@nurix/nustack 0.10.0-dev.10

package/dist/lib/git-sync/core/engine.js

@@ -0,0 +1,263 @@
+import { getBindingById, listActiveBindings } from "../../local_store/bindings.js";
+import { NotARepositoryError } from "./git_runner.js";
+import { resolveRepository, readHeadCommit, readSymbolicBranch, } from "./repository.js";
+import { readGitOperationState, isTechnicalWaitState } from "./operation_state.js";
+import { resolveCommitRange } from "./commit_range.js";
+import { withReconciliationLock, } from "./reconciliation_lock.js";
+import { watchGitControlPaths } from "./watcher.js";
+const DEFAULT_INTERVAL_MS = 5 * 60_000;
+const DEFAULT_HEARTBEAT_MS = 30_000;
+export function observeBinding(binding) {
+    const base = {
+        bindingId: binding.id,
+        workspaceId: binding.workspaceId,
+        boundBranch: binding.boundBranch,
+        status: binding.status,
+        resolved: false,
+        symbolicBranch: null,
+        operationState: "unknown",
+        headCommitId: null,
+        lastProcessedCommitId: binding.lastProcessedCommitId,
+        lastAppliedWorkspaceSequence: binding.lastAppliedWorkspaceSequence,
+        pendingCommitCount: 0,
+    };
+    let repo;
+    try {
+        repo = resolveRepository(binding.repositoryRoot);
+    }
+    catch {
+        return base;
+    }
+    const range = resolveCommitRange(repo, {
+        boundBranch: binding.boundBranch,
+        lastProcessedCommitId: binding.lastProcessedCommitId,
+    });
+    return {
+        ...base,
+        resolved: true,
+        symbolicBranch: readSymbolicBranch(repo),
+        operationState: readGitOperationState(repo).kind,
+        headCommitId: readHeadCommit(repo),
+        pendingCommitCount: range.kind === "range" ? range.commitIds.length : 0,
+    };
+}
+export function createSyncEngine(options) {
+    const { store } = options;
+    const emitter = options.emitter ?? null;
+    const onLog = options.onLog ?? null;
+    const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+    const heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+    const lockOptions = options.lockOptions ?? {};
+    const registry = {
+        outboundPublisher: null,
+        inboundApplier: null,
+    };
+    const bindingFilter = new Set(options.bindingIds ?? []);
+    function scopedActiveBindings() {
+        const active = listActiveBindings(store);
+        return bindingFilter.size === 0 ? active : active.filter((binding) => bindingFilter.has(binding.id));
+    }
+    const watchers = new Map();
+    const inFlight = new Set();
+    let started = false;
+    let intervalTimer;
+    let heartbeatTimer;
+    function safeEmit(input) {
+        if (!emitter)
+            return;
+        try {
+            emitter.emit(input);
+        }
+        catch {
+            try {
+                emitter.emit({ event: "error", code: "emit_failed", message: "an event was withheld" });
+            }
+            catch {
+            }
+        }
+    }
+    function log(line) {
+        if (onLog)
+            onLog(line);
+    }
+    function describeOutcome(outcome) {
+        const detail = outcome.outcome === "commit_range_ready"
+            ? ` (${outcome.pendingCommitCount} pending commit(s))`
+            : outcome.waitReason
+                ? ` (${outcome.waitReason})`
+                : outcome.errorCode
+                    ? ` (${outcome.errorCode})`
+                    : "";
+        return `${outcome.bindingId}: ${outcome.outcome}${detail}`;
+    }
+    function emitResult(outcome) {
+        safeEmit({
+            event: "reconcile_result",
+            bindingId: outcome.bindingId,
+            outcome: outcome.outcome,
+            headCommitId: outcome.headCommitId,
+            lastProcessedCommitId: outcome.lastProcessedCommitId,
+            pendingCommitCount: outcome.pendingCommitCount,
+            ...(outcome.waitReason ? { waitReason: outcome.waitReason } : {}),
+            ...(outcome.errorCode ? { errorCode: outcome.errorCode } : {}),
+        });
+        log(describeOutcome(outcome));
+    }
+    async function reconcileBinding(bindingId, _source) {
+        return withReconciliationLock(bindingId, async () => {
+            safeEmit({ event: "reconcile_started", bindingId });
+            const binding = getBindingById(store, bindingId);
+            if (!binding) {
+                const outcome = {
+                    bindingId,
+                    outcome: "error",
+                    headCommitId: null,
+                    lastProcessedCommitId: null,
+                    pendingCommitCount: 0,
+                    errorCode: "binding_not_found",
+                };
+                emitResult(outcome);
+                return outcome;
+            }
+            let repo;
+            try {
+                repo = resolveRepository(binding.repositoryRoot);
+            }
+            catch (error) {
+                const outcome = {
+                    bindingId,
+                    outcome: "error",
+                    headCommitId: null,
+                    lastProcessedCommitId: binding.lastProcessedCommitId,
+                    pendingCommitCount: 0,
+                    errorCode: error instanceof NotARepositoryError ? "not_a_repository" : "repository_unresolved",
