@pugi/cli 0.1.0-alpha.9 → 0.1.0-beta.10

package/dist/core/consensus/anvil-fanout.js

@@ -0,0 +1,276 @@
+/**
+ * Anvil fan-out — `pugi review --consensus` (α6.7).
+ *
+ * Posts the captured diff to Anvil's consensus endpoint and consumes the
+ * SSE stream that interleaves per-reviewer events (`type:"verdict"`) and
+ * the final consensus event (`type:"consensus"`).
+ *
+ * Endpoint contract (admin-api side, ships as α6.7.1 follow-up):
+ *
+ *   POST {apiUrl}/api/pugi/review-consensus
+ *   Authorization: Bearer {apiKey}
+ *   Content-Type: application/json
+ *   Body: { diff, context: { branch, commit, title } }
+ *   Response: text/event-stream
+ *     data: { reviewer: "codex"|"claude"|"deepseek", type:"started" }
+ *     data: { reviewer, type:"verdict", severity:"P0|P1|P2|P3|CLEAN",
+ *             rawContent:"<reviewer text>", latencyMs, error? }
+ *     data: { type:"consensus", rubric_verdict, reasoning }
+ *
+ * The CLI side does NOT trust the server's `rubric_verdict` — we recompute
+ * it locally from the per-reviewer verdicts so a malformed / forged server
+ * cannot weaken the gate. The server-side verdict comes through as a
+ * cross-check (logged when it disagrees with the client rubric).
+ *
+ * Graceful degradation:
+ *
+ *   - 404 from runtime  → "endpoint_missing" (admin-api endpoint pending,
+ *                         α6.7 ships CLI-only). Caller falls back to the
+ *                         legacy `pugi review --triple --remote` flow OR
+ *                         prints a "backend not deployed" notice depending
+ *                         on the operator's invocation.
+ *   - 401/403 / 429     → matching status with an actionable message.
+ *   - 5xx / timeout     → "failed" with the truncated body.
+ *
+ * Local-first contract (ADR-0037): this module never touches the disk,
+ * never logs the diff payload, and never retries on transient errors.
+ */
+/**
+ * Dispatch the consensus request and stream events back through `sink`
+ * until the SSE stream closes OR a transport error occurs.
+ *
+ * Returns the collected reviewer events plus the server's final consensus
+ * event (if it sent one). The caller computes the authoritative rubric
+ * locally from the reviewer events.
+ */
+export async function dispatchConsensus(config, request, sink) {
+    const url = `${config.apiUrl.replace(/\/+$/, '')}/api/pugi/review-consensus`;
+    const controller = new AbortController();
+    // Idle timeout: aborts the request when no SSE chunk has been
+    // received for `timeoutMs`. A one-shot setTimeout from request-start
+    // would kill long-running reviewers (codex ~30s, claude ~60s) even
+    // though the server is actively streaming events every few seconds.
+    // `resetIdleTimeout` is called from `parseSseStream` on each chunk.
+    let idleTimer = null;
+    const resetIdleTimeout = () => {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => controller.abort(), config.timeoutMs);
+    };
+    resetIdleTimeout();
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'text/event-stream',
+                authorization: `Bearer ${config.apiKey}`,
+                'user-agent': 'pugi-cli-consensus/0.1.0',
+            },
+            body: JSON.stringify(request),
+            signal: controller.signal,
+        });
+        const code = res.status;
+        if (code === 404) {
+            return {
+                status: 'endpoint_missing',
+                code,
+                message: 'POST /api/pugi/review-consensus not deployed on this runtime (α6.7.1 follow-up).',
+            };
+        }
+        if (code === 401 || code === 403) {
+            return {
+                status: 'unauthenticated',
+                code,
+                message: `runtime rejected credentials (HTTP ${code})`,
+            };
+        }
+        if (code === 429) {
+            const header = res.headers.get('retry-after');
+            const retryAfterMs = header ? Number.parseInt(header, 10) * 1000 : 60_000;
+            return {
+                status: 'rate_limited',
+                code,
+                retryAfterMs: Number.isFinite(retryAfterMs) ? retryAfterMs : 60_000,
+                message: 'runtime rate limit reached for this tenant',
+            };
+        }
+        if (code !== 200) {
+            const text = await safeText(res);
+            return {
+                status: 'failed',
+                code,
+                message: `runtime returned HTTP ${code}${text ? `: ${text.slice(0, 200)}` : ''}`,
+            };
+        }
+        // 200 — consume the SSE stream. Surface a graceful failure if the
+        // body is missing (some intermediaries strip it on long-poll).
