@playcraft/cli 0.1.24 → 0.1.26

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -0,0 +1,155 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath, readdir, rename, unlink } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { join, resolve, sep } from 'node:path';
+import { isLocalWorkspaceGitEnvironment, workspaceGitDirectAccessSchema, workspaceDirectoryNameSchema, sameWorkspaceRegistration } from '@playcraft/common/cloud-workspace/runtime';
+/** Control-owned files only. Same-user processes are not an operating-system isolation boundary. */
+export class WorkspaceGitDirectStore {
+    state;
+    mutation = Promise.resolve();
+    constructor(state) {
+        this.state = state;
+    }
+    exclusive(action) {
+        const result = this.mutation.then(action);
+        this.mutation = result.catch(() => undefined);
+        return result;
+    }
+    identity() {
+        const c = this.state.config;
+        return JSON.stringify([c.environment, c.userId, c.runtimeId, c.generation]);
+    }
+    name(id, directoryName = 'basic') {
+        if (!/^[a-f0-9-]{36}$/.test(id))
+            throw new Error('git_access_denied');
+        workspaceDirectoryNameSchema.parse(directoryName);
+        return `${id}${directoryName === 'basic' ? '' : `--${directoryName}`}.json`;
+    }
+    async directory(create, action) {
+        const stateDir = resolve(this.state.config.stateDir);
+        const directory = join(stateDir, 'direct-git');
+        if (!create && !(await lstat(directory).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        })))
+            return undefined;
+        const root = await realpath(this.state.config.workspaceRoot);
+        if (this.state.config.stateDir !== stateDir || await realpath(stateDir) !== stateDir || stateDir === root || stateDir.startsWith(`${root}${sep}`)) {
+            throw new Error('git_control_directory_rejected');
+        }
+        for (const path of [stateDir, directory]) {
+            if (path === directory && create)
+                await mkdir(path, { mode: 0o700 }).catch(error => {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                });
+            const stat = await lstat(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
+                throw new Error('git_control_directory_rejected');
+            }
+        }
+        const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        try {
+            const pinned = process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : directory;
+            return await action(pinned);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async read(path) {
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!handle)
+            return undefined;
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > 16384) {
+                throw new Error('git_credential_file_rejected');
+            }
+            return JSON.parse(await handle.readFile('utf8'));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async get(binding, directoryName = 'basic') {
+        return this.directory(false, async (path) => {
+            const stored = await this.read(join(path, this.name(binding.workspaceId, directoryName)));
+            if (!stored)
+                return undefined;
+            if (stored.identity !== this.identity() || !sameWorkspaceRegistration(stored.binding, binding)
+                || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                throw new Error('git_access_denied');
+            if (stored.access !== null) {
+                const access = workspaceGitDirectAccessSchema.parse(stored.access);
+                if (access.repositoryUrl !== binding.repositoryUrl)
+                    throw new Error('git_access_denied');
+            }
+            return stored;
+        });
+    }
+    async put(binding, access, rejectedPassword, directoryName = 'basic') {
+        if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || this.state.journal.destroyed())
+            throw new Error('git_access_denied');
+        if (access && (workspaceGitDirectAccessSchema.parse(access).repositoryUrl !== binding.repositoryUrl))
+            throw new Error('git_access_denied');
+        await this.exclusive(() => this.directory(true, async (path) => {
+            const target = join(path, this.name(binding.workspaceId, directoryName));
+            // Refuse symlink/hardlink/permissive old files even though rename would replace them.
