@mmerterden/multi-agent-pipeline 20.27.2 → 20.29.0

package/pipeline/scripts/_handle-patterns.mjs

@@ -0,0 +1,166 @@
+/**
+ * @file _handle-patterns.mjs  -  what an automation handle looks like, per platform.
+ *
+ * A handle is the stable identifier a UI test finds an element by: an iOS
+ * `accessibilityIdentifier`, a Compose `testTag` (or `testTagsAsResourceId` in
+ * a semantics block), a web `data-testid`. Each file is judged only by its own
+ * platform's pattern, chosen from the extension, so a Swift string that
+ * happens to contain "data-testid" is not an iOS handle and a Flutter `Key`
+ * is not one at all.
+ *
+ * Shared by handle-diff-audit.mjs (did the diff add only handles) and
+ * test-gen-gate.mjs (did the handle stage add any).
+ *
+ * @module pipeline/scripts/_handle-patterns
+ */
+
+import { parseUnifiedDiff } from "./_unified-diff.mjs";
+
+export { parseUnifiedDiff };
+
+const STR = String.raw`"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'`;
+const REF = String.raw`[A-Za-z_$][\w$.]*(?:\([^()]*\))?`;
+
+/**
+ * `handle` decides whether a line carries a handle; `strip` removes the handle
+ * construct so what is left can be compared with the removed lines.
+ */
+export const PLATFORMS = Object.freeze({
+  ios: {
+    ext: /\.(swift|m|mm)$/i,
+    handle: /\baccessibilityIdentifier\b/,
+    strip: [
+      new RegExp(String.raw`\.accessibilityIdentifier\(\s*(?:${STR}|${REF})\s*\)`, "g"),
+      new RegExp(
+        String.raw`(?:\b[\w$.]*\.)?accessibilityIdentifier\s*=\s*(?:${STR}|${REF})\s*;?`,
+        "g",
+      ),
+    ],
+  },
+  compose: {
+    ext: /\.kts?$/i,
+    handle: /\btestTag\b|\btestTagsAsResourceId\b/,
+    strip: [
+      new RegExp(
+        String.raw`(?:\bmodifier\s*=\s*)?\bModifier\s*\.\s*testTag\(\s*(?:${STR}|${REF})\s*\)\s*,?`,
+        "g",
+      ),
+      new RegExp(String.raw`\.testTag\(\s*(?:${STR}|${REF})\s*\)`, "g"),
+      new RegExp(
+        String.raw`\.semantics\s*(?:\([^()]*\))?\s*\{\s*(?:testTag\s*=\s*(?:${STR}|${REF})|testTagsAsResourceId\s*=\s*true)\s*\}`,
+        "g",
+      ),
+      new RegExp(String.raw`\btestTag\s*=\s*(?:${STR}|${REF})`, "g"),
+      /\btestTagsAsResourceId\s*=\s*true/g,
+    ],
+  },
+  web: {
+    ext: /\.(html?|vue|svelte|astro|[cm]?[jt]sx?)$/i,
+    handle: /\bdata-testid\b/,
+    strip: [
+      new RegExp(String.raw`:?\bdata-testid\s*=\s*(?:${STR}|\{[^{}]*\})`, "g"),
+      new RegExp(String.raw`(["'])data-testid\1\s*:\s*(?:${STR}|${REF})\s*,?`, "g"),
+    ],
+  },
+});
+
+const TEST_PATH =
+  /(^|\/)(tests?|__tests__|e2e|specs?|androidTest|[\w-]*UITests?)\/|\.(test|spec)\.[cm]?[jt]sx?$|Tests?\.(swift|kt)$/;
+const SNAPSHOT_PATH = /(^|\/)__snapshots__\/|\.snap$/;
+
+/** @param {string} path @returns {"ios"|"compose"|"web"|null} */
+export function platformOf(path) {
+  for (const [id, p] of Object.entries(PLATFORMS)) if (p.ext.test(path)) return id;
+  return null;
+}
+
+/** @param {string} path */
+export function isTestPath(path) {
+  return TEST_PATH.test(path);
+}
+
+/** @param {string} path */
+export function isSnapshotPath(path) {
+  return SNAPSHOT_PATH.test(path);
+}
+
+/** Does this line of this file carry a handle, by that file's own platform? */
+export function isHandleLine(path, line) {
+  const id = platformOf(path);
+  return id !== null && PLATFORMS[id].handle.test(line);
+}
+
+/** The line with its handle constructs removed. */
+export function stripHandles(path, line) {
+  const id = platformOf(path);
+  if (id === null) return line;
+  return PLATFORMS[id].strip.reduce((s, re) => s.replace(re, " "), line);
+}
+
+/**
+ * The code a line carries, as an ordered token list: string literals whole,
+ * identifiers, numbers, multi-character operators and every other punctuation
+ * character. Whitespace and line breaks are dropped, so re-wrapping a tag over
+ * several lines or moving a modifier onto its own line changes nothing, while
+ * a flipped comparison, a dropped `!` or swapped arguments do. A comma left
+ * dangling before a closing bracket by a stripped handle is dropped too.
