infraweaver 0.1.0

package/src/utils/providerErrors.ts

@@ -0,0 +1,189 @@
+type ProviderErrorPattern = { regex: RegExp; label: string };
+
+/** Stable label for the BYOK provider-billing-exhausted classification. */
+export const PROVIDER_BILLING_EXHAUSTED_LABEL = "provider billing exhausted";
+
+// status codes are only treated as provider errors when they are adjacent to
+// a recognised status key. this rejects commit SHAs that happen to contain
+// "429", version strings, file hashes, etc.
+const statusKey = `\\b(?:status[_ ]?code|http[_ ]?status|status)["']?\\s*[:=]\\s*["']?`;
+
+const PROVIDER_ERROR_PATTERNS: ProviderErrorPattern[] = [
+  // billing-payload patterns come BEFORE bare status-code patterns. providers
+  // commonly return 401 / 429 for billing/quota exhaustion (OpenCode Zen
+  // `CreditsError` / `FreeUsageLimitError`, Gemini `RESOURCE_EXHAUSTED` +
+  // "spending cap", Anthropic "Insufficient balance" / "credit balance is
+  // too low"). these are non-retryable and require user-billing action —
+  // distinct from a transient auth error or rate-limit. status-code patterns
+  // would otherwise win and surface "auth error (401)" / "rate limited (429)"
+  // with no billing hint. see #778, #835.
+  { regex: /\bCreditsError\b/, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  { regex: /\bFreeUsageLimitError\b/, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  { regex: /Insufficient balance/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  {
+    regex: /credit balance is too low/i,
+    label: PROVIDER_BILLING_EXHAUSTED_LABEL,
+  },
+  { regex: /spending cap/i, label: PROVIDER_BILLING_EXHAUSTED_LABEL },
+  // auth patterns must come BEFORE rate-limit patterns. OpenRouter 401 error
+  // payloads carry `x-ratelimit-*` response headers in the dump, and the
+  // free-form rate-limit regex below would otherwise win on word-boundary
+  // matches inside header names. canonical 401 messages: OpenRouter returns
+  // `{"error":{"message":"User not found","code":401}}` for disabled or
+  // invalid keys (https://openai.luzhipeng.com/docs/api/reference/errors-and-debugging).
+  { regex: new RegExp(`${statusKey}401\\b`, "i"), label: "auth error (401)" },
+  { regex: new RegExp(`${statusKey}403\\b`, "i"), label: "auth error (403)" },
+  { regex: /\bUser not found\b/i, label: "auth error (invalid/disabled key)" },
+  {
+    regex: /\bInvalid authentication\b/i,
+    label: "auth error (invalid credentials)",
+  },
+  {
+    regex: /\bNo auth credentials found\b/i,
+    label: "auth error (missing credentials)",
+  },
+  { regex: new RegExp(`${statusKey}429\\b`, "i"), label: "rate limited (429)" },
+  { regex: new RegExp(`${statusKey}500\\b`, "i"), label: "provider 500 error" },
+  {
+    regex: new RegExp(`${statusKey}503\\b`, "i"),
+    label: "provider unavailable (503)",
+  },
+  // matches `rate limit`, `rate limited`, `rate limits exceeded`,
+  // `rate_limit_error`, `rate_limit_exceeded`. the leading `\b` + `[_ ]`
+  // separator rejects `x-ratelimit-*` / `anthropic-ratelimit-*` response
+  // headers (no separator between "rate" and "limit") which routinely
+  // appear in dumped 401 / 4xx error JSON.
+  { regex: /\brate[_ ]limit/i, label: "rate limited" },
+  { regex: /\bRESOURCE_EXHAUSTED\b/, label: "quota exhausted" },
+  // Google gRPC `INTERNAL` status. word-boundary anchors reject
+  // `INTERNAL_SERVER_ERROR` (HTTP 500 message that may appear in unrelated
+  // log lines) and identifiers like `INTERNALS`.
