agentic-workflow-manager 9.19.0 → 9.20.0

package/dist/tests/core/changes/git-env.test.js

@@ -0,0 +1,143 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = __importDefault(require("child_process"));
+const git_env_1 = require("../../../src/core/changes/git-env");
+const git_1 = require("../../../src/core/changes/git");
+const receipt_1 = require("../../../src/core/changes/receipt");
+const change_1 = require("../../../src/commands/change");
+const worktree_1 = require("../../../src/core/changes/worktree");
+const helpers_1 = require("./helpers");
+describe('gitSpawnOptions', () => {
+    test('has the cwd, utf8, the shared timeout and a scrubbed environment (stdio is spelled out by execGit)', () => {
+        (0, helpers_1.withEnv)({ GIT_LITERAL_PATHSPECS: '1', GIT_AUTHOR_NAME: 'a' }, () => {
+            const opts = (0, git_env_1.gitSpawnOptions)('/some/dir');
+            expect(opts).toMatchObject({ cwd: '/some/dir', encoding: 'utf8', timeout: git_env_1.GIT_TIMEOUT_MS });
+            expect(opts.env.GIT_LITERAL_PATHSPECS).toBeUndefined();
+            expect(opts.env.GIT_AUTHOR_NAME).toBe('a');
+        });
+    });
+    test('every git child runs with lazy fetching off', () => {
+        expect((0, git_env_1.gitSpawnOptions)('/some/dir').env.GIT_NO_LAZY_FETCH).toBe('1');
+    });
+    test('takes the output buffer from an explicit parameter', () => {
+        const opts = (0, git_env_1.gitSpawnOptions)('/d', { stderr: 'ignore', maxBuffer: 64 * 1024 * 1024 });
+        expect(opts.maxBuffer).toBe(64 * 1024 * 1024);
+    });
+    test('leaves maxBuffer to the Node default when none is requested', () => {
+        expect('maxBuffer' in (0, git_env_1.gitSpawnOptions)('/d')).toBe(false);
+    });
+});
+describe('gitChildEnv', () => {
+    test('removes the pathspec variables whatever their case, and keeps everything else', () => {
+        (0, helpers_1.withEnv)({ GIT_LITERAL_PATHSPECS: '1', git_literal_pathspecs: '1', Git_Icase_Pathspecs: '1', GIT_GLOB_PATHSPECS: '1', git_noglob_pathspecs: '1', GIT_CONFIG_NOSYSTEM: '1', GIT_AUTHOR_NAME: 'a', AWM_KEEP_ME: 'k' }, () => {
+            const env = (0, git_env_1.gitChildEnv)();
+            expect(Object.keys(env).filter((k) => k.toUpperCase().endsWith('_PATHSPECS'))).toEqual([]);
+            expect(env.GIT_CONFIG_NOSYSTEM).toBe('1');
+            expect(env.GIT_AUTHOR_NAME).toBe('a');
+            expect(env.AWM_KEEP_ME).toBe('k');
+        });
+    });
+    test('turns lazy fetching off, whatever the caller has set, so that reading never fetches from a promisor remote', () => {
+        for (const value of [undefined, '0', 'false', '']) {
+            (0, helpers_1.withEnv)(value === undefined ? {} : { GIT_NO_LAZY_FETCH: value }, () => expect((0, git_env_1.gitChildEnv)().GIT_NO_LAZY_FETCH).toBe('1'));
+        }
+    });
+    test('turns lazy fetching off under any spelling of the name (environment names are case-insensitive on Windows)', () => {
+        (0, helpers_1.withEnv)({ git_no_lazy_fetch: '0' }, () => {
+            const env = (0, git_env_1.gitChildEnv)();
+            expect(Object.keys(env).filter((k) => k.toUpperCase() === 'GIT_NO_LAZY_FETCH')).toEqual(['GIT_NO_LAZY_FETCH']);
+            expect(env.GIT_NO_LAZY_FETCH).toBe('1');
+        });
+    });
+    test.each(['GIT_DIR', 'GIT_INDEX_FILE', 'GIT_WORK_TREE', 'GIT_COMMON_DIR', 'GIT_OBJECT_DIRECTORY', 'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_NAMESPACE', 'GIT_PREFIX'])('removes the repository-location variable %s under any spelling, and keeps the rest of the environment', (name) => {
+        (0, helpers_1.withEnv)({ [name]: '/hostile', [name.toLowerCase()]: '/hostile', GIT_AUTHOR_NAME: 'a' }, () => {
+            const env = (0, git_env_1.gitChildEnv)();
+            expect(Object.keys(env).filter((k) => k.toUpperCase() === name)).toEqual([]);
+            expect(env.GIT_AUTHOR_NAME).toBe('a');
+        });
+    });
+    test('does not modify process.env', () => {
+        (0, helpers_1.withEnv)({ GIT_LITERAL_PATHSPECS: '1' }, () => {
+            (0, git_env_1.gitChildEnv)();
+            expect(process.env.GIT_LITERAL_PATHSPECS).toBe('1');
+        });
+    });
+});
+describe('the options every git child is really spawned with (stdio is explicit at the call)', () => {
+    const optionsOfCalls = (fn) => {
+        const real = child_process_1.default.execFileSync;
+        const seen = [];
+        const spy = jest.spyOn(child_process_1.default, 'execFileSync').mockImplementation(((cmd, args, opts) => {
+            seen.push(opts);
