@vibe-agent-toolkit/utils 0.1.42 → 0.2.0-rc.10

package/dist/git-utils.d.ts

@@ -2,9 +2,56 @@
  * Centralized git command wrapper.
  * All git commands should go through this module for consistency and testability.
  */
+import { type UnreadablePolicy } from './listing-refusal.js';
+/**
+ * The directories a git listing was REFUSED, read off its stderr.
+ *
+ * Pure. Returns each refused directory once, worktree-relative and without
+ * git's trailing slash, with the errno its reason maps to. A directory git
+ * could not open because it no longer exists is not returned: that is the
+ * `absent` outcome of {@link listingFailure}, decided there and not here, so
+ * the two routes classify a vanished directory the same way.
+ *
+ * @param stderr - What the listing wrote to stderr
+ * @returns The refusals, in the order git printed them, deduplicated
+ */
+export declare function unlistableDirectoriesIn(stderr: string): {
+    directory: string;
+    code: string;
+}[];
+/**
+ * The policy every working-tree listing here REQUIRES.
+ *
+ * A refused directory is otherwise invisible: git's exit status is 0 and its
+ * stdout is simply shorter. Each directory git could not open is settled as
+ * the SAME {@link DirectoryRefusal} the filesystem walk produces
+ * (`file-crawler.ts`) — absolute, forward-slashed, with `transient` derived
+ * beside the errno list in `fs-utils.ts` — under the same
+ * {@link UnreadablePolicy}, so a caller decides once for both routes.
+ *
+ * 🪤 This was `onUnreadable?`, and when it was omitted the refusals git printed
+ * were DROPPED — not thrown, as the walk did, but read off stderr and ignored.
+ * The one lane whose only witness to the gap is stderr was the one lane that
+ * defaulted to silence. There is no default now.
+ */
+export interface GitListingOptions {
+    /** What to do with a directory git could not open while walking the working tree. */
+    unreadable: UnreadablePolicy;
+}
 /**
  * Find the git repository root by walking up from the given directory.
  *
+ * Memoized module-wide via `git-root-cache.ts`: the walk seeds an entry for
+ * every directory it climbs, not just for `startDir`, because the redundancy
+ * this removes is overlapping walks from *different* start directories rather
+ * than repeated calls with the same one. A `null` answer is memoized too — that
+ * is the case that costs a walk to the filesystem root.
+ *
+ * The memo therefore does NOT see a `.git` directory created or removed after
+ * the fact. Anything that mutates repositories in-process (tests; a host that
+ * re-enters a command) must call `resetProjectRootCaches()`, which clears this
+ * cache along with the project-root one.
+ *
  * @param startDir - Directory to start searching from
  * @returns Path to git root, or null if not in a git repository
  */
@@ -16,6 +63,8 @@ export declare function gitFindRoot(startDir: string): string | null;
  * @param options.cwd - Working directory (git repository root or subdirectory)
  * @param options.patterns - Optional glob patterns to filter files (e.g., '*.md', 'docs/**\/*.ts')
  * @param options.includeUntracked - Include untracked files that aren't gitignored (default: false)
+ * @param options.unreadable - See {@link GitListingOptions}. Only the untracked
+ *   listing walks the working tree, so only it can have skipped a directory
  * @returns Array of file paths relative to the git root, or null if not in a git repo
  *
  * @example
@@ -27,11 +76,56 @@ export declare function gitFindRoot(startDir: string): string | null;
  * const allFiles = gitLsFiles({ cwd: '/project', includeUntracked: true });
  * ```
  */
-export declare function gitLsFiles(options: {
+export declare function gitLsFiles(options: GitListingOptions & {
     cwd: string;
     patterns?: string[];
     includeUntracked?: boolean;
 }): string[] | null;
+/**
+ * List paths git does NOT track, with each wholly-untracked directory collapsed
+ * to a single entry.
+ *
+ * This is the **prune list**, not a file list, and the distinction is the whole
+ * value. `--others --ignored --exclude-standard` alone returns every ignored file
+ * individually: measured on an 8,496-path adopter working tree that is 533,557
+ * paths in 1.19 s — worse than the crawl it was meant to replace, because
+ * `.turbo/cache` alone contributed 418,518 of them. Adding `--directory`
+ * collapses each wholly-ignored directory to one entry: **369 entries in 60 ms**.
