limn-review 0.1.123

package/dist/conflict/suggestion.js

@@ -0,0 +1,398 @@
+import { hasConflictMarkers } from '../coding/merge.js';
+/**
+ * THE TWO TEXT INGRESSES' VALIDATORS. The Pro per-hunk suggestion's, and the CORE manual
+ * edit's — in one file because they are the same job (nothing untrusted becomes a blob until
+ * something here has vouched for it) and because they must not drift into two vocabularies for
+ * one fact. They are DIFFERENT functions, though, and the bottom of this file says why.
+ *
+ * THE PRO PER-HUNK SUGGESTION'S VALIDATORS — and they live in CORE, deliberately.
+ *
+ * ⚠ WHY THEY ARE NOT IN THE PLUGIN. `packages/pro/test/` does not run in CI and is not
+ * typechecked (`pnpm test` is recursive vitest and the plugin's tsconfig includes only `src`).
+ * These functions are the only thing standing between attacker-authored conflict text and a
+ * blob in somebody's repository, and they have to agree byte-for-byte with the model the host
+ * built. In core they run on every `pnpm test`, against the same `ConflictModelRegion` the land
+ * path folds.
+ *
+ * ⚠ EVERY CHECK REFUSES. There is no "accept with a warning" path and there must not be one: a
+ * suggestion that fails any check never reaches the centre pane, so the reader never sees text
+ * we could not vouch for sitting where their code will be. `cannot_reconcile` — the model saying
+ * the two sides genuinely contest — is a DESIGNED outcome on the same footing, not a failure.
+ *
+ * ⚠ THE RAW MODEL TEXT NEVER LEAVES THIS FILE'S CALLER. On a refusal the route sends the code
+ * and OUR sentence; echoing the answer back would hand an injection payload a rendering surface
+ * in the one screen whose whole job is to show text the reader is about to commit.
+ */
+/* ═════════════════════════════════ the fences ═════════════════════════════════ */
+/**
+ * The six fenced regions of the prompt. Five are input the model READS; `RESOLVED` is the one it
+ * WRITES, and the only one this file extracts.
+ *
+ * ⚠ ONE PRODUCER, IN CORE, REACHED BY THE PLUGIN THROUGH THE SEAM (`ConflictSeam.fences`). The
+ * prompt's fences and the validator's extraction are the same strings by construction — a second
+ * spelling in the plugin would make every answer refuse `unparseable` against a host whose
+ * markers had moved, which is loud but pointless. Nothing here is a secret: the NONCE is what
+ * makes a fence unforgeable, not the word.
+ */
+export const CONFLICT_FENCE_REGIONS = [
+    'BASE',
+    'OURS',
+    'THEIRS',
+    'CONTEXT BEFORE',
+    'CONTEXT AFTER',
+    'RESOLVED',
+];
+/**
+ * The marker pair for every fenced region, at one per-request nonce.
+ *
+ * ⚠ THE NONCE IS THE WHOLE MECHANISM. A conflict hunk is attacker-authored on any pull request,
+ * so a line inside one reading `---END OURS---` would close a fixed fence and let the rest of
+ * that side be read as instructions. With a fresh 16-hex nonce in every marker, such a line is
+ * data: it closes nothing, and the caller re-rolls the nonce on the ~2⁻⁶⁴ chance the untrusted
+ * text contains it (see `nonceCollides`).
+ */
+export function conflictFences(nonce) {
+    const out = {};
+    for (const region of CONFLICT_FENCE_REGIONS) {
+        out[region] = {
+            begin: `---BEGIN ${region} ${nonce}---`,
+            end: `---END ${region} ${nonce}---`,
+        };
+    }
+    return out;
+}
+/** True when the nonce appears anywhere in the untrusted material, so the caller must re-roll it
+ *  before building a prompt. Checked against everything that gets fenced, not just the sides. */
+export function nonceCollides(hunk, nonce) {
+    const needle = nonce.toLowerCase();
+    for (const side of [
+        hunk.base,
+        hunk.ours,
+        hunk.theirs,
+        hunk.contextBefore,
+        hunk.contextAfter,
+        [hunk.path, hunk.headRef, hunk.baseRef],
+    ]) {
+        for (const line of side)
+            if (line.toLowerCase().includes(needle))
+                return true;
+    }
+    return false;
+}
+/** Context lines either side of the hunk, and the per-line clip. Both are prompt budget, and
+ *  clipping CONTEXT is safe in a way clipping the region is not: context is never spliced back. */
+export const HUNK_CONTEXT_LINES = 8;
+export const HUNK_CONTEXT_LINE_CHARS = 200;
+/** The characters `config.conflictSuggestMaxChars` is measured against: the three SIDES only.
