@lisang233/pi-sync 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LosLisang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,96 @@
+# 🔄 pi-sync
+
+A personal Pi extension that syncs Pi configuration through **Git** with git-style `fetch`/`pull`/`merge`/`push`, a single config file, and conflict resolution inside the Pi UI.
+
+> **Experimental.** This is a from-scratch rewrite of the classic pi-sync flow: one config file, one git remote, content-level diffs, three-way merges, and deliberate commands that never move your files without asking.
+
+## ✨ Features
+
+- **Single config, direct connection** — one `pi-sync.json` points at one git remote and branch. No two-level setup/connection model.
+- **Observe-only automatic** — `automatic: true` fetches at session start and shows a persistent status-bar indicator (up-to-date / ahead / behind / conflict). It never pushes, pulls or merges on its own.
+- **Git-style pull** — `/sync pull` fetches and merges. Clean changes apply directly; divergence without a flag writes nothing; `--force` overwrites local files; `--merge` opens in-UI conflict resolution.
+- **In-UI conflict resolution** — divergent edits are parsed into conflict blocks and resolved one at a time (keep local / keep remote / type a replacement). Progress persists across sessions; `/sync merge` resumes, `/sync merge --abort` restores the pre-merge backup.
+- **JSON-aware merging** — single-line `settings.json`/`keybindings.json`/`models.json` merge field-wise, so formatting or an unrelated field change doesn't conflict.
+- **Closed-loop status** — `/sync status` shows the effective config, the sync state, any in-progress merge, and the exact next step; `/sync status --diff` shows the content-level diff (JSON pretty-printed, secrets masked, bounded).
+- **No stored credentials** — Git uses your existing SSH/credential-helper setup; the config file never holds tokens.
+
+## 📦 Install
+
+```bash
+pi install -l ~/Documents/code/pi-sync
+```
+
+or from npm once published:
+
+```bash
+pi install npm:@lisang233/pi-sync
+```
+
+## 🚀 Quick start
+
+```bash
+/sync init         # first-run wizard: remote, branch, include, automatic
+/sync config       # view and edit the config at any time
+/sync status       # config + sync state + next step (--diff for content)
+/sync fetch        # pull the remote snapshot without applying
+/sync pull         # fetch + merge (--force overwrites, --merge resolves)
+/sync merge        # continue an in-progress merge (--abort discards)
+/sync push         # publish local snapshot (--force overwrites remote)
+```
+
+## ⚙️ Settings
+
+The config lives at `~/.pi/agent/pi-sync.json` (agent dir honors `PI_CODING_AGENT_DIR`):
+
+```json
+{
+	"remote": "git@github.com:you/pi-sync.git",
+	"branch": "pi-sync",
+	"include": [
+		"settings.json",
+		"keybindings.json",
+		"models.json",
+		"skills",
+		"prompts",
+		"themes",
+		"extensions",
+		"extension-settings"
+	],
+	"automatic": true
+}
+```
+
+- `include` selects which agent-dir paths sync. The defaults are `settings.json`, `keybindings.json`, `models.json`, `skills`, `prompts`, `themes`, `extensions`, and `extension-settings`. Sessions and `AGENTS.md` are intentionally not included by default. Edit it any time with `/sync config`.
+- `automatic` only controls whether a non-destructive fetch runs at session start; the status-bar indicator always reflects the last known state.
+- State lives under `<agent-dir>/pi-sync/` (a mirror git repo, `state.json`, `merge-session/`, and backups).
