killeros 3.0.7 → 3.0.8

package/killeros/passive-git-status.ts

@@ -1,408 +1,391 @@
-import { createHash } from "node:crypto";
-import { accessSync, constants, existsSync, realpathSync, statSync } from "node:fs";
-import { lstat, open, readlink } from "node:fs/promises";
-import path from "node:path";
-
-const WORKTREE_CONTENT_LIMIT = 128 * 1024 * 1024;
-const PASSIVE_METADATA_ARGS = ["-c", "core.fsmonitor=false"] as const;
-
-export type PassiveGitRunner = (args: readonly string[]) => Promise<Buffer>;
-
-/** Revs-only returns empty output for an unborn HEAD; command failures still reject. */
-export async function resolvePassiveHead(runGit: PassiveGitRunner): Promise<string> {
-  const head = decode(await runGit(["rev-parse", "--revs-only", "--end-of-options", "HEAD"])).trim();
-  if (head && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new Error("invalid HEAD");
-  return head || "(initial)";
-}
-
-export type PassiveWorktreeFile = {
-  path: string;
-  headMode?: string;
-  headObjectId?: string;
-  indexMode?: string;
-  indexObjectId?: string;
-  mode?: string;
-  content?: Buffer;
-  contentObjectId?: string;
-};
-
-export type PassiveWorktreeSnapshot = {
-  head: string;
-  files: Map<string, PassiveWorktreeFile>;
-  fileMode: boolean;
-  symlinks: boolean;
-};
-
-export async function passiveWorktreeSettings(runGit: PassiveGitRunner): Promise<Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">> {
-  const [fileMode, symlinks] = await Promise.all([
-    runGit(["config", "--type=bool", "--default", "true", "--get", "core.filemode"]),
-    runGit(["config", "--type=bool", "--default", "true", "--get", "core.symlinks"]),
-  ]);
-  return { fileMode: decode(fileMode).trim() === "true", symlinks: decode(symlinks).trim() === "true" };
-}
-
-export function passiveWorktreeMode(
-  actual: string,
-  indexed: string | undefined,
-  settings: Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">,
-): string {
-  if (actual === "100644" || actual === "100755") {
-    if (indexed === "120000" && !settings.symlinks) return indexed;
-    if ((indexed === "100644" || indexed === "100755") && !settings.fileMode) return indexed;
-  }
-  return actual;
-}
-
-type IndexEntry = {
-  mode: string;
-  objectId: string;
-  eolAttributes: string;
-  ctimeNanoseconds: bigint;
-  mtimeNanoseconds: bigint;
-  size: bigint;
-  skipWorktree: boolean;
-};
-
-type TreeEntry = { mode: string; objectId: string };
-
-function searchPathEntries(env: NodeJS.ProcessEnv): string[] {
-  const values: string[] = [];
-  for (const [key, value] of Object.entries(env)) {
-    if (key.toLowerCase() === "path" && typeof value === "string") values.push(value);
-  }
-  const entries: string[] = [];
-  for (const value of values) entries.push(...value.split(path.delimiter));
-  return entries;
-}
-
-function pathExtensionEntries(env: NodeJS.ProcessEnv): string[] {
-  let raw: string | undefined;
-  for (const [key, value] of Object.entries(env)) {
-    if (key.toLowerCase() === "pathext" && typeof value === "string") {
-      raw = value;
-      break;
-    }
-  }
-  raw ??= ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL";
-  return raw.split(";").map((entry) => entry.trim()).filter(Boolean).map((entry) => entry.startsWith(".") ? entry : `.${entry}`);
-}
-
-function unquoted(entry: string): string {
-  if (entry.length >= 2) {
-    const first = entry[0];
-    const last = entry[entry.length - 1];
-    if ((first === '"' && last === '"') || (first === "'" && last === "'")) return entry.slice(1, -1);
-  }
-  return entry;
-}
-
-function inspectedRoot(cwd: string): string | undefined {
-  if (!cwd || typeof cwd !== "string") return undefined;
-  let start: string;
-  try {
-    start = path.resolve(cwd);
-  } catch {
-    return undefined;
-  }
-  let base: string;
-  try {
-    base = realpathSync.native(start);
-  } catch {
-    base = start;
-  }
-  let current = base;
-  for (;;) {
-    try {
-      if (existsSync(path.join(current, ".git"))) {
-        try {
-          return realpathSync.native(current);
-        } catch {
-          return current;
-        }
-      }
-    } catch {
-      // Unreadable directory: keep walking toward the filesystem root.
