@lyupro/codex-bridge 0.6.8 → 0.6.10

package/src/home/lib/runner/flag-scan.mjs

@@ -0,0 +1,165 @@
+/**
+ * Judges added lines against start bytes because Plan_60 D3a must not blame earlier dirty work or TODO test data.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { readFlagBaseline, removeFlagBaselineCopies, FLAG_BASELINE_DIR } from './flag-baseline.mjs';
+import { runSnapshotChanges } from '../meta/run-snapshots.mjs';
+
+const STUB = /test\.(skip|only)|it\.(skip|only)|describe\.(skip|only)|NotImplemented/;
+const MARKER_PREFIX = /(?:^[ \t]*|\/\/[ \t]*|\/\*+[ \t]*|#[ \t]*|<!--[ \t]*|--[ \t]*|^[ \t]*\*[ \t]*)$/;
+const LIST_PREFIX = /^[ \t]*(?:[-+*]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?$/;
+
+export function isFlagLine(text) {
+  if (STUB.test(text)) return true;
+  for (const match of text.matchAll(/(?:TODO|FIXME)(?![A-Za-z0-9_])/g)) {
+    const prefix = text.slice(0, match.index);
+    if (MARKER_PREFIX.test(prefix) || LIST_PREFIX.test(prefix)) return true;
+  }
+  return false;
+}
+
+function addedLines(diff) {
+  const added = [];
+  let inside = false;
+  let number = 0;
+  for (const line of diff.split('\n')) {
+    if (line.startsWith('diff ')) {
+      inside = false;
+      continue;
+    }
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      inside = true;
+      number = Number(hunk[1]);
+    } else if (inside && line.startsWith('+')) {
+      added.push({ number, text: line.slice(1) });
+      number += 1;
+    } else if (inside && line.startsWith(' ')) {
+      number += 1;
+    }
+  }
+  return added;
+}
+
+function compareFile(baseFile, currentFile) {
+  const result = spawnSync('git', [
+    '-c', 'core.quotepath=false', 'diff', '--no-index', '--no-color', '--no-ext-diff', '--no-textconv',
+    '--ignore-cr-at-eol', '--diff-algorithm=myers', '-U0', '--', baseFile, currentFile,
+  ], { windowsHide: true, timeout: 30_000, maxBuffer: 8 * 1024 * 1024 });
+  if (result.error || ![0, 1].includes(result.status)) return null;
+  return result.status === 0 ? [] : addedLines(result.stdout.toString('utf8'));
+}
+
+// `git show <head>:<path>` exits non-zero both for a path the start commit lacks (a new file: every line is added)
+// and for a start commit nobody can read; only a readable commit lets the first case accuse anyone.
+function headReadable(repoRoot, head) {
+  const result = spawnSync('git', ['-C', repoRoot, 'cat-file', '-e', `${head}^{commit}`], {
+    windowsHide: true, timeout: 30_000,
+  });
+  return !result.error && result.status === 0;
+}
+
+function scanPath({ name, entry, baseline, headKnown, runDir, repoRoot, gaps }) {
+  const currentFile = path.join(repoRoot, name);
+  let current;
+  try {
+    const stat = fs.lstatSync(currentFile);
+    if (!stat.isFile()) return [];
+    if (stat.size > baseline.limits.perFileBytes) {
+      gaps.push(`${name}: end content over the limit`);
+      return [];
+    }
+    current = fs.readFileSync(currentFile);
+  } catch (error) {
+    if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') gaps.push(`${name}: end content unreadable`);
+    return [];
+  }
+  if (current.length > baseline.limits.perFileBytes) {
+    gaps.push(`${name}: end content over the limit`);
+    return [];
+  }
+  if (current.subarray(0, 8000).includes(0)) return [];
+
+  let base = Buffer.alloc(0);
+  let baseFile;
+  let temporary = false;
+  if (entry) {
+    if (entry.state === 'copied') {
+      baseFile = path.join(runDir, FLAG_BASELINE_DIR, entry.copy);
+      try {
+        base = fs.readFileSync(baseFile);
+      } catch {
+        gaps.push(`${name}: start content unreadable`);
+        return [];
+      }
+    } else if (!['deleted', 'absent'].includes(entry.state)) {
+      gaps.push(`${name}: start content ${entry.state}`);
+      return [];
+    }
+  } else if (!headKnown) {
+    gaps.push(`${name}: start commit unreadable`);
+    return [];
+  } else {
+    const result = spawnSync('git', ['-C', repoRoot, 'show', `${baseline.head}:${name}`], {
+      windowsHide: true, timeout: 30_000, maxBuffer: 8 * 1024 * 1024,
+    });
+    if (result.error || result.status === null) {
+      gaps.push(`${name}: start content unreadable`);
+      return [];
+    }
+    if (result.status === 0) base = result.stdout;
+    if (base.length) {
+      const copyDir = path.join(runDir, FLAG_BASELINE_DIR);
+      fs.mkdirSync(copyDir, { recursive: true });
+      baseFile = path.join(copyDir, `head-${randomUUID()}.bin`);
+      fs.writeFileSync(baseFile, base, { flag: 'wx' });
+      temporary = true;
+    }
+  }
+
+  if (!base.length) {
+    return current.toString('utf8').split('\n').map((text, index) => ({ number: index + 1, text }));
+  }
+  let added;
+  try {
+    added = compareFile(baseFile, currentFile);
+  } finally {
+    if (temporary) fs.unlinkSync(baseFile);
+  }
+  if (added === null) {
+    gaps.push(`${name}: diff failed`);
+    return [];
+  }
+  return added;
+}
+
+export function scanRunFlags({ runDir, repoRoot }) {
+  const gaps = [];
+  const hits = [];
+  try {
+    const baseline = readFlagBaseline(runDir);
+    if (!baseline) {
+      gaps.push('no flag baseline');
+    } else if (!baseline.complete && baseline.files.length === 0) {
+      gaps.push(`flag baseline incomplete: ${baseline.reason}`);
+    } else {
+      const entries = new Map(baseline.files.map((entry) => [entry.path, entry]));
+      const comparison = runSnapshotChanges(runDir);
+      if (!comparison.ok) gaps.push('snapshots not comparable');
+      const names = [...new Set([...entries.keys(), ...(comparison.ok ? comparison.changed : [])])].sort();
+      const headKnown = headReadable(repoRoot, baseline.head);
+      for (const name of names) {
+        const added = scanPath({ name, entry: entries.get(name), baseline, headKnown, runDir, repoRoot, gaps });
+        for (const line of added) {
+          if (hits.length < 20 && isFlagLine(line.text)) hits.push(`${name}:${line.number}: ${line.text.trim()}\n`);
+        }
+      }
+    }
+  } finally {
+    removeFlagBaselineCopies(runDir);
+  }
+  return { text: hits.join(''), coverage: { complete: gaps.length === 0, gaps } };
+}