+
+## 🗂️ Package layout
+
+```text
+src/
+  index.ts          extension entrypoint
+  extension.ts      lifecycle, /sync command routes, session-start fetch
+  config.ts         single-file config load/validate/save
+  config-ui.ts      interactive config editor (view + edit fields)
+  paths.ts          agent-dir paths and include normalization
+  git.ts            git subprocess backend (fetch/push/show/merge-file)
+  snapshot.ts       scan include paths into a hashed snapshot
+  state.ts          last-applied snapshot + remote revision
+  status.ts         sync-state derivation and indicator text
+  merge-session.ts  persistent conflict-resolution session store
+  conflict.ts       diff3 marker parsing and resolved-text splicing
+  resolve.ts        structured block-by-block conflict resolver
+  diff.ts           content-level diff with JSON formatting and secret masking
+  merge.ts          three-way merge (JSON field-wise + git merge-file fallback)
+  operations.ts     status/push/pull/fetch/merge
+  wizard.ts         first-run setup wizard
+test/               vitest unit + local-bare-repo end-to-end tests
+```
+
+## 🔎 Keywords
+
+`pi-package` `pi-extension` `pi` `sync` `git`
+
+## 📄 License
+
+MIT

package/package.json

@@ -0,0 +1,48 @@
+{
+	"name": "@lisang233/pi-sync",
+	"version": "0.1.0",
+	"description": "Personal Pi extension that syncs Pi configuration through Git with background auto-sync and git-style fetch/merge conflict handling.",
+	"type": "module",
+	"license": "MIT",
+	"keywords": [
+		"pi-package",
+		"pi-extension",
+		"pi",
+		"sync",
+		"git"
+	],
+	"files": [
+		"src",
+		"README.md",
+		"LICENSE"
+	],
+	"pi": {
+		"extensions": [
+			"./src/index.ts"
+		]
+	},
+	"piExtension": {
+		"lifecycle": "experimental"
+	},
+	"scripts": {
+		"check": "biome check . && tsc --noEmit",
+		"format": "biome check --write .",
+		"test": "vitest run",
+		"typecheck": "tsc --noEmit"
+	},
+	"dependencies": {
+		"diff": "8.0.4"
+	},
+	"peerDependencies": {
+		"@earendil-works/pi-coding-agent": "*",
+		"@earendil-works/pi-tui": "*"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "2.5.7",
+		"@earendil-works/pi-coding-agent": "0.84.1",
+		"@earendil-works/pi-tui": "0.84.1",
+		"@types/node": "^24.0.0",
+		"typescript": "7.0.2",
+		"vitest": "4.1.10"
+	}
+}

package/src/config-ui.ts

@@ -0,0 +1,138 @@
+import type { ExtensionUIContext } from "@earendil-works/pi-coding-agent";
+import { parseConfig, type SyncConfig, saveConfig } from "./config.js";
+import { DEFAULT_INCLUDE, normalizeInclude } from "./paths.js";
+
+export function formatConfig(config: SyncConfig): string {
+	return [
+		`remote: ${config.remote}`,
+		`branch: ${config.branch}`,
+		`automatic: ${config.automatic ? "enabled" : "disabled"}`,
+		`included (${config.include.length}): ${config.include.join(", ") || "none"}`,
+	].join("\n");
+}
+
+/**
+ * Interactive config editor: show the current config, then loop over the
+ * fields (remote/branch/include/automatic) letting the user change one at a
+ * time. Each change is validated immediately; everything is saved atomically
+ * when the user picks "done". Escaping discards pending changes.
+ */
+export async function runConfigEditor(ui: ExtensionUIContext, config: SyncConfig): Promise<void> {
+	let current = { ...config };
+	let dirty = false;
+	ui.notify(formatConfig(current), "info");
+	for (;;) {
+		const field = await ui.select("pi-sync config — edit a field", [
+			"remote",
+			"branch",
+			"include",
+			"automatic",
+			"done",
+		]);
+		if (field === undefined) {
+			if (dirty) ui.notify("Config changes discarded.", "info");
+			return;
+		}
+		if (field === "done") break;
+		try {
+			if (field === "include") {
+				const result = await editInclude(ui, current);
+				current = result.config;
+				dirty = dirty || result.changed;
+				continue;
+			}
+			let candidate: SyncConfig | undefined;
+			if (field === "remote") {
+				const value = await ui.input("Git remote URL", current.remote);
+				if (value === undefined) continue;
+				candidate = parseConfig({ ...current, remote: value.trim() });