+        if (!res.body) {
+            return {
+                status: 'failed',
+                code,
+                message: 'runtime returned 200 but no SSE body',
+            };
+        }
+        const reviewerEvents = [];
+        let serverVerdict = null;
+        for await (const event of parseSseStream(res.body, resetIdleTimeout)) {
+            if (event.type === 'consensus') {
+                serverVerdict = event;
+                sink(event);
+            }
+            else {
+                reviewerEvents.push(event);
+                sink(event);
+            }
+        }
+        return { status: 'ok', serverVerdict, reviewerEvents };
+    }
+    catch (error) {
+        const message = error instanceof Error
+            ? error.name === 'AbortError'
+                ? `runtime call idle for more than ${config.timeoutMs}ms`
+                : error.message
+            : 'unknown error';
+        return { status: 'failed', code: 0, message };
+    }
+    finally {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+    }
+}
+/**
+ * Async-iterable SSE parser. Spec'd against the
+ * [HTML SSE spec](https://html.spec.whatwg.org/multipage/server-sent-events.html):
+ *
+ *   - Events are delimited by a blank line.
+ *   - Each line is `field:value` (whitespace after `:` stripped).
+ *   - Multiple `data:` lines in one event concatenate with `\n`.
+ *   - We only care about `data:` payloads carrying JSON; everything
+ *     else (event:, id:, retry:) is ignored.
+ *
+ * The parser tolerates JSON-parse failures by dropping the malformed
+ * event and continuing; a single bad event must not block the consensus
+ * gate. Errors are surfaced to the sink as an `error` reviewer event
+ * with `reviewer:"stream"`.
+ */
+export async function* parseSseStream(body, onChunk) {
+    const decoder = new TextDecoder('utf-8');
+    let buffer = '';
+    // Bridge Node ReadableStream and web ReadableStream. The web type has
+    // `getReader()`; the Node type is an `AsyncIterable<Buffer>`. Detect
+    // by feature so the parser works regardless of which fetch impl wrote
+    // the body.
+    const chunks = toAsyncIterable(body);
+    for await (const chunk of chunks) {
+        // Signal liveness so the dispatcher can reset its idle timeout. Any
+        // bytes received counts: even a heartbeat comment line keeps the
+        // connection alive from our perspective.
+        if (onChunk)
+            onChunk();
+        buffer += decoder.decode(chunk, { stream: true });
+        // SSE event boundary is a blank line. The spec allows either LF
+        // (`\n\n`) OR CRLF (`\r\n\r\n`). nginx, CDNs, and some load
+        // balancers rewrite to CRLF, so we accept both and find whichever
+        // delimiter appears first in the buffer.
+        let boundary = findNextEventBoundary(buffer);
+        while (boundary !== null) {
+            const rawEvent = buffer.slice(0, boundary.start);
+            buffer = buffer.slice(boundary.end);
+            const parsed = parseSseEvent(rawEvent);
+            if (parsed)
+                yield parsed;
+            boundary = findNextEventBoundary(buffer);
+        }
+    }
+    // Flush trailing event if the server omitted the final blank line.
+    const tail = buffer.trim();
+    if (tail.length > 0) {
+        const parsed = parseSseEvent(tail);
+        if (parsed)
+            yield parsed;
+    }
+}
+/**
+ * Find the next SSE event boundary in `buffer`. Returns the start
+ * index of the delimiter and the index where the next event begins,
+ * or `null` if no complete boundary has been buffered yet.
