@narumitw/pi-sync 0.51.1 → 0.52.1

package/src/sync/conflict-preview.ts

@@ -0,0 +1,56 @@
+import type { SnapshotFile } from "../snapshot/snapshot-types.js";
+import { safeTerminalText } from "../ui/terminal-text.js";
+import type { ConflictArtifact } from "./conflict-artifacts.js";
+
+export const CONFLICT_DISPLAY_BYTES = 2 * 1024 * 1024;
+const tooLarge = () =>
+  new Error(
+    "Conflict review exceeds the 2 MiB display bound; inspect private evidence and use a reviewed explicit direction.",
+  );
+
+/** Index once and refuse a version before decoding if it cannot fit the remaining display budget. */
+export function conflictPreview(artifact: ConflictArtifact, paths: readonly string[], destination: string) {
+  const index = (files: SnapshotFile[]) => new Map(files.map((file) => [file.path, file]));
+  const ancestors = index(artifact.ancestors ?? []);
+  const local = index(artifact.local.files);
+  const remote = index(artifact.remote.files);
+  const parts: string[] = [];
+  let size = 0;
+  const remaining = () => CONFLICT_DISPLAY_BYTES - size - (parts.length ? 1 : 0);
+  const append = (value: string, prefix = "") => {
+    if (Buffer.byteLength(value) + Buffer.byteLength(prefix) > remaining()) throw tooLarge();
+    // Sanitize at the display boundary, retaining line endings and raw evidence unchanged.
+    parts.push(prefix + value.split("\n").map(safeTerminalText).join("\n"));
+    size += Buffer.byteLength(prefix) + Buffer.byteLength(value) + (parts.length > 1 ? 1 : 0);
+  };
+  const version = (files: Map<string, SnapshotFile>, filePath: string) => {
+    const file = files.get(filePath);
+    if (!file) return append("(absent)");
+    append(file.sha256, "sha256: ");
+    if (Buffer.byteLength(file.contentBase64, "base64") > remaining()) throw tooLarge();
+    const bytes = Buffer.from(file.contentBase64, "base64");
+    let value: string;
+    try {
+      value = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    } catch {
+      return append(file.contentBase64, "base64: ");
+    }
+    append(value);
+  };
+  append(safeTerminalText(destination), "Storage: ");
+  append(
+    "Private conflict versions. Historical artifact is not authority for changed bytes/head. No automatic activation.",
+  );
+  for (const filePath of paths) {
+    append(safeTerminalText(filePath), "Path: ");
+    append("Base:");
+    const hash = artifact.state.lastFileHashes[filePath];
+    if (hash && !ancestors.has(filePath)) append(`(verified ancestor unavailable; sha256: ${hash})`);
+    else version(ancestors, filePath);
+    append("Local:");
+    version(local, filePath);
+    append("Remote:");
+    version(remote, filePath);
+  }
+  return parts.join("\n");
+}