+			} else if (field === "branch") {
+				const value = await ui.input("Remote branch", current.branch);
+				if (value === undefined) continue;
+				candidate = parseConfig({ ...current, branch: value.trim() || undefined });
+			} else if (field === "automatic") {
+				const value = await ui.confirm(
+					"Enable automatic sync?",
+					`Fetch at session start and refresh the indicator.\nCurrently: ${current.automatic ? "enabled" : "disabled"}`,
+				);
+				candidate = parseConfig({ ...current, automatic: value });
+			}
+			if (candidate) {
+				current = candidate;
+				dirty = true;
+				const shown =
+					field === "automatic"
+						? current.automatic
+							? "enabled"
+							: "disabled"
+						: field === "branch"
+							? current.branch
+							: current.remote;
+				ui.notify(`${field}: ${shown}`, "info");
+			}
+		} catch (error) {
+			ui.notify(errorMessage(error), "warning");
+		}
+	}
+	await saveConfig(current);
+	ui.notify(`Config saved.\n${formatConfig(current)}`, "info");
+}
+
+async function editInclude(
+	ui: ExtensionUIContext,
+	config: SyncConfig,
+): Promise<{ config: SyncConfig; changed: boolean }> {
+	let current = { ...config };
+	let changed = false;
+	for (;;) {
+		const action = await ui.select(
+			`include (${current.include.length}): ${current.include.join(", ") || "none"}`,
+			["＋ add a path", "－ remove a path", "✔ done"],
+		);
+		if (action === undefined || action === "✔ done") return { config: current, changed };
+		if (action === "＋ add a path") {
+			const candidates = [
+				...DEFAULT_INCLUDE.filter((name) => !current.include.includes(name)),
+				"type a path…",
+			];
+			const picked = await ui.select("Add include path", candidates);
+			if (picked === undefined) continue;
+			let entry = picked;
+			if (picked === "type a path…") {
+				const typed = await ui.input("Agent-relative path to include (e.g. AGENTS.md)");
+				if (typed === undefined) continue;
+				entry = typed.trim();
+			}
+			if (entry.length === 0) continue;
+			try {
+				current = addInclude(current, entry);
+				changed = true;
+				ui.notify(`+ ${entry}`, "info");
+			} catch (error) {
+				ui.notify(errorMessage(error), "warning");
+			}
+		} else {
+			if (current.include.length === 0) {
+				ui.notify("Nothing to remove.", "info");
+				continue;
+			}
+			const picked = await ui.select("Remove include path", current.include);
+			if (picked === undefined) continue;
+			current = {
+				...current,
+				include: normalizeInclude(current.include.filter((name) => name !== picked)),
+			};
+			changed = true;
+			ui.notify(`− ${picked}`, "info");
+		}
+	}
+}
+
+function errorMessage(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+/** Validate an additional include entry (throws on unsafe or duplicate). */
+function addInclude(config: SyncConfig, entry: string): SyncConfig {
+	return { ...config, include: normalizeInclude([...config.include, entry]) };
+}

package/src/config.ts

@@ -0,0 +1,111 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { agentDir, normalizeInclude } from "./paths.js";
+
+export const CONFIG_FILE_NAME = "pi-sync.json";
+
+export interface SyncConfig {
+	remote: string;
+	branch: string;
+	include: string[];
+	automatic: boolean;
+}
+
+export const DEFAULT_CONFIG: SyncConfig = {
+	remote: "",
+	branch: "pi-sync",
+	include: [
+		"settings.json",
+		"keybindings.json",
+		"models.json",
+		"skills",
+		"prompts",
+		"themes",
+		"extensions",
+		"extension-settings",
+	],
+	automatic: true,
+};
+
+export const SNAPSHOT_FILE = "snapshot.json";
+export const BACKUP_DIR = "backups";
+
+export function configPath(): string {
+	return path.join(agentDir(), CONFIG_FILE_NAME);
+}
+
+export function stateDir(): string {
+	return path.join(agentDir(), "pi-sync");
+}
+
+export function mirrorRepoDir(): string {
+	return path.join(stateDir(), "mirror");
+}
+
+export function snapshotFilePath(): string {
+	return path.join(mirrorRepoDir(), "pi-sync", SNAPSHOT_FILE);
+}
+
+export function backupRootDir(): string {
+	return path.join(stateDir(), BACKUP_DIR);
+}
