@wjarka/cezarion 0.10.0-pr30.54

package/dist/core/usage-limit.js

@@ -0,0 +1,209 @@
+/**
+ * Provider usage-limit detection (spec 2026-08-03-auto-resume-after-usage-limit).
+ *
+ * A subscription that runs out of its window does not fail like an agent bug does: the work is
+ * fine, the account is simply closed until a KNOWN instant. That instant is the whole feature —
+ * without it there is nothing to schedule, so this module answers exactly one question about a
+ * terminal error string: "is this a usage limit, and when does it lift?".
+ *
+ * The evidence differs per backend, so the shapes are recognized in order of how exact they are:
+ *
+ *  1. Claude Code's machine-readable envelope, `Claude AI usage limit reached|<epoch>` — the CLI
+ *     puts it in an `is_error` result frame, which reaches cezar verbatim as the run's `error`.
+ *     Exact, no locale, no parsing of prose. This is the one that matters in practice.
+ *  2. An explicit reset instant in the prose (`try again at 2026-08-03T18:00:00Z`) — how Codex and
+ *     OpenCode phrase the same thing when they carry a timestamp at all.
+ *  3. A clock-only reset in prose (`resets 8:10pm (Europe/Warsaw)`) — how Claude Code phrases
+ *     session windows in some interactive output.
+ *  4. A relative delay (`try again in 42 minutes`, `retry-after: 3600`).
+ *
+ * Nothing else counts. A limit message with no recoverable reset instant returns `null` on
+ * purpose: guessing a window would turn one interruption into a retry loop against a provider
+ * that is still refusing, and "we don't know when" is an honest answer the caller can surface.
+ */
+/**
+ * The furthest ahead a reset may sit and still be believed. Claude's weekly window is the real
+ * ceiling; anything beyond a week is a corrupt or unit-confused number, and parking a task on it
+ * would be indistinguishable from losing the task.
+ */
+export const MAX_USAGE_LIMIT_WAIT_MS = 7 * 24 * 60 * 60_000;
+/** Claude Code's own envelope. The suffix is Unix EPOCH SECONDS (ms tolerated — see below). */
+const CLAUDE_MARKER_RE = /claude(?:\s+ai)?\s+usage\s+limit\s+reached\s*\|\s*(\d{9,16})/i;
+/**
+ * "This is a limit, not a crash." Deliberately narrow: it gates the two prose shapes below, and a
+ * false positive there would schedule a resume on a timestamp that means something else entirely.
+ */
+const LIMIT_PHRASE_RE = /\b(?:usage|rate|session|weekly|hourly)[\s-]?limit\b|\brate[_-]?limit(?:_error|ed)?\b|\bquota\s+(?:exceeded|reached)\b|\bout\s+of\s+(?:credits|quota)\b/i;
+/** `…try again at 2026-08-03T18:00:00Z`, `…resets at 2026-08-03 18:00`. */
+const RESET_AT_RE = /(?:resets?|reset[s]?\s+at|try\s+again|retry|available\s+again|unlocks?)\b[^\n]{0,24}?\b(\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?)/i;
+/** `...resets 8:10pm (Europe/Warsaw)`, `...try again at 20:10`. */
+const RESET_CLOCK_RE = /(?:resets?|reset[s]?\s+at|try\s+again|retry|available\s+again|unlocks?)\b[^\n]{0,24}?\b(?:at\s*)?(\d{1,2})(?:(?::(\d{2}))\s*([ap]\.?m\.?)?|\s*([ap]\.?m\.?))(?:\s*\(([^)]+)\))?/i;
+/** `…try again in 42 minutes`, `…retry after 3600 seconds`, `retry-after: 3600`. */
+const RESET_IN_RE = /(?:try\s+again|retry|resets?|available\s+again)\b[^\n]{0,16}?\b(?:in|after)\s+(\d{1,7})\s*(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h)\b/i;
+const RETRY_AFTER_HEADER_RE = /\bretry[-_\s]?after\b\s*[:=]?\s*(\d{1,7})\b/i;
+const UNIT_MS = {
+    s: 1_000, sec: 1_000, secs: 1_000, second: 1_000, seconds: 1_000,
+    m: 60_000, min: 60_000, mins: 60_000, minute: 60_000, minutes: 60_000,
+    h: 3_600_000, hr: 3_600_000, hrs: 3_600_000, hour: 3_600_000, hours: 3_600_000,
+};
+/**
+ * Read a usage limit out of a terminal error message, or `null` when it is not one (or carries no
+ * usable reset instant). `now` is injected so callers and tests share one clock.
+ *
+ * Never throws: this runs on the failure path of every run, where a second failure helps nobody.
+ */
+export function parseUsageLimit(message, now = Date.now()) {
+    if (!message)
+        return null;
+    const marker = CLAUDE_MARKER_RE.exec(message);
+    if (marker) {
+        const raw = Number(marker[1]);
+        // Epoch seconds is the documented unit; a value large enough to only make sense as
+        // milliseconds is accepted rather than parked ~50,000 years out.
+        const epochMs = raw >= 1e12 ? raw : raw * 1_000;
+        return settle(epochMs, now, 'claude-marker');
+    }
+    if (!LIMIT_PHRASE_RE.test(message))
+        return null;
+    const at = RESET_AT_RE.exec(message);
+    if (at) {
+        // A bare date, or `YYYY-MM-DD HH:MM` without a zone, is read in the host's local time — the
+        // provider is talking to the person at this machine, and `Date.parse` would otherwise read the
+        // space-separated form as UTC on some runtimes and local on others. A date with no time at all
+        // needs the midnight spelled out for the same reason: the ECMAScript date-ONLY form is defined