+ *  Context is bounded by construction, so it cannot be the thing that pushes a small hunk over. */
+export function hunkRegionChars(base, ours, theirs) {
+    let n = 0;
+    for (const side of [base, ours, theirs])
+        for (const line of side)
+            n += line.length + 1;
+    return n;
+}
+/* ═════════════════════════════════ validation ═════════════════════════════════ */
+/** A lone half of a surrogate pair — legal in a JS string, not encodable as UTF-8. */
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const ALPHANUMERIC = /[\p{L}\p{N}]/u;
+/** Check 7's filter: a line substantial enough that losing it is a real loss. Punctuation-only
+ *  lines are excluded HERE and deliberately included in check 8 — a dropped `}` is exactly the
+ *  failure worth refusing on when the line was one side's own contribution. */
+function significant(line) {
+    const t = line.trim();
+    return t.length >= 3 && ALPHANUMERIC.test(t);
+}
+function countBy(lines, keep) {
+    const m = new Map();
+    for (const line of lines) {
+        if (!keep(line))
+            continue;
+        const k = line.trim();
+        m.set(k, (m.get(k) ?? 0) + 1);
+    }
+    return m;
+}
+/** Trailing BLANK lines only — never leading ones, and never whitespace inside a line. A model
+ *  that indents its answer is right to; a model that pads it with newlines is just verbose. */
+function trimTrailingBlank(lines) {
+    let end = lines.length;
+    while (end > 0 && (lines[end - 1] ?? '').trim() === '')
+        end -= 1;
+    return lines.slice(0, end);
+}
+/** The last `n` non-blank lines of `lines`, trimmed. */
+function tailSignificant(lines, n) {
+    const out = [];
+    for (let i = lines.length - 1; i >= 0 && out.length < n; i -= 1) {
+        const t = (lines[i] ?? '').trim();
+        if (t !== '')
+            out.unshift(t);
+    }
+    return out;
+}
+/** The first `n` non-blank lines of `lines`, trimmed. */
+function headSignificant(lines, n) {
+    const out = [];
+    for (let i = 0; i < lines.length && out.length < n; i += 1) {
+        const t = (lines[i] ?? '').trim();
+        if (t !== '')
+            out.push(t);
+    }
+    return out;
+}
+const sameLines = (a, b) => a.length > 0 && a.length === b.length && a.every((l, i) => l === b[i]);
+/**
+ * THE VALIDATOR. Pure — no I/O, no git, no clock. First failure wins, and every failure refuses.
+ *
+ * The order is load-bearing and pinned by a test: an answer that both kept a conflict marker and
+ * ran long reports `markers`, because the marker is the fact worth telling the reader about.
+ *
+ *  1. Shape                — one `RESOLVED` fence, each marker alone on its line, in order.
+ *  2. Designed refusal     — `CANNOT RECONCILE` alone in the block.
+ *  3. Text-ness            — no NUL, no lone surrogate, no BOM.
+ *  4. Leakage              — no nonce, no `---BEGIN `/`---END ` at a line start.
+ *  5. Markers              — no surviving conflict marker.
+ *  6. Context not repeated — it must not re-emit the lines it sits between.
+ *  7. Common lines kept    — what BOTH sides already had must survive.
+ *  8. Side lines kept      — what EITHER side added must survive.
+ *  9. Length               — bounded in lines AND bytes.
+ * 10. Not empty            — when either side had content.