+  { regex: /\bINTERNAL\b/, label: "provider internal error" },
+  { regex: /\bUNAVAILABLE\b/, label: "provider unavailable" },
+  // matches `quota`, `insufficient_quota`, `quota_exceeded`, `quotaExceeded`.
+  // word-character lookarounds would reject `_quota` / `quotaX`; `quota` is
+  // specific enough that a plain substring match is safe.
+  { regex: /quota/i, label: "quota error" },
+  // explicit zero-quota response, e.g. `{"limit": 0}`. the `\b` anchor
+  // around `limit` rejects keys like `time_limit` or `field_limit`.
+  { regex: /["']?\blimit\b["']?\s*:\s*0\b/, label: "zero quota" },
+];
+
+/**
+ * Result of a provider-error scan: the classification label plus a
+ * human-readable excerpt centered on the matched line. The excerpt is what
+ * gets surfaced in `» provider error detected (...)` log lines — see
+ * `extractExcerpt` for the windowing/byte-cap policy.
+ */
+export type ProviderErrorMatch = {
+  label: string;
+  excerpt: string;
+};
+
+// roughly half a wide terminal line by 4–5 lines of context; large enough
+// to capture a structured error payload (request id, retry-after, model)
+// plus its immediate stack/headers, small enough to not flood the log.
+const EXCERPT_MAX_BYTES = 600;
+const LINES_BEFORE = 1;
+const LINES_AFTER = 2;
+
+export function findProviderErrorMatch(
+  text: string,
+): ProviderErrorMatch | null {
+  for (const entry of PROVIDER_ERROR_PATTERNS) {
+    const m = entry.regex.exec(text);
+    if (!m) continue;
+    return { label: entry.label, excerpt: extractExcerpt(text, m.index) };
+  }
+  return null;
+}
+
+export function detectProviderError(text: string): string | null {
+  return findProviderErrorMatch(text)?.label ?? null;
+}
+
+/**
+ * Slice a context window around `matchIndex`: the matched line plus
+ * `LINES_BEFORE`/`LINES_AFTER` neighbours. If the windowed slice exceeds
+ * `EXCERPT_MAX_BYTES` (giant adjacent lines, e.g. JSON tool-schema dumps),
+ * fall back to the matched line alone, head-truncated if still too long.
+ * Replaces the old `chunk.substring(0, 500)` head-anchored excerpt which
+ * surfaced whatever happened to be at the front of the stderr buffer
+ * instead of the error itself. See issue #703.
+ */
+function extractExcerpt(text: string, matchIndex: number): string {
+  const lineStart = text.lastIndexOf("\n", matchIndex - 1) + 1;
+  const lineEndRaw = text.indexOf("\n", matchIndex);
+  const lineEnd = lineEndRaw === -1 ? text.length : lineEndRaw;
+
+  let start = lineStart;
+  for (let i = 0; i < LINES_BEFORE && start > 0; i++) {
+    const prev = text.lastIndexOf("\n", start - 2);
+    start = prev < 0 ? 0 : prev + 1;
+  }
+
+  let end = lineEnd;
+  for (let i = 0; i < LINES_AFTER && end < text.length; i++) {
+    const next = text.indexOf("\n", end + 1);
+    end = next < 0 ? text.length : next;
+  }
+
+  let excerpt = text.slice(start, end);
+  if (excerpt.length > EXCERPT_MAX_BYTES) {
+    excerpt = text.slice(lineStart, lineEnd);
+    if (excerpt.length > EXCERPT_MAX_BYTES)
+      excerpt = excerpt.slice(0, EXCERPT_MAX_BYTES);
+  }
+  return excerpt.trim();
+}
+
+/**
+ * OpenRouter's response when the per-run key's remaining budget can't cover
+ * the agent's `max_tokens` reservation. Distinct from a generic provider error
+ * because it's a Infraweaver billing concern, not an upstream outage — the user's
+ * Router wallet ran out (or the key budget was undersized at mint time and the
+ * agent ran out of headroom partway through).
+ *
+ * Match must be specific to this exact OpenRouter error class. Generic "credits"
+ * or "limit" text shows up in unrelated errors and would mis-classify them.
