@kabmo-labs/kabmo 0.0.0-stage → 0.0.1

package/src/server/lib/fs/git-diff.ts

@@ -0,0 +1,162 @@
+import path from 'path';
+import type { FileDiffData } from '@/shared/types/git';
+import { runGit } from '@/server/lib/fs/git-run';
+
+/**
+ * Context lines requested when the reader wants the whole file rather than the
+ * hunks. `--unified` takes any count, so this is a cap on the FILE, not on the
+ * change: git emits every line it can reach around the edits.
+ */
+const FULL_CONTEXT = 1000000;
+
+/**
+ * Run one git probe and return its stdout ('' on failure).
+ *
+ * Every operand is its own argv element, never interpolated into a shell
+ * string. A repo-relative path is repository-controlled data: a file named
+ * ``a$(touch /tmp/PWNED).sh`` used to have that substitution EXECUTED by the
+ * `sh -c` the previous form went through — verified, the file appeared — and a
+ * filename holding a double quote broke the quoting outright. The `:0:` and
+ * `HEAD:` spellings are a single argv element for the same reason.
+ */
+async function gitOut(args: string[], cwd: string, timeout: number, maxBuffer: number = 1024 * 1024 * 2): Promise<string> {
+  const result = await runGit(args, { cwd, timeout, maxBuffer });
+  return result.error === undefined && result.exitCode === 0 ? result.stdout : '';
+}
+
+/**
+ * Fetch git diff for a specific file in the working directory or index.
+ *
+ * `fullContext` asks git for the entire file rather than the surrounding hunks,
+ * which is what the panel's "Full Code" mode renders — the diff comes back in
+ * the same unified format, so no second rendering path exists.
+ */
+export async function fetchWorkingFileDiff(
+  targetDir: string,
+  file: string,
+  staged: boolean = false,
+  requestedStatus?: string,
+  fullContext: boolean = false
+): Promise<FileDiffData> {
+  // Only a LEADING `./`, `../` or `/` is removed. The previous `[./\\]+` class
+  // also ate a leading dot that began a real name, so `.claude/tools/x.sh`
+  // became `claude/tools/x.sh` — a path that does not exist, which every probe
+  // below then answered "No differences found" for. Measured on the author's
+  // checkouts: 292 of 403 changed files, and they were exactly the dot-paths
+  // (`.github/`, `.idea/`, `.claude/`, `.history/`, `.env`, `.gitignore`,
+  // `.DS_Store`) — which is what "the diff does not show for some .sh/.xml" was.
+  //
+  // A backslash folds to a separator on WINDOWS ONLY. There it cannot be part
+  // of a name, and a client-supplied path may spell the separator either way;
+  // on POSIX it is an ordinary filename character (`a\b.sh` is a legal name),
+  // so folding it there pointed the probes at a file that does not exist.
+  const cleanFile = (process.platform === 'win32' ? file.replace(/\\/g, '/') : file)
+    .replace(/^(?:\.\.?\/|\/)+/, '');
+  const fullPath = path.join(targetDir, cleanFile);
+  let status = requestedStatus && requestedStatus.trim() ? requestedStatus.trim() : 'M';
+  let diff = '';
+  let oldContent = '';
+  let newContent = '';
+  let additions = 0;
+  let deletions = 0;
+
+  try {
+    // Check porcelain status of this file
+    const statusResult = await gitOut(['status', '--porcelain=v1', '--', cleanFile], targetDir, 10000);
+    const statusLine = statusResult.trim();
+    if (statusLine) {
+      status = statusLine.slice(0, 2).trim() || status;
+    }
+
+    // Try reading current new content from disk if it exists
+    try {
+      newContent = await Bun.file(fullPath).text();
+    } catch {
+      newContent = '';
+    }
+
+    // Read old content from index or HEAD
+    oldContent = await gitOut(['show', `HEAD:${cleanFile}`], targetDir, 5000)
+      || await gitOut(['show', `:0:${cleanFile}`], targetDir, 5000);
+
+    // `-U<n>` on every probe: the full-code mode asks for the whole file, and
+    // the diff-only mode keeps git's own default by passing no flag at all.
