flowviant 0.41.0 → 0.44.1

package/bin/lib/fleet.mjs

@@ -5,7 +5,13 @@
  * MCP token, and only spawns Claude when the server says an agent has work.
  */
 
-import { mkdirSync, existsSync, rmSync, readdirSync, statSync } from 'node:fs';
+import {
+  mkdirSync,
+  existsSync,
+  rmSync,
+  readdirSync,
+  statSync,
+} from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
@@ -57,8 +63,8 @@ import {
   SYSTEM_PLAN_CHECK,
   PLAN_CHECK_KICKOFF,
   REGROUND_KICKOFF,
-  SYSTEM_CONSULT,
-  CONSULT_KICKOFF,
+  SYSTEM_PLAN,
+  PLAN_TURN_KICKOFF,
   SYSTEM_QUICK_EDIT,
   QUICK_EDIT_KICKOFF,
 } from './claude.mjs';
@@ -77,6 +83,7 @@ import {
 import { processDeployJobs, reportDeployConfig } from './deploy.mjs';
 import { machineSnapshot } from './resources.mjs';
 import { detectRuntimes, pickRuntimeFor, RUNTIMES } from './runtimes.mjs';
+import { createWorkManager } from './work.mjs';
 
 async function fetchRoster(haveIds) {
   const url = new URL(FLEET_URL);
@@ -451,6 +458,7 @@ export async function runFleetDaemon() {
   const workers = new Map(); // agentId -> { state, promise, wt, label }
   let daemonAlive = true; // flipped false on shutdown so the stream stops reconnecting
   let stream = null; // push channel handle (set once the loop is set up)
+  let workShutdown = null; // kills live session-turn CLIs (set with the work manager below)
 
   // Shutdown KEEPS the worktrees: in-flight local work survives Ctrl+C and
   // resumes in place on the next run (the task marker matches). Worktrees are
@@ -471,6 +479,14 @@ export async function runFleetDaemon() {
     } catch {
       /* best-effort */
     }
+    // Session-turn CLIs die with the daemon too: an orphan keeps editing the
+    // session worktree and burning quota, and its live-pid lock would make the
+    // restarted daemon skip that tab's turns for as long as it survived.
+    try {
+      workShutdown?.();
+    } catch {
+      /* best-effort */
+    }
     for (const [, w] of workers) {
       w.state.alive = false;
       try {
@@ -494,6 +510,15 @@ export async function runFleetDaemon() {
     teardown();
     process.exit(130);
   });
+  // A service manager stops the daemon with SIGTERM, not Ctrl+C. Without this
+  // handler every child survived a `systemctl stop` — the exact orphaning the
+  // teardown exists to prevent.
+  process.on('SIGTERM', () => {
+    console.log('');
+    note('shutting down (SIGTERM) — stopping workers. Worktrees are kept: in-flight work resumes next run.');
+    teardown();
+    process.exit(143);
+  });
   // Keep the daemon alive on a stray rejection. Many loops here are fire-and-
   // forget (`void drainWiki()`, dispatch, sync) and rely on their callees never
   // rejecting; Node ≥15 terminates the process on an unhandled rejection, which
@@ -748,21 +773,155 @@ export async function runFleetDaemon() {
     }
   };
 