+                };
+                emitResult(outcome);
+                return outcome;
+            }
+            const head = readHeadCommit(repo);
+            const operationState = readGitOperationState(repo);
+            if (isTechnicalWaitState(operationState)) {
+                const outcome = {
+                    bindingId,
+                    outcome: "technical_wait",
+                    headCommitId: head,
+                    lastProcessedCommitId: binding.lastProcessedCommitId,
+                    pendingCommitCount: 0,
+                    waitReason: operationState.kind,
+                };
+                emitResult(outcome);
+                return outcome;
+            }
+            const range = resolveCommitRange(repo, {
+                boundBranch: binding.boundBranch,
+                lastProcessedCommitId: binding.lastProcessedCommitId,
+            });
+            const outcome = {
+                bindingId,
+                outcome: "no_op",
+                headCommitId: head,
+                lastProcessedCommitId: binding.lastProcessedCommitId,
+                pendingCommitCount: 0,
+            };
+            switch (range.kind) {
+                case "branch_wait":
+                    outcome.outcome = "branch_wait";
+                    outcome.waitReason = range.reason;
+                    break;
+                case "history_decision_required":
+                    outcome.outcome = "history_decision_required";
+                    break;
+                case "no_op":
+                    outcome.outcome = "no_op";
+                    break;
+                case "range":
+                    outcome.outcome = "commit_range_ready";
+                    outcome.pendingCommitCount = range.commitIds.length;
+                    if (registry.outboundPublisher) {
+                        await registry.outboundPublisher({ store, repo, binding, commitIds: range.commitIds, emit: safeEmit });
+                    }
+                    break;
+            }
+            emitResult(outcome);
+            return outcome;
+        }, lockOptions);
+    }
+    function triggerReconcile(bindingId, source) {
+        safeEmit({ event: "wake", bindingId, source });
+        const promise = reconcileBinding(bindingId, source);
+        inFlight.add(promise);
+        void promise.finally(() => inFlight.delete(promise));
+        return promise;
+    }
+    async function reconcileAll(source) {
+        const outcomes = [];
+        for (const binding of scopedActiveBindings()) {
+            outcomes.push(await triggerReconcile(binding.id, source));
+        }
+        return outcomes;
+    }
+    async function start() {
+        if (started)
+            return;
+        started = true;
+        const bindings = scopedActiveBindings();
+        safeEmit({ event: "watch_started", pid: process.pid, bindingCount: bindings.length });
+        log(`watching ${bindings.length} binding(s) — Ctrl-C to stop`);
+        for (const binding of bindings) {
+            const observation = observeBinding(binding);
+            safeEmit({
+                event: "binding_status",
+                bindingId: observation.bindingId,
+                workspaceId: observation.workspaceId,
+                boundBranch: observation.boundBranch,
+                status: observation.status,
+                headCommitId: observation.headCommitId,
+                lastProcessedCommitId: observation.lastProcessedCommitId,
+                lastAppliedWorkspaceSequence: observation.lastAppliedWorkspaceSequence,
+                pendingCommitCount: observation.pendingCommitCount,
+            });
+        }
+        await reconcileAll("startup");
+        for (const binding of bindings) {
+            try {
+                const repo = resolveRepository(binding.repositoryRoot);
+                watchers.set(binding.id, watchGitControlPaths(repo, binding.boundBranch, () => {
+                    void triggerReconcile(binding.id, "fs");
+                }));
+            }
+            catch {
+            }
+        }
+        intervalTimer = setInterval(() => void reconcileAll("interval"), intervalMs);
+        if (emitter)
+            heartbeatTimer = setInterval(() => safeEmit({ event: "heartbeat" }), heartbeatMs);
+    }
+    async function stop(reason = "signal") {
+        if (intervalTimer)
+            clearInterval(intervalTimer);
+        if (heartbeatTimer)
+            clearInterval(heartbeatTimer);
+        intervalTimer = undefined;
+        heartbeatTimer = undefined;
+        for (const handle of watchers.values())
+            handle.close();
+        watchers.clear();
+        await Promise.allSettled([...inFlight]);
+        started = false;
+        safeEmit({ event: "watch_stopped", reason });
+        log(`stopped (${reason})`);
+    }
+    return {
+        reconcileBinding,
+        reconcileAll,
+        registerOutboundPublisher(publisher) {
+            registry.outboundPublisher = publisher;
+        },
+        registerInboundApplier(applier) {
+            registry.inboundApplier = applier;
+        },
+        start,
+        stop,
+    };
+}

