@gobing-ai/spur 0.4.1 → 0.4.2

package/plugins/sp/scripts/quality-gate.mjs

@@ -21,16 +21,14 @@ import {
   mkdirSync,
   mkdtempSync,
   openSync,
-  readdirSync,
   readFileSync,
-  rmdirSync,
   rmSync,
   statSync,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 var __defProp = Object.defineProperty;
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
@@ -82,19 +80,9 @@ var init_api_response = __esm(() => {
   CLIENT_SAFE_CODES = new Set([ErrorCode.NotFound, ErrorCode.Validation, ErrorCode.Conflict]);
 });
 var init_cursor = () => {};
-function getEnvVar(name, fallback) {
-  const raw = process.env[name];
-  return raw === undefined ? fallback : raw;
-}
 function getEnvVars2() {
   return process.env;
 }
-function setEnvVar(name, value) {
-  if (value === undefined)
-    delete process.env[name];
-  else
-    process.env[name] = value;
-}
 var init_event_severity = () => {};
 var init_dist = __esm(() => {
   init_api_response();
@@ -24913,7 +24901,7 @@ var POST_WATERMARK_TABLES = [
   "history_daily_stats",
   "history_board_source_daily"
 ];
-var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.21";
+var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.22";
 var HISTORY_IMPORT_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS history_import_checkpoint (
     source TEXT NOT NULL,
@@ -27867,6 +27855,9 @@ var INBOX_MESSAGES_REQUEST_KEY_SCHEMA_SQL = `
 ALTER TABLE inbox_messages ADD COLUMN request_key TEXT;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_inbox_messages_request_key ON inbox_messages (request_key) WHERE request_key IS NOT NULL;
 `;
+var INBOX_MESSAGES_READ_AT_SCHEMA_SQL = `
+ALTER TABLE inbox_messages ADD COLUMN read_at INTEGER;
+`;
 var QUEUE_JOBS_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS queue_jobs (
     id TEXT PRIMARY KEY,
@@ -28879,6 +28870,11 @@ var CLI_MIGRATIONS = [
   {
     id: "0052_spur_cli_decision_logs",
     sql: DECISION_LOGS_SCHEMA_SQL
+  },
+  {
+    id: "0053_spur_cli_inbox_messages_read_at",
+    sql: INBOX_MESSAGES_READ_AT_SCHEMA_SQL,
+    addColumnIfMissing: { table: "inbox_messages", column: "read_at" }
   }
 ];
 init_zod();
@@ -30367,159 +30363,6 @@ function runShellCommand(cmd, cwd, extraEnv) {
     rmSync(dir, { recursive: true, force: true });
   }
 }
-var GATE_LOCK_DIR_ENV = "SPUR_GATE_LOCK_DIR";
-var GATE_LOCK_POLL_MS_ENV = "SPUR_GATE_LOCK_POLL_MS";
-var GATE_LOCK_OFF_ENV = "SPUR_GATE_LOCK";
-var GATE_LOCK_TOKEN_ENV = "SPUR_GATE_LOCK_TOKEN";
-var GATE_LOCK_POLL_MS_DEFAULT = 5000;
-var GATE_LOCK_MKDIR_HOLD_MS_ENV = "SPUR_GATE_LOCK_TEST_MKDIR_HOLD_MS";
-var GATE_LOCK_LOST_RACE_SLEEP_MS = 20;
-var GATE_LOCK_LOST_RACE_LOG_AT = 250;
-function gateLockDir() {
-  const raw = getEnvVar(GATE_LOCK_DIR_ENV);
-  return raw !== undefined && raw.length > 0 ? raw : join(homedir(), ".config", "spur", "run", "full-gate.lock");
-}
-function gateLockPollMs() {
-  const raw = Number.parseInt(getEnvVar(GATE_LOCK_POLL_MS_ENV) ?? "", 10);
-  return Number.isFinite(raw) && raw > 0 ? raw : GATE_LOCK_POLL_MS_DEFAULT;
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error51) {
-    return error51.code !== "ESRCH";
-  }
-}
-function readGateLockClaim(dir) {
-  let markers;
-  try {
-    markers = readdirSync(dir).sort();
-  } catch {
-    return null;
-  }
-  for (const marker of markers) {
-    try {
-      const claim = JSON.parse(readFileSync(join(dir, marker), "utf8"));
-      if (typeof claim.pid === "number")
-        return { claim, marker };
-    } catch {
-      const pid = Number.parseInt(/^(\d+)-/.exec(marker)?.[1] ?? "", 10);
-      if (pid > 0) {