+        // as UTC, so `2026-08-03` alone would land up to a day away from the day the provider named.
+        const stamp = at[1].includes('T') ? at[1] : at[1].replace(' ', 'T');
+        const parsed = Date.parse(stamp.includes('T') ? stamp : `${stamp}T00:00`);
+        if (Number.isFinite(parsed))
+            return settle(parsed, now, 'timestamp');
+    }
+    const clock = RESET_CLOCK_RE.exec(message);
+    if (clock) {
+        const parsed = parseClockReset(clock, now);
+        if (parsed !== null)
+            return settle(parsed, now, 'clock');
+    }
+    const relative = RESET_IN_RE.exec(message);
+    if (relative) {
+        const unit = UNIT_MS[relative[2].toLowerCase()];
+        if (unit !== undefined)
+            return settle(now + Number(relative[1]) * unit, now, 'delay');
+    }
+    const header = RETRY_AFTER_HEADER_RE.exec(message);
+    if (header)
+        return settle(now + Number(header[1]) * 1_000, now, 'delay');
+    return null;
+}
+function parseClockReset(match, now) {
+    const hourRaw = Number(match[1]);
+    const minute = match[2] === undefined ? 0 : Number(match[2]);
+    const meridiem = (match[3] ?? match[4])?.toLowerCase().replaceAll('.', '');
+    if (!Number.isInteger(hourRaw) || !Number.isInteger(minute) || minute < 0 || minute > 59) {
+        return null;
+    }
+    let hour = hourRaw;
+    if (meridiem) {
+        if (hour < 1 || hour > 12)
+            return null;
+        if (meridiem === 'am')
+            hour = hour === 12 ? 0 : hour;
+        else if (meridiem === 'pm')
+            hour = hour === 12 ? 12 : hour + 12;
+        else
+            return null;
+    }
+    else if (hour < 0 || hour > 23) {
+        return null;
+    }
+    const timeZone = validTimeZone(match[5]?.trim());
+    if (timeZone)
+        return nextClockInTimeZone(hour, minute, timeZone, now);
+    return nextLocalClock(hour, minute, now);
+}
+function nextLocalClock(hour, minute, now) {
+    const candidate = new Date(now);
+    candidate.setHours(hour, minute, 0, 0);
+    if (candidate.getTime() < now)
+        candidate.setDate(candidate.getDate() + 1);
+    return candidate.getTime();
+}
+function nextClockInTimeZone(hour, minute, timeZone, now) {
+    const today = zonedParts(now, timeZone);
+    if (!today)
+        return null;
+    let candidate = zonedWallTimeToUtc(today.year, today.month, today.day, hour, minute, timeZone);
+    if (candidate === null)
+        return null;
+    if (candidate < now) {
+        const tomorrow = new Date(Date.UTC(today.year, today.month - 1, today.day + 1));
+        candidate = zonedWallTimeToUtc(tomorrow.getUTCFullYear(), tomorrow.getUTCMonth() + 1, tomorrow.getUTCDate(), hour, minute, timeZone);
+    }
+    return candidate;
+}
+function validTimeZone(candidate) {
+    if (!candidate)
+        return null;
+    try {
+        new Intl.DateTimeFormat('en-US', { timeZone: candidate }).format(new Date(0));
+        return candidate;
+    }
+    catch {
+        return null;
+    }
+}
+function zonedWallTimeToUtc(year, month, day, hour, minute, timeZone) {
+    const wallAsUtc = Date.UTC(year, month - 1, day, hour, minute, 0, 0);
+    let candidate = wallAsUtc;
+    for (let i = 0; i < 3; i += 1) {
+        const offset = timeZoneOffsetMs(timeZone, candidate);
+        if (offset === null)
+            return null;
+        const next = wallAsUtc - offset;
+        if (Math.abs(next - candidate) < 1_000)
+            return next;
+        candidate = next;
+    }
+    return candidate;
+}
+function timeZoneOffsetMs(timeZone, utcMs) {
+    const parts = zonedParts(utcMs, timeZone);
+    if (!parts)
+        return null;
+    const asUtc = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second);
+    return asUtc - utcMs;
+}
+function zonedParts(utcMs, timeZone) {
+    try {
+        const parts = new Intl.DateTimeFormat('en-CA', {
+            timeZone,
+            year: 'numeric',
+            month: '2-digit',
+            day: '2-digit',
+            hour: '2-digit',
+            minute: '2-digit',
+            second: '2-digit',
+            hourCycle: 'h23',
+        }).formatToParts(new Date(utcMs));
+        const value = (type) => Number(parts.find((part) => part.type === type)?.value);
+        return {
+            year: value('year'),
+            month: value('month'),
+            day: value('day'),
+            hour: value('hour'),
+            minute: value('minute'),
+            second: value('second'),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Bound a candidate instant: past → now (the limit already lifted), absurd → not believed. */
+function settle(epochMs, now, evidence) {
+    if (!Number.isFinite(epochMs))
+        return null;
+    if (epochMs - now > MAX_USAGE_LIMIT_WAIT_MS)
+        return null;
+    return { resetAt: new Date(Math.max(epochMs, now)), evidence };
+}
+//# sourceMappingURL=usage-limit.js.map