+    const ctx = fullContext ? [`-U${FULL_CONTEXT}`] : [];
+    // Full-context output is the file, not the change, so a fixed buffer would
+    // truncate a large file's diff — and a killed process is not a success, so
+    // `gitOut` reports it as no diff at all and the synthesized whole-file
+    // rewrite below takes over silently. Sized off the content already read, so
+    // it cannot exceed roughly twice the file.
+    const buf = fullContext
+      ? Math.max(1024 * 1024 * 16, (oldContent.length + newContent.length) * 2 + 1024 * 1024)
+      : 1024 * 1024 * 2;
+
+    if (staged) {
+      // 1. Try staged diff (index vs HEAD), 2. HEAD diff, 3. unstaged diff
+      diff = await gitOut(['diff', ...ctx, '--cached', '--', cleanFile], targetDir, 10000, buf)
+        || await gitOut(['diff', ...ctx, 'HEAD', '--', cleanFile], targetDir, 10000, buf)
+        || await gitOut(['diff', ...ctx, '--', cleanFile], targetDir, 10000, buf);
+    } else if (status === '??' || status === 'U' || status === '?') {
+      // Untracked file: `--no-index` exits 1 when it produced a diff, so read
+      // stdout directly instead of relying on the exit code.
+      const untracked = await runGit(['diff', ...ctx, '--no-index', '/dev/null', cleanFile], { cwd: targetDir, timeout: 10000, maxBuffer: buf });
+      diff = untracked.stdout.trim() ? untracked.stdout : '';
+    } else {
+      // 1. Working tree diff, 2. cached diff, 3. HEAD diff
+      diff = await gitOut(['diff', ...ctx, '--', cleanFile], targetDir, 10000, buf)
+        || await gitOut(['diff', ...ctx, '--cached', '--', cleanFile], targetDir, 10000, buf)
+        || await gitOut(['diff', ...ctx, 'HEAD', '--', cleanFile], targetDir, 10000, buf);
+    }
+
+    // 4. If git diff is still empty but new content exists:
+    if (!diff.trim()) {
+      if (oldContent && newContent && oldContent !== newContent) {
+        // Synthesize diff from old and new lines
+        const oldLines = oldContent.split(/\r?\n/);
+        const newLines = newContent.split(/\r?\n/);
+        const diffBody = [
+          ...oldLines.map((l) => `-${l}`),
+          ...newLines.map((l) => `+${l}`),
+        ].join('\n');
+        diff = `--- a/${cleanFile}\n+++ b/${cleanFile}\n@@ -1,${oldLines.length} +1,${newLines.length} @@\n${diffBody}`;
+      } else if (newContent) {
+        const lines = newContent.split(/\r?\n/);
+        const prefix = status === 'A' || status === '??' ? '+' : ' ';
+        const diffBody = lines.map((l) => `${prefix}${l}`).join('\n');
+        diff = `--- a/${cleanFile}\n+++ b/${cleanFile}\n@@ -1,${lines.length} +1,${lines.length} @@\n${diffBody}`;
+      }
+    }
+
+    // Count additions and deletions from diff
+    if (diff) {
+      const diffLines = diff.split('\n');
+      for (const line of diffLines) {
+        if (line.startsWith('+++') || line.startsWith('---') || line.startsWith('@@')) continue;
+        if (line.startsWith('+')) additions++;
+        else if (line.startsWith('-')) deletions++;
+      }
+    }
+
+    return {
+      file: cleanFile,
+      diff: diff || (newContent ? `--- a/${cleanFile}\n+++ b/${cleanFile}\n@@ -1,1 +1,1 @@\n ${newContent.slice(0, 100)}` : 'No differences found'),
+      oldContent,
+      newContent,
+      staged,
+      status,
+      additions,
+      deletions,
+    };
+  } catch (error: any) {
+    return {
+      file: cleanFile,
+      diff: `// Unable to compute diff for ${cleanFile}: ${error?.message || 'Unknown error'}`,
+      oldContent: '',
+      newContent,
+      staged,
+      status: 'M',
+      additions: 0,
+      deletions: 0,
+    };
+  }
+}

package/src/server/lib/fs/git-ignore.ts

@@ -0,0 +1,105 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Git-ignore resolution for the Files panel.