+            return real(cmd, args, opts);
+        }));
+        try {
+            fn();
+        }
+        finally {
+            spy.mockRestore();
+        }
+        return seen;
+    };
+    test('execGit returns stdout and passes stdin closed, stdout piped, stderr as asked', () => {
+        const repo = (0, helpers_1.makeRepo)();
+        try {
+            const piped = optionsOfCalls(() => expect((0, git_env_1.execGit)(repo.root, ['rev-parse', 'HEAD'])).toBe(repo.git('rev-parse', 'HEAD') + '\n'));
+            expect(piped.map((o) => o.stdio)).toEqual([['ignore', 'pipe', 'pipe']]);
+            const ignored = optionsOfCalls(() => { (0, git_env_1.execGit)(repo.root, ['rev-parse', 'HEAD'], { stderr: 'ignore' }); });
+            expect(ignored.map((o) => o.stdio)).toEqual([['ignore', 'pipe', 'ignore']]);
+        }
+        finally {
+            repo.cleanup();
+        }
+    });
+    test('runGit and gitState keep stdin closed and stdout piped on every child; gitState discards stderr', () => {
+        const repo = (0, helpers_1.makeRepo)();
+        try {
+            const run = optionsOfCalls(() => { expect((0, git_1.runGit)(repo.root, ['rev-parse', 'HEAD'])).not.toBeNull(); });
+            expect(run).toHaveLength(1);
+            expect(run[0]).toMatchObject({ cwd: repo.root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: git_env_1.GIT_TIMEOUT_MS });
+            const state = optionsOfCalls(() => { expect((0, worktree_1.gitState)(repo.root, true).kind).toBe('ok'); });
+            expect(state).toHaveLength(3);
+            for (const o of state)
+                expect(o).toMatchObject({ encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: git_env_1.GIT_TIMEOUT_MS });
+        }
+        finally {
+            repo.cleanup();
+        }
+    });
+});
+describe('an inherited GIT_DIR cannot redirect the change-record code to another repository', () => {
+    test('runGit, headSha, gitState, the receipt precondition and `change validate` all describe the cwd repository', () => {
+        const mine = (0, helpers_1.makeRepo)();
+        const decoy = (0, helpers_1.makeRepo)();
+        try {
+            decoy.commit({ 'decoy.txt': 'x' }, 'feat: the decoy has a different history');
+            const head = mine.git('rev-parse', 'HEAD');
+            const decoyHead = decoy.git('rev-parse', 'HEAD');
+            expect(decoyHead).not.toBe(head);
+            const validate = () => (0, change_1.runChangeValidate)(mine.root, undefined, { json: true });
+            const baseline = validate();
+            const hostile = { GIT_DIR: path_1.default.join(decoy.root, '.git'), GIT_WORK_TREE: decoy.root, GIT_INDEX_FILE: path_1.default.join(decoy.root, '.git', 'index') };
+            (0, helpers_1.withEnv)(hostile, () => {
+                expect((0, git_1.runGit)(mine.root, ['rev-parse', 'HEAD'])?.trim()).toBe(head);
+                expect((0, git_1.headSha)(mine.root)).toBe(head);
+                const state = (0, worktree_1.gitState)(mine.root, true);
+                expect(state.kind === 'ok' && state.commit).toBe(head);
+                const pre = (0, receipt_1.captureReceiptPrecondition)(mine.root);
+                expect(pre.eligible && pre.commit).toBe(head);
+                expect(pre.eligible && fs_1.default.realpathSync.native(pre.root)).toBe(mine.root);
+                expect(validate()).toEqual(baseline);
+            });
+        }
+        finally {
+            decoy.cleanup();
+            mine.cleanup();
+        }
+    });
+});

package/dist/tests/core/changes/git.test.js

@@ -0,0 +1,442 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const helpers_1 = require("./helpers");
+const git_1 = require("../../../src/core/changes/git");
+const ANY_DIR = os_1.default.tmpdir();
+const NOT_STRINGS = [undefined, null, 7, {}, ['main'], true];
+const UNSAFE_REFS = ['--upload-pack=x', '-x', '-', 'a..b', 'a b', 'main\n', 'x\ny', 'a\u0000b', 'a;b', '$(id)', 'a`b`', 'main^', 'HEAD~1', 'a:b', '', 'a'.repeat(300), 'ma\u0301in'];
+/** The base ref `resolveBaseCommit` picks (R3.1), or null. */
+const baseOf = (root, explicit) => (0, git_1.resolveBaseCommit)(root, explicit)?.base ?? null;
+describe('ref and revision predicates (no repository)', () => {
+    test('isSafeRef accepts plain ref names only', () => {
+        for (const ok of ['main', 'refs/remotes/origin/HEAD', 'feat/x-1.2', 'a'.repeat(40), '.hidden'])
+            expect((0, git_1.isSafeRef)(ok)).toBe(true);
+        for (const no of ['', '-x', '--a', 'a..b', 'a b', 'a\nb', 'a^', 'a~1', 'a@{1}', 'a:b', 'a'.repeat(256), 7, null, undefined, {}])