+ *
+ * @param {string} text
+ * @returns {string[]}
+ */
+export function codeTokens(text) {
+  const out =
+    String(text).match(
+      /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`|[A-Za-z_$][\w$]*|\d[\w.]*|===|!==|==|!=|<=|>=|&&|\|\||\?\?|\?\.|->|=>|::|\.\.\.|\.\.<|\S/g,
+    ) || [];
+  return out.filter((t, i) => !(t === "," && /^[)\]}>]$/.test(out[i + 1] || "")));
+}
+
+const STR_LIT = String.raw`(?:"(?:[^"\\$]|\\.)*"|'(?:[^'\\$]|\\.)*'|` + "`[^`$]*`)";
+const IDENTIFIER_FILE_LINE = [
+  /^$/,
+  /^(\/\/|\/\*|\*|#|<!--)/,
+  /^(import|package)\s/,
+  /^@file:/,
+  /^(?:(?:public|internal|private|fileprivate|export|default)\s+)*(?:enum|struct|object|class|extension|namespace)\s+[\w.]+(?:\s*:\s*[\w., ]+)?\s*\{?$/,
+  /^(?:export\s+)?(?:const|let|var|val)\s+\w+(?:\s*:\s*[\w.<>? ]+)?\s*=\s*\{$/,
+  new RegExp(
+    String.raw`^(?:(?:public|internal|private|fileprivate|export)\s+)*(?:static\s+)?(?:let|var|const\s+val|val|const)\s+\w+(?:\s*:\s*\w+)?\s*=\s*${STR_LIT}\s*[;,]?$`,
+  ),
+  new RegExp(String.raw`^case\s+\w+(?:\s*=\s*${STR_LIT})?$`),
+  new RegExp(String.raw`^(?:\w+|${STR_LIT})\s*:\s*${STR_LIT}\s*,?$`),
+  /^[}\])]+(?:\s*as\s+const)?\s*[;,]?$/,
+];
+
+/**
+ * Does a new file hold handle constants and nothing else? Declarations of
+ * string constants, the enums or objects that group them, imports, comments
+ * and closing brackets. A function, a computed value or an interpolated
+ * string is behaviour, whatever the file is called.
+ *
+ * @param {string[]} lines
+ */
+export function isHandleConstantsFile(lines) {
+  return lines.every((l) => IDENTIFIER_FILE_LINE.some((re) => re.test(l.trim())));
+}
+
+/**
+ * Added handle lines in a diff, product files only: a selector string in a
+ * test file names a handle, it does not add one.