+ * A caller can then decide per directory whether to descend, and skip a
+ * half-million paths by name without ever entering them.
+ *
+ * A collapsed directory entry is returned with a trailing `/`, exactly as git
+ * spells it. That is how a caller tells "this whole subtree" from "this one
+ * file", so it is deliberately not normalized away here.
+ *
+ * @param options - Configuration options
+ * @param options.cwd - Working directory inside the repository
+ * @param options.ignored - Restrict to ignored paths. Off, the listing is
+ *   untracked-but-not-ignored paths — which is the only way to see an EMPTY
+ *   untracked directory, since a directory with no files in it is invisible to
+ *   `ls-files` and to any tree object
+ * @param options.directory - Collapse a wholly-untracked directory to one entry
+ * @param options.unreadable - See {@link GitListingOptions}. ⚠️ The two
+ *   listings meet different refusals: without `--ignored`, git collapses a
+ *   WHOLLY-untracked directory without opening it, but it still opens a
+ *   non-ignored directory that holds tracked files (to look for untracked
+ *   siblings) and warns when it cannot; the `ignored` listing opens every
+ *   non-ignored directory and so meets every refusal the first one does and
+ *   more (measured on git 2.50)
+ * @returns Paths relative to the git root, or null if git did not answer
+ *
+ * @example
+ * ```typescript
+ * // The prune list: where the ignored territory is, without enumerating it.
+ * const prune = gitLsOthers({ cwd: root, ignored: true, directory: true });
+ * // → ['dist/', 'node_modules/', '.turbo/', 'notes.local.md']
+ * ```
+ */
+export declare function gitLsOthers(options: GitListingOptions & {
+    cwd: string;
+    ignored?: boolean;
+    directory?: boolean;
+}): string[] | null;
 /**
  * Check if a file path is ignored by git
  *

package/dist/git-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-utils.d.ts","sourceRoot":"","sources":["../src/git-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,MAAM,EAAE,GAAG,IAAI,CA0ClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAkEnF"}
+{"version":3,"file":"git-utils.d.ts","sourceRoot":"","sources":["../src/git-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAA0C,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAmDrG;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAW7F;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,UAAU,EAAE,gBAAgB,CAAC;CAC9B;AAkDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkB3D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,MAAM,EAAE,GAAG,IAAI,CAqBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,iBAAiB,GAAG;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,MAAM,EAAE,GAAG,IAAI,CAiBlB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAiDnF"}

package/dist/git-utils.js

@@ -2,29 +2,153 @@
  * Centralized git command wrapper.
  * All git commands should go through this module for consistency and testability.
  */
-import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { dirname, parse } from 'node:path';
-import which from 'which';
+import { directoryRefusalFor, listingFailure } from './fs-utils.js';
+import { lookupGitRoot, rememberGitRoot } from './git-root-cache.js';
+import { runGit } from './git-run.js';
+import { requireUnreadablePolicy, settleRefusal } from './listing-refusal.js';
 import { safePath } from './path-utils.js';
+/**
+ * One line of git's stderr that means "I skipped this directory".
+ *
+ * `git ls-files --others` (and `--ignored`, and `git add --all`) walks the
+ * working tree to find untracked files. On a directory it cannot open it prints
+ * this warning, exits 0, and omits the subtree — so stdout alone is a shorter
+ * list that nothing can tell from a complete one. The path is spelled
+ * **relative to the worktree root** with a trailing slash, even when git was
+ * run from a subdirectory (measured: cwd `docs/open`, warning names
+ * `'docs/open/sub/'`).
+ *
+ * Anchored to the line so an unrelated warning naming a directory in passing
+ * is not read as a refusal. The reason after the colon is `strerror` text —
+ * see {@link STRERROR_TO_ERRNO}.
+ */
+const UNLISTABLE_DIRECTORY_LINE = /^warning: could not open directory '(.+?)\/?': (.*)$/gm;
+/**
+ * C-locale `strerror` text → errno, for the reasons git can print here.