+            expect((0, git_1.isSafeRef)(no)).toBe(false);
+    });
+    test('isSafeRevision accepts a ref or a two-sided range', () => {
+        for (const ok of ['main', 'a..b', 'a...b', 'refs/heads/x..HEAD'])
+            expect((0, git_1.isSafeRevision)(ok)).toBe(true);
+        for (const no of ['', '..', 'a..', '..b', 'a..b..c', '-x..b', 'a..-x', 'a b..c', 7, null])
+            expect((0, git_1.isSafeRevision)(no)).toBe(false);
+    });
+    test('LOG_SAFETY_ARGS switches signature display off and fixes the encoding', () => {
+        expect([...git_1.LOG_SAFETY_ARGS]).toEqual(['--no-show-signature', '--encoding=UTF-8']);
+    });
+    test.each(NOT_STRINGS)('returns null for a non-string cwd (%p)', (cwd) => {
+        expect((0, git_1.runGit)((0, helpers_1.bad)(cwd), ['status'])).toBeNull();
+    });
+    test('returns null for a non-array args value', () => {
+        expect((0, git_1.runGit)(ANY_DIR, (0, helpers_1.bad)('status'))).toBeNull();
+    });
+    test('returns null when an argument is not a string or holds a NUL', () => {
+        expect((0, git_1.runGit)(ANY_DIR, (0, helpers_1.bad)(['status', 7]))).toBeNull();
+        expect((0, git_1.runGit)(ANY_DIR, ['status', 'a\u0000b'])).toBeNull();
+    });
+});
+describe('git functions in a repository', () => {
+    let repo;
+    let template;
+    beforeAll(() => { template = (0, helpers_1.makeRepo)(); });
+    afterAll(() => template.cleanup());
+    beforeEach(() => { repo = (0, helpers_1.cloneRepo)(template); });
+    afterEach(() => repo.cleanup());
+    const branch = () => (0, helpers_1.branchOff)(repo);
+    const noNewFile = (name) => expect(fs_1.default.existsSync(path_1.default.join(repo.root, name))).toBe(false);
+    const nonRepoDir = () => (0, helpers_1.nonRepoDir)(repo);
+    test('returns the output of a successful command', () => {
+        expect((0, git_1.runGit)(repo.root, ['rev-parse', '--is-inside-work-tree'])?.trim()).toBe('true');
+    });
+    test('reads output above Node\'s 1 MB default and gives up (null) above 16 MB', () => {
+        const blob = (megabytes) => {
+            const file = path_1.default.join(repo.home, `blob-${megabytes}`);
+            fs_1.default.writeFileSync(file, 'x'.repeat(megabytes * 1024 * 1024));
+            return repo.git('hash-object', '-w', file);
+        };
+        expect((0, git_1.runGit)(repo.root, ['cat-file', 'blob', blob(2)])?.length).toBe(2 * 1024 * 1024);
+        expect((0, git_1.runGit)(repo.root, ['cat-file', 'blob', blob(17)])).toBeNull();
+    });
+    test('returns null when git fails', () => {
+        expect((0, git_1.runGit)(repo.root, ['rev-parse', '--verify', '--quiet', 'nope-ref'])).toBeNull();
+    });
+    test('returns null for a directory that does not exist', () => {
+        expect((0, git_1.runGit)(path_1.default.join(repo.home, 'missing'), ['status'])).toBeNull();
+    });
+    test('R3.1 resolves base: explicit, origin/HEAD, main, master', () => {
+        branch();
+        expect(baseOf(repo.root)).toBe('main');
+        expect(baseOf(repo.root, 'main')).toBe('main');
+        repo.git('update-ref', 'refs/remotes/origin/main', 'main');
+        repo.git('symbolic-ref', 'refs/remotes/origin/HEAD', 'refs/remotes/origin/main');
+        expect(baseOf(repo.root)).toBe('refs/remotes/origin/HEAD');
+    });
+    test('R3.1 an explicit base wins over origin/HEAD and main', () => {
+        branch();
+        repo.git('branch', 'release');
+        repo.git('update-ref', 'refs/remotes/origin/main', 'main');
+        repo.git('symbolic-ref', 'refs/remotes/origin/HEAD', 'refs/remotes/origin/main');
+        expect(baseOf(repo.root, 'release')).toBe('release');
+    });
+    test('R3.1 main wins over master and master is the last resort', () => {
+        repo.git('branch', 'master');
+        expect(baseOf(repo.root)).toBe('main');
+        repo.git('branch', '-m', 'main', 'trunk');
+        expect(baseOf(repo.root)).toBe('master');
+    });
+    test('R3.1 origin/HEAD that points nowhere is skipped', () => {
+        repo.git('symbolic-ref', 'refs/remotes/origin/HEAD', 'refs/remotes/origin/gone');
+        expect(baseOf(repo.root)).toBe('main');
+    });
+    test('R3.2 unresolvable base returns null', () => {
+        repo.git('branch', '-m', 'main', 'trunk');
+        expect(baseOf(repo.root)).toBeNull();
+        expect(baseOf(repo.root, 'nope')).toBeNull();
+    });
+    test.each(UNSAFE_REFS)('R3.2 unsafe explicit base %j returns null without falling back to main', (ref) => {