+ *
+ * `git check-ignore` is the only authority that evaluates every rule source in
+ * one pass — per-directory `.gitignore`, `.git/info/exclude`, and the global
+ * `core.excludesFile` (`~/.gitignore`) — so the panel dims exactly what git
+ * would refuse to track. Paths are fed NUL-separated over stdin (`--stdin -z`)
+ * so a directory listing of any size cannot overflow argv, and the verbatim
+ * NUL-separated reply maps straight back onto those same paths.
+ *
+ * Paths must be relative to `dir` and must exist on disk: git resolves
+ * directory-only patterns (`build/`) by stat-ing the path.
+ *
+ * Answers are memoized per path: the panel asks again every time a folder is
+ * re-listed or re-expanded, and each question costs a `git` subprocess
+ * (measured 5.6 ms). The TTL is short because a `.gitignore` the user just
+ * edited should take effect without a reload; a path whose answer is still
+ * cached is simply not asked about, so a re-listing of a known folder spawns
+ * nothing at all.
+ */
+
+import { GIT_ENV } from '@/server/lib/fs/git-run';
+
+const CACHE_TTL_MS = 5_000;
+/** Bound on remembered paths; the oldest answer is evicted past this. */
+const CACHE_MAX_ENTRIES = 20_000;
+
+interface IgnoreAnswer {
+  ignored: boolean;
+  at: number;
+}
+
+const cache = new Map<string, IgnoreAnswer>();
+
+function cacheKey(dir: string, rel: string): string {
+  return `${dir}\0${rel}`;
+}
+
+export async function collectIgnoredPaths(dir: string, relPaths: string[]): Promise<Set<string>> {
+  if (relPaths.length === 0) return new Set();
+
+  const now = Date.now();
+  const ignored = new Set<string>();
+  const unknown: string[] = [];
+  for (const rel of relPaths) {
+    const answer = cache.get(cacheKey(dir, rel));
+    if (answer && now - answer.at < CACHE_TTL_MS) {
+      if (answer.ignored) ignored.add(rel);
+      continue;
+    }
+    unknown.push(rel);
+  }
+  if (unknown.length === 0) return ignored;
+
+  try {
+    const proc = Bun.spawn({
+      cmd: ['git', 'check-ignore', '--stdin', '-z'],
+      cwd: dir,
+      stdin: 'pipe',
+      stdout: 'pipe',
+      stderr: 'ignore',
+      timeout: 10_000,
+      // The same three variables every other git spawn gets — `GIT_ENV` in
+      // `lib/fs/git-run.ts` names what each prevents. This call site spawns
+      // directly rather than through `runGit`/`runShell`, so it has to opt in.
+      env: { ...Bun.env, ...GIT_ENV },
+    });
+
+    // Drain stdout while the listing is written: a directory big enough to
+    // fill both pipe buffers would otherwise deadlock child against parent.
+    const stdout = new Response(proc.stdout).text();
+    proc.stdin.write(unknown.map(rel => `${rel}\0`).join(''));
+    // FileSink.end() types as `number | Promise<number>` — EPIPE (child gone)
+    // must not surface as an unhandled rejection.
+    void Promise.resolve(proc.stdin.end()).catch(() => {});
+
+    const [text, exitCode] = await Promise.all([stdout, proc.exited]);
+    // 0 = at least one path matched, 1 = none, 128 = no repository. Only 0 can
+    // carry a match list, but every path still gets a definite answer: an
+    // unlisted one is not ignored.