-    }
-    const parent = path.dirname(current);
-    if (parent === current) break;
-    current = parent;
-  }
-  return base;
-}
-
-function insideInspected(candidate: string, root: string): boolean {
-  if (process.platform === "win32") {
-    const normalizedCandidate = path.win32.normalize(candidate).toLowerCase();
-    const normalizedRoot = path.win32.normalize(root).toLowerCase();
-    const trimmed = normalizedRoot.length > 3 && normalizedRoot.endsWith(path.win32.sep)
-      ? normalizedRoot.slice(0, -1)
-      : normalizedRoot;
-    if (normalizedCandidate === trimmed) return true;
-    return normalizedCandidate.startsWith(`${trimmed}${path.win32.sep}`);
-  }
-  const normalizedCandidate = path.normalize(candidate);
-  const normalizedRoot = path.normalize(root);
-  const trimmed = normalizedRoot.length > 1 && normalizedRoot.endsWith(path.sep)
-    ? normalizedRoot.slice(0, -1)
-    : normalizedRoot;
-  if (normalizedCandidate === trimmed) return true;
-  return normalizedCandidate.startsWith(`${trimmed}${path.sep}`);
-}
-
-function traversesInspected(candidate: string, root: string): boolean {
-  let current = path.dirname(candidate);
-  for (;;) {
-    try {
-      if (insideInspected(realpathSync.native(current), root)) return true;
-    } catch {
-      return true;
-    }
-    const parent = path.dirname(current);
-    if (parent === current) return false;
-    current = parent;
-  }
-}
-
-/** Returns an absolute Git binary outside the inspected repository without starting a locator process. */
-export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
-  const root = inspectedRoot(cwd);
-  if (!root) return undefined;
-  const entries = searchPathEntries(env);
-  if (entries.length === 0) return undefined;
-  const windows = process.platform === "win32";
-  const baseNames = windows ? ["git", ...pathExtensionEntries(env).map((extension) => `git${extension}`)] : ["git"];
-  for (const raw of entries) {
-    if (raw === "" || raw.trim() === "") continue;
-    const directory = unquoted(raw);
-    if (directory === "" || directory.trim() === "" || !path.isAbsolute(directory)) continue;
-    for (const base of baseNames) {
-      const candidate = path.join(directory, base);
-      if (insideInspected(candidate, root)) continue;
-      try {
-        if (!statSync(candidate).isFile()) continue;
-      } catch {
-        continue;
-      }
-      if (!windows) {
-        try {
-          accessSync(candidate, constants.X_OK);
-        } catch {
-          continue;
-        }
-      }
-      let resolved: string;
-      try {
-        resolved = realpathSync.native(candidate);
-      } catch {
-        continue;
-      }
-      if (path.isAbsolute(resolved) && !insideInspected(resolved, root) && !traversesInspected(candidate, root)) return resolved;
-    }
-  }
-  return undefined;
-}
-
-/** Environment for automatic Git children, without inherited repository selection or PATH command resolution. */
-export function passiveGitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = { ...base };
-  const selectors = [
-    "GIT_DIR",
-    "GIT_CEILING_DIRECTORIES",
-    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
-    "GIT_WORK_TREE",
-    "GIT_INDEX_FILE",
-    "GIT_OBJECT_DIRECTORY",
-    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-    "GIT_COMMON_DIR",
-    "GIT_NAMESPACE",
-  ];
-  let hasPath = false;
-  for (const key of Object.keys(env)) {
-    const normalized = key.toUpperCase();
-    if (selectors.includes(normalized)
-      || normalized === "GIT_OPTIONAL_LOCKS"
-      || normalized === "GIT_NO_LAZY_FETCH") {
-      delete env[key];
-    } else if (normalized === "PATH") {
-      env[key] = "";
-      hasPath = true;
-    }
-  }
-  if (!hasPath) env.PATH = "";
-  env.GIT_OPTIONAL_LOCKS = "0";
-  env.GIT_NO_LAZY_FETCH = "1";
-  return env;
-}
-
-function decode(buffer: Buffer): string {
-  return new TextDecoder("utf-8", { fatal: true }).decode(buffer);
-}
-
-function parseIndex(output: Buffer): Map<string, IndexEntry> {
-  const text = decode(output);
-  const pattern = /([0-7]{6}) ([0-9a-f]{40}(?:[0-9a-f]{24})?) ([0-3])\t([^\t]*)\t([^\0]*)\0  ctime: (\d+):(\d+)\n  mtime: (\d+):(\d+)\n  dev: \d+\tino: \d+\n  uid: \d+\tgid: \d+\n  size: (\d+)\tflags: ([0-9a-f]+)\n/gu;