package/dist/core/usage-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-limit.js","sourceRoot":"","sources":["../../src/core/usage-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE5D,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,+DAA+D,CAAC;AAEzF;;;GAGG;AACH,MAAM,eAAe,GACnB,yJAAyJ,CAAC;AAE5J,2EAA2E;AAC3E,MAAM,WAAW,GACf,6KAA6K,CAAC;AAEhL,mEAAmE;AACnE,MAAM,cAAc,GAClB,kLAAkL,CAAC;AAErL,oFAAoF;AACpF,MAAM,WAAW,GACf,gJAAgJ,CAAC;AACnJ,MAAM,qBAAqB,GAAG,8CAA8C,CAAC;AAE7E,MAAM,OAAO,GAA2B;IACtC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAChE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACrE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,mFAAmF;QACnF,iEAAiE;QACjE,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,CAAC;QACP,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB,EAAE,GAAW;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;aAChD,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;;YAC3D,OAAO,IAAI,CAAC;IACnB,CAAC;SAAM,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG;QAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAc,EAAE,QAAgB,EAAE,GAAW;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/F,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChF,SAAS,GAAG,kBAAkB,CAC5B,QAAQ,CAAC,cAAc,EAAE,EACzB,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAC1B,QAAQ,CAAC,UAAU,EAAE,EACrB,IAAI,EACJ,MAAM,EACN,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,SAA6B;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,KAAa,EACb,GAAW,EACX,IAAY,EACZ,MAAc,EACd,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QACpD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YAC7C,QAAQ;YACR,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;YACjB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,MAAM,CAAC,OAAe,EAAE,GAAW,EAAE,QAAmC;IAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,GAAG,GAAG,GAAG,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC"}

package/dist/core/usage.d.ts

@@ -0,0 +1,11 @@
+export declare const CACHE_READ_WEIGHT = 0.1;
+export declare const CACHE_CREATION_WEIGHT = 1.25;
+/** A loosely-typed usage record as emitted by the claude CLI stream. */
+export interface RawUsage {
+    input_tokens?: number;
+    output_tokens?: number;
+    cache_creation_input_tokens?: number;
+    cache_read_input_tokens?: number;
+}
+/** Collapse a raw usage record into a single cost-weighted token count. */
+export declare function costWeightedTokens(usage: RawUsage | undefined | null): number;