+ *
+ * Accepts both `\n\n` (Unix-style streams) and `\r\n\r\n` (CRLF, as
+ * emitted by nginx, Cloudflare, and some Node intermediaries). Picks
+ * whichever appears FIRST so a stream that mixes both styles parses
+ * deterministically.
+ */
+function findNextEventBoundary(buffer) {
+    const lfIdx = buffer.indexOf('\n\n');
+    const crlfIdx = buffer.indexOf('\r\n\r\n');
+    if (lfIdx === -1 && crlfIdx === -1)
+        return null;
+    if (crlfIdx === -1)
+        return { start: lfIdx, end: lfIdx + 2 };
+    if (lfIdx === -1)
+        return { start: crlfIdx, end: crlfIdx + 4 };
+    if (lfIdx < crlfIdx)
+        return { start: lfIdx, end: lfIdx + 2 };
+    return { start: crlfIdx, end: crlfIdx + 4 };
+}
+function parseSseEvent(raw) {
+    const dataLines = [];
+    for (const line of raw.split(/\r?\n/)) {
+        // The SSE spec strips one leading space after the colon if present.
+        // We do the same so payloads written `data: {...}` parse correctly.
+        if (!line.startsWith('data:'))
+            continue;
+        const value = line.slice('data:'.length);
+        dataLines.push(value.startsWith(' ') ? value.slice(1) : value);
+    }
+    if (dataLines.length === 0)
+        return null;
+    const payload = dataLines.join('\n').trim();
+    if (payload.length === 0)
+        return null;
+    try {
+        const parsed = JSON.parse(payload);
+        if (parsed && typeof parsed === 'object' && typeof parsed['type'] === 'string') {
+            // Trust shape coming from the server enough to forward it; the
+            // command handler treats unknown fields defensively.
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function toAsyncIterable(body) {
+    // Web ReadableStream → iterate via reader.read() loop bridged to async-iter.
+    if (typeof body.getReader === 'function') {
+        return webStreamToAsyncIterable(body);
+    }
+    // Node Readable: already async-iterable.
+    return body;
+}
+async function* webStreamToAsyncIterable(stream) {
+    const reader = stream.getReader();
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                return;
+            if (value)
+                yield value;
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+async function safeText(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=anvil-fanout.js.map

package/dist/core/consensus/diff-capture.js

@@ -0,0 +1,382 @@
+/**
+ * Diff capture — `pugi review --consensus` (α6.7).
+ *
+ * Captures the diff that the consensus fan-out will send to Anvil. Four
+ * supported source kinds (in order of precedence):
+ *
+ *   1. `--pr <number>`    — uses `gh pr diff <num>` (gh CLI required).
+ *   2. `--commit <sha>`   — diff of that commit vs its first parent.
+ *   3. `--branch <name>`  — diff of HEAD vs `origin/<name>` merge-base.
+ *   4. (default)          — diff of HEAD vs `origin/main` merge-base
+ *                           covering BOTH committed-since-base AND
+ *                           uncommitted (staged + working tree) edits.
+ *
+ * The shape mirrors the existing `performRemoteTripleReview` flow:
+ * uncommitted edits are deliberately included by computing the diff
+ * against the merge-base SHA rather than `base...HEAD`, otherwise the
+ * common case ("review what I'm about to commit") would lose signal.
+ *
+ * Protected paths (`.env*`, `*.key`, `*.pem`, `*.sql` etc) are excluded
+ * at the git layer so a secret cannot leak into the egress payload even
+ * if the operator has it staged.
+ */
+import { execFileSync } from 'node:child_process';
+/**
+ * Hard cap on the diff payload sent egress. Anvil enforces its own cap
+ * server-side; this is a defense-in-depth so a runaway monorepo merge
+ * doesn't OOM the SSE encoder. 1 MiB ≈ 30k LOC, which is well above the
+ * largest review the rubric can reason about.
+ */
+export const DIFF_MAX_BYTES = 1 * 1024 * 1024;
+/**
+ * Git pathspec exclusions for sensitive blobs. This is the source of truth
+ * for both the consensus surface AND the legacy `PROTECTED_DIFF_EXCLUDES`
+ * in cli.ts; keep both lists in sync when adding new patterns.
