agentic-workflow-manager 9.19.0 → 9.20.0

package/dist/src/core/changes/derive.js

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveFromCommits = deriveFromCommits;
+exports.deriveModules = deriveModules;
+exports.commitsFromRecords = commitsFromRecords;
+exports.deriveFields = deriveFields;
+const path_1 = __importDefault(require("path"));
+const core_1 = require("../../release/core");
+const git_1 = require("./git");
+const text_safety_1 = require("./text-safety");
+const types_1 = require("./types");
+// Pathspecs relative to the repository top, so the result does not depend on the directory git runs in.
+const ALL_FILES = ':/';
+const EXCLUDE_RECORDS = `:(top,exclude,literal)${types_1.RECORD_DIR}`;
+const PARSER_TYPE = /^\w+$/;
+const RECORD_TYPE = /^[a-z]+$/;
+const MODULE_DEPTH = 3;
+// R3.3: the release parser's header regex backtracks quadratically on a long subject with blanks and line terminators, so a
+// subject (the text before the first US of a record) over this many UTF-16 units is never handed to it.
+const MAX_SUBJECT_UNITS = 1024;
+/** Keeps the commits the release parser can produce (a `\w+` type, any spelling) with a scope that is usable text; anything else is ignored. */
+function usable(commits) {
+    if (!Array.isArray(commits))
+        return [];
+    const out = [];
+    for (const c of commits) {
+        if (typeof c !== 'object' || c === null)
+            continue;
+        const { type, scope, breaking, subject } = c;
+        if (typeof type !== 'string' || !PARSER_TYPE.test(type))
+            continue;
+        const cleanScope = typeof scope === 'string' && scope.trim() !== '' && (0, text_safety_1.isSingleLine)(scope) ? scope.trim() : null;
+        out.push({ type, scope: cleanScope, breaking: breaking === true, subject: typeof subject === 'string' ? subject : '' });
+    }
+    return out;
+}
+const byCodeUnit = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+/**
+ * R3.3. `breaking` and `semver` cover every usable commit, with the release parser's exact-type semantics; the recorded type is
+ * the highest-impact commit's type lowercased, or `other` when that is still not purely letters. Null when no commit is usable.
+ */
+function deriveFromCommits(input) {
+    const commits = usable(input);
+    if (commits.length === 0)
+        return null;
+    const breaking = commits.some((c) => c.breaking);
+    const pick = commits.find((c) => c.breaking) ?? commits.find((c) => c.type === 'feat') ?? commits.find((c) => c.type === 'fix')
+        ?? commits.find((c) => c.type === 'perf') ?? commits[0];
+    const counts = new Map();
+    for (const c of commits)
+        if (c.scope)
+            counts.set(c.scope, (counts.get(c.scope) ?? 0) + 1);
+    const scope = [...counts.entries()].sort((a, b) => b[1] - a[1] || byCodeUnit(a[0], b[0]))[0]?.[0] ?? null;
+    const semver = (0, core_1.determineBump)(commits) ?? 'none';
+    const type = pick.type.toLowerCase();
+    return { type: RECORD_TYPE.test(type) ? type : 'other', scope, semver, breaking };
+}
+/** R3.4. Directories a record cannot hold (control characters, backslashes, `..` ...) are left out rather than leaked into it. */
+function deriveModules(files) {
+    if (!Array.isArray(files))
+        return [];
+    const modules = new Set();
+    for (const f of files) {
+        if (typeof f !== 'string' || f.length === 0 || f.startsWith(`${types_1.RECORD_DIR}/`))
+            continue;
+        const dir = path_1.default.posix.dirname(f);
+        const module = dir === '.' ? '.' : dir.split('/').slice(0, MODULE_DEPTH).join('/');
+        if (module === '.' || (0, text_safety_1.isSafeRelativePath)(module))
+            modules.add(module);
+    }
+    return [...modules].sort();
+}
+/**
+ * The conventional commits of NUL-separated `git log` records. Measured on the raw record, before RS is stripped (the stripped text
+ * is never longer): like the release parser, the subject ends at the first US, so only the text before it counts, and a subject over
+ * MAX_SUBJECT_UNITS is never handed to the parser.
