agentic-workflow-manager 9.18.0 → 9.20.0

package/dist/tests/core/changes/text-safety.test.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const text_safety_1 = require("../../../src/core/changes/text-safety");
+const LINE_BREAKS = ['\r', '\n', '\u0085', '
', '
'];
+describe('isSingleLine', () => {
+    test.each(['', 'plain', 'with spaces', 'ñandú', '😀', 'a/b:c'])('accepts %j', (t) => {
+        expect((0, text_safety_1.isSingleLine)(t)).toBe(true);
+    });
+    test.each([...LINE_BREAKS, '\t', '\u0000', '\u001b', '\u007f', '\u0080', '\u009f'])('rejects a string containing %j', (c) => {
+        expect((0, text_safety_1.isSingleLine)(`a${c}b`)).toBe(false);
+    });
+    test.each([undefined, null, 1, {}, []])('rejects the non-string %j', (v) => {
+        expect((0, text_safety_1.isSingleLine)(v)).toBe(false);
+    });
+});
+describe('isSafeMultiline', () => {
+    test('accepts newline, tab, U+2028 and plain text', () => {
+        expect((0, text_safety_1.isSafeMultiline)('line 1\n\tline 2
x')).toBe(true);
+    });
+    test.each(['\r', '\u0085', '\u0000', '\u001b', '\u007f', '\u0080', '\u009f'])('rejects a string containing %j', (c) => {
+        expect((0, text_safety_1.isSafeMultiline)(`a${c}b`)).toBe(false);
+    });
+    test.each([undefined, null, 1, {}, []])('rejects the non-string %j', (v) => {
+        expect((0, text_safety_1.isSafeMultiline)(v)).toBe(false);
+    });
+});
+const LONE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+describe('sliceNoSplit', () => {
+    test('returns short text unchanged', () => {
+        expect((0, text_safety_1.sliceNoSplit)('abc', 3)).toBe('abc');
+        expect((0, text_safety_1.sliceNoSplit)('', 3)).toBe('');
+    });
+    test('cuts at the given number of UTF-16 units', () => {
+        expect((0, text_safety_1.sliceNoSplit)('abcdef', 4)).toBe('abcd');
+    });
+    test('drops a trailing high surrogate instead of splitting the pair', () => {
+        expect((0, text_safety_1.sliceNoSplit)('ab😀cd', 3)).toBe('ab');
+        expect((0, text_safety_1.sliceNoSplit)('ab😀cd', 4)).toBe('ab😀');
+        expect((0, text_safety_1.sliceNoSplit)('😀😀', 1)).toBe('');
+    });
+});
+describe('escapeText', () => {
+    test('JSON-escapes quotes, backslashes and controls', () => {
+        expect((0, text_safety_1.escapeText)('a"b\\c\nd\x1b')).toBe('a\\"b\\\\c\\nd\\u001b');
+    });
+    test('escapes the line breaks JSON leaves alone', () => {
+        expect((0, text_safety_1.escapeText)('\u0085\u2028\u2029')).toBe('\\u0085\\u2028\\u2029');
+    });
+    test('escapes lone surrogates', () => {
+        expect((0, text_safety_1.escapeText)('\ud800')).not.toMatch(LONE);
+    });
+    test('does not clip', () => {
+        expect((0, text_safety_1.escapeText)('x'.repeat(1000))).toHaveLength(1000);
+    });
+});
+describe('esc', () => {
+    test('leaves ordinary short text unchanged', () => {
+        expect((0, text_safety_1.esc)('status')).toBe('status');
+    });
+    test('clips to 80 code points with an ellipsis', () => {
+        expect((0, text_safety_1.esc)('y'.repeat(81))).toBe(`${'y'.repeat(80)}…`);
+    });
+    test('bounds the escaped length and never splits a surrogate pair', () => {
+        for (let pad = 0; pad < 4; pad++) {
+            const out = (0, text_safety_1.esc)(`${'\u0001'.repeat(39)}${'a'.repeat(pad)}😀bbbb`);
+            expect(out.length).toBeLessThanOrEqual(241);
+            expect(out).not.toMatch(LONE);
+            expect(out).not.toMatch(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/);
+        }
+    });
+});
+describe('clipMessage', () => {
+    test('leaves messages up to the limit unchanged', () => {
+        expect((0, text_safety_1.clipMessage)('x'.repeat(text_safety_1.MAX_MESSAGE))).toBe('x'.repeat(text_safety_1.MAX_MESSAGE));