+ *
+ * Coverage policy: a credential committed under ANY plausible filename
+ * pattern must be excluded. Adversarial PRs can stage secrets under
+ * unconventional names (deploy.crt, credentials, .netrc) to bypass a
+ * narrow exclude list and exfiltrate to the reviewer payload.
+ *
+ * Pathspec form `:(exclude,glob)<starstar>/<pattern>` (where `<starstar>`
+ * is the `*` `*` doubled glob) matches at the repo root AND in any
+ * subdirectory; without the doubled-star prefix git's literal pathspec
+ * syntax silently misses subdir matches in pnpm/turbo monorepos.
+ */
+export const PROTECTED_PATHSPEC_EXCLUDES = Object.freeze([
+    // Dotfiles + RC files that frequently hold tokens.
+    ':(exclude,glob)**/.env',
+    ':(exclude,glob)**/.env.*',
+    ':(exclude,glob)**/.npmrc',
+    ':(exclude,glob)**/.yarnrc',
+    ':(exclude,glob)**/.pypirc',
+    ':(exclude,glob)**/.gitconfig',
+    ':(exclude,glob)**/.netrc',
+    // SSH private keys (every algorithm we have seen committed in the wild).
+    ':(exclude,glob)**/id_rsa',
+    ':(exclude,glob)**/id_ed25519',
+    ':(exclude,glob)**/id_ecdsa',
+    ':(exclude,glob)**/id_dsa',
+    // PEM-encoded + DER-encoded private keys / certs / containers.
+    ':(exclude,glob)**/*.pem',
+    ':(exclude,glob)**/*.key',
+    ':(exclude,glob)**/*.crt',
+    ':(exclude,glob)**/*.cer',
+    ':(exclude,glob)**/*.der',
+    ':(exclude,glob)**/*.pfx',
+    ':(exclude,glob)**/*.p12',
+    // SQL dumps / DB exports often contain real PII + credentials.
+    ':(exclude,glob)**/*.dump',
+    ':(exclude,glob)**/*.sql',
+    // Generic credential blobs under any directory.
+    ':(exclude,glob)**/*.secret',
+    ':(exclude,glob)**/credentials',
+    ':(exclude,glob)**/credentials.json',
+    // `secrets/**` (not `secrets/*`) so nested credential paths recurse:
+    // `secrets/prod/token.txt`, `apps/foo/secrets/nested/key`, and any
+    // arbitrarily deep `**/secrets/<...>/<file>` get excluded. With glob
+    // pathspec magic enabled, a single `*` does NOT cross path separators,
+    // so the non-recursive form would leak nested-directory secrets.
+    ':(exclude,glob)**/secrets/**',
+]);
+/**
+ * Captures the diff per the source spec and returns the augmented payload
+ * plus narrative context (branch, commit, title) that gets attached to
+ * the egress request.
+ *
+ * Errors are returned as thrown `Error` instances; the caller (the
+ * command handler) translates them to JSON error payloads + exit codes
+ * so the CLI never crashes on a malformed ref.
+ */
+export function captureDiff(spec) {
+    const cwd = spec.cwd ?? process.cwd();
+    // Source precedence: pr > commit > branch > default.
+    if (typeof spec.pr === 'number' && Number.isFinite(spec.pr) && spec.pr > 0) {
+        return captureFromPr(cwd, spec.pr);
+    }
+    if (typeof spec.commit === 'string' && spec.commit.length > 0) {
+        return captureFromCommit(cwd, spec.commit);
+    }
+    if (typeof spec.branch === 'string' && spec.branch.length > 0) {
+        return captureFromBranch(cwd, spec.branch, spec.baseRef ?? 'origin/main');
+    }
+    return captureFromBase(cwd, spec.baseRef ?? 'origin/main');
+}
+function captureFromPr(cwd, pr) {
+    // CRITICAL: `gh pr diff <num>` bypasses PROTECTED_PATHSPEC_EXCLUDES,
+    // exfiltrating `.env`, `*.key`, `*.pem`, `*.sql`, secrets/* to the
+    // reviewer payload. We instead fetch the PR head ref locally and run
+    // `git diff` with the same pathspec excludes as every other capture
+    // path. PR metadata still comes from `gh pr view` (read-only).