+ */
+export function validateConflictSuggestion(hunk, nonce, rawModelText) {
+    // Normalise once: CRLF → LF so a Windows-flavoured answer behaves as its LF twin, and one
+    // leading BOM stripped (a transport artefact). Any OTHER BOM is a check-3 refusal.
+    const text = rawModelText.replace(/^\uFEFF/, '').replace(/\r\n/g, '\n');
+    const fence = conflictFences(nonce).RESOLVED;
+    const all = text.split('\n');
+    // ---- 1. Shape --------------------------------------------------------------------------
+    const begins = [];
+    const ends = [];
+    all.forEach((line, i) => {
+        const t = line.trim();
+        if (t === fence.begin)
+            begins.push(i);
+        if (t === fence.end)
+            ends.push(i);
+    });
+    const begin = begins[0];
+    const end = ends[0];
+    if (begins.length !== 1 || ends.length !== 1 || begin === undefined || end === undefined) {
+        return { ok: false, refusal: 'unparseable' };
+    }
+    if (end <= begin)
+        return { ok: false, refusal: 'unparseable' };
+    const region = trimTrailingBlank(all.slice(begin + 1, end));
+    const body = region.join('\n');
+    // ---- 2. The designed refusal -----------------------------------------------------------
+    // Its own outcome, ABOVE every content check: a model that correctly says the two sides
+    // genuinely contest must not then be told its answer was unparseable or empty.
+    if (body.trim() === 'CANNOT RECONCILE')
+        return { ok: false, refusal: 'cannot_reconcile' };
+    // ---- 3. Text-ness ----------------------------------------------------------------------
+    if (body.includes('\0') || body.includes('\uFEFF') || LONE_SURROGATE.test(body)) {
+        return { ok: false, refusal: 'not_text' };
+    }
+    // ---- 4. Leakage ------------------------------------------------------------------------
+    // The nonce inside the block means the model echoed our scaffolding; a `---BEGIN `/`---END `
+    // line start means it invented a fence of its own. Both are the same fact — the answer is not
+    // the shape we asked for — so they share `unparseable` and share one sentence on screen.
+    if (body.toLowerCase().includes(nonce.toLowerCase())) {
+        return { ok: false, refusal: 'unparseable' };
+    }
+    if (region.some((l) => l.startsWith('---BEGIN ') || l.startsWith('---END '))) {
+        return { ok: false, refusal: 'unparseable' };
+    }
+    // ---- 5. Conflict markers ---------------------------------------------------------------
+    // ⚠ IMPORTED, NOT RE-SPELT. `coding/merge.ts`'s matcher deliberately EXCLUDES a bare
+    // `=======` — real files contain rows of equals signs — and relies on the unambiguous
+    // open/close markers. A local copy here would drift from the one the merge path trusts.
+    if (hasConflictMarkers(body))
+        return { ok: false, refusal: 'markers' };
+    // ---- 6. The context is not repeated ----------------------------------------------------
+    // ⚠ NARROW ON PURPOSE, AND NOT A WHOLE-FILE COMPARISON. The context bytes are byte-identical
+    // BY CONSTRUCTION — the model is never given the chance to write them, because only the
+    // region between the two fences is ever read back. This check exists solely to catch an
+    // answer that smuggles them back INSIDE the region, which would duplicate the surrounding
+    // lines when the fold splices it. Do not "harden" it into a diff of the whole file.
+    const edge = (n) => Math.max(1, Math.min(3, n));
+    if (hunk.contextBefore.length > 0 && region.length > 0) {
+        const n = edge(Math.min(hunk.contextBefore.length, region.length));
+        if (sameLines(headSignificant(region, n), tailSignificant(hunk.contextBefore, n))) {
+            return { ok: false, refusal: 'context_duplicated' };
+        }
+    }
+    if (hunk.contextAfter.length > 0 && region.length > 0) {
+        const n = edge(Math.min(hunk.contextAfter.length, region.length));
+        if (sameLines(tailSignificant(region, n), headSignificant(hunk.contextAfter, n))) {
+            return { ok: false, refusal: 'context_duplicated' };
+        }
+    }
+    // ---- 7. Lines BOTH versions kept ------------------------------------------------------
+    // The multiset intersection of the two sides' significant lines: text neither side touched
+    // and both therefore still want. Compared TRIMMED, so a whitespace-only reindent on an agreed
+    // line is not a loss.