+ *
+ * git does not print the errno name, only its message; every listing below
+ * runs with `LC_ALL=C` so the message is the C-locale one and this table can
+ * be short. An unlisted reason is still a refusal — it becomes `UNKNOWN`, the
+ * same answer `listingFailure` gives an error carrying no errno — because
+ * dropping the line would reinstate the silent gap for exactly the errnos
+ * nobody thought of.
+ *
+ * The two ABSENCE reasons are listed so that `listingFailure` — the one owner
+ * of the absent/unreadable split — can recognise them and the line can be
+ * skipped: git prints "No such file or directory" for an untracked directory
+ * deleted between its parent's `readdir` and its own `opendir` (a concurrent
+ * `rm -rf tmp/`), and the walk route treats that same race as "no longer in
+ * the population" rather than as a refusal. Left unmapped it read as an
+ * `UNKNOWN` refusal, and the git route aborted a run the walk completed.
+ */
+const STRERROR_TO_ERRNO = new Map([
+    ['Permission denied', 'EACCES'],
+    ['Too many open files', 'EMFILE'],
+    ['Too many open files in system', 'ENFILE'],
+    ['Too many levels of symbolic links', 'ELOOP'],
+    ['Resource temporarily unavailable', 'EAGAIN'],
+    ['Input/output error', 'EIO'],
+    ['Stale file handle', 'ESTALE'],
+    ['Stale NFS file handle', 'ESTALE'],
+    ['No such file or directory', 'ENOENT'],
+    ['Not a directory', 'ENOTDIR'],
+]);
+/**
+ * The directories a git listing was REFUSED, read off its stderr.
+ *
+ * Pure. Returns each refused directory once, worktree-relative and without
+ * git's trailing slash, with the errno its reason maps to. A directory git
+ * could not open because it no longer exists is not returned: that is the
+ * `absent` outcome of {@link listingFailure}, decided there and not here, so
+ * the two routes classify a vanished directory the same way.
+ *
+ * @param stderr - What the listing wrote to stderr
+ * @returns The refusals, in the order git printed them, deduplicated
+ */
+export function unlistableDirectoriesIn(stderr) {
+    const seen = new Set();
+    const refusals = [];
+    for (const match of stderr.matchAll(UNLISTABLE_DIRECTORY_LINE)) {
+        const directory = match[1] ?? '';
+        if (directory === '' || seen.has(directory))
+            continue;
+        seen.add(directory);
+        const listing = listingFailure({ code: STRERROR_TO_ERRNO.get((match[2] ?? '').trim()) });
+        if (listing.outcome === 'unreadable')
+            refusals.push({ directory, code: listing.code });
+    }
+    return refusals;
+}
+/**
+ * Run one NUL-delimited `ls-files` listing and report what git skipped.
+ *
+ * `LC_ALL=C` so the stderr reason is the C-locale `strerror` text the parser
+ * knows; `trim: false` because the output is NUL-delimited (see the callers).
+ *
+ * @param args - The `ls-files` argv
+ * @param cwd - Where to run it
+ * @param api - The entry point, for the sentence an omitted policy gets
+ * @param unreadable - What a skipped directory means to the caller
+ * @returns The listed paths, or null when git did not answer
+ */
+function runListing(args, cwd, api, unreadable) {
+    // Before the spawn: an omitted policy is a programming error, not a fact
+    // about the tree, and a tree with nothing unreadable must not hide it.
+    requireUnreadablePolicy(unreadable, api);
+    const result = runGit(args, { cwd, trim: false, env: { LC_ALL: 'C' } });
+    // Every failure means the same thing to this caller — no listing. That covers
+    // "not a repository" (128), git missing entirely, and a listing too large for
+    // the buffer, which `ok` folds in because a truncated answer here is files
+    // silently missing rather than a short list.
+    if (!result.ok) {
+        return null;
+    }
+    if (result.stderr !== '') {
+        // The warning is worktree-root-relative regardless of `cwd`.
+        const worktreeRoot = gitFindRoot(cwd) ?? cwd;
+        for (const { directory, code } of unlistableDirectoriesIn(result.stderr)) {
+            settleRefusal(unreadable, directoryRefusalFor({ outcome: 'unreadable', code }, safePath.resolve(worktreeRoot, directory)));
+        }
+    }
+    // NUL-separated (from -z), so no path can ever need quote-unescaping — a
+    // trailing NUL just produces one empty string at the end, dropped here.