+ *
+ * Sample:
+ *   `APIError: This request requires more credits, or fewer max_tokens.
+ *    You requested up to 32000 tokens, but can only afford 22800.`
+ */
+// `/s` (dotAll) lets `.*?` cross newlines so we still detect the error if any
+// upstream layer reformats the message onto multiple lines. Without it, a
+// single inserted `\n` would silently bypass the BillingError reclassification
+// and the user would see the generic `❌ Infraweaver failed` dump instead of the
+// actionable top-up CTA.
+const ROUTER_KEYLIMIT_EXHAUSTED_PATTERN =
+  /requires more credits.*?fewer max_tokens|requested up to \d+ tokens.*?can only afford/is;
+
+export function isRouterKeylimitExhaustedError(text: string): boolean {
+  return ROUTER_KEYLIMIT_EXHAUSTED_PATTERN.test(text);
+}
+
+/**
+ * BYOK billing-exhausted: provider rejected the request because the user's
+ * provider wallet is empty (DeepSeek "Insufficient Balance", Anthropic
+ * "credit balance is too low", OpenCode Zen `CreditsError` /
+ * `FreeUsageLimitError`, Gemini "spending cap"). Distinct from
+ * `isRouterKeylimitExhaustedError` — that's Infraweaver's Router wallet, this
+ * is the user's own provider account.
+ */
+export function isProviderBillingExhausted(text: string): boolean {
+  return (
+    findProviderErrorMatch(text)?.label === PROVIDER_BILLING_EXHAUSTED_LABEL
+  );
+}
+
+/**
+ * Extract `providerID=foo` from agent error logs (OpenCode emits this on
+ * `provider error detected (...)` lines). Returns the lowercase provider
+ * slug, or null when absent. Used to render a provider-specific dashboard
+ * link in the BYOK billing-exhausted summary.
+ */
+export function extractProviderId(text: string): string | null {
+  const match = text.match(/\bproviderID=([a-z0-9_-]+)/i);
+  return match ? match[1]!.toLowerCase() : null;
+}

package/src/utils/proxyModel.ts

@@ -0,0 +1,239 @@
+import * as core from "@actions/core";
+
+import type { Agent } from "#app/agents/index";
+import type { ModelGateResult } from "#app/utils/agent";
+import { apiFetch } from "#app/utils/apiFetch";
+import { BillingError } from "#app/utils/billingErrors";
+import { resolveModelSlug } from "#app/models";
+import { registerSecret } from "#app/utils/redact";
+import type { AccountPlan } from "#app/utils/runContext";
+
+/**
+ * Managed-model routing (the engine half of Phase D). On a PAYG plan with no BYO
+ * provider key, instead of the free fallback the engine mints a short-lived proxy
+ * token from the Cloud (`POST /api/proxy-token`) and points the Anthropic-compatible
+ * harness at the returned EU Bedrock proxy endpoint. The proxy meters usage out of
+ * band (`/api/proxy-usage`) — the engine never bills.
+ *
+ * `applyManagedProxy` overlays this decision onto a BYOK model gate and returns a
+ * complete `RoutedModel` — including the env patch the caller must apply
+ * (`envToApply`) rather than mutating `process.env` from inside, so the routing
+ * decision is fully described by its return value. The composition with the gate
+ * and validation lives in modelResolver.ts (`resolveRunModel`).
+ */
+
+// The Anthropic CLI / Claude Code harness reads these to route through a gateway:
+// a base URL + a bearer token. NOT CLAUDE_CODE_USE_BEDROCK — the proxy speaks the
+// Anthropic Messages API, not the Bedrock wire format.