+            const old = await this.read(target);
+            if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
+                return;
+            const temporary = join(path, `${randomUUID()}.tmp`);
+            const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));
+                await handle.sync();
+                await handle.close();
+                if (this.state.journal.destroyed())
+                    throw new Error('git_access_denied');
+                await rename(temporary, target);
+                const dir = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
+                try {
+                    await dir.sync();
+                }
+                finally {
+                    await dir.close();
+                }
+            }
+            finally {
+                await handle.close();
+                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+                    throw error; });
+            }
+        }));
+    }
+    async remove(workspaceId, directoryName = 'basic') {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            const target = join(path, this.name(workspaceId, directoryName));
+            await this.read(target);
+            await unlink(target).catch(error => { if (error.code !== 'ENOENT')
+                throw error; });
+        }));
+    }
+    async sweep(destroy = false) {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            for (const name of await readdir(path)) {
+                if (!/^[a-f0-9-]{36}(?:--remix-[a-z0-9][a-z0-9-]{3,63})?\.(json|tmp)$/.test(name))
+                    throw new Error('git_credential_file_rejected');
+                const target = join(path, name);
+                if (name.endsWith('.tmp')) {
+                    await unlink(target);
+                    continue;
+                }
+                const stored = await this.read(target);
+                if (destroy || stored?.identity !== this.identity() || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                    await unlink(target);
+            }
+        }));
+    }
+}

package/dist/workspace-runtime/workspaces/git.js

@@ -0,0 +1,481 @@
+import { spawn } from 'node:child_process';
+import { excludeFromGit } from './dependencies.js';
+import { lstat, readFile, realpath, stat, unlink } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, dirname, join, relative, resolve, sep } from 'node:path';
+import { WORKSPACE_FILE_CONTENT_MAX, gitDiffSchema, gitFileContentSchema, gitGraphSchema, gitStatusSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
+const GIT_DIFF_MAX_BYTES = 1024 * 1024;
+const GIT_PREFIX = [
+    '-c',
+    'core.hooksPath=/dev/null',
+    '-c',
+    'commit.gpgsign=false',
+    '-c',
+    'safe.directory=*',
+];
+export class GitWorkspaceError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'GitWorkspaceError';
+    }
+}
+export async function probeGitBinary() {
+    try {
+        const result = await runGitProcess(tmpdir(), ['--version'], 4000);
+        return result.code === 0;
+    }
+    catch (error) {
+        return error instanceof GitWorkspaceError && error.code === 'git_binary_missing' ? false : false;
+    }
+}
+export async function readWorkspaceGitStatus(root) {
+    const rootReal = await ensureWorkspaceGit(root);
+    const branchResult = await gitAllowFail(rootReal, ['symbolic-ref', '--short', 'HEAD']);
+    const branch = branchResult.code === 0 ? branchResult.stdout.trim() || 'HEAD' : 'HEAD';
+    const upstream = await gitAllowFail(rootReal, ['rev-list', '--left-right', '--count', '@{upstream}...HEAD']);
+    let ahead = 0;
+    let behind = 0;
+    if (upstream.code === 0) {
+        const [left, right] = upstream.stdout.trim().split(/\s+/);
+        behind = Number.parseInt(left ?? '0', 10) || 0;
+        ahead = Number.parseInt(right ?? '0', 10) || 0;
+    }
+    const porcelain = await git(rootReal, ['status', '--porcelain=v1', '--untracked-files=all', '-z']);
+    // Line counts are a convenience; a repository without commits still lists its files.
+    const [staged, unstaged] = await Promise.all([
+        gitAllowFail(rootReal, ['diff', '--cached', '--numstat', '-z']),
+        gitAllowFail(rootReal, ['diff', '--numstat', '-z']),
+    ]);
+    const stagedCounts = staged.code === 0 ? parseNumstat(staged.stdout) : new Map();
+    const unstagedCounts = unstaged.code === 0 ? parseNumstat(unstaged.stdout) : new Map();
+    return gitStatusSchema.parse({
+        initialized: true,
+        branch,
+        ahead,
+        behind,
+        hasUpstream: upstream.code === 0,
+        files: parsePorcelain(porcelain).map((entry) => ({
+            ...entry,
+            ...(stagedCounts.has(entry.path) ? { staged: stagedCounts.get(entry.path) } : {}),
+            ...(unstagedCounts.has(entry.path) ? { unstaged: unstagedCounts.get(entry.path) } : {}),
+        })),
+    });
+}
+/**
+ * One file as stored in the last commit or in the index. Reads the blob as is, without filters,
+ * so the browser compares exactly what Git holds.