+    return result.stdout.split('\0').filter((line) => line.length > 0);
+}
 /**
  * Find the git repository root by walking up from the given directory.
  *
+ * Memoized module-wide via `git-root-cache.ts`: the walk seeds an entry for
+ * every directory it climbs, not just for `startDir`, because the redundancy
+ * this removes is overlapping walks from *different* start directories rather
+ * than repeated calls with the same one. A `null` answer is memoized too — that
+ * is the case that costs a walk to the filesystem root.
+ *
+ * The memo therefore does NOT see a `.git` directory created or removed after
+ * the fact. Anything that mutates repositories in-process (tests; a host that
+ * re-enters a command) must call `resetProjectRootCaches()`, which clears this
+ * cache along with the project-root one.
+ *
  * @param startDir - Directory to start searching from
  * @returns Path to git root, or null if not in a git repository
  */
 export function gitFindRoot(startDir) {
     let currentDir = safePath.resolve(startDir);
     const root = parse(currentDir).root;
+    const climbed = [];
     while (currentDir !== root) {
+        const memoized = lookupGitRoot(currentDir);
+        if (memoized !== undefined)
+            return rememberGitRoot(climbed, memoized);
+        climbed.push(currentDir);
         const gitDir = safePath.join(currentDir, '.git');
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- walking up from validated startDir
         if (existsSync(gitDir)) {
-            return currentDir;
+            return rememberGitRoot(climbed, currentDir);
         }
         currentDir = dirname(currentDir);
     }
-    return null;
+    return rememberGitRoot(climbed, null);
 }
 /**
  * List files tracked by git, optionally filtered by patterns.
@@ -33,6 +157,8 @@ export function gitFindRoot(startDir) {
  * @param options.cwd - Working directory (git repository root or subdirectory)
  * @param options.patterns - Optional glob patterns to filter files (e.g., '*.md', 'docs/**\/*.ts')
  * @param options.includeUntracked - Include untracked files that aren't gitignored (default: false)
+ * @param options.unreadable - See {@link GitListingOptions}. Only the untracked
+ *   listing walks the working tree, so only it can have skipped a directory
  * @returns Array of file paths relative to the git root, or null if not in a git repo
  *
  * @example
@@ -45,41 +171,79 @@ export function gitFindRoot(startDir) {
  * ```
  */
 export function gitLsFiles(options) {
-    try {
-        // Resolve git path using which for security (avoids PATH manipulation)
-        const gitPath = which.sync('git');
-        const args = ['ls-files'];
-        // Include untracked files that aren't gitignored
-        if (options.includeUntracked) {
-            args.push('--cached', '--others', '--exclude-standard');
-        }
-        // Add patterns if provided
-        if (options.patterns && options.patterns.length > 0) {
-            args.push('--', ...options.patterns);
-        }
-        const result = spawnSync(gitPath, args, {
-            cwd: options.cwd,
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            shell: false, // No shell interpreter for security
-        });
-        // Exit code 128 typically means not a git repository
-        if (result.status === 128 || result.error) {
-            return null;
-        }
-        if (result.status !== 0) {
-            return null;
-        }
-        // Parse output into array of file paths
-        return result.stdout
-            .split('\n')
-            .map((line) => line.trim())
-            .filter((line) => line.length > 0);
+    // -z emits NUL-separated, UNQUOTED paths regardless of byte content. Without
+    // it, git quotes any path containing non-ASCII bytes (wraps it in double
+    // quotes with octal escapes, e.g. `café.md` -> `"caf\303\251.md"`), which is
+    // unusable to any exact-string lookup against the real filename.
+    const args = ['ls-files', '-z'];
+    // Include untracked files that aren't gitignored
+    if (options.includeUntracked) {
+        args.push('--cached', '--others', '--exclude-standard');
     }
-    catch {
-        // Git not available or other error
-        return null;
+    // Add patterns if provided
+    if (options.patterns && options.patterns.length > 0) {
+        args.push('--', ...options.patterns);
+    }
+    // `trim: false` (inside `runListing`) because the output is NUL-delimited:
+    // git sorts by byte value, so a path beginning with a space sorts FIRST and a
+    // trim would silently rename it to a path that does not exist.