+    const matched = exitCode === 0 ? new Set(text.split('\0').filter(Boolean)) : new Set<string>();
+
+    // Only 0 and 1 mean git actually read the paths; 128 (no repository) is
+    // not an answer, so nothing is cached from it and the next listing retries.
+    const answered = exitCode === 0 || exitCode === 1;
+    const stamped = Date.now();
+    for (const rel of unknown) {
+      const isIgnored = matched.has(rel);
+      if (isIgnored) ignored.add(rel);
+      if (answered) {
+        if (cache.size >= CACHE_MAX_ENTRIES) cache.clear();
+        cache.set(cacheKey(dir, rel), { ignored: isIgnored, at: stamped });
+      }
+    }
+
+    return ignored;
+  } catch {
+    return ignored; // git missing / spawn failed — nothing is dimmed
+  }
+}

package/src/server/lib/fs/git-index-lock.test.ts

@@ -0,0 +1,232 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * A git READ must not take `.git/index.lock`, because the panel reads and
+ * writes the same repository concurrently.
+ *
+ * `git status` looks read-only and is not. With a STALE index — a working file
+ * whose mtime is newer than the stat the index recorded, which is the normal
+ * state right after a checkout, a merge, or any tool that wrote files — git
+ * refreshes the index and WRITES IT BACK (`do_write_index` in `read-cache.c`,
+ * writing `<repo>/.git/index.lock`), which is why the panel's reads race its own
+ * merges. Measured on git 2.50: `GIT_TRACE2_EVENT=1 git status` on a stale index
+ * records `do_write_index … index.lock` twice, and the same command with
+ * `GIT_OPTIONAL_LOCKS=0` records it ZERO times. Under concurrency the loser of
+ * the race is the merge:
+ *
+ *   git action merge_branch failed (HTTP 400): error: Unable to create
+ *   '<repo>/.git/index.lock': File exists.
+ *
+ * That is a real failure on a user's machine, not a flaky test: it fired twice
+ * in the browser specs (2026-10-15 and 2026-10-16) and needs only the repository
+ * modal to be open while a merge is clicked.
+ *
+ * `GIT_OPTIONAL_LOCKS=0` is git's own answer for a read — the index refresh is
+ * an optimization (it lets the next read skip re-stat'ing), so declining it
+ * costs a stat and removes the write. This test drives the REAL `runGit` and the
+ * REAL status read against a real repository, because the whole bug lives in the
+ * spawn environment: a fake child would prove nothing about which variables git
+ * was given.
+ *
+ * The assertion is the index FILE's identity (mtime + size), not a race: git
+ * either replaced it or it did not. The race itself is deliberately NOT
+ * asserted — measured, spawning the reads and the merge together does not
+ * reproduce it reliably enough to be a test (0 of 6 runs failed with the fix
+ * reverted), and a test that passes with the bug present is worse than no test.
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { runGit } from '@/server/lib/fs/git-run';
+import { readGitStatus } from '@/server/lib/fs/git-status-read';
+import { testPosix } from '@/test-support/platform';
+
+const repos: string[] = [];
+
+afterEach(() => {
+  while (repos.length > 0) fs.rmSync(repos.pop() as string, { recursive: true, force: true });
+});
+
+function git(cwd: string, ...args: string[]): string {
+  const result = Bun.spawnSync({
+    cmd: ['git', ...args],
+    cwd,
+    env: { ...Bun.env, GIT_EDITOR: 'true' },
+  });
+  if (result.exitCode !== 0) throw new Error(`git ${args.join(' ')} failed: ${result.stderr.toString()}`);
+  return result.stdout.toString();
+}
+
+function makeRepo(): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'kabmo-index-lock-'));
+  repos.push(dir);
+  git(dir, 'init', '-q', '-b', 'main');
+  git(dir, 'config', 'user.email', 'e2e@example.invalid');
+  git(dir, 'config', 'user.name', 'E2E');
+  return dir;
+}
+
+/** One commit of `files` tracked files, so a changed stat below makes the index stale. */
+function seedTracked(cwd: string, files = 200): void {
+  for (let i = 0; i < files; i += 1) {
+    fs.writeFileSync(path.join(cwd, `f${i}.txt`), `line ${i}\n`);
+  }
+  git(cwd, 'add', '-A');
+  git(cwd, 'commit', '-q', '-m', 'base');
+}
+
+/**
+ * Make the index STAT-STALE without changing any file's content: every tracked
+ * file's mtime is moved well ahead of the stat the index recorded.
