git-coco 0.54.0 → 0.54.1

package/dist/index.esm.mjs

@@ -61,7 +61,7 @@ import { pathToFileURL } from 'url';
 /**
  * Current build version from package.json
  */
-const BUILD_VERSION = "0.54.0";
+const BUILD_VERSION = "0.54.1";
 
 const isInteractive = (config) => {
     return config?.mode === 'interactive' || !!config?.interactive;
@@ -20220,9 +20220,16 @@ function applyCommitComposeAction(state, action) {
                 field: state.field === 'summary' ? 'body' : 'summary',
             };
         case 'setEditing':
+            // Audit finding #12: defensively clear `streamingPreview` when
+            // editing toggles off AND no draft is in flight. The current
+            // input pipeline never triggers this combination, but the
+            // reducer is the source of truth — if a future code path
+            // toggles editing off mid-stream, the preview shouldn't linger
+            // below an idle compose panel.
             return {
                 ...state,
                 editing: action.value,
+                streamingPreview: !action.value && !state.loading ? undefined : state.streamingPreview,
             };
         case 'setLoading':
             // Clearing loading also clears any in-flight streaming preview;
@@ -20234,6 +20241,22 @@ function applyCommitComposeAction(state, action) {
                 streamingPreview: action.value ? state.streamingPreview : undefined,
             };
         case 'setDraft':
+            // Audit finding #7: if the user has typed content in summary or
+            // body, the AI draft would silently clobber their work with no
+            // undo. Route the result to `pendingAiDraft` instead and surface
+            // a confirmation message; the user accepts with `R` (replace)
+            // or dismisses with Esc. Empty fields = safe to replace as
+            // before, since there's nothing to lose.
+            if (state.summary.trim() || state.body.trim()) {
+                return {
+                    ...state,
+                    loading: false,
+                    streamingPreview: undefined,
+                    pendingAiDraft: action.value,
+                    message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                    details: undefined,
+                };
+            }
             // No `message` here — the loader → filled fields are the confirmation
             // that the AI generated something. A lingering "AI draft ready for
             // editing" line in the panel reads as stale state. The runtime still
@@ -20248,6 +20271,7 @@ function applyCommitComposeAction(state, action) {
                 message: undefined,
                 details: undefined,
                 streamingPreview: undefined,
+                pendingAiDraft: undefined,
             };
         case 'setResult':
             return {
@@ -20267,6 +20291,46 @@ function applyCommitComposeAction(state, action) {
                 ...state,
                 streamingPreview: action.value,
             };
+        case 'setPendingAiDraft':
+            // Audit finding #7: route the AI draft here (instead of straight
+            // to summary/body via `setDraft`) when the user has unsaved
+            // typing the draft would clobber. The dispatcher does the
+            // user-content check; this reducer just stashes the draft and
+            // surfaces a message inviting the user to accept or dismiss.
+            return {
+                ...state,
+                loading: false,
+                streamingPreview: undefined,
+                pendingAiDraft: action.value,
+                message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                details: undefined,
+            };
+        case 'acceptPendingAiDraft':
+            // Swap the pending draft into the editable fields and clear it.
+            // Mirrors `setDraft`'s field positioning (focus on summary,
+            // editing on) so the user lands in the same place whether they
+            // accepted immediately or after deliberation.
+            if (!state.pendingAiDraft)
+                return state;
+            return {
+                ...state,
+                ...splitCommitDraft(state.pendingAiDraft),
+                field: 'summary',
+                editing: true,
+                loading: false,
+                message: undefined,
+                details: undefined,
+                streamingPreview: undefined,
+                pendingAiDraft: undefined,
+            };
+        case 'dismissPendingAiDraft':
+            // User chose to keep their typing; drop the AI draft.
+            return {
+                ...state,
+                pendingAiDraft: undefined,
+                message: undefined,
+                details: undefined,
+            };
         case 'reset':
             // Drop message/details too — the post-commit "Created commit ..."
             // notification is already on the runtime status line (footer); a
@@ -20454,6 +20518,14 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
         // classify below.
         const stream = await chain.stream(variables, signal ? { signal } : undefined);
         let chunkCount = 0;
+        let callbackFailureCount = 0;
+        // Audit finding #13: cap consecutive callback failures so a
+        // genuinely broken render handler can't tie up the LLM call
+        // silently for the user's entire wait. Five strikes (out of an
+        // expected ~50-500 chunks for a normal commit message) is enough
+        // to ride out a transient blip but small enough to bail before
+        // the user finishes waiting on a useless stream.
+        const MAX_CALLBACK_FAILURES = 5;
         for await (const messageChunk of stream) {
             const text = coerceChunkText(messageChunk);
             if (!text)
@@ -20462,12 +20534,20 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
             chunkCount += 1;
             try {
                 onChunk({ text, accumulated });
+                // Successful callback resets the consecutive-failure counter —
+                // we only bail on a STREAK of failures, not on isolated ones.
+                callbackFailureCount = 0;
             }
             catch (callbackError) {
                 // Deliberately swallow callback errors so a bad render handler
                 // can't tank the entire LLM call. Log at verbose so users with
                 // verbose mode on can still see what happened.
-                logger?.verbose(`executeChainStreaming: onChunk handler threw: ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+                callbackFailureCount += 1;
+                logger?.verbose(`executeChainStreaming: onChunk handler threw (${callbackFailureCount}/${MAX_CALLBACK_FAILURES}): ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+                if (callbackFailureCount >= MAX_CALLBACK_FAILURES) {
+                    logger?.verbose(`executeChainStreaming: bailing stream — ${MAX_CALLBACK_FAILURES} consecutive callback failures suggest a broken render handler.`, { color: 'red' });
+                    throw new LangChainExecutionError(`executeChainStreaming: render handler failed ${MAX_CALLBACK_FAILURES} times in a row; aborting stream so the failure surfaces to the caller.`, { accumulatedLength: accumulated.length, chunkCount });
+                }
             }
         }
         if (!accumulated) {
@@ -20501,15 +20581,22 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
     }
     catch (error) {
         // Cancellation classifier (#881 phase 3). Three signals: an
-        // explicitly aborted user signal (post-throw check), the
-        // standard DOM `AbortError`, or a Node `AbortSignal` with
-        // `signal.aborted === true` while a chain-internal error
-        // propagates. Any of these means "user wanted out," not "the
-        // call failed." Wrap the raw error so callers can pattern-match
-        // on `LangChainCancelledError` and carry the partial accumulated
-        // text in case the caller wants to salvage anything.