+    return runListing(args, options.cwd, 'gitLsFiles', options.unreadable);
+}
+/**
+ * List paths git does NOT track, with each wholly-untracked directory collapsed
+ * to a single entry.
+ *
+ * This is the **prune list**, not a file list, and the distinction is the whole
+ * value. `--others --ignored --exclude-standard` alone returns every ignored file
+ * individually: measured on an 8,496-path adopter working tree that is 533,557
+ * paths in 1.19 s — worse than the crawl it was meant to replace, because
+ * `.turbo/cache` alone contributed 418,518 of them. Adding `--directory`
+ * collapses each wholly-ignored directory to one entry: **369 entries in 60 ms**.
+ * A caller can then decide per directory whether to descend, and skip a
+ * half-million paths by name without ever entering them.
+ *
+ * A collapsed directory entry is returned with a trailing `/`, exactly as git
+ * spells it. That is how a caller tells "this whole subtree" from "this one
+ * file", so it is deliberately not normalized away here.
+ *
+ * @param options - Configuration options
+ * @param options.cwd - Working directory inside the repository
+ * @param options.ignored - Restrict to ignored paths. Off, the listing is
+ *   untracked-but-not-ignored paths — which is the only way to see an EMPTY
+ *   untracked directory, since a directory with no files in it is invisible to
+ *   `ls-files` and to any tree object
+ * @param options.directory - Collapse a wholly-untracked directory to one entry
+ * @param options.unreadable - See {@link GitListingOptions}. ⚠️ The two
+ *   listings meet different refusals: without `--ignored`, git collapses a
+ *   WHOLLY-untracked directory without opening it, but it still opens a
+ *   non-ignored directory that holds tracked files (to look for untracked
+ *   siblings) and warns when it cannot; the `ignored` listing opens every
+ *   non-ignored directory and so meets every refusal the first one does and
+ *   more (measured on git 2.50)
+ * @returns Paths relative to the git root, or null if git did not answer
+ *
+ * @example
+ * ```typescript
+ * // The prune list: where the ignored territory is, without enumerating it.
+ * const prune = gitLsOthers({ cwd: root, ignored: true, directory: true });
+ * // → ['dist/', 'node_modules/', '.turbo/', 'notes.local.md']
+ * ```
+ */
+export function gitLsOthers(options) {
+    // `--exclude-standard` is unconditional: `--ignored` is rejected outright by
+    // git without an exclude source, and without it the not-ignored listing would
+    // report every ignored path as merely untracked — the exact inversion of what
+    // either caller asked for.
+    const args = ['ls-files', '-z', '--others', '--exclude-standard'];
+    if (options.ignored) {
+        args.push('--ignored');
+    }
+    if (options.directory) {
+        args.push('--directory');
     }
+    // See `gitLsFiles`: NUL-delimited output must not be trimmed, or a path
+    // beginning with a space — which git sorts FIRST — comes back renamed.
+    return runListing(args, options.cwd, 'gitLsOthers', options.unreadable);
 }
 /**
  * Check if a file path is ignored by git
@@ -117,51 +281,33 @@ export function isGitIgnored(filePath, cwd = process.cwd()) {
     if (gitFindRoot(cwd) === null) {
         return false;
     }
-    try {
-        // Resolve git path using which for security (avoids PATH manipulation)
-        const gitPath = which.sync('git');
-        const checkIgnoreArgs = ['check-ignore', '-q'];
-        // git check-ignore returns exit code 0 if file is ignored, 1 if not
-        const result = spawnSync(gitPath, [...checkIgnoreArgs, filePath], {
-            cwd,
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            shell: false, // No shell interpreter for security
-        });
-        if (result.status === 0) {
-            return true;
-        }
-        // Exit code 128 = fatal error (e.g., path beyond a symbolic link).
-        // Walk up ancestor directories to check if a parent is gitignored.
-        // Example: data/ is gitignored, data/symlink/deep/file.md fails with 128,
-        // but checking data/ directly returns 0.