+ *
+ * **The content must stay identical, and that is the whole point.** `git status`
+ * only writes the index back when it can REFRESH an entry (`cache_changed`), and
+ * an entry whose CONTENT changed is dirty — git cannot refresh it, so the write
+ * then depends on `has_racy_timestamp` instead: the index's own mtime second
+ * against the entry's recorded one. That is a clock race against the fixture's
+ * setup, and it is what made this control flake (measured on macOS: every run
+ * whose `git add`/`git commit` stayed inside one second wrote the index, and the
+ * one run that crossed a second boundary did not — `git status` reported the
+ * same 200 modified files either way). Touching the mtime with the content
+ * intact makes the refresh SUCCEED, so `cache_changed` is set on every git build
+ * and every platform, independent of timestamps.
+ *
+ * The mtime is moved EXPLICITLY rather than left to "the rewrite happens after
+ * the commit". Those differ by filesystem timestamp granularity: on a runner
+ * whose clock or FS rounds to the second, a rewrite inside the same second as
+ * the index write leaves the entry "racily clean". A minute of headroom is
+ * unambiguous on every filesystem git supports, and each call takes a larger
+ * offset so a second pass is stale against the stat the first one wrote back.
+ */
+function staleIndex(cwd: string, secondsAhead: number, files = 200): void {
+  for (let i = 0; i < files; i += 1) {
+    const file = path.join(cwd, `f${i}.txt`);
+    const future = new Date(Date.now() + secondsAhead * 1000);
+    fs.utimesSync(file, future, future);
+  }
+}
+
+/** The index's identity: git replaces it atomically, so either field moves. */
+function indexStamp(cwd: string): string {
+  const stat = fs.statSync(path.join(cwd, '.git', 'index'));
+  return `${stat.mtimeMs}:${stat.size}`;
+}
+
+/**
+ * Whether a `git status` run rewrote the index — i.e. took the lock.
+ *
+ * Read from the index FILE rather than from git's `GIT_TRACE2_EVENT` stream.
+ * The trace was the original probe and it is version- and platform-sensitive:
+ * the region name (`do_write_index`) is an implementation detail, git-for-Windows
+ * does not emit it at all, and a `trace2` config in the environment can redirect
+ * the stream away from stderr. The file is the thing the assertion is actually
+ * about — `index.lock` is taken so the index can be replaced — and it is
+ * observable on every platform and version.
+ */
+function indexWriteCount(cwd: string, env: Record<string, string>): number {
+  const before = indexStamp(cwd);
+  const result = Bun.spawnSync({
+    cmd: ['git', 'status', '--porcelain'],
+    cwd,
+    env: { ...Bun.env, ...env },
+  });
+  // A failed run proves nothing either way; the caller's assertion would read a
+  // crash as "no write", which is the vacuous pass this control exists to stop.
+  if (result.exitCode !== 0) throw new Error(`git status failed: ${result.stderr.toString()}`);
+  return indexStamp(cwd) === before ? 0 : 1;
+}
+
+describe('a git READ does not take the index lock', () => {
+  // The positive control watches the INDEX FILE, which is what the lock exists
+  // to replace. That keeps it meaningful on every git version and platform; the
+  // `testPosix` guard stays because the shim-based case below writes a `#!/bin/sh`
+  // stub, which Windows cannot execute.
+  testPosix('git status writes the index on a stale index — and stops when the lock is refused', () => {
+    // The mechanism itself, so the rest of the test cannot pass vacuously: if a
+    // future git stops refreshing the index here, this assertion fails and says
+    // so rather than silently proving nothing.
