@happier-dev/stack 0.1.0-preview.74.1

package/scripts/utils/review/sliced_runner.mjs

@@ -0,0 +1,39 @@
+import { runWithConcurrencyLimit } from '../proc/parallel.mjs';
+
+/**
+ * Run a list of "slice jobs" with:
+ * - a mandatory sequential first job (preflight)
+ * - parallel execution for the remainder (bounded by `limit`)
+ * - stable, input-order results
+ * - optional early-abort after the first job (e.g. auth/credits missing)
+ */
+export async function runSlicedJobs({ items, limit = 1, run, shouldAbortEarly } = {}) {
+  const list = Array.isArray(items) ? items : [];
+  if (!list.length) return [];
+  if (typeof run !== 'function') throw new Error('[review] runSlicedJobs: missing run()');
+
+  const concurrency = Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 1;
+
+  const out = [];
+  // Always run the first item sequentially so we can fail fast on auth/credits problems
+  // before spinning up many long-running review jobs.
+  // eslint-disable-next-line no-await-in-loop
+  const firstRes = await run(list[0]);
+  out.push(firstRes);
+  if (typeof shouldAbortEarly === 'function' && shouldAbortEarly(firstRes)) {
+    return out;
+  }
+
+  if (list.length === 1) return out;
+
+  const rest = list.slice(1);
+  const restRes = await runWithConcurrencyLimit({
+    items: rest,
+    limit: concurrency,
+    fn: async (item) => await run(item),
+  });
+
+  // Preserve input order.
+  return [...out, ...restRes];
+}
+

package/scripts/utils/review/sliced_runner.test.mjs

@@ -0,0 +1,57 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { runSlicedJobs } from './sliced_runner.mjs';
+
+test('runSlicedJobs preserves order and respects concurrency', async () => {
+  const items = Array.from({ length: 7 }, (_, i) => ({ index: i + 1 }));
+
+  let active = 0;
+  let maxActive = 0;
+  let startedParallel = 0;
+  let releaseParallel;
+  const parallelGate = new Promise((resolve) => {
+    releaseParallel = resolve;
+  });
+
+  const results = await runSlicedJobs({
+    items,
+    limit: 2,
+    run: async (item) => {
+      active += 1;
+      maxActive = Math.max(maxActive, active);
+      if (item.index > 1) {
+        startedParallel += 1;
+        if (startedParallel === 2) {
+          releaseParallel();
+        }
+        await parallelGate;
+      }
+      active -= 1;
+      return { index: item.index };
+    },
+  });
+
+  assert.equal(maxActive, 2);
+  assert.deepEqual(
+    results.map((r) => r.index),
+    items.map((i) => i.index)
+  );
+});
+
+test('runSlicedJobs can abort early after the first item', async () => {
+  const items = Array.from({ length: 5 }, (_, i) => ({ index: i + 1 }));
+  const seen = [];
+
+  const results = await runSlicedJobs({
+    items,
+    limit: 3,
+    run: async (item) => {
+      seen.push(item.index);
+      return { index: item.index, abort: item.index === 1 };
+    },
+    shouldAbortEarly: (res) => Boolean(res?.abort),
+  });
+
+  assert.deepEqual(seen, [1]);
+  assert.deepEqual(results.map((r) => r.index), [1]);
+});