+ */
+export async function readWorkspaceGitFile(root, path, ref) {
+    const rootReal = await ensureWorkspaceGit(root);
+    assertWorkspacePaths([path]);
+    const object = ref === 'HEAD' ? `HEAD:${path}` : `:${path}`;
+    const absent = gitFileContentSchema.parse({ path, ref, exists: false, binary: false, content: '' });
+    const size = await gitAllowFail(rootReal, ['cat-file', '-s', object]);
+    if (size.code !== 0)
+        return absent;
+    if (Number.parseInt(size.stdout.trim(), 10) > WORKSPACE_FILE_CONTENT_MAX) {
+        throw new GitWorkspaceError('git_file_too_large', path);
+    }
+    const blob = await gitAllowFail(rootReal, ['cat-file', 'blob', object]);
+    if (blob.code !== 0)
+        return absent;
+    // Git treats a NUL byte as the mark of binary content; so does the diff view.
+    const binary = blob.stdout.includes('\0');
+    return gitFileContentSchema.parse({ path, ref, exists: true, binary, content: binary ? '' : blob.stdout });
+}
+/** Adds the paths to the index, including deletions. */
+export async function stageWorkspaceGit(root, payload) {
+    const rootReal = await ensureWorkspaceGit(root);
+    assertWorkspacePaths(payload.paths);
+    await git(rootReal, ['--literal-pathspecs', 'add', '-A', '--', ...payload.paths]);
+}
+/** Returns the paths' index entries to the last commit, leaving the work tree alone. */
+export async function unstageWorkspaceGit(root, payload) {
+    const rootReal = await ensureWorkspaceGit(root);
+    assertWorkspacePaths(payload.paths);
+    const head = await gitAllowFail(rootReal, ['rev-parse', '--verify', '--quiet', 'HEAD']);
+    if (head.code === 0) {
+        await git(rootReal, ['--literal-pathspecs', 'restore', '--staged', '--', ...payload.paths]);
+    }
+    else {
+        // Before the first commit there is nothing to restore from; the entries are simply removed.
+        await git(rootReal, ['--literal-pathspecs', 'rm', '--cached', '-r', '-q', '--ignore-unmatch', '--', ...payload.paths]);
+    }
+}
+/**
+ * Throws away work-tree changes: tracked files return to their staged content, untracked files are
+ * deleted. Staged content is never touched, so a staged change survives a discard.
+ */
+export async function discardWorkspaceGit(root, payload) {
+    const rootReal = await ensureWorkspaceGit(root);
+    assertWorkspacePaths(payload.paths);
+    const others = await git(rootReal, ['--literal-pathspecs', 'ls-files', '--others', '--exclude-standard', '-z', '--', ...payload.paths]);
+    const untracked = new Set(others.split('\0').filter((path) => path.length > 0));
+    const tracked = payload.paths.filter((path) => !untracked.has(path));
+    if (tracked.length > 0) {
+        await git(rootReal, ['--literal-pathspecs', 'restore', '--worktree', '--', ...tracked]);
+    }
+    for (const path of untracked) {
+        const target = resolve(rootReal, path);
+        // The parent must resolve inside the workspace, so a symlinked directory cannot redirect the delete.