-  // Consults — a planning question aimed at THIS machine, answered by reading
-  // the repo. Deliberately the lightest job on the roster: same read-only
-  // detached checkout the plan check uses, no MCP, no writes, no run recorded.
+  // ── Planning sessions ────────────────────────────────────────────────────
+  //
+  // A turn in a plan thread, answered inside a HELD session. This was the
+  // consult, which answered one question in prose and kept nothing: it existed
+  // because the planner was a different, weaker brain and this turn's only job
+  // was to correct it from the real code. That planner is gone, so the session
+  // reads the repo AND writes the plan, over many turns, in one context.
+  //
+  // Two things changed shape as a result.
+  //
+  // ONE WORKTREE PER PLAN, not the shared `wikiWt`. Every CLI here resumes with
+  // "continue the last session in this directory" (`--continue`, `resume
+  // --last`) rather than by session id, so the WORKING DIRECTORY *is* the
+  // session handle. A shared directory would have made two plans on one machine
+  // take turns wearing each other's context — and the wiki queue hard-resets
+  // that directory between tasks, which would pull the files out from under a
+  // session mid-argument. A private detached checkout per plan also means plan
+  // turns no longer queue behind the wiki lock.
+  //
+  // IT CARRIES MCP. A consult passed none — nothing to write. A session spawns
+  // slices, re-shapes them, drops them and maintains the spec, all of which are
+  // control-plane calls. The token is the fleet's PLAN principal, whose entire
+  // tool set is those five: it cannot claim, cannot open a worktree, cannot
+  // commit. That absence is the product rule, not a hardening measure — it is
+  // what makes "add a dark mode toggle" typed at a plan add a slice instead of
+  // building one, with nothing reading the sentence to decide.
   const CONSULT_DONE_URL = FLEET_URL.replace(/\/agents\/?$/, '/consult-done');
+  const PLAN_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/plan-token');
   const answering = new Set();
-  const consultAttempts = new Map(); // consultId -> tries
-  /** Give up after this many turns on one question. A /consult-done that never
+  const consultAttempts = new Map(); // turn id -> tries
+  /** Give up after this many turns on one message. A /consult-done that never
    *  reaches the server (offline, 500) would otherwise re-run the whole Claude
    *  turn every poll, forever, on the owner's quota. */
   const MAX_CONSULT_TRIES = 3;
-  /** ONE consult at a time. They all read the same worktree, and the roster can
-   *  hand back a batch — un-awaited spawns meant N pending questions became N
-   *  concurrent `claude` processes on someone's laptop. */
+  /** ONE planning turn at a time on this machine. Sessions are per-plan so they
+   *  no longer collide on a directory, but the roster can hand back a batch, and
+   *  un-awaited spawns would put N concurrent CLI processes on someone's laptop
+   *  for what is, on the human's side, a chat. */
   let consultChain = Promise.resolve();
 