+ */
+function commitsFromRecords(records) {
+    return records.flatMap((record) => {
+        const end = record.indexOf(core_1.US);
+        return (end < 0 ? record.length : end) > MAX_SUBJECT_UNITS ? [] : (0, core_1.parseCommits)(record.split(core_1.RS).join(''));
+    });
+}
+const fail = (code, message) => ({ ok: false, diagnostic: { code, message: (0, text_safety_1.clipMessage)(message) } });
+/**
+ * Derives from the non-merge commits in mergeBaseSha..HEAD, ignoring commits and files that only touch docs/changes/.
+ * `mergeBaseSha` must be a full commit id (the output of `mergeBase`); anything else is `invalid-input`.
+ */
+function deriveFields(root, mergeBaseSha) {
+    if (typeof root !== 'string' || root.length === 0)
+        return fail('invalid-input', 'repository root must be a non-empty string');
+    if (typeof mergeBaseSha !== 'string' || !types_1.COMMIT_ID.test(mergeBaseSha))
+        return fail('invalid-input', `merge-base must be a full commit id, got "${(0, text_safety_1.esc)(mergeBaseSha)}"`);
+    // HEAD is read once: the log and the diff below both use this sha, so a HEAD that moves meanwhile cannot mix snapshots.
+    const head = (0, git_1.headSha)(root);
+    if (head === null)
+        return fail('git-failed', 'git could not read HEAD');
+    const range = `${mergeBaseSha}..${head}`;
+    // --full-history: with a pathspec git would otherwise prune the side of a merge whose tree equals the other parent
+    // (`merge -s ours`), silently dropping real commits from the range.
+    // -z ends every commit with NUL, which a message cannot contain: each record is exactly one commit, so a message that
+    // embeds the parser's own separator cannot be read as a second commit.
+    const raw = (0, git_1.runGit)(root, ['log', ...git_1.LOG_SAFETY_ARGS, '--no-merges', '--full-history', '--reverse', '-z', `--format=${core_1.GIT_LOG_FORMAT}`, '--end-of-options', range, '--', ALL_FILES, EXCLUDE_RECORDS]);
+    if (raw === null)
+        return fail('git-failed', `git could not read the commits in ${range}`);
+    const records = raw.split('\0').filter((record) => record !== '');
+    if (records.length === 0)
+        return fail('no-commits', `no non-merge commits outside ${types_1.RECORD_DIR}/ in ${range}`);
+    const commits = commitsFromRecords(records);
+    const derived = deriveFromCommits(commits);
+    if (derived === null)
+        return fail('no-conventional-commits', 'no commit in the range uses a conventional-commit subject (type(scope): subject)');
+    const files = (0, git_1.changedFiles)(root, mergeBaseSha, head);
+    if (files === null)
+        return fail('git-failed', `git could not list the files changed in ${range}`);
+    return { ok: true, fields: { ...derived, modules: deriveModules(files) } };
+}

package/dist/src/core/changes/fs-safe.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRegularFileInside = isRegularFileInside;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const text_safety_1 = require("./text-safety");
+// Read-only filesystem checks. No import of the write-capable record-io: the pure record validator depends on this module.
+/** True when `name` is listed in `parent` exactly as spelled: on a case-insensitive file system `stat` also finds other spellings. */
+function listedAs(parent, name) {
+    try {
+        return fs_1.default.readdirSync(parent).includes(name);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A repo-relative path naming a regular file (not a link) that lies inside `root` once every link on the way is resolved, and
+ * whose every segment is spelled exactly as on disk (so the answer is the same on a case-insensitive file system as on Linux,
+ * where the validation of the committed record will run). Never throws.