package/dist/lib/git-sync/core/git_runner.js

@@ -0,0 +1,137 @@
+import { spawnSync } from "node:child_process";
+export const GIT_READ_ONLY_SUBCOMMANDS = [
+    "rev-parse",
+    "symbolic-ref",
+    "rev-list",
+    "merge-base",
+    "for-each-ref",
+    "cat-file",
+    "diff-tree",
+    "ls-tree",
+    "status",
+];
+export const GIT_WRITE_PLUMBING_SUBCOMMANDS = [
+    "hash-object",
+    "read-tree",
+    "update-index",
+    "write-tree",
+    "commit-tree",
+    "update-ref",
+    "ls-files",
+    "merge-file",
+    "config",
+];
+const DEFAULT_TIMEOUT_MS = 15_000;
+const MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
+export class GitNotInstalledError extends Error {
+    constructor() {
+        super("git is not installed or not on PATH");
+        this.name = "GitNotInstalledError";
+    }
+}
+export class NotARepositoryError extends Error {
+    startDir;
+    constructor(startDir) {
+        super(`not a Git repository (or any parent): ${startDir}`);
+        this.name = "NotARepositoryError";
+        this.startDir = startDir;
+    }
+}
+export class GitSubcommandNotAllowedError extends Error {
+    subcommand;
+    constructor(subcommand) {
+        super(`git subcommand not permitted by the allowlist: ${subcommand}`);
+        this.name = "GitSubcommandNotAllowedError";
+        this.subcommand = subcommand;
+    }
+}
+export class GitConfigWriteNotAllowedError extends Error {
+    args;
+    constructor(args) {
+        super("git config is permitted for --get reads only; a write/unset argument was refused");
+        this.name = "GitConfigWriteNotAllowedError";
+        this.args = args;
+    }
+}
+export class GitCommandError extends Error {
+    subcommand;
+    redactedArgv;
+    exitCode;
+    stderr;
+    constructor(subcommand, redactedArgv, exitCode, stderr) {
+        super(`git ${subcommand} failed (exit ${exitCode})`);
+        this.name = "GitCommandError";
+        this.subcommand = subcommand;
+        this.redactedArgv = redactedArgv;
+        this.exitCode = exitCode;
+        this.stderr = stderr;
+    }
+}
+function redactArg(arg) {
+    return arg.startsWith("/") || /^[A-Za-z]:\\/.test(arg) ? "<path>" : arg;
+}
+function isAllowed(subcommand) {
+    return (GIT_READ_ONLY_SUBCOMMANDS.includes(subcommand) ||
+        GIT_WRITE_PLUMBING_SUBCOMMANDS.includes(subcommand));
+}
+function isConfigReadOnly(args) {
+    const rest = args.slice(1).filter((arg) => arg !== "--null" && arg !== "-z");