+        repo.commit({ 'second.ts': '1' }, 'feat: second');
+        expect(baseOf(repo.root, ref)).toBeNull();
+        noNewFile('x');
+    });
+    test.each(NOT_STRINGS.filter((v) => v !== undefined))('R3.2 non-string explicit base (%p) returns null', (ref) => {
+        expect(baseOf(repo.root, (0, helpers_1.bad)(ref))).toBeNull();
+    });
+    test('R3.2 a non-string root returns null', () => {
+        expect(baseOf((0, helpers_1.bad)(null))).toBeNull();
+        expect(baseOf(nonRepoDir())).toBeNull();
+    });
+    test('R3.1 a ref that names a tree rather than a commit is not a base', () => {
+        const tree = repo.git('rev-parse', 'HEAD^{tree}');
+        repo.git('update-ref', 'refs/tags/treeish', tree);
+        expect(baseOf(repo.root, 'treeish')).toBeNull();
+    });
+    test('mergeBase returns the fork point, not the tip of the base', () => {
+        const fork = branch();
+        repo.commit({ 'a.ts': '1' }, 'feat: a');
+        repo.git('checkout', '-q', 'main');
+        repo.commit({ 'm.ts': '1' }, 'feat: moves main');
+        repo.git('checkout', '-q', 'feat/x');
+        expect((0, git_1.mergeBase)(repo.root, 'main')).toBe(fork);
+        expect((0, git_1.mergeBase)(repo.root, 'main')).not.toBe(repo.git('rev-parse', 'main'));
+    });
+    test('mergeBase returns null for unrelated histories, unknown, unsafe or non-string refs', () => {
+        repo.git('checkout', '-q', '--orphan', 'orphan');
+        repo.commit({ 'o.ts': '1' }, 'feat: orphan');
+        expect((0, git_1.mergeBase)(repo.root, 'main')).toBeNull();
+        expect((0, git_1.mergeBase)(repo.root, 'nope')).toBeNull();
+        expect((0, git_1.mergeBase)(repo.root, '--output=x')).toBeNull();
+        expect((0, git_1.mergeBase)(repo.root, 'a..b')).toBeNull();
+        repo.commit({ 'second.ts': '1' }, 'feat: second');
+        expect((0, git_1.mergeBase)(repo.root, 'HEAD~1')).toBeNull();
+        expect((0, git_1.mergeBase)(repo.root, (0, helpers_1.bad)(7))).toBeNull();
+        expect((0, git_1.mergeBase)((0, helpers_1.bad)(undefined), 'main')).toBeNull();
+        noNewFile('x');
+    });
+    test('ancestry', () => {
+        const base = branch();
+        const c1 = repo.commit({ 'src/a.ts': '1' }, 'feat: a');
+        expect((0, git_1.isAncestor)(repo.root, base, c1)).toBe(true);
+        expect((0, git_1.isAncestor)(repo.root, c1, base)).toBe(false);
+        expect((0, git_1.isAncestor)(repo.root, 'f'.repeat(40), c1)).toBe(false);
+    });
+    test('ancestry is false for unsafe or non-string arguments', () => {
+        const base = branch();
+        repo.commit({ 'second.ts': '1' }, 'feat: second');
+        expect((0, git_1.isAncestor)(repo.root, 'HEAD~1', 'HEAD')).toBe(false);
+        expect((0, git_1.isAncestor)(repo.root, 'main', 'HEAD^')).toBe(false);
+        expect((0, git_1.isAncestor)(repo.root, '--help', 'HEAD')).toBe(false);
+        expect((0, git_1.isAncestor)(repo.root, base, '-x')).toBe(false);
+        expect((0, git_1.isAncestor)(repo.root, 'a..b', 'HEAD')).toBe(false);
+        expect((0, git_1.isAncestor)(repo.root, (0, helpers_1.bad)(null), 'HEAD')).toBe(false);
+        expect((0, git_1.isAncestor)(repo.root, base, (0, helpers_1.bad)(7))).toBe(false);
+        expect((0, git_1.isAncestor)((0, helpers_1.bad)({}), base, 'HEAD')).toBe(false);
+    });
+    test('changedFiles lists the files of the range', () => {
+        const base = branch();
+        repo.commit({ 'src/a.ts': '1' }, 'feat: a');
+        expect((0, git_1.changedFiles)(repo.root, base, 'HEAD')).toEqual(['src/a.ts']);
+    });
+    test('changedFiles reports a rename as the old and the new path', () => {
+        repo.commit({ 'old.ts': 'same content, long enough to be detected as a rename\n'.repeat(5) }, 'feat: old');
+        const base = branch();
+        repo.git('mv', 'old.ts', 'new.ts');
+        repo.git('commit', '-q', '-m', 'refactor: rename');
+        expect((0, git_1.changedFiles)(repo.root, base)?.slice().sort()).toEqual(['new.ts', 'old.ts']);
+    });
+    test('changedFiles returns paths verbatim: spaces, unicode and (off Windows) a newline', () => {
+        const base = branch();
+        const names = ['dir with space/ñandú.ts'];
+        if (process.platform !== 'win32')
+            names.push('line\nbreak/x.ts');
+        repo.commit(Object.fromEntries(names.map((n) => [n, '1'])), 'feat: odd names');
+        expect((0, git_1.changedFiles)(repo.root, base)?.slice().sort()).toEqual([...names].sort());
+    });
+    test('changedFiles returns null for unsafe, unknown or non-string revisions and for a non-repo', () => {