+    const repo = makeRepo();
+    seedTracked(repo);
+    staleIndex(repo, 60);
+    expect(indexWriteCount(repo, {})).toBeGreaterThan(0);
+
+    staleIndex(repo, 120);
+    expect(indexWriteCount(repo, { GIT_OPTIONAL_LOCKS: '0' })).toBe(0);
+  });
+
+  testPosix('Kabmo spawns git with the lock refused, on both the argv and the shell path', async () => {
+    // The status read goes through `runShell` (a `sh -c` string), the repo-modal
+    // read through `runGit` (argv) — the split is exactly how one of the two
+    // paths would have kept the bug. A shim on PATH records what each child was
+    // actually given.
+    //
+    // **The shim is only reached by a spawn that passes `env:`** — measured:
+    // `Bun.spawn` with no `env` option resolves the command against the
+    // environment captured at process start, so a shim added to `process.env`
+    // afterwards is invisible to it. That is not a limitation to work around, it
+    // IS the signal: a call site that drops its `env` is a call site the shim
+    // never sees, which is why each path is asserted BY ITS OWN ARGUMENTS rather
+    // than by a total count.
+    //
+    // The real git is resolved BEFORE the shim goes on PATH, and the shim execs
+    // that absolute path: a bare `git` inside the shim would find the shim again
+    // and recurse (measured: the fixture's own `git init` timed out).
+    const realGit = Bun.which('git');
+    expect(realGit).toBeTruthy();
+
+    // The repository is built FIRST, while the real git is still the one on
+    // PATH — the fixture's own `git init`/`commit` calls do not set the variable
+    // and would otherwise be recorded as misses.
+    const repo = makeRepo();
+    seedTracked(repo);
+
+    const shimDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kabmo-git-shim-'));
+    repos.push(shimDir);
+    const record = path.join(shimDir, 'env.txt');
+    const shim = path.join(shimDir, 'git');
+    fs.writeFileSync(
+      shim,
+      `#!/bin/sh\nprintf 'locks=%s argv=%s\\n' "\${GIT_OPTIONAL_LOCKS-unset}" "$*" >> ${JSON.stringify(record)}\nexec ${JSON.stringify(realGit)} "$@"\n`,
+      { mode: 0o755 },
+    );
+
+    const previousPath = process.env.PATH;
+    process.env.PATH = `${shimDir}:${previousPath ?? ''}`;
+    try {
+      // The shell path: the status read the panel runs on every tool call.
+      await readGitStatus(repo);
+      // The argv path, with its own format so the two cannot be confused in the
+      // record.
+      await runGit(['status', '--porcelain=v2'], { cwd: repo });
+
+      const lines = fs.readFileSync(record, 'utf8').trim().split('\n');
+      const shell = lines.filter((line) => line.includes('--porcelain=v1'));
+      const argv = lines.filter((line) => line.includes('--porcelain=v2'));
+      // Both paths reached the shim at all — this is what fails when a call site
+      // stops passing its environment.
+      expect(shell.length).toBeGreaterThan(0);
+      expect(argv.length).toBeGreaterThan(0);
+      // And every spawn refused the lock.
+      expect(lines.every((line) => line.startsWith('locks=0 '))).toBe(true);
+    } finally {
+      process.env.PATH = previousPath;
+    }
+  });
+
+  test('a mutating command still writes the index with the variable set', async () => {
+    // The lock is a READ concern. A commit that skipped it would be broken, so
+    // this pins that the variable does not disarm a writer.
+    const repo = makeRepo();
+    fs.writeFileSync(path.join(repo, 'a.txt'), 'x\n');
+    const add = await runGit(['add', 'a.txt'], { cwd: repo });
+    expect(add.exitCode).toBe(0);
+    const commit = await runGit(['commit', '-q', '-m', 'add a'], { cwd: repo });
+    expect(commit.exitCode).toBe(0);
+    expect(git(repo, 'log', '--oneline', '-1')).toContain('add a');
+  });
+});

package/src/server/lib/fs/git-log-parse.test.ts

@@ -0,0 +1,155 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * `git log --numstat` parsing, isolated from the repository fixtures.