+
+export async function loadConfig(): Promise<SyncConfig> {
+	let text: string;
+	try {
+		text = await fs.readFile(configPath(), "utf8");
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+			return { ...DEFAULT_CONFIG };
+		}
+		throw error;
+	}
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(text);
+	} catch (error) {
+		throw new Error(`pi-sync config is not valid JSON: ${configPath()}`, { cause: error });
+	}
+	return parseConfig(parsed);
+}
+
+export function parseConfig(value: unknown): SyncConfig {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		throw new Error("Invalid pi-sync config: expected an object.");
+	}
+	const record = value as Record<string, unknown>;
+	const remote = record.remote;
+	if (typeof remote !== "string" || remote.trim().length === 0) {
+		throw new Error("Invalid pi-sync config: remote must be a non-empty git URL.");
+	}
+	const branch = record.branch;
+	if (branch !== undefined && typeof branch !== "string") {
+		throw new Error("Invalid pi-sync config: branch must be a string.");
+	}
+	if (typeof branch === "string" && (!/^[\w./-]+$/u.test(branch) || branch.includes(".."))) {
+		throw new Error("Invalid pi-sync config: branch contains unsafe characters.");
+	}
+	const include =
+		record.include === undefined ? [...DEFAULT_CONFIG.include] : normalizeInclude(record.include);
+	const automatic =
+		record.automatic === undefined ? DEFAULT_CONFIG.automatic : parseBoolean(record.automatic);
+	return {
+		remote: remote.trim(),
+		branch: (branch ?? DEFAULT_CONFIG.branch).trim(),
+		include,
+		automatic,
+	};
+}
+
+export async function saveConfig(config: SyncConfig): Promise<void> {
+	await fs.mkdir(agentDir(), { recursive: true });
+	const serialized = `${JSON.stringify(config, null, "\t")}\n`;
+	await fs.writeFile(configPath(), serialized, { mode: 0o600 });
+}
+
+function parseBoolean(value: unknown): boolean {
+	if (typeof value === "boolean") return value;
+	if (value === "true" || value === 1) return true;
+	if (value === "false" || value === 0) return false;
+	throw new Error("Invalid pi-sync config: automatic must be a boolean.");
+}

package/src/conflict.ts

@@ -0,0 +1,90 @@
+import type { ConflictBlock } from "./merge-session.js";
+
+/** A parsed diff3 conflict block with its line span in the merged text. */
+export interface ParsedConflictBlock {
+	block: ConflictBlock;
+	/** Line index of the "<<<<<<<" marker. */
+	startLine: number;
+	/** Line index of the ">>>>>>>" marker (inclusive). */
+	endLine: number;
+}
+
+const MARKER_OPEN = "<<<<<<<";
+const MARKER_BASE = "|||||||";
+const MARKER_SEP = "=======";
+const MARKER_CLOSE = ">>>>>>>";
+
+/**
+ * Parse diff3 conflict markers (as written by `git merge-file --diff3`) into
+ * independent blocks. Malformed blocks are skipped rather than failing the
+ * whole file. Marker labels (anything after the marker prefix) are ignored.
+ */
+export function parseConflictBlocks(mergedText: string): ParsedConflictBlock[] {
+	const lines = mergedText.split(/\r?\n/u);
+	const blocks: ParsedConflictBlock[] = [];
+	let index = 0;
+	while (index < lines.length) {
+		if (lines[index].startsWith(MARKER_OPEN)) {
+			const startLine = index;
+			const localEnd = findMarker(lines, index + 1, [MARKER_BASE, MARKER_SEP, MARKER_CLOSE]);
+			if (localEnd === undefined) break;
+			const baseStart = localEnd;
+			const baseEnd = findMarker(lines, baseStart + 1, [MARKER_SEP, MARKER_CLOSE]);
+			if (baseEnd === undefined) break;
+			const sep = baseEnd;
+			const remoteEnd = findMarker(lines, sep + 1, [MARKER_CLOSE]);
+			if (remoteEnd === undefined) break;
+			blocks.push({
+				block: {
+					local: lines.slice(startLine + 1, localEnd).join("\n"),
+					base: lines.slice(baseStart + 1, sep).join("\n"),
+					remote: lines.slice(sep + 1, remoteEnd).join("\n"),
+					resolution: undefined,
+					choice: undefined,
+				},
+				startLine,
+				endLine: remoteEnd,
+			});
+			index = remoteEnd + 1;
+			continue;
+		}
+		index += 1;
+	}
+	return blocks;
+}
+
+/**
+ * Rebuild the merged text with conflict blocks replaced by their resolutions.
