@stigmer/runner 3.1.2 → 3.1.4

package/src/shared/filereview/capture.ts

@@ -77,6 +77,7 @@ import {
   type CasPathCapture,
   type CasSnapshotRef,
 } from "./cas-substrate.js";
+import { isSecretLikePath } from "./secret-paths.js";
 
 /**
  * Whether a turn runs in apply-then-review CAPTURE mode (file edits flow and are
@@ -244,21 +245,41 @@ export async function captureCandidateToLedger(opts: {
 
   const unreviewable = unreviewablePaths ?? [];
 
+  // Secret handling is three-way across the substrates, and this is the last of
+  // the three (the other two happen upstream at the harness gate):
+  //   1. A gitignored secret WRITE never flows — hard-blocked at the gate /
+  //      deny-gate (DD-12/DD-30). It arrives here only as a path in
+  //      `unreviewablePaths` (recorded by the gate), authored content-less below.
+  //   2. A gitignored secret that flowed under the global bypass is withheld from
+  //      CAS by `partitionIgnoredPathsBySecret` (secret-paths.ts), so its bytes
+  //      never reach `casCaptures`.
+  //   3. A git-TRACKED secret DID flow (the capture-mode gate allows tracked
+  //      mutations with no secret check) and is present in `gitChanges` with real
+  //      bytes. We split it out here and author it content-less, so its content
+  //      never reaches the ledger. Unlike a gitignored secret it HAS a reversible
+  //      substrate (the git refs), so it is withheld-and-reverted rather than
+  //      never-applied — same never-persisted guarantee, appropriate mechanism.
+  const { safe: safeGitChanges, secret: secretGitChanges } =
+    partitionGitChangesBySecret(gitChanges);
+
   // A turn that changed nothing (no tracked/ignored change and no blocked path)
-  // authors no event.
+  // authors no event. A secret-only tracked turn is NOT a no-op — its file is in
+  // `gitChanges`, so the guard below is false and it authors a blocked entry.
   if (gitChanges.length === 0 && casFiles.length === 0 && unreviewable.length === 0) {
     return gitChanges;
   }
 
-  // One combined change set: git-tracked (inline bodies) + CAS (blob refs) +
-  // secret-blocked (content-less, DIFF_UNREVIEWABLE). The aggregate digest folds
-  // all (buildCandidateCapturedEvent sorts by file digest), so the reviewed diff
-  // and its identity span every substrate. deriveDiffCompleteness then rolls the
-  // per-file signals up three ways: any content-less (non-binary) entry forces
-  // PARTIAL_BLOCKED; a set blocked only by binaries is BINARY_SUMMARY_ONLY
-  // (keepable in one acknowledged action); else COMPLETE.
+  // One combined change set: git-tracked (inline bodies) + git-tracked-secret
+  // (content-less) + CAS (blob refs) + gitignored-secret-blocked (content-less).
+  // The aggregate digest folds all (buildCandidateCapturedEvent sorts by file
+  // digest), so the reviewed diff and its identity span every substrate.
+  // deriveDiffCompleteness then rolls the per-file signals up three ways: any
+  // content-less (non-binary) entry forces PARTIAL_BLOCKED; a set blocked only by
+  // binaries is BINARY_SUMMARY_ONLY (keepable in one acknowledged action); else
+  // COMPLETE.
   const captured = [
-    ...gitChanges.map((c) => buildCapturedFileChange(toCapturedChangeInput(changeSetId, c))),
+    ...safeGitChanges.map((c) => buildCapturedFileChange(toCapturedChangeInput(changeSetId, c))),
+    ...secretGitChanges.map((c) => buildCapturedFileChange(trackedSecretChangeInput(changeSetId, c))),
     ...casFiles.map((f) => buildCapturedFileChange(casToCapturedChangeInput(changeSetId, f))),
     ...unreviewable.map((p) => buildCapturedFileChange(unreviewableChangeInput(changeSetId, p, unreviewableCaptureClass))),
   ];
@@ -622,7 +643,9 @@ function candidateCasRef(changeSet: FileChangeSet): CasSnapshotRef | undefined {
  * after bodies are carried as blob REFS (already offloaded to artifact storage
  * by the CAS substrate), never re-inlined — so the CANDIDATE event stays small
  * and the bytes are stored exactly once. Enforcement digests come from the blob
- * content addresses, identical in form to the git path.
+ * content addresses, identical in form to the git path. The display line counts
+ * ride along explicitly — a ref side has no inline text for the producer to
+ * count, so the substrate's capture-time counts are the only honest source.
  */
 function casToCapturedChangeInput(
   changeSetId: string,
@@ -634,6 +657,7 @@ function casToCapturedChangeInput(
     pathAfter: file.pathAfter,
     kind: file.kind,
     captureClass: file.captureClass,
+    lineCounts: file.lineCounts,
     before: file.before
       ? {
           kind: "ref",
@@ -657,37 +681,117 @@ function casToCapturedChangeInput(
 }
 