+ *
+ * The body is fenced by `\x1f`/`\x1e` in the log format precisely because a
+ * body line can carry a TAB, which the numstat branch would otherwise read as
+ * a changed file — and because a one-line commit still emits the record
+ * separator, which must be honoured on the header line or the first file row
+ * becomes body text. Both shapes are pinned here; the repository-backed
+ * contract (`limit`/`skip`/`hasMore`/`total`) lives in `git-log.test.ts`.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { parseGitLogOutput } from '@/server/lib/fs/git-log';
+
+describe('parseGitLogOutput', () => {
+  test('empty stdout is an empty history, never a mock page', () => {
+    expect(parseGitLogOutput('')).toEqual([]);
+    expect(parseGitLogOutput('\n')).toEqual([]);
+  });
+
+  test('parses the header fields, refs and parents', () => {
+    const stdout =
+      'COMMIT_SPLIT|~|abc1234567890|~|abc1234|~|Ada|~|Jan 01, 2024, 10:00 AM|~|subject line|~|HEAD -> main, origin/main|~|p1 p2\n';
+    expect(parseGitLogOutput(stdout)).toEqual([
+      {
+        hash: 'abc1234567890',
+        shortHash: 'abc1234',
+        author: 'Ada',
+        date: 'Jan 01, 2024, 10:00 AM',
+        message: 'subject line',
+        refs: ['HEAD -> main', 'origin/main'],
+        parents: ['p1', 'p2'],
+        files: [],
+      },
+    ]);
+  });
+
+  test('the raw row supplies the status and the numstat row the counts', () => {
+    // `--raw` and `--numstat` print one block each, in the same order, so the
+    // two are zipped. The status comes from git — a file that only LOST lines
+    // is `M`, and the numstat counts alone cannot say so (`0\t3\tf.txt` is a
+    // deletion's shape too).
+    const stdout = [
+      'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|msg|~||~|',
+      ':000000 100644 0000000 1111111 A\tadded.txt',
+      ':100644 000000 2222222 0000000 D\tgone.txt',
+      ':100644 100644 3333333 4444444 R100\told.txt\tnew.txt',
+      ':100644 100644 5555555 6666666 M\tboth.txt',
+      ':100644 100644 7777777 8888888 M\tlogo.png',
+      ':000000 100644 0000000 9999999 A\t"tab\\there.txt"',
+      '1\t0\tadded.txt',
+      '0\t3\tgone.txt',
+      '0\t0\told.txt => new.txt',
+      '2\t1\tboth.txt',
+      '-\t-\tlogo.png',
+      '1\t0\t"tab\\there.txt"',
+      '',
+    ].join('\n');
+    const [commit] = parseGitLogOutput(stdout);
+    expect(commit.files).toEqual([
+      { file: 'added.txt', status: 'A', additions: 1, deletions: 0 },
+      { file: 'gone.txt', status: 'D', additions: 0, deletions: 3 },
+      { file: 'old.txt => new.txt', status: 'R', additions: 0, deletions: 0 },
+      { file: 'both.txt', status: 'M', additions: 2, deletions: 1 },
+      { file: 'logo.png', status: 'M', additions: 0, deletions: 0 },
+      { file: 'tab\there.txt', status: 'A', additions: 1, deletions: 0 },
+    ]);
+  });
+
+  test('a modified file that only lost lines is M, never D', () => {
+    // The reported bug: `0\t1\tf.txt` is a shrink, and inferring the status
+    // from the counts rendered it as a deletion.