+        // explicitly aborted user signal (post-throw check) or a thrown
+        // `AbortError` from the standard DOM API. Either means "user
+        // wanted out," not "the call failed." Wrap the raw error so
+        // callers can pattern-match on `LangChainCancelledError` and
+        // carry the partial accumulated text in case the caller wants
+        // to salvage anything.
+        //
+        // Audit finding #8: an earlier implementation also fell back to
+        // `error.message.includes('aborted')` as a third signal. That
+        // substring heuristic is footgun-shaped — legitimate provider
+        // errors ("model not aborted properly", future API copy) would
+        // misclassify as user cancels. Dropped; rely on the structured
+        // signal (`signal.aborted`) and the standard error class
+        // (`name === 'AbortError'`).
         const aborted = signal?.aborted ||
-            (error instanceof Error && (error.name === 'AbortError' || error.message?.includes('aborted')));
+            (error instanceof Error && error.name === 'AbortError');
         if (aborted) {
             throw new LangChainCancelledError(error instanceof Error ? error.message : 'Streaming aborted by user', accumulated, {
                 provider: effectiveProvider,
@@ -20768,6 +20855,12 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
             // schema-validated retry — paying for a second LLM call only
             // on the edge case where the streamed output is unsalvageable.
             const streamingParser = createSchemaParser(schema, llm);
+            // Capture the final accumulated text out-of-band so we can
+            // attempt salvage if the parser throws on completion (audit
+            // finding #1). Updated on every chunk; the last value is
+            // whatever the stream produced before the parser ran. Empty
+            // string when streaming throws before any chunks arrived.
+            let streamedAccumulated = '';
             let salvaged;
             try {
                 // `executeChainStreaming` runs the parser on the accumulated
@@ -20781,6 +20874,7 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                     variables: budgetedPrompt.variables,
                     parser: streamingParser,
                     onChunk: ({ text, accumulated }) => {
+                        streamedAccumulated = accumulated;
                         onStreamChunk(text, accumulated);
                     },
                     signal,
@@ -20810,13 +20904,24 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                         cancelled: true,
                     };
                 }
-                // Streamed accumulated text didn't parse cleanly. Try the
-                // lossy salvager on whatever we have; if that produces a
-                // non-placeholder title, accept it. Otherwise fall through
-                // to the non-streaming path which can retry with a fresh
-                // LLM call.
-                logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
-                salvaged = undefined;
+                // Audit finding #1: try the lossy salvager on the accumulated
+                // text before paying for a second LLM call. The salvager
+                // strips code fences, attempts strict JSON parse, and falls
+                // back to "first line is title, rest is body." We only accept
+                // its output when it produced a real title — the placeholder
+                // title ("Auto-generated commit") means the salvager
+                // couldn't extract anything meaningful and the non-streaming
+                // retry is the better choice.
+                if (streamedAccumulated) {
+                    const candidate = salvageCommitMessageFromText(streamedAccumulated);
+                    if (candidate.title && candidate.title !== 'Auto-generated commit') {
+                        salvaged = candidate;
+                        logger.verbose(`Streaming parser failed but salvager recovered a draft from ${streamedAccumulated.length} accumulated chars; skipping non-streaming retry.`, { color: 'green' });
+                    }
+                }
+                if (!salvaged) {
+                    logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
+                }
             }
             // Type-narrow: commitMsg is set inside try{}, but TS doesn't
             // see that across the catch. Re-init through the salvage path
@@ -20825,10 +20930,12 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                 commitMsg = salvaged;
             }
             else if (!(commitMsg)) {
-                // Streaming threw; do the standard non-streaming flow to
-                // recover. This is the trade-off documented in the issue —
-                // streaming gives us a preview but the validated result still
-                // comes from the schema-aware retry path when streaming fails.
+                // Streaming threw AND the salvager couldn't recover anything
+                // useful; fall back to the standard non-streaming flow.
+                // Documented trade-off from the issue: streaming gives us a
+                // preview but the validated result still comes from the
+                // schema-aware retry path when both streaming AND salvage
+                // fail.
                 commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
                     logger,
                     tokenizer,
@@ -24271,10 +24378,14 @@ function applyLogInkAction(state, action) {
             // Cache the result so re-entry (or `c` to PR) reuses it instead of
             // re-running the LLM. Keyed by branch so a checkout naturally
             // produces a fresh generation.
+            // Audit finding #9: `generatedAt` arrives on the action payload
+            // instead of being read from `Date.now()` here, so the reducer
+            // stays pure. Dispatchers (currently `runChangelogView` in
+            // app.ts) call `Date.now()` at dispatch time.
             const cached = {
                 text: action.text,
                 baseLabel: action.baseLabel,
-                generatedAt: Date.now(),
+                generatedAt: action.generatedAt,
             };
             return {
                 ...state,
@@ -24328,7 +24439,8 @@ function applyLogInkAction(state, action) {
                         // Updated-at timestamp reflects the edit. Not the original
                         // generation time — `r` (regenerate) is the explicit knob
                         // for "I want fresh LLM output, not my edits".
-                        generatedAt: Date.now(),
+                        // Audit finding #9: timestamp arrives on the action.
+                        generatedAt: action.generatedAt,
                     },
                 },
                 pendingKey: undefined,
@@ -24364,7 +24476,9 @@ function applyLogInkAction(state, action) {
             }
             return {
                 ...state,
-                recentCommitHashes: { hashes: action.hashes, markedAt: Date.now() },
+                // Audit finding #9: timestamp arrives on the action payload
+                // instead of being read from `Date.now()` here.