package/dist/core/usage.js

@@ -0,0 +1,15 @@
+// Anthropic bills cache-read input at ~10% of standard input cost and cache
+// creation at ~125%. Weighting raw counts by these keeps the token number
+// shown in the cockpit roughly proportional to dollar cost.
+export const CACHE_READ_WEIGHT = 0.1;
+export const CACHE_CREATION_WEIGHT = 1.25;
+/** Collapse a raw usage record into a single cost-weighted token count. */
+export function costWeightedTokens(usage) {
+    if (!usage)
+        return 0;
+    return Math.round((usage.input_tokens ?? 0) +
+        (usage.output_tokens ?? 0) +
+        (usage.cache_creation_input_tokens ?? 0) * CACHE_CREATION_WEIGHT +
+        (usage.cache_read_input_tokens ?? 0) * CACHE_READ_WEIGHT);
+}
+//# sourceMappingURL=usage.js.map

package/dist/core/usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../../src/core/usage.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,0EAA0E;AAC1E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAU1C,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,KAAkC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC,KAAK,CACf,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;QACvB,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;QAC1B,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,CAAC,GAAG,qBAAqB;QAChE,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,CAAC,GAAG,iBAAiB,CAC3D,CAAC;AACJ,CAAC"}

package/dist/core/v1-text-coalescer.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Per-item coalescing of streamed assistant text into whole v1 `text` events.
+ *
+ * The v1 `AgentEvent` contract treats `text` as a complete assistant block —
+ * that is what claude emits, what the RunManager persists one NDJSON line per
+ * event, and what every consumer renders as one paragraph (cockpit thread,
+ * headless CLI). Codex and opencode stream deltas, so emitting each delta as
+ * its own `text` event persisted one line per token: transcripts rendered one
+ * paragraph per token, and turn-end markers split across deltas (`CE`+`Z`+
+ * `:D`+`ONE`) slipped past the server's per-event marker stripping.
+ *
+ * Streaming display does not go through v1 at all — protocol v2's
+ * `item.delta` (coalesced by `UiEventSink`) carries it — so v1 can afford
+ * whole-block granularity.
+ */
+export declare class V1TextCoalescer {
+    private readonly emitText;
+    /** Accumulated deltas per open item. Deltas with no item id share the ''
+     *  bucket (at most one anonymous item streams at a time). */
+    private readonly pending;
+    /** Items already emitted — a late snapshot/delta must not double-emit. */
+    private readonly done;
+    constructor(emitText: (text: string) => void);
+    /** Buffer one streamed delta of an item. */
+    append(itemId: string | undefined, delta: string): void;
+    /**
+     * The item is final: emit its text exactly once — the wire snapshot when the
+     * backend sent one (authoritative full text), else the accumulated deltas.
+     */
+    complete(itemId: string | undefined, snapshotText?: string): void;
+    /** Turn/session boundary: emit whatever never saw its item complete, in
+     *  arrival order, so interrupted turns still surface their partial prose.
+     *  The `done` latch survives on purpose — item/part ids are unique per
+     *  session, and a re-sent snapshot after the boundary must not re-emit. */
+    flush(): void;
+}