+    const stdout = [
+      'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|msg|~||~|',
+      ':100644 100644 aaa bbb M\tf.txt',
+      '0\t1\tf.txt',
+      '',
+    ].join('\n');
+    const [commit] = parseGitLogOutput(stdout);
+    expect(commit.files).toEqual([{ file: 'f.txt', status: 'M', additions: 0, deletions: 1 }]);
+  });
+
+  test('a copy is a new file, not a rename', () => {
+    const stdout = [
+      'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|msg|~||~|',
+      ':100644 100644 aaa bbb C100\tsrc/a.ts\tsrc/b.ts',
+      '0\t0\tsrc/{a.ts => b.ts}',
+      '',
+    ].join('\n');
+    const [commit] = parseGitLogOutput(stdout);
+    expect(commit.files).toEqual([
+      { file: 'src/{a.ts => b.ts}', status: 'A', additions: 0, deletions: 0 },
+    ]);
+  });
+
+  test('a numstat row without a raw status falls back to M rather than a guess', () => {
+    const stdout = 'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|msg|~||~|\n0\t3\tgone.txt\n';
+    const [commit] = parseGitLogOutput(stdout);
+    expect(commit.files).toEqual([{ file: 'gone.txt', status: 'M', additions: 0, deletions: 3 }]);
+  });
+
+  test('ignores file rows before the first header and short rows', () => {
+    const stdout =
+      '1\t0\tstray.txt\n' +
+      'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|msg|~||~|\n' +
+      'garbage\n' +
+      ':000000 100644 0000000 1111111 A\tok.txt\n' +
+      '1\t0\tok.txt\n';
+    const commits = parseGitLogOutput(stdout);
+    expect(commits).toHaveLength(1);
+    expect(commits[0].files).toEqual([{ file: 'ok.txt', status: 'A', additions: 1, deletions: 0 }]);
+  });
+
+  test('falls back to a short hash and an unknown author when fields are blank', () => {
+    const stdout = 'COMMIT_SPLIT|~|0123456789abcdef|~||~||~||~|msg|~||~|\n';
+    const [commit] = parseGitLogOutput(stdout);
+    expect(commit.shortHash).toBe('01234567');
+    expect(commit.author).toBe('Unknown');
+    expect(commit.refs).toEqual([]);
+    expect(commit.parents).toEqual([]);
+  });
+
+  test('a commit body is captured across its lines, tabs and all', () => {
+    // The body is fenced by \x1f/\x1e precisely because a body line can carry a
+    // TAB, which the numstat branch would otherwise read as a changed file.
+    const stdout =
+      'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|subject|~||~|\x1fpara one\n\n\tindented line\n\x1e\n:000000 100644 0000000 1111111 A\treal.txt\n1\t0\treal.txt\n';
+    const [commit] = parseGitLogOutput(stdout);
+    expect(commit.body).toBe('para one\n\n\tindented line');
+    expect(commit.files).toEqual([{ file: 'real.txt', status: 'A', additions: 1, deletions: 0 }]);
+  });
+
+  test('a one-line commit has no body and still parses its file rows', () => {
+    // git emits the record separator even with an empty `%b`; if it were not
+    // honoured on the header line the first numstat row would become the body.
+    const stdout = 'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|subject|~||~|\x1e\n2\t1\tboth.txt\n';
+    const [commit] = parseGitLogOutput(stdout);
+    expect(commit.body).toBeUndefined();
+    expect(commit.files).toEqual([{ file: 'both.txt', status: 'M', additions: 2, deletions: 1 }]);
+  });
+
+  test('a body is fenced per commit, so the next header is not body text', () => {
+    const stdout =
+      'COMMIT_SPLIT|~|h1|~|s1|~|Ada|~|date|~|first|~||~|\x1fbody of first\n\x1e\n1\t0\ta.txt\n' +
+      'COMMIT_SPLIT|~|h2|~|s2|~|Ada|~|date|~|second|~||~|\x1fbody of second\n\x1e\n1\t0\tb.txt\n';
+    const commits = parseGitLogOutput(stdout);
+    expect(commits.map((c) => c.body)).toEqual(['body of first', 'body of second']);
+    expect(commits.map((c) => c.files?.[0].file)).toEqual(['a.txt', 'b.txt']);
+  });
+});