-        return { claim: { pid, startedAt: Date.now(), wbs: "?", runId: "?", cwd: "?" }, marker };
-      }
-    }
-  }
-  return null;
-}
-function acquireGateLock(env2, logLine = () => {}) {
-  if ((getEnvVar(GATE_LOCK_OFF_ENV) ?? "") === "off") {
-    return { release() {}, queueWaitMs: 0, token: "" };
-  }
-  const dir = gateLockDir();
-  mkdirSync(dirname(dir), { recursive: true });
-  const pollMs = gateLockPollMs();
-  const claim = {
-    pid: process.pid,
-    startedAt: Date.now(),
-    wbs: env2.wbs,
-    runId: receiptRunId(env2),
-    cwd: process.cwd()
-  };
-  const marker = `${process.pid}-${randomUUID()}`;
-  const startedWaitingAt = Date.now();
-  let holderLogged = false;
-  let graceLogged = false;
-  let lostRaces = 0;
-  let lostRaceLogged = false;
-  const mkdirHoldMs = Number.parseInt(getEnvVar(GATE_LOCK_MKDIR_HOLD_MS_ENV) ?? "", 10);
-  for (;; ) {
-    let dirIno = null;
-    try {
-      mkdirSync(dir);
-      dirIno = statSync(dir).ino;
-      if (Number.isFinite(mkdirHoldMs) && mkdirHoldMs > 0)
-        gateSleep(mkdirHoldMs);
-      writeFileSync(join(dir, marker), JSON.stringify(claim), { flag: "wx" });
-    } catch (error51) {
-      const code = error51.code;
-      if (code === "ENOENT" || code === "EINVAL") {
-        lostRaces += 1;
-        if (lostRaces === GATE_LOCK_LOST_RACE_LOG_AT && !lostRaceLogged) {
-          lostRaceLogged = true;
-          logLine(`quality gate lock: still losing the claim race after ${lostRaces} attempts (dir ${dir})
-`);
-        }
-        gateSleep(GATE_LOCK_LOST_RACE_SLEEP_MS);
-        continue;
-      }
-      if (code !== "EEXIST") {
-        throw error51;
-      }
-    }
-    if (dirIno !== null) {
-      let currentIno = null;
-      let entries = [];
-      try {
-        currentIno = statSync(dir).ino;
-        entries = readdirSync(dir);
-      } catch {}
-      if (currentIno !== dirIno || entries.length !== 1 || entries[0] !== marker) {
-        try {
-          unlinkSync(join(dir, marker));
-        } catch {}
-        lostRaces += 1;
-        gateSleep(GATE_LOCK_LOST_RACE_SLEEP_MS);
-        continue;
-      }
-      return {
-        release() {
-          try {
-            rmSync(join(dir, marker), { force: true });
-            rmdirSync(dir);
-          } catch {}
-        },
-        queueWaitMs: Date.now() - startedWaitingAt,
-        token: marker
-      };
-    }
-    const held = readGateLockClaim(dir);
-    if (held !== null && isProcessAlive(held.claim.pid)) {
-      if (getEnvVar(GATE_LOCK_TOKEN_ENV) === held.marker) {
-        return { release() {}, queueWaitMs: Date.now() - startedWaitingAt, token: held.marker };
-      }
-      if (!holderLogged) {
-        holderLogged = true;
-        logLine(`quality gate lock: waiting for holder (wbs ${held.claim.wbs}, run ${held.claim.runId}, pid ${held.claim.pid}, cwd ${held.claim.cwd}, held ${Date.now() - held.claim.startedAt}ms)
-`);
-      }
-    } else if (held !== null) {
-      logLine(`quality gate lock: reclaimed stale claim (pid ${held.claim.pid})
-`);
-      try {
-        unlinkSync(join(dir, held.marker));
-        rmdirSync(dir);
-      } catch {}
-    } else {
-      try {
-        rmdirSync(dir);
-        graceLogged = false;
-      } catch {
-        gateSleep(pollMs);
-        try {
-          rmdirSync(dir);
-          graceLogged = false;
-        } catch {
-          if (!graceLogged) {
-            graceLogged = true;
-            logLine(`quality gate lock: dir has no readable claim and is not empty — waiting
-`);
-          }
-        }
-      }