+    const verb = rest[0];
+    if (verb !== "--get" && verb !== "--get-all" && verb !== "--get-regexp")
+        return false;
+    return !rest.slice(1).some((arg) => arg.startsWith("--") && arg !== "--get" && arg !== "--get-all");
+}
+export function runGit(cwd, args, options = {}) {
+    const subcommand = args[0] ?? "";
+    if (!isAllowed(subcommand)) {
+        throw new GitSubcommandNotAllowedError(subcommand);
+    }
+    if (subcommand === "config" && !isConfigReadOnly(args)) {
+        throw new GitConfigWriteNotAllowedError(args);
+    }
+    const env = { ...process.env };
+    delete env.GIT_DIR;
+    delete env.GIT_WORK_TREE;
+    delete env.GIT_INDEX_FILE;
+    if (options.indexFile)
+        env.GIT_INDEX_FILE = options.indexFile;
+    if (options.identity) {
+        const id = options.identity;
+        if (id.authorName !== undefined)
+            env.GIT_AUTHOR_NAME = id.authorName;
+        if (id.authorEmail !== undefined)
+            env.GIT_AUTHOR_EMAIL = id.authorEmail;
+        if (id.committerName !== undefined)
+            env.GIT_COMMITTER_NAME = id.committerName;
+        if (id.committerEmail !== undefined)
+            env.GIT_COMMITTER_EMAIL = id.committerEmail;
+        if (id.authorDate !== undefined)
+            env.GIT_AUTHOR_DATE = id.authorDate;
+        if (id.committerDate !== undefined)
+            env.GIT_COMMITTER_DATE = id.committerDate;
+    }
+    const result = spawnSync("git", args, {
+        cwd,
+        env,
+        encoding: "utf8",
+        timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        maxBuffer: MAX_OUTPUT_BYTES,
+        ...(options.input !== undefined ? { input: options.input } : {}),
+    });
+    if (result.error) {
+        const code = result.error.code;
+        if (code === "ENOENT")
+            throw new GitNotInstalledError();
+        throw new GitCommandError(subcommand, [subcommand, ...args.slice(1).map(redactArg)], -1, String(result.error));
+    }
+    const exitCode = result.status ?? -1;
+    const stdout = result.stdout ?? "";
+    const stderr = result.stderr ?? "";
+    if (exitCode !== 0 && !options.allowFailure) {
+        if (/not a git repository/i.test(stderr)) {
+            throw new NotARepositoryError(cwd);
+        }
+        throw new GitCommandError(subcommand, [subcommand, ...args.slice(1).map(redactArg)], exitCode, stderr);
+    }
+    return { stdout, stderr, exitCode };
+}