package/src/sync/conflict-resolution.ts

@@ -0,0 +1,93 @@
+import type { RemoteHead, SyncBackend } from "../backends/sync-backend.js";
+import type { AnySyncConfig } from "../settings/settings-types.js";
+import type { Snapshot } from "../snapshot/snapshot-types.js";
+import type { SyncState } from "../state/state-types.js";
+import { syncStateFingerprint } from "../state/sync-state-store.js";
+import { conflictArtifactFingerprint, readConflictArtifact } from "./conflict-artifacts.js";
+import { type FileMergePlan, mergePathIdentity, planFileMerge } from "./file-merge-planner.js";
+import { fileHashMap } from "./sync-state.js";
+export interface ConflictResolution {
+  token: string;
+  group: number;
+  source: "local" | "remote";
+  stateIdentity: string;
+  artifactIdentity: string;
+}
+export async function resolveReviewedGroup(
+  config: AnySyncConfig,
+  backend: SyncBackend,
+  state: SyncState,
+  local: Snapshot,
+  remote: Snapshot,
+  head: RemoteHead,
+  plan: FileMergePlan,
+  resolution: ConflictResolution,
+  protectedPaths: ReadonlySet<string>,
+): Promise<FileMergePlan> {
+  const artifact = await readConflictArtifact(config, backend.identity, resolution.token);
+  const group = artifact.groups[resolution.group];
+  if (
+    conflictArtifactFingerprint(artifact) !== resolution.artifactIdentity ||
+    !group ||
+    plan.kind !== "planned" ||
+    !state.unresolved?.some(
+      (item) => item.artifact === resolution.token && JSON.stringify(item.paths) === JSON.stringify(group.paths),
+    ) ||
+    syncStateFingerprint(state) !== resolution.stateIdentity ||
+    state.lastObservedSnapshot !== head.snapshotId ||
+    !state.lastObservedRevision ||
+    !backend.sameRevision(state.lastObservedRevision, head.revision)
+  )
+    throw new Error("Conflict review is stale; refresh sync and review again.");
+  const ours = fileHashMap(local);
+  const theirs = fileHashMap(remote);
+  const oldOurs = fileHashMap(artifact.local);
+  const oldTheirs = fileHashMap(artifact.remote);
+  if (
+    group.paths.some(
+      (filePath) =>
+        ours[filePath] !== oldOurs[filePath] ||
+        theirs[filePath] !== oldTheirs[filePath] ||
+        state.lastFileHashes[filePath] !== artifact.state.lastFileHashes[filePath],
+    )
+  )
+    throw new Error("Conflict versions changed; no resolution was applied.");
+  if (
+    group.paths.some((filePath) =>
+      [...protectedPaths].some((value) => mergePathIdentity(value) === mergePathIdentity(filePath)),
+    )
+  )
+    throw new Error(
+      "Current session conflict cannot be resolved from the loaded session; preserve evidence and close Pi.",
+    );
+  const selected = resolution.source === "local" ? local : remote;
+  const paths = new Set(group.paths);
+  for (const snapshot of [selected, local]) {
+    const layout = planFileMerge({
+      baseline: {},
+      local: snapshot.files.filter((file) => paths.has(file.path)),
+      remote: [],
+      selectionCompatible: true,
+    });
+    if (layout.kind !== "planned" || layout.conflicts.length)
+      throw new Error(
+        "Selected/current local group still has path collisions; preserve evidence, repair the layout manually and refresh sync.",
+      );
+  }
+  const selectedFiles = new Map(selected.files.map((file) => [file.path, file]));
+  const decisions = plan.decisions.map((item) =>
+    paths.has(item.path)
+      ? {
+          kind: "accepted" as const,
+          path: item.path,
+          source: resolution.source,
+          file: selectedFiles.get(item.path),
+        }
+      : item,
+  );
+  return {
+    kind: "planned",
+    decisions,
+    conflicts: decisions.filter((item): item is Extract<typeof item, { kind: "conflict" }> => item.kind === "conflict"),
+  };
+}

package/src/sync/conflict-retention.ts

@@ -0,0 +1,72 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import type { AnySyncConfig } from "../settings/settings-types.js";
+import type { Snapshot } from "../snapshot/snapshot-types.js";
+import { syncDirectory } from "../state/json-file.js";
+import type { SyncState } from "../state/state-types.js";
+import { conflictDirectory, readConflictArtifact } from "./conflict-artifacts.js";
+import { fileHashMap } from "./sync-state.js";
+/** Only after accepted state and journal retirement, under the operation lock. Unknown/unresolved evidence is never pruned. */
+export async function pruneCompletedConflicts(
+  config: AnySyncConfig,
+  backend: string,
+  state: SyncState,
+  local: Snapshot,
+  remote: Snapshot,
+  validate: () => void,
+) {
+  validate();
+  const directory = conflictDirectory(config);
+  let names: string[];
+  try {
+    const stat = await fs.lstat(directory);
+    validate();
+    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("Unsafe conflict retention directory.");
+    names = await fs.readdir(directory);
+    validate();
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+  const pinned = new Set(state.unresolved?.map((group) => group.artifact) ?? []);
+  const ours = fileHashMap(local);
+  const theirs = fileHashMap(remote);
+  const completed: { token: string; modified: number }[] = [];
+  for (const name of names) {
+    validate();
+    const token = name.replace(/\.json$/u, "");
+    if (!/^[a-f0-9-]{36}\.json$/u.test(name) || pinned.has(token)) continue;
+    try {
+      const artifact = await readConflictArtifact(config, backend, token);
+      validate();
+      const originalLocal = fileHashMap(artifact.local);
+      const originalRemote = fileHashMap(artifact.remote);
+      if (
+        !artifact.groups.every((group) =>
+          group.paths.every(
+            (filePath) =>
+              state.lastFileHashes[filePath] === ours[filePath] &&
+              ours[filePath] === theirs[filePath] &&
+              (ours[filePath] === originalLocal[filePath] || ours[filePath] === originalRemote[filePath]),
+          ),
+        )
+      )
+        continue;
+      const stat = await fs.lstat(path.join(directory, name));
+      validate();
+      if (stat.isFile()) completed.push({ token, modified: stat.mtimeMs });
+    } catch {
+      validate(); /* Corrupt/unknown evidence remains. */
+    }
+  }
+  completed.sort((left, right) => right.modified - left.modified || left.token.localeCompare(right.token));
+  for (const entry of completed.slice(32)) {
+    validate();
+    await fs.rm(path.join(directory, `${entry.token}.json`));
+    validate();
+  }
+  if (completed.length > 32) {
+    await syncDirectory(directory);
+    validate();
+  }
+}