+const PROXY_BASE_URL_ENV = "ANTHROPIC_BASE_URL";
+const PROXY_AUTH_TOKEN_ENV = "ANTHROPIC_AUTH_TOKEN";
+
+/** A resolved model decision plus the env patch (if any) the caller must apply to
+ *  route the run. `envToApply` is set only when the managed proxy engaged. */
+export type RoutedModel = ModelGateResult & {
+  envToApply?: Record<string, string>;
+};
+
+export type ProxyMintResult =
+  | { ok: true; token: string; endpoint: string }
+  | {
+      ok: false;
+      reason:
+        | "requires_card"
+        | "requires_upgrade"
+        | "unconfigured"
+        | "transient";
+    };
+
+/**
+ * The proxy `endpoint` becomes `ANTHROPIC_BASE_URL` and receives the bearer on every
+ * model call, so it must be a well-formed **https** URL — never cleartext. It comes
+ * from the authenticated Cloud (not directly attacker-controlled), but a
+ * compromised/misconfigured Cloud response could otherwise redirect the proxy token.
+ * Operators can additionally pin exact hosts via `INFRAWEAVER_MODEL_PROXY_ALLOWED_HOSTS`
+ * (comma-separated); unset = trust any https host the Cloud returns.
+ */
+export function isSafeProxyEndpoint(endpoint: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const pinned = (process.env.INFRAWEAVER_MODEL_PROXY_ALLOWED_HOSTS ?? "")
+    .split(",")
+    .map((h) => h.trim().toLowerCase())
+    .filter(Boolean);
+  return pinned.length === 0 || pinned.includes(url.hostname.toLowerCase());
+}
+
+/** Classify a `/api/proxy-token` response. Pure given the status + parsed body
+ *  (aside from the optional `INFRAWEAVER_MODEL_PROXY_ALLOWED_HOSTS` host pin). */
+export function classifyProxyMint(
+  status: number,
+  body: { token?: unknown; endpoint?: unknown } | null,
+): ProxyMintResult {
+  if (
+    status === 200 &&
+    body &&
+    typeof body.token === "string" &&
+    typeof body.endpoint === "string" &&
+    // refuse to route the bearer to a cleartext / malformed / non-allowlisted host.
+    isSafeProxyEndpoint(body.endpoint)
+  ) {
+    return { ok: true, token: body.token, endpoint: body.endpoint };
+  }
+  // 402 = router_requires_card (no payment method); 403 = the requested managed
+  // model needs a higher plan (Opus / Sonnet run on OSS + Team, Claude Fable is
+  // Enterprise); 501 = proxy not deployed yet.
+  if (status === 402) return { ok: false, reason: "requires_card" };
+  if (status === 403) return { ok: false, reason: "requires_upgrade" };
+  if (status === 501) return { ok: false, reason: "unconfigured" };
+  return { ok: false, reason: "transient" };
+}
+
+/** The env that points the Anthropic-compatible harness at the managed proxy. Pure. */
+export function managedProxyEnv(
+  token: string,
+  endpoint: string,
+): Record<string, string> {
+  return { [PROXY_BASE_URL_ENV]: endpoint, [PROXY_AUTH_TOKEN_ENV]: token };
+}
+
+/** Apply a model-routing env patch to the process. The one place env is mutated, and
+ *  the caller does it explicitly with a value it can see (no hidden side effect). */
+export function applyModelEnv(env: Record<string, string>): void {
+  for (const [key, value] of Object.entries(env)) process.env[key] = value;
+}
+
+/** Mint a managed-model proxy token from the Cloud. Never throws — network/parse
+ *  failures classify as `transient` so the caller can fall back to the free model. */
+export async function mintProxyToken(opts: {
+  credential: string;
+  model?: string | undefined;
+  fetchImpl?: typeof apiFetch;
+}): Promise<ProxyMintResult> {
+  const doFetch = opts.fetchImpl ?? apiFetch;
+  try {
+    const res = await doFetch({
+      path: "/api/proxy-token",
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${opts.credential}`,
+        "content-type": "application/json",
+      },
+      body: JSON.stringify(opts.model ? { model: opts.model } : {}),
+    });
+    let body: { token?: unknown; endpoint?: unknown } | null = null;
+    try {
+      body = (await res.json()) as { token?: unknown; endpoint?: unknown };
+    } catch {
+      body = null;
+    }
+    const result = classifyProxyMint(res.status, body);
+    // register the minted `tmpx_` proxy token for log masking the moment we
+    // receive it — exactly like every other bearer the engine handles (gitAuth,
+    // token.ts, payload.ts). It is about to be placed in `ANTHROPIC_AUTH_TOKEN`
+    // (managedProxyEnv → applyModelEnv); GitHub only masks REGISTERED secrets, so
+    // without this any later env dump / error line would print it in cleartext.