+ */
+function isRegularFileInside(root, rel) {
+    if (typeof root !== 'string' || !(0, text_safety_1.isSafeRelativePath)(rel))
+        return false;
+    const segments = rel.split('/');
+    const abs = path_1.default.join(root, ...segments);
+    try {
+        if (!fs_1.default.lstatSync(abs).isFile())
+            return false;
+        const inside = path_1.default.relative(fs_1.default.realpathSync.native(root), fs_1.default.realpathSync.native(abs));
+        if (inside === '' || inside === '..' || inside.startsWith(`..${path_1.default.sep}`) || path_1.default.isAbsolute(inside))
+            return false;
+        let parent = root;
+        for (const segment of segments) {
+            if (!listedAs(parent, segment))
+                return false;
+            parent = path_1.default.join(parent, segment);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/core/changes/git-env.js

@@ -0,0 +1,68 @@
+"use strict";
+// Leaf module: how every git child of the change-record code is spawned. No sibling imports.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GIT_TIMEOUT_MS = void 0;
+exports.gitChildEnv = gitChildEnv;
+exports.gitSpawnOptions = gitSpawnOptions;
+exports.execGit = execGit;
+exports.execGitBytes = execGitBytes;
+const child_process_1 = require("child_process");
+exports.GIT_TIMEOUT_MS = 15000;
+/**
+ * Variables that change how pathspecs are read (`:/`, `:(exclude)` ...) and so the meaning of every range/count/status we ask
+ * for: literal/glob/noglob/icase would turn a plain exclusion into a literal name, a glob or a case-insensitive match. They are
+ * removed from the child's environment, matched case-insensitively (Windows environment names are case-insensitive, and a
+ * plain-object copy of process.env is not); everything else (GIT_CONFIG_*, GIT_AUTHOR_*, HOME ...) is passed through untouched.
+ */
+const PATHSPEC_ENV = new Set(['GIT_LITERAL_PATHSPECS', 'GIT_GLOB_PATHSPECS', 'GIT_NOGLOB_PATHSPECS', 'GIT_ICASE_PATHSPECS']);
+/**
+ * Variables that relocate the repository, its index or its object store: inherited ones would make git answer for a different
+ * repository than the `cwd` we pass (a fail-open). The same set read-only-observation.ts removes for its own git children.
+ */
+const LOCATION_ENV = new Set([
+    'GIT_DIR', 'GIT_WORK_TREE', 'GIT_INDEX_FILE', 'GIT_OBJECT_DIRECTORY',
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES', 'GIT_COMMON_DIR', 'GIT_NAMESPACE', 'GIT_PREFIX',
+]);
+/**
+ * Makes git fail on a missing object (partial clone) instead of fetching it from the promisor remote. Needs git 2.43 or newer:
+ * an older git ignores the variable and keeps its previous behaviour (it fetches the object), so the read-only guarantee for
+ * partial clones is only given from 2.43 on.
+ */
+const NO_LAZY_FETCH = 'GIT_NO_LAZY_FETCH';
+/** The environment every git child of the change-record code runs in: pathspec and repository-location variables removed, lazy fetching off. */
+function gitChildEnv() {
+    const env = { ...process.env };
+    for (const name of Object.keys(env))
+        if (PATHSPEC_ENV.has(name.toUpperCase()) || LOCATION_ENV.has(name.toUpperCase()))
+            delete env[name];
+    // A partial clone would otherwise fetch a missing object from its promisor remote the moment a read needs it: that writes
+    // the object database and uses the network. Reading must stay read-only, so a missing object is a plain failure instead.
+    // (Windows environment names are case-insensitive: drop any other spelling first.)
+    for (const name of Object.keys(env))
+        if (name.toUpperCase() === NO_LAZY_FETCH)
+            delete env[name];
+    env[NO_LAZY_FETCH] = '1';
+    return env;
+}
+/** The options of every git child except `stdio` (execGit spells that out): no shell, utf8, bounded time, scrubbed environment. */
+function gitSpawnOptions(cwd, extras = {}) {
+    return {
+        cwd,
+        encoding: 'utf8',
+        timeout: exports.GIT_TIMEOUT_MS,
+        env: gitChildEnv(),
+        ...(extras.maxBuffer === undefined ? {} : { maxBuffer: extras.maxBuffer }),
+    };
+}
+/**
+ * Runs `git args` in `cwd` with gitSpawnOptions and returns its stdout. The one execFileSync of the change-record code, with the
+ * stdio option spelled out at the call (stdin closed, stdout piped, stderr as asked; never Node's default relay of the child's
+ * stderr onto ours), as tests/structural/exec-invocation-explicit-stdio.test.ts requires. Throws like execFileSync does.