package/src/sync/conflict-review.ts

@@ -0,0 +1,95 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { truncateToWidth } from "@earendil-works/pi-tui";
+import { createSyncBackend, type SyncBackendFactory } from "../backends/backend-factory.js";
+import type { CommandOptions } from "../commands/command-types.js";
+import { loadConfig, syncCheckConfigFingerprint } from "../settings/config.js";
+import { readStateForConfig, syncStateFingerprint } from "../state/sync-state-store.js";
+import { confirmMergeReview } from "../ui/merge-review.js";
+import { safeTerminalText } from "../ui/terminal-text.js";
+import { conflictArtifactFingerprint, readConflictArtifact } from "./conflict-artifacts.js";
+import { conflictPreview } from "./conflict-preview.js";
+import { mergeSync } from "./merged-sync.js";
+import { captureMutationOwner } from "./sync-local.js";
+export async function showConflicts(
+  ctx: ExtensionContext,
+  options: CommandOptions,
+  factory: SyncBackendFactory = createSyncBackend,
+) {
+  const validate = captureMutationOwner(ctx, options.signal);
+  const config = await loadConfig(options.setup);
+  validate();
+  const state = await readStateForConfig(config);
+  validate();
+  if (!state.unresolved?.length) {
+    ctx.ui.notify("No recorded unresolved conflict groups.", "info");
+    return;
+  }
+  if (!ctx.hasUI) {
+    ctx.ui.notify(
+      `${state.unresolved.length} conflict groups remain unresolved. Review with TUI/RPC; no transfer performed.`,
+      "warning",
+    );
+    return;
+  }
+  const backend = await factory(config);
+  validate();
+  const labels = state.unresolved.map(
+    (group, index) =>
+      `${index + 1}: ${group.paths.length} paths · ${group.paths
+        .slice(0, 3)
+        .map((value) => truncateToWidth(safeTerminalText(value), 80))
+        .join(", ")}${group.paths.length > 3 ? ", …" : ""}`,
+  );
+  const choice = await ctx.ui.select("Review unresolved dependency group", [...labels, "Keep all unresolved"], {
+    signal: options.signal,
+  });
+  validate();
+  const index = labels.indexOf(choice ?? "");
+  if (index < 0) return;
+  const reference = state.unresolved[index];
+  if (!reference) return;
+  const artifact = await readConflictArtifact(config, backend.identity, reference.artifact);
+  validate();
+  const groupIndex = artifact.groups.findIndex(
+    (group) => JSON.stringify(group.paths) === JSON.stringify(reference.paths),
+  );
+  if (groupIndex < 0) throw new Error("Conflict reference is stale; refresh sync.");
+  const body = conflictPreview(artifact, reference.paths, backend.destination);
+  if (
+    !(await confirmMergeReview(
+      ctx,
+      "Review private conflict versions",
+      body,
+      options.signal,
+      () => {
+        try {
+          validate();
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      "Continue to resolution choices",
+    ))
+  )
+    return;
+  validate();
+  const decision = await ctx.ui.select(
+    "Resolve the entire reviewed group",
+    ["Keep unresolved", "Use local group", "Use remote group"],
+    { signal: options.signal },
+  );
+  validate();
+  if (decision !== "Use local group" && decision !== "Use remote group") return;
+  if (syncCheckConfigFingerprint(config) !== syncCheckConfigFingerprint(await loadConfig(options.setup)))
+    throw new Error("Settings changed during conflict review.");
+  validate();
+  await mergeSync(ctx, { ...options, yes: false, auto: false }, factory, {
+    token: reference.artifact,
+    group: groupIndex,
+    source: decision === "Use local group" ? "local" : "remote",
+    stateIdentity: syncStateFingerprint(state),
+    artifactIdentity: conflictArtifactFingerprint(artifact),
+  });
+  validate();
+}