+  /**
+   * The plan credential, cached until it stops working.
+   *
+   * Minted lazily rather than at startup: most daemons never host a planning
+   * session, and a token nobody uses is a credential sitting on disk for no
+   * reason. Rotated by the server on every mint, so a re-mint after a 401 is the
+   * recovery path.
+   */
+  let planToken = null;
+  const mintPlanToken = async (force = false) => {
+    if (planToken && !force) return planToken;
+    try {
+      const res = await fetch(PLAN_TOKEN_URL, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${FLEET_TOKEN}`, 'User-Agent': USER_AGENT },
+      });
+      if (!res.ok) return null;
+      const data = await res.json().catch(() => null);
+      planToken = data?.data?.token ?? null;
+      return planToken;
+    } catch {
+      return null;
+    }
+  };
+
+  /**
+   * This plan's session directory — its context, expressed as a place.
+   *
+   * A detached checkout at base, like a consult's, but PRIVATE and PERSISTENT:
+   * private so `--continue` resumes this argument rather than whichever ran last
+   * on the box, persistent so it survives the daemon restarting or updating
+   * under it. Re-pointed at the current base each turn, because "reads your
+   * code" has to mean the code as it is now — a plan that runs for days would
+   * otherwise keep answering from the commit it was opened at.
+   *
+   * Returns null when the id is not a safe path segment: it comes off the wire.
+   */
+  const planWtFor = (planId) => {
+    if (!isSafePathSegment(planId)) return null;
+    const wt = join(baseDir, 'plans', planId);
+    const fresh = !existsSync(wt);
+    if (fresh) {
+      try {
+        git(['worktree', 'add', '--detach', wt, baseRef], repoRoot);
+      } catch {
+        git(['worktree', 'prune'], repoRoot);
+        try {
+          git(['worktree', 'add', '--detach', wt, baseRef], repoRoot);
+        } catch {
+          return null;
+        }
+      }
+    } else {
+      try {
+        git(['fetch', 'origin', '--quiet'], repoRoot);
+        git(['checkout', '--detach', baseRef], wt);
+        git(['reset', '--hard', baseRef], wt);
+        git(['clean', '-fd'], wt);
+      } catch {
+        /* offline, or a turn left it dirty — read what we have */
+      }
+    }
+    return { wt, fresh };
+  };
+
+  /**
+   * Retire the least-recently-touched session directories.
+   *
+   * The bound belongs HERE, in the machine, and never in the interface: ten
+   * plans open across a team is ten checkouts on one box, which is a resource
+   * question. Announcing a session limit in the app would be advertising
+   * capacity, which this product does not do. A retired session simply rebuilds
+   * from the spec next time it is asked for — the fallback the server already
+   * expects, and which the thread says out loud when it happens.
+   */
+  const MAX_PLAN_SESSIONS = 8;
+  const planTouched = new Map(); // planId -> ms
+  const retireIdlePlanSessions = () => {
+    const dir = join(baseDir, 'plans');
+    if (!existsSync(dir)) return;
+    let ids;
+    try {
+      ids = readdirSync(dir);
+    } catch {
+      return;
+    }
+    if (ids.length <= MAX_PLAN_SESSIONS) return;
+    const oldestFirst = ids.sort(
+      (a, b) => (planTouched.get(a) ?? 0) - (planTouched.get(b) ?? 0)
+    );
+    for (const id of oldestFirst.slice(0, ids.length - MAX_PLAN_SESSIONS)) {
+      try {
+        git(['worktree', 'remove', '--force', join(dir, id)], repoRoot);
+      } catch {
+        try {
+          rmSync(join(dir, id), { recursive: true, force: true });
+        } catch {
+          /* it is a directory we will overwrite next time; not worth failing a turn */
+        }
+      }
+      planTouched.delete(id);
+    }
+    try {
+      git(['worktree', 'prune'], repoRoot);
+    } catch {
+      /* best effort */
+    }
+  };
+
   // Quick edits — a SECOND Claude alongside a task this machine is already
   // building. Unlike every other roster job it does not get a worktree of its
   // own: the whole point is to work in the one the running task opened, on that
@@ -875,57 +1034,91 @@ export async function runFleetDaemon() {
       answering.add(job.id);
       consultChain = consultChain.then(async () => {
         try {
-          note(`${c.cyan('ask')} ${c.dim(`— ${job.askedByName || 'someone'} asked about "${job.planTitle || 'a plan'}"`)}`);
-          // Serialised against the wiki queue as well: that queue hard-resets
-          // this worktree mid-turn, which would pull the files out from under a
-          // consult that is reading them.
-          // A consult's prompt is steered by a question ANY project editor can
-          // type, so the profile is the enforcement and a runtime that cannot
-          // express it does not get the job. Today that means Claude; see the
-          // `profiles` notes in runtimes.mjs for exactly what Codex is missing.
-          const consultRt = pickRuntimeFor('consult');
-          if (!consultRt) {
-            warn('a consult is waiting, but no installed CLI can run a read-only turn');
+          note(`${c.cyan('plan')} ${c.dim(`— ${job.askedByName || 'someone'} on "${job.planTitle || 'a plan'}"`)}`);
+          // The profile is the enforcement, not the prompt: this turn is steered
+          // by anything a project editor can type, and it holds write tools. A
+          // runtime that cannot express `plan` does not get the job rather than
+          // getting it with guarantees nobody wrote down — which today excludes
+          // Antigravity, whose mediated shape fits a build and not an argument.
+          const planRt = pickRuntimeFor('plan');
+          if (!planRt) {
+            warn('a planning turn is waiting, but no installed CLI can run a planning session');
             return;
           }
-          await withWikiLock(async () => {
-            ensureWikiWorktree();
-            const out = await runTurn({
-              prompt: CONSULT_KICKOFF({
+          const token = await mintPlanToken();
+          if (!token) {
+            warn('a planning turn is waiting, but the plan credential could not be minted');
+            return;
+          }
+          const dir = planWtFor(job.taskId);
+          if (!dir) {
+            warn(`a planning turn is waiting, but its session directory could not be opened`);
+            return;
+          }
+          planTouched.set(job.taskId, Date.now());
+          // Resume only when this plan already HAS a session here. A fresh
+          // directory means either the first turn or a session we retired, and
+          // both want the same thing: start over from the spec, which the
+          // kickoff carries. `--continue` against an empty directory is not an
+          // error on every CLI, so asking `fresh` is what keeps it honest.
+          const resume = !dir.fresh && Boolean(job.sessionRef);
+          const mcp = mcpFor(planRt, token, mcpUrl);
+          let out;
+          try {
+            out = await runTurn({
+              prompt: PLAN_TURN_KICKOFF({
+                planId: job.taskId,
                 planTitle: job.planTitle,
                 question: job.question,
                 askedByName: job.askedByName,
+                // Sent only when we are NOT resuming: a live session already has
+                // the argument in its context, and re-stating the spec every
+                // turn would spend tokens telling it what it just wrote. On a
+                // rebuild it is the whole inheritance.
+                spec: resume ? null : job.spec,
               }),
-              resume: false,
-              system: SYSTEM_CONSULT,
-              cwd: wikiWt,
-              // TRULY read-only — no Write/Edit/rm, no MCP. The prompt also says
-              // not to change anything, but the prompt is what an injected
-              // question competes with; the toolset is what it cannot.
-              readOnly: true,
-              runtime: consultRt,
-              label: c.cyan('[ask]'),
-            });
-            const answer = (out || '').trim();
-            const posted = await reportMergeOutcome(CONSULT_DONE_URL, {
-              consultId: job.id,
-              ok: answer.length > 0,
-              // Scrub: an answer can quote config or env-adjacent code.
-              answer: envScrub(answer).slice(0, 8000),
+              resume,
+              system: SYSTEM_PLAN,
+              cwd: dir.wt,
+              // Read the repo, write the PLAN. No Edit/Write/commit anywhere in
+              // the toolset — the prompt says so too, but the prompt is what an
+              // injected message competes with.
+              planPerm: true,
+              mcpArgs: mcp.args,
+              mcpEnv: mcp.env,
+              runtime: planRt,
+              label: c.cyan('[plan]'),
             });
-            if (posted) consultAttempts.delete(job.id);
-            ok(`${c.cyan('ask')} ${c.dim('— answered in the plan thread')}`);
+          } finally {
+            if (mcp.dir) rmSync(mcp.dir, { recursive: true, force: true });
+          }
+          const answer = (out || '').trim();
+          const posted = await reportMergeOutcome(CONSULT_DONE_URL, {
+            consultId: job.id,
+            ok: answer.length > 0,
+            // Scrub: a reply can quote config or env-adjacent code.
+            answer: envScrub(answer).slice(0, 8000),
+            // The handle the server stores, reported on EVERY turn: a session we
+            // had to rebuild comes back under a new directory state, and a
+            // stored handle that does not follow it leaves later turns trying to
+            // resume something that is gone.
+            sessionRef: dir.wt,
           });
+          if (posted) consultAttempts.delete(job.id);
+          ok(`${c.cyan('plan')} ${c.dim('— replied in the plan thread')}`);
+          retireIdlePlanSessions();
         } catch (e) {
-          // Settle it. A question that cannot be answered must not re-burn a
-          // Claude turn every poll, and silence would leave the human waiting on
-          // a machine that already gave up.
+          // Settle it. A turn that cannot be answered must not re-burn quota
+          // every poll, and silence would leave the human waiting on a machine
+          // that already gave up.
           await reportMergeOutcome(CONSULT_DONE_URL, {
             consultId: job.id,
             ok: false,
-            answer: e?.message ?? 'the read failed',
+            // Scrub, like the success path: an exception routinely quotes
+            // command output, and command output can quote a synced secret.
+            answer: envScrub(String(e?.message ?? 'the planning turn failed')).slice(0, 2000),
           });
-          warn(`consult failed: ${e?.message ?? e}`);
+          warn(`planning turn failed: ${e?.message ?? e}`);
         } finally {
           answering.delete(job.id);
         }
@@ -933,6 +1126,26 @@ export async function runFleetDaemon() {
     }
   };
 