+        assertInsideRoot(rootReal, join(await realpath(dirname(target)), basename(target)));
+        if ((await lstat(target)).isDirectory())
+            throw new GitWorkspaceError('invalid_workspace_path', path);
+        await unlink(target);
+    }
+}
+function assertWorkspacePaths(paths) {
+    for (const relativePath of paths) {
+        if (!workspaceRelativePathSchema.safeParse(relativePath).success) {
+            throw new GitWorkspaceError('invalid_workspace_path', relativePath);
+        }
+    }
+}
+export async function readWorkspaceGitDiff(root) {
+    const rootReal = await ensureWorkspaceGit(root);
+    const vsHead = await gitAllowFail(rootReal, ['diff', '--no-color', 'HEAD']);
+    const patch = vsHead.code === 0
+        ? vsHead.stdout
+        : `${(await gitAllowFail(rootReal, ['diff', '--no-color'])).stdout}${(await gitAllowFail(rootReal, ['diff', '--no-color', '--cached'])).stdout}`;
+    if (Buffer.byteLength(patch, 'utf8') > GIT_DIFF_MAX_BYTES) {
+        throw new GitWorkspaceError('git_diff_too_large', '1MiB');
+    }
+    return gitDiffSchema.parse({ patch });
+}
+export async function readWorkspaceGitGraph(root) {
+    const rootReal = await ensureWorkspaceGit(root);
+    const log = await gitAllowFail(rootReal, ['log', '-n', '20', '--format=%H%x09%s%x09%cI']);
+    if (log.code !== 0)
+        return gitGraphSchema.parse({ commits: [] });
+    const commits = log.stdout
+        .split('\n')
+        .map((line) => line.trimEnd())
+        .filter((line) => line.length > 0)
+        .map((line) => {
+        const [sha, subject, committedAt] = splitLogLine(line);
+        return {
+            sha,
+            subject: subject.length > 0 ? subject : '(empty)',
+            committedAt: committedAt.length > 0 ? committedAt : new Date(0).toISOString(),
+        };
+    });
+    return gitGraphSchema.parse({ commits });
+}
+function splitLogLine(line) {
+    const first = line.indexOf('\t');
+    if (first < 0)
+        return [line, '', ''];
+    const second = line.indexOf('\t', first + 1);
+    if (second < 0)
+        return [line.slice(0, first), line.slice(first + 1), ''];
+    return [line.slice(0, first), line.slice(first + 1, second), line.slice(second + 1)];
+}
+/**
+ * Commit and push stay on the branch the workspace is bound to. A switch made in a shell or by an
+ * agent is reported, never followed, so work cannot land on another Remix.
+ */
+async function assertBoundBranch(rootReal, boundBranch) {
+    if (!boundBranch)
+        return;
+    const current = await gitAllowFail(rootReal, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+    const branch = current.code === 0 ? current.stdout.trim() : '';
+    if (branch !== boundBranch) {
+        throw new GitWorkspaceError('workspace_branch_mismatch', branch || 'detached HEAD');
+    }
+}
+/**
+ * A push the remote refused for this ref is a definite outcome, unlike a lost response. Porcelain
+ * output marks the ref with "!" and says whether the remote has commits this checkout lacks.
+ */
+/**
+ * The gateway or the host refused the push over HTTP before any ref changed: no write access, the
+ * gateway's writes switched off, or no such repository. Like a protected-branch refusal, nothing
+ * was pushed and the commit is kept.
+ */
+function httpRefusal(stderr) {
+    return /returned error: (?:401|403|404)\b|Authentication failed|Access denied|could not read Username|repository '[^']*' not found/i.test(stderr)
+        ? 'git_push_rejected'
+        : undefined;
+}
+function pushRejection(stdout) {
+    const line = stdout.split('\n').find((item) => item.startsWith('!\t'));
+    if (!line)
+        return undefined;
+    if (/\[rejected\] \((?:non-fast-forward|fetch first)\)/.test(line))
+        return 'git_push_remote_ahead';
+    return 'git_push_rejected';
+}
+export async function commitWorkspaceGit(root, payload, boundBranch) {
+    const rootReal = await ensureWorkspaceGit(root);
+    await assertBoundBranch(rootReal, boundBranch);
+    if (payload.stagedOnly) {
+        // The index is the commit; nothing is added.