+                recentCommitHashes: { hashes: action.hashes, markedAt: action.markedAt },
                 pendingKey: undefined,
             };
         case 'clearRecentCommits':
@@ -25164,16 +25278,24 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         return [];
     }
     // Cancel in-flight AI commit draft (#881 phase 3). When the compose
-    // surface is mid-stream (loading === true), Esc aborts the LLM call
-    // and the runtime handler cleans up (clear loading, clear preview,
-    // status line shows "AI draft cancelled."). Sits above the editing
-    // / view handlers so the cancel keystroke can't fall through to
-    // "leave compose" or anything else.
+    // state has a draft in flight (loading === true), Esc aborts the
+    // LLM call and the runtime handler cleans up (clear loading, clear
+    // preview, status line shows "AI draft cancelled.").
+    //
+    // Audit finding #5: the `activeView === 'compose'` gate from the
+    // original phase 3 implementation made the cancel keystroke
+    // unreachable after the user chord-navigated away from compose
+    // mid-stream (Esc would fall through to popView etc., consuming
+    // the navigation intent while the LLM call silently ran to
+    // completion). Cancel should work wherever the user is — they
+    // can always navigate back to compose afterwards.
     //
-    // Loading and editing are mutually exclusive in practice (the user
-    // can't type while the AI is generating), but the order here makes
-    // the precedence explicit if that ever changes.
-    if (state.activeView === 'compose' && state.commitCompose.loading && key.escape) {
+    // Sits above the editing / view handlers so the cancel keystroke
+    // can't fall through to "leave compose" or anything else. Loading
+    // and editing are mutually exclusive in practice (the user can't
+    // type while the AI is generating), but the order here makes the
+    // precedence explicit if that ever changes.
+    if (state.commitCompose.loading && key.escape) {
         return [{ type: 'cancelAiCommitDraft' }];
     }
     // Cancel in-flight PR body draft (#881 phase 4). The `C` keystroke
@@ -25193,6 +25315,27 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
     if (state.pendingPullRequestBodyDraft && key.escape) {
         return [{ type: 'cancelPullRequestBodyDraft' }];
     }
+    // Pending AI draft confirmation (audit finding #7). When the AI
+    // draft completes against a non-empty compose surface, it lands in
+    // `pendingAiDraft` instead of overwriting the user's typing. `R`
+    // accepts the swap (user's typing is lost, AI draft becomes the
+    // new content). `Esc` dismisses the AI draft (typing is preserved,
+    // AI draft is lost — the user paid for the tokens but explicitly
+    // chose not to use them).
+    //
+    // Gated on `activeView === 'compose'` because the pending draft is
+    // only meaningful on the compose surface (where the message line
+    // surfaces the prompt). A user who chord-navigated away while the
+    // draft was pending should see the original `R` / Esc semantics of
+    // wherever they are now.
+    if (state.activeView === 'compose' && state.commitCompose.pendingAiDraft) {
+        if (inputValue === 'R' && !key.ctrl && !key.meta) {
+            return [action({ type: 'commitCompose', action: { type: 'acceptPendingAiDraft' } })];
+        }
+        if (key.escape) {
+            return [action({ type: 'commitCompose', action: { type: 'dismissPendingAiDraft' } })];
+        }
+    }
     if (state.commitCompose.editing) {
         if (key.escape) {
             return [action({ type: 'commitCompose', action: { type: 'setEditing', value: false } })];
@@ -36251,6 +36394,14 @@ function LogInkApp(deps) {
     // workdirs for submodule paths recorded in `.gitmodules` (which
     // are repo-relative). Undefined during the brief moment between
     // git swap and the revparse callback resolving.
+    //
+    // Audit finding #10: rapid frame push/pop races are prevented by
+    // the per-effect `cancelled` flag — React fires the cleanup
+    // synchronously BEFORE running the next effect body, so any
+    // pending revparse from the old `git` sees `cancelled === true`
+    // and skips its write. The `git` reference itself is captured by
+    // closure, so each effect run resolves against the right binding.
+    // No additional depth tagging is needed.
     const [activeRepoRoot, setActiveRepoRoot] = React.useState(undefined);
     React.useEffect(() => {
         let cancelled = false;
@@ -36681,18 +36832,50 @@ function LogInkApp(deps) {
         })();
         return () => { cancelled = true; };
     }, [git, dispatch]);
+    // Audit finding #2: re-resolve the repo root inline on every save
+    // and key the deps off `git` + the saved value. The original
+    // implementation read from `repoRootRef.current`, which is async-
+    // populated by the resolver effect above and can lag behind a git
+    // swap. After #995's synchronous pop-restore, the parent's freshly
+    // restored sidebar tab was being written into the submodule's
+    // cache because the ref still held the submodule root during the
+    // brief window before the resolver settled.
+    //
+    // The extra `revparse` cost per save is negligible (saves fire
+    // once per user-initiated tab change, not per render) and the
+    // cancellation flag prevents a stale resolution from racing a
+    // newer one in flight.
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveSidebarTab(repoRoot, state.userSidebarTab);
-    }, [state.userSidebarTab]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveSidebarTab(root, state.userSidebarTab);
+            }
+            catch {
+                // Not in a worktree, or revparse failed — silently skip.
+                // The next save attempt will retry.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.userSidebarTab, git]);
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveDiffViewMode(repoRoot, state.diffViewMode);
-    }, [state.diffViewMode]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveDiffViewMode(root, state.diffViewMode);
+            }
+            catch {
+                // Same as above.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.diffViewMode, git]);
     // P-stash-explorer: load `git stash show -p <ref>` once the diff view
     // becomes active with diffSource='stash'. Best-effort — empty stashes
     // or read errors fall through to a "no diff" hint at the render site.
@@ -37326,6 +37509,12 @@ function LogInkApp(deps) {
                 git,
                 signal: controller.signal,
                 onStreamChunk: (_text, accumulated) => {
+                    // Audit finding #4: skip dispatching into a torn-down
+                    // tree. If the user quit (or otherwise unmounted the
+                    // workstation) mid-stream, React warns about updates on
+                    // an unmounted component. Drop the chunk silently.