+    const metaRaw = safeExec(cwd, 'gh', ['pr', 'view', String(pr), '--json', 'title,headRefName,headRefOid,baseRefName']);
+    const meta = safeParseJson(metaRaw);
+    const tempRef = `refs/pugi/consensus-pr-${pr}`;
+    // Fetch the PR head into a private ref so we have local objects to
+    // diff against. `pull/<num>/head` is GitHub's special refspec exposed
+    // to anyone with read access on the repo.
+    safeExec(cwd, 'git', ['fetch', 'origin', `pull/${pr}/head:${tempRef}`]);
+    try {
+        // Resolve the base ref to diff against. Prefer the PR's declared
+        // base; fall back to `origin/main`. We compute the merge-base so a
+        // PR that's behind main still shows only the author's hunks.
+        const baseRef = meta?.baseRefName ? `origin/${meta.baseRefName}` : 'origin/main';
+        const mergeBase = safeExecOptional(cwd, 'git', ['merge-base', baseRef, tempRef]).trim();
+        const range = mergeBase ? `${mergeBase}..${tempRef}` : `${baseRef}..${tempRef}`;
+        const diff = safeExec(cwd, 'git', [
+            'diff',
+            range,
+            '--',
+            '.',
+            ...PROTECTED_PATHSPEC_EXCLUDES,
+        ]);
+        const cappedDiff = capDiff(diff);
+        const stats = computeStats(cappedDiff);
+        return {
+            diff: cappedDiff,
+            context: {
+                branch: meta?.headRefName ?? `pr-${pr}`,
+                commit: shortSha(meta?.headRefOid ?? ''),
+                title: meta?.title ?? `PR #${pr}`,
+                ref: `pr:${pr}`,
+                stats,
+            },
+        };
+    }
+    finally {
+        // Best-effort cleanup of the private ref. Never throw from the
+        // cleanup path so the operator's primary error (if any) reaches them.
+        try {
+            safeExec(cwd, 'git', ['update-ref', '-d', tempRef]);
+        }
+        catch {
+            // Swallow: a leftover ref under refs/pugi/ is harmless. The next
+            // run will overwrite it via `fetch ... :ref` anyway.
+        }
+    }
+}
+function captureFromCommit(cwd, commit) {
+    // `<sha>~1..<sha>` covers exactly that commit's changes. For a ROOT
+    // commit (no parent) the `~1` lookup explodes and produces an empty
+    // diff masquerading as success. Detect this up front and fall back
+    // to the git empty-tree sha so the first commit's introduction shows
+    // up in the diff.
+    const fullSha = safeExec(cwd, 'git', ['rev-parse', commit]).trim();
+    if (!fullSha)
+        throw new Error(`Unknown commit ref: ${commit}`);
+    // Probe for a parent. `rev-parse --verify <sha>~1` exits non-zero on
+    // a root commit; we treat that as "diff against the empty tree".
+    const hasParent = safeExecOptional(cwd, 'git', ['rev-parse', '--verify', `${fullSha}~1`]).trim().length > 0;
+    // The well-known git "empty tree" SHA. Stable across all git versions
+    // since 2005; documented in `git hash-object -t tree /dev/null`.