-  const entries = new Map<string, IndexEntry>();
-  let end = 0;
-  for (const match of text.matchAll(pattern)) {
-    if (match.index !== end) throw new Error("invalid index metadata");
-    end = match.index + match[0].length;
-    const [, mode, objectId, stage, eolAttributes, filePath, ctimeSeconds, ctimeNanoseconds, mtimeSeconds, mtimeNanoseconds, size, flags] = match;
-    if (!mode || !objectId || !stage || eolAttributes === undefined || filePath === undefined || !ctimeSeconds || !ctimeNanoseconds || !mtimeSeconds || !mtimeNanoseconds || !size || !flags || stage !== "0") {
-      throw new Error("unsupported index entry");
-    }
-    entries.set(filePath, {
-      mode,
-      objectId,
-      eolAttributes: eolAttributes.trim(),
-      ctimeNanoseconds: BigInt(ctimeSeconds) * 1_000_000_000n + BigInt(ctimeNanoseconds),
-      mtimeNanoseconds: BigInt(mtimeSeconds) * 1_000_000_000n + BigInt(mtimeNanoseconds),
-      size: BigInt(size),
-      skipWorktree: (Number.parseInt(flags, 16) & 0x40000000) !== 0,
-    });
-  }
-  if (end !== text.length) throw new Error("incomplete index metadata");
-  return entries;
-}
-
-function parseTree(output: Buffer): Map<string, TreeEntry> {
-  const entries = new Map<string, TreeEntry>();
-  for (const record of decode(output).split("\0")) {
-    if (!record) continue;
-    const match = /^([0-7]{6}) (?:blob|commit) ([0-9a-f]{40}(?:[0-9a-f]{24})?)\t([^\0]+)$/u.exec(record);
-    if (!match?.[1] || !match[2] || !match[3]) throw new Error("invalid tree entry");
-    entries.set(match[3], { mode: match[1], objectId: match[2] });
-  }
-  return entries;
-}
-
-function parsePaths(output: Buffer): string[] {
-  const records = decode(output).split("\0");
-  if (records.at(-1) !== "") throw new Error("incomplete path list");
-  return records.slice(0, -1);
-}
-
-async function readFileState(root: string, entry: IndexEntry | undefined, filePath: string, remaining: number): Promise<{ mode: string; content?: Buffer; statsMatch: boolean }> {
-  const absolutePath = path.join(root, ...filePath.split("/"));
-  const stats = await lstat(absolutePath, { bigint: true });
-  const mode = stats.isSymbolicLink() ? "120000" : stats.isFile() ? stats.mode & 0o111n ? "100755" : "100644" : "";
-  if (!mode) throw new Error("unsupported worktree entry");
-  const statsMatch = entry !== undefined
-    && entry.mode === mode
-    && entry.size === stats.size
-    && entry.ctimeNanoseconds === stats.ctimeNs
-    && entry.mtimeNanoseconds === stats.mtimeNs;
-  if (statsMatch) return { mode, statsMatch };
-  if (!stats.isSymbolicLink() && stats.size > BigInt(remaining)) throw new Error("worktree content limit exceeded");
-  const content = stats.isSymbolicLink() ? Buffer.from(await readlink(absolutePath)) : await readBounded(absolutePath, remaining);
-  return { mode, content, statsMatch };
-}
-
-async function readBounded(filePath: string, limit: number): Promise<Buffer> {
-  const handle = await open(filePath, "r");
-  try {
-    const stats = await handle.stat();
-    if (!stats.isFile() || stats.size > limit) throw new Error("worktree content limit exceeded");
-    const content = Buffer.alloc(stats.size + 1);
-    let length = 0;
-    while (length < content.length) {
-      const { bytesRead } = await handle.read(content, length, content.length - length, length);
-      if (bytesRead === 0) break;
-      length += bytesRead;
-    }
-    if (length > stats.size) throw new Error("worktree changed while reading");
-    return content.subarray(0, length);
-  } finally {
-    await handle.close();
-  }
-}
-
-function blobObjectId(content: Buffer, length: number): string {
-  const algorithm = length === 64 ? "sha256" : "sha1";
-  return createHash(algorithm).update(`blob ${content.length}\0`).update(content).digest("hex");
-}
-
-function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boolean {
-  if (blobObjectId(content, entry.objectId.length) === entry.objectId) return true;
-  if (entry.mode === "120000" || !content.includes(Buffer.from("\r\n"))) return false;
-  const attributes = entry.eolAttributes;
-  // eol controls checkout bytes; text files still normalize CRLF when compared with the index.