+                    if (!mountedRef.current)
+                        return;
                     // Dispatch the full accumulated text — the preview chrome
                     // helper does the last-N-lines slicing at render time, so
                     // re-doing the slice here would be wasted work. Per-chunk
@@ -37337,6 +37526,11 @@ function LogInkApp(deps) {
                     });
                 },
             });
+            // Audit finding #4 (unmount race): bail out before any
+            // post-await dispatch if the user quit while the LLM call was
+            // in flight. Same pattern as `refreshHistoryRows` upstream.
+            if (!mountedRef.current)
+                return;
             // Cancel path (#881 phase 3). User pressed Esc during the
             // stream; reducer drops loading + preview, status line shows
             // a neutral "cancelled" message. Skip the result / failure
@@ -37357,6 +37551,23 @@ function LogInkApp(deps) {
             });
             dispatch({ type: 'setStatus', value: result.message });
         }
+        catch (error) {
+            // Audit finding #3: defensive recovery for unexpected throws
+            // from the workflow. The workflow catches its own errors
+            // today, so this catch is latent — but any future refactor
+            // that lets an error escape would otherwise strand the
+            // spinner permanently with no user-facing recovery short of
+            // quitting. Surface a generic failure and clear the loading
+            // state so the user can re-try.
+            if (mountedRef.current) {
+                dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: false } });
+                dispatch({
+                    type: 'setStatus',
+                    value: `AI draft failed unexpectedly: ${error instanceof Error ? error.message : String(error)}`,
+                    kind: 'error',
+                });
+            }
+        }
         finally {
             // Clear the ref only if it still points at OUR controller — a
             // rapid second invocation could have already replaced it, in
@@ -37448,9 +37659,14 @@ function LogInkApp(deps) {
         const cancelHandle = { cancelled: false };
         pullRequestBodyCancelRef.current = cancelHandle;
         dispatch({ type: 'setPendingPullRequestBodyDraft', value: true });
+        // Audit finding #6: soft cancel today — Esc skips opening the
+        // follow-up prompt, but the LLM call itself keeps running to
+        // completion (no AbortSignal threaded through the changelog CLI
+        // chain). Status copy reflects that honestly so the user isn't
+        // misled into thinking they're saving tokens.
         dispatch({
             type: 'setStatus',
-            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to cancel`,
+            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to skip prompt`,
             loading: true,
         });
         try {
@@ -37477,6 +37693,15 @@ function LogInkApp(deps) {
             else {
                 dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.' });
             }
+            // Audit finding #11: clear the pending flag BEFORE opening the
+            // prompt. If a future refactor adds an `await` between the flag
+            // clear (currently in `finally`) and the `openInputPrompt`
+            // dispatch, an Esc keystroke in the gap would dispatch
+            // `cancelPullRequestBodyDraft` AFTER the prompt opens, leaving
+            // the prompt visible with a stale "cancelled" message. Clearing
+            // here moves the flag teardown into the same React batch as the
+            // prompt open, eliminating the race.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             dispatch({
                 type: 'openInputPrompt',
                 kind: 'create-pr',
@@ -37486,11 +37711,14 @@ function LogInkApp(deps) {
             });
         }
         finally {
-            // Clear the flag + the ref so a subsequent draft starts clean.
+            // Belt-and-suspenders: the `try` block clears the flag on the
+            // success path (audit finding #11). This duplicate clear handles
+            // the error / cancel paths where the early-returns skip the
+            // success-path dispatch. Safe to no-op when already false.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             // Only clear the ref if we still own it — a second invocation
             // would have already taken ownership in which case the cancel
             // duty has rolled over.
-            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             if (pullRequestBodyCancelRef.current === cancelHandle) {
                 pullRequestBodyCancelRef.current = null;
             }
@@ -37591,6 +37819,11 @@ function LogInkApp(deps) {
                 branch: head,
                 baseLabel: cached.baseLabel,
                 text: cached.text,
+                // Audit finding #9: cache-hit path preserves the original
+                // generation timestamp rather than minting a fresh one — the
+                // "X ago" header should reflect when the LLM ran, not when
+                // the cached entry was re-displayed.
+                generatedAt: cached.generatedAt,
             });
             dispatch({
                 type: 'setStatus',
@@ -37619,6 +37852,9 @@ function LogInkApp(deps) {
             branch: head,
             baseLabel,
             text: result.text,
+            // Audit finding #9: timestamp captured at dispatch time, not
+            // inside the reducer.
+            generatedAt: Date.now(),
         });
         dispatch({
             type: 'setStatus',
@@ -37721,7 +37957,7 @@ function LogInkApp(deps) {
         if (editorOk) {
             try {
                 const content = readFileSync$1(file, 'utf8');
-                dispatch({ type: 'setChangelogText', text: content });
+                dispatch({ type: 'setChangelogText', text: content, generatedAt: Date.now() });
                 dispatch({ type: 'setStatus', value: 'Changelog updated from editor.' });
             }
             catch (error) {
@@ -38076,7 +38312,8 @@ function LogInkApp(deps) {
         // that could disagree with reality on partial-apply.
         const commitHashes = result.commitHashes || [];
         if (commitHashes.length > 0) {
-            dispatch({ type: 'markRecentCommits', hashes: commitHashes });
+            // Audit finding #9: timestamp captured at dispatch time.