+    const outCounts = countBy(region, () => true);
+    const oursSig = countBy(hunk.ours, significant);
+    const theirsSig = countBy(hunk.theirs, significant);
+    let keptCommonLines = 0;
+    for (const [line, n] of oursSig) {
+        const need = Math.min(n, theirsSig.get(line) ?? 0);
+        if (need === 0)
+            continue;
+        if ((outCounts.get(line) ?? 0) < need)
+            return { ok: false, refusal: 'dropped_common_lines' };
+        keptCommonLines += need;
+    }
+    // ---- 8. Lines EITHER side added -------------------------------------------------------
+    // ⚠ THE CHECK THAT MAKES 7 WORTH HAVING. Check 7 only protects text both versions already
+    // agreed on, so a model that emits THEIRS alone — deleting the pull request's entire
+    // contribution — sails through it. Here a line one side has and the ancestor does not must
+    // survive, unless the OTHER side deliberately deleted it (which is what "also in base" means
+    // once its own side's excess is accounted for).
+    //
+    // ⚠ NO ≥3-CHAR FILTER HERE, unlike check 7. A dropped `}` from one side's addition is exactly
+    // the failure worth refusing on.
+    const nonBlank = (l) => l.trim() !== '';
+    const baseAll = countBy(hunk.base, nonBlank);
+    const oursAll = countBy(hunk.ours, nonBlank);
+    const theirsAll = countBy(hunk.theirs, nonBlank);
+    const required = new Map();
+    for (const counts of [oursAll, theirsAll]) {
+        for (const [line, n] of counts) {
+            // What THIS side has beyond the ancestor. Two sides adding the same line require it
+            // ONCE, not twice — hence `max`, not a sum.
+            const excess = n - (baseAll.get(line) ?? 0);
+            if (excess <= 0)
+                continue;
+            required.set(line, Math.max(required.get(line) ?? 0, excess));
+        }
+    }
+    for (const [line, need] of required) {
+        if ((outCounts.get(line) ?? 0) < need)
+            return { ok: false, refusal: 'dropped_side_lines' };
+    }
+    // ---- 9. Length -------------------------------------------------------------------------
+    const maxSideLines = Math.max(hunk.base.length, hunk.ours.length, hunk.theirs.length);
+    const sideBytes = Buffer.byteLength(hunk.ours.join('\n'), 'utf8') +
+        Buffer.byteLength(hunk.theirs.join('\n'), 'utf8');
+    if (region.length > maxSideLines * 3 + 10)
+        return { ok: false, refusal: 'too_long' };
+    if (Buffer.byteLength(body, 'utf8') > sideBytes * 2 + 512) {
+        return { ok: false, refusal: 'too_long' };
+    }
+    // ---- 10. Not empty ---------------------------------------------------------------------
+    // Reached only when checks 7 and 8 found nothing to require, which is the case where both
+    // sides are pure deletions of ancestor text — and even then an answer of nothing is a claim
+    // the reader should make themselves, not one to accept silently from a model.
+    if (region.length === 0 && (hunk.ours.length > 0 || hunk.theirs.length > 0)) {
+        return { ok: false, refusal: 'empty' };
+    }
+    return { ok: true, lines: region, keptCommonLines };
+}
+export const NO_EDIT_SHAPE = { crlf: false, leadingBom: false };
+/**
+ * What an edit to this region has to inherit from it.
+ *
+ * ⚠ A TEXTAREA DESTROYS BOTH FACTS AND SAYS NOTHING. The browser's API value normalises every
+ * CRLF to a bare LF before React ever sees a keystroke (HTML's "normalize newlines"), so one
+ * character typed into a Windows-authored file used to rewrite the WHOLE hunk's line endings —
+ * a diff of every line, and a genuinely wrong file in any repo carrying `* text eol=crlf`. A BOM
+ * survives the round trip but is zero-width, so `validateConflictEdit`'s blanket U+FEFF refusal
+ * made the first region of every BOM file permanently uneditable, with a sentence
+ * ("Retype the odd one out") naming a character nobody can see.