+  // ── Work sessions — the Workbench tabs ─────────────────────────────────────
+  //
+  // The whole machinery — per-session turn/ship chains, per-session work
+  // tokens, the settle-every-turn contract, the ship executor, worktree
+  // retirement — lives in work.mjs; this hands it the loop's mutable state.
+  const {
+    flushWorkReports,
+    processWorkTurns,
+    processShipJobs,
+    retireWorkSessions,
+    shutdownWork,
+  } = createWorkManager({
+    repoRoot,
+    baseDir,
+    baseRef,
+    getMcpUrl: () => mcpUrl,
+    getLeaseTtl: () => leaseTtlSeconds,
+  });
+  workShutdown = shutdownWork; // teardown can now reach the live session CLIs
+
   const processMergeJobs = (jobs) => {
     for (const job of jobs ?? []) {
       if (!job || typeof job.id !== 'string') continue; // a null element would wedge the loop
@@ -1525,10 +1738,22 @@ export async function runFleetDaemon() {
       });
       if (updating) return;
     }
+    // Settle any turn/ship answers whose earlier report POST failed BEFORE
+    // taking new work — the skip-if-pending guards make the ordering safe, but
+    // delivering first keeps the tab honest a poll sooner.
+    void flushWorkReports();
     processMergeJobs(roster.mergeJobs);
     processPatchRevertJobs(roster.patchRevertJobs);
     processPlanCheckJobs(roster.planCheckJobs);
     processConsultJobs(roster.consultJobs);
+    processWorkTurns(roster.workTurnJobs);
+    // The roster's live-session list rides along: an ENDED session's ship
+    // must not be refused by checks whose remedies need a live tab.
+    processShipJobs(roster.shipJobs, roster.activeWorkSessions);
+    // AFTER the work/ship intake: retirement is the server saying which
+    // sessions are LIVE, and the guards above (chains, shipping) are populated
+    // by the intake this same tick.
+    retireWorkSessions(roster.activeWorkSessions);
     processJoinJobs(roster.joinJobs);
     processCleanupJobs(roster.cleanupJobs);
     const rosterIds = new Set(roster.agents.map((a) => a.agentId));