+    });
+    test('clips to the limit including the ellipsis', () => {
+        const out = (0, text_safety_1.clipMessage)('x'.repeat(text_safety_1.MAX_MESSAGE + 50));
+        expect(out).toHaveLength(text_safety_1.MAX_MESSAGE);
+        expect(out.endsWith('…')).toBe(true);
+    });
+    test('never splits a surrogate pair', () => {
+        for (const pad of ['', 'x']) {
+            const out = (0, text_safety_1.clipMessage)(`${pad}${'😀'.repeat(300)}`);
+            expect(out.length).toBeLessThanOrEqual(text_safety_1.MAX_MESSAGE);
+            expect(out).not.toMatch(LONE);
+        }
+    });
+});
+describe('every export tolerates non-string text without throwing', () => {
+    const nonStrings = [['undefined', undefined], ['null', null], ['42', 42], ['{}', {}], ['[]', []], ['a Buffer', Buffer.from('x')], ['NaN', NaN]];
+    test.each(nonStrings)('esc, escapeText, cleanText and clipMessage map %s to the placeholder', (_label, value) => {
+        expect(() => (0, text_safety_1.esc)(value)).not.toThrow();
+        expect((0, text_safety_1.esc)(value)).toBe(text_safety_1.NON_STRING);
+        expect((0, text_safety_1.escapeText)(value)).toBe(text_safety_1.NON_STRING);
+        expect((0, text_safety_1.cleanText)(value)).toBe(text_safety_1.NON_STRING);
+        expect((0, text_safety_1.clipMessage)(value)).toBe(text_safety_1.NON_STRING);
+    });
+    test.each(nonStrings)('sliceNoSplit returns an empty string for text %s', (_label, value) => {
+        expect(() => (0, text_safety_1.sliceNoSplit)(value, 5)).not.toThrow();
+        expect((0, text_safety_1.sliceNoSplit)(value, 5)).toBe('');
+    });
+    test.each(nonStrings)('isSingleLine and isSafeMultiline are false for %s', (_label, value) => {
+        expect((0, text_safety_1.isSingleLine)(value)).toBe(false);
+        expect((0, text_safety_1.isSafeMultiline)(value)).toBe(false);
+    });
+    test('the placeholder is itself single-line text', () => {
+        expect((0, text_safety_1.isSingleLine)(text_safety_1.NON_STRING)).toBe(true);
+    });
+});
+describe('sliceNoSplit with a bad limit never throws and never over-returns', () => {
+    test.each([['NaN', NaN], ['-1', -1], ['-Infinity', -Infinity], ['Infinity', Infinity], ['0', 0], ['0.9', 0.9], ['undefined', undefined], ['null', null], ['a string', '3']])('maxUnits %s yields an empty string', (_label, limit) => {
+        expect(() => (0, text_safety_1.sliceNoSplit)('abc', limit)).not.toThrow();
+        expect((0, text_safety_1.sliceNoSplit)('abc', limit)).toBe('');
+    });
+    test('a fractional limit is floored', () => {
+        expect((0, text_safety_1.sliceNoSplit)('abcdef', 2.9)).toBe('ab');
+    });
+    test('a whole-number limit is unchanged', () => {
+        expect((0, text_safety_1.sliceNoSplit)('abcdef', 6)).toBe('abcdef');
+        expect((0, text_safety_1.sliceNoSplit)('abcdef', 100)).toBe('abcdef');
+    });
+});
+describe('isSafeRelativePath', () => {
+    test.each(['a', 'a/b', 'docs/changes', '.awm/journal', 'src/file name.ts', 'ñandú/x', '.hidden/..dots', 'a'.repeat(1024)])('accepts %j', (p) => {
+        expect((0, text_safety_1.isSafeRelativePath)(p)).toBe(true);
+    });
+    test.each([
+        ['empty', ''], ['dot', '.'], ['dot-dot', '..'], ['parent segment', '../a'], ['inner parent', 'a/../b'], ['dot segment', 'a/./b'], ['empty segment', 'a//b'],
+        ['trailing slash', 'a/'], ['absolute', '/a'], ['drive letter', 'C:/a'], ['drive letter, no slash', 'C:a'], ['backslash', 'a\\b'],
+        ['leading space', ' a'], ['trailing space', 'a '], ['leading tab', '\ta'], ['newline', 'a\nb'], ['carriage return', 'a\rb'], ['NUL', 'a\u0000b'],