+ *
+ * @param sides the region's own `base`, `ours` and `theirs` line texts, terminators attached.
+ * @param isFirstRegion is this the file's FIRST region? Only there can a BOM be legitimate.
+ */
+export function editShapeFor(sides, isFirstRegion) {
+    const lines = sides.flat();
+    return {
+        // ⚠ UNANIMOUS, NOT A MAJORITY. A CRLF file's final line carries no `\r` when the file has no
+        // trailing newline, so that region reads as mixed and is left alone — which is correct: there
+        // is nothing there to re-impose without inventing a byte.
+        crlf: lines.length > 0 && lines.every((l) => l.endsWith('\r')),
+        leadingBom: isFirstRegion && sides.some((side) => side[0]?.startsWith('') === true),
+    };
+}
+/**
+ * THE MANUAL EDIT'S VALIDATOR — three checks, and the list of what it deliberately does NOT
+ * check is the more important half.
+ *
+ *  1. Text-ness  — no NUL, no lone surrogate, no BOM.
+ *  2. Markers    — no surviving conflict marker.
+ *  3. Length     — bounded by `config.conflictSuggestMaxChars`, ONE budget for both ingresses.
+ *
+ * ⚠ 1 IS NOT A FORMALITY HERE. `land.ts` does `Buffer.from(foldToText(...), 'utf8')`, and its
+ * byte-for-byte round-trip claim rests on every side having decoded STRICTLY as UTF-8 at model
+ * build — which is why `not_text` is a file-level REFUSAL there rather than a lossy decode.
+ * Typed text does not inherit that provenance: a lone surrogate reaches `Buffer.from` and is
+ * silently substituted with U+FFFD, so the bytes committed would not be the bytes anybody saw.
+ *
+ * ⚠ THE U+FEFF HALF OF 1 IS NOT BLANKET, AND THE EXCEPTION IS THE FILE'S OWN BOM. `model.ts`
+ * decodes with `ignoreBOM: true` deliberately, so a BOM file's first line really does begin
+ * U+FEFF and the textarea really is seeded with it. Refusing that made the first region of every
+ * Visual-Studio-authored file permanently uneditable — and the only escape, retyping the hunk
+ * from scratch, silently stripped the BOM that the decoder exists to preserve. So when
+ * `shape.leadingBom` says this region owns the file's BOM, one LEADING U+FEFF is taken off before
+ * the scan and put back on the first stored line. Anywhere else it is still `not_text`, and
+ * `validateConflictSuggestion` — whose input is MODEL output, where a BOM is junk — is untouched.
+ *
+ * ⚠ AND THE LINE ENDING IS RE-IMPOSED, BECAUSE THE BROWSER ALREADY DESTROYED IT. See
+ * `editShapeFor`: a textarea hands back LF for every CRLF it was given, so without this one
+ * keystroke in a CRLF file rewrites the whole hunk's endings. Imposing costs nothing when the
+ * region is LF (`shape.crlf` false ⇒ this is a no-op) and is the only way the stored lines can
+ * agree with their own neighbours.
+ *
+ * ⚠ 2 IS NOT COVERED BY ANYTHING ELSE. The land path's full-resolution guard only proves each
+ * conflicted path was OVERWRITTEN (merge-tree's tree stores marker content at those paths); it
+ * never inspects the bytes. A typed `<<<<<<<` would commit with nothing refusing it.
+ *
+ * ⚠ AND CHECKS 6, 7 AND 8 OF THE SUGGESTION VALIDATOR ARE DELIBERATELY ABSENT — context not
+ * repeated, common lines kept, side lines kept. Those three exist because a MODEL silently drops
+ * lines it was not asked to drop, and the reader has no way to know it happened. A PERSON
+ * deleting a line is not a failure mode, it is the feature: the whole reason this route exists
+ * is the trailing comma, the duplicated import, the brace that belongs to neither side. Porting
+ * them over would refuse exactly the edits somebody opened the textarea to make.