+    // also register it with the sink-independent redactor so it's masked on the
+    // stderr / local sinks `core.setSecret` doesn't cover.
+    if (result.ok) {
+      core.setSecret(result.token);
+      registerSecret(result.token);
+    }
+    return result;
+  } catch {
+    return { ok: false, reason: "transient" };
+  }
+}
+
+/** The mint seam `applyManagedProxy` / `resolveRunModel` accept for tests. */
+export type ProxyMint = typeof mintProxyToken;
+
+/**
+ * The model the managed EU Bedrock proxy should serve for this run. The managed
+ * gateway is Anthropic-on-Bedrock, and unlike a BYOK key it can serve the whole
+ * Claude family — including Claude Fable, which the BYOK catalog deprecates to Opus
+ * (many BYOK Anthropic keys can't invoke Fable). So for an `anthropic/*` selection
+ * we mint for the slug's *undeprecated* resolve (e.g. `anthropic/claude-fable`
+ * stays Fable) rather than the fallback-collapsed model the BYOK gate produced.
+ * Non-Anthropic selections keep the gate's resolved model (the proxy maps anything
+ * else to its default Claude model anyway). Returns undefined when there is no
+ * usable Anthropic override, so the caller keeps `gate.fallback.from`.
+ */
+export function managedProxyModel(
+  slug: string | undefined,
+): string | undefined {
+  if (!slug?.startsWith("anthropic/")) return undefined;
+  return resolveModelSlug(slug);
+}
+
+/**
+ * Overlay the managed proxy onto a model gate. A no-op (returns the gate unchanged)
+ * unless the free fallback engaged (no BYO key) AND the org is on PAYG. On a
+ * successful mint it routes the originally-requested model through the proxy and sets
+ * `envToApply`; a `requires_card` mint surfaces a `BillingError`;
+ * `unconfigured`/`transient` keep the free fallback the gate already chose.
+ */
+export async function applyManagedProxy(input: {
+  gate: ModelGateResult;
+  plan: AccountPlan;
+  credential: string;
+  resolveAgent: (ctx: { model?: string | undefined }) => Agent;
+  /** the originally-requested model slug (before BYOK fallback), when known */
+  slug?: string | undefined;
+  mint?: ProxyMint;
+}): Promise<RoutedModel> {
+  const { gate } = input;
+  if (!gate.fallback || input.plan !== "payg" || !input.credential) return gate;
+
+  // Prefer the user's chosen managed Claude model (Fable survives here) over the
+  // BYOK fallback-collapsed model — see {@link managedProxyModel}.
+  const requested = managedProxyModel(input.slug) ?? gate.fallback.from;
+  const mintFn = input.mint ?? mintProxyToken;
+  const result = await mintFn({
+    credential: input.credential,
+    model: requested,
+  });
+
+  if (result.ok) {
+    const model = requested;
+    return {
+      model,
+      effectiveSlug: model,
+      agent: input.resolveAgent({ model }),
+      warnings: [
+        `» routing ${model} through the managed EU Bedrock proxy (no BYO key on a PAYG plan)`,
+      ],
+      validate: false,
+      envToApply: managedProxyEnv(result.token, result.endpoint),
+    };
+  }
+
+  if (result.reason === "requires_card") {
+    throw new BillingError(
+      "Managed models require a payment method on this organisation.",
+      {
+        code: "router_requires_card",
+      },
+    );
+  }
+
+  if (result.reason === "requires_upgrade") {
+    throw new BillingError(
+      `The managed model ${requested} needs a higher plan — Claude Opus and Sonnet run on OSS + Team, ` +
+        `Claude Fable is on Enterprise. Upgrade, or pick a managed model your plan includes.`,
+      { code: "router_requires_upgrade" },
+    );
+  }
+
+  return {
+    ...gate,
+    warnings: [
+      ...gate.warnings,
+      `» managed-model proxy ${result.reason}; using the free fallback model`,
+    ],
+  };
+}

package/src/utils/rangeDiff.ts

@@ -0,0 +1,182 @@
+import { log } from "#app/utils/cli";
+import { $ } from "#app/utils/shell";
+
+type ComputeIncrementalDiffParams = {
+  baseBranch: string;
+  beforeSha: string;
+  headSha: string;
+};
+
+/**
+ * computes the incremental diff between two versions of a PR using range-diff
+ * on virtual squash commits created via `git commit-tree`.