+    }
+    else if (payload.paths && payload.paths.length > 0) {
+        assertWorkspacePaths(payload.paths);
+        await git(rootReal, ['add', '--', ...payload.paths]);
+    }
+    else {
+        await git(rootReal, ['add', '-A']);
+    }
+    const cached = await gitAllowFail(rootReal, ['diff', '--cached', '--quiet']);
+    if (cached.code === 0) {
+        throw new GitWorkspaceError('nothing_to_commit', payload.message);
+    }
+    await git(rootReal, ['commit', '-m', payload.message], 20000);
+    return (await git(rootReal, ['rev-parse', 'HEAD'])).trim();
+}
+export async function pushWorkspaceGit(root, boundBranch) {
+    const rootReal = await ensureWorkspaceGit(root);
+    await assertBoundBranch(rootReal, boundBranch);
+    const origin = await gitAllowFail(rootReal, ['remote', 'get-url', 'origin']);
+    if (origin.code !== 0) {
+        throw new GitWorkspaceError('remote_not_configured', 'origin');
+    }
+    const ref = (await git(rootReal, ['symbolic-ref', '--quiet', 'HEAD'])).trim();
+    if (!ref.startsWith('refs/heads/'))
+        throw new GitWorkspaceError('git_command_failed', 'git_branch_required');
+    const commit = (await git(rootReal, ['rev-parse', '--verify', 'HEAD^{commit}'])).trim();
+    let pushed;
+    try {
+        pushed = await gitAllowFail(rootReal, ['push', '--porcelain', 'origin', `${commit}:${ref}`], 90000);
+    }
+    catch { /* A lost response does not prove the remote rejected the update. */ }
+    if (pushed?.code === 0)
+        return;
+    const rejected = pushed ? pushRejection(pushed.stdout) ?? httpRefusal(pushed.stderr) : undefined;
+    if (rejected)
+        throw new GitWorkspaceError(rejected, rejected);
+    try {
+        const remote = await gitAllowFail(rootReal, ['ls-remote', '--refs', 'origin', ref], 20000);
+        if (remote.code === 0 && remote.stdout.trim() === `${commit}\t${ref}`)
+            return;
+    }
+    catch { /* Preserve uncertainty; never replay a write automatically. */ }
+    throw new GitWorkspaceError('git_push_outcome_unknown', 'git_push_outcome_unknown');
+}
+/**
+ * Credential files a save never commits, even when `.gitignore` misses them: env files (their
+ * `.example` / `.sample` / `.template` stay), SSH keys, netrc and Git credential stores, and key
+ * or certificate bundles.
+ */
+const CREDENTIAL_FILE = /^(?:\.env(?:\.(?!(?:example|sample|template)$)[^/]+)?|id_(?:rsa|dsa|ecdsa|ed25519)|\.netrc|\.git-credentials|[^/]*\.(?:pem|key|p12|pfx))$/i;
+export function isCredentialFile(path) {
+    return CREDENTIAL_FILE.test(path.split('/').pop() ?? '');
+}
+/**
+ * Commits every change in the work tree (`git add -A`, credential files aside) and, when asked,
+ * pushes the branch. A save with nothing new commits nothing and pushes only what the remote
+ * lacks, so a commit whose push failed goes out with the next save.
+ */
+export async function saveWorkspaceGit(root, input) {
+    const rootReal = await ensureWorkspaceGit(root);
+    await assertBoundBranch(rootReal, input.boundBranch);
+    await git(rootReal, ['add', '-A'], 60000);
+    const staged = (await git(rootReal, ['diff', '--cached', '--name-only', '-z'], 60000)).split('\0').filter(Boolean);
+    const withheld = staged.filter(isCredentialFile);
+    await unstage(rootReal, withheld);
+    const cached = await gitAllowFail(rootReal, ['diff', '--cached', '--quiet'], 60000);
+    if (cached.code !== 0 && cached.code !== 1) {
+        throw new GitWorkspaceError('git_command_failed', cached.stderr.trim() || 'git_diff_failed');
+    }
+    let commit;
+    if (cached.code === 1) {
+        await git(rootReal, [...(await commitIdentity(rootReal)), 'commit', '-q', '-m', input.message], 60000);
+        commit = (await git(rootReal, ['rev-parse', 'HEAD'])).trim();
+    }
+    if (!input.push || (await remoteHasHead(rootReal)))
+        return { ...(commit ? { commit } : {}), pushed: false, withheld };
+    await pushWorkspaceGit(rootReal, input.boundBranch);
+    await recordPushedHead(rootReal);
+    return { ...(commit ? { commit } : {}), pushed: true, withheld };
+}
+async function unstage(rootReal, paths) {
+    if (paths.length === 0)
+        return;
+    const born = (await gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD'])).code === 0;
+    for (let start = 0; start < paths.length; start += 100) {
+        const chunk = paths.slice(start, start + 100);
+        // Before the first commit there is no HEAD to reset to; dropping the entries does the same.