+ *
+ * The order is text-ness → markers → length, matching the suggestion validator's: the marker is
+ * the fact worth telling somebody about, and "this is also too long" can wait. The scans cannot
+ * run away on a huge body because the route's ajv schema bounds `text` structurally first.
+ */
+export function validateConflictEdit(text, maxChars, shape = NO_EDIT_SHAPE) {
+    // The file's own BOM, off the front before the scan and back on after it. Only ever ONE, only
+    // ever leading, and only when this region is where the file's BOM lives.
+    const bom = shape.leadingBom && text.startsWith('\uFEFF');
+    const body = bom ? text.slice(1) : text;
+    if (body.includes('\0') || body.includes('\uFEFF') || LONE_SURROGATE.test(body)) {
+        return { ok: false, refusal: 'not_text' };
+    }
+    if (hasConflictMarkers(body))
+        return { ok: false, refusal: 'markers' };
+    if (body.length > maxChars)
+        return { ok: false, refusal: 'too_long' };
+    const lines = splitEditLines(body).map((l) => shape.crlf && !l.endsWith('\r') ? `${l}\r` : l);
+    // \u26A0 RE-ATTACHED TO THE FIRST LINE, NOT TO THE TEXT. The reader may have deleted it \u2014 it is
+    // zero-width, so they cannot have done so deliberately \u2014 and the file's decoder is documented
+    // to keep it. An edit that leaves the region EMPTY has no first line, and in that case the BOM
+    // goes with the lines the reader deleted, which is the one place they really did choose.
+    if (shape.leadingBom && lines[0] != null && !lines[0].startsWith('\uFEFF')) {
+        lines[0] = `\uFEFF${lines[0]}`;
+    }
+    return { ok: true, lines };
+}
+/**
+ * The reader's text as fold lines.
+ *
+ * ⚠ AN EMPTY TEXTAREA IS ZERO LINES, NOT ONE BLANK ONE. `''.split('\n')` is `['']`, which folds
+ * to a region containing one empty line — not what somebody who selected everything and pressed
+ * delete asked for. Deleting a whole hunk has to be reachable; it is half of why this exists.
+ *
+ * ⚠ A TRAILING NEWLINE IS A REAL TRAILING BLANK LINE, and stays one. The suggestion validator
+ * trims trailing blanks because a verbose model pads its answer; a person who left a blank line
+ * at the end of the box can see it there and meant it.
+ */
+function splitEditLines(text) {
+    return text === '' ? [] : text.split('\n');
+}
+//# sourceMappingURL=suggestion.js.map

package/dist/conflict/tokens.js

@@ -0,0 +1,72 @@
+/**
+ * Tokenisers + the interner the diff runs on.
+ *
+ * Everything the resolver diffs — lines at file grain, words inside one contested region — is
+ * turned into an array of small integers first. The diff then compares numbers, which is what
+ * makes the O(ND) inner loop cheap enough to run over a whole file and again over every
+ * conflicted region.
+ *
+ * ⚠ `tokenizeWords(text).join('') === text` is a HARD invariant, not a nicety. The wand's
+ * word-level merge reassembles a region by concatenating token runs, so a tokeniser that
+ * dropped or normalised a byte would silently commit different text than the user read.
+ * `tokens.test.ts` pins it over code, CRLF, tabs, unicode identifiers and emoji.
+ */
+/**
+ * Split into: runs of word characters, runs of whitespace, and one code point for anything
+ * else. Unicode-aware on both counts — `ünicode` is ONE token, and an astral code point (an
+ * emoji, a rare CJK ideograph) is one token rather than two lone surrogates.