package/src/home/lib/runner/git-paths.mjs

@@ -0,0 +1,74 @@
+/**
+ * One responsibility: every git call that lists repository paths runs here with `-z` and returns exact names.
+ * On 2026-09-30, quoted octal escapes for areas/tickets-и-notifier.md made scope preflight
+ * refuse both its literal path and an ASCII glob, blocking a vault with Cyrillic file names.
+ */
+import { spawnSync } from 'node:child_process';
+
+function pathRecords(repoRoot, args) {
+  const result = spawnSync(
+    'git',
+    ['-C', repoRoot, ...args],
+    { windowsHide: true, maxBuffer: 64 * 1024 * 1024 },
+  );
+  if (result.error || result.status !== 0) return null;
+
+  let output;
+  try {
+    // A leading BOM can be part of the first name, so decoding must preserve it too.
+    output = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(result.stdout);
+  } catch (cause) {
+    const error = new Error(`Repository ${repoRoot} contains a file name that is not UTF-8`, { cause });
+    error.code = 'ERR_GIT_PATH_NOT_UTF8';
+    throw error;
+  }
+  const names = output.split('\0');
+  if (names.at(-1) === '') names.pop();
+  return names;
+}
+
+export function listRepositoryPaths(repoRoot) {
+  return pathRecords(repoRoot, ['ls-files', '-z', '--cached', '--others', '--exclude-standard']);
+}
+
+export function listUntrackedPaths(repoRoot) {
+  return pathRecords(repoRoot, ['ls-files', '-z', '-o', '--exclude-standard']);
+}
+
+export function numstatRows(repoRoot) {
+  const records = pathRecords(repoRoot, ['diff', 'HEAD', '--numstat', '--no-renames', '-z']);
+  if (records === null) return null;
+  return records.map((record) => {
+    const firstTab = record.indexOf('\t');
+    const secondTab = record.indexOf('\t', firstTab + 1);
+    return {
+      added: record.slice(0, firstTab),
+      deleted: record.slice(firstTab + 1, secondTab),
+      path: record.slice(secondTab + 1),
+    };
+  });
+}
+
+// The owner spells each command whole: a caller that composes path-listing arguments itself is what
+// tests/git-path-listing-guard.test.mjs exists to catch.
+export function diffNames(repoRoot, range) {
+  return pathRecords(repoRoot, ['diff', '--name-only', '-z', range]);
+}
+
+export function commitNames(repoRoot, sha) {
+  return pathRecords(repoRoot, ['show', '--name-only', '--format=', '-z', sha]);
+}
+
+export function porcelainPaths(repoRoot) {
+  const records = pathRecords(repoRoot, ['status', '--porcelain', '-z']);
+  if (records === null) return null;
+  const names = new Set();
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    names.add(record.slice(3));
+    if (record[0] === 'R' || record[1] === 'R' || record[0] === 'C' || record[1] === 'C') {
+      names.add(records[++index]);
+    }
+  }
+  return [...names];
+}