+        await git(rootReal, born ? ['reset', '-q', '--', ...chunk] : ['rm', '-q', '--cached', '--', ...chunk]);
+    }
+}
+/** A clone carries no committer; the sandbox image sets none either. */
+async function commitIdentity(rootReal) {
+    const email = await gitAllowFail(rootReal, ['config', 'user.email']);
+    if (email.code === 0 && email.stdout.trim())
+        return [];
+    return ['-c', 'user.name=PlayCraft Workspace', '-c', 'user.email=workspace@playcraft.local'];
+}
+/**
+ * The remote-tracking ref of the current branch. A fork clone has no fetch refspec for its own
+ * branch, so the ref is written here after a confirmed push.
+ */
+async function trackingRef(rootReal) {
+    const branch = (await gitAllowFail(rootReal, ['symbolic-ref', '--quiet', '--short', 'HEAD'])).stdout.trim();
+    return branch ? `refs/remotes/origin/${branch}` : undefined;
+}
+async function remoteHasHead(rootReal) {
+    const ref = await trackingRef(rootReal);
+    if (!ref)
+        return false;
+    const [head, tracked] = await Promise.all([
+        gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD^{commit}']),
+        gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', `${ref}^{commit}`]),
+    ]);
+    return head.code === 0 && tracked.code === 0 && head.stdout.trim() === tracked.stdout.trim();
+}
+async function recordPushedHead(rootReal) {
+    const ref = await trackingRef(rootReal);
+    if (ref)
+        await gitAllowFail(rootReal, ['update-ref', ref, 'HEAD']);
+}
+export async function ensureWorkspaceGit(root) {
+    const rootReal = await realpath(root);
+    if (!(await gitMarkerExists(rootReal))) {
+        const init = await gitAllowFail(rootReal, ['init']);
+        if (init.code !== 0) {
+            throw new GitWorkspaceError('git_command_failed', init.stderr.trim() || 'git_init_failed');
+        }
+        await git(rootReal, ['config', 'user.name', 'PlayCraft Workspace']);
+        await git(rootReal, ['config', 'user.email', 'workspace@playcraft.local']);
+    }
+    await assertWorkspaceGitRoot(rootReal);
+    await excludeFromGit(rootReal, '/.tmp/user_uploads/');
+    return rootReal;
+}
+async function gitMarkerExists(rootReal) {
+    try {
+        await stat(join(rootReal, '.git'));
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+async function assertWorkspaceGitRoot(rootReal) {
+    const marker = join(rootReal, '.git');
+    const info = await stat(marker);
+    if (info.isDirectory()) {
+        assertInsideRoot(rootReal, await realpath(marker));
+        return;
+    }
+    if (info.isFile()) {
+        const text = await readFile(marker, 'utf8');
+        const match = /^gitdir:\s*(.+)$/m.exec(text);
+        if (!match)
+            throw new GitWorkspaceError('git_root_escape', 'invalid_gitdir');
+        const target = resolve(rootReal, match[1].trim());
+        assertInsideRoot(rootReal, await realpath(target));
+        return;
+    }
+    throw new GitWorkspaceError('git_root_escape', marker);
+}
+function assertInsideRoot(rootReal, target) {
+    const rel = relative(rootReal, target);
+    if (rel === '' || rel.startsWith(`..${sep}`) || rel === '..' || rel.startsWith('..')) {
+        throw new GitWorkspaceError('git_root_escape', target);
+    }
+}
+function parsePorcelain(raw) {
+    const parts = raw.split('\0').filter((part) => part.length > 0);
+    const files = [];
+    for (let i = 0; i < parts.length; i += 1) {
