chainlesschain 0.162.175 → 0.162.176

package/src/lib/agent-ipc-bus.js

@@ -11,6 +11,8 @@
 
 import { EventEmitter } from "node:events";
 import crypto from "node:crypto";
+import { EventRuntimeProducer } from "./event-runtime-producer.js";
+import { EventRuntimeStore } from "./event-runtime-store.js";
 
 /**
  * @typedef {Object} InteractionRequest
@@ -27,8 +29,11 @@ import crypto from "node:crypto";
  */
 
 class AgentIPCBus extends EventEmitter {
-  constructor() {
+  constructor({ runtimeStore = null } = {}) {
     super();
+    this._runtimeProducer = runtimeStore
+      ? new EventRuntimeProducer({ store: runtimeStore, emitter: this })
+      : null;
     /** @type {Map<string, {req: InteractionRequest, resolve: Function, reject: Function, timer?: NodeJS.Timeout}>} */
     this._pendingRequests = new Map();
     /** @type {Map<string, Function>} resolvers by agentId */
@@ -58,6 +63,10 @@ class AgentIPCBus extends EventEmitter {
     this.emit("agent:unregistered", { agentId });
   }
 
+  isAgentRegistered(agentId) {
+    return this._agentResolvers.has(agentId);
+  }
+
   /**
    * Child agent calls this to request human interaction
    * @param {string} agentId
@@ -91,6 +100,19 @@ class AgentIPCBus extends EventEmitter {
       }, fullReq.timeoutMs);
 
       this._pendingRequests.set(requestId, { req: fullReq, resolve, reject, timer });
+      try {
+        this._runtimeProducer?.publish(
+          { type: "interaction_request", request: fullReq },
+          { origin: "agent-ipc", id: `interaction:${requestId}` },
+        );
+      } catch (error) {
+        // Durable publication is fail-closed for configured runtime mode: do
+        // not leave a request that cannot be recovered after a crash.
+        this._pendingRequests.delete(requestId);
+        clearTimeout(timer);
+        reject(error);
+        return;
+      }
       this.emit("request", fullReq);
     });
   }
@@ -106,6 +128,10 @@ class AgentIPCBus extends EventEmitter {
     if (entry.timer) clearTimeout(entry.timer);
     this._pendingRequests.delete(requestId);
     entry.resolve(response);
+    try {
+      const id = `interaction:${requestId}`;
+      this._runtimeProducer?.store.acknowledgeInbox(id, { response });
+    } catch {}
     this.emit("request:resolved", { requestId, response });
     return true;
   }
@@ -326,6 +352,10 @@ class AgentIPCBus extends EventEmitter {
 }
 
 // Singleton
-const ipcBus = new AgentIPCBus();
+const ipcBus = new AgentIPCBus(
+  process.env.CC_EVENT_RUNTIME_DURABLE === "1"
+    ? { runtimeStore: new EventRuntimeStore() }
+    : {},
+);
 export default ipcBus;
 export { AgentIPCBus };

package/src/lib/agent-sandbox.js

@@ -1,10 +1,12 @@
 /** OS-isolated shell execution for the coding agent. */
-import { spawnSync } from "node:child_process";
 import path from "node:path";
 import { proxyEnv } from "./sandbox-egress-proxy.js";
+import executionBroker from "./process-execution-broker/index.js";
 
 export const DEFAULT_SANDBOX_IMAGE = "node:22-bookworm-slim";
-export const _deps = { spawnSync };
+export const _deps = {
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
+};
 
 function stringList(value) {
   if (!Array.isArray(value)) return [];
@@ -126,6 +128,10 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   }
   args.push(sandbox.image, "sh", "-lc", String(command || ""));
   const result = _deps.spawnSync("docker", args, {
+    origin: "agent-sandbox:docker",
+    scope: "sandbox",
+    policy: "allow",
+    shell: false,
     encoding: "utf8",
     timeout: options.timeout,
     maxBuffer: options.maxBuffer,
@@ -189,6 +195,10 @@ function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
       ? { ...(options.env || {}), ...proxyEnv(egress.port, "127.0.0.1") }
       : options.env;
   const result = _deps.spawnSync("bwrap", args, {
+    origin: "agent-sandbox:bubblewrap",
+    scope: "sandbox",
+    policy: "allow",
+    shell: false,
     cwd: hostCwd,
     env: bwrapEnv,
     encoding: "utf8",
@@ -244,6 +254,10 @@ export function probeSandboxAvailability(sandbox, deps = _deps) {
       ? ["bwrap", ["--version"]]
       : ["docker", ["version", "--format", "{{.Server.Version}}"]];
   const result = deps.spawnSync(probeArgs[0], probeArgs[1], {
+    origin: "agent-sandbox:probe",
+    scope: "sandbox",
+    policy: "allow",
+    shell: false,
     encoding: "utf8",
     timeout: 10000,
     windowsHide: true,