-    }
-  }
-}
 function recomputeGateProofFingerprint(cwd, env2) {
   const taskSpecPath = env2.taskSpecPath ?? env2.taskFile;
   if (!taskSpecPath || taskSpecPath.trim() === "") {
@@ -30643,44 +30486,27 @@ function runQualityGate(mode, env2, options = {}) {
     appendFileSync(abs(logFile), probe.output);
     rmSync(abs(`${logFile}.probe`), { force: true });
   }
-  let queueWaitMs = 0;
   let gateRuntimeMs = 0;
   if (gateRc === 0) {
     const delayMs = retryDelayMs(env2);
-    const lockLine = (line) => {
+    const gateRuntimeStartMs = Date.now();
+    for (gateAttempt = 1;gateAttempt <= MAX_GATE_ATTEMPTS; gateAttempt++) {
+      const attemptLogPath = `${logFile}.attempt-${gateAttempt}`;
+      const attempt = runShellCommand(env2.qualityGateCmd ?? "", cwd);
+      writeFileSync(abs(attemptLogPath), attempt.output);
+      const locked = isTransientLock(attempt.output);
+      appendFileSync(abs(logFile), attempt.output);
+      rmSync(abs(attemptLogPath), { force: true });
+      gateRc = attempt.code;
+      if (gateRc === 0 || !locked || gateAttempt >= MAX_GATE_ATTEMPTS)
+        break;
+      const line = retryMessage(gateAttempt);
       process.stdout.write(line);
       appendFileSync(abs(logFile), line);
-    };
-    const lock = acquireGateLock(env2, lockLine);
-    queueWaitMs = lock.queueWaitMs;
-    lockLine(`quality gate lock: queueWaitMs=${queueWaitMs}
-`);
-    const gateRuntimeStartMs = Date.now();
-    const previousToken = getEnvVar(GATE_LOCK_TOKEN_ENV);
-    if (lock.token.length > 0)
-      setEnvVar(GATE_LOCK_TOKEN_ENV, lock.token);
-    try {
-      for (gateAttempt = 1;gateAttempt <= MAX_GATE_ATTEMPTS; gateAttempt++) {
-        const attemptLogPath = `${logFile}.attempt-${gateAttempt}`;
-        const attempt = runShellCommand(env2.qualityGateCmd ?? "", cwd, lock.token.length > 0 ? { [GATE_LOCK_TOKEN_ENV]: lock.token } : undefined);
-        writeFileSync(abs(attemptLogPath), attempt.output);
-        const locked = isTransientLock(attempt.output);
-        appendFileSync(abs(logFile), attempt.output);
-        rmSync(abs(attemptLogPath), { force: true });
-        gateRc = attempt.code;
-        if (gateRc === 0 || !locked || gateAttempt >= MAX_GATE_ATTEMPTS)
-          break;
-        const line = retryMessage(gateAttempt);
-        process.stdout.write(line);
-        appendFileSync(abs(logFile), line);
-        gateSleep(delayMs);
-      }
-    } finally {
-      setEnvVar(GATE_LOCK_TOKEN_ENV, previousToken);
-      lock.release();
+      gateSleep(delayMs);
     }
     gateRuntimeMs = Date.now() - gateRuntimeStartMs;
-    appendFileSync(abs(logFile), `quality gate lock: queueWaitMs=${queueWaitMs} gateRuntimeMs=${gateRuntimeMs}
+    appendFileSync(abs(logFile), `gate runtime: ${gateRuntimeMs}ms
 `);
   }
   if (gateRc !== 0) {
@@ -30733,7 +30559,6 @@ function runQualityGate(mode, env2, options = {}) {
           }
         ],
         completedAt: new Date().toISOString(),
-        queueWaitMs,
         gateRuntimeMs
       });
       writeFileSync(abs(receiptFile), `${JSON.stringify(receipt, null, 2)}
@@ -30811,7 +30636,6 @@ export {
   isTransientLock,
   extractFindings,
   buildReceipt,
-  acquireGateLock,
   RETRY_DELAY_MS_ENV,
   RETRY_DELAY_MS_DEFAULT,
   RECEIPT_SCHEMA_VERSION,
@@ -30819,12 +30643,6 @@ export {
   MAX_GATE_ATTEMPTS,
   MAX_FINDINGS,
   LOCKED_PATTERN,
-  GATE_LOCK_TOKEN_ENV,
-  GATE_LOCK_POLL_MS_ENV,
-  GATE_LOCK_POLL_MS_DEFAULT,
-  GATE_LOCK_OFF_ENV,
-  GATE_LOCK_MKDIR_HOLD_MS_ENV,
-  GATE_LOCK_DIR_ENV,
   FINDINGS_PATTERN,
   COVERAGE_ROW_PATTERN
 };