package/bin/lib/live.mjs

@@ -43,7 +43,7 @@ import {
   restoreWip,
   clearWip,
 } from './git.mjs';
-import { applyPatch, fileDiffs, ownerCurrentBranch, withPatchLock } from './patch.mjs';
+import { applyPatch, commitHistory, fileDiffs, ownerCurrentBranch, withPatchLock } from './patch.mjs';
 import { RUNTIMES, runtimeById, drivableHere, mediated } from './runtimes.mjs';
 import { loadPreviewConfig, startPreview } from './preview.mjs';
 import { materializeInto, scrub as envScrub } from './env.mjs';
@@ -316,6 +316,33 @@ function seedPrompt(runId, brief, transcript, resumedInPlace) {
 // The flowviant MCP endpoint handles tools/call statelessly with a bearer
 // worker token — no handshake — so this is all the daemon needs.
 let rpcId = 0;
+/**
+ * Push this task's commits + real diffs to the control plane.
+ *
+ * The server used to fetch exactly this from github.com with a GitHub App
+ * installation token — the app existed largely for it. We are standing in the
+ * worktree that produced these commits, so we send them: the thread's diff
+ * timeline, the review quiz and the merge gate's approved-head pin all read
+ * what lands here.
+ *
+ * Best-effort by design. A failure here must never fail the run — the work is
+ * committed and the PR is open either way, and the next push reports again.
+ * What it costs when it does fail is visible rather than silent: the thread
+ * shows no diffs, which is the same thing it showed when GitHub was unreachable.
+ */
+async function reportCommits({ mcpUrl, token, runId, cwd, baseRef }) {
+  try {
+    const base = baseRef ?? 'HEAD';
+    const commits = commitHistory(cwd, base);
+    if (commits.length === 0) return;
+    const headSha = commits[commits.length - 1].sha;
+    const res = await mcpCall(mcpUrl, token, 'report_commits', { runId, headSha, commits });
+    if (res?.ok === false) warn(`report_commits rejected: ${res.reason ?? 'unknown'}`);
+  } catch (e) {
+    warn(`report_commits skipped: ${e?.message ?? String(e)}`);
+  }
+}
+
 async function mcpCall(mcpUrl, token, name, args) {
   const res = await fetch(mcpUrl, {
     method: 'POST',
@@ -1023,6 +1050,7 @@ async function driveMediated({
             ...(result.branch ? { branch: String(result.branch) } : {}),
           }).catch((e) => ({ ok: false, reason: e?.message ?? String(e) }));
           if (attached?.ok === false) warn(`attach_pr rejected: ${attached.reason ?? 'unknown'}`);
+          else await reportCommits({ mcpUrl, token, runId, cwd, baseRef });
         }
       }
       clearTaskMarker(cwd);