package/src/sync/content-conflicts.ts

@@ -0,0 +1,73 @@
+import { createHash } from "node:crypto";
+import type { AnySyncConfig } from "../settings/settings-types.js";
+import type { Snapshot, SnapshotFile } from "../snapshot/snapshot-types.js";
+import { readMergeAncestors } from "../state/merge-baseline-store.js";
+import type { SyncState } from "../state/state-types.js";
+import { type FileMergePlan, mergePathIdentity } from "./file-merge-planner.js";
+import { mergeSession } from "./session-merge.js";
+import { isMergeTextPath, mergeText, TEXT_MERGE_WORK_LIMIT, type TextMergeBudget } from "./text-merge.js";
+export function snapshotFile(filePath: string, bytes: Buffer): SnapshotFile {
+  return {
+    path: filePath,
+    contentBase64: bytes.toString("base64"),
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+  };
+}
+export async function resolveContentConflicts(
+  config: AnySyncConfig,
+  state: SyncState,
+  local: Snapshot,
+  remote: Snapshot,
+  plan: FileMergePlan,
+  protectedPaths: ReadonlySet<string>,
+  options: { textBudget?: TextMergeBudget; signal?: AbortSignal } = {},
+): Promise<FileMergePlan> {
+  if (plan.kind !== "planned" || !config.mergeContent) return plan;
+  options.signal?.throwIfAborted();
+  const budget = options.textBudget ?? { remaining: TEXT_MERGE_WORK_LIMIT };
+  const decisions = [...plan.decisions];
+  let ancestors: SnapshotFile[] = [];
+  try {
+    ancestors = (await readMergeAncestors(config, state)) ?? [];
+  } catch {
+    options.signal?.throwIfAborted();
+    return plan;
+  }
+  options.signal?.throwIfAborted();
+  const oursByPath = new Map(local.files.map((file) => [file.path, file]));
+  const theirsByPath = new Map(remote.files.map((file) => [file.path, file]));
+  const ancestorsByPath = new Map(ancestors.map((file) => [file.path, file]));
+  const decisionIndex = new Map(decisions.map((decision, index) => [decision.path, index]));
+  const protectedKeys = new Set([...protectedPaths].map(mergePathIdentity));
+  for (const conflict of plan.conflicts) {
+    options.signal?.throwIfAborted();
+    if (conflict.reason !== "both-changed" || protectedKeys.has(mergePathIdentity(conflict.path))) continue;
+    const session = conflict.path.startsWith("sessions/") && conflict.path.endsWith(".jsonl");
+    if (!session && (!isMergeTextPath(conflict.path) || budget.remaining === 0)) continue;
+    const ours = oursByPath.get(conflict.path);
+    const theirs = theirsByPath.get(conflict.path);
+    if (!ours || !theirs) continue;
+    const ancestor = ancestorsByPath.get(conflict.path);
+    const base = ancestor ? Buffer.from(ancestor.contentBase64, "base64") : undefined;
+    if (!base) continue;
+    const localBytes = Buffer.from(ours.contentBase64, "base64");
+    const remoteBytes = Buffer.from(theirs.contentBase64, "base64");
+    const bytes = session
+      ? mergeSession(base, localBytes, remoteBytes)
+      : mergeText(base, localBytes, remoteBytes, { budget, signal: options.signal });
+    if (!bytes) continue;
+    const index = decisionIndex.get(conflict.path);
+    if (index === undefined) continue;
+    decisions[index] = {
+      kind: "accepted",
+      path: conflict.path,
+      source: "merged",
+      file: snapshotFile(conflict.path, bytes),
+    };
+  }
+  return {
+    kind: "planned",
+    decisions,
+    conflicts: decisions.filter((item): item is Extract<typeof item, { kind: "conflict" }> => item.kind === "conflict"),
+  };
+}