-  if (attributes === "-text") return false;
-  const automatic = attributes.startsWith("text=auto") || !attributes;
-  if (!attributes && !["true", "input"].includes(autoCrlf)) return false;
-  if (automatic) {
-    // Match Git's convert_is_binary heuristic, including its terminal EOF exception.
-    let printable = 0;
-    let nonprintable = 0;
-    for (let index = 0; index < content.length; index += 1) {
-      const byte = content[index];
-      if (byte === 0 || byte === 13 && content[index + 1] !== 10) return false;
-      if (byte === 13 || byte === 10 || byte === 26 && index === content.length - 1) continue;
-      if (byte === 127 || byte < 32 && ![8, 9, 12, 27].includes(byte)) nonprintable += 1;
-      else printable += 1;
-    }
-    if (Math.floor(printable / 128) < nonprintable) return false;
-  }
-  const normalized = Buffer.from(content.toString("latin1").replaceAll("\r\n", "\n"), "latin1");
-  return blobObjectId(normalized, entry.objectId.length) === entry.objectId;
-}
-
-/**
- * Reads index and tree metadata with Git, then inspects worktree files with Node.
- * No Git command in this path asks Git to convert worktree content, so clean and process filters cannot start.
- */
-export async function inspectWorktreeWithoutFilters(root: string, runGit: PassiveGitRunner): Promise<PassiveWorktreeSnapshot> {
-  const [indexOutput, untrackedOutput, head, autoCrlfOutput, settings] = await Promise.all([
-    runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--cached", "--debug", "-z", "--full-name",
-      "--format=%(objectmode) %(objectname) %(stage)%x09%(eolattr)%x09%(path)"]),
-    runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--others", "--exclude-standard", "-z", "--full-name"]),
-    resolvePassiveHead(runGit),
-    runGit(["config", "--type=bool-or-str", "--default", "false", "--get", "core.autocrlf"]),
-    passiveWorktreeSettings(runGit),
-  ]);
-  const autoCrlf = decode(autoCrlfOutput).trim().toLowerCase();
-  const index = parseIndex(indexOutput);
-  const tree = head !== "(initial)" ? parseTree(await runGit(["ls-tree", "-r", "-z", "--full-tree", head])) : new Map<string, TreeEntry>();
-  const files = new Map<string, PassiveWorktreeFile>();
-  let contentBytes = 0;
-
-  for (const filePath of new Set([...tree.keys(), ...index.keys()])) {
-    const headEntry = tree.get(filePath);
-    const indexEntry = index.get(filePath);
-    if (headEntry?.mode === "160000" || indexEntry?.mode === "160000") continue;
-    const staged = headEntry?.mode !== indexEntry?.mode || headEntry?.objectId !== indexEntry?.objectId;
-    let mode: string | undefined;
-    let content: Buffer | undefined;
-    let worktreeChanged = false;
-    if (indexEntry && !indexEntry.skipWorktree) {
-      try {
-        const state = await readFileState(root, indexEntry, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
-        mode = passiveWorktreeMode(state.mode, indexEntry.mode, settings);
-        content = state.content;
-        if (content) contentBytes += content.length;
-        worktreeChanged = !state.statsMatch && (mode !== indexEntry.mode || !content || !matchesIndex(content, indexEntry, autoCrlf));
-      } catch (error) {
-        if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") worktreeChanged = true;
-        else throw error;
-      }
-    }
-    if (!staged && !worktreeChanged) continue;
-    files.set(filePath, {
-      path: filePath,
-      headMode: headEntry?.mode,
-      headObjectId: headEntry?.objectId,
-      indexMode: indexEntry?.mode,
-      indexObjectId: indexEntry?.objectId,
-      mode: worktreeChanged ? mode : indexEntry?.mode,
-      ...(worktreeChanged && content ? { content } : indexEntry ? { contentObjectId: indexEntry.objectId } : {}),
-    });
-  }
-
-  for (const filePath of parsePaths(untrackedOutput)) {
-    const state = await readFileState(root, undefined, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
-    if (!state.content) throw new Error("missing untracked content");
-    contentBytes += state.content.length;
-    const previous = files.get(filePath);
-    files.set(filePath, { ...previous, path: filePath, mode: state.mode, content: state.content, contentObjectId: undefined });