package/plugins/sp/scripts/run-summary.mjs

@@ -40,17 +40,19 @@ function formatTokenSplit(t) {
   return `${formatTokens(nonCached + t.cacheRead)} / ${formatTokens(nonCached)}`;
 }
 function promptText(row) {
+  if (row.type === "custom_message") {
+    if (row.display === false)
+      return;
+    const text = typeof row.content === "string" ? row.content.trim() : "";
+    return text === "" ? undefined : text;
+  }
   if (row.type === "message") {
     if (row.message?.role !== "user")
       return;
-    if (isInjectedPrompt(row))
-      return;
-    const content2 = row.message.content;
-    if (typeof content2 === "string")
-      return content2;
-    if (!Array.isArray(content2))
+    const text = firstTextContent(row);
+    if (text === undefined)
       return;
-    return content2.find((b) => b.type === "text")?.text;
+    return skillInvocationPrompt(text) ?? text;
   }
   if (row.type !== "user" || row.isMeta || row.isCompactSummary)
     return;
@@ -61,12 +63,21 @@ function promptText(row) {
     return;
   return content.find((b) => b.type === "text")?.text;
 }
-function isInjectedPrompt(row) {
-  if (row.type !== "message" || row.message?.role !== "user")
-    return false;
-  const content = row.message.content;
-  const text = typeof content === "string" ? content : Array.isArray(content) ? content.find((b) => b.type === "text")?.text : undefined;
-  return typeof text === "string" && text.replace(/^\s+/, "").startsWith('<skill name="');
+function firstTextContent(row) {
+  const content = row.message?.content;
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return;
+  return content.find((b) => b.type === "text")?.text;
+}
+function skillInvocationPrompt(text) {
+  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
+  if (name === undefined)
+    return;
+  const close = text.lastIndexOf("</skill>");
+  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
+  return args === "" ? `/${name}` : `/${name} ${args}`;
 }
 function sumTokens(all) {
   const total = zeroTokens();