+ *
+ * @param {string} text
+ * @returns {{total: number, byFile: Record<string, number>}}
+ */
+export function countAddedHandles(text) {
+  const byFile = {};
+  let total = 0;
+  for (const [file, f] of parseUnifiedDiff(text)) {
+    if (isTestPath(file) || isSnapshotPath(file)) continue;
+    const n = f.added.filter((l) => isHandleLine(file, l)).length;
+    if (n > 0) {
+      byFile[file] = n;
+      total += n;
+    }
+  }
+  return { total, byFile };
+}

package/pipeline/scripts/_http-post.mjs

@@ -0,0 +1,141 @@
+// _http-post.mjs - POST a JSON body, falling back to curl when Node's fetch
+// cannot reach the host at all.
+//
+// Node's built-in fetch ignores HTTPS_PROXY and trusts only its bundled CA
+// list, so behind a corporate proxy or a TLS-inspecting gateway it fails with
+// ECONNREFUSED, ENOTFOUND or SELF_SIGNED_CERT_IN_CHAIN while gh, git and curl on
+// the same machine work. curl honours the proxy variables and the system trust
+// store, so a transport failure (never an HTTP status) is retried through it.
+//
+// Secret headers never reach argv: curl reads them from a 0600 file that is
+// removed before this returns. Redirects are never followed by either path.
+
+import { spawn as spawnChild } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+/** The low-level reason a fetch failed, e.g. ECONNREFUSED or SELF_SIGNED_CERT_IN_CHAIN. */
+export function failureCode(err, aborted = false) {
+  if (aborted) return "timeout";
+  return String(err?.cause?.code ?? err?.code ?? err?.name ?? "error").slice(0, 40);
+}
+
+function run(spawn, cmd, args, input, timeoutMs) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let child;
+    try {
+      child = spawn(cmd, args, { stdio: ["pipe", "pipe", "ignore"] });
+    } catch (error) {
+      resolve({ error });
+      return;
+    }
+    const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+    child.stdout.on("data", (c) => (stdout += c));
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve({ error });
+    });
+    child.on("close", (status) => {
+      clearTimeout(timer);
+      resolve({ status, stdout });
+    });
+    child.stdin.end(input);
+  });
+}
+
+/**
+ * One POST through curl. Returns { status, body, location, transport: "curl" }
+ * or { failure, transport: "curl" } when curl is missing or cannot connect.
+ */
+export async function curlPost({ url, headers = {}, body, timeoutMs, spawn = spawnChild }) {
+  const dir = mkdtempSync(join(tmpdir(), "ma-http-"));
+  const headerFile = join(dir, "headers");
+  try {
+    const lines = Object.entries(headers).map(([k, v]) => `${k}: ${v}`);
+    writeFileSync(headerFile, lines.join("\n") + "\n", { mode: 0o600 });
+    const seconds = String(Math.max(1, Math.ceil(timeoutMs / 1000)));
+    const r = await run(
+      spawn,
+      "curl",
+      [
+        "-sS",
+        "--max-time",
+        seconds,
+        "-X",
+        "POST",
+        "-H",
+        `@${headerFile}`,
+        "--data-binary",
+        "@-",
+        "-w",
+        "\n%{http_code} %{redirect_url}",
+        url,
+      ],
+      body,
+      timeoutMs + 2000,
+    );
+    if (r.error) return { failure: failureCode(r.error), transport: "curl" };
+    if (r.status !== 0) {
+      return { failure: `curl-exit-${r.status}`, transport: "curl" };
+    }
+    const out = String(r.stdout ?? "");
+    const cut = out.lastIndexOf("\n");
+    const [code, location = ""] = out.slice(cut + 1).split(" ");
+    return {
+      status: Number(code) || 0,
+      body: out.slice(0, cut),
+      location: location || null,
+      transport: "curl",
+    };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * fetch first; on a transport failure, curl. Returns { status, body, location,
+ * transport } on any HTTP answer, or { failure, fetchFailure, transport } when
+ * neither path reached the host. `fetchFailure` keeps the original cause.