-  }
-  return { head, files, ...settings };
-}
+import { createHash } from "node:crypto";
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { lstat, open, readlink } from "node:fs/promises";
+import path from "node:path";
+
+const WORKTREE_CONTENT_LIMIT = 128 * 1024 * 1024;
+const PASSIVE_METADATA_ARGS = ["-c", "core.fsmonitor=false"] as const;
+
+export type PassiveGitRunner = (args: readonly string[]) => Promise<Buffer>;
+
+/** Revs-only returns empty output for an unborn HEAD; command failures still reject. */
+export async function resolvePassiveHead(runGit: PassiveGitRunner): Promise<string> {
+  const head = decode(await runGit(["rev-parse", "--revs-only", "--end-of-options", "HEAD"])).trim();
+  if (head && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new Error("invalid HEAD");
+  return head || "(initial)";
+}
+
+export type PassiveWorktreeFile = {
+  path: string;
+  headMode?: string;
+  headObjectId?: string;
+  indexMode?: string;
+  indexObjectId?: string;
+  mode?: string;
+  content?: Buffer;
+  contentObjectId?: string;
+};
+
+export type PassiveWorktreeSnapshot = {
+  head: string;
+  files: Map<string, PassiveWorktreeFile>;
+  fileMode: boolean;
+  symlinks: boolean;
+};
+
+export async function passiveWorktreeSettings(runGit: PassiveGitRunner): Promise<Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">> {
+  const [fileMode, symlinks] = await Promise.all([
+    runGit(["config", "--type=bool", "--default", "true", "--get", "core.filemode"]),
+    runGit(["config", "--type=bool", "--default", "true", "--get", "core.symlinks"]),
+  ]);
+  return { fileMode: decode(fileMode).trim() === "true", symlinks: decode(symlinks).trim() === "true" };
+}
+
+export function passiveWorktreeMode(
+  actual: string,
+  indexed: string | undefined,
+  settings: Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">,
+): string {
+  if (actual === "100644" || actual === "100755") {
+    if (indexed === "120000" && !settings.symlinks) return indexed;
+    if ((indexed === "100644" || indexed === "100755") && !settings.fileMode) return indexed;
+  }
+  return actual;
+}
+
+type IndexEntry = {
+  mode: string;
+  objectId: string;
+  eolAttributes: string;
+  ctimeNanoseconds: bigint;
+  mtimeNanoseconds: bigint;
+  size: bigint;
+  skipWorktree: boolean;
+};
+
+type TreeEntry = { mode: string; objectId: string };
+
+function searchPathEntries(env: NodeJS.ProcessEnv): string[] {
+  const values: string[] = [];
+  for (const [key, value] of Object.entries(env)) {
+    if (key.toLowerCase() === "path" && typeof value === "string") values.push(value);
+  }
+  const entries: string[] = [];
+  for (const value of values) entries.push(...value.split(path.delimiter));
+  return entries;
+}
+
+function pathExtensionEntries(env: NodeJS.ProcessEnv): string[] {
+  let raw: string | undefined;
+  for (const [key, value] of Object.entries(env)) {
+    if (key.toLowerCase() === "pathext" && typeof value === "string") {
+      raw = value;
+      break;
+    }
+  }
+  raw ??= ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL";
+  return raw.split(";").map((entry) => entry.trim()).filter(Boolean).map((entry) => entry.startsWith(".") ? entry : `.${entry}`);
+}
+
+function unquoted(entry: string): string {
+  if (entry.length >= 2) {
+    const first = entry[0];
+    const last = entry[entry.length - 1];
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) return entry.slice(1, -1);
+  }
+  return entry;
+}
+
+function inspectedRoot(cwd: string): string | undefined {
+  if (!cwd || typeof cwd !== "string") return undefined;
+  let start: string;
+  try {
+    start = path.resolve(cwd);
+  } catch {
+    return undefined;
+  }
+  let base: string;
+  try {
+    base = realpathSync.native(start);
+  } catch {
+    base = start;
+  }
+  let current = base;
+  for (;;) {
+    try {
+      if (existsSync(path.join(current, ".git"))) {
+        try {
+          return realpathSync.native(current);
+        } catch {
+          return current;
+        }
+      }
+    } catch {
+      // Unreadable directory: keep walking toward the filesystem root.