package/bin/lib/patch.mjs

@@ -125,12 +125,15 @@ const DIFF_STATUS = { A: 'added', D: 'removed', M: 'modified' };
  * pass back to `git diff -- <path>`. A rename showing up as a delete plus an add
  * is a slightly longer diff and a correct one.
  */
-export function fileDiffs(cwd, base) {
+export function fileDiffs(cwd, base, { range, maxFiles = MAX_DIFF_FILES } = {}) {
+  // `range` lets the per-COMMIT walk reuse this (`sha^..sha`); without it the
+  // original meaning holds — everything the agent did since `base`.
+  const rev = range ?? `${base}..HEAD`;
   let numstat = '';
   let names = '';
   try {
-    numstat = git(['diff', '--numstat', '--no-renames', `${base}..HEAD`], cwd);
-    names = git(['diff', '--name-status', '--no-renames', `${base}..HEAD`], cwd);
+    numstat = git(['diff', '--numstat', '--no-renames', rev], cwd);
+    names = git(['diff', '--name-status', '--no-renames', rev], cwd);
   } catch {
     return [];
   }
@@ -144,7 +147,7 @@ export function fileDiffs(cwd, base) {
 
   const out = [];
   for (const line of numstat.split('\n')) {
-    if (out.length >= MAX_DIFF_FILES) break;
+    if (out.length >= maxFiles) break;
     const m = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line.replace(/\n$/, ''));
     if (!m) continue;
     const path = m[3].trim();
@@ -154,7 +157,7 @@ export function fileDiffs(cwd, base) {
     let patch = null;
     if (!binary) {
       try {
-        const full = git(['diff', `${base}..HEAD`, '--', path], cwd);
+        const full = git(['diff', rev, '--', path], cwd);
         // Drop git's own "diff --git a/… b/…" preamble; the card shows the path.
         const at = full.indexOf('@@');
         const hunks = at === -1 ? full : full.slice(at);
@@ -293,3 +296,68 @@ export function revertPatch({ repoRoot, shas }) {
     return { ok: false, error: e?.message ?? String(e) };
   }
 }
+
+
+// How many commits of a task's branch we carry across. The server used to read
+// this from GitHub and capped at 50 for the same reason: each commit costs a
+// diff, and a runaway branch must not fan out unbounded work or produce a row
+// too big to read on every card render. Truncation keeps the MOST RECENT
+// commits — the tail is what a reviewer is looking at.
+const MAX_COMMITS = 50;
+
+/**
+ * A task branch's commits with their real per-file diffs, in the exact shape
+ * the server's GitHub read used to return (`TaskCommit[]`).
+ *
+ * This is the function that let the GitHub App die. The server used to resolve
+ * the project's linked repo, mint an installation token, fetch
+ * `GET /pulls/{n}/commits` and then run an N+1 of `GET /commits/{sha}` for the
+ * per-file patches — up to ~52 API calls to describe work THIS process had just
+ * performed, in a checkout it is standing in. Now the daemon reports it through
+ * `report_commits` and the server reads a row.
+ *
+ * Oldest → newest, because the thread appends chronologically.
+ */
+export function commitHistory(cwd, base) {
+  let log = '';
+  try {
+    // %x1f/%x1e are unit/record separators: a commit subject can contain
+    // anything, tabs and pipes included, so the delimiters have to be bytes a
+    // human will never type.
+    log = git(
+      ['log', '--reverse', `--max-count=${MAX_COMMITS}`, '--format=%H%x1f%s%x1f%an%x1f%aI%x1e', `${base}..HEAD`],
+      cwd,
+    );
+  } catch {
+    return [];
+  }
+
+  const out = [];
+  for (const record of log.split('\x1e')) {
+    const line = record.trim();
+    if (!line) continue;
+    const [sha, message, authorName, committedAt] = line.split('\x1f');
+    if (!sha) continue;
+    // First-parent range for the commit itself. A root commit has no `^`, in
+    // which case git's empty-tree hash gives us the whole thing as an add.
+    let range = `${sha}^..${sha}`;
+    try {
+      git(['rev-parse', `${sha}^`], cwd);
+    } catch {
+      range = `4b825dc642cb6eb9a060e54bf8d69288fbee4904..${sha}`;
+    }
+    const files = fileDiffs(cwd, null, { range });
+    out.push({
+      sha,
+      message: (message ?? '').slice(0, 500),
+      authorName: (authorName ?? '').slice(0, 200),
+      authorLogin: null,
+      committedAt: committedAt ?? new Date().toISOString(),
+      url: null,
+      additions: files.reduce((n, f) => n + f.additions, 0),
+      deletions: files.reduce((n, f) => n + f.deletions, 0),
+      files,
+    });
+  }
+  return out;
+}