package/plugins/sp/scripts/session-timeline.mjs

@@ -36,17 +36,19 @@ function formatTokenSplit(t) {
   return `${formatTokens(nonCached + t.cacheRead)} / ${formatTokens(nonCached)}`;
 }
 function promptText(row) {
+  if (row.type === "custom_message") {
+    if (row.display === false)
+      return;
+    const text = typeof row.content === "string" ? row.content.trim() : "";
+    return text === "" ? undefined : text;
+  }
   if (row.type === "message") {
     if (row.message?.role !== "user")
       return;
-    if (isInjectedPrompt(row))
-      return;
-    const content2 = row.message.content;
-    if (typeof content2 === "string")
-      return content2;
-    if (!Array.isArray(content2))
+    const text = firstTextContent(row);
+    if (text === undefined)
       return;
-    return content2.find((b) => b.type === "text")?.text;
+    return skillInvocationPrompt(text) ?? text;
   }
   if (row.type !== "user" || row.isMeta || row.isCompactSummary)
     return;
@@ -57,12 +59,21 @@ function promptText(row) {
     return;
   return content.find((b) => b.type === "text")?.text;
 }
-function isInjectedPrompt(row) {
-  if (row.type !== "message" || row.message?.role !== "user")
-    return false;
-  const content = row.message.content;
-  const text = typeof content === "string" ? content : Array.isArray(content) ? content.find((b) => b.type === "text")?.text : undefined;
-  return typeof text === "string" && text.replace(/^\s+/, "").startsWith('<skill name="');
+function firstTextContent(row) {
+  const content = row.message?.content;
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return;
+  return content.find((b) => b.type === "text")?.text;
+}
+function skillInvocationPrompt(text) {
+  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
+  if (name === undefined)
+    return;
+  const close = text.lastIndexOf("</skill>");
+  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
+  return args === "" ? `/${name}` : `/${name} ${args}`;
 }
 function sumTokens(all) {
   const total = zeroTokens();
@@ -212,15 +223,7 @@ function buildTimeline(lines, group) {
   const open = [];
   const { rows, skippedLines, format } = parseRows(lines);
   const isPi = format === "pi";
-  let injectedPrompts = 0;
   for (const [row, ts] of rows) {
-    if (isPi && isInjectedPrompt(row)) {
-      injectedPrompts++;
-      const injectedSeg = open.at(-1);
-      if (injectedSeg)
-        accumulate(injectedSeg, row, ts);
-      continue;
-    }
     const prompt = promptText(row);
     if (prompt !== undefined) {
       open.push({ start: ts, prompt, ...newAcc(ts) });
@@ -253,8 +256,7 @@ function buildTimeline(lines, group) {
     available: true,
     segments,
     totals: render(isPi ? { ...totals, compactions: segments.reduce((n, s) => n + (s.compactions ?? 0), 0) } : totals),
-    skippedLines,
-    ...isPi ? { injectedPrompts } : {}
+    skippedLines
   };
   if (group) {
     timeline.stages = parseGroups(group, segments.length).map(([a, b]) => render({ ...sumSpans(segments.slice(a - 1, b)), segments: a === b ? `${a}` : `${a}-${b}` }));
@@ -273,8 +275,7 @@ function zeroSegmentReason(rows) {
     const census = [...counts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 5).map(([kind, n]) => `${kind} ${n}`).join(", ");
     return `unrecognized transcript format (row types: ${census})`;
   }
-  const injected = rows.filter(([r]) => isInjectedPrompt(r)).length;
-  return `${format} transcript with no operator prompts (${rows.length} rows, ${injected} injected)`;
+  return `${format} transcript with no operator prompts (${rows.length} rows)`;
 }
 function main(argv, env = getEnvVars(), write = (s) => process.stdout.write(s), projectsRoot, writeErr = (s) => process.stderr.write(s)) {
   let transcript;