 /**
- * Map a secret-blocked gitignored path to a content-less producer input (design
- * doc 12, DD-E). The bytes are deliberately never captured, so both sides are
- * absent (empty enforcement digests) and `diffComplete=false`. Being non-binary
- * incomplete with no keepable bytes, it forces the change set to PARTIAL_BLOCKED
- * (never BINARY_SUMMARY_ONLY) — approval is blocked and the path is surfaced
- * honestly, while its CONTENT never enters the ledger or storage. `blockedReason` records
- * the honest cause (SECRET_WITHHELD) so the review UI can say *why* rather than
- * showing a cause-agnostic "unavailable" (doc 15). Kind is MODIFY: the write was
- * blocked before it ran, so create-vs-modify is unknown and irrelevant (nothing
- * is ever applied or reconciled for this entry). `captureClass` is the turn's CAS
- * substrate class (GIT_IGNORED_CAPTURED | NON_GIT_CAS) so the blocked path is
- * labeled with its true provenance.
+ * The single content-less `SECRET_WITHHELD` producer input — the one shape every
+ * secret-blocked change (gitignored OR git-tracked) is authored with, so the two
+ * producers can never drift (a divergence in `diffComplete`/`blockedReason` would
+ * make the backend gate treat one kind of secret differently from the other).
+ *
+ * Both sides are absent (empty enforcement digests) and `diffComplete=false`.
+ * Being non-binary incomplete with no keepable bytes, it forces the change set to
+ * PARTIAL_BLOCKED (never BINARY_SUMMARY_ONLY) — approval is blocked and the path
+ * is surfaced honestly, while its CONTENT never enters the ledger or storage.
+ * `blockedReason=SECRET_WITHHELD` records the honest cause so the review UI can say
+ * *why* rather than a cause-agnostic "unavailable" (doc 15). Callers supply the
+ * id / paths / kind / captureClass so each producer keeps its own honest identity.
  */
-function unreviewableChangeInput(
-  changeSetId: string,
-  path: string,
+function secretWithheldChangeInput(
+  id: string,
+  pathBefore: string,
+  pathAfter: string,
+  kind: FileChangeKind,
   captureClass: FileCaptureClass,
 ): CapturedChangeInput {
   return {
-    id: `${changeSetId}:${path}`,
-    pathBefore: path,
-    pathAfter: path,
-    kind: FileChangeKind.MODIFY,
+    id,
+    pathBefore,
+    pathAfter,
+    kind,
     captureClass,
     diffComplete: false,
     blockedReason: FileReviewBlockReason.SECRET_WITHHELD,
   };
 }
 