package/dist/core/v1-text-coalescer.js

@@ -0,0 +1,72 @@
+/**
+ * Per-item coalescing of streamed assistant text into whole v1 `text` events.
+ *
+ * The v1 `AgentEvent` contract treats `text` as a complete assistant block —
+ * that is what claude emits, what the RunManager persists one NDJSON line per
+ * event, and what every consumer renders as one paragraph (cockpit thread,
+ * headless CLI). Codex and opencode stream deltas, so emitting each delta as
+ * its own `text` event persisted one line per token: transcripts rendered one
+ * paragraph per token, and turn-end markers split across deltas (`CE`+`Z`+
+ * `:D`+`ONE`) slipped past the server's per-event marker stripping.
+ *
+ * Streaming display does not go through v1 at all — protocol v2's
+ * `item.delta` (coalesced by `UiEventSink`) carries it — so v1 can afford
+ * whole-block granularity.
+ */
+export class V1TextCoalescer {
+    emitText;
+    /** Accumulated deltas per open item. Deltas with no item id share the ''
+     *  bucket (at most one anonymous item streams at a time). */
+    pending = new Map();
+    /** Items already emitted — a late snapshot/delta must not double-emit. */
+    done = new Set();
+    constructor(emitText) {
+        this.emitText = emitText;
+    }
+    /** Buffer one streamed delta of an item. */
+    append(itemId, delta) {
+        if (delta === '')
+            return;
+        const key = itemId ?? '';
+        if (this.done.has(key))
+            return;
+        this.pending.set(key, (this.pending.get(key) ?? '') + delta);
+    }
+    /**
+     * The item is final: emit its text exactly once — the wire snapshot when the
+     * backend sent one (authoritative full text), else the accumulated deltas.
+     */
+    complete(itemId, snapshotText) {
+        const key = itemId ?? '';
+        if (this.done.has(key))
+            return;
+        // The anonymous bucket is never latched: without an identity, "already
+        // emitted" can't be told apart from "the next id-less item".
+        if (key !== '')
+            this.done.add(key);
+        let buffered = this.pending.get(key);
+        this.pending.delete(key);
+        if (buffered === undefined && key !== '') {
+            // Deltas that arrived without an item id belong to the only in-flight item.
+            buffered = this.pending.get('');
+            this.pending.delete('');
+        }
+        const text = snapshotText !== undefined && snapshotText !== '' ? snapshotText : (buffered ?? '');
+        if (text !== '')
+            this.emitText(text);
+    }
+    /** Turn/session boundary: emit whatever never saw its item complete, in
+     *  arrival order, so interrupted turns still surface their partial prose.
+     *  The `done` latch survives on purpose — item/part ids are unique per
+     *  session, and a re-sent snapshot after the boundary must not re-emit. */
+    flush() {
+        for (const [key, text] of this.pending) {
+            if (text !== '')
+                this.emitText(text);
+            if (key !== '')
+                this.done.add(key);
+        }
+        this.pending.clear();
+    }
+}
+//# sourceMappingURL=v1-text-coalescer.js.map

package/dist/core/v1-text-coalescer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1-text-coalescer.js","sourceRoot":"","sources":["../../src/core/v1-text-coalescer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,eAAe;IAOG,QAAQ;IANrC;iEAC6D;IAC5C,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,0EAA0E;IACzD,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,YAA6B,QAAgC;wBAAhC,QAAQ;IAA2B,CAAC;IAEjE,4CAA4C;IAC5C,MAAM,CAAC,MAA0B,EAAE,KAAa;QAC9C,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,MAA0B,EAAE,YAAqB;QACxD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,uEAAuE;QACvE,6DAA6D;QAC7D,IAAI,GAAG,KAAK,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACzC,4EAA4E;YAC5E,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACjG,IAAI,IAAI,KAAK,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;+EAG2E;IAC3E,KAAK;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,IAAI,KAAK,EAAE;gBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/git-diff-base.d.ts