package/dist/lib/git-sync/core/operation_state.js

@@ -0,0 +1,22 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+export function readGitOperationState(repo) {
+    const gitDir = repo.gitDir;
+    const has = (entry) => existsSync(path.join(gitDir, entry));
+    if (has("MERGE_HEAD"))
+        return { kind: "merge" };
+    if (has("rebase-merge") || has("rebase-apply"))
+        return { kind: "rebase" };
+    if (has("CHERRY_PICK_HEAD"))
+        return { kind: "cherry_pick" };
+    if (has("REVERT_HEAD"))
+        return { kind: "revert" };
+    if (has("BISECT_LOG"))
+        return { kind: "bisect" };
+    if (has("index.lock"))
+        return { kind: "index_locked" };
+    return { kind: "normal" };
+}
+export function isTechnicalWaitState(state) {
+    return state.kind !== "normal";
+}

package/dist/lib/git-sync/core/path_normalizer.js

@@ -0,0 +1,98 @@
+import path from "node:path";
+import { lstatSync } from "node:fs";
+export const PROTECTED_PATTERNS = [
+    ".git/**",
+    ".env*",
+    ".nustack/recovery/**",
+    ".npmrc",
+    ".netrc",
+    "*.pem",
+    "*.key",
+    "id_rsa*",
+];
+const PROTECTED_PREFIXES = [".git", ".nustack/recovery"];
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const CONTROL_CHARACTER = /[\u0001-\u001F\u007F]/;
+export function isProtectedPath(normalizedPath) {
+    for (const prefix of PROTECTED_PREFIXES) {
+        if (normalizedPath === prefix || normalizedPath.startsWith(`${prefix}/`))
+            return true;
+    }
+    const basename = normalizedPath.slice(normalizedPath.lastIndexOf("/") + 1);
+    if (basename.startsWith(".env"))
+        return true;
+    if (basename === ".npmrc" || basename === ".netrc")
+        return true;
+    if (basename.endsWith(".pem") || basename.endsWith(".key"))
+        return true;
+    if (basename.startsWith("id_rsa"))
+        return true;
+    return false;
+}
+export function normalizeRepositoryPath(raw) {
+    if (raw.length === 0)
+        return { ok: false, code: "empty" };
+    if (LONE_SURROGATE.test(raw))
+        return { ok: false, code: "invalid_encoding" };
+    if (raw.includes("\u0000"))
+        return { ok: false, code: "nul_byte" };
+    if (CONTROL_CHARACTER.test(raw))
+        return { ok: false, code: "control_character" };
+    const slashed = raw.replace(/\\/g, "/");
+    if (slashed.startsWith("//"))
+        return { ok: false, code: "unc" };
+    if (/^[A-Za-z]:/.test(slashed))
+        return { ok: false, code: "drive_qualified" };
+    if (slashed.startsWith("/"))
+        return { ok: false, code: "absolute" };
+    const rawSegments = slashed.split("/");
+    for (const segment of rawSegments) {
+        if (segment === "." || segment === "..")
+            return { ok: false, code: "dot_segment" };
+    }
+    const segments = rawSegments.filter((segment) => segment.length > 0);
+    if (segments.length === 0)
+        return { ok: false, code: "empty" };
+    const normalizedPath = segments.join("/");
+    if (isProtectedPath(normalizedPath))
+        return { ok: false, code: "protected_path" };
+    return { ok: true, path: normalizedPath };
+}
+export function safeJoin(repositoryRoot, normalizedPath) {
+    const root = path.resolve(repositoryRoot);
+    const target = path.resolve(root, normalizedPath);
+    const rel = path.relative(root, target);
+    if (rel.length === 0 || rel.startsWith("..") || path.isAbsolute(rel)) {
+        return { ok: false, code: "outside_root" };
+    }
+    let current = root;
+    for (const segment of rel.split(path.sep)) {
+        current = path.join(current, segment);
+        try {
+            if (lstatSync(current).isSymbolicLink())
+                return { ok: false, code: "outside_root" };
+        }
+        catch {
+            break;
+        }
+    }
+    return { ok: true, path: target };
+}
+export function findCaseFoldCollisions(paths) {
+    return groupCollisions(paths, (candidate) => candidate.toLowerCase());
+}
+export function findUnicodeCollisions(paths) {
+    return groupCollisions(paths, (candidate) => candidate.normalize("NFC"));
+}
+function groupCollisions(paths, keyOf) {
+    const groups = new Map();
+    for (const candidate of paths) {
+        const key = keyOf(candidate);
+        const bucket = groups.get(key);
+        if (bucket)
+            bucket.push(candidate);
+        else
+            groups.set(key, [candidate]);
+    }
+    return [...groups.values()].filter((group) => new Set(group).size > 1);
+}