+/**
+ * Map a secret-blocked GITIGNORED path (the write never flowed — hard-blocked at
+ * the harness gate, design doc 12 / DD-E) to a content-less entry. The write was
+ * blocked before it ran, so create-vs-modify is unknown and irrelevant (nothing
+ * is ever applied or reconciled for this entry) — kind is MODIFY. `captureClass`
+ * is the turn's CAS substrate class (GIT_IGNORED_CAPTURED | NON_GIT_CAS).
+ */
+function unreviewableChangeInput(
+  changeSetId: string,
+  path: string,
+  captureClass: FileCaptureClass,
+): CapturedChangeInput {
+  return secretWithheldChangeInput(
+    `${changeSetId}:${path}`,
+    path,
+    path,
+    FileChangeKind.MODIFY,
+    captureClass,
+  );
+}
+
+/**
+ * Map a secret-like GIT-TRACKED change to a content-less entry (DD-26 follow-up
+ * #3). Unlike a gitignored secret, a tracked secret write actually FLOWED (the
+ * capture-mode gate allows tracked mutations), so it is present in the git diff
+ * with real bytes — which must never be persisted into the ledger. We author it
+ * content-less here so its CONTENT never reaches the ledger / Temporal history /
+ * storage, while the honest kind + paths (a CREATE/MODIFY/DELETE, mirroring
+ * {@link toCapturedChangeInput}'s id/path derivation so the resume reconcile
+ * lookup matches) and `GIT_TRACKED` provenance are preserved. It is discard-only
+ * (PARTIAL_BLOCKED): on resume it can only be rejected, and the git substrate
+ * reverts it byte-exact from the baseline ref (the reversible substrate a
+ * gitignored secret lacks — so "withhold + revert" upholds never-persisted here
+ * without the gate hard-block). A DELETE is handled here too: the git diff
+ * resurrects the deleted file's baseline (secret) bytes as the `before` side, a
+ * leak only this seam can withhold (the gate sees no content for a delete).
+ */
+function trackedSecretChangeInput(
+  changeSetId: string,
+  change: GitCapturedChange,
+): CapturedChangeInput {
+  const isCreate = change.changeType === FileChangeType.CREATE;
+  const isDelete = change.changeType === FileChangeType.DELETE;
+  const pathBefore = isCreate ? "" : change.path;
+  const pathAfter = isDelete ? "" : change.path;
+  return secretWithheldChangeInput(
+    `${changeSetId}:${pathAfter || pathBefore}`,
+    pathBefore,
+    pathAfter,
+    toFileChangeKind(change.changeType),
+    FileCaptureClass.GIT_TRACKED,
+  );
+}
+
+/**
+ * Split a turn's git-tracked changes by the secret gate: a secret-like tracked
+ * path (a committed `credentials.json`, `.env.example`, `*.tfvars`, ...) goes to
+ * `secret` (authored content-less via {@link trackedSecretChangeInput}); every
+ * other tracked change stays in `safe` (its diff is captured normally). Pure and
+ * exported for direct unit testing. Keyed on the same {@link isSecretLikePath}
+ * classifier the CAS/gitignored path uses ({@link partitionIgnoredPathsBySecret}
+ * in secret-paths.ts), so a path is classified identically everywhere. NOTE: the
+ * classifier is path-based (DD-12 D2), so a rename to an innocuous name defeats
+ * it — an intentional, cross-substrate limitation, not introduced here.
+ */
+export function partitionGitChangesBySecret(changes: readonly GitCapturedChange[]): {
+  readonly safe: readonly GitCapturedChange[];
+  readonly secret: readonly GitCapturedChange[];
+} {
+  const safe: GitCapturedChange[] = [];
+  const secret: GitCapturedChange[] = [];
+  for (const change of changes) {
+    if (isSecretLikePath(change.path)) secret.push(change);
+    else safe.push(change);
+  }
+  return { safe, secret };
+}
+
 /** Map the git capture kind to the file-review {@link FileChangeKind}. */
-function toFileChangeKind(changeType: FileChangeType): FileChangeKind {
+export function toFileChangeKind(changeType: FileChangeType): FileChangeKind {
   switch (changeType) {
     case FileChangeType.CREATE:
       return FileChangeKind.ADD;