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return base;
+}
+
+function insideInspected(candidate: string, root: string): boolean {
+  const normalizedCandidate = path.normalize(candidate).toLowerCase();
+  const normalizedRoot = path.normalize(root).toLowerCase();
+  const trimmed = normalizedRoot.length > 3 && normalizedRoot.endsWith(path.sep)
+    ? normalizedRoot.slice(0, -1)
+    : normalizedRoot;
+  if (normalizedCandidate === trimmed) return true;
+  return normalizedCandidate.startsWith(`${trimmed}${path.sep}`);
+}
+
+function traversesInspected(candidate: string, root: string): boolean {
+  let current = path.dirname(candidate);
+  for (;;) {
+    try {
+      if (insideInspected(realpathSync.native(current), root)) return true;
+    } catch {
+      return true;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
+
+/** Returns an absolute Git binary outside the inspected repository without starting a locator process. */
+export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const root = inspectedRoot(cwd);
+  if (!root) return undefined;
+  const entries = searchPathEntries(env);
+  if (entries.length === 0) return undefined;
+  const baseNames = ["git", ...pathExtensionEntries(env).map((extension) => `git${extension}`)];
+  for (const raw of entries) {
+    if (raw === "" || raw.trim() === "") continue;
+    const directory = unquoted(raw);
+    if (directory === "" || directory.trim() === "" || !path.isAbsolute(directory)) continue;
+    for (const base of baseNames) {
+      const candidate = path.join(directory, base);
+      if (insideInspected(candidate, root)) continue;
+      try {
+        if (!statSync(candidate).isFile()) continue;
+      } catch {
+        continue;
+      }
+      let resolved: string;
+      try {
+        resolved = realpathSync.native(candidate);
+      } catch {
+        continue;
+      }
+      if (path.isAbsolute(resolved) && !insideInspected(resolved, root) && !traversesInspected(candidate, root)) return resolved;
+    }
+  }
+  return undefined;
+}
+
+/** Environment for automatic Git children, without inherited repository selection or PATH command resolution. */
+export function passiveGitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...base };
+  const selectors = [
+    "GIT_DIR",
+    "GIT_CEILING_DIRECTORIES",
+    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR",
+    "GIT_NAMESPACE",
+  ];
+  let hasPath = false;
+  for (const key of Object.keys(env)) {
+    const normalized = key.toUpperCase();
+    if (selectors.includes(normalized)
+      || normalized === "GIT_OPTIONAL_LOCKS"
+      || normalized === "GIT_NO_LAZY_FETCH") {
+      delete env[key];
+    } else if (normalized === "PATH") {
+      env[key] = "";
+      hasPath = true;
+    }
+  }
+  if (!hasPath) env.PATH = "";
+  env.GIT_OPTIONAL_LOCKS = "0";
+  env.GIT_NO_LAZY_FETCH = "1";
+  return env;
+}
+
+function decode(buffer: Buffer): string {
+  return new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+}
+
+function parseIndex(output: Buffer): Map<string, IndexEntry> {
+  const text = decode(output);
+  const pattern = /([0-7]{6}) ([0-9a-f]{40}(?:[0-9a-f]{24})?) ([0-3])\t([^\t]*)\t([^\0]*)\0  ctime: (\d+):(\d+)\n  mtime: (\d+):(\d+)\n  dev: \d+\tino: \d+\n  uid: \d+\tgid: \d+\n  size: (\d+)\tflags: ([0-9a-f]+)\n/gu;
+  const entries = new Map<string, IndexEntry>();
+  let end = 0;
+  for (const match of text.matchAll(pattern)) {
+    if (match.index !== end) throw new Error("invalid index metadata");
+    end = match.index + match[0].length;
+    const [, mode, objectId, stage, eolAttributes, filePath, ctimeSeconds, ctimeNanoseconds, mtimeSeconds, mtimeNanoseconds, size, flags] = match;