+ */
+function execGit(cwd, args, extras = {}) {
+    return (0, child_process_1.execFileSync)('git', args, { ...gitSpawnOptions(cwd, extras), stdio: ['ignore', 'pipe', extras.stderr ?? 'pipe'] });
+}
+/** Like execGit, but returns the raw bytes of stdout (no decoding): for content that must be checked as UTF-8 strictly. */
+function execGitBytes(cwd, args, extras = {}) {
+    return (0, child_process_1.execFileSync)('git', args, { ...gitSpawnOptions(cwd, extras), encoding: 'buffer', stdio: ['ignore', 'pipe', extras.stderr ?? 'pipe'] });
+}

package/dist/src/core/changes/git.js

@@ -0,0 +1,216 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOG_SAFETY_ARGS = void 0;
+exports.runGit = runGit;
+exports.runGitBytes = runGitBytes;
+exports.isSafeRef = isSafeRef;
+exports.isSafeRevision = isSafeRevision;
+exports.resolveBaseCommit = resolveBaseCommit;
+exports.mergeBase = mergeBase;
+exports.isAncestor = isAncestor;
+exports.changedFiles = changedFiles;
+exports.addedFilesUnder = addedFilesUnder;
+exports.isCommittedClean = isCommittedClean;
+exports.isDirtyOutside = isDirtyOutside;
+exports.repoRoot = repoRoot;
+exports.commitSha = commitSha;
+exports.headSha = headSha;
+exports.trimSlashes = trimSlashes;
+exports.identityFromUrl = identityFromUrl;
+exports.repoIdentity = repoIdentity;
+const path_1 = __importDefault(require("path"));
+const git_env_1 = require("./git-env");
+const text_safety_1 = require("./text-safety");
+const types_1 = require("./types");
+const worktree_1 = require("./worktree");
+// Every function here takes values that may be influenced by a user or by repository content (refs, paths, remote URLs).
+// None of them throws: git failures and invalid input come back as null / false / true (fail closed) so that callers
+// decide how to report them. Git runs without a shell, and a revision never reaches it unless it passed a whitelist.
+const MAX_OUTPUT = 16 * 1024 * 1024;
+const SAFE_REF = /^[A-Za-z0-9._/][A-Za-z0-9._/-]*$/;
+const MAX_REF = 255;
+const MAX_IDENTITY = 300;
+const MAX_REMOTE_URL = 2048;
+/**
+ * Every `git log` whose output is parsed must start with these. User and repository config would otherwise change that
+ * output: `log.showSignature` prints verification text before each signed commit's formatted output, and
+ * `i18n.logOutputEncoding` re-encodes it. (`log.decorate`, `log.mailmap`, notes and colour only affect placeholders or
+ * default formats we do not use.)