package/src/home/lib/runner/git-state.mjs

@@ -10,7 +10,10 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { runsRoot } from './runs-root.mjs';
+import { commitNames, diffNames, listUntrackedPaths, numstatRows, porcelainPaths } from './git-paths.mjs';
+import { encodeSnapshot } from '../meta/snapshot-format.mjs';
 
 export const MAX_LOG = 256 * 1024 * 1024;
 
@@ -32,38 +35,48 @@ export function runsPrefixInside(repo) {
 
 /**
  * State of the worktree in terms of actual content, not porcelain letters: line counts
- * per tracked file plus sizes of untracked ones. A porcelain code stays ` M` when Codex
+ * per tracked file plus content hashes of untracked ones. A porcelain code stays ` M` when Codex
  * edits an already-modified file, so comparing codes would report "0 files changed" for
  * a run that did real work.
  */
 export function worktreeSnapshot(repo) {
   const skip = runsPrefixInside(repo);
-  // The path is the third tab-separated field in both git outputs used here.
-  const mine = (line) => Boolean(skip) && (line.split('\t')[2] || '').startsWith(skip);
   // `--no-renames` because every reader of this snapshot compares paths against a scope: with
   // rename detection on, numstat prints one row spelled `old => new` (or `dir/{a => b}/file`),
   // which is not a path and matches no pattern — an in-scope rename would be judged a stray, and
   // the witness named that token at the orchestrator on 2026-09-20. Without it a rename is a
   // deletion plus an addition: two rows, both real paths, both judged on their own merits.
-  const tracked = (git(repo, ['diff', 'HEAD', '--numstat', '--no-renames']).stdout || '')
-    .split(/\r?\n/)
-    .filter((line) => line.trim() && !mine(line))
-    .join('\n')
-    .trim();
-  const untracked = (git(repo, ['ls-files', '-o', '--exclude-standard']).stdout || '')
-    .split(/\r?\n/)
-    .filter(Boolean)
+  // Plan_73 D4 preserves the existing git-failure meaning: no rows from that listing.
+  const tracked = (numstatRows(repo) ?? [])
+    .filter((row) => !(skip && row.path.startsWith(skip)))
+    .map((row) => ({ path: row.path, state: `${row.added}\t${row.deleted}` }));
+  const untracked = (listUntrackedPaths(repo) ?? [])
     .filter((file) => !(skip && `${file}/`.startsWith(skip)))
-    .map((file) => {
-      let bytes = 0;
-      try {
-        bytes = fs.statSync(path.join(repo, file)).size;
-      } catch {
-        // Vanished between listing and stat: size 0 still marks it as present.
-      }
-      return `U\t${bytes}\t${file}`;
-    });
-  return [tracked, untracked.join('\n')].filter(Boolean).join('\n');
+    .map((file) => ({ path: file, state: untrackedState(path.join(repo, file)) }));
+  return encodeSnapshot([...tracked, ...untracked]);
+}
+
+/**
+ * Size plus sha256 of an untracked file, read in chunks so a large one does not have to fit in
+ * memory. A file that vanished after listing is `missing`; one that cannot be read (on Windows a
+ * file held by another process) is `unreadable` rather than an exception that stops the run.
+ */
+function untrackedState(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+    const hash = createHash('sha256');
+    const chunk = Buffer.alloc(1024 * 1024);
+    let bytes = 0;
+    for (let read; (read = fs.readSync(fd, chunk, 0, chunk.length, null)) > 0; bytes += read) {
+      hash.update(chunk.subarray(0, read));
+    }
+    return `U\t${bytes}:${hash.digest('hex')}`;
+  } catch (error) {
+    return error.code === 'ENOENT' ? 'U\tmissing' : 'U\tunreadable';
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
 }
 