+ *
+ * each PR version is squashed into a single synthetic commit (merge-base → tip tree),
+ * then range-diff compares those two single-commit ranges. this:
+ * - isolates each version's net effect (base branch noise eliminated via per-version merge bases)
+ * - avoids commit-matching issues that raw range-diff has with rebases/squashes/reordering
+ * - creates only loose git objects, no branches or refs (unlike temp-branch squash approaches)
+ *
+ * unlike fetchAndFormatPrDiff/formatFilesWithLineNumbers, this output has no line numbers.
+ * range-diff compares *patches* (diffs-of-diffs), not file trees — its hunk headers are
+ * `@@ file.ts` breadcrumbs, not positional `@@ -X,Y +A,B @@` markers. reconstructing
+ * line numbers would require cross-referencing with the v2 diff or content-matching against
+ * file trees, both of which are fragile (duplicate lines, hunk boundary shifts after rebase).
+ * a structured interdiff approach (diff two parsed patches, compare only +/- keys via Myers)
+ * could approximate line numbers but loses semantic precision: range-diff understands patch
+ * structure natively (rename detection, hunk-aware matching, dual-prefix inner/outer changes),
+ * while flat key-sequence comparison can misalign duplicate lines and can't distinguish
+ * "new addition to the PR" from "existing code newly modified by the PR". range-diff is the
+ * right abstraction here — the incremental diff answers "how did the changeset evolve?",
+ * not "where in the file is this?", and forcing positional line numbers onto it would be
+ * semantically misleading.
+ *
+ * alternatives considered:
+ * - plain git diff (two-tree or three-dot): includes base branch changes, no PR isolation
+ * - patch-text diffing (interdiff / diff-of-diffs): fragile, hunk offset noise on rebase
+ * - range-diff on raw commit ranges: confused by commit reorganization across force-pushes
+ */
+export function computeIncrementalDiff(params: ComputeIncrementalDiffParams): string | null {
+  try {
+    // $1=beforeSha, $2=baseBranch, $3=headSha
+    const raw = $(
+      "sh",
+      [
+        "-c",
+        'old_base=$(git merge-base "$1" "origin/$2") && ' +
+          'new_base=$(git merge-base "$3" "origin/$2") && ' +
+          "git range-diff --no-color " +
+          '"$old_base..$(git commit-tree "$1^{tree}" -p "$old_base" -m x)" ' +
+          '"$new_base..$(git commit-tree "$3^{tree}" -p "$new_base" -m x)"',
+        "--",
+        params.beforeSha,
+        params.baseBranch,
+        params.headSha,
+      ],
+      { log: false },
+    );
+
+    return postProcessRangeDiff(raw);
+  } catch (e) {
+    log.debug(`» range-diff failed: ${e instanceof Error ? e.message : String(e)}`);
+    return null;
+  }
+}
+
+function isDiffPrefix(ch: string): boolean {
+  return ch === " " || ch === "+" || ch === "-";
+}
+
+/**
+ * transforms git range-diff output into a clean incremental diff.
+ *
+ * range-diff content lines have two prefix characters:
+ *   1st (outer): range-diff level — space (same in both), + (new only), - (old only)
+ *   2nd (inner): original diff level — space (context), + (added), - (removed)
+ *
+ * stripping the inner prefix produces a standard unified-diff-like output where
+ * +/- means "changed between PR versions" rather than "changed vs base branch".