+        ['ESC', 'a\u001bb'], ['DEL', 'a\u007fb'], ['C1 control', 'a\u0085b'], ['line separator', 'a\u2028b'], ['paragraph separator', 'a\u2029b'],
+        ['over-length', 'a'.repeat(1025)], ['trailing no-break space', 'a\u00a0'],
+    ])('rejects %s', (_label, p) => {
+        expect((0, text_safety_1.isSafeRelativePath)(p)).toBe(false);
+    });
+    test.each([[undefined], [null], [7], [{}], [['a']], [true]])('rejects the non-string %p without throwing', (p) => {
+        expect((0, text_safety_1.isSafeRelativePath)(p)).toBe(false);
+    });
+});
+describe('isObj', () => {
+    test.each([[{}], [{ a: 1 }], [Object.create(null)]])('accepts the object %j', (v) => {
+        expect((0, text_safety_1.isObj)(v)).toBe(true);
+    });
+    test.each([[null], [undefined], [[]], [[1]], ['x'], [1], [true]])('rejects %j', (v) => {
+        expect((0, text_safety_1.isObj)(v)).toBe(false);
+    });
+});
+describe('isWellFormed', () => {
+    test.each(['', 'plain', 'ñandú', '😀'])('accepts %j', (t) => {
+        expect((0, text_safety_1.isWellFormed)(t)).toBe(true);
+    });
+    test.each(['a\ud800b', '\udc00', 'a\ud83d'])('rejects a lone surrogate in %j', (t) => {
+        expect((0, text_safety_1.isWellFormed)(t)).toBe(false);
+    });
+    test.each([[undefined], [null], [1]])('rejects the non-string %p', (v) => {
+        expect((0, text_safety_1.isWellFormed)(v)).toBe(false);
+    });
+});
+describe('isHttpsUrl', () => {
+    const lenient = { allowCredentials: true };
+    const strict = { allowCredentials: false, maxLength: 2048 };
+    test.each(['https://github.com/o/r/issues/1', 'https://example.com', 'https://example.com:8443/a?b=c#d', 'https://[::1]/x'])('accepts %j in both modes', (u) => {
+        expect((0, text_safety_1.isHttpsUrl)(u, lenient)).toBe(true);
+        expect((0, text_safety_1.isHttpsUrl)(u, strict)).toBe(true);
+    });
+    test.each([
+        ['http', 'http://example.com'], ['other scheme', 'javascript:alert(1)'], ['upper-case scheme', 'HTTPS://example.com'], ['no authority', 'https://'],
+        ['empty host before a path', 'https:///a'], ['query first', 'https://?a'], ['whitespace', 'https://example.com/a b'], ['a line break', 'https://example.com/a\nb'],
+        ['a backslash first', 'https://\\example.com'], ['an at-sign first', 'https://@example.com'], ['plain text', 'not a url'], ['empty', ''],
+    ])('rejects %s in both modes', (_name, u) => {
+        expect((0, text_safety_1.isHttpsUrl)(u, lenient)).toBe(false);
+        expect((0, text_safety_1.isHttpsUrl)(u, strict)).toBe(false);
+    });
+    test('credentials are accepted only when allowed', () => {
+        expect((0, text_safety_1.isHttpsUrl)('https://user:pw@example.com/1', lenient)).toBe(true);
+        expect((0, text_safety_1.isHttpsUrl)('https://user:pw@example.com/1', strict)).toBe(false);
+        expect((0, text_safety_1.isHttpsUrl)('https://user@example.com/1', strict)).toBe(false);
+    });
+    test('the length limit applies only when given', () => {
+        const long = `https://example.com/${'a'.repeat(3000)}`;
+        expect((0, text_safety_1.isHttpsUrl)(long, lenient)).toBe(true);
+        expect((0, text_safety_1.isHttpsUrl)(long, strict)).toBe(false);
+        expect((0, text_safety_1.isHttpsUrl)(`https://example.com/${'a'.repeat(2048 - 20)}`, strict)).toBe(true);
+    });
+    test.each([[undefined], [null], [1], [{}]])('rejects the non-string %p without throwing', (v) => {
+        expect((0, text_safety_1.isHttpsUrl)(v, lenient)).toBe(false);
+    });
+});
+describe('isCanonicalIso', () => {
+    test.each(['2026-10-17T12:00:00.000Z', '1970-01-01T00:00:00.000Z', '2024-02-29T23:59:59.999Z'])('accepts %j', (v) => {
+        expect((0, text_safety_1.isCanonicalIso)(v)).toBe(true);
+    });
+    test.each([