-        if (result.status !== 1) {
-            const resolvedCwd = safePath.resolve(cwd);
-            const resolvedFile = safePath.resolve(cwd, filePath);
-            let current = dirname(resolvedFile);
-            while (current !== resolvedCwd && !current.endsWith(parse(current).root)) {
-                const ancestorResult = spawnSync(gitPath, [...checkIgnoreArgs, current], {
-                    cwd,
-                    encoding: 'utf-8',
-                    stdio: 'pipe',
-                    shell: false,
-                });
-                if (ancestorResult.status === 0) {
-                    return true;
-                }
-                // If this ancestor check also fails fatally, keep walking up
-                // If it returns 1 (not ignored), the parent is tracked — stop walking
-                if (ancestorResult.status === 1) {
-                    break;
-                }
-                current = dirname(current);
+    const checkIgnoreArgs = ['check-ignore', '-q'];
+    // git check-ignore returns exit code 0 if file is ignored, 1 if not
+    const result = runGit([...checkIgnoreArgs, filePath], { cwd });
+    if (result.status === 0) {
+        return true;
+    }
+    // Exit code 128 = fatal error (e.g., path beyond a symbolic link).
+    // Walk up ancestor directories to check if a parent is gitignored.
+    // Example: data/ is gitignored, data/symlink/deep/file.md fails with 128,
+    // but checking data/ directly returns 0.
+    if (result.status !== 1) {
+        const resolvedCwd = safePath.resolve(cwd);
+        const resolvedFile = safePath.resolve(cwd, filePath);
+        let current = dirname(resolvedFile);
+        while (current !== resolvedCwd && !current.endsWith(parse(current).root)) {
+            const ancestorResult = runGit([...checkIgnoreArgs, current], { cwd });
+            if (ancestorResult.status === 0) {
+                return true;
+            }
+            // If this ancestor check also fails fatally, keep walking up
+            // If it returns 1 (not ignored), the parent is tracked — stop walking
+            if (ancestorResult.status === 1) {
+                break;
             }
+            current = dirname(current);
         }
-        return false;
-    }
-    catch {
-        // If git is not available or other error, assume not ignored
-        return false;
     }
+    return false;
 }
 //# sourceMappingURL=git-utils.js.map

package/dist/git-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-utils.js","sourceRoot":"","sources":["../src/git-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IAEpC,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,yGAAyG;QACzG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,OAI1B;IACC,IAAI,CAAC;QACH,uEAAuE;QACvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE1B,iDAAiD;QACjD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC1D,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,KAAK,EAAE,oCAAoC;SACnD,CAAC,CAAC;QAEH,qDAAqD;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wCAAwC;QACxC,OAAO,MAAM,CAAC,MAAM;aACjB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IACxE,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,kFAAkF;IAClF,oFAAoF;IACpF,qFAAqF;IACrF,4EAA4E;IAC5E,+EAA+E;IAC/E,EAAE;IACF,gFAAgF;IAChF,uCAAuC;IACvC,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,IAAI,CAAU,CAAC;QAExD,oEAAoE;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,eAAe,EAAE,QAAQ,CAAC,EAAE;YAChE,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,KAAK,EAAE,oCAAoC;SACnD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,mEAAmE;QACnE,0EAA0E;QAC1E,yCAAyC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACrD,IAAI,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YAEpC,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzE,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,eAAe,EAAE,OAAO,CAAC,EAAE;oBACvE,GAAG;oBACH,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,MAAM;oBACb,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;gBACH,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChC,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,6DAA6D;gBAC7D,sEAAsE;gBACtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM;gBACR,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"git-utils.js","sourceRoot":"","sources":["../src/git-utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAyB,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,MAAM,yBAAyB,GAAG,wDAAwD,CAAC;AAE3F;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAC;IAC7D,CAAC,mBAAmB,EAAE,QAAQ,CAAC;IAC/B,CAAC,qBAAqB,EAAE,QAAQ,CAAC;IACjC,CAAC,+BAA+B,EAAE,QAAQ,CAAC;IAC3C,CAAC,mCAAmC,EAAE,OAAO,CAAC;IAC9C,CAAC,kCAAkC,EAAE,QAAQ,CAAC;IAC9C,CAAC,oBAAoB,EAAE,KAAK,CAAC;IAC7B,CAAC,mBAAmB,EAAE,QAAQ,CAAC;IAC/B,CAAC,uBAAuB,EAAE,QAAQ,CAAC;IACnC,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,CAAC,iBAAiB,EAAE,SAAS,CAAC;CAC/B,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAA0C,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAsBD;;;;;;;;;;;GAWG;AACH,SAAS,UAAU,CACjB,IAAuB,EACvB,GAAW,EACX,GAAW,EACX,UAAwC;IAExC,yEAAyE;IACzE,uEAAuE;IACvE,uBAAuB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAExE,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,6CAA6C;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,6DAA6D;QAC7D,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC7C,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,aAAa,CACX,UAAU,EACV,mBAAmB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAGD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QACD,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,UAAU,CAAC,OAI1B;IACC,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAEhC,iDAAiD;IACjD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC1D,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,+DAA+D;IAC/D,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,WAAW,CAAC,OAI3B;IACC,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,2BAA2B;IAC3B,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAElE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3B,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,OAAO,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IACxE,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,kFAAkF;IAClF,oFAAoF;IACpF,qFAAqF;IACrF,4EAA4E;IAC5E,+EAA+E;IAC/E,EAAE;IACF,gFAAgF;IAChF,uCAAuC;IACvC,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,cAAc,EAAE,IAAI,CAAU,CAAC;IAExD,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAE/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,mEAAmE;IACnE,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QAEpC,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,GAAG,eAAe,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,6DAA6D;YAC7D,sEAAsE;YACtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM;YACR,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/git.d.ts

@@ -1,9 +1,15 @@
 /**
  * @vibe-agent-toolkit/utils/git
  *
- * Git primitives for build guards and gates: root discovery, tracked-file
- * enumeration, gitignore evaluation, and git URL parsing. Node-only —
- * shells out to `git` and reads the filesystem.
+ * Git primitives for build guards and gates: command execution, root discovery,
+ * tracked-file enumeration, tree snapshots, gitignore evaluation, and git URL
+ * parsing. Node-only — shells out to `git` and reads the filesystem.
+ *
+ * This is the ONLY published route to `runGit`. `safeExecSync`/`safeExecResult`
+ * on `./process` refuse the `git` binary outright and point here, so a caller
+ * that wants git gets the scrubbed environment rather than the ambient one by
+ * construction. The scrub itself, and dirty-corrected tree snapshots, come from
+ * `@vibe-validate/git`.
  *
  * The re-exports below are explicit rather than `export *` on purpose. A
  * blanket re-export surfaced TWO root finders under two names — `gitFindRoot`
@@ -16,7 +22,10 @@
  * old code rather than maintain two APIs). `gitFindRoot` is the only root
  * finder in the package.
  */
-export { gitFindRoot, gitLsFiles, isGitIgnored } from './git-utils.js';
+export { runGit, runGitOrThrow, type GitRunOptions, type GitRunResult, } from './git-run.js';
+export { gitFindRoot, gitLsFiles, gitLsOthers, isGitIgnored } from './git-utils.js';
+export type { RefuseListingContext, UnreadablePolicy } from './listing-refusal.js';
+export { freshGitTreeSnapshot, gitTreeSnapshot, peekGitTreeSnapshot, withGitSnapshotCache, type GitSnapshotEntry, type GitTreeSnapshot, } from './git-snapshot.js';
 export { loadGitignoreRules } from './gitignore-checker.js';
 export { GitTracker, type GitTrackerInitOptions } from './git-tracker.js';
 export { isGitUrl, nonInteractiveGitOverrides, parseGitUrl, type NonInteractiveGitOverrides, type ParsedGitUrl, } from './git-url.js';

package/dist/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,WAAW,EACX,KAAK,0BAA0B,EAC/B,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EACL,MAAM,EACN,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAIpF,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,WAAW,EACX,KAAK,0BAA0B,EAC/B,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC"}

package/dist/git.js

@@ -1,9 +1,15 @@
 /**
  * @vibe-agent-toolkit/utils/git
  *
- * Git primitives for build guards and gates: root discovery, tracked-file
- * enumeration, gitignore evaluation, and git URL parsing. Node-only —
- * shells out to `git` and reads the filesystem.