+ */
+export async function postJson({
+  url,
+  headers = {},
+  body,
+  timeoutMs,
+  fetchImpl = fetch,
+  curl = curlPost,
+}) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  let fetchFailure;
+  try {
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...headers },
+      body,
+      redirect: "manual",
+      signal: ctrl.signal,
+    });
+    const text = await res.text().catch(() => "");
+    return {
+      status: res.status,
+      body: text,
+      location: res.headers.get("location"),
+      transport: "fetch",
+    };
+  } catch (err) {
+    fetchFailure = failureCode(err, ctrl.signal.aborted);
+  } finally {
+    clearTimeout(timer);
+  }
+  const viaCurl = await curl({
+    url,
+    headers: { "Content-Type": "application/json", ...headers },
+    body,
+    timeoutMs,
+  });
+  if (viaCurl.failure) return { failure: viaCurl.failure, fetchFailure, transport: "curl" };
+  return { ...viaCurl, fetchFailure };
+}

package/pipeline/scripts/_stack-routing.mjs

@@ -31,6 +31,10 @@ export const COMMON_SKILLS = [
   "security-review",
   "valven-rules",
   "e2e-testing",
+  "scenario-gap-analysis",
+  "test-result-triage",
+  "handle-request",
+  "fix-review-verdicts",
 ];
 
 // The analyst plugin is the second always-enabled toolkit. It carries outside

package/pipeline/scripts/_test-gaming.mjs

@@ -0,0 +1,227 @@
+/**
+ * @file _test-gaming.mjs  -  added lines that make a suite green without fixing the code.
+ *
+ * Three shapes, read from the added lines of a unified diff:
+ *
+ *   environment-branch  product code that asks whether it is under test
+ *                       (`navigator.webdriver`, `process.env.CI`, ProcessInfo
+ *                       and XCTest, `isRunningTests`, a test-harness check) and
+ *                       does something else when it is. The test then measures
+ *                       a path users never take. Blocking. Test files are
+ *                       exempt: a test asking about its own runner is normal.
+ *   swallowed-error     an empty catch, `.catch(() => {})`, `except: pass`, a
+ *                       statement-level Swift `try?`, a Kotlin `runCatching`
+ *                       whose failure nothing reads. The failure the test
+ *                       should have seen is discarded. One finding per
+ *                       occurrence.
+ *   inflated-timeout    a timeout raised to at least twice the removed value
+ *                       it replaces (the nearest removed timeout in the same
+ *                       hunk), or a new wait of 30s or more in a test file. A
+ *                       slow or racy path is waited out instead of fixed.
+ *                       Units follow the language: JavaScript and TypeScript
+ *                       timeouts are milliseconds, Swift and Python seconds,
+ *                       Kotlin and Java milliseconds; a Ms / Millis / Seconds
+ *                       suffix overrides.
+ *
+ * Only source files are read, and comment lines are skipped. Configuration
+ * (`*.config.*`, CI workflows, YAML) and documentation are out of scope:
+ * `retries: process.env.CI ? 2 : 0` in a Playwright config tunes the runner,
+ * it does not change what the product does.
+ *
+ * A grep finds the obvious forms only; the Phase 3 reviewers judge the rest
+ * under the same name. Every finding is reviewer-shaped (`test_integrity`
+ * tag, `test_gaming` signal) so triage adjudicates it like the other
+ * test-integrity findings.