package/scripts/utils/review/slices.mjs

@@ -0,0 +1,140 @@
+function normalizePath(p) {
+  return String(p ?? '').replace(/\\/g, '/').replace(/^\/+/, '');
+}
+
+function commonPrefixParts(partsList) {
+  if (!partsList.length) return [];
+  const first = partsList[0];
+  let n = first.length;
+  for (const parts of partsList.slice(1)) {
+    n = Math.min(n, parts.length, n);
+    for (let i = 0; i < n; i += 1) {
+      if (parts[i] !== first[i]) {
+        n = i;
+        break;
+      }
+    }
+  }
+  return first.slice(0, n);
+}
+
+function pathPrefixLabel(parts, { maxDepth = 4 } = {}) {
+  const depth = Math.min(parts.length, Math.max(1, maxDepth));
+  return parts.slice(0, depth).join('/');
+}
+
+function groupByPrefix(paths, depth) {
+  const groups = new Map();
+  for (const p of paths) {
+    const parts = normalizePath(p).split('/').filter(Boolean);
+    const key = parts.slice(0, Math.max(1, Math.min(depth, parts.length))).join('/');
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(p);
+  }
+  return groups;
+}
+
+/**
+ * Plan review slices that:
+ * - cover every changed path exactly once
+ * - keep each slice at <= maxFiles where possible
+ * - prefer directory-prefix grouping (better reviewer context) over raw batching
+ *
+ * The output is intended for "HEAD-sliced" review: the reviewer gets a focused diff
+ * while still having access to the full repo code at HEAD.
+ */
+export function planPathSlices({ changedPaths, maxFiles = 300, maxPrefixDepth = 6 } = {}) {
+  const unique = Array.from(new Set((Array.isArray(changedPaths) ? changedPaths : []).map(normalizePath))).filter(Boolean);
+  unique.sort();
+  if (!unique.length) return [];
+
+  const limit = Number.isFinite(maxFiles) && maxFiles > 0 ? Math.floor(maxFiles) : 300;
+  if (unique.length <= limit) {
+    const parts = unique.map((p) => p.split('/').filter(Boolean));
+    const prefix = commonPrefixParts(parts);
+    return [
+      {
+        label: prefix.length ? `${pathPrefixLabel(prefix, { maxDepth: 3 })}/` : 'repo/',
+        paths: unique,
+      },
+    ];
+  }
+
+  // First pass: top-level directories (plus root files).
+  const topGroups = groupByPrefix(unique, 1);
+
+  const slices = [];
+  const pushSlice = (label, paths) => {
+    const normalized = Array.from(new Set(paths.map(normalizePath))).filter(Boolean).sort();
+    if (!normalized.length) return;
+    slices.push({ label, paths: normalized });
+  };
+
+  for (const [top, paths] of topGroups.entries()) {
+    if (paths.length <= limit) {
+      pushSlice(top.includes('/') ? top : `${top}/`, paths);
+      continue;
+    }
+
+    // Iteratively refine prefix depth within this group until all chunks are <= limit.
+    let pending = [{ label: top, paths }];
+    for (let depth = 2; depth <= maxPrefixDepth && pending.some((x) => x.paths.length > limit); depth += 1) {
+      const next = [];
+      for (const item of pending) {
+        if (item.paths.length <= limit) {
+          next.push(item);
+          continue;
+        }
+        const groups = groupByPrefix(item.paths, depth);
+        if (groups.size <= 1) {
+          next.push(item);
+          continue;
+        }
+        for (const [k, v] of groups.entries()) {
+          next.push({ label: k, paths: v });
+        }
+      }
+      pending = next;
+    }
+
+    // Final pass: pack refined groups into <=limit windows (greedy, stable order).
+    pending.sort((a, b) => a.label.localeCompare(b.label));
+    let bucket = [];
+    let bucketCount = 0;
+    let bucketLabelParts = [];
+    const flush = () => {
+      if (!bucket.length) return;
+      const parts = commonPrefixParts(bucketLabelParts);
+      const label = parts.length ? `${pathPrefixLabel(parts, { maxDepth: 4 })}/` : `${top}/`;
+      pushSlice(label, bucket);
+      bucket = [];
+      bucketCount = 0;
+      bucketLabelParts = [];
+    };
+
+    for (const g of pending) {
+      const n = g.paths.length;
+      if (n > limit) {
+        // Fall back to raw batching for truly massive groups (rare).
+        flush();
+        for (let i = 0; i < g.paths.length; i += limit) {
+          const batch = g.paths.slice(i, i + limit);
+          pushSlice(`${g.label}/`, batch);
+        }
+        continue;
+      }
+      if (bucketCount + n > limit) {
+        flush();
+      }
+      bucket.push(...g.paths);
+      bucketCount += n;
+      bucketLabelParts.push(g.label.split('/').filter(Boolean));
+    }
+    flush();
+  }
+
+  // Stable ordering helps humans follow progress.
+  slices.sort((a, b) => a.label.localeCompare(b.label));
+  return slices;
+}
+