+        ['a date only', '2026-10-17'], ['no milliseconds', '2026-10-17T12:00:00Z'], ['an offset', '2026-10-17T12:00:00.000+00:00'], ['lower-case z', '2026-10-17T12:00:00.000z'],
+        ['an impossible day', '2026-02-30T00:00:00.000Z'], ['padding', ' 2026-10-17T12:00:00.000Z'], ['text', 'yesterday'], ['empty', ''],
+    ])('rejects %s', (_n, v) => {
+        expect((0, text_safety_1.isCanonicalIso)(v)).toBe(false);
+    });
+    test.each([[undefined], [null], [0], [{}], [new Date(0)], [Symbol('x')], [{ toString: () => { throw new Error('boom'); } }], [{ toString: () => '2026-10-17T12:00:00.000Z' }]])('rejects the non-string %p without throwing', (v) => {
+        expect((0, text_safety_1.isCanonicalIso)(v)).toBe(false);
+    });
+});
+// Bidirectional controls reorder what a terminal shows around them: every echo of untrusted text escapes them, the same way everywhere.
+const BIDI_CHARS = ['\u061c', '\u200e', '\u200f', '\u202a', '\u202b', '\u202c', '\u202d', '\u202e', '\u2066', '\u2067', '\u2068', '\u2069'];
+const hex = (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`;
+describe('bidi controls are escaped by the shared helpers', () => {
+    test.each(BIDI_CHARS)('escapeBidi escapes %j', (c) => {
+        expect((0, text_safety_1.escapeBidi)(`a${c}b`)).toBe(`a${hex(c)}b`);
+    });
+    test('escapeBidi leaves other text alone', () => {
+        expect((0, text_safety_1.escapeBidi)('plain \u00e9 \u6f22 \u{1F600}')).toBe('plain \u00e9 \u6f22 \u{1F600}');
+    });
+    test.each([...BIDI_CHARS, '\u2028', '\u2029'])('escapeText, cleanText and esc escape %j', (c) => {
+        expect((0, text_safety_1.escapeText)(`a${c}b`)).toBe(`a${hex(c)}b`);
+        expect((0, text_safety_1.cleanText)(`a${c}b`)).toBe(`a${hex(c)}b`);
+        expect((0, text_safety_1.esc)(`a${c}b`)).toBe(`a${hex(c)}b`);
+    });
+    test('the escaped output of every helper holds no bidi control and no raw line separator', () => {
+        const hostile = `${BIDI_CHARS.join('')}\u2028\u2029x`;
+        for (const out of [(0, text_safety_1.escapeText)(hostile), (0, text_safety_1.cleanText)(hostile), (0, text_safety_1.esc)(hostile)])
+            expect(out).not.toMatch(/[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\u2028\u2029]/);
+    });
+    test('they are still valid text for the predicates: isSingleLine is about controls and line breaks, not bidi', () => {
+        expect((0, text_safety_1.isSingleLine)('a\u202eb')).toBe(true);
+    });
+});

package/dist/tests/core/changes/trailers.test.js

@@ -0,0 +1,181 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const helpers_1 = require("./helpers");
+const trailers_1 = require("../../../src/core/changes/trailers");
+describe('hasOptOut', () => {
+    let repo;
+    let template;
+    beforeAll(() => { template = (0, helpers_1.makeRepo)(); });
+    afterAll(() => template.cleanup());
+    beforeEach(() => { repo = (0, helpers_1.cloneRepo)(template); });
+    afterEach(() => repo.cleanup());
+    const branch = () => (0, helpers_1.branchOff)(repo);
+    const noNewFile = (name) => expect(fs_1.default.existsSync(path_1.default.join(repo.root, name))).toBe(false);
+    const nonRepoDir = () => (0, helpers_1.nonRepoDir)(repo);
+    test('detects Change-Record: none in a range', () => {
+        const base = branch();
+        repo.commit({ 'a.ts': '1' }, 'docs: typo');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(false);
+        repo.commit({ 'b.ts': '1' }, 'docs: typo2\n\nChange-Record: none');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(true);
+    });
+    test('the key and the value match case-insensitively', () => {
+        const base = branch();
+        repo.commit({ 'a.ts': '1' }, 'docs: typo\n\nchange-record:   NONE  ');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(true);