+ * Git primitives for build guards and gates: command execution, root discovery,
+ * tracked-file enumeration, tree snapshots, gitignore evaluation, and git URL
+ * parsing. Node-only — shells out to `git` and reads the filesystem.
+ *
+ * This is the ONLY published route to `runGit`. `safeExecSync`/`safeExecResult`
+ * on `./process` refuse the `git` binary outright and point here, so a caller
+ * that wants git gets the scrubbed environment rather than the ambient one by
+ * construction. The scrub itself, and dirty-corrected tree snapshots, come from
+ * `@vibe-validate/git`.
  *
  * The re-exports below are explicit rather than `export *` on purpose. A
  * blanket re-export surfaced TWO root finders under two names — `gitFindRoot`
@@ -16,7 +22,9 @@
  * old code rather than maintain two APIs). `gitFindRoot` is the only root
  * finder in the package.
  */
-export { gitFindRoot, gitLsFiles, isGitIgnored } from './git-utils.js';
+export { runGit, runGitOrThrow, } from './git-run.js';
+export { gitFindRoot, gitLsFiles, gitLsOthers, isGitIgnored } from './git-utils.js';
+export { freshGitTreeSnapshot, gitTreeSnapshot, peekGitTreeSnapshot, withGitSnapshotCache, } from './git-snapshot.js';
 export { loadGitignoreRules } from './gitignore-checker.js';
 export { GitTracker } from './git-tracker.js';
 export { isGitUrl, nonInteractiveGitOverrides, parseGitUrl, } from './git-url.js';

package/dist/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAA8B,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,WAAW,GAGZ,MAAM,cAAc,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EACL,MAAM,EACN,aAAa,GAGd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKpF,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GAGrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAA8B,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,WAAW,GAGZ,MAAM,cAAc,CAAC"}

package/dist/gitignore-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitignore-checker.d.ts","sourceRoot":"","sources":["../src/gitignore-checker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAe,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAI7C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwCnF"}
+{"version":3,"file":"gitignore-checker.d.ts","sourceRoot":"","sources":["../src/gitignore-checker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAe,EAAE,KAAK,MAAM,EAAE,MAAM,QAAQ,CAAC;AAM7C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA8CnF"}

package/dist/gitignore-checker.js

@@ -8,7 +8,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import ignore from 'ignore';
+import { isPathAbsentError } from './errors/errno.js';
 import { safePath, toForwardSlash } from './path-utils.js';
+import { readTextContentSync } from './text-file.js';
 /**
  * Load and parse .gitignore files from git root to baseDir.
  * Returns an ignore instance configured with all applicable .gitignore rules.
@@ -39,15 +41,22 @@ export function loadGitignoreRules(gitRoot, baseDir) {
     // Load .gitignore files from git root down to baseDir
     for (const dir of dirsToCheck) {
         const gitignorePath = safePath.join(dir, '.gitignore');
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- constructed from validated gitRoot and baseDir
         if (fs.existsSync(gitignorePath)) {
             try {
-                // eslint-disable-next-line security/detect-non-literal-fs-filename -- validated above
-                const content = fs.readFileSync(gitignorePath, 'utf-8');
-                ig.add(content);
+                // Through the decoding seam. A `.gitignore` written by PowerShell's `>`
+                // is UTF-16LE, and `readFileSync(p, 'utf-8')` would hand `ignore` a
+                // string of NUL-interleaved garbage — every pattern silently wrong, with
+                // no error anywhere.
+                ig.add(readTextContentSync(gitignorePath).text);
             }
-            catch {
-                // Skip gitignore files we can't read
+            catch (error) {
+                // Gone between `existsSync` and the read: no rules here. A `.gitignore`
+                // the OS refuses to read (`EACCES`), or one that is a directory
+                // (`EISDIR`), holds rules this checker cannot honour — and a crawl that
+                // quietly proceeded without them enumerated the ignored tree with
+                // nothing anywhere saying so. Those stay loud.
+                if (!isPathAbsentError(error))
+                    throw error;
             }
         }
     }