+        branch();
+        expect((0, git_1.changedFiles)(repo.root, '--output=x', 'HEAD')).toBeNull();
+        expect((0, git_1.changedFiles)(repo.root, 'HEAD', '--output=x')).toBeNull();
+        expect((0, git_1.changedFiles)(repo.root, 'nope', 'HEAD')).toBeNull();
+        expect((0, git_1.changedFiles)(repo.root, (0, helpers_1.bad)(7), 'HEAD')).toBeNull();
+        repo.commit({ 'second.ts': '1' }, 'feat: second');
+        expect((0, git_1.changedFiles)(repo.root, 'HEAD~1', 'HEAD')).toBeNull();
+        expect((0, git_1.changedFiles)(repo.root, 'HEAD', 'HEAD^')).toBeNull();
+        expect((0, git_1.changedFiles)(nonRepoDir(), 'main', 'HEAD')).toBeNull();
+        noNewFile('x');
+    });
+    test('addedFilesUnder lists only files ADDED in the range under the directory', () => {
+        repo.commit({ 'docs/changes/old.md': '1', 'docs/other/x.md': '1' }, 'docs: existing');
+        const base = branch();
+        repo.commit({ 'docs/changes/new.md': '1', 'docs/changes/old.md': '2', 'docs/other/y.md': '1', 'src/a.ts': '1' }, 'feat: a');
+        expect((0, git_1.addedFilesUnder)(repo.root, base, 'HEAD', 'docs/changes')).toEqual(['docs/changes/new.md']);
+    });
+    test('addedFilesUnder reports a file moved into the directory as added', () => {
+        repo.commit({ 'other/r.md': 'same content, long enough to be detected as a rename\n'.repeat(5) }, 'feat: r');
+        const base = branch();
+        fs_1.default.mkdirSync(path_1.default.join(repo.root, 'docs/changes'), { recursive: true });
+        repo.git('mv', 'other/r.md', 'docs/changes/r.md');
+        repo.git('commit', '-q', '-m', 'refactor: move');
+        expect((0, git_1.addedFilesUnder)(repo.root, base, 'HEAD', 'docs/changes')).toEqual(['docs/changes/r.md']);
+    });
+    test('addedFilesUnder returns null for unsafe revisions, an unsafe directory, an unknown revision and a non-repo', () => {
+        const base = branch();
+        repo.commit({ 'docs/changes/new.md': '1' }, 'feat: a');
+        expect((0, git_1.addedFilesUnder)(repo.root, '--output=x', 'HEAD', 'docs/changes')).toBeNull();
+        expect((0, git_1.addedFilesUnder)(repo.root, base, '-x', 'docs/changes')).toBeNull();
+        expect((0, git_1.addedFilesUnder)(repo.root, 'nope', 'HEAD', 'docs/changes')).toBeNull();
+        expect((0, git_1.addedFilesUnder)(repo.root, (0, helpers_1.bad)(7), 'HEAD', 'docs/changes')).toBeNull();
+        expect((0, git_1.addedFilesUnder)(repo.root, base, 'HEAD', '../x')).toBeNull();
+        expect((0, git_1.addedFilesUnder)(repo.root, base, 'HEAD', (0, helpers_1.bad)(null))).toBeNull();
+        expect((0, git_1.addedFilesUnder)(nonRepoDir(), 'main', 'HEAD', 'docs/changes')).toBeNull();
+        expect((0, git_1.addedFilesUnder)(repo.root, base, 'HEAD', 'docs/changes')).toEqual(['docs/changes/new.md']);
+    });
+    test('isCommittedClean is true for an unchanged tracked file and false after an unstaged or a staged edit', () => {
+        branch();
+        repo.commit({ 'docs/changes/r.md': 'one' }, 'docs: r');
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/r.md')).toBe(true);
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/r.md'), 'two');
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/r.md')).toBe(false);
+        repo.git('add', 'docs/changes/r.md');
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/r.md')).toBe(false);
+        repo.git('commit', '-q', '-m', 'docs: r2');
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/r.md')).toBe(true);
+    });
+    test('isCommittedClean looks only at the given path, literally', () => {
+        branch();
+        repo.commit({ 'docs/changes/r.md': 'one', 'docs/changes/s.md': 'one', 'docs/changes/[a].md': 'one', 'docs/changes/a.md': 'one' }, 'docs: files');
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/s.md'), 'two');
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/a.md'), 'two');
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/r.md')).toBe(true);
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/[a].md')).toBe(true); // a glob would match a.md
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/s.md')).toBe(false);
+    });
+    test('isCommittedClean ignores untracked files and runs from any directory of the repository', () => {
+        branch();
+        repo.commit({ 'docs/changes/r.md': 'one' }, 'docs: r');
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/new.md'), 'x');
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/new.md')).toBe(true);