+ * `resolutions[i]` is the resolved content for block i; undefined is an error.
+ * Preserves the merged text's line-ending style.
+ */
+export function applyResolutions(
+	mergedText: string,
+	resolutions: Array<string | undefined>,
+): string {
+	const eol = mergedText.includes("\r\n") ? "\r\n" : "\n";
+	const lines = mergedText.split(/\r?\n/u);
+	const blocks = parseConflictBlocks(mergedText);
+	if (blocks.length !== resolutions.length) {
+		throw new Error(
+			`Conflict block count changed (${blocks.length} on disk vs ${resolutions.length} in session). Re-run /sync pull --merge or /sync merge --abort.`,
+		);
+	}
+	for (let index = blocks.length - 1; index >= 0; index -= 1) {
+		const resolution = resolutions[index];
+		if (resolution === undefined) {
+			throw new Error(`Conflict block ${index + 1} is not resolved yet.`);
+		}
+		const block = blocks[index];
+		const replacement = resolution.split(/\r?\n/u);
+		lines.splice(block.startLine, block.endLine - block.startLine + 1, ...replacement);
+	}
+	return lines.join(eol);
+}
+
+function findMarker(lines: string[], from: number, markers: string[]): number | undefined {
+	for (let index = from; index < lines.length; index += 1) {
+		if (markers.some((marker) => lines[index].startsWith(marker))) return index;
+	}
+	return undefined;
+}

package/src/diff.ts

@@ -0,0 +1,154 @@
+import { createTwoFilesPatch } from "diff";
+import { fileHashMap, type Snapshot, snapshotFileContent } from "./snapshot.js";
+
+const HUNK_CONTEXT_LINES = 2;
+const MAX_HUNK_FILE_BYTES = 1024 * 1024;
+const MAX_TOTAL_HUNK_LINES = 300;
+const SECRET_MASK = "****";
+const TRUNCATED_MARKER = "… (hunk truncated)";
+
+const SECRET_PATTERNS = [
+	/AWS_SECRET_ACCESS_KEY\s*[=:]\s*['"]?[A-Za-z0-9/+]{35,}/i,
+	/(ANTHROPIC|OPENAI|GEMINI|GOOGLE|FIRECRAWL|GITHUB|CLOUDFLARE|R2|S3)_[A-Z0-9_]*(KEY|TOKEN|SECRET)\s*[=:]\s*['"]?[^\s'"]{12,}/i,
+	/sk-ant-[A-Za-z0-9_-]{20,}/,
+	/sk-[A-Za-z0-9]{20,}/,
+	/gh[pousr]_[A-Za-z0-9_]{20,}/,
+];
+
+export interface SnapshotDiffSummary {
+	changed: number;
+	added: number;
+	removed: number;
+	identical: boolean;
+}
+
+export function diffSummary(local: Snapshot, remote: Snapshot): SnapshotDiffSummary {
+	const localMap = fileHashMap(local);
+	const remoteMap = fileHashMap(remote);
+	const paths = [...new Set([...localMap.keys(), ...remoteMap.keys()])];
+	let added = 0;
+	let removed = 0;
+	let changed = 0;
+	for (const filePath of paths) {
+		if (!localMap.has(filePath)) added += 1;
+		else if (!remoteMap.has(filePath)) removed += 1;
+		else if (localMap.get(filePath) !== remoteMap.get(filePath)) changed += 1;
+	}
+	return { changed, added, removed, identical: added === 0 && removed === 0 && changed === 0 };
+}
+
+/** Content-level diff of local vs remote with JSON pretty-print, masking, and bounds. */
+export function formatSnapshotDiff(local: Snapshot, remote: Snapshot): string {
+	const localMap = fileHashMap(local);
+	const remoteMap = fileHashMap(remote);
+	const allPaths = [...new Set([...localMap.keys(), ...remoteMap.keys()])].sort();
+	const lines = [
+		`local: ${local.files.length} files`,
+		`remote: ${remote.createdAt} (${remote.files.length} files)`,
+		"",
+	];
+	let totalChanges = 0;
+	let hunkBudget = MAX_TOTAL_HUNK_LINES;
+	let truncated = false;
+	const appendHunks = (hunks: string[]) => {
+		if (hunks.length === 0) return;
+		lines.push(...hunks.map((line) => `  ${line}`));
+		hunkBudget -= hunks.length;