package/src/shared/filereview/cas-progress.ts

@@ -0,0 +1,170 @@
+/**
+ * Mid-run progress substrate for the CAS (content-addressed) domain — the
+ * non-git and gitignored half of DD-33. The git substrate ({@link ./progress.js}
+ * `createGitProgressSubstrate`) covers git-tracked changes cheaply via
+ * `--numstat`; this covers the paths git cannot see, sourced from the same
+ * per-turn observer the turn-boundary CAS capture reads:
+ *  - a non-git workspace: EVERY tool-mediated write (the whole change set), and
+ *  - a git tree's gitignored writes (the CAS half of a HYBRID turn).
+ *
+ * COST MODEL (why this is not as cheap as git)
+ * --------------------------------------------
+ * `git --numstat` yields exact `+N −M` with zero byte reads; CAS has no such free
+ * lunch — kind, no-op exclusion, and counts all need the after-bytes. So we bound
+ * the work: only the sorted read-PREFIX (up to {@link PROGRESS_MAX_ENTRIES}) has
+ * its after-bytes read and counted; the tail contributes to `totalFilesChanged`
+ * (the honest count) only. `files_changed` is therefore net-exact for a normal
+ * turn (≤ the budget) and an upper bound beyond it — matching git where git is
+ * free, diverging only where the substrate cannot be. A `size+mtime` signature
+ * (the stats are collected anyway) short-circuits an unchanged capture.
+ *
+ * CONSISTENCY & SECRET SAFETY
+ * ---------------------------
+ * Counts come from {@link classifyCasChange} — the SAME classifier the reviewed
+ * set uses — so the strip and the change set never disagree. Secret-like paths
+ * are excluded up front via {@link partitionIgnoredPathsBySecret} (and zeroed
+ * again in `buildFileChangeProgress` as a backstop); no file bodies are ever
+ * carried on the wire. Only tool-mediated writes are observed, exactly the scope
+ * of the non-git / HYBRID turn-boundary capture — no new divergence.
+ *
+ * @since File-Change HITL Redesign (non-git + hybrid mid-run progress / DD-33)
+ */
+
+import { readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { FileChangeKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { classifyCasChange } from "./cas-substrate.js";
+import { LINE_COUNT_MAX_BYTES } from "./line-counts.js";
+import {
+  PROGRESS_MAX_ENTRIES,
+  type ProgressCapture,
+  type ProgressDelta,
+  type ProgressEntry,
+  type ProgressSubstrate,
+} from "./progress.js";
+import { partitionIgnoredPathsBySecret } from "./secret-paths.js";
+
+/**
+ * A snapshot of the turn's CAS-observed paths, read on each capture:
+ *  - `before`: first-touched paths' pre-turn bytes (`null` = the path did not
+ *    exist before → an ADD). The KEYS are the touched-path set.
+ *  - `blockedSecretPaths`: paths the gate hard-blocked as secret-like — excluded
+ *    from capture.
+ *
+ * Deep-agent supplies a synchronous copy of its live `CasCaptureObserver`; Cursor
+ * supplies a reader over the hook's on-disk sidecar. The reader MUST return an
+ * atomic snapshot (copy the live map before any await) so a concurrent sub-agent
+ * write cannot mutate it mid-capture.
+ */
+export interface CasTouchedSnapshot {
+  readonly before: ReadonlyMap<string, Uint8Array | null>;
+  readonly blockedSecretPaths: ReadonlySet<string>;
+}
+
+/** Produces a {@link CasTouchedSnapshot} for one capture. */
+export type CasTouchedReader = () => CasTouchedSnapshot | Promise<CasTouchedSnapshot>;
+
+/**
+ * The CAS progress substrate. Reads the touched set on each capture, computes
+ * kind + `+N −M` for the bounded read-prefix via {@link classifyCasChange}, and
+ * reports `totalFilesChanged` over the full capturable set. Owns a `size+mtime`
+ * signature so an unchanged capture returns `changed:false` (the cached delta is
+ * reused, letting the hybrid still merge it with a changed git slice).
+ */
+export function createCasProgressSubstrate(opts: {
+  readonly workspaceRoot: string;