@@ -0,0 +1,85 @@
+/**
+ * "Which ref anchors *this task's* diff" — the single rule every task-diff
+ * surface resolves through (#751).
+ *
+ * The normal answer is `merge-base(baseBranch, HEAD)`: it keeps a task's diff
+ * to the task's own commits even after the base branch moves on, and even
+ * after the task merges the base back in.
+ *
+ * Two things break that answer, and both are fixed here:
+ *
+ * **A stale local base ref.** `RunRecord.baseBranch` is a NAME (`main`),
+ * resolved to a ref once, when the worktree was created. Nothing ever
+ * fast-forwards the user's local `main` — cezar's agents only ever `git fetch`,
+ * which moves `origin/main` — so on a repo the user does not pull, the local
+ * ref drifts arbitrarily far behind. The merge-base then collapses onto that
+ * stale tip and every upstream commit the task forked from or merged in counts
+ * as the task's own work: an eight-line fix measured `+59514 −12160` against a
+ * `main` that was 98 commits and one monorepo restructure behind origin. So the
+ * base is re-resolved to the freshest ref it names at every call
+ * (`freshestBaseRef`) — the read-time twin of `resolveBaseRef`, which does the
+ * same thing at worktree-creation time and cannot know what happens later.
+ *
+ * **A repointed HEAD.** cezar hands the agent a worktree on the task's own
+ * branch, but nothing stops the agent from checking out another branch in it —
+ * every `review/pr-NNN` and QA run does exactly that, and so does every skill
+ * that opens its work on a named `feat/…` branch. The merge-base then silently
+ * redefines "this task's diff" as *the whole checked-out branch*, which is how
+ * a task that committed nothing came to report `+22505 −2628`. #591 and #751
+ * answered that with `HEAD` — uncommitted work only — which is right for a
+ * pure review and badly wrong for the far more common case of an agent that
+ * committed real work on a branch it created itself: those runs reported
+ * `+0 −0` for changes that were genuinely theirs.
+ *
+ * The honest anchor for a repointed HEAD is the branch as it stood **when this
+ * run first saw it** — its `<branch>@{<run start>}` reflog state. Diffing
+ * against that attributes exactly what the run did to the tree and nothing
+ * that was already there: a review run gets its `+0`, and a run that branched
+ * off the base and committed gets its real numbers. Where that baseline is
+ * itself stale — the run merged the base branch in afterwards, dragging the
+ * whole upstream delta behind it — the ordinary merge-base is the tighter
+ * answer, so the two candidates compete and the one that attributes FEWER
+ * CHANGED LINES to the task wins. The reported number is then never more than
+ * the least either measure can defend.
+ *
+ * It lives here so a third surface cannot get it wrong again — callers hand in
+ * their own `git` runner (`git-worktree.ts` and `server/git-changes.ts` each
+ * own a private one, and `git-changes` needs its scratch-`GIT_INDEX_FILE`
+ * variant), so this module stays a pure decision with no process-spawning of
+ * its own.
+ */
+/** What a caller's `git` runner must answer with. Both existing runners are wider than this. */
+export interface GitRunResult {
+    ok: boolean;
+    stdout: string;
+}
+/** A caller-supplied `git` invocation, already bound to a working directory (and env). */
+export type GitRunner = (args: string[]) => Promise<GitRunResult>;
+/** The task branch cezar created vs. the branch HEAD actually sits on. */
+export interface RepointedHead {
+    headBranch: string;
+    taskBranch: string;
+}
+export interface TaskDiffBase {
+    /** The ref to diff against. */
+    base: string;
+    /** Present only when HEAD left the task's branch — the reason `base` is what it is. */
+    repointedHead?: RepointedHead;
+}
+/**
+ * Resolve the diff anchor for a task worktree. Never throws: a failing git call
+ * degrades to the base branch name, which is what the un-guarded callers did
+ * before this helper existed.
+ *
+ * `taskBranch` is optional because not every caller has one (the main working
+ * tree has no task branch at all). Without it there is nothing to compare HEAD
+ * against, so the merge-base anchor is used unchanged.
+ *
+ * `runStartedAt` is what makes the repointed-HEAD answer a measurement instead
+ * of a guess; without it the anchor stays `HEAD` (uncommitted work only), the
+ * conservative #751 answer that can never claim someone else's commits.
+ */
+export declare function resolveTaskDiffBase(runGit: GitRunner, baseBranch: string, opts?: {
+    taskBranch?: string;
+    runStartedAt?: string;
+}): Promise<TaskDiffBase>;