+        expect((0, git_1.isCommittedClean)(path_1.default.join(repo.root, 'docs'), 'docs/changes/r.md')).toBe(true);
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/r.md'), 'two');
+        expect((0, git_1.isCommittedClean)(path_1.default.join(repo.root, 'docs'), 'docs/changes/r.md')).toBe(false);
+    });
+    test('isCommittedClean is null for an unsafe path, a non-string input and a non-repository', () => {
+        branch();
+        for (const rel of ['../x', '/etc/passwd', '', 'a\nb', '-x/../y', (0, helpers_1.bad)(7), (0, helpers_1.bad)(null)])
+            expect((0, git_1.isCommittedClean)(repo.root, rel)).toBeNull();
+        expect((0, git_1.isCommittedClean)((0, helpers_1.bad)(undefined), 'docs/changes/r.md')).toBeNull();
+        expect((0, git_1.isCommittedClean)(nonRepoDir(), 'docs/changes/r.md')).toBeNull();
+    });
+    test('isCommittedClean never takes the optional index lock (status would otherwise refresh and write the index)', () => {
+        branch();
+        repo.commit({ 'docs/changes/r.md': 'one' }, 'docs: r');
+        const git = (0, helpers_1.spyOnGit)();
+        try {
+            (0, git_1.isCommittedClean)(repo.root, 'docs/changes/r.md');
+        }
+        finally {
+            git.restore();
+        }
+        const { calls } = git;
+        expect(calls).toHaveLength(1);
+        expect(calls[0][0]).toBe('--no-optional-locks');
+        expect(calls[0]).toEqual(expect.arrayContaining(['status', '--porcelain', '-z', '--untracked-files=no', '--ignore-submodules=none']));
+    });
+    test('isCommittedClean leaves the index file untouched even when its stat data is stale', () => {
+        branch();
+        repo.commit({ 'docs/changes/r.md': 'one' }, 'docs: r');
+        const index = path_1.default.join(repo.root, '.git', 'index');
+        fs_1.default.utimesSync(path_1.default.join(repo.root, 'docs/changes/r.md'), new Date(2000, 0, 1), new Date(2000, 0, 1));
+        const before = fs_1.default.readFileSync(index);
+        expect((0, git_1.isCommittedClean)(repo.root, 'docs/changes/r.md')).toBe(true);
+        expect(fs_1.default.readFileSync(index).equals(before)).toBe(true);
+    });
+    test('dirtiness ignores only the excluded paths', () => {
+        branch();
+        expect((0, git_1.isDirtyOutside)(repo.root, ['docs/changes'])).toBe(false);
+        fs_1.default.mkdirSync(path_1.default.join(repo.root, 'docs/changes'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/r.md'), 'r');
+        expect((0, git_1.isDirtyOutside)(repo.root, ['docs/changes'])).toBe(false);
+        expect((0, git_1.isDirtyOutside)(repo.root, [])).toBe(true);
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs-x.md'), 'y');
+        expect((0, git_1.isDirtyOutside)(repo.root, ['.awm', 'docs/changes'])).toBe(true);
+    });
+    test('dirtiness: runtime state under .awm is ignored but a modified tracked sensors.json is dirty', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo.root, '.awm/journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, '.awm/sensors.json'), '{}');
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, '.awm/journal/j.json'), '1');
+        repo.git('add', '-f', '.awm/sensors.json', '.awm/journal/j.json');
+        repo.git('commit', '-q', '-m', 'chore: track awm files');
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, '.awm/journal/j.json'), '2');
+        expect((0, git_1.isDirtyOutside)(repo.root, [])).toBe(false);
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, '.awm/sensors.json'), '{"a":1}');
+        expect((0, git_1.isDirtyOutside)(repo.root, [])).toBe(true);
+    });
+    test('dirtiness: runtime state stays excluded when extra exclusions are given too', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo.root, '.awm/journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, '.awm/journal/j.json'), '1');
+        repo.git('add', '-f', '.awm/journal/j.json');
+        repo.git('commit', '-q', '-m', 'chore: track journal');
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, '.awm/journal/j.json'), '2');
+        fs_1.default.mkdirSync(path_1.default.join(repo.root, 'docs/changes'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/r.md'), 'r');
+        expect((0, git_1.isDirtyOutside)(repo.root, ['docs/changes'])).toBe(false);
+    });
+    test('dirtiness: a submodule checked out at another commit is dirty even with ignore=all and diff.ignoreSubmodules=all', () => {
+        const { commitInSm } = (0, helpers_1.makeHiddenSubmodule)(repo.root, (cwd, ...args) => repo.git('-C', cwd, ...args));