+  readonly read: CasTouchedReader;
+  /** Read budget / display cap; defaults to {@link PROGRESS_MAX_ENTRIES}. Injectable for tests. */
+  readonly maxEntries?: number;
+}): ProgressSubstrate {
+  const maxEntries = opts.maxEntries ?? PROGRESS_MAX_ENTRIES;
+  let cachedFull: ProgressDelta = { entries: [], totalFilesChanged: 0 };
+  let lastSignature: string | undefined;
+
+  return {
+    async capture(): Promise<ProgressCapture> {
+      const snapshot = await opts.read();
+      const { capturablePaths } = partitionIgnoredPathsBySecret(
+        snapshot.before.keys(),
+        snapshot.blockedSecretPaths,
+      );
+      // Deterministic order so the read prefix and entry order are stable.
+      const sorted = [...capturablePaths].sort();
+      const prefix = sorted.slice(0, maxEntries);
+
+      const entries: ProgressEntry[] = [];
+      // The signature keys on the capturable count (catches a new touch) plus the
+      // read prefix's size+mtime (catches a content edit to a shown file). A
+      // change to an UNshown tail file has no display effect, so it is not keyed.
+      const sigParts: string[] = [`${capturablePaths.length}`];
+
+      for (const relPath of prefix) {
+        const abs = join(opts.workspaceRoot, relPath);
+        const st = await statOrNull(abs);
+        sigParts.push(`${relPath}\u0000${st ? `${st.size}:${st.mtimeMs}` : "\u2205"}`);
+
+        const beforeBytes = snapshot.before.get(relPath) ?? null;
+        const beforeBuf = beforeBytes === null ? null : Buffer.from(beforeBytes);
+
+        // Oversized after: derive the kind without reading (bound the I/O) and
+        // leave counts at zero — the same "no stat" shape a binary/oversized side
+        // takes in the reviewed set. A same-size no-op cannot be excluded here; an
+        // accepted overstatement only for very large files.
+        if (st && st.size > LINE_COUNT_MAX_BYTES) {
+          const kind = beforeBuf === null ? FileChangeKind.ADD : FileChangeKind.MODIFY;
+          entries.push({
+            pathBefore: kind === FileChangeKind.ADD ? "" : relPath,
+            pathAfter: relPath,
+            kind,
+            linesAdded: 0,
+            linesRemoved: 0,
+          });
+          continue;
+        }
+
+        const afterBytes = st ? await readFileOrNull(abs) : null;
+        const afterBuf = afterBytes === null ? null : Buffer.from(afterBytes);
+        const cls = classifyCasChange(relPath, beforeBuf, afterBuf);
+        if (!cls) continue; // no-op (unchanged touch) or both sides absent
+        entries.push({
+          pathBefore: cls.pathBefore,
+          pathAfter: cls.pathAfter,
+          kind: cls.kind,
+          linesAdded: cls.lineCounts?.linesAdded ?? 0,
+          linesRemoved: cls.lineCounts?.linesRemoved ?? 0,
+        });
+      }
+
+      // Honest total: the capturable set minus the no-ops detected in the read
+      // prefix. Net-exact for a turn within the read budget; an upper bound beyond
+      // it (tail no-ops are not read, so cannot be excluded).
+      const prefixNoOps = prefix.length - entries.length;
+      const totalFilesChanged = capturablePaths.length - prefixNoOps;
+
+      const signature = sigParts.join("|");
+      if (signature === lastSignature) {
+        return { delta: cachedFull, changed: false };
+      }
+      lastSignature = signature;
+      cachedFull = { entries, totalFilesChanged };
+      return { delta: cachedFull, changed: true };
+    },
+  };
+}
+
+async function statOrNull(abs: string): Promise<{ size: number; mtimeMs: number } | null> {
+  try {
+    const s = await stat(abs);
+    return { size: s.size, mtimeMs: s.mtimeMs };
+  } catch {
+    return null;
+  }
+}
+
+async function readFileOrNull(abs: string): Promise<Uint8Array | null> {
+  try {
+    return await readFile(abs);
+  } catch {
+    return null;
+  }
+}