+    const EMPTY_TREE_SHA = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
+    const range = hasParent ? `${fullSha}~1..${fullSha}` : `${EMPTY_TREE_SHA}..${fullSha}`;
+    const diff = safeExec(cwd, 'git', [
+        'diff',
+        range,
+        '--',
+        '.',
+        ...PROTECTED_PATHSPEC_EXCLUDES,
+    ]);
+    const cappedDiff = capDiff(diff);
+    const subject = safeExec(cwd, 'git', ['log', '-1', '--pretty=%s', fullSha]).trim();
+    const branch = safeExec(cwd, 'git', ['name-rev', '--name-only', fullSha]).trim() || 'detached';
+    const stats = computeStats(cappedDiff);
+    return {
+        diff: cappedDiff,
+        context: {
+            branch,
+            commit: shortSha(fullSha),
+            title: subject || `commit ${shortSha(fullSha)}`,
+            ref: `commit:${shortSha(fullSha)}`,
+            stats,
+        },
+    };
+}
+function captureFromBranch(cwd, branch, baseRef) {
+    const remoteRef = branch.includes('/') ? branch : `origin/${branch}`;
+    const mergeBase = safeExec(cwd, 'git', ['merge-base', baseRef, remoteRef]).trim();
+    if (!mergeBase)
+        throw new Error(`Cannot compute merge-base of ${baseRef} and ${remoteRef}`);
+    const diff = safeExec(cwd, 'git', [
+        'diff',
+        `${mergeBase}..${remoteRef}`,
+        '--',
+        '.',
+        ...PROTECTED_PATHSPEC_EXCLUDES,
+    ]);
+    const cappedDiff = capDiff(diff);
+    const head = safeExec(cwd, 'git', ['rev-parse', remoteRef]).trim();
+    const subject = safeExec(cwd, 'git', ['log', '-1', '--pretty=%s', remoteRef]).trim();
+    const stats = computeStats(cappedDiff);
+    return {
+        diff: cappedDiff,
+        context: {
+            branch,
+            commit: shortSha(head),
+            title: subject || `branch ${branch}`,
+            ref: `branch:${branch}`,
+            stats,
+        },
+    };
+}
+function captureFromBase(cwd, baseRef) {
+    // The default surface — diff HEAD against the merge-base of the
+    // protected base. When the merge-base lookup fails (shallow clone,
+    // no upstream, baseRef not configured), fall back to the working-tree
+    // diff so the consensus gate still has signal rather than crashing.
+    const mergeBase = safeExecOptional(cwd, 'git', ['merge-base', baseRef, 'HEAD']).trim();
+    if (mergeBase) {
+        // Two parts (non-overlapping):
+        //   1. Committed since base:  `<base>..HEAD`
+        //   2. Uncommitted (staged + working tree as a single union): `git diff HEAD`
+        // `git diff HEAD` already reports BOTH staged AND working-tree
+        // changes relative to HEAD, so we MUST NOT add a separate
+        // `--cached` invocation: doing so emits the same staged hunks
+        // twice, inflating reviewer cost and confusing the rubric on
+        // duplicate-finding correlation.
+        const committedDiff = safeExec(cwd, 'git', [
+            'diff',
+            `${mergeBase}..HEAD`,
+            '--',
+            '.',
+            ...PROTECTED_PATHSPEC_EXCLUDES,
+        ]);
+        const uncommittedDiff = safeExec(cwd, 'git', [
+            'diff',
+            'HEAD',
+            '--',
+            '.',
+            ...PROTECTED_PATHSPEC_EXCLUDES,
+        ]);
+        const combined = [committedDiff, uncommittedDiff]
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0)
+            .join('\n');
+        const cappedDiff = capDiff(combined);
+        const branch = safeExec(cwd, 'git', ['branch', '--show-current']).trim() || 'detached';
+        const head = safeExec(cwd, 'git', ['rev-parse', 'HEAD']).trim();
+        const subject = safeExec(cwd, 'git', ['log', '-1', '--pretty=%s', 'HEAD']).trim();
+        const stats = computeStats(cappedDiff);
+        return {
+            diff: cappedDiff,
+            context: {
+                branch,
+                commit: shortSha(head),
+                title: subject || branch,
+                ref: `merge-base:${baseRef}`,
+                stats,
+            },
+        };
+    }
+    // Fallback path: no merge-base available. `git diff HEAD` reports
+    // BOTH staged AND working-tree changes relative to HEAD in a single
+    // unified diff, so it's the right one-shot capture for "what would I
+    // commit if I ran `git add -A && git commit` right now". A separate
+    // `--cached` call would double-report the staged hunks.