package/plugins/sp/scripts/session-timeline.ts

@@ -16,7 +16,6 @@ import {
     accumulate,
     formatDuration,
     formatTokenSplit,
-    isInjectedPrompt,
     newAcc,
     parseRows,
     promptText,
@@ -40,8 +39,6 @@ export interface Timeline {
     stages?: Rendered<Span & { segments: string }>[];
     totals: Rendered<Span & { elapsedMs: number; elapsed: string; compactions?: number }>;
     skippedLines: number;
-    /** pi only (1138 R2): skill-injected user bodies counted as activity, never as segments. */
-    injectedPrompts?: number;
 }
 
 const PROMPT_EXCERPT = 80;
@@ -75,17 +72,8 @@ export function buildTimeline(lines: string[], group?: string): Timeline {
     const open: Open[] = [];
     const { rows, skippedLines, format } = parseRows(lines);
     const isPi = format === 'pi';
-    let injectedPrompts = 0;
 
     for (const [row, ts] of rows) {
-        // 1138 R2: an injected skill body is activity, not a prompt — accumulate it into the open
-        // segment (its tools and usage are real work) and count it, never open a segment.
-        if (isPi && isInjectedPrompt(row)) {
-            injectedPrompts++;
-            const injectedSeg = open.at(-1);
-            if (injectedSeg) accumulate(injectedSeg, row, ts);
-            continue;
-        }
         const prompt = promptText(row);
         if (prompt !== undefined) {
             open.push({ start: ts, prompt, ...newAcc(ts) });
@@ -124,8 +112,6 @@ export function buildTimeline(lines: string[], group?: string): Timeline {
             isPi ? { ...totals, compactions: segments.reduce((n, s) => n + (s.compactions ?? 0), 0) } : totals,
         ),
         skippedLines,
-        // Emitted only for pi, as `compactions` is, so Claude output is unchanged (1138 R2).
-        ...(isPi ? { injectedPrompts } : {}),
     };
     if (group) {
         timeline.stages = parseGroups(group, segments.length).map(([a, b]) =>
@@ -139,8 +125,9 @@ export const SESSION_TIMELINE_USAGE = 'usage: session-timeline [--transcript <pa
 
 /**
  * 1138 R3: a zero-segment result must say WHAT was detected, so an unparseable-but-recognised
- * transcript can never read as an authoritative all-zero timeline. A known format names the
- * row count and the injected count; an unknown one lists the top-5 row-type census.
+ * transcript can never read as an authoritative all-zero timeline. A known format names the row
+ * count; an unknown one lists the top-5 row-type census. (1151 R2 removed the pi-only injected
+ * count: pi injects no skill bodies, so a wrapper row is an operator prompt and the class is gone.)
  */
 export function zeroSegmentReason(rows: [Row, number][]): string {
     const format = sniffFormat(rows.map(([r]) => r));
@@ -157,8 +144,7 @@ export function zeroSegmentReason(rows: [Row, number][]): string {
             .join(', ');
         return `unrecognized transcript format (row types: ${census})`;
     }
-    const injected = rows.filter(([r]) => isInjectedPrompt(r)).length;
-    return `${format} transcript with no operator prompts (${rows.length} rows, ${injected} injected)`;
+    return `${format} transcript with no operator prompts (${rows.length} rows)`;
 }
 