+    if (!mode || !objectId || !stage || eolAttributes === undefined || filePath === undefined || !ctimeSeconds || !ctimeNanoseconds || !mtimeSeconds || !mtimeNanoseconds || !size || !flags || stage !== "0") {
+      throw new Error("unsupported index entry");
+    }
+    entries.set(filePath, {
+      mode,
+      objectId,
+      eolAttributes: eolAttributes.trim(),
+      ctimeNanoseconds: BigInt(ctimeSeconds) * 1_000_000_000n + BigInt(ctimeNanoseconds),
+      mtimeNanoseconds: BigInt(mtimeSeconds) * 1_000_000_000n + BigInt(mtimeNanoseconds),
+      size: BigInt(size),
+      skipWorktree: (Number.parseInt(flags, 16) & 0x40000000) !== 0,
+    });
+  }
+  if (end !== text.length) throw new Error("incomplete index metadata");
+  return entries;
+}
+
+function parseTree(output: Buffer): Map<string, TreeEntry> {
+  const entries = new Map<string, TreeEntry>();
+  for (const record of decode(output).split("\0")) {
+    if (!record) continue;
+    const match = /^([0-7]{6}) (?:blob|commit) ([0-9a-f]{40}(?:[0-9a-f]{24})?)\t([^\0]+)$/u.exec(record);
+    if (!match?.[1] || !match[2] || !match[3]) throw new Error("invalid tree entry");
+    entries.set(match[3], { mode: match[1], objectId: match[2] });
+  }
+  return entries;
+}
+
+function parsePaths(output: Buffer): string[] {
+  const records = decode(output).split("\0");
+  if (records.at(-1) !== "") throw new Error("incomplete path list");
+  return records.slice(0, -1);
+}
+
+async function readFileState(root: string, entry: IndexEntry | undefined, filePath: string, remaining: number): Promise<{ mode: string; content?: Buffer; statsMatch: boolean }> {
+  const absolutePath = path.join(root, ...filePath.split("/"));
+  const stats = await lstat(absolutePath, { bigint: true });
+  const mode = stats.isSymbolicLink() ? "120000" : stats.isFile() ? stats.mode & 0o111n ? "100755" : "100644" : "";
+  if (!mode) throw new Error("unsupported worktree entry");
+  const statsMatch = entry !== undefined
+    && entry.mode === mode
+    && entry.size === stats.size
+    && entry.ctimeNanoseconds === stats.ctimeNs
+    && entry.mtimeNanoseconds === stats.mtimeNs;
+  if (statsMatch) return { mode, statsMatch };
+  if (!stats.isSymbolicLink() && stats.size > BigInt(remaining)) throw new Error("worktree content limit exceeded");
+  const content = stats.isSymbolicLink() ? Buffer.from(await readlink(absolutePath)) : await readBounded(absolutePath, remaining);
+  return { mode, content, statsMatch };
+}
+
+async function readBounded(filePath: string, limit: number): Promise<Buffer> {
+  const handle = await open(filePath, "r");
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || stats.size > limit) throw new Error("worktree content limit exceeded");
+    const content = Buffer.alloc(stats.size + 1);
+    let length = 0;
+    while (length < content.length) {
+      const { bytesRead } = await handle.read(content, length, content.length - length, length);
+      if (bytesRead === 0) break;
+      length += bytesRead;
+    }
+    if (length > stats.size) throw new Error("worktree changed while reading");
+    return content.subarray(0, length);
+  } finally {
+    await handle.close();
+  }
+}
+
+function blobObjectId(content: Buffer, length: number): string {
+  const algorithm = length === 64 ? "sha256" : "sha1";
+  return createHash(algorithm).update(`blob ${content.length}\0`).update(content).digest("hex");
+}
+
+function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boolean {
+  if (blobObjectId(content, entry.objectId.length) === entry.objectId) return true;
+  if (entry.mode === "120000" || !content.includes(Buffer.from("\r\n"))) return false;
+  const attributes = entry.eolAttributes;
+  // eol controls checkout bytes; text files still normalize CRLF when compared with the index.