package/src/lib/agent-schedule-store.js

@@ -27,6 +27,7 @@ import { isEntryExpired, effectiveFireAt } from "./schedule-planner.js";
 import { SUBAGENT_PERMISSION_MODES } from "./subagent-contract.js";
 import { parseGoalCondition } from "./goal-condition-engine.js";
 import { normalizeActionClass } from "./unattended-action-policy.js";
+import { withFileLock } from "./with-file-lock.js";
 
 export const SCHEDULE_KINDS = Object.freeze(["wakeup", "cron", "monitor"]);
 
@@ -155,6 +156,10 @@ function isSchedulableStatus(entry) {
     : entry.status === "active";
 }
 
+function hasLiveExecutionLease(entry, now) {
+  return Number(entry.executionLease?.expiresAt) > Number(now);
+}
+
 /** Statuses an entry can never leave — safe to prune. */
 export const TERMINAL_STATUSES = Object.freeze([
   "fired",
@@ -487,6 +492,7 @@ export class AgentScheduleStore {
       // (defense-in-depth: retireExpired need not have run first).
       if (isEntryExpired(entry, now)) return false;
       if (!isSchedulableStatus(entry)) return false;
+      if (hasLiveExecutionLease(entry, now)) return false;
       // The effective fire time applies the entry's OWN deterministic jitter
       // (`entry.jitterMs`, default 0 → base fire time, byte-identical to the
       // prior `dueAt`/`nextAt` comparison). A jittered entry fires slightly
@@ -496,6 +502,52 @@ export class AgentScheduleStore {
     });
   }
 
+  /**
+   * Atomically claim due entries for one agenda runner. The lease is retained
+   * on the durable entry, so a second process cannot fire the same item while
+   * the first is working; an abandoned process becomes reclaimable after the
+   * lease expires. This is deliberately separate from `due()` for backwards
+   * compatibility with read-only callers and injected test stores.
+   */
+  claimDue(atMs = null, leaseMs = 120000) {
+    const now = atMs != null ? Number(atMs) : this._now();
+    const ttl = Math.max(1000, Number(leaseMs) || 120000);
+    this._ensureDir();
+    return withFileLock(path.join(this.dir, ".agenda-claims"), () => {
+      const claimed = [];
+      for (const kind of SCHEDULE_KINDS) {
+        const entries = this._readAll(kind);
+        let changed = false;
+        for (const entry of entries) {
+          if (!isSchedulableStatus(entry) || isEntryExpired(entry, now)) continue;
+          if (hasLiveExecutionLease(entry, now)) continue;
+          const fireAt = effectiveFireAt(entry);
+          if (fireAt == null || fireAt > now) continue;
+          entry.executionLease = {
+            owner: `${process.pid}:${randomUUID()}`,
+            claimedAt: now,
+            expiresAt: now + ttl,
+          };
+          claimed.push({ ...entry, executionLease: { ...entry.executionLease } });
+          changed = true;
+        }
+        if (changed) this._writeAll(kind, entries);
+      }
+      return claimed;
+    }, { failIfUnavailable: true });
+  }
+
+  /** Release a failed/aborted claim so a later runner can retry it. */
+  releaseClaim(id) {
+    for (const kind of SCHEDULE_KINDS) {
+      const updated = this._mutate(kind, id, (entry) => {
+        delete entry.executionLease;
+      });
+      if (updated) return updated;
+    }
+    return null;
+  }
+
   /**
    * Retire every schedulable entry whose `expiresAt` has passed (status →
    * "expired", stamping `expiredAt`), across all kinds, so it never fires again.
@@ -632,6 +684,9 @@ export class AgentScheduleStore {
     const entry = entries.find((e) => e.id === id);
     if (!entry) return null;
     fn(entry);
+    // Every lifecycle mutation settles the claim before the write becomes
+    // visible, including a recurring cron/monitor entry that remains active.
+    delete entry.executionLease;
     this._writeAll(kind, entries);
     return entry;
   }

package/src/lib/agent-tool-admission.js

@@ -30,6 +30,110 @@ export const TOOL_TIER = Object.freeze({
   EXTENSION: "extension",
 });
 