package/scripts/utils/review/slices.test.mjs

@@ -0,0 +1,41 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { planPathSlices } from './slices.mjs';
+
+test('planPathSlices returns empty for no paths', () => {
+  assert.deepEqual(planPathSlices({ changedPaths: [], maxFiles: 3 }), []);
+});
+
+test('planPathSlices creates a single slice when under maxFiles', () => {
+  const slices = planPathSlices({
+    changedPaths: ['apps/ui/a.txt', 'apps/cli/b.txt', 'apps/server/c.txt'],
+    maxFiles: 10,
+  });
+  assert.equal(slices.length, 1);
+  assert.deepEqual(slices[0].paths, ['apps/cli/b.txt', 'apps/server/c.txt', 'apps/ui/a.txt']);
+});
+
+test('planPathSlices splits large groups by prefix depth and respects maxFiles', () => {
+  const changedPaths = [
+    ...Array.from({ length: 6 }, (_, i) => `apps/ui/sources/a${i}.ts`),
+    ...Array.from({ length: 6 }, (_, i) => `apps/ui/sources/b${i}.ts`),
+    ...Array.from({ length: 2 }, (_, i) => `apps/cli/src/x${i}.ts`),
+  ];
+  const slices = planPathSlices({ changedPaths, maxFiles: 5, maxPrefixDepth: 4 });
+  assert.ok(slices.length > 1);
+  for (const s of slices) {
+    assert.ok(s.paths.length <= 5, `slice ${s.label} exceeded maxFiles`);
+  }
+  const all = slices.flatMap((s) => s.paths).sort();
+  assert.deepEqual(all, Array.from(new Set(changedPaths)).sort());
+});
+
+test('planPathSlices normalizes duplicate and absolute/windows-shaped paths', () => {
+  const slices = planPathSlices({
+    changedPaths: ['apps\\ui\\a.ts', '/apps/ui/a.ts', 'apps/ui/a.ts', 'apps/ui/b.ts'],
+    maxFiles: 5,
+  });
+
+  assert.equal(slices.length, 1);
+  assert.deepEqual(slices[0].paths, ['apps/ui/a.ts', 'apps/ui/b.ts']);
+});

package/scripts/utils/review/targets.mjs

@@ -0,0 +1,23 @@
+import { getRepoDir } from '../paths/paths.mjs';
+
+export function isStackMode(env = process.env) {
+  const stack = String(env.HAPPIER_STACK_STACK ?? '').trim();
+  const envFile = String(env.HAPPIER_STACK_ENV_FILE ?? '').trim();
+  return Boolean(stack && envFile);
+}
+
+export function defaultRepoCheckoutDir(rootDir, env = process.env) {
+  const clean = { ...env, HAPPIER_STACK_REPO_DIR: '' };
+  return getRepoDir(rootDir, clean);
+}
+
+export function resolveDefaultStackReviewComponents({ rootDir, components, env = process.env }) {
+  const list = Array.isArray(components) ? components : [];
+  if (!list.length) return [];
+
+  const effectiveRepo = getRepoDir(rootDir, env);
+  const defaultRepo = defaultRepoCheckoutDir(rootDir, env);
+  // Repo-only model: if the stack is pinned to a non-default worktree/checkout, all
+  // logical services share that same repo pin.
+  return effectiveRepo !== defaultRepo ? list : [];
+}