+            dispatch({ type: 'markRecentCommits', hashes: commitHashes, markedAt: Date.now() });
             // DevSkim: ignore DS172411 — function literal, fixed delay,
             // no caller-supplied data flowing through.
             setTimeout(() => dispatch({ type: 'clearRecentCommits' }), 5000);

package/dist/index.js

@@ -78,7 +78,7 @@ var readline__namespace = /*#__PURE__*/_interopNamespaceDefault(readline);
 /**
  * Current build version from package.json
  */
-const BUILD_VERSION = "0.54.0";
+const BUILD_VERSION = "0.54.1";
 
 const isInteractive = (config) => {
     return config?.mode === 'interactive' || !!config?.interactive;
@@ -20237,9 +20237,16 @@ function applyCommitComposeAction(state, action) {
                 field: state.field === 'summary' ? 'body' : 'summary',
             };
         case 'setEditing':
+            // Audit finding #12: defensively clear `streamingPreview` when
+            // editing toggles off AND no draft is in flight. The current
+            // input pipeline never triggers this combination, but the
+            // reducer is the source of truth — if a future code path
+            // toggles editing off mid-stream, the preview shouldn't linger
+            // below an idle compose panel.
             return {
                 ...state,
                 editing: action.value,
+                streamingPreview: !action.value && !state.loading ? undefined : state.streamingPreview,
             };
         case 'setLoading':
             // Clearing loading also clears any in-flight streaming preview;
@@ -20251,6 +20258,22 @@ function applyCommitComposeAction(state, action) {
                 streamingPreview: action.value ? state.streamingPreview : undefined,
             };
         case 'setDraft':
+            // Audit finding #7: if the user has typed content in summary or
+            // body, the AI draft would silently clobber their work with no
+            // undo. Route the result to `pendingAiDraft` instead and surface
+            // a confirmation message; the user accepts with `R` (replace)
+            // or dismisses with Esc. Empty fields = safe to replace as
+            // before, since there's nothing to lose.
+            if (state.summary.trim() || state.body.trim()) {
+                return {
+                    ...state,
+                    loading: false,
+                    streamingPreview: undefined,
+                    pendingAiDraft: action.value,
+                    message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                    details: undefined,
+                };
+            }
             // No `message` here — the loader → filled fields are the confirmation
             // that the AI generated something. A lingering "AI draft ready for
             // editing" line in the panel reads as stale state. The runtime still
@@ -20265,6 +20288,7 @@ function applyCommitComposeAction(state, action) {
                 message: undefined,
                 details: undefined,
                 streamingPreview: undefined,
+                pendingAiDraft: undefined,
             };
         case 'setResult':
             return {
@@ -20284,6 +20308,46 @@ function applyCommitComposeAction(state, action) {
                 ...state,
                 streamingPreview: action.value,
             };
+        case 'setPendingAiDraft':
+            // Audit finding #7: route the AI draft here (instead of straight
+            // to summary/body via `setDraft`) when the user has unsaved
+            // typing the draft would clobber. The dispatcher does the
+            // user-content check; this reducer just stashes the draft and
+            // surfaces a message inviting the user to accept or dismiss.
+            return {
+                ...state,
+                loading: false,
+                streamingPreview: undefined,
+                pendingAiDraft: action.value,
+                message: 'AI draft ready. Press R to replace your text, or Esc to keep what you have.',
+                details: undefined,
+            };
+        case 'acceptPendingAiDraft':
+            // Swap the pending draft into the editable fields and clear it.
+            // Mirrors `setDraft`'s field positioning (focus on summary,
+            // editing on) so the user lands in the same place whether they
+            // accepted immediately or after deliberation.
+            if (!state.pendingAiDraft)
+                return state;
+            return {
+                ...state,
+                ...splitCommitDraft(state.pendingAiDraft),
+                field: 'summary',
+                editing: true,
+                loading: false,
+                message: undefined,
+                details: undefined,
+                streamingPreview: undefined,
+                pendingAiDraft: undefined,
+            };
+        case 'dismissPendingAiDraft':
+            // User chose to keep their typing; drop the AI draft.
+            return {
+                ...state,
+                pendingAiDraft: undefined,
+                message: undefined,
+                details: undefined,
+            };
         case 'reset':
             // Drop message/details too — the post-commit "Created commit ..."
             // notification is already on the runtime status line (footer); a
@@ -20471,6 +20535,14 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
         // classify below.
         const stream = await chain.stream(variables, signal ? { signal } : undefined);
         let chunkCount = 0;
+        let callbackFailureCount = 0;
+        // Audit finding #13: cap consecutive callback failures so a
+        // genuinely broken render handler can't tie up the LLM call
+        // silently for the user's entire wait. Five strikes (out of an
+        // expected ~50-500 chunks for a normal commit message) is enough
+        // to ride out a transient blip but small enough to bail before
+        // the user finishes waiting on a useless stream.
+        const MAX_CALLBACK_FAILURES = 5;
         for await (const messageChunk of stream) {
             const text = coerceChunkText(messageChunk);
             if (!text)
@@ -20479,12 +20551,20 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
             chunkCount += 1;
             try {
                 onChunk({ text, accumulated });
+                // Successful callback resets the consecutive-failure counter —
+                // we only bail on a STREAK of failures, not on isolated ones.
+                callbackFailureCount = 0;
             }
             catch (callbackError) {
                 // Deliberately swallow callback errors so a bad render handler
                 // can't tank the entire LLM call. Log at verbose so users with
                 // verbose mode on can still see what happened.
-                logger?.verbose(`executeChainStreaming: onChunk handler threw: ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+                callbackFailureCount += 1;
+                logger?.verbose(`executeChainStreaming: onChunk handler threw (${callbackFailureCount}/${MAX_CALLBACK_FAILURES}): ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+                if (callbackFailureCount >= MAX_CALLBACK_FAILURES) {
+                    logger?.verbose(`executeChainStreaming: bailing stream — ${MAX_CALLBACK_FAILURES} consecutive callback failures suggest a broken render handler.`, { color: 'red' });
+                    throw new LangChainExecutionError(`executeChainStreaming: render handler failed ${MAX_CALLBACK_FAILURES} times in a row; aborting stream so the failure surfaces to the caller.`, { accumulatedLength: accumulated.length, chunkCount });
+                }
             }
         }
         if (!accumulated) {
@@ -20518,15 +20598,22 @@ async function executeChainStreaming({ llm, prompt, variables, parser, onChunk,
     }
     catch (error) {
         // Cancellation classifier (#881 phase 3). Three signals: an
-        // explicitly aborted user signal (post-throw check), the
-        // standard DOM `AbortError`, or a Node `AbortSignal` with
-        // `signal.aborted === true` while a chain-internal error
-        // propagates. Any of these means "user wanted out," not "the
-        // call failed." Wrap the raw error so callers can pattern-match
-        // on `LangChainCancelledError` and carry the partial accumulated
-        // text in case the caller wants to salvage anything.