+const ADMISSION_BOOLEAN_FIELDS = Object.freeze([
+  "enforce",
+  "capabilityGranted",
+  "policyAllowed",
+  "permissionGranted",
+  "budgetOk",
+  "uiSupported",
+]);
+const ADMISSION_TEXT_FIELDS = Object.freeze([
+  "source",
+  "version",
+  "scope",
+  "tier",
+]);
+const ADMISSION_TEXT_PATTERN = /^[A-Za-z0-9@][A-Za-z0-9_.:/@+-]{0,127}$/;
+const RESERVED_TOOL_NAMES = new Set(["__proto__", "prototype", "constructor"]);
+
+/**
+ * Parse the IDE-to-CLI CC_TOOL_ADMISSION envelope. Only decision/provenance
+ * fields are accepted; arguments, prompts and credentials have no place in
+ * this contract. Invalid input throws so a host that opted into enforcement
+ * cannot silently fall back to an ungoverned session.
+ */
+export function parseToolAdmissionConfig(input) {
+  if (input == null || input === "") return null;
+  let raw;
+  try {
+    raw = typeof input === "string" ? input : JSON.stringify(input);
+  } catch {
+    throw new Error("tool admission config is not valid JSON");
+  }
+  if (typeof raw !== "string") {
+    throw new Error("tool admission config must be an object");
+  }
+  if (Buffer.byteLength(raw, "utf8") > 32768) {
+    throw new Error("tool admission config exceeds 32 KiB");
+  }
+  let value;
+  try {
+    value = typeof input === "string" ? JSON.parse(input) : input;
+  } catch {
+    throw new Error("tool admission config is not valid JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("tool admission config must be an object");
+  }
+  if (value.enforce !== true) {
+    throw new Error("tool admission config must set enforce=true");
+  }
+
+  const sanitize = (entry, label) => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new Error(`${label} must be an object`);
+    }
+    const out = {};
+    for (const field of ADMISSION_BOOLEAN_FIELDS) {
+      if (entry[field] !== undefined) {
+        if (typeof entry[field] !== "boolean") {
+          throw new Error(`${label}.${field} must be boolean`);
+        }
+        out[field] = entry[field];
+      }
+    }
+    for (const field of ADMISSION_TEXT_FIELDS) {
+      if (entry[field] !== undefined) {
+        if (
+          typeof entry[field] !== "string" ||
+          !ADMISSION_TEXT_PATTERN.test(entry[field])
+        ) {
+          throw new Error(`${label}.${field} must be a safe identifier`);
+        }
+        out[field] = entry[field];
+      }
+    }
+    return out;
+  };
+
+  const config = sanitize(value, "toolAdmission");
+  config.enforce = true;
+  if (value.tools !== undefined) {
+    if (
+      !value.tools ||
+      typeof value.tools !== "object" ||
+      Array.isArray(value.tools)
+    ) {
+      throw new Error("toolAdmission.tools must be an object");
+    }
+    const entries = Object.entries(value.tools);
+    if (entries.length > 256)
+      throw new Error("toolAdmission.tools exceeds 256 entries");
+    config.tools = {};
+    for (const [name, entry] of entries) {
+      if (
+        !/^[A-Za-z0-9_.:-]{1,160}$/.test(name) ||
+        RESERVED_TOOL_NAMES.has(name)
+      ) {
+        throw new Error(`invalid tool admission name: ${name}`);
+      }
+      config.tools[name] = sanitize(entry, `toolAdmission.tools.${name}`);
+    }
+  }
+  return config;
+}
+
 /** Normalize a tier label; anything unrecognized → EXTENSION (fail-closed). */
 export function normalizeToolTier(value) {
   const s = String(value || "")

package/src/lib/api-key-helper.js

@@ -14,7 +14,7 @@
  * rule). Cached per process (5 min) so multi-call runs don't re-spawn it.
  */
 