+        const entry = parts[i] ?? '';
+        if (entry.length < 3)
+            continue;
+        const indexStatus = entry[0] ?? ' ';
+        const worktreeStatus = entry[1] ?? ' ';
+        const pathPart = entry.slice(3);
+        if (indexStatus === 'R' || indexStatus === 'C' || worktreeStatus === 'R' || worktreeStatus === 'C') {
+            const dest = parts[i + 1] ?? pathPart;
+            i += 1;
+            files.push({ path: dest, indexStatus, worktreeStatus });
+            continue;
+        }
+        files.push({ path: pathPart, indexStatus, worktreeStatus });
+    }
+    return files;
+}
+/**
+ * `diff --numstat -z`: `added<TAB>removed<TAB>path<NUL>`, or for a rename an empty path followed by
+ * `old<NUL>new<NUL>`. Binary files report `-` and are left out.
+ */
+function parseNumstat(raw) {
+    const counts = new Map();
+    const parts = raw.split('\0');
+    for (let index = 0; index < parts.length; index += 1) {
+        const match = /^(\d+|-)\t(\d+|-)\t(.*)$/s.exec(parts[index] ?? '');
+        if (!match)
+            continue;
+        let path = match[3];
+        if (path === '') {
+            path = parts[index + 2] ?? '';
+            index += 2;
+        }
+        if (match[1] === '-' || !path)
+            continue;
+        counts.set(path, { added: Number(match[1]), removed: Number(match[2]) });
+    }
+    return counts;
+}
+async function git(root, args, timeoutMs = 15000) {
+    const result = await gitAllowFail(root, args, timeoutMs);
+    if (result.code !== 0) {
+        throw new GitWorkspaceError('git_command_failed', result.stderr.trim() || `git_exit_${result.code}`);
+    }
+    return result.stdout;
+}
+async function gitAllowFail(root, args, timeoutMs = 15000) {
+    return runGitProcess(root, [...GIT_PREFIX, `--git-dir=${join(root, '.git')}`, `--work-tree=${root}`, ...args], timeoutMs);
+}
+function gitEnv() {
+    const env = { ...process.env };
+    delete env.GIT_DIR;
+    delete env.GIT_WORK_TREE;
+    delete env.GIT_COMMON_DIR;
+    delete env.GIT_INDEX_FILE;
+    delete env.GIT_OBJECT_DIRECTORY;
+    delete env.GIT_ALTERNATE_OBJECT_DIRECTORIES;
+    env.GIT_OPTIONAL_LOCKS = '0';
+    env.GIT_TERMINAL_PROMPT = '0';
+    return env;
+}
+function runGitProcess(cwd, args, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('git', args, { cwd, env: gitEnv(), windowsHide: true });
+        // Chunks are decoded together; a character split across two chunks would otherwise be corrupted.
+        const stdout = [];
+        const stderr = [];
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            reject(new GitWorkspaceError('git_command_failed', 'timeout'));
+        }, timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            stdout.push(Buffer.from(chunk));
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr.push(Buffer.from(chunk));
+        });
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            if (error.code === 'ENOENT') {
+                reject(new GitWorkspaceError('git_binary_missing', 'git'));
+                return;
+            }
+            reject(error);
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            resolve({
+                stdout: Buffer.concat(stdout).toString('utf8'),
+                stderr: Buffer.concat(stderr).toString('utf8'),
+                code: code ?? 1,
+            });
+        });
+    });
+}