 export function main(

package/plugins/sp/scripts/task-diffstat.mjs

@@ -16,7 +16,7 @@ var SENSITIVE_PREFIXES = ["drizzle/", "packages/config/", ".github/", "plugins/s
 var SENSITIVE_GLOBS = ["apps/server/src/**/auth*", "**/*secret*", "**/*.sql"];
 function globToRegex(glob) {
   const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("**/", "\x00").replaceAll("**", "\x01").replaceAll("*", "[^/]*").replaceAll("\x00", "(?:.*/)?").replaceAll("\x01", ".*");
-  return new RegExp(`^${escaped}$`);
+  return new RegExp(`^${escaped}$`, "s");
 }
 var SENSITIVE_MATCHERS = [
   ...SENSITIVE_PREFIXES.map((prefix) => ({
@@ -52,22 +52,12 @@ function countNewlines(path, cwd) {
       lines += 1;
   return lines;
 }
-function expandDiffPath(raw) {
-  const arrow = raw.indexOf(" => ");
-  if (arrow === -1)
-    return [raw];
-  const open = raw.indexOf("{");
-  const close = raw.lastIndexOf("}");
-  if (open !== -1 && close > open && open < arrow && arrow < close) {
-    const inner = raw.slice(open + 1, close);
-    const innerArrow = inner.indexOf(" => ");
-    if (innerArrow !== -1) {
-      const head = raw.slice(0, open);
-      const tail = raw.slice(close + 1);
-      return [head + inner.slice(0, innerArrow) + tail, head + inner.slice(innerArrow + 4) + tail];
-    }
-  }
-  return [raw.slice(0, arrow), raw.slice(arrow + 4)];
+function addCounts(add, del) {
+  for (const count of [add, del])
+    if (count !== "-" && !/^\d+$/.test(count))
+      return null;
+  const [a, d] = [add === "-" ? 0 : Number(add), del === "-" ? 0 : Number(del)];
+  return Number.isSafeInteger(a) && Number.isSafeInteger(d) ? [a, d] : null;
 }
 function runDiffstat(env, options = {}, git = defaultGitRunner(options.cwd)) {
   const cwd = options.cwd;
@@ -99,23 +89,37 @@ function runDiffstat(env, options = {}, git = defaultGitRunner(options.cwd)) {
   } catch {}
   if (!/^[0-9a-f]{7,40}$/i.test(base))
     return failSafe("run base .spur/run/<wbs>-base.sha missing or malformed");
-  const numstat = git(["diff", "--numstat", base]);
+  const numstat = git(["diff", "--numstat", "-z", base]);
   if (numstat.status !== 0)
     return failSafe(`git diff --numstat failed (status=${numstat.status})`);
+  if (numstat.stdout.length > 0 && !numstat.stdout.endsWith("\x00"))
+    return failSafe("git diff --numstat -z output is not NUL-terminated (malformed framing)");
   const paths = new Set;
   let insertions = 0;
   let deletions = 0;
-  for (const line of numstat.stdout.split(`
-`)) {
-    const row2 = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
-    if (!row2)
+  const records = numstat.stdout.split("\x00").slice(0, -1);
+  for (let i = 0;i < records.length; i++) {
+    const header = records[i] ?? "";
+    const first = header.indexOf("\t");
+    const second = header.indexOf("\t", first + 1);
+    if (first < 1 || second < first + 2)
+      return failSafe("git diff --numstat -z record is missing counts or path");
+    const counts = addCounts(header.slice(0, first), header.slice(first + 1, second));
+    if (counts === null)
+      return failSafe("git diff --numstat -z record has a malformed count");
+    insertions += counts[0];
+    deletions += counts[1];
+    const path = header.slice(second + 1);
+    if (path !== "") {
+      paths.add(path);
       continue;
-    for (const p of expandDiffPath(row2[3] ?? ""))
-      paths.add(p);
-    if (row2[1] !== "-")
-      insertions += Number(row2[1]);
-    if (row2[2] !== "-")
-      deletions += Number(row2[2]);
+    }
+    const oldPath = records[++i];
+    const newPath = records[++i];
+    if (!oldPath || !newPath)
+      return failSafe("git diff --numstat -z rename record has incomplete paths");
+    paths.add(oldPath);
+    paths.add(newPath);
   }
   const others = git(["ls-files", "--others", "--exclude-standard", "-z"]);
   if (others.status !== 0)
@@ -161,7 +165,6 @@ export {
   sensitiveReasonForPath,
   runDiffstat,
   main,
-  expandDiffPath,
   TASK_DIFFSTAT_USAGE,
   SENSITIVE_PREFIXES,
   SENSITIVE_GLOBS