-import { execSync } from "node:child_process";
+import { executionBroker } from "./process-execution-broker/index.js";
 
 const TTL_MS = 5 * 60 * 1000;
 const _cache = new Map(); // helper command → { key, at }
@@ -31,7 +31,15 @@ export function resolveApiKeyFromHelper(helperCmd, opts = {}) {
   const now = opts.now || Date.now;
   const hit = _cache.get(cmd);
   if (hit && now() - hit.at < TTL_MS) return hit.key;
-  const exec = opts.exec || execSync;
+  const exec =
+    opts.exec ||
+    ((command, options) =>
+      executionBroker.execSync(command, {
+        ...options,
+        origin: "credential:api-key-helper",
+        policy: "allow",
+        scope: "credential",
+      }));
   try {
     const out = exec(cmd, {
       encoding: "utf-8",

package/src/lib/async-hook-supervisor.cjs

@@ -251,7 +251,7 @@ class AsyncHookSupervisor {
 
     let child;
     try {
-      child = this._deps.spawn(hook.command, {
+      const spawnOptions = {
         cwd: opts.cwd || process.cwd(),
         shell: true,
         // POSIX: own process group so a timeout / stopAll can signal the whole
@@ -262,7 +262,17 @@ class AsyncHookSupervisor {
           ...process.env,
           CLAUDE_HOOK_EVENT: hook.event || payload.hook_event_name || "",
         },
-      });
+      };
+      child = opts.broker && hook.origin === "plugin:hook"
+        ? opts.broker.spawn(hook.command, [], {
+            ...spawnOptions,
+            origin: hook.origin,
+            policy: "allow",
+            pluginId: hook.pluginId || null,
+            pluginVersion: hook.pluginVersion || null,
+            pluginSource: hook.pluginSource || null,
+          })
+        : this._deps.spawn(hook.command, spawnOptions);
     } catch (err) {
       this._record(hook, {
         ok: false,

package/src/lib/changelog.js

@@ -225,24 +225,32 @@ function extractCliSections(bodyLines, header) {
  *
  * @returns {{ source: string, releases: Array }}
  */
-export function loadChangelog() {
+export function loadChangelog({
+  fsApi = fs,
+  pathApi = path,
+  dirname = __dirname,
+} = {}) {
   const changelogCandidates = [
-    path.join(__dirname, "..", "..", "CHANGELOG.md"), // packages/cli/CHANGELOG.md
-    path.join(__dirname, "..", "..", "..", "..", "CHANGELOG.md"), // repo root
+    pathApi.join(dirname, "..", "..", "CHANGELOG.md"), // packages/cli/CHANGELOG.md
+    pathApi.join(dirname, "..", "..", "..", "..", "CHANGELOG.md"), // repo root
   ];
   for (const p of changelogCandidates) {
-    if (fs.existsSync(p)) {
-      return {
-        source: "CHANGELOG.md",
-        releases: parseChangelog(fs.readFileSync(p, "utf-8")),
-      };
+    if (fsApi.existsSync(p)) {
+      const releases = parseChangelog(fsApi.readFileSync(p, "utf-8"));
+      // A parent-level CHANGELOG can exist in a global Node.js installation
+      // (for example C:\\nvm4w\\nodejs\\CHANGELOG.md).  Do not treat an
+      // unrelated, successfully-read file with zero CLI releases as the
+      // authoritative source; continue to the bundled artifact instead.
+      if (releases.length > 0) {
+        return { source: "CHANGELOG.md", releases };
+      }
     }
   }
   // Installed npm package: CHANGELOG.md isn't shipped, use the bundled artifact.
-  const jsonPath = path.join(__dirname, "..", "data", "changelog.json");
-  if (fs.existsSync(jsonPath)) {
+  const jsonPath = pathApi.join(dirname, "..", "data", "changelog.json");
+  if (fsApi.existsSync(jsonPath)) {
     try {
-      const data = JSON.parse(fs.readFileSync(jsonPath, "utf-8"));
+      const data = JSON.parse(fsApi.readFileSync(jsonPath, "utf-8"));
       if (Array.isArray(data.releases)) return data;
     } catch {
       /* fall through to empty */

package/src/lib/channels/channel-manager.js

@@ -20,6 +20,7 @@ import {
   canApprove,
   describeAuthorityChain,
 } from "../agent-authority.js";
+import { EventRuntimeStore } from "../event-runtime-store.js";
 
 export const CHANNEL_KINDS = ["webhook", "telegram"];
 