+ */
+const WORD_TOKEN_RE = /[\p{L}\p{N}_]+|\s+|[\s\S]/gu;
+export function tokenizeWords(text) {
+    return text.match(WORD_TOKEN_RE) ?? [];
+}
+/** True when a token is entirely whitespace. The disjointness rule needs REAL evidence that
+ *  two authors worked on different things, and a single space between two edits is not it. */
+export function isWhitespaceToken(token) {
+    return token.length > 0 && token.trim().length === 0;
+}
+/**
+ * Map token strings to dense integer ids. One interner per diff pair, so ids are only ever
+ * compared within the arrays that produced them.
+ */
+export class TokenInterner {
+    ids = new Map();
+    id(token) {
+        const existing = this.ids.get(token);
+        if (existing !== undefined)
+            return existing;
+        const next = this.ids.size;
+        this.ids.set(token, next);
+        return next;
+    }
+    /** How many distinct tokens have been seen. */
+    get size() {
+        return this.ids.size;
+    }
+}
+/** Intern a whole array in one pass. */
+export function internAll(tokens, interner) {
+    const out = new Array(tokens.length);
+    for (let i = 0; i < tokens.length; i++) {
+        // noUncheckedIndexedAccess: the loop bound guarantees it, the compiler does not.
+        out[i] = interner.id(tokens[i]);
+    }
+    return out;
+}
+/**
+ * Split a UTF-8 string into lines WITHOUT their terminators, plus whether the text ended with
+ * one. `\r` stays attached to its line, so a CRLF file round-trips byte for byte.
+ *
+ * An empty file is zero lines and no terminator — NOT one empty line, which would commit a
+ * newline into a file that never had one.
+ */
+export function splitLines(text) {
+    if (text.length === 0)
+        return { lines: [], finalNewline: false };
+    const finalNewline = text.endsWith('\n');
+    const lines = text.split('\n');
+    if (finalNewline)
+        lines.pop();
+    return { lines, finalNewline };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/data-dir.js

@@ -0,0 +1,112 @@
+// THE LOCAL DATA DIRECTORY — ~/.limn, and the one-time move from ~/.pierre-review.
+//
+// Everything Limn keeps on a user's machine lives under ONE directory: the installed CLI's SQLite
+// database, the clone cache, `config.json` (the per-review budget) and the AI runtime the agentic
+// features download on first use (`ai-runtime/`, see ai/runtime.ts). Before the npm package was
+// renamed `pierre-review` → `limn-review` that directory was `~/.pierre-review`.
+//
+// ⚠ THE MOVE IS ONE `rename`, AND IT NEVER CLOBBERS. On the first local boot after the upgrade an
+// existing `~/.pierre-review` is renamed to `~/.limn` — DB, WAL files, clones, config, everything,
+// in one atomic step on the same filesystem (both live in the home directory). If `~/.limn`
+// already exists nothing is moved and nothing is deleted: the old directory is simply left where
+// it is. A copy-then-delete would be the dangerous version (a half-copied SQLite file next to a
+// deleted original), which is why there is none.
+//
+// ⚠ AN EXPLICIT LOCATION WINS AND IS NEVER MIGRATED INTO. `LIMN_DATA_DIR` names the directory; when
+// it is set this module moves nothing, because the user chose where their data lives. The finer
+// overrides keep working on top of either: `DATABASE_URL` / `--db` (the database file) and
+// `CLONE_DIR` (the clone cache).
+//
+// ⚠ A PINNED PATH INSIDE THE OLD DIRECTORY STOPS THE MOVE. The old README told people to pass
+// `--db ~/.pierre-review/pierre-review.sqlite`, so a shell profile may still say so. Moving the
+// directory out from under that value would make the next open CREATE an empty database at the old
+// path while the real one sat unseen in ~/.limn. So nothing moves (`pinned_path`), and everything
+// keeps using the old directory (below).
+//
+// ⚠ UNTIL THE MOVE HAS HAPPENED, THE OLD DIRECTORY IS THE DATA DIRECTORY. `resolveDataDir` answers
+// `~/.pierre-review` while it exists and `~/.limn` does not — after a pinned path, or a rename that
+// failed (Windows EBUSY on an open SQLite file, EXDEV, EACCES). Answering `~/.limn` there would
+// create it, fresh and empty, and from then on every boot would stop at `target_exists` with the
+// user's history stranded. Instead the next boot simply tries the move again.
