,
+      files: [],
+      patch_content: "",
+      content_hash: "",
+      strippedPaths
+    };
+  }
+  const newContentHash = patchContentStripped ? computeContentHash2(newPatchContent) : patch.content_hash;
+  return {
+    unchanged: false,
+    remove: false,
+    files: survivingFiles,
+    patch_content: newPatchContent,
+    content_hash: newContentHash,
+    ...survivingSnapshot !== void 0 ? { theirs_snapshot: survivingSnapshot } : {},
+    strippedPaths
+  };
+}
+function stripFernignoreDiffSections(patchContent, matchesFernignore) {
+  const lines = patchContent.split("\n");
+  const sectionStarts = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.startsWith("diff --git ")) {
+      const match = line.match(/^diff --git a\/(.+?) b\/(.+?)$/);
+      const path = match ? match[2] : null;
+      sectionStarts.push({ idx: i, path });
+    }
+  }
+  if (sectionStarts.length === 0) {
+    return { stripped: false, content: patchContent, strippedSectionPaths: [] };
+  }
+  const preamble = lines.slice(0, sectionStarts[0].idx);
+  const newLines = [...preamble];
+  const strippedSectionPaths = [];
+  let stripped = false;
+  for (let i = 0; i < sectionStarts.length; i++) {
+    const section = sectionStarts[i];
+    const next = sectionStarts[i + 1];
+    const endIdx = next ? next.idx : lines.length;
+    if (section.path !== null && matchesFernignore(section.path)) {
+      stripped = true;
+      strippedSectionPaths.push(section.path);
+      continue;
+    }
+    newLines.push(...lines.slice(section.idx, endIdx));
+  }
+  return { stripped, content: newLines.join("\n"), strippedSectionPaths };
+}
 
 // src/FernignoreMigrator.ts
 var import_node_crypto2 = require("crypto");
 var import_node_fs3 = require("fs");
 var import_node_path9 = require("path");
-var import_minimatch4 = require("minimatch");
+var import_minimatch6 = require("minimatch");
 var import_yaml2 = require("yaml");
 var FernignoreMigrator = class {
   git;
@@ -4299,7 +4522,7 @@ var FernignoreMigrator = class {
     const commitsOnly = [];
     const syntheticPatches = [];
     for (const pattern of patterns) {
-      const matchingPatch = patches.find((p) => p.files.some((f) => (0, import_minimatch4.minimatch)(f, pattern) || f === pattern));
+      const matchingPatch = patches.find((p) => p.files.some((f) => (0, import_minimatch6.minimatch)(f, pattern) || f === pattern));
       if (matchingPatch) {
         trackedByBoth.push({
           file: pattern,
@@ -4372,7 +4595,7 @@ var FernignoreMigrator = class {
       fernignoreOnly.push(...remainingFernignoreOnly);
     }
     for (const patch of patches) {
-      const hasUnprotectedFiles = patch.files.some((f) => !patterns.some((p) => (0, import_minimatch4.minimatch)(f, p) || f === p));
+      const hasUnprotectedFiles = patch.files.some((f) => !patterns.some((p) => (0, import_minimatch6.minimatch)(f, p) || f === p));
       if (hasUnprotectedFiles) {
         commitsOnly.push(patch);
       }
@@ -4384,7 +4607,7 @@ var FernignoreMigrator = class {
     const results = [];
     for (const pattern of patterns) {
       const matching = allFiles.filter(
-        (f) => (0, import_minimatch4.minimatch)(f, pattern) || f === pattern || f.startsWith(pattern + "/")
+        (f) => (0, import_minimatch6.minimatch)(f, pattern) || f === pattern || f.startsWith(pattern + "/")
       );
       results.push({ pattern, files: matching.length > 0 ? matching : [pattern] });
     }
@@ -4697,7 +4920,7 @@ function computeContentHash(patchContent) {
 }
 
 // src/commands/forget.ts
-var import_minimatch5 = require("minimatch");
+var import_minimatch7 = require("minimatch");
 function parseDiffStat(patchContent) {
   let additions = 0;
   let deletions = 0;
@@ -4727,7 +4950,7 @@ function toMatchedPatch(patch) {
 }
 function matchesPatch(patch, pattern) {
   const fileMatch = patch.files.some(
-    (file) => file === pattern || (0, import_minimatch5.minimatch)(file, pattern)
+    (file) => file === pattern || (0, import_minimatch7.minimatch)(file, pattern)
   );
   if (fileMatch) return true;
   return patch.original_message.toLowerCase().includes(pattern.toLowerCase());