+        // explicitly aborted user signal (post-throw check) or a thrown
+        // `AbortError` from the standard DOM API. Either means "user
+        // wanted out," not "the call failed." Wrap the raw error so
+        // callers can pattern-match on `LangChainCancelledError` and
+        // carry the partial accumulated text in case the caller wants
+        // to salvage anything.
+        //
+        // Audit finding #8: an earlier implementation also fell back to
+        // `error.message.includes('aborted')` as a third signal. That
+        // substring heuristic is footgun-shaped — legitimate provider
+        // errors ("model not aborted properly", future API copy) would
+        // misclassify as user cancels. Dropped; rely on the structured
+        // signal (`signal.aborted`) and the standard error class
+        // (`name === 'AbortError'`).
         const aborted = signal?.aborted ||
-            (error instanceof Error && (error.name === 'AbortError' || error.message?.includes('aborted')));
+            (error instanceof Error && error.name === 'AbortError');
         if (aborted) {
             throw new LangChainCancelledError(error instanceof Error ? error.message : 'Streaming aborted by user', accumulated, {
                 provider: effectiveProvider,
@@ -20785,6 +20872,12 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
             // schema-validated retry — paying for a second LLM call only
             // on the edge case where the streamed output is unsalvageable.
             const streamingParser = createSchemaParser(schema, llm);
+            // Capture the final accumulated text out-of-band so we can
+            // attempt salvage if the parser throws on completion (audit
+            // finding #1). Updated on every chunk; the last value is
+            // whatever the stream produced before the parser ran. Empty
+            // string when streaming throws before any chunks arrived.
+            let streamedAccumulated = '';
             let salvaged;
             try {
                 // `executeChainStreaming` runs the parser on the accumulated
@@ -20798,6 +20891,7 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                     variables: budgetedPrompt.variables,
                     parser: streamingParser,
                     onChunk: ({ text, accumulated }) => {
+                        streamedAccumulated = accumulated;
                         onStreamChunk(text, accumulated);
                     },
                     signal,
@@ -20827,13 +20921,24 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                         cancelled: true,
                     };
                 }
-                // Streamed accumulated text didn't parse cleanly. Try the
-                // lossy salvager on whatever we have; if that produces a
-                // non-placeholder title, accept it. Otherwise fall through
-                // to the non-streaming path which can retry with a fresh
-                // LLM call.
-                logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
-                salvaged = undefined;
+                // Audit finding #1: try the lossy salvager on the accumulated
+                // text before paying for a second LLM call. The salvager
+                // strips code fences, attempts strict JSON parse, and falls
+                // back to "first line is title, rest is body." We only accept
+                // its output when it produced a real title — the placeholder
+                // title ("Auto-generated commit") means the salvager
+                // couldn't extract anything meaningful and the non-streaming
+                // retry is the better choice.
+                if (streamedAccumulated) {
+                    const candidate = salvageCommitMessageFromText(streamedAccumulated);
+                    if (candidate.title && candidate.title !== 'Auto-generated commit') {
+                        salvaged = candidate;
+                        logger.verbose(`Streaming parser failed but salvager recovered a draft from ${streamedAccumulated.length} accumulated chars; skipping non-streaming retry.`, { color: 'green' });
+                    }
+                }
+                if (!salvaged) {
+                    logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
+                }
             }
             // Type-narrow: commitMsg is set inside try{}, but TS doesn't
             // see that across the catch. Re-init through the salvage path
@@ -20842,10 +20947,12 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
                 commitMsg = salvaged;
             }
             else if (!(commitMsg)) {
-                // Streaming threw; do the standard non-streaming flow to
-                // recover. This is the trade-off documented in the issue —
-                // streaming gives us a preview but the validated result still
-                // comes from the schema-aware retry path when streaming fails.
+                // Streaming threw AND the salvager couldn't recover anything
+                // useful; fall back to the standard non-streaming flow.
+                // Documented trade-off from the issue: streaming gives us a
+                // preview but the validated result still comes from the
+                // schema-aware retry path when both streaming AND salvage
+                // fail.
                 commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
                     logger,
                     tokenizer,
@@ -24288,10 +24395,14 @@ function applyLogInkAction(state, action) {
             // Cache the result so re-entry (or `c` to PR) reuses it instead of
             // re-running the LLM. Keyed by branch so a checkout naturally
             // produces a fresh generation.
+            // Audit finding #9: `generatedAt` arrives on the action payload
+            // instead of being read from `Date.now()` here, so the reducer
+            // stays pure. Dispatchers (currently `runChangelogView` in
+            // app.ts) call `Date.now()` at dispatch time.
             const cached = {
                 text: action.text,
                 baseLabel: action.baseLabel,
-                generatedAt: Date.now(),
+                generatedAt: action.generatedAt,
             };
             return {
                 ...state,
@@ -24345,7 +24456,8 @@ function applyLogInkAction(state, action) {
                         // Updated-at timestamp reflects the edit. Not the original
                         // generation time — `r` (regenerate) is the explicit knob
                         // for "I want fresh LLM output, not my edits".
-                        generatedAt: Date.now(),
+                        // Audit finding #9: timestamp arrives on the action.
+                        generatedAt: action.generatedAt,
                     },
                 },
                 pendingKey: undefined,
@@ -24381,7 +24493,9 @@ function applyLogInkAction(state, action) {
             }
             return {
                 ...state,
-                recentCommitHashes: { hashes: action.hashes, markedAt: Date.now() },
+                // Audit finding #9: timestamp arrives on the action payload
+                // instead of being read from `Date.now()` here.