package/src/sync/field-migration.ts

@@ -0,0 +1,39 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { AnySyncConfig } from "../settings/settings-types.js";
+import type { Snapshot } from "../snapshot/snapshot-types.js";
+import type { SyncState } from "../state/state-types.js";
+import { safeTerminalText } from "../ui/terminal-text.js";
+import { sameLocalFields } from "./local-fields.js";
+import { captureMutationOwner } from "./sync-local.js";
+
+export async function confirmFieldMigration(
+  ctx: ExtensionContext,
+  config: AnySyncConfig,
+  state: SyncState,
+  remote: Snapshot | undefined,
+  force: boolean,
+  signal?: AbortSignal,
+) {
+  if (remote?.localFields !== undefined && config.localFields === undefined)
+    throw new Error(
+      "Portable snapshots require settings version 4 and explicit localFields rules on this machine; older policy must not replace local-only values.",
+    );
+  const changed =
+    (Boolean(state.lastAppliedSnapshot) && !sameLocalFields(state.localFields, config.localFields)) ||
+    (remote !== undefined && !sameLocalFields(remote.localFields, config.localFields));
+  if (!changed) return true;
+  if (!force)
+    throw new Error(
+      "Local-field policy changed; review an explicit push --force or pull --force migration. Old remote history is not erased.",
+    );
+  const validate = captureMutationOwner(ctx, signal);
+  if (!ctx.hasUI) throw new Error("Local-field migration requires observable TUI/RPC confirmation.");
+  validate();
+  const confirmed = await ctx.ui.confirm(
+    "Migrate portable settings policy?",
+    `New machine-local fields: ${(config.localFields ?? []).map(safeTerminalText).join(", ") || "none"}. Additions remove fields from future snapshots, not old history. Removals make local-only values portable again and a pull may replace them. The selected direction is authoritative; inspect /sync diff first. This confirmation is required even with --yes.`,
+    { signal },
+  );
+  validate();
+  return confirmed;
+}