+ *
+ * uses a streaming approach: a ring buffer of before-context lines is flushed when
+ * a change is hit, then afterCount lines of after-context are emitted directly.
+ * nearest preceding ## / @@ headers are force-included when outside the context window.
+ */
+export function postProcessRangeDiff(raw: string, contextLines = 3): string | null {
+  if (!raw.trim()) return null;
+  if (/^\d+:\s+\w+\s+=\s+\d+:/m.test(raw)) return null;
+
+  type Line = { prefix: string; from: number; to: number; seq: number };
+
+  const beforeBuf: Line[] = [];
+  let lastFileHdr: Line | null = null;
+  let lastHunkHdr: Line | null = null;
+  let fileHdrEmitted = true;
+  let hunkHdrEmitted = true;
+
+  let out = "";
+  let afterRemaining = 0;
+  let lastEmittedSeq = -2;
+  let seq = 0;
+  let hasChanges = false;
+
+  function emit(line: Line) {
+    if (lastEmittedSeq >= 0 && line.seq > lastEmittedSeq + 1) out += `${out ? "\n" : ""}...`;
+    out += (out ? "\n" : "") + line.prefix + raw.slice(line.from, line.to);
+    lastEmittedSeq = line.seq;
+    if (lastFileHdr?.seq === line.seq) fileHdrEmitted = true;
+    if (lastHunkHdr?.seq === line.seq) hunkHdrEmitted = true;
+  }
+
+  function flushBefore() {
+    if (lastFileHdr && !fileHdrEmitted) emit(lastFileHdr);
+    if (lastHunkHdr && !hunkHdrEmitted) emit(lastHunkHdr);
+    for (const line of beforeBuf) {
+      if (line.seq > lastEmittedSeq) emit(line);
+    }
+    beforeBuf.length = 0;
+  }
+
+  let cursor = 0;
+  while (cursor < raw.length) {
+    const eol = raw.indexOf("\n", cursor);
+    const lineEnd = eol === -1 ? raw.length : eol;
+
+    if (raw.charCodeAt(cursor) >= 48 && raw.charCodeAt(cursor) <= 57) {
+      cursor = lineEnd + 1;
+      continue;
+    }
+
+    if (lineEnd - cursor >= 5 && raw.startsWith("    ", cursor)) {
+      const prefix = raw[cursor + 4]!;
+      if (isDiffPrefix(prefix)) {
+        const contentPos = cursor + 5;
+        const isOuterChange = prefix !== " ";
+        let line: Line;
+        let isChange = false;
+
+        if (contentPos >= lineEnd) {
+          line = { prefix, from: lineEnd, to: lineEnd, seq };
+        } else if (isDiffPrefix(raw[contentPos]!)) {
+          isChange = isOuterChange;
+          line = { prefix, from: contentPos + 1, to: lineEnd, seq };
+        } else {
+          line = { prefix, from: contentPos, to: lineEnd, seq };
+          if (
+            raw.startsWith("## ", contentPos) &&
+            !raw.startsWith("## Commit message", contentPos)
+          ) {
+            lastFileHdr = line;
+            fileHdrEmitted = false;
+            lastHunkHdr = null;
+            hunkHdrEmitted = true;
+          } else if (
+            raw.startsWith("@@", contentPos) &&
+            !raw.startsWith("@@ Metadata", contentPos)
+          ) {
+            lastHunkHdr = line;
+            hunkHdrEmitted = false;
+          }
+        }
+
+        if (isChange) {
+          hasChanges = true;
+          flushBefore();
+          emit(line);
+          afterRemaining = contextLines;
+        } else if (afterRemaining > 0) {
+          emit(line);
+          afterRemaining--;
+        } else {
+          if (beforeBuf.length >= contextLines) beforeBuf.shift();
+          beforeBuf.push(line);
+        }
+
+        seq++;
+      }
+    }
+
+    cursor = lineEnd + 1;
+  }
+
+  return hasChanges ? out : null;
+}