+        expect((0, git_1.isDirtyOutside)(repo.root, [])).toBe(false);
+        commitInSm('two');
+        expect((0, git_1.isDirtyOutside)(repo.root, [])).toBe(true);
+        expect((0, git_1.isDirtyOutside)(repo.root, ['docs/changes'])).toBe(true);
+    });
+    test('dirtiness is reported (fail closed) when the state cannot be read or the excludes are unsafe', () => {
+        expect((0, git_1.isDirtyOutside)(nonRepoDir(), [])).toBe(true);
+        expect((0, git_1.isDirtyOutside)((0, helpers_1.bad)(null), [])).toBe(true);
+        expect((0, git_1.isDirtyOutside)(repo.root, (0, helpers_1.bad)('docs/changes'))).toBe(true);
+        expect((0, git_1.isDirtyOutside)(repo.root, (0, helpers_1.bad)([7]))).toBe(true);
+        expect((0, git_1.isDirtyOutside)(repo.root, ['../outside'])).toBe(true);
+        expect((0, git_1.isDirtyOutside)(repo.root, ['a\nb'])).toBe(true);
+        expect((0, git_1.isDirtyOutside)(repo.root, ['/abs'])).toBe(true);
+    });
+    test('repoRoot and headSha describe the repository, from a subdirectory too', () => {
+        const sub = path_1.default.join(repo.root, 'deep', 'er');
+        fs_1.default.mkdirSync(sub, { recursive: true });
+        expect(fs_1.default.realpathSync.native((0, git_1.repoRoot)(repo.root))).toBe(fs_1.default.realpathSync.native(repo.root));
+        expect(fs_1.default.realpathSync.native((0, git_1.repoRoot)(sub))).toBe(fs_1.default.realpathSync.native(repo.root));
+        expect(path_1.default.isAbsolute((0, git_1.repoRoot)(sub))).toBe(true);
+        expect((0, git_1.headSha)(sub)).toBe(repo.git('rev-parse', 'HEAD'));
+    });
+    test('repoRoot and headSha never run git status, so a slow or failing status cannot hide a readable HEAD', () => {
+        const git = (0, helpers_1.spyOnGit)((args) => { if (args[0] === 'status')
+            throw Object.assign(new Error('status must not run'), { code: 'ETIMEDOUT' }); });
+        try {
+            expect(fs_1.default.realpathSync.native((0, git_1.repoRoot)(repo.root))).toBe(fs_1.default.realpathSync.native(repo.root));
+            expect((0, git_1.headSha)(repo.root)).toMatch(/^[0-9a-f]{40}$/);
+        }
+        finally {
+            git.restore();
+        }
+        const seen = git.calls.flat();
+        expect(seen).not.toContain('status');
+        expect(seen).toContain('rev-parse');
+    });
+    test('repoRoot works in a repository without a commit; headSha is null there', () => {
+        const empty = fs_1.default.mkdtempSync(path_1.default.join(repo.home, 'empty-'));
+        repo.git('-C', empty, 'init', '-q', '-b', 'main');
+        expect(fs_1.default.realpathSync.native((0, git_1.repoRoot)(empty))).toBe(fs_1.default.realpathSync.native(empty));
+        expect((0, git_1.headSha)(empty)).toBeNull();
+    });
+    test('repoRoot and headSha are null outside a repository and for non-string input', () => {
+        expect((0, git_1.repoRoot)(nonRepoDir())).toBeNull();
+        expect((0, git_1.headSha)(nonRepoDir())).toBeNull();
+        expect((0, git_1.repoRoot)((0, helpers_1.bad)(undefined))).toBeNull();
+        expect((0, git_1.headSha)((0, helpers_1.bad)(7))).toBeNull();
+    });
+    describe('repoIdentity', () => {
+        const identity = (url) => { repo.git('remote', 'add', 'origin', url); return (0, git_1.repoIdentity)(repo.root); };
+        test('is null without a remote', () => expect((0, git_1.repoIdentity)(repo.root)).toBeNull());
+        test('reads an https remote and strips credentials and .git', () => {
+            expect(identity('https://user:secret@github.com/Kodria/awm.git')).toBe('github.com/Kodria/awm');
+        });
+        test('reads an scp-style remote', () => expect(identity('git@github.com:Kodria/awm.git')).toBe('github.com/Kodria/awm'));
+        test('reads an ssh:// remote with a port', () => expect(identity('ssh://git@host.example:2222/o/r')).toBe('host.example/o/r'));
+        test('is null for an unparseable remote', () => expect(identity('not a url')).toBeNull());
+        test('lowercases the host in the scp-style and the URL form alike, so both name the same repository', () => {
+            expect(identity('git@GitHub.com:o/r.git')).toBe('github.com/o/r');
+            const other = (0, helpers_1.makeRepo)();
+            try {
+                other.git('remote', 'add', 'origin', 'https://GITHUB.com/o/r');
+                expect((0, git_1.repoIdentity)(other.root)).toBe('github.com/o/r');
+            }
+            finally {
+                other.cleanup();
+            }
+        });
+        test('strips credentials in the scp-style form too', () => {