@@ -120,6 +121,9 @@ export async function startChannels(specsInput, opts = {}) {
   const config = opts.config || {};
   const log = opts.log || ((msg) => logger.info(msg));
   const deps = opts.deps || {};
+  const eventRuntimeStore =
+    opts.eventRuntimeStore ||
+    (process.env.CC_EVENT_RUNTIME_DURABLE === "1" ? new EventRuntimeStore() : null);
   // Every inbound event is stamped with its channel authority (`steer`, never
   // `approve`) before the caller's handler sees it — so a channel message can
   // never be mistaken for a user approval no matter what it contains.
@@ -149,6 +153,7 @@ export async function startChannels(specsInput, opts = {}) {
           port: spec.arg ? Number(spec.arg) : cfg.port,
           onEvent,
           log,
+          eventRuntimeStore,
         });
         started.push({ kind: "webhook", describe: handle.describe, ...handle });
       } else if (spec.kind === "telegram") {
@@ -161,6 +166,7 @@ export async function startChannels(specsInput, opts = {}) {
           ...cfg,
           onEvent,
           log,
+          eventRuntimeStore,
         });
         started.push({
           kind: "telegram",

package/src/lib/channels/telegram-channel.js

@@ -13,6 +13,7 @@
 
 const POLL_TIMEOUT_S = 25;
 const ERROR_BACKOFF_MS = 5000;
+import { EventRuntimeProducer } from "../event-runtime-producer.js";
 
 export async function startTelegramChannel(options = {}) {
   const {
@@ -27,7 +28,11 @@ export async function startTelegramChannel(options = {}) {
     // failures) can never turn the loop into a microtask chain that starves
     // the event loop (timers, stop()) entirely.
     pollPauseMs = 50,
+    eventRuntimeStore = null,
   } = options;
+  const runtimeProducer = eventRuntimeStore
+    ? new EventRuntimeProducer({ store: eventRuntimeStore })
+    : null;
 
   if (!botToken) {
     throw new Error(
@@ -65,12 +70,17 @@ export async function startTelegramChannel(options = {}) {
           if (!chatId || !text) continue;
           if (!allowed.has(String(chatId))) continue; // fail closed
           try {
-            onEvent?.({
+            const event = {
               channel: "telegram",
               sender: String(chatId),
               text,
               meta: { updateId: update.update_id },
+            };
+            runtimeProducer?.publish(event, {
+              origin: "telegram",
+              id: `telegram:${update.update_id}`,
             });
+            onEvent?.(event);
           } catch {
             /* downstream owns its failures */
           }

package/src/lib/channels/webhook-channel.js

@@ -17,6 +17,7 @@
 
 import { createServer } from "node:http";
 import { randomBytes, timingSafeEqual } from "node:crypto";
+import { EventRuntimeProducer } from "../event-runtime-producer.js";
 
 const MAX_BODY_BYTES = 64 * 1024;
 
@@ -34,7 +35,11 @@ export async function startWebhookChannel(options = {}) {
     allowlist,
     onEvent,
     log = () => {},
+    eventRuntimeStore = null,
   } = options;
+  const runtimeProducer = eventRuntimeStore
+    ? new EventRuntimeProducer({ store: eventRuntimeStore })
+    : null;
 
   const isLoopback =
     host === "127.0.0.1" || host === "::1" || host === "localhost";
@@ -92,8 +97,7 @@ export async function startWebhookChannel(options = {}) {
           return respond(403, { error: "sender not in allowlist" });
         }
       }
-      try {
-        onEvent?.({
+      const event = {
           channel: "webhook",
           sender,
           text,
@@ -101,9 +105,17 @@ export async function startWebhookChannel(options = {}) {
             payload.meta && typeof payload.meta === "object"
               ? payload.meta
               : undefined,
+        };
+      try {
+        runtimeProducer?.publish(event, {
+          origin: "webhook",
+          id: payload.event_id || payload.eventId || null,
         });
+        onEvent?.(event);
       } catch {
-        /* the session queue owns downstream failures */
+        // A configured durable runtime is the recovery boundary. Refuse the
+        // request rather than acknowledging an event that was not persisted.
+        if (runtimeProducer) return respond(503, { error: "event persistence unavailable" });
       }
       respond(202, { ok: true });
     });