package/dist/lib/git-sync/core/reconciliation_lock.js

@@ -0,0 +1,103 @@
+import { openSync, writeSync, closeSync, readFileSync, unlinkSync } from "node:fs";
+import path from "node:path";
+import { mkdirSecure } from "../../secure_file.js";
+import { locksDir } from "../../local_store/paths.js";
+const DEFAULT_STALENESS_MS = 60_000;
+const DEFAULT_ACQUIRE_TIMEOUT_MS = 30_000;
+const DEFAULT_POLL_INTERVAL_MS = 50;
+export class ReconciliationLockBusyError extends Error {
+    bindingId;
+    constructor(bindingId) {
+        super(`reconciliation lock for binding ${bindingId} is held by another live process`);
+        this.name = "ReconciliationLockBusyError";
+        this.bindingId = bindingId;
+    }
+}
+const inProcessChains = new Map();
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+function takeOverIfStale(lockPath, stalenessMs) {
+    let content;
+    try {
+        content = JSON.parse(readFileSync(lockPath, "utf8"));
+    }
+    catch {
+        content = undefined;
+    }
+    const stale = content === undefined ||
+        typeof content.pid !== "number" ||
+        !isProcessAlive(content.pid) ||
+        Date.now() - content.acquiredAtMs > stalenessMs;
+    if (!stale)
+        return false;
+    try {
+        unlinkSync(lockPath);
+    }
+    catch {
+    }
+    return true;
+}
+async function acquireFileLock(bindingId, options) {
+    const dir = options.lockDir ?? locksDir();
+    await mkdirSecure(dir);
+    const lockPath = path.join(dir, `${bindingId}.lock`);
+    const stalenessMs = options.stalenessMs ?? DEFAULT_STALENESS_MS;
+    const acquireTimeoutMs = options.acquireTimeoutMs ?? DEFAULT_ACQUIRE_TIMEOUT_MS;
+    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const deadline = Date.now() + acquireTimeoutMs;
+    for (;;) {
+        try {
+            const fd = openSync(lockPath, "wx", 0o600);
+            writeSync(fd, JSON.stringify({ pid: process.pid, acquiredAtMs: Date.now() }));
+            closeSync(fd);
+            return lockPath;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            if (takeOverIfStale(lockPath, stalenessMs))
+                continue;
+            if (Date.now() >= deadline)
+                throw new ReconciliationLockBusyError(bindingId);
+            await delay(pollIntervalMs);
+        }
+    }
+}
+function releaseFileLock(lockPath) {
+    try {
+        unlinkSync(lockPath);
+    }
+    catch {
+    }
+}
+export async function withReconciliationLock(bindingId, fn, options = {}) {
+    const previous = inProcessChains.get(bindingId) ?? Promise.resolve();
+    let releaseInProcess;
+    const nextTail = new Promise((resolve) => (releaseInProcess = resolve));
+    inProcessChains.set(bindingId, nextTail);
+    await previous;
+    try {
+        const lockPath = await acquireFileLock(bindingId, options);
+        try {
+            return await fn();
+        }
+        finally {
+            releaseFileLock(lockPath);
+        }
+    }
+    finally {
+        releaseInProcess();
+        if (inProcessChains.get(bindingId) === nextTail)
+            inProcessChains.delete(bindingId);
+    }
+}

package/dist/lib/git-sync/core/repository.js

@@ -0,0 +1,49 @@
+import path from "node:path";
+import { runGit, NotARepositoryError } from "./git_runner.js";
+export function resolveRepository(startDir) {
+    const { stdout } = runGit(startDir, [
+        "rev-parse",
+        "--show-toplevel",
+        "--absolute-git-dir",
+        "--git-common-dir",
+    ]);
+    const lines = stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    const [repositoryRoot, gitDir, commonDirRaw] = lines;
+    if (!repositoryRoot || !gitDir || !commonDirRaw) {
+        throw new NotARepositoryError(startDir);
+    }
+    const commonDir = path.isAbsolute(commonDirRaw)
+        ? commonDirRaw
+        : path.resolve(startDir, commonDirRaw);
+    return { repositoryRoot, gitDir, commonDir };
+}
+export function readHeadCommit(repo) {
+    const result = runGit(repo.repositoryRoot, ["rev-parse", "--verify", "--quiet", "HEAD"], {
+        allowFailure: true,
+    });
+    if (result.exitCode !== 0)
+        return null;
+    const commit = result.stdout.trim();
+    return commit.length > 0 ? commit : null;
+}
+export function readSymbolicBranch(repo) {
+    const result = runGit(repo.repositoryRoot, ["symbolic-ref", "--quiet", "--short", "HEAD"], {
+        allowFailure: true,
+    });
+    if (result.exitCode !== 0)
+        return null;
+    const branch = result.stdout.trim();
+    return branch.length > 0 ? branch : null;
+}
+export function readRefCommit(repo, ref) {
+    const result = runGit(repo.repositoryRoot, ["rev-parse", "--verify", "--quiet", ref], {
+        allowFailure: true,
+    });
+    if (result.exitCode !== 0)
+        return null;
+    const commit = result.stdout.trim();
+    return commit.length > 0 ? commit : null;
+}