package/scripts/utils/review/targets.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { resolveDefaultStackReviewComponents } from './targets.mjs';
+
+test('resolveDefaultStackReviewComponents returns only non-default pinned components', () => {
+  const rootDir = '/tmp/hs-root';
+  const env = {
+    HAPPIER_STACK_WORKSPACE_DIR: '/tmp/hs-root',
+    HAPPIER_STACK_REPO_DIR: '/tmp/custom/happier',
+  };
+  const comps = resolveDefaultStackReviewComponents({
+    rootDir,
+    env,
+    components: ['happy', 'happy-cli', 'happy-server-light', 'happy-server'],
+  });
+  assert.deepEqual(comps.sort(), ['happy', 'happy-cli', 'happy-server-light', 'happy-server'].sort());
+});
+
+test('resolveDefaultStackReviewComponents returns empty list for default repo checkout', () => {
+  const rootDir = '/tmp/hs-root';
+  const env = {
+    HAPPIER_STACK_WORKSPACE_DIR: '/tmp/hs-root',
+    HAPPIER_STACK_REPO_DIR: '',
+  };
+  const comps = resolveDefaultStackReviewComponents({
+    rootDir,
+    env,
+    components: ['happy', 'happy-cli'],
+  });
+  assert.deepEqual(comps, []);
+});