+ *
+ * @module pipeline/scripts/_test-gaming
+ */
+
+import { isTestPath } from "./_handle-patterns.mjs";
+import { parseUnifiedDiff } from "./_unified-diff.mjs";
+
+const SOURCE = /\.(swift|m|mm|kt|kts|java|[cm]?[jt]sx?|vue|svelte|py|go|rb|dart|cs)$/i;
+const CONFIG = /(^|\/)[^/]*\.config\.[^/]+$|(^|\/)\.github\//;
+const COMMENT = /^\s*(\/\/|\/\*|\*|#|<!--|--)/;
+
+const ENV_BRANCH = [
+  /\bnavigator\s*\.\s*webdriver\b/,
+  /\bprocess\.env(?:\.CI\b|\[\s*["']CI["']\s*\])/,
+  /\bprocess\.env(?:\.|\[\s*["'])(?:JEST_WORKER_ID|VITEST|CYPRESS|PLAYWRIGHT\w*)\b/,
+  /\bwindow\s*\.\s*(?:Cypress|__playwright\w*)\b/,
+  /\bProcessInfo\b.*\bXCTest/,
+  /\bXCTestConfigurationFilePath\b/,
+  /NSClassFromString\(\s*"XCTest/,
+  /\bisRunning(?:Unit|UI)?Tests?\b/,
+  /\bisRunningInTestHarness\b/,
+  /\bBuild\s*\.\s*FINGERPRINT\b.*robolectric/i,
+];
+
+const SWALLOWED = [
+  /\bcatch\s*(?:\([^()]*\))?\s*\{\s*\}/g,
+  /\.catch\(\s*(?:\([^()]*\)|[A-Za-z_$][\w$]*)?\s*=>\s*(?:\{\s*\}|null|undefined|void 0)\s*\)/g,
+  /\bexcept\b[^:\n]*:\s*pass\b/g,
+];
+const SWIFT_TRY = /^\s*(?:_\s*=\s*)?try\?\s/;
+const KOTLIN_RUN_CATCHING = /\brunCatching\s*\{/;
+const RESULT_READ =
+  /\.(onFailure|getOrThrow|getOrElse|getOrDefault|exceptionOrNull|fold|isFailure|isSuccess|recover)\b|=\s*runCatching|return\s+runCatching/;
+
+const LONG_TEST_WAIT_SECONDS = 30;
+const RAISE_FACTOR = 2;
+
+const TIMEOUT_VALUE = [
+  /\b(?:set|waitFor)?[Tt]imeout(Interval|Ms|Millis|Milliseconds|Seconds)?\b\s*(?:[:=]|\()\s*(\d[\d_]*(?:\.\d+)?)/g,
+  /\bsetTimeout\(\s*[^,()]+(?:\([^()]*\))?\s*,\s*()(\d[\d_]*)/g,
+  /\bwithTimeout\(\s*()(\d[\d_]*)/g,
+];
+
+/** Seconds or milliseconds for a bare timeout number, by the file's language. */
+function bareUnitIsMs(file) {
+  return /\.([cm]?[jt]sx?|vue|svelte|kt|kts|java|dart|cs)$/i.test(file);
+}
+
+/** Timeout values on a line, in seconds. */
+export function timeoutsOn(line, file = "") {
+  const out = [];
+  for (const re of TIMEOUT_VALUE) {
+    re.lastIndex = 0;
+    for (const m of line.matchAll(re)) {
+      const raw = Number(m[2].replace(/_/g, ""));
+      if (!Number.isFinite(raw)) continue;
+      const unit = m[1] || "";
+      const ms = unit === "Seconds" ? false : /^M/.test(unit) || bareUnitIsMs(file);
+      out.push(ms ? raw / 1000 : raw);
+    }
+  }
+  return out;
+}
+
+/** Runs of consecutive added lines, so a pattern may span a line break. */
+function segments(addedAt) {
+  const runs = [];
+  for (const a of addedAt) {
+    const last = runs[runs.length - 1];
+    if (last && last[last.length - 1].line + 1 === a.line) last.push(a);
+    else runs.push([a]);
+  }
+  return runs;
+}
+
+function finding(file, line, kind, severity, evidence, message) {
+  return {
+    file,
+    line,
+    severity,
+    tag: "test_integrity",
+    signal: "test_gaming",
+    kind,
+    evidence: evidence.trim().slice(0, 200),
+    message,
+  };
+}
+
+const swallowedMessage = (file, line) =>
+  `An error is caught and discarded at ${file}:${line}. Whatever the test should have seen fail is hidden; handle it or let it propagate.`;
+
+/** Swallowed errors in a run of consecutive added lines, one per occurrence. */
+function swallowedIn(file, run) {
+  const out = [];
+  const joined = run.map((a) => (COMMENT.test(a.text) ? "" : a.text)).join("\n");
+  const lineAt = (index) => run[joined.slice(0, index).split("\n").length - 1].line;
+  for (const re of SWALLOWED) {
+    re.lastIndex = 0;