+            expect(identity('user:secret@Host.example:o/r')).toBe('host.example/o/r');
+        });
+        test.each([
+            ['an scp-style remote with a ?query', 'git@host.example:o/r?token=SECRET'],
+            ['an scp-style remote with a #fragment', 'git@host.example:o/r#SECRET'],
+            ['an scp-style remote with .git then ?query', 'git@host.example:o/r.git?token=SECRET'],
+            ['an scp-style remote with a query and a fragment', 'git@host.example:o/r?a=1#SECRET'],
+            ['an https remote with a ?query', 'https://host.example/o/r?token=SECRET'],
+            ['an https remote with a #fragment', 'https://host.example/o/r#SECRET'],
+            ['an https remote with credentials, .git and a query', 'https://u:SECRET@host.example/o/r.git?token=SECRET'],
+        ])('R5.5 %s: the identity holds host/owner/name and no query or fragment', (_label, url) => {
+            const id = identity(url);
+            expect(id).toBe('host.example/o/r');
+            expect(id).not.toContain('SECRET');
+        });
+        test('an over-long remote url is null (git reads it, the 2048-unit cap rejects it)', () => {
+            fs_1.default.appendFileSync(path_1.default.join(repo.root, '.git', 'config'), `[remote "origin"]\n\turl = https://h.example/${'/'.repeat(100000)}x\n`);
+            expect((0, git_1.repoIdentity)(repo.root)).toBeNull();
+        });
+        test('identityFromUrl: a hostile url is rejected, whatever its length', () => {
+            expect((0, git_1.identityFromUrl)(`https://h.example/${'/'.repeat(100000)}x`)).toBeNull();
+            expect((0, git_1.identityFromUrl)(`git@h.example:${'/'.repeat(100000)}x`)).toBeNull();
+            expect((0, git_1.identityFromUrl)(`https://h.example/${'/'.repeat(1000)}o/r`)).toBe('h.example/o/r');
+        });
+        // The 2048-unit cap returns before any scan, so the url-level tests above cannot show that the scan is linear: the helper
+        // that does the scanning is measured on its own, on inputs far beyond what the cap lets through.
+        test('trimSlashes removes the runs of slashes at both ends and scales linearly', () => {
+            expect((0, git_1.trimSlashes)('///a/b///')).toBe('a/b');
+            expect((0, git_1.trimSlashes)('////')).toBe('');
+            expect((0, git_1.trimSlashes)('a')).toBe('a');
+            expect((0, git_1.trimSlashes)(`x${'/'.repeat(5000)}y`)).toBe(`x${'/'.repeat(5000)}y`);
+            (0, helpers_1.expectLinearScaling)((n) => { (0, git_1.trimSlashes)(`x${'/'.repeat(n)}y`); (0, git_1.trimSlashes)(`${'/'.repeat(n)}x`); (0, git_1.trimSlashes)(`x${'/'.repeat(n)}`); }, 20_000);
+        });
+        test.each([
+            ['a ? in the scp host', 'git@github.com?token=abc:o/r'],
+            ['a # in the scp host', 'git@github.com#tok:o/r'],
+            ['a second @ in the scp host', 'git@evil@github.com:o/r'],
+            ['credentials with a # in the host', 'user:pw@host#frag:o/r'],
+        ])('R5.5 %s makes the identity null (a token must never reach repo)', (_label, url) => {
+            expect((0, git_1.identityFromUrl)(url)).toBeNull();
+            expect(identity(url)).toBeNull();
+        });
+        test('is null for a non-string root or outside a repository', () => {
+            expect((0, git_1.repoIdentity)((0, helpers_1.bad)(null))).toBeNull();
+            expect((0, git_1.repoIdentity)(nonRepoDir())).toBeNull();
+        });
+        test('is null when the remote path carries a control character', () => {
+            expect(identity('git@host:o/r\u0001x.git')).toBeNull();
+        });
+    });
+    test.each(['GIT_LITERAL_PATHSPECS', 'GIT_GLOB_PATHSPECS', 'GIT_NOGLOB_PATHSPECS', 'GIT_ICASE_PATHSPECS'])('R3.4 %s=1 does not change the file list', (name) => {
+        const base = branch();
+        repo.commit({ 'cli/src/a.ts': '1' }, 'feat(c): a');
+        (0, helpers_1.withEnv)({ [name]: '1' }, () => expect((0, git_1.changedFiles)(repo.root, base)).toEqual(['cli/src/a.ts']));
+    });
+    test('dirtiness with extra exclusions is not changed by GIT_LITERAL_PATHSPECS', () => {
+        fs_1.default.mkdirSync(path_1.default.join(repo.root, 'docs/changes'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(repo.root, 'docs/changes/r.md'), 'r');
+        (0, helpers_1.withEnv)({ GIT_LITERAL_PATHSPECS: '1' }, () => {
+            expect((0, git_1.isDirtyOutside)(repo.root, ['docs/changes'])).toBe(false);
+            expect((0, git_1.isDirtyOutside)(repo.root, [])).toBe(true);
+        });
+    });
+});