+ */
+exports.LOG_SAFETY_ARGS = ['--no-show-signature', '--encoding=UTF-8'];
+/** Runs git without a shell and returns its stdout, or null when it fails, times out, overflows or the input is invalid. */
+function runGit(cwd, args) {
+    if (typeof cwd !== 'string' || cwd.length === 0 || cwd.includes('\0'))
+        return null;
+    if (!Array.isArray(args) || !args.every((a) => typeof a === 'string' && !a.includes('\0')))
+        return null;
+    try {
+        return (0, git_env_1.execGit)(cwd, args, { maxBuffer: MAX_OUTPUT });
+    }
+    catch {
+        return null;
+    }
+}
+/** Like runGit, but returns the raw bytes of stdout (for content that must be decoded strictly); null on the same failures. */
+function runGitBytes(cwd, args) {
+    if (typeof cwd !== 'string' || cwd.length === 0 || cwd.includes('\0'))
+        return null;
+    if (!Array.isArray(args) || !args.every((a) => typeof a === 'string' && !a.includes('\0')))
+        return null;
+    try {
+        return (0, git_env_1.execGitBytes)(cwd, args, { maxBuffer: MAX_OUTPUT });
+    }
+    catch {
+        return null;
+    }
+}
+/** A ref name that cannot be read as an option, a range, a revision expression or a path. */
+function isSafeRef(ref) {
+    return typeof ref === 'string' && ref.length <= MAX_REF && SAFE_REF.test(ref) && !ref.includes('..');
+}
+/** A safe ref, or `a..b` / `a...b` made of two safe refs. */
+function isSafeRevision(rev) {
+    if (typeof rev !== 'string')
+        return false;
+    if (rev.length > 2 * MAX_REF + 3)
+        return false;
+    const parts = rev.split(/\.\.\.?/);
+    return parts.length <= 2 && parts.every(isSafeRef);
+}
+/**
+ * R3.1: --base, then origin/HEAD, then main, then master: the first that names a commit, with that commit's id. Null when none
+ * does (or the explicit base is unsafe). One `rev-parse` per candidate.
+ */
+function resolveBaseCommit(root, explicit) {
+    for (const candidate of explicit !== undefined ? [explicit] : ['refs/remotes/origin/HEAD', 'main', 'master']) {
+        const sha = commitSha(root, candidate);
+        if (sha !== null)
+            return { base: candidate, sha };
+    }
+    return null;
+}
+/** Full id of the common ancestor of `base` and HEAD; null when there is none or the input is invalid. */
+function mergeBase(root, base) {
+    if (!isSafeRef(base))
+        return null;
+    const out = runGit(root, ['merge-base', '--end-of-options', base, 'HEAD'])?.trim();
+    return out !== undefined && types_1.COMMIT_ID.test(out) ? out : null;
+}
+function isAncestor(root, ancestor, descendant) {
+    if (!isSafeRef(ancestor) || !isSafeRef(descendant))
+        return false;
+    return runGit(root, ['merge-base', '--is-ancestor', '--end-of-options', ancestor, descendant]) !== null;
+}
+/** Paths differing between two revisions, renames reported as delete + add, verbatim (untrusted). Null on failure. */
+function changedFiles(root, from, to = 'HEAD') {
+    if (!isSafeRef(from) || !isSafeRef(to))
+        return null;
+    // --no-renames: diff.renames would report a rename as one path. -c diff.relative=false: diff.relative would make paths relative to
+    // the cwd and drop those outside it (the config form, unlike --no-relative, also works on git < 2.28). --ignore-submodules=none: diff.ignoreSubmodules / .gitmodules `ignore` would hide a
+    // submodule bump. -z: core.quotePath never applies. diff.noprefix and colour do not affect --name-only.
+    const out = runGit(root, ['-c', 'diff.relative=false', 'diff', '--no-renames', '--ignore-submodules=none', '--name-only', '-z', '--end-of-options', from, to, '--']);
+    return out === null ? null : out.split('\0').filter(Boolean);
+}
+/**
+ * Files ADDED (not modified, not renamed-into: renames are off) between two revisions under the repo-relative directory `dir`,
+ * verbatim (untrusted). Same safety flags as changedFiles. Null on failure or invalid input.
+ */
+function addedFilesUnder(root, from, to, dir) {
+    if (!isSafeRef(from) || !isSafeRef(to) || !(0, text_safety_1.isSafeRelativePath)(dir))
+        return null;
+    const out = runGit(root, ['-c', 'diff.relative=false', 'diff', '--no-renames', '--ignore-submodules=none', '--diff-filter=A', '--name-only', '-z', '--end-of-options', from, to, '--', `:(top,literal)${dir}`]);
+    return out === null ? null : out.split('\0').filter(Boolean);
+}
+/**
+ * True when the tracked file `rel` (repo-relative, matched literally, from any directory) equals HEAD in both the index and the
+ * working tree; false when it differs; null when that cannot be told (unsafe path, git failure). Untracked files are not looked at.