+                recentCommitHashes: { hashes: action.hashes, markedAt: action.markedAt },
                 pendingKey: undefined,
             };
         case 'clearRecentCommits':
@@ -25181,16 +25295,24 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         return [];
     }
     // Cancel in-flight AI commit draft (#881 phase 3). When the compose
-    // surface is mid-stream (loading === true), Esc aborts the LLM call
-    // and the runtime handler cleans up (clear loading, clear preview,
-    // status line shows "AI draft cancelled."). Sits above the editing
-    // / view handlers so the cancel keystroke can't fall through to
-    // "leave compose" or anything else.
+    // state has a draft in flight (loading === true), Esc aborts the
+    // LLM call and the runtime handler cleans up (clear loading, clear
+    // preview, status line shows "AI draft cancelled.").
+    //
+    // Audit finding #5: the `activeView === 'compose'` gate from the
+    // original phase 3 implementation made the cancel keystroke
+    // unreachable after the user chord-navigated away from compose
+    // mid-stream (Esc would fall through to popView etc., consuming
+    // the navigation intent while the LLM call silently ran to
+    // completion). Cancel should work wherever the user is — they
+    // can always navigate back to compose afterwards.
     //
-    // Loading and editing are mutually exclusive in practice (the user
-    // can't type while the AI is generating), but the order here makes
-    // the precedence explicit if that ever changes.
-    if (state.activeView === 'compose' && state.commitCompose.loading && key.escape) {
+    // Sits above the editing / view handlers so the cancel keystroke
+    // can't fall through to "leave compose" or anything else. Loading
+    // and editing are mutually exclusive in practice (the user can't
+    // type while the AI is generating), but the order here makes the
+    // precedence explicit if that ever changes.
+    if (state.commitCompose.loading && key.escape) {
         return [{ type: 'cancelAiCommitDraft' }];
     }
     // Cancel in-flight PR body draft (#881 phase 4). The `C` keystroke
@@ -25210,6 +25332,27 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
     if (state.pendingPullRequestBodyDraft && key.escape) {
         return [{ type: 'cancelPullRequestBodyDraft' }];
     }
+    // Pending AI draft confirmation (audit finding #7). When the AI
+    // draft completes against a non-empty compose surface, it lands in
+    // `pendingAiDraft` instead of overwriting the user's typing. `R`
+    // accepts the swap (user's typing is lost, AI draft becomes the
+    // new content). `Esc` dismisses the AI draft (typing is preserved,
+    // AI draft is lost — the user paid for the tokens but explicitly
+    // chose not to use them).
+    //
+    // Gated on `activeView === 'compose'` because the pending draft is
+    // only meaningful on the compose surface (where the message line
+    // surfaces the prompt). A user who chord-navigated away while the
+    // draft was pending should see the original `R` / Esc semantics of
+    // wherever they are now.
+    if (state.activeView === 'compose' && state.commitCompose.pendingAiDraft) {
+        if (inputValue === 'R' && !key.ctrl && !key.meta) {
+            return [action({ type: 'commitCompose', action: { type: 'acceptPendingAiDraft' } })];
+        }
+        if (key.escape) {
+            return [action({ type: 'commitCompose', action: { type: 'dismissPendingAiDraft' } })];
+        }
+    }
     if (state.commitCompose.editing) {
         if (key.escape) {
             return [action({ type: 'commitCompose', action: { type: 'setEditing', value: false } })];
@@ -36268,6 +36411,14 @@ function LogInkApp(deps) {
     // workdirs for submodule paths recorded in `.gitmodules` (which
     // are repo-relative). Undefined during the brief moment between
     // git swap and the revparse callback resolving.
+    //
+    // Audit finding #10: rapid frame push/pop races are prevented by
+    // the per-effect `cancelled` flag — React fires the cleanup
+    // synchronously BEFORE running the next effect body, so any
+    // pending revparse from the old `git` sees `cancelled === true`
+    // and skips its write. The `git` reference itself is captured by
+    // closure, so each effect run resolves against the right binding.
+    // No additional depth tagging is needed.
     const [activeRepoRoot, setActiveRepoRoot] = React.useState(undefined);
     React.useEffect(() => {
         let cancelled = false;
@@ -36698,18 +36849,50 @@ function LogInkApp(deps) {
         })();
         return () => { cancelled = true; };
     }, [git, dispatch]);
+    // Audit finding #2: re-resolve the repo root inline on every save
+    // and key the deps off `git` + the saved value. The original
+    // implementation read from `repoRootRef.current`, which is async-
+    // populated by the resolver effect above and can lag behind a git
+    // swap. After #995's synchronous pop-restore, the parent's freshly
+    // restored sidebar tab was being written into the submodule's
+    // cache because the ref still held the submodule root during the
+    // brief window before the resolver settled.
+    //
+    // The extra `revparse` cost per save is negligible (saves fire
+    // once per user-initiated tab change, not per render) and the
+    // cancellation flag prevents a stale resolution from racing a
+    // newer one in flight.
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveSidebarTab(repoRoot, state.userSidebarTab);
-    }, [state.userSidebarTab]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveSidebarTab(root, state.userSidebarTab);
+            }
+            catch {
+                // Not in a worktree, or revparse failed — silently skip.
+                // The next save attempt will retry.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.userSidebarTab, git]);
     React.useEffect(() => {
-        const repoRoot = repoRootRef.current;
-        if (!repoRoot)
-            return;
-        saveDiffViewMode(repoRoot, state.diffViewMode);
-    }, [state.diffViewMode]);
+        let cancelled = false;
+        void (async () => {
+            try {
+                const root = (await git.revparse(['--show-toplevel'])).trim();
+                if (cancelled || !root)
+                    return;
+                saveDiffViewMode(root, state.diffViewMode);
+            }
+            catch {
+                // Same as above.
+            }
+        })();
+        return () => { cancelled = true; };
+    }, [state.diffViewMode, git]);
     // P-stash-explorer: load `git stash show -p <ref>` once the diff view
     // becomes active with diffSource='stash'. Best-effort — empty stashes
     // or read errors fall through to a "no diff" hint at the render site.