+    });
+    test('another value, another key or a longer key is not an opt-out', () => {
+        const base = branch();
+        repo.commit({ 'a.ts': '1' }, 'docs: a\n\nChange-Record: pending');
+        repo.commit({ 'b.ts': '1' }, 'docs: b\n\nChange-Records: none');
+        repo.commit({ 'c.ts': '1' }, 'docs: c\n\nX-Change-Record: none');
+        repo.commit({ 'd.ts': '1' }, 'docs: d\n\nChange-Record: none-ish');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(false);
+    });
+    test('DD-6 documented limit: a trailer in a mid-message paragraph (a squash-merge body) is NOT an opt-out; only the final paragraph counts', () => {
+        const base = branch();
+        // What a squash merge produces: the squashed commits' messages become the body, so the author's trailer is not last.
+        repo.commit({ 'a.ts': '1' }, 'docs: typo (#12)\n\n* docs: typo\n\nChange-Record: none\n\n* fix: other');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(false);
+        // The same trailer as the final paragraph (the author edited the squash message) is found.
+        repo.commit({ 'b.ts': '1' }, 'docs: typo (#13)\n\n* docs: typo\n\nChange-Record: none');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(true);
+    });
+    test('an opt-out is found among several trailers and among several commits', () => {
+        const base = branch();
+        repo.commit({ 'a.ts': '1' }, 'docs: a');
+        repo.commit({ 'b.ts': '1' }, 'docs: b\n\nChange-Record: pending\nChange-Record: none');
+        repo.commit({ 'c.ts': '1' }, 'docs: c');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(true);
+    });
+    test('trailer.* configuration cannot turn another separator or token into an opt-out', () => {
+        const base = branch();
+        repo.git('config', 'trailer.separators', ':=#');
+        repo.git('config', 'trailer.cr.key', 'Change-Record');
+        repo.commit({ 'a.ts': '1' }, 'docs: a\n\nChange-Record= none');
+        repo.commit({ 'b.ts': '1' }, 'docs: b\n\nCR: none');
+        repo.commit({ 'c.ts': '1' }, 'docs: c\n\nChange-Record# none');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(false);
+        repo.commit({ 'd.ts': '1' }, 'docs: d\n\nChange-Record: none');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(true);
+    });
+    test('the value must be exactly none after optional blanks, in the final paragraph', () => {
+        branch();
+        repo.commit({ 'a.ts': '1' }, 'docs: a\n\nChange-Record:none');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(true);
+        repo.commit({ 'b.ts': '1' }, 'docs: b\n\nChange-Record:\t none \t');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(true);
+        repo.commit({ 'c.ts': '1' }, 'docs: c\n\nSigned-off-by: t\nChange-Record: none');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(true);
+        for (const message of ['docs: d\n\nChange-Record: nonesuch', 'docs: e\n\nChange-Record: none of it', 'docs: f\n\nChange-Record:', 'docs: g\n\nChange-Record:\n none', 'docs: h\n\n Change-Record: none', 'docs: i\n\nChange-Record: none\u00a0', 'docs: j\n\nChange-Record: none\u2028', 'docs: k\n\nChange-Record: none\u000b']) {
+            repo.commit({ [`${message[6]}.ts`]: '1' }, message);
+            expect([message, (0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])]).toEqual([message, false]);
+        }
+    });
+    test('text that is not in the trailer block does not count', () => {
+        const base = branch();
+        repo.commit({ 'a.ts': '1' }, 'Change-Record: none');
+        repo.commit({ 'b.ts': '1' }, 'docs: b\n\nChange-Record: none\n\nand then more prose after it');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(false);