+ * `--no-optional-locks`: `status` would otherwise refresh the index, and a read-only caller must not write it.
+ */
+function isCommittedClean(root, rel) {
+    if (!(0, text_safety_1.isSafeRelativePath)(rel))
+        return null;
+    const out = runGit(root, ['--no-optional-locks', 'status', '--porcelain', '-z', '--untracked-files=no', '--ignore-submodules=none', '--', `:(top,literal)${rel}`]);
+    return out === null ? null : out.length === 0;
+}
+/**
+ * Whether the tree differs from HEAD outside RUNTIME_STATE_EXCLUDES and `extraExcludes` (untracked files count).
+ * Unknown state, or an unsafe exclusion, counts as dirty: an unreadable repository must never look clean.
+ */
+function isDirtyOutside(root, extraExcludes) {
+    const state = (0, worktree_1.gitState)(root, true, extraExcludes);
+    return state.kind !== 'ok' || state.dirty;
+}
+/** Repository root with native separators; null outside a repository. Only `rev-parse`: never a (slow, refreshing) `status`. */
+function repoRoot(cwd) {
+    const out = runGit(cwd, ['rev-parse', '--show-toplevel'])?.trim();
+    return out ? path_1.default.resolve(out) : null;
+}
+/** Full id of the commit a safe ref names; null for an unsafe ref, no such commit or a git failure. Only `rev-parse`. */
+function commitSha(root, ref) {
+    if (!isSafeRef(ref))
+        return null;
+    const out = runGit(root, ['rev-parse', '--verify', '--quiet', '--end-of-options', `${ref}^{commit}`])?.trim();
+    return out !== undefined && types_1.COMMIT_ID.test(out) ? out : null;
+}
+/** Full id of HEAD; null when there is no commit or git fails. Only `rev-parse`: never a `status`. */
+function headSha(root) {
+    return commitSha(root, 'HEAD');
+}
+/** Removes any run of `/` from the start and the end of `s` (index scan: linear, unlike /\/+$/). */
+function trimSlashes(s) {
+    let start = 0;
+    let end = s.length;
+    while (start < end && s[start] === '/')
+        start++;
+    while (end > start && s[end - 1] === '/')
+        end--;
+    return s.slice(start, end);
+}
+/** `name` without one trailing `.git`. */
+const withoutDotGit = (s) => (s.endsWith('.git') ? s.slice(0, -4) : s);
+/** `text` up to the first `?` or `#`: a query or fragment of a remote can carry a token, and is not part of the repository name. */
+function withoutQueryAndFragment(text) {
+    const cut = text.search(/[?#]/);
+    return cut < 0 ? text : text.slice(0, cut);
+}
+/** `user@host:path` (scp-style); null when the text is not of that form. The host is lowercased like in the URL form. */
+function scpIdentity(url) {
+    const at = url.indexOf('@');
+    if (at < 1 || url.slice(0, at).includes('/'))
+        return null;
+    const colon = url.indexOf(':', at + 1);
+    if (colon < 0)
+        return null;
+    const host = url.slice(at + 1, colon);
+    // A `?`, `#` or `@` in the host segment can only be a token or a malformed remote: nothing of it is ever echoed.