+  if (attributes === "-text") return false;
+  const automatic = attributes.startsWith("text=auto") || !attributes;
+  if (!attributes && !["true", "input"].includes(autoCrlf)) return false;
+  if (automatic) {
+    // Match Git's convert_is_binary heuristic, including its terminal EOF exception.
+    let printable = 0;
+    let nonprintable = 0;
+    for (let index = 0; index < content.length; index += 1) {
+      const byte = content[index];
+      if (byte === 0 || byte === 13 && content[index + 1] !== 10) return false;
+      if (byte === 13 || byte === 10 || byte === 26 && index === content.length - 1) continue;
+      if (byte === 127 || byte < 32 && ![8, 9, 12, 27].includes(byte)) nonprintable += 1;
+      else printable += 1;
+    }
+    if (Math.floor(printable / 128) < nonprintable) return false;
+  }
+  const normalized = Buffer.from(content.toString("latin1").replaceAll("\r\n", "\n"), "latin1");
+  return blobObjectId(normalized, entry.objectId.length) === entry.objectId;
+}
+
+/**
+ * Reads index and tree metadata with Git, then inspects worktree files with Node.
+ * No Git command in this path asks Git to convert worktree content, so clean and process filters cannot start.
+ */
+export async function inspectWorktreeWithoutFilters(root: string, runGit: PassiveGitRunner): Promise<PassiveWorktreeSnapshot> {
+  const [indexOutput, untrackedOutput, head, autoCrlfOutput, settings] = await Promise.all([
+    runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--cached", "--debug", "-z", "--full-name",
+      "--format=%(objectmode) %(objectname) %(stage)%x09%(eolattr)%x09%(path)"]),
+    runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--others", "--exclude-standard", "-z", "--full-name"]),
+    resolvePassiveHead(runGit),
+    runGit(["config", "--type=bool-or-str", "--default", "false", "--get", "core.autocrlf"]),
+    passiveWorktreeSettings(runGit),
+  ]);
+  const autoCrlf = decode(autoCrlfOutput).trim().toLowerCase();
+  const index = parseIndex(indexOutput);
+  const tree = head !== "(initial)" ? parseTree(await runGit(["ls-tree", "-r", "-z", "--full-tree", head])) : new Map<string, TreeEntry>();
+  const files = new Map<string, PassiveWorktreeFile>();
+  let contentBytes = 0;
+
+  for (const filePath of new Set([...tree.keys(), ...index.keys()])) {
+    const headEntry = tree.get(filePath);
+    const indexEntry = index.get(filePath);
+    if (headEntry?.mode === "160000" || indexEntry?.mode === "160000") continue;
+    const staged = headEntry?.mode !== indexEntry?.mode || headEntry?.objectId !== indexEntry?.objectId;
+    let mode: string | undefined;
+    let content: Buffer | undefined;
+    let worktreeChanged = false;
+    if (indexEntry && !indexEntry.skipWorktree) {
+      try {
+        const state = await readFileState(root, indexEntry, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
+        mode = passiveWorktreeMode(state.mode, indexEntry.mode, settings);
+        content = state.content;
+        if (content) contentBytes += content.length;
+        worktreeChanged = !state.statsMatch && (mode !== indexEntry.mode || !content || !matchesIndex(content, indexEntry, autoCrlf));
+      } catch (error) {
+        if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") worktreeChanged = true;
+        else throw error;
+      }
+    }
+    if (!staged && !worktreeChanged) continue;
+    files.set(filePath, {
+      path: filePath,
+      headMode: headEntry?.mode,
+      headObjectId: headEntry?.objectId,
+      indexMode: indexEntry?.mode,
+      indexObjectId: indexEntry?.objectId,
+      mode: worktreeChanged ? mode : indexEntry?.mode,
+      ...(worktreeChanged && content ? { content } : indexEntry ? { contentObjectId: indexEntry.objectId } : {}),
+    });
+  }
+
+  for (const filePath of parsePaths(untrackedOutput)) {
+    const state = await readFileState(root, undefined, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
+    if (!state.content) throw new Error("missing untracked content");
+    contentBytes += state.content.length;
+    const previous = files.get(filePath);
+    files.set(filePath, { ...previous, path: filePath, mode: state.mode, content: state.content, contentObjectId: undefined });
+  }
+  return { head, files, ...settings };
+}