package/dist/git-diff-base.js

@@ -0,0 +1,180 @@
+/**
+ * "Which ref anchors *this task's* diff" — the single rule every task-diff
+ * surface resolves through (#751).
+ *
+ * The normal answer is `merge-base(baseBranch, HEAD)`: it keeps a task's diff
+ * to the task's own commits even after the base branch moves on, and even
+ * after the task merges the base back in.
+ *
+ * Two things break that answer, and both are fixed here:
+ *
+ * **A stale local base ref.** `RunRecord.baseBranch` is a NAME (`main`),
+ * resolved to a ref once, when the worktree was created. Nothing ever
+ * fast-forwards the user's local `main` — cezar's agents only ever `git fetch`,
+ * which moves `origin/main` — so on a repo the user does not pull, the local
+ * ref drifts arbitrarily far behind. The merge-base then collapses onto that
+ * stale tip and every upstream commit the task forked from or merged in counts
+ * as the task's own work: an eight-line fix measured `+59514 −12160` against a
+ * `main` that was 98 commits and one monorepo restructure behind origin. So the
+ * base is re-resolved to the freshest ref it names at every call
+ * (`freshestBaseRef`) — the read-time twin of `resolveBaseRef`, which does the
+ * same thing at worktree-creation time and cannot know what happens later.
+ *
+ * **A repointed HEAD.** cezar hands the agent a worktree on the task's own
+ * branch, but nothing stops the agent from checking out another branch in it —
+ * every `review/pr-NNN` and QA run does exactly that, and so does every skill
+ * that opens its work on a named `feat/…` branch. The merge-base then silently
+ * redefines "this task's diff" as *the whole checked-out branch*, which is how
+ * a task that committed nothing came to report `+22505 −2628`. #591 and #751
+ * answered that with `HEAD` — uncommitted work only — which is right for a
+ * pure review and badly wrong for the far more common case of an agent that
+ * committed real work on a branch it created itself: those runs reported
+ * `+0 −0` for changes that were genuinely theirs.
+ *
+ * The honest anchor for a repointed HEAD is the branch as it stood **when this
+ * run first saw it** — its `<branch>@{<run start>}` reflog state. Diffing
+ * against that attributes exactly what the run did to the tree and nothing
+ * that was already there: a review run gets its `+0`, and a run that branched
+ * off the base and committed gets its real numbers. Where that baseline is
+ * itself stale — the run merged the base branch in afterwards, dragging the
+ * whole upstream delta behind it — the ordinary merge-base is the tighter
+ * answer, so the two candidates compete and the one that attributes FEWER
+ * CHANGED LINES to the task wins. The reported number is then never more than
+ * the least either measure can defend.
+ *
+ * It lives here so a third surface cannot get it wrong again — callers hand in
+ * their own `git` runner (`git-worktree.ts` and `server/git-changes.ts` each
+ * own a private one, and `git-changes` needs its scratch-`GIT_INDEX_FILE`
+ * variant), so this module stays a pure decision with no process-spawning of
+ * its own.
+ */
+import { isSafeGitRef } from './git-refs.js';
+/**
+ * ISO-8601 instants only, for the `<branch>@{<date>}` revision below. The
+ * timestamp comes from a stored run record, and a git revision expression is
+ * the one place a stray value would be interpreted rather than compared —
+ * `@{-1}` is "the previously checked-out branch", not a date. Anything that is
+ * not plainly a timestamp simply disables the baseline anchor.
+ */
+const ISO_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+/**
+ * The freshest ref the configured base branch names: `origin/<base>` when the
+ * local branch is behind it (or missing entirely), the local branch otherwise.
+ *
+ * Same rule as `resolveBaseRef` (`git-worktree.ts`), which picks the fork point
+ * when the worktree is created; this one re-applies it every time a diff is
+ * measured, because that is when the local ref's staleness actually shows up.
+ * A base that is already remote-tracking, a commit sha pinned from a detached
+ * HEAD, or a repo with no `origin` all fall through unchanged.
+ */
+async function freshestBaseRef(runGit, base) {
+    if (!isSafeGitRef(base) || base === 'HEAD' || base.startsWith('origin/'))
+        return base;
+    const remote = `origin/${base}`;
+    const hasRemote = await runGit(['rev-parse', '--verify', '--quiet', `${remote}^{commit}`]);
+    if (!hasRemote.ok)
+        return base;
+    // Exits 0 iff local is equal to or ahead of origin — the case where the local
+    // ref carries unpushed base commits and is the better answer.
+    const localCurrent = await runGit(['merge-base', '--is-ancestor', remote, base]);
+    return localCurrent.ok ? base : remote;
+}
+/**
+ * Where the repointed branch stood when this run started — `git rev-parse
+ * <branch>@{<runStartedAt>}`, i.e. its own reflog, read at a point in time.
+ *
+ * Git answers this generously by design: a timestamp older than the whole
+ * reflog resolves to the branch's OLDEST recorded state, which for a branch the
+ * agent created during the run is its creation commit — exactly the fork point
+ * we want. A branch that already existed resolves to the tip it had before the
+ * run touched it, so the previous author's commits stay theirs.
+ *
+ * Null (→ the caller keeps the conservative `HEAD` anchor) when there is no run
+ * start to read at, when HEAD is detached (no branch reflog to consult), or
+ * when reflogs are unavailable — a guess is worse than the narrow answer.
+ */
+async function checkoutBaseline(runGit, headBranch, runStartedAt) {