package/src/sync/file-merge-planner.ts

@@ -0,0 +1,143 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { isDeniedPath } from "../paths.js";
+import type { SnapshotFile } from "../snapshot/snapshot-types.js";
+
+/** Absence and an empty file are different states. A missing ancestor is not absence. */
+export type FileVersion = SnapshotFile | undefined;
+export type FileMergeDecision =
+  | { kind: "accepted"; path: string; source: "equal" | "local" | "remote" | "merged"; file: FileVersion }
+  | { kind: "conflict"; path: string; reason: "both-changed" | "protected-session" | "path-collision" };
+
+export type FileMergePlan =
+  | { kind: "review"; reason: "missing-baseline" | "selection-changed" }
+  | { kind: "planned"; decisions: FileMergeDecision[]; conflicts: Extract<FileMergeDecision, { kind: "conflict" }>[] };
+
+export interface FileMergeInput {
+  /** Undefined means unavailable; an empty map is an established empty baseline. */
+  baseline: Readonly<Record<string, string>> | undefined;
+  local: readonly SnapshotFile[];
+  remote: readonly SnapshotFile[];
+  selectionCompatible: boolean;
+  protectedPaths?: ReadonlySet<string>;
+}
+
+/** Pure, deterministic decisions only. This does not authorize publication or mutation. */
+export function planFileMerge(input: FileMergeInput): FileMergePlan {
+  if (!input.selectionCompatible) return { kind: "review", reason: "selection-changed" };
+  if (input.baseline === undefined) return { kind: "review", reason: "missing-baseline" };
+  const local = indexFiles(input.local);
+  const remote = indexFiles(input.remote);
+  const baseline = input.baseline;
+  for (const [filePath, hash] of Object.entries(baseline)) {
+    validatePath(filePath);
+    if (!/^[a-f0-9]{64}$/u.test(hash)) throw new Error("Invalid merge baseline hash.");
+  }
+  const paths = [...new Set([...Object.keys(baseline), ...local.keys(), ...remote.keys()])].sort();
+  const collisions = collidingPaths(paths);
+  const protectedKeys = new Set([...(input.protectedPaths ?? [])].map(mergePathIdentity));
+  const decisions: FileMergeDecision[] = paths.map((filePath) => {
+    if (collisions.has(filePath)) return { kind: "conflict", path: filePath, reason: "path-collision" };
+    const left = local.get(filePath);
+    const right = remote.get(filePath);
+    const ancestor = Object.hasOwn(baseline, filePath) ? baseline[filePath] : undefined;
+    let source: "equal" | "local" | "remote";
+    let file: FileVersion;
+    if (left?.sha256 === right?.sha256) {
+      source = "equal";
+      file = left;
+    } else if (right?.sha256 === ancestor) {
+      source = "local";
+      file = left;
+    } else if (left?.sha256 === ancestor) {
+      source = "remote";
+      file = right;
+    } else {
+      return { kind: "conflict", path: filePath, reason: "both-changed" };
+    }
+    if (source === "remote" && protectedKeys.has(mergePathIdentity(filePath))) {
+      return { kind: "conflict", path: filePath, reason: "protected-session" };
+    }
+    return { kind: "accepted", path: filePath, source, file };
+  });
+  return {
+    kind: "planned",
+    decisions,
+    conflicts: decisions.filter((decision) => decision.kind === "conflict"),
+  };
+}
+
+function indexFiles(files: readonly SnapshotFile[]) {
+  const result = new Map<string, SnapshotFile>();
+  for (const file of files) {
+    validatePath(file.path);
+    if (result.has(file.path)) throw new Error("Duplicate merge path.");
+    if (
+      !/^[A-Za-z0-9+/]*={0,2}$/u.test(file.contentBase64) ||
+      file.contentBase64.length % 4 !== 0 ||
+      Buffer.from(file.contentBase64, "base64").toString("base64") !== file.contentBase64 ||
+      createHash("sha256").update(Buffer.from(file.contentBase64, "base64")).digest("hex") !== file.sha256
+    ) {
+      throw new Error("Invalid merge file content or checksum.");
+    }
+    result.set(file.path, file);
+  }
+  return result;
+}
+
+function validatePath(filePath: string) {
+  if (
+    !filePath ||
+    filePath === "." ||
+    filePath === ".." ||
+    filePath.startsWith("../") ||
+    path.posix.isAbsolute(filePath) ||
+    filePath.includes("\\") ||
+    (process.platform === "win32" &&
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: Native Windows filename restrictions.
+      (/[<>:"|?*\u0001-\u001f]/u.test(filePath) ||
+        filePath
+          .split("/")
+          .some(
+            (segment) => /[ .]$/u.test(segment) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(segment),
+          ))) ||
+    path.posix.normalize(filePath) !== filePath ||
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: Reject unsafe snapshot paths.
+    /[\u0000\ud800-\udfff]/u.test(filePath) ||
+    isDeniedPath(filePath) ||
+    (filePath.startsWith("sessions/") && !filePath.endsWith(".jsonl"))
+  ) {
+    throw new Error("Unsafe merge path.");
+  }
+}
+
+export function mergePathIdentity(filePath: string) {
+  // Node path strings encode invalid UTF-16 as U+FFFD; context paths can still contain it.
+  return Buffer.from(filePath, "utf8").toString("utf8").normalize("NFC").toLowerCase();
+}
+
+/** Conservative dependency groups: never accept a case or file/directory transition independently. */
+export function collidingPaths(paths: readonly string[]) {
+  const byLower = new Map<string, string[]>();
+  for (const filePath of paths) {
+    const lower = mergePathIdentity(filePath);
+    const variants = byLower.get(lower) ?? [];
+    variants.push(filePath);
+    byLower.set(lower, variants);
+  }
+  const result = new Set<string>();
+  for (const variants of byLower.values()) {
+    if (variants.length > 1) for (const variant of variants) result.add(variant);
+  }
+  for (const filePath of paths) {
+    const segments = mergePathIdentity(filePath).split("/");
+    for (let length = 1; length < segments.length; length += 1) {
+      const ancestors = byLower.get(segments.slice(0, length).join("/"));
+      if (ancestors) {
+        result.add(filePath);
+        for (const ancestor of ancestors) result.add(ancestor);
+      }
+    }
+  }
+  return result;
+}