package/src/lib/checkpoint-store.js

@@ -18,9 +18,13 @@
  * is. When it is not, callers should fall back / report unavailable.
  */
 
-import { spawnSync } from "node:child_process";
 import { rmSync } from "node:fs";
 import path from "node:path";
+import executionBroker from "./process-execution-broker/index.js";
+
+export const _deps = {
+  spawnSync: (...args) => executionBroker.spawnSync(...args),
+};
 
 const REF_NS = "refs/cc-checkpoints";
 // Deterministic identity for shadow commits so `git commit-tree` never trips on
@@ -41,7 +45,11 @@ const CHECKPOINT_IDENTITY = Object.freeze({
  * @throws {Error} with git's stderr when the command fails
  */
 function git(args, { cwd, env, input } = {}) {
-  const res = spawnSync("git", args, {
+  const res = _deps.spawnSync("git", args, {
+    origin: "checkpoint:git",
+    scope: "checkpoint",
+    policy: "allow",
+    shell: false,
     cwd,
     input,
     encoding: "utf-8",

package/src/lib/cloud/bundle.js

@@ -7,13 +7,23 @@
  * a repo.
  */
 
-import { execFileSync } from "node:child_process";
 import { writeFileSync, mkdtempSync } from "node:fs";
 import { readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
+import { executionBroker } from "../process-execution-broker/index.js";
 
-export const _deps = { execFileSync };
+function brokerExecFileSync(file, args, options) {
+  return executionBroker.execFileSync(file, args, {
+    ...options,
+    origin: "cloud:git",
+    policy: "allow",
+    scope: "cloud",
+    shell: false,
+  });
+}
+
+export const _deps = { execFileSync: brokerExecFileSync };
 
 function git(args, cwd, deps = _deps) {
   return deps

package/src/lib/code-review.js

@@ -4,8 +4,37 @@
  * @module lib/code-review
  */
 
-import { execSync } from "child_process";
 import { logger } from "./logger.js";
+import { executionBroker } from "./process-execution-broker/index.js";
+
+export const _deps = {
+  execFileSync: (...args) => executionBroker.execFileSync(...args),
+};
+
+export function buildGitDiffArgs(
+  target = "--staged",
+  { nameOnly = false } = {},
+) {
+  const args = ["diff"];
+  if (nameOnly) args.push("--name-only");
+  if (target === "--staged" || target === "--cached") {
+    args.push(target);
+  } else {
+    args.push("--end-of-options", String(target), "--");
+  }
+  return args;
+}
+
+function gitDiff(target, options = {}) {
+  return _deps.execFileSync("git", buildGitDiffArgs(target, options), {
+    encoding: "utf8",
+    maxBuffer: 10 * 1024 * 1024,
+    origin: "review:git-diff",
+    policy: "allow",
+    scope: "review",
+    shell: false,
+  });
+}
 
 /**
  * Get git diff for review
@@ -14,10 +43,7 @@ import { logger } from "./logger.js";
  */
 export function getGitDiff(target = "--staged") {
   try {
-    return execSync(`git diff ${target}`, {
-      encoding: "utf8",
-      maxBuffer: 10 * 1024 * 1024,
-    });
+    return gitDiff(target);
   } catch (err) {
     logger.error(`Failed to get git diff: ${err.message}`);
     return "";
@@ -31,9 +57,7 @@ export function getGitDiff(target = "--staged") {
  */
 export function getChangedFiles(target = "--staged") {
   try {
-    const output = execSync(`git diff ${target} --name-only`, {
-      encoding: "utf8",
-    });
+    const output = gitDiff(target, { nameOnly: true });
     return output.trim().split("\n").filter(Boolean);
   } catch (err) {
     logger.error(`Failed to get changed files: ${err.message}`);