package/src/shared/filereview/cas-substrate.ts

@@ -57,6 +57,7 @@ import {
 import type { ArtifactStorage } from "../artifact-storage.js";
 import { bytesLookBinary } from "../file-change.js";
 import { sha256Bytes, sha256Hex } from "./digest.js";
+import { countLineChanges, type LineChangeCounts } from "./line-counts.js";
 
 /**
  * Reads an artifact's raw bytes back by storage key. Injected so this module
@@ -91,6 +92,14 @@ export interface CasCapturedFile {
   readonly after?: CasBlobRef;
   /** False when a side is binary — the change set cannot be approved as complete. */
   readonly diffComplete: boolean;
+  /**
+   * Display `+N −M` counted from the in-memory bytes at capture — the only
+   * moment a CAS change's text exists outside blob storage. Absent for binary
+   * or oversized sides. Carried in memory to the CANDIDATE event only, never
+   * persisted in the manifest: the manifest is the reconcile's source of truth,
+   * and display decoration does not belong in an enforcement record.
+   */
+  readonly lineCounts?: LineChangeCounts;
 }
 
 /** The durable manifest for one change set — the reconcile's source of truth. */
@@ -180,6 +189,66 @@ export async function snapshotCasChangeSet(opts: {
   };
 }
 
+/**
+ * The display-facing classification of one CAS path's before/after bytes: the
+ * change kind, whether either side is binary, and the `+N −M` line counts.
+ */
+export interface CasChangeClassification {
+  /** Path before the change (workspace-relative). Empty for ADD. */
+  readonly pathBefore: string;
+  /** Path after the change. Empty for DELETE. */
+  readonly pathAfter: string;
+  readonly kind: FileChangeKind;
+  /** A NUL byte on either side — the diff cannot render as text. */
+  readonly isBinary: boolean;
+  /** `+N −M` from the in-memory bytes; absent for a binary or oversized side. */
+  readonly lineCounts?: LineChangeCounts;
+}
+
+/**
+ * Classify one CAS path's before/after bytes. Returns `undefined` for a
+ * non-change — both sides absent, or a touch that left the bytes unchanged —
+ * exactly as the git substrate's diff omits unchanged files.
+ *
+ * This is the SINGLE classification authority for a CAS before/after pair: the
+ * turn-boundary capture ({@link buildCasCapturedFile}) and the mid-run progress
+ * producer ({@link ./cas-progress.js}) both route through it, so the live "N
+ * files changed so far" strip and the reviewed change set can never disagree on
+ * an edge case (the trailing-newline class of bug {@link ./line-counts.js}
+ * warns about). Kind, no-op detection, binary detection, and counting live here
+ * and nowhere else.
+ */
+export function classifyCasChange(
+  path: string,
+  beforeBuf: Buffer | null,
+  afterBuf: Buffer | null,
+): CasChangeClassification | undefined {
+  if (beforeBuf === null && afterBuf === null) return undefined;
+  // A touch that did not change the bytes is not a reviewable change.
+  if (beforeBuf && afterBuf && beforeBuf.equals(afterBuf)) return undefined;
+
+  const kind =
+    beforeBuf === null
+      ? FileChangeKind.ADD
+      : afterBuf === null
+        ? FileChangeKind.DELETE
+        : FileChangeKind.MODIFY;
+  const isBinary =
+    (beforeBuf !== null && bytesLookBinary(beforeBuf)) ||
+    (afterBuf !== null && bytesLookBinary(afterBuf));
+
+  return {
+    pathBefore: kind === FileChangeKind.ADD ? "" : path,
+    pathAfter: kind === FileChangeKind.DELETE ? "" : path,
+    kind,
+    isBinary,
+    // A binary change has no text line diff to count.
+    lineCounts: isBinary
+      ? undefined
+      : countLineChanges(beforeBuf?.toString("utf8"), afterBuf?.toString("utf8")),
+  };
+}
+
 /**
  * Store one path's before/after blobs and classify the change. Returns
  * `undefined` for a no-op (both sides absent, or an unchanged touch).
@@ -190,37 +259,29 @@ async function buildCasCapturedFile(
   capture: CasPathCapture,
 ): Promise<CasCapturedFile | undefined> {
   const { path, before, after, captureClass } = capture;
-  if (before === null && after === null) return undefined;
-
   const beforeBuf = before === null ? null : Buffer.from(before);
   const afterBuf = after === null ? null : Buffer.from(after);
 
-  // A touch that did not change the bytes is not a reviewable change.
-  if (beforeBuf && afterBuf && beforeBuf.equals(afterBuf)) return undefined;
+  const classification = classifyCasChange(path, beforeBuf, afterBuf);
+  if (!classification) return undefined;
 
   const beforeRef = beforeBuf ? await storeBlob(storage, executionId, beforeBuf) : undefined;
   const afterRef = afterBuf ? await storeBlob(storage, executionId, afterBuf) : undefined;
 
-  const kind =
-    beforeRef === undefined
-      ? FileChangeKind.ADD
-      : afterRef === undefined
-        ? FileChangeKind.DELETE
-        : FileChangeKind.MODIFY;
-
-  const isCreate = kind === FileChangeKind.ADD;
-  const isDelete = kind === FileChangeKind.DELETE;
-
   return {
-    pathBefore: isCreate ? "" : path,
-    pathAfter: isDelete ? "" : path,
-    kind,
+    pathBefore: classification.pathBefore,
+    pathAfter: classification.pathAfter,
+    kind: classification.kind,
     captureClass,
     before: beforeRef,
     after: afterRef,
     // Binary on either side means the diff cannot render as text; the change set
     // then cannot be approved as complete (parity with the git substrate).
-    diffComplete: !(beforeRef?.isBinary || afterRef?.isBinary),
+    diffComplete: !classification.isBinary,
+    // Display counts are taken NOW, while the text bytes are still in memory —
+    // after this they exist only as offloaded blobs (the same counts the mid-run
+    // progress producer derives via classifyCasChange).
+    lineCounts: classification.lineCounts,
   };
 }