package/scripts/utils/review/tool_home_seed.mjs

@@ -0,0 +1,106 @@
+import { copyFile, cp, mkdir, rm, stat } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+async function mergeCopyDir({ srcDir, destDir }) {
+  if (!existsSync(srcDir)) return;
+  await mkdir(destDir, { recursive: true });
+  await cp(srcDir, destDir, { recursive: true, force: false, errorOnExist: false });
+}
+
+async function copyFileIfNewer({ srcFile, destFile }) {
+  if (!existsSync(srcFile)) return;
+  try {
+    const srcStat = await stat(srcFile);
+    let destStat = null;
+    try {
+      destStat = await stat(destFile);
+    } catch {
+      destStat = null;
+    }
+    if (!destStat || srcStat.mtimeMs > destStat.mtimeMs) {
+      await mkdir(join(destFile, '..'), { recursive: true });
+      await copyFile(srcFile, destFile);
+    }
+  } catch {
+    // best-effort
+  }
+}
+
+/**
+ * Best-effort: seed CodeRabbit auth/config into an isolated home directory.
+ *
+ * We do not read or print any auth contents; we only copy the on-disk state when present.
+ */
+export async function seedCodeRabbitHomeFromRealHome({ realHomeDir, isolatedHomeDir } = {}) {
+  const real = String(realHomeDir ?? '').trim();
+  const isolated = String(isolatedHomeDir ?? '').trim();
+  if (!real || !isolated || real === isolated) return;
+
+  // Common CodeRabbit state locations:
+  // - ~/.coderabbit/
+  // - ~/.config/coderabbit/ (XDG config)
+  // - ~/.cache/coderabbit/ (XDG cache)
+  // - ~/.local/share/coderabbit/ (XDG data)
+  // - ~/.local/state/coderabbit/ (XDG state)
+  //
+  // We merge-copy without overwriting existing files so a user can explicitly
+  // auth in the isolated dir and we won't clobber it.
+  await mergeCopyDir({ srcDir: join(real, '.coderabbit'), destDir: join(isolated, '.coderabbit') });
+  await mergeCopyDir({ srcDir: join(real, '.config', 'coderabbit'), destDir: join(isolated, '.config', 'coderabbit') });
+  await mergeCopyDir({ srcDir: join(real, '.cache', 'coderabbit'), destDir: join(isolated, '.cache', 'coderabbit') });
+  await mergeCopyDir({ srcDir: join(real, '.local', 'share', 'coderabbit'), destDir: join(isolated, '.local', 'share', 'coderabbit') });
+  await mergeCopyDir({ srcDir: join(real, '.local', 'state', 'coderabbit'), destDir: join(isolated, '.local', 'state', 'coderabbit') });
+
+  // If the user re-authenticated recently, refresh auth.json even when it already exists.
+  await copyFileIfNewer({
+    srcFile: join(real, '.coderabbit', 'auth.json'),
+    destFile: join(isolated, '.coderabbit', 'auth.json'),
+  });
+}
+
+/**
+ * Best-effort: seed Codex auth/config into an isolated CODEX_HOME directory.
+ *
+ * Codex stores auth/config under `CODEX_HOME` (default: ~/.codex). In stack review runs we
+ * use a per-repo isolated home (e.g. .project/codex-home) to avoid polluting ~/.codex and
+ * to keep sandboxed runs self-contained.
+ *
+ * We do not read or print any auth contents; we only copy the on-disk state when present.
+ */
+export async function seedCodexHomeFromRealHome({ realHomeDir, isolatedHomeDir } = {}) {
+  const real = String(realHomeDir ?? '').trim();
+  const isolated = String(isolatedHomeDir ?? '').trim();
+  if (!real || !isolated || real === isolated) return;
+
+  // Ensure prior runs do not leak custom user config (MCP/plugins) into review jobs.
+  try {
+    await rm(join(isolated, 'config.toml'), { force: true });
+  } catch {
+    // best-effort
+  }
+
+  // Copy auth only. We intentionally avoid copying user config.toml so review
+  // runs do not inherit personal MCP/plugin settings that can stall batch jobs.
+  await copyFileIfNewer({ srcFile: join(real, '.codex', 'auth.json'), destFile: join(isolated, 'auth.json') });
+}
+
+/**
+ * Best-effort: seed Auggie (Augment CLI) auth/config into an isolated cache directory.
+ *
+ * Auggie uses `~/.augment` by default (see `--augment-cache-dir`), and supports
+ * providing session auth via `AUGMENT_SESSION_AUTH` (same format as `~/.augment/session.json`).
+ *
+ * We do not read or print any auth contents; we only copy the on-disk state when present.
+ */
+export async function seedAugmentHomeFromRealHome({ realHomeDir, isolatedHomeDir } = {}) {
+  const real = String(realHomeDir ?? '').trim();
+  const isolated = String(isolatedHomeDir ?? '').trim();
+  if (!real || !isolated || real === isolated) return;
+
+  // Copy ~/.augment/* into the isolated cache dir.
+  await mergeCopyDir({ srcDir: join(real, '.augment'), destDir: isolated });
+
+  // Refresh session.json when it is newer.
+  await copyFileIfNewer({ srcFile: join(real, '.augment', 'session.json'), destFile: join(isolated, 'session.json') });
+}