+		if (hunks.at(-1) === TRUNCATED_MARKER) truncated = true;
+	};
+	for (const filePath of allPaths) {
+		if (!localMap.has(filePath)) {
+			lines.push(`Remote only: ${filePath}`);
+			totalChanges += 1;
+			if (hunkBudget <= 0) truncated = true;
+			else appendHunks(contentHunks("", fileText(remote, filePath), hunkBudget));
+		} else if (!remoteMap.has(filePath)) {
+			lines.push(`Local only: ${filePath}`);
+			totalChanges += 1;
+			if (hunkBudget <= 0) truncated = true;
+			else appendHunks(contentHunks("", fileText(local, filePath), hunkBudget));
+		} else if (localMap.get(filePath) !== remoteMap.get(filePath)) {
+			lines.push(`Different: ${filePath}`);
+			totalChanges += 1;
+			if (hunkBudget <= 0) truncated = true;
+			else {
+				const texts = diffTexts(fileText(remote, filePath), fileText(local, filePath));
+				appendHunks(contentHunks(texts.before, texts.after, hunkBudget));
+			}
+		}
+	}
+	if (totalChanges === 0) lines.push("No file differences.");
+	else if (truncated) lines.push("(content hunks truncated; all changed paths are listed)");
+	return lines.join("\n");
+}
+
+function fileText(snapshot: Snapshot, filePath: string): string {
+	return snapshotFileContent(snapshot, filePath) ?? "";
+}
+
+function diffTexts(before: string | undefined, after: string | undefined) {
+	const beforePretty = before !== undefined ? prettyJson(before) : undefined;
+	const afterPretty = after !== undefined ? prettyJson(after) : undefined;
+	if (beforePretty !== undefined || afterPretty !== undefined) {
+		return { before: beforePretty ?? "", after: afterPretty ?? "" };
+	}
+	return { before: before ?? "", after: after ?? "" };
+}
+
+function prettyJson(text: string): string | undefined {
+	try {
+		return JSON.stringify(JSON.parse(text), null, 2);
+	} catch {
+		return undefined;
+	}
+}
+
+function contentHunks(before: string, after: string, maxLines: number): string[] {
+	if (before === after) return [];
+	if (maxLines <= 0) return [];
+	if (before.length > MAX_HUNK_FILE_BYTES || after.length > MAX_HUNK_FILE_BYTES) return [];
+	const patch = createTwoFilesPatch("", "", before, after, "", "", {
+		context: HUNK_CONTEXT_LINES,
+	});
+	const lines: string[] = [];
+	let inHunks = false;
+	for (const line of patch.split("\n")) {
+		if (!inHunks) {
+			if (line.startsWith("@@")) inHunks = true;
+			else continue;
+		}
+		if (line === "" || line === "\") continue;
+		if (lines.length >= maxLines) {
+			lines[maxLines - 1] = TRUNCATED_MARKER;
+			break;
+		}
+		lines.push(sanitizeHunkLine(line));
+	}
+	return lines;
+}
+
+function sanitizeHunkLine(line: string): string {
+	const prefix =
+		line.startsWith("+") || line.startsWith("-") || line.startsWith(" ") ? line[0] : "";
+	const content = prefix ? line.slice(1) : line;
+	return `${prefix}${safeTerminalText(maskSecrets(content))}`;
+}
+
+function maskSecrets(text: string): string {
+	let masked = text;
+	for (const pattern of SECRET_PATTERNS) {
+		masked = masked.replace(new RegExp(pattern.source, "giu"), (match) => {
+			const separator = match.search(/[=:]/u);
+			if (separator >= 0 && separator < match.length - 1) {
+				return `${match.slice(0, separator + 1)}${SECRET_MASK}`;
+			}
+			return SECRET_MASK;
+		});
+	}
+	return masked;
+}
+
+function safeTerminalText(value: string): string {
+	// biome-ignore lint/suspicious/noControlCharactersInRegex: Escape untrusted terminal controls.
+	return value.replace(/[\u0000-\u001f\u007f-\u009f]/gu, "?");
+}