+    if (!runStartedAt || !ISO_INSTANT.test(runStartedAt))
+        return null;
+    if (headBranch === 'HEAD' || !isSafeGitRef(headBranch))
+        return null;
+    const at = await runGit([
+        'rev-parse',
+        '--verify',
+        '--quiet',
+        `${headBranch}@{${runStartedAt}}^{commit}`,
+    ]);
+    const sha = at.ok ? at.stdout.trim() : '';
+    return sha || null;
+}
+/**
+ * How many changed lines an anchor attributes to the task — the comparison that
+ * picks between two candidates, never a number anyone sees (the callers do their
+ * own parsing for that, `parseShortstat`). Both candidates cover the same
+ * uncommitted work, so the comparison is fair whatever the index holds.
+ *
+ * This is the one part of the decision that reads the index rather than just
+ * refs, and `git diff` rewrites the index it reads (a stat refresh). Callers
+ * that keep their diffs off an index they do not own — `collectChanges` and its
+ * scratch `GIT_INDEX_FILE` — must therefore hand this module a runner carrying
+ * that same environment, and the two probes below run one after the other so
+ * they never refresh one index file concurrently.
+ */
+async function changedLines(runGit, ref) {
+    const res = await runGit(['diff', '--shortstat', ref]);
+    if (!res.ok)
+        return null;
+    let total = 0;
+    for (const m of res.stdout.matchAll(/(\d+) (?:insertions?\(\+\)|deletions?\(-\))/g)) {
+        total += Number(m[1]);
+    }
+    return total;
+}
+/**
+ * Resolve the diff anchor for a task worktree. Never throws: a failing git call
+ * degrades to the base branch name, which is what the un-guarded callers did
+ * before this helper existed.
+ *
+ * `taskBranch` is optional because not every caller has one (the main working
+ * tree has no task branch at all). Without it there is nothing to compare HEAD
+ * against, so the merge-base anchor is used unchanged.
+ *
+ * `runStartedAt` is what makes the repointed-HEAD answer a measurement instead
+ * of a guess; without it the anchor stays `HEAD` (uncommitted work only), the
+ * conservative #751 answer that can never claim someone else's commits.
+ */
+export async function resolveTaskDiffBase(runGit, baseBranch, opts = {}) {
+    const base = await freshestBaseRef(runGit, baseBranch);
+    const mergeBase = async () => {
+        const res = await runGit(['merge-base', base, 'HEAD']);
+        return res.ok && res.stdout.trim() ? res.stdout.trim() : base;
+    };
+    if (!opts.taskBranch)
+        return { base: await mergeBase() };
+    const headBranchResult = await runGit(['rev-parse', '--abbrev-ref', 'HEAD']);
+    const headBranch = headBranchResult.ok ? headBranchResult.stdout.trim() : '';
+    // An unreadable HEAD (no commits yet, broken worktree) is NOT evidence of a
+    // repoint — fall through to the merge-base anchor rather than narrowing on a
+    // guess. A detached HEAD, on the other hand, is by definition not the task's
+    // branch and takes the repointed path below.
+    if (!headBranch || headBranch === opts.taskBranch)
+        return { base: await mergeBase() };
+    const repointedHead = { headBranch, taskBranch: opts.taskBranch };
+    const baseline = await checkoutBaseline(runGit, headBranch, opts.runStartedAt);
+    if (!baseline)
+        return { base: 'HEAD', repointedHead };
+    // Two defensible anchors, so report the tighter one: the number must never
+    // claim more than the least either measure attributes to this task. The
+    // baseline is usually it — but not when the run merged the base branch in
+    // afterwards, which drags the whole upstream delta past a pre-merge baseline
+    // and leaves the merge-base as the only anchor that still measures the task.
+    const anchor = await mergeBase();
+    const viaBaseline = await changedLines(runGit, baseline);
+    if (viaBaseline === null)
+        return { base: anchor, repointedHead };
+    const viaMergeBase = await changedLines(runGit, anchor);
+    if (viaMergeBase === null || viaBaseline <= viaMergeBase)
+        return { base: baseline, repointedHead };
+    return { base: anchor, repointedHead };
+}
+//# sourceMappingURL=git-diff-base.js.map

package/dist/git-diff-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-diff-base.js","sourceRoot":"","sources":["../src/git-diff-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAwB7C;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,sEAAsE,CAAC;AAE3F;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,MAAiB,EAAE,IAAY;IAC5D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,MAAM,MAAM,GAAG,UAAU,IAAI,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACjF,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAiB,EACjB,UAAkB,EAClB,YAAgC;IAEhC,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,UAAU,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC;QACtB,WAAW;QACX,UAAU;QACV,SAAS;QACT,GAAG,UAAU,KAAK,YAAY,YAAY;KAC3C,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,YAAY,CAAC,MAAiB,EAAE,GAAW;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,8CAA8C,CAAC,EAAE,CAAC;QACpF,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAiB,EACjB,UAAkB,EAClB,IAAI,GAAmD,EAAE;IAEzD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC;IAEzD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,6CAA6C;IAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,EAAE,EAAE,CAAC;IAEtF,MAAM,aAAa,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEtD,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,YAAY,KAAK,IAAI,IAAI,WAAW,IAAI,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IACnG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACzC,CAAC"}