+    if (host === '' || /[/?#@]/.test(host))
+        return null;
+    const repo = withoutDotGit(trimSlashes(withoutQueryAndFragment(url.slice(colon + 1))));
+    return repo === '' ? null : `${host.toLowerCase()}/${repo}`;
+}
+/** `host/owner/name` from a remote url with credentials, query and fragment stripped; null when unparseable, too long or not single-line. */
+function identityFromUrl(rawUrl) {
+    const url = typeof rawUrl === 'string' ? rawUrl.trim() : '';
+    if (!url || url.length > MAX_REMOTE_URL)
+        return null;
+    let identity = scpIdentity(url);
+    if (identity === null) {
+        try {
+            const u = new URL(url);
+            const p = withoutDotGit(trimSlashes(u.pathname));
+            identity = u.hostname && p ? `${u.hostname}/${p}` : null;
+        }
+        catch {
+            identity = null;
+        }
+    }
+    return identity !== null && (0, text_safety_1.isSingleLine)(identity) && identity.length <= MAX_IDENTITY ? identity : null;
+}
+/** `host/owner/name` from remote.origin.url (see identityFromUrl); null when there is no remote. */
+function repoIdentity(root) {
+    const url = runGit(root, ['config', '--get', 'remote.origin.url']);
+    return url === null ? null : identityFromUrl(url);
+}

package/dist/src/core/changes/list-parse.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cleanLine = cleanLine;
+exports.parseSince = parseSince;
+exports.parsePr = parsePr;
+const text_safety_1 = require("./text-safety");
+// Pure text and number parsing of `awm changes list`: no git, no I/O, nothing throws. Shared by the reader (list.ts), the
+// renderings (render-list.ts) and the command.
+/**
+ * Untrusted text as one clean line of at most `max` UTF-16 units: controls, line breaks and bidi marks escaped, an ellipsis
+ * where it was cut, a surrogate pair never split. Never throws.
+ */
+function cleanLine(text, max) {
+    if (typeof text !== 'string')
+        return text_safety_1.NON_STRING;
+    const raw = (0, text_safety_1.sliceNoSplit)(text, max);
+    let out = (0, text_safety_1.cleanText)(raw);
+    if (raw.length < text.length || out.length > max)
+        out = `${out.length > max - 1 ? (0, text_safety_1.sliceNoSplit)(out, max - 1) : out}…`;
+    return out;
+}
+const RELATIVE = /^(\d{1,9})([hd])$/;
+const ISO_DATE = /^\d{4}-\d{2}-\d{2}$/;
+const MAX_SINCE_TEXT = 16;
+/** `<n>h` or `<n>d` (n of 1 to 9 digits, at least 1, the result a valid date) or a calendar date `YYYY-MM-DD`; null for anything else. Never throws. */
+function parseSince(value, now) {
+    if (typeof value !== 'string' || value.length > MAX_SINCE_TEXT || !(now instanceof Date))
+        return null;
+    const nowMs = now.getTime();
+    if (!Number.isFinite(nowMs))
+        return null;
+    const rel = RELATIVE.exec(value);
+    if (rel) {
+        const n = Number(rel[1]);
+        const hours = rel[2] === 'h';
+        if (n < 1)
+            return null;
+        const since = new Date(nowMs - n * (hours ? 3600e3 : 86400e3));
+        return Number.isNaN(since.getTime()) ? null : since;
+    }
+    if (ISO_DATE.test(value)) {
+        const since = new Date(`${value}T00:00:00Z`);
+        return !Number.isNaN(since.getTime()) && since.toISOString().slice(0, 10) === value ? since : null;
+    }
+    return null;
+}
+/** The number of a trailing `(#<n>)`; null when there is none or n is not a safe integer. Index scans only. */
+function parsePr(subject) {
+    if (typeof subject !== 'string')
+        return null;
+    let end = subject.length;
+    while (end > 0 && (subject[end - 1] === ' ' || subject[end - 1] === '\t' || subject[end - 1] === '\r' || subject[end - 1] === '\n'))
+        end--;
+    if (end < 4 || subject[end - 1] !== ')')
+        return null;
+    const open = subject.lastIndexOf('(#', end - 1);
+    if (open < 0)
+        return null;
+    const digits = subject.slice(open + 2, end - 1);
+    if (digits.length === 0 || digits.length > 16)
+        return null;
+    for (let i = 0; i < digits.length; i++)
+        if (digits[i] < '0' || digits[i] > '9')
+            return null;
+    const n = Number(digits);
+    return Number.isSafeInteger(n) ? n : null;
+}