+    const cappedDiff = capDiff(safeExec(cwd, 'git', ['diff', 'HEAD', '--', '.', ...PROTECTED_PATHSPEC_EXCLUDES]));
+    const branch = safeExec(cwd, 'git', ['branch', '--show-current']).trim() || 'detached';
+    const head = safeExec(cwd, 'git', ['rev-parse', 'HEAD']).trim();
+    const subject = safeExec(cwd, 'git', ['log', '-1', '--pretty=%s', 'HEAD']).trim();
+    const stats = computeStats(cappedDiff);
+    return {
+        diff: cappedDiff,
+        context: {
+            branch,
+            commit: shortSha(head),
+            title: subject || branch,
+            ref: 'head-only',
+            stats,
+        },
+    };
+}
+/**
+ * Non-throwing variant of `safeExec`. Returns an empty string on
+ * non-zero exit instead of throwing. Used for the optional `merge-base`
+ * lookup which fails legitimately in shallow clones / no-upstream setups.
+ */
+function safeExecOptional(cwd, file, args) {
+    try {
+        return safeExec(cwd, file, args);
+    }
+    catch {
+        return '';
+    }
+}
+/** Compute file / insertion / deletion counts from a unified diff. */
+function computeStats(diff) {
+    let filesChanged = 0;
+    let insertions = 0;
+    let deletions = 0;
+    for (const line of diff.split(/\r?\n/)) {
+        if (line.startsWith('diff --git '))
+            filesChanged += 1;
+        else if (line.startsWith('+') && !line.startsWith('+++'))
+            insertions += 1;
+        else if (line.startsWith('-') && !line.startsWith('---'))
+            deletions += 1;
+    }
+    return { filesChanged, insertions, deletions };
+}
+/**
+ * Truncate the diff if it grows past `DIFF_MAX_BYTES`. Truncation is
+ * marked with a sentinel comment so reviewers see the cap explicitly
+ * instead of silently reasoning over a partial patch.
+ */
+function capDiff(diff) {
+    // `Buffer.byteLength` is required — `.length` counts UTF-16 code units
+    // and underestimates multi-byte sequences common in diffs that touch
+    // i18n / cyrillic content.
+    if (Buffer.byteLength(diff, 'utf8') <= DIFF_MAX_BYTES)
+        return diff;
+    // Slice by code units, then re-check byte length. UTF-8 is variable-
+    // width, so 1 MiB of code units can exceed the cap; iterate until it
+    // fits. Two passes is the worst case for any reasonable input.
+    let slice = diff.slice(0, DIFF_MAX_BYTES);
+    while (Buffer.byteLength(slice, 'utf8') > DIFF_MAX_BYTES && slice.length > 0) {
+        slice = slice.slice(0, slice.length - 1024);
+    }
+    return `${slice}\n\n# [pugi-cli] diff truncated at ${DIFF_MAX_BYTES} bytes; reviewers see a partial patch.\n`;
+}
+function shortSha(sha) {
+    if (!sha)
+        return '';
+    return sha.length > 7 ? sha.slice(0, 7) : sha;
+}
+/**
+ * Wrapper around `execFileSync` that returns stdout as a UTF-8 string,
+ * swallows stderr, and throws with a stable shape on non-zero exit.
+ *
+ * The `execFileSync` form avoids shell injection (no shell process is
+ * spawned), which matters because we pass user-supplied refs / branch
+ * names into the command line.
+ */
+function safeExec(cwd, file, args) {
+    try {
+        const out = execFileSync(file, args, {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            // 32 MiB buffer — covers the worst-case PR diff before our 1 MiB
+            // cap kicks in. The cap is applied after capture so we can report
+            // truncation honestly.
+            maxBuffer: 32 * 1024 * 1024,
+            encoding: 'utf8',
+        });
+        // Specifying `encoding: 'utf8'` narrows the return type to string,
+        // but TS still types `out` as `string` always here — defensively
+        // coerce via `String()` to satisfy lint without an `as` cast.
+        return String(out);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`${file} ${args.slice(0, 2).join(' ')} failed: ${message.split('\n')[0]}`);
+    }
+}
+function safeParseJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=diff-capture.js.map