@@ -37343,6 +37526,12 @@ function LogInkApp(deps) {
                 git,
                 signal: controller.signal,
                 onStreamChunk: (_text, accumulated) => {
+                    // Audit finding #4: skip dispatching into a torn-down
+                    // tree. If the user quit (or otherwise unmounted the
+                    // workstation) mid-stream, React warns about updates on
+                    // an unmounted component. Drop the chunk silently.
+                    if (!mountedRef.current)
+                        return;
                     // Dispatch the full accumulated text — the preview chrome
                     // helper does the last-N-lines slicing at render time, so
                     // re-doing the slice here would be wasted work. Per-chunk
@@ -37354,6 +37543,11 @@ function LogInkApp(deps) {
                     });
                 },
             });
+            // Audit finding #4 (unmount race): bail out before any
+            // post-await dispatch if the user quit while the LLM call was
+            // in flight. Same pattern as `refreshHistoryRows` upstream.
+            if (!mountedRef.current)
+                return;
             // Cancel path (#881 phase 3). User pressed Esc during the
             // stream; reducer drops loading + preview, status line shows
             // a neutral "cancelled" message. Skip the result / failure
@@ -37374,6 +37568,23 @@ function LogInkApp(deps) {
             });
             dispatch({ type: 'setStatus', value: result.message });
         }
+        catch (error) {
+            // Audit finding #3: defensive recovery for unexpected throws
+            // from the workflow. The workflow catches its own errors
+            // today, so this catch is latent — but any future refactor
+            // that lets an error escape would otherwise strand the
+            // spinner permanently with no user-facing recovery short of
+            // quitting. Surface a generic failure and clear the loading
+            // state so the user can re-try.
+            if (mountedRef.current) {
+                dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: false } });
+                dispatch({
+                    type: 'setStatus',
+                    value: `AI draft failed unexpectedly: ${error instanceof Error ? error.message : String(error)}`,
+                    kind: 'error',
+                });
+            }
+        }
         finally {
             // Clear the ref only if it still points at OUR controller — a
             // rapid second invocation could have already replaced it, in
@@ -37465,9 +37676,14 @@ function LogInkApp(deps) {
         const cancelHandle = { cancelled: false };
         pullRequestBodyCancelRef.current = cancelHandle;
         dispatch({ type: 'setPendingPullRequestBodyDraft', value: true });
+        // Audit finding #6: soft cancel today — Esc skips opening the
+        // follow-up prompt, but the LLM call itself keeps running to
+        // completion (no AbortSignal threaded through the changelog CLI
+        // chain). Status copy reflects that honestly so the user isn't
+        // misled into thinking they're saving tokens.
         dispatch({
             type: 'setStatus',
-            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to cancel`,
+            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to skip prompt`,
             loading: true,
         });
         try {
@@ -37494,6 +37710,15 @@ function LogInkApp(deps) {
             else {
                 dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.' });
             }
+            // Audit finding #11: clear the pending flag BEFORE opening the
+            // prompt. If a future refactor adds an `await` between the flag
+            // clear (currently in `finally`) and the `openInputPrompt`
+            // dispatch, an Esc keystroke in the gap would dispatch
+            // `cancelPullRequestBodyDraft` AFTER the prompt opens, leaving
+            // the prompt visible with a stale "cancelled" message. Clearing
+            // here moves the flag teardown into the same React batch as the
+            // prompt open, eliminating the race.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             dispatch({
                 type: 'openInputPrompt',
                 kind: 'create-pr',
@@ -37503,11 +37728,14 @@ function LogInkApp(deps) {
             });
         }
         finally {
-            // Clear the flag + the ref so a subsequent draft starts clean.
+            // Belt-and-suspenders: the `try` block clears the flag on the
+            // success path (audit finding #11). This duplicate clear handles
+            // the error / cancel paths where the early-returns skip the
+            // success-path dispatch. Safe to no-op when already false.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             // Only clear the ref if we still own it — a second invocation
             // would have already taken ownership in which case the cancel
             // duty has rolled over.
-            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
             if (pullRequestBodyCancelRef.current === cancelHandle) {
                 pullRequestBodyCancelRef.current = null;
             }
@@ -37608,6 +37836,11 @@ function LogInkApp(deps) {
                 branch: head,
                 baseLabel: cached.baseLabel,
                 text: cached.text,
+                // Audit finding #9: cache-hit path preserves the original
+                // generation timestamp rather than minting a fresh one — the
+                // "X ago" header should reflect when the LLM ran, not when
+                // the cached entry was re-displayed.
+                generatedAt: cached.generatedAt,
             });
             dispatch({
                 type: 'setStatus',
@@ -37636,6 +37869,9 @@ function LogInkApp(deps) {
             branch: head,
             baseLabel,
             text: result.text,
+            // Audit finding #9: timestamp captured at dispatch time, not
+            // inside the reducer.
+            generatedAt: Date.now(),
         });
         dispatch({
             type: 'setStatus',
@@ -37738,7 +37974,7 @@ function LogInkApp(deps) {
         if (editorOk) {
             try {
                 const content = fs$1.readFileSync(file, 'utf8');
-                dispatch({ type: 'setChangelogText', text: content });
+                dispatch({ type: 'setChangelogText', text: content, generatedAt: Date.now() });
                 dispatch({ type: 'setStatus', value: 'Changelog updated from editor.' });
             }
             catch (error) {
@@ -38093,7 +38329,8 @@ function LogInkApp(deps) {
         // that could disagree with reality on partial-apply.
         const commitHashes = result.commitHashes || [];
         if (commitHashes.length > 0) {
-            dispatch({ type: 'markRecentCommits', hashes: commitHashes });
+            // Audit finding #9: timestamp captured at dispatch time.
+            dispatch({ type: 'markRecentCommits', hashes: commitHashes, markedAt: Date.now() });
             // DevSkim: ignore DS172411 — function literal, fixed delay,
             // no caller-supplied data flowing through.
             setTimeout(() => dispatch({ type: 'clearRecentCommits' }), 5000);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-coco",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "zero-effort git commits with coco.",
   "author": "gfargo <ghfargo@gmail.com>",
   "license": "MIT",