+    for (const m of joined.matchAll(re)) {
+      out.push({ line: lineAt(m.index), evidence: m[0] });
+    }
+  }
+  for (const a of run) {
+    if (COMMENT.test(a.text)) continue;
+    if (/\.swift$/i.test(file) && SWIFT_TRY.test(a.text))
+      out.push({ line: a.line, evidence: a.text });
+    if (/\.kts?$/i.test(file) && KOTLIN_RUN_CATCHING.test(a.text) && !RESULT_READ.test(a.text)) {
+      out.push({ line: a.line, evidence: a.text });
+    }
+  }
+  return out
+    .sort((x, y) => x.line - y.line)
+    .map((s) =>
+      finding(
+        file,
+        s.line,
+        "swallowed-error",
+        "important",
+        s.evidence,
+        swallowedMessage(file, s.line),
+      ),
+    );
+}
+
+/** Inflated timeouts in one hunk: each added value against the nearest removed one. */
+function timeoutsIn(file, hunk, testFile) {
+  const out = [];
+  const removed = hunk.removed
+    .filter((d) => !COMMENT.test(d.text))
+    .flatMap((d) => timeoutsOn(d.text, file).map((s) => ({ line: d.line, s })));
+  hunk.added.forEach((a, i) => {
+    if (COMMENT.test(a.text)) return;
+    const values = timeoutsOn(a.text, file);
+    if (!values.length) return;
+    let near = null;
+    if (removed.length) {
+      const anchor = hunk.removed[Math.min(i, hunk.removed.length - 1)]?.line ?? a.line;
+      near = removed.reduce((best, r) =>
+        Math.abs(r.line - anchor) < Math.abs(best.line - anchor) ? r : best,
+      );
+    }
+    for (const seconds of values) {
+      const raised = near !== null && near.s > 0 && seconds >= near.s * RAISE_FACTOR;
+      const longNew = near === null && testFile && seconds >= LONG_TEST_WAIT_SECONDS;
+      if (!raised && !longNew) continue;
+      out.push(
+        finding(
+          file,
+          a.line,
+          "inflated-timeout",
+          "important",
+          a.text,
+          raised
+            ? `Timeout at ${file}:${a.line} raised from ${near.s}s to ${seconds}s. Waiting longer hides a slow or racy path; find why it is slow.`
+            : `A ${seconds}s wait was added to a test at ${file}:${a.line}. Waiting longer hides a slow or racy path; wait for a condition instead.`,
+        ),
+      );
+      break;
+    }
+  });
+  return out;
+}
+
+/**
+ * @param {string} diffText unified diff
+ * @returns {object[]} reviewer-shaped findings
+ */
+export function scanTestGaming(diffText) {
+  const findings = [];
+  for (const [file, f] of parseUnifiedDiff(diffText)) {
+    if (!SOURCE.test(file) || CONFIG.test(file)) continue;
+    const testFile = isTestPath(file);
+
+    if (!testFile) {
+      for (const { line, text } of f.addedAt) {
+        if (COMMENT.test(text) || !ENV_BRANCH.some((re) => re.test(text))) continue;
+        findings.push(
+          finding(
+            file,
+            line,
+            "environment-branch",
+            "blocking",
+            text,
+            `Product code at ${file}:${line} checks whether it runs under test. A test that passes through this branch measures a path users never take; fix the code the test exercises instead.`,
+          ),
+        );
+      }
+    }
+    for (const run of segments(f.addedAt)) findings.push(...swallowedIn(file, run));
+    for (const hunk of f.hunks) findings.push(...timeoutsIn(file, hunk, testFile));
+  }
+  return findings;
+}

package/pipeline/scripts/_unified-diff.mjs

@@ -0,0 +1,104 @@
+/**
+ * @file _unified-diff.mjs  -  a unified diff split into files, hunks and lines.