 /**
@@ -81,41 +94,6 @@ export const headSha = (repo) => (git(repo, ['rev-parse', 'HEAD']).stdout || '')
 export const branchName = (repo) =>
   (git(repo, ['symbolic-ref', '--short', '-q', 'HEAD']).stdout || '').trim();
 
-const FAKE_DONE_RE =
-  /TODO|FIXME|test\.(skip|only)|it\.(skip|only)|describe\.(skip|only)|NotImplemented/;
-
-/**
- * Traces of fake completion. `git diff` carries nothing for untracked files, so a brand
- * new file full of TODOs would otherwise pass as "Flags: none" — the one case the check
- * exists for.
- */
-export function findFakeDone(repo) {
-  const skip = runsPrefixInside(repo);
-  const hits = (git(repo, ['diff', '-U0']).stdout || '')
-    .split(/\r?\n/)
-    .filter((l) => l.startsWith('+') && FAKE_DONE_RE.test(l));
-  for (const file of (git(repo, ['ls-files', '-o', '--exclude-standard']).stdout || '')
-    .split(/\r?\n/)
-    .filter(Boolean)
-    // Same reason as in worktreeSnapshot: inside ~/.claude the run folder is part of the
-    // worktree, and task.md spells out the very words this scans for ("do not leave TODOs,
-    // test.skip"). A run flagged itself for quoting its own instructions.
-    .filter((file) => !(skip && `${file}/`.startsWith(skip)))) {
-    const full = path.join(repo, file);
-    try {
-      if (fs.statSync(full).size > 1024 * 1024) continue;
-      fs.readFileSync(full, 'utf8')
-        .split(/\r?\n/)
-        .forEach((l, i) => {
-          if (FAKE_DONE_RE.test(l)) hits.push(`${file}:${i + 1}: ${l.trim()}`);
-        });
-    } catch {
-      // Binary or unreadable: nothing to flag.
-    }
-  }
-  return hits.length ? `${hits.slice(0, 20).join('\n')}\n` : '';
-}
-
 /** What exactly is under review, resolved from git rather than from wording. */
 export function reviewScope(repo, changeset) {
   if (changeset.startsWith('base:')) {
@@ -123,9 +101,7 @@ export function reviewScope(repo, changeset) {
     return {
       label: `branch changes against base ${base}`,
       diffCommand: `git diff ${base}...HEAD`,
-      files: (git(repo, ['diff', '--name-only', `${base}...HEAD`]).stdout || '')
-        .split(/\r?\n/)
-        .filter(Boolean),
+      files: diffNames(repo, `${base}...HEAD`) ?? [],
     };
   }
   if (changeset.startsWith('commit:')) {
@@ -133,17 +109,12 @@ export function reviewScope(repo, changeset) {
     return {
       label: `commit ${sha}`,
       diffCommand: `git show ${sha}`,
-      files: (git(repo, ['show', '--name-only', '--format=', sha]).stdout || '')
-        .split(/\r?\n/)
-        .filter(Boolean),
+      files: commitNames(repo, sha) ?? [],
     };
   }
   return {
     label: 'uncommitted changes (staged, unstaged, untracked)',
     diffCommand: 'git status --porcelain && git diff HEAD',
-    files: (git(repo, ['status', '--porcelain']).stdout || '')
-      .split(/\r?\n/)
-      .filter(Boolean)
-      .map((l) => l.slice(3).trim()),
+    files: porcelainPaths(repo) ?? [],
   };
 }