package/scripts/utils/review/tool_home_seed.test.mjs

@@ -0,0 +1,124 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, rm, stat, utimes, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { seedAugmentHomeFromRealHome, seedCodeRabbitHomeFromRealHome, seedCodexHomeFromRealHome } from './tool_home_seed.mjs';
+
+test('seedCodeRabbitHomeFromRealHome copies coderabbit state into isolated home when missing', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'happy-stacks-coderabbit-seed-'));
+  const realHome = join(root, 'real');
+  const isolatedHome = join(root, 'isolated');
+
+  try {
+    await mkdir(join(realHome, '.coderabbit'), { recursive: true });
+    await mkdir(join(realHome, '.config', 'coderabbit'), { recursive: true });
+    await writeFile(join(realHome, '.coderabbit', 'auth.json'), 'secret-ish\n', 'utf-8');
+    await writeFile(join(realHome, '.config', 'coderabbit', 'config.toml'), 'cfg\n', 'utf-8');
+
+    await mkdir(isolatedHome, { recursive: true });
+
+    await seedCodeRabbitHomeFromRealHome({ realHomeDir: realHome, isolatedHomeDir: isolatedHome });
+
+    assert.equal(await readFile(join(isolatedHome, '.coderabbit', 'auth.json'), 'utf-8'), 'secret-ish\n');
+    assert.equal(await readFile(join(isolatedHome, '.config', 'coderabbit', 'config.toml'), 'utf-8'), 'cfg\n');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('seedCodeRabbitHomeFromRealHome does not overwrite existing isolated state', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'happy-stacks-coderabbit-seed-'));
+  const realHome = join(root, 'real');
+  const isolatedHome = join(root, 'isolated');
+
+  try {
+    await mkdir(join(realHome, '.coderabbit'), { recursive: true });
+    await writeFile(join(realHome, '.coderabbit', 'auth.json'), 'from-real\n', 'utf-8');
+
+    await mkdir(join(isolatedHome, '.coderabbit'), { recursive: true });
+    await writeFile(join(isolatedHome, '.coderabbit', 'auth.json'), 'already\n', 'utf-8');
+
+    await seedCodeRabbitHomeFromRealHome({ realHomeDir: realHome, isolatedHomeDir: isolatedHome });
+
+    assert.equal(await readFile(join(isolatedHome, '.coderabbit', 'auth.json'), 'utf-8'), 'already\n');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('seedCodeRabbitHomeFromRealHome refreshes auth.json when the real home has a newer one', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'happy-stacks-coderabbit-seed-'));
+  const realHome = join(root, 'real');
+  const isolatedHome = join(root, 'isolated');
+
+  try {
+    await mkdir(join(realHome, '.coderabbit'), { recursive: true });
+    await mkdir(join(isolatedHome, '.coderabbit'), { recursive: true });
+
+    const isolatedAuthPath = join(isolatedHome, '.coderabbit', 'auth.json');
+    const realAuthPath = join(realHome, '.coderabbit', 'auth.json');
+    await writeFile(isolatedAuthPath, 'old\n', 'utf-8');
+    await writeFile(realAuthPath, 'new\n', 'utf-8');
+    await utimes(isolatedAuthPath, new Date(1_000), new Date(1_000));
+    await utimes(realAuthPath, new Date(2_000), new Date(2_000));
+
+    await seedCodeRabbitHomeFromRealHome({ realHomeDir: realHome, isolatedHomeDir: isolatedHome });
+
+    assert.equal(await readFile(isolatedAuthPath, 'utf-8'), 'new\n');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('seedCodexHomeFromRealHome refreshes auth and does not copy user config.toml', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'happy-stacks-codex-seed-'));
+  const realHome = join(root, 'real');
+  const isolatedHome = join(root, 'isolated');
+
+  try {
+    await mkdir(join(realHome, '.codex'), { recursive: true });
+    await mkdir(isolatedHome, { recursive: true });
+
+    const isolatedAuthPath = join(isolatedHome, 'auth.json');
+    const realAuthPath = join(realHome, '.codex', 'auth.json');
+
+    await writeFile(isolatedAuthPath, 'old-auth\n', 'utf-8');
+    await writeFile(join(isolatedHome, 'config.toml'), 'old-cfg\n', 'utf-8');
+    await writeFile(realAuthPath, 'new-auth\n', 'utf-8');
+    await writeFile(join(realHome, '.codex', 'config.toml'), 'new-cfg\n', 'utf-8');
+    await utimes(isolatedAuthPath, new Date(1_000), new Date(1_000));
+    await utimes(realAuthPath, new Date(2_000), new Date(2_000));
+
+    await seedCodexHomeFromRealHome({ realHomeDir: realHome, isolatedHomeDir: isolatedHome });
+
+    assert.equal(await readFile(isolatedAuthPath, 'utf-8'), 'new-auth\n');
+    let hasConfig = true;
+    try {
+      await stat(join(isolatedHome, 'config.toml'));
+    } catch {
+      hasConfig = false;
+    }
+    assert.equal(hasConfig, false);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test('seedAugmentHomeFromRealHome copies session.json into isolated cache dir', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'happy-stacks-augment-seed-'));
+  const realHome = join(root, 'real');
+  const isolatedHome = join(root, 'isolated');
+
+  try {
+    await mkdir(join(realHome, '.augment'), { recursive: true });
+    await writeFile(join(realHome, '.augment', 'session.json'), '{"ok":true}\n', 'utf-8');
+    await mkdir(isolatedHome, { recursive: true });
+
+    await seedAugmentHomeFromRealHome({ realHomeDir: realHome, isolatedHomeDir: isolatedHome });
+
+    assert.equal(await readFile(join(isolatedHome, 'session.json'), 'utf-8'), '{"ok":true}\n');
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/scripts/utils/review/uncommitted_ops.mjs