+    });
+    test('a trailer value cannot forge none through folding or separators', () => {
+        const base = branch();
+        repo.commit({ 'a.ts': '1' }, 'docs: a\n\nChange-Record: other\n none');
+        repo.commit({ 'b.ts': '1' }, 'docs: b\n\nChange-Record: other\u001fnone');
+        repo.commit({ 'c.ts': '1' }, 'docs: c\n\nChange-Record: other\u001enone');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(false);
+    });
+    test('only the commits selected by the revisions are examined', () => {
+        repo.commit({ 'a.ts': '1' }, 'docs: early\n\nChange-Record: none');
+        const base = branch();
+        const tip = repo.commit({ 'b.ts': '1' }, 'docs: plain');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(false);
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', tip])).toBe(false);
+        expect((0, trailers_1.hasOptOut)(repo.root, [base])).toBe(true);
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', base])).toBe(true);
+    });
+    test.each([
+        [['--output=x']], [['--all']], [['-1', '--all']], [['-1', '-2', 'HEAD']], [['HEAD~1']], [['HEAD^']], [['HEAD@{1}']], [['-x', 'HEAD']], [['a\nb']], [['HEAD\u0000']], [[]], [['-1']], [(0, helpers_1.bad)('HEAD')], [(0, helpers_1.bad)(null)], [(0, helpers_1.bad)([7])], [(0, helpers_1.bad)([null])], [['']], [['-99999999', 'HEAD']],
+    ])('hostile revisions %j are rejected as no opt-out', (revArgs) => {
+        repo.commit({ 'z.ts': '1' }, 'docs: z\n\nChange-Record: none');
+        repo.commit({ 'y.ts': '1' }, 'docs: y');
+        expect((0, trailers_1.hasOptOut)(repo.root, revArgs)).toBe(false);
+        noNewFile('x');
+    });
+    test('option injection through the revisions creates no file', () => {
+        expect((0, trailers_1.hasOptOut)(repo.root, ['--output=injected.txt', 'HEAD'])).toBe(false);
+        noNewFile('injected.txt');
+    });
+    test('a non-string root or a non-repository is no opt-out', () => {
+        expect((0, trailers_1.hasOptOut)((0, helpers_1.bad)(null), ['HEAD'])).toBe(false);
+        expect((0, trailers_1.hasOptOut)(nonRepoDir(), ['HEAD'])).toBe(false);
+    });
+    test('hasOptOut sees a signed Change-Record: none commit even with log.showSignature on', () => {
+        const base = branch();
+        (0, helpers_1.showSignaturesInLog)(repo);
+        (0, helpers_1.commitForgedSigned)(repo, 'docs: signed\n\nChange-Record: none');
+        expect(repo.git('log', '-1', '--format=%s')).not.toBe('docs: signed');
+        expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(true);
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(true);
+    });
+    // The verification text of a signed commit comes out BEFORE the formatted message when log.showSignature is on. A fake gpg that
+    // ends its text with a blank line turns a subject-only `Change-Record: none` into a "second paragraph": without
+    // --no-show-signature (LOG_SAFETY_ARGS) hasOptOut would exempt a change that never opted out.
+    (0, helpers_1.posixOnly)('a signed commit whose verification text ends in a blank line is not read as having a final paragraph (LOG_SAFETY_ARGS)', () => {
+        const gpg = path_1.default.join(repo.home, 'fake-gpg.sh');
+        fs_1.default.writeFileSync(gpg, '#!/bin/sh\necho "[GNUPG:] GOODSIG 0123456789ABCDEF t <t@t>"\nprintf \'gpg: Signature made today\\ngpg: Good signature from "t"\\n\\n\' >&2\nexit 0\n', { mode: 0o755 });
+        repo.git('config', 'log.showSignature', 'true');
+        repo.git('config', 'gpg.program', gpg);
+        (0, helpers_1.commitForgedSigned)(repo, 'Change-Record: none');
+        // The fixture works: an unprotected log really carries the verification text in front of the message.