+//
+// No imports outside `node:*`, so cli.ts can load it before config.ts reads the environment.
+import { existsSync, renameSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+/** The directory name under the home directory. */
+export const DATA_DIR_NAME = '.limn';
+/** The pre-rename directory name, moved once on first boot. */
+export const LEGACY_DATA_DIR_NAME = '.pierre-review';
+/**
+ * The local data directory: `LIMN_DATA_DIR` when set; else `~/.pierre-review` while it exists and
+ * `~/.limn` does not (the move has not happened yet — see the header); else `~/.limn`.
+ */
+export function resolveDataDir(env = process.env, home = homedir()) {
+    const explicit = env.LIMN_DATA_DIR?.trim();
+    if (explicit)
+        return resolve(explicit);
+    const target = join(home, DATA_DIR_NAME);
+    const legacy = join(home, LEGACY_DATA_DIR_NAME);
+    if (existsSync(legacy) && !existsSync(target))
+        return legacy;
+    return target;
+}
+/** The database file the CLI and the server open by default (the name predates the rename). */
+const DB_FILE = 'pierre-review.sqlite';
+function isInside(dir, path) {
+    const rel = relative(dir, path);
+    return rel === '' || (!!rel && !rel.startsWith('..') && !isAbsolute(rel));
+}
+// The same failure can be reported by the CLI's call and the server's; say it once per process.
+const said = new Set();
+/**
+ * Move `~/.pierre-review` to `~/.limn`, once. Safe to call on every boot: after the first move
+ * there is no legacy directory left, so it is a single `existsSync`.
+ */
+export function migrateLegacyDataDir(opts = {}) {
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? homedir();
+    const say = (msg) => {
+        if (said.has(msg))
+            return;
+        said.add(msg);
+        opts.log?.(msg);
+    };
+    if (env.LIMN_DATA_DIR?.trim())
+        return { moved: false, reason: 'explicit_dir' };
+    const from = join(home, LEGACY_DATA_DIR_NAME);
+    const to = join(home, DATA_DIR_NAME);
+    if (!existsSync(from))
+        return { moved: false, reason: 'no_legacy_dir' };
+    // Never clobber: an existing ~/.limn is the user's data too. The old directory stays as it is —
+    // but a ~/.limn with no database next to an old one that has one is worth a line.
+    if (existsSync(to)) {
+        if (!existsSync(join(to, DB_FILE)) && existsSync(join(from, DB_FILE))) {
+            say(`Your earlier Limn data is still in ${from}, and ${to} already exists, so it was not moved. To use it, stop Limn and move ${join(from, DB_FILE)} into ${to}.`);
+        }
+        return { moved: false, reason: 'target_exists' };
+    }
+    // A database or clone path pinned inside the old directory: moving it would orphan that path.
+    const resolvePath = opts.resolvePath ?? ((p) => resolve(p));
+    for (const key of ['DATABASE_URL', 'CLONE_DIR']) {
+        const raw = env[key]?.trim();
+        if (raw && isInside(from, resolvePath(raw))) {
+            say(`Your data stays in ${from} because ${key} points inside it. To move it to ${to}, stop Limn, move the folder, and update ${key}.`);
+            return { moved: false, reason: 'pinned_path' };
+        }
+    }
+    try {
+        renameSync(from, to);
+    }
+    catch (err) {
+        // Leave everything where it was. `resolveDataDir` keeps answering the old directory while
+        // ~/.limn does not exist, so this boot runs on the user's real data and the next one tries
+        // the move again.
+        const error = err instanceof Error ? err.message : String(err);
+        say(`Could not move ${from} to ${to} (${error}). Limn is using ${from} for now and will try again next time.`);
+        return { moved: false, reason: 'rename_failed', error };
+    }
+    say(`Moved your Limn data from ${from} to ${to}.`);
+    return { moved: true, from, to };
+}
+//# sourceMappingURL=data-dir.js.map