@@ -0,0 +1,77 @@
+import { runCapture } from '../proc/proc.mjs';
+import { normalize } from 'node:path';
+import { parseNameStatusZ } from '../git/parse_name_status_z.mjs';
+
+function normalizePath(p) {
+  return String(p ?? '').replace(/\\/g, '/');
+}
+
+function parsePathsZ(buf) {
+  const raw = String(buf ?? '');
+  if (!raw) return [];
+  return raw.split('\0').filter((x) => x.length);
+}
+
+export function assertSafeRelativeRepoPath(rel) {
+  const raw = String(rel ?? '').trim();
+  if (!raw) {
+    throw new Error('[review] unsafe path: empty path');
+  }
+  if (raw.includes('\0')) {
+    throw new Error(`[review] unsafe path: ${raw}`);
+  }
+  if (/^[a-zA-Z]:[\\/]/.test(raw) || raw.startsWith('\\\\') || raw.startsWith('/') || raw.startsWith('\\')) {
+    throw new Error(`[review] unsafe path (absolute): ${raw}`);
+  }
+  const normalized = normalize(raw).replaceAll('\\', '/');
+  if (
+    normalized === '..' ||
+    normalized.startsWith('../') ||
+    normalized.startsWith('/'))
+  {
+    throw new Error(`[review] unsafe path traversal: ${raw}`);
+  }
+  return normalized.replace(/^\.\/+/, '');
+}
+
+export async function getUncommittedOps({ cwd, env = process.env } = {}) {
+  const checkout = new Set();
+  const remove = new Set();
+
+  let entries = [];
+  try {
+    const out = await runCapture('git', ['diff', '--name-status', '--find-renames', '-z', 'HEAD'], { cwd, env });
+    entries = parseNameStatusZ(out);
+  } catch (error) {
+    const details = `${String(error?.message ?? '')}\n${String(error?.err ?? '')}`.toLowerCase();
+    const isMissingHead =
+      details.includes("bad revision 'head'") ||
+      details.includes("ambiguous argument 'head'") ||
+      details.includes("unknown revision or path not in the working tree");
+    if (!isMissingHead) throw error;
+  }
+
+  for (const e of entries) {
+    if (e.code === 'A' || e.code === 'M' || e.code === 'T') {
+      checkout.add(assertSafeRelativeRepoPath(normalizePath(e.path)));
+      continue;
+    }
+    if (e.code === 'D') {
+      remove.add(assertSafeRelativeRepoPath(normalizePath(e.path)));
+      continue;
+    }
+    if (e.code === 'R' || e.code === 'C') {
+      if (e.code === 'R' && e.from) remove.add(assertSafeRelativeRepoPath(normalizePath(e.from)));
+      if (e.to) checkout.add(assertSafeRelativeRepoPath(normalizePath(e.to)));
+      continue;
+    }
+  }
+
+  const untrackedOut = await runCapture('git', ['ls-files', '--others', '--exclude-standard', '-z'], { cwd, env });
+  for (const p of parsePathsZ(untrackedOut)) {
+    checkout.add(assertSafeRelativeRepoPath(normalizePath(p)));
+  }
+
+  const all = new Set([...checkout, ...remove]);
+  return { checkout, remove, all };
+}