+ *
+ * Hunk bodies are read by the line counts in their `@@ -a,b +c,d @@` header,
+ * so a removed line that starts with "--" or an added line that starts with
+ * "++" is never mistaken for the next file's header.
+ *
+ * @module pipeline/scripts/_unified-diff
+ */
+
+/**
+ * @typedef {{line: number, text: string}} DiffLine
+ * @typedef {{removed: DiffLine[], added: DiffLine[]}} Hunk
+ * @typedef {{added: string[], addedAt: DiffLine[], removed: string[], removedAt: DiffLine[],
+ *            hunks: Hunk[], isNew: boolean, isDeleted: boolean, binary: boolean}} DiffFile
+ */
+
+const HUNK = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
+
+/**
+ * Split a unified diff into files. Works with any context size; -U0 is what
+ * the callers produce. Line numbers come from the hunk headers: `addedAt` in
+ * the new file, `removedAt` in the old one.
+ *
+ * @param {string} text
+ * @returns {Map<string, DiffFile>}
+ */
+export function parseUnifiedDiff(text) {
+  const files = new Map();
+  let cur = null;
+  const open = (name) => {
+    if (!files.has(name)) {
+      files.set(name, {
+        added: [],
+        addedAt: [],
+        removed: [],
+        removedAt: [],
+        hunks: [],
+        isNew: false,
+        isDeleted: false,
+        binary: false,
+      });
+    }
+    return files.get(name);
+  };
+  const lines = String(text).split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const header = /^diff --git a\/(.+?) b\/(.+)$/.exec(line);
+    if (header) {
+      cur = open(header[2]);
+      continue;
+    }
+    if (line.startsWith("+++ ") || line.startsWith("--- ")) {
+      const side = line.slice(4).replace(/\t.*$/, "");
+      if (line.startsWith("+++ ") && side !== "/dev/null") {
+        const name = side.replace(/^b\//, "");
+        if (!cur || !files.has(name)) cur = open(name);
+      }
+      if (side === "/dev/null" && cur) {
+        if (line.startsWith("--- ")) cur.isNew = true;
+        else cur.isDeleted = true;
+      }
+      continue;
+    }
+    if (!cur) continue;
+    if (line.startsWith("new file mode")) cur.isNew = true;
+    else if (line.startsWith("deleted file mode")) cur.isDeleted = true;
+    else if (line.startsWith("Binary files")) cur.binary = true;
+    const h = HUNK.exec(line);
+    if (!h) continue;
+    let oldLeft = h[2] === undefined ? 1 : Number(h[2]);
+    let newLeft = h[4] === undefined ? 1 : Number(h[4]);
+    let oldNo = Number(h[1]);
+    let newNo = Number(h[3]);
+    const hunk = { removed: [], added: [] };
+    cur.hunks.push(hunk);
+    while ((oldLeft > 0 || newLeft > 0) && i + 1 < lines.length) {
+      const body = lines[++i];
+      if (body.startsWith("\\")) continue;
+      const mark = body[0];
+      const rest = body.slice(1);
+      if (mark === "-" && oldLeft > 0) {
+        const d = { line: oldNo++, text: rest };
+        hunk.removed.push(d);
+        cur.removed.push(rest);
+        cur.removedAt.push(d);
+        oldLeft--;
+      } else if (mark === "+" && newLeft > 0) {
+        const d = { line: newNo++, text: rest };
+        hunk.added.push(d);
+        cur.added.push(rest);
+        cur.addedAt.push(d);
+        newLeft--;
+      } else {
+        oldNo++;
+        newNo++;
+        oldLeft--;
+        newLeft--;
+      }
+    }
+  }
+  return files;
+}