lumencode 1.1.0 → 1.3.0

package/lib/git.js

@@ -2,6 +2,14 @@ import { execSync, exec as execCb } from 'child_process';
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { aggregateAttribution, classifyAttribution } from './attribution.js';
+import {
+  normalizeCommitFilePath,
+  normalizePathForGit,
+  projectMatches as projectMatchesFromGitPaths,
+  toRepoRelativePath,
+} from './git-paths.js';
+import { resolveAttributionOptions } from './git-attribution-options.js';
+import { scoreSessionCandidate } from './git-attribution-candidates.js';
 
 // ── helpers ──
 
@@ -157,13 +165,6 @@ const AI_CONFIDENCE = {
   HIGH: 'high',
 };
 
-const CONFIDENCE_WEIGHTS = {
-  [AI_CONFIDENCE.HIGH]: 1.0,
-  [AI_CONFIDENCE.MEDIUM]: 0.7,
-  [AI_CONFIDENCE.LOW]: 0.2,
-  [AI_CONFIDENCE.NONE]: 0,
-};
-
 function isCountedAIConfidence(confidence) {
   return confidence === AI_CONFIDENCE.HIGH || confidence === AI_CONFIDENCE.MEDIUM;
 }
@@ -180,7 +181,7 @@ function resolveToolFromSignals(signals) {
   return null;
 }
 
-function createAIAttribution({ confidence = AI_CONFIDENCE.NONE, signals = [], attributionType = null, detectedTool = null } = {}) {
+function createAIAttribution({ confidence = AI_CONFIDENCE.NONE, signals = [], attributionType = null, detectedTool = null, negativeSignals = [] } = {}) {
   const normalizedSignals = [...new Set(signals)];
   return {
     isAI: isCountedAIConfidence(confidence),
@@ -191,6 +192,7 @@ function createAIAttribution({ confidence = AI_CONFIDENCE.NONE, signals = [], at
     aiEvidence: normalizedSignals,
     attributionType,
     detectedTool,
+    negativeSignals,
   };
 }
 
@@ -221,6 +223,21 @@ function buildEvidenceDetails({
   };
 }
 
+// 检测正则中可能导致回溯爆炸的危险模式
+function isSafeRegex(pattern) {
+  // 限制最大长度
+  if (pattern.length > 200) return false;
+  // 嵌套量词：如 (a+)+, (a*){2,}, (a{1,3})+
+  if (/\([^)]*[+*{][^)]*\)[+*{]/.test(pattern)) return false;
+  // 交替+量词：如 (a|b)*, (foo|bar)+
+  if (/\([^)]*\|[^)]*\)[+*{]/.test(pattern)) return false;
+  // 字符类后跟量词且字符类内含量词：如 [\w+]* — 模糊但潜在危险
+  if (/\[[^\]]+\][+*{]/.test(pattern) && /\[[^\]]*[*+]/.test(pattern)) return false;
+  // 重复量词：如 a** 或 a++ (有些引擎报错但不应依赖)
+  if (/[+*{]\s*[+*{]/.test(pattern)) return false;
+  return true;
+}
+
 function loadCustomPatterns() {
   try {
     const configPath = join(process.cwd(), 'ai-patterns.json');
@@ -228,6 +245,13 @@ function loadCustomPatterns() {
       const raw = JSON.parse(readFileSync(configPath, 'utf-8'));
       return raw
         .filter(p => typeof p.re === 'string' && typeof p.signal === 'string')
+        .filter(p => {
+          if (!isSafeRegex(p.re)) {
+            console.warn(`[git] 跳过不安全正则: ${p.re.slice(0, 50)}`);
+            return false;
+          }
+          return true;
+        })
         .map(p => ({ re: new RegExp(p.re, p.flags || 'i'), signal: p.signal }));
     }
   } catch { /* ignore */ }
@@ -248,6 +272,205 @@ function loadAttributionOverrides() {
   }
 }
 
+// ── Style-based heuristic detection (fallback when no explicit signals) ──
+
+const IMPERATIVE_VERBS = /^(?:add|fix|update|