+        expect(repo.git('log', '-1', '-z', '--format=%B')).toContain('gpg: Good signature from "t"');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(false);
+    });
+    test('R4.2 a message with CRLF line endings (kept verbatim) still opts out: the trailing CR of the trailer line is ignored', () => {
+        const file = path_1.default.join(repo.home, 'crlf.txt');
+        fs_1.default.writeFileSync(file, 'docs: crlf\r\n\r\nChange-Record: none\r\n');
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'crlf.ts'), '1');
+        repo.git('add', '-A');
+        repo.git('commit', '-q', '--cleanup=verbatim', '-F', file);
+        expect(repo.git('log', '-1', '--format=%B')).toContain('\r');
+        expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(true);
+    });
+    test.each(['GIT_LITERAL_PATHSPECS', 'GIT_GLOB_PATHSPECS', 'GIT_NOGLOB_PATHSPECS', 'GIT_ICASE_PATHSPECS'])('%s=1 does not change the opt-out result', (name) => {
+        const base = branch();
+        repo.commit({ 'cli/src/a.ts': '1' }, 'feat(c): a\n\nChange-Record: none');
+        (0, helpers_1.withEnv)({ [name]: '1' }, () => expect((0, trailers_1.hasOptOut)(repo.root, [`${base}..HEAD`])).toBe(true));
+    });
+    // Untrusted commit messages are scanned in linear time: a regex that backtracks over a long whitespace run took seconds (80k spaces: 6.6 s).
+    // The scaling is measured on the pure parser (no git child), so a slow or loaded runner cannot fail it; the git-level test only
+    // checks the result.
+    describe('linear-time parsing of hostile messages', () => {
+        const CASES = [
+            ['spaces inside a line of the final paragraph', (n) => `docs: a\n\nx${' '.repeat(n)}y`, false],
+            ['spaces inside the subject line', (n) => `docs: x${' '.repeat(n)}y\n\nChange-Record: none`, true],
+            ['alternating blanks inside a line', (n) => `docs: a\n\nx${' \t'.repeat(n / 2)}y`, false],
+            ['a single very long line', (n) => `docs: a\n\n${'x'.repeat(n)}`, false],
+            ['an opt-out line followed by blanks and text', (n) => `docs: a\n\nChange-Record: none${' '.repeat(n)}x`, false],
+            ['an opt-out key followed by blanks and no value', (n) => `docs: a\n\nChange-Record:${' '.repeat(n)}`, false],
+            ['an opt-out line with trailing blanks', (n) => `docs: a\n\nChange-Record: none${' '.repeat(n)}`, true],
+            ['many blank lines between paragraphs', (n) => `docs: a\n${'\n'.repeat(n / 2)}Change-Record: none`, true],
+            ['many whitespace-only lines', (n) => `docs: a\n\n${' \n'.repeat(n / 2)}Change-Record: none`, true],
+        ];
+        test.each(CASES)('%s gives the usual result through git', (_label, message, expected) => {
+            const file = path_1.default.join(repo.home, 'message.txt');
+            fs_1.default.writeFileSync(file, message(200_000));
+            fs_1.default.writeFileSync(path_1.default.join(repo.root, 'perf.txt'), 'x');
+            repo.git('add', '-A');
+            repo.git('commit', '-q', '--cleanup=verbatim', '-F', file);
+            expect((0, trailers_1.hasOptOut)(repo.root, ['-1', 'HEAD'])).toBe(expected);
+        });
+        test.each(CASES)('%s: the parser gives the usual result and scales linearly', (_label, message, expected) => {
+            expect((0, trailers_1.optsOut)(message(200_000))).toBe(expected);
+            (0, helpers_1.expectLinearScaling)((n) => { (0, trailers_1.optsOut)(message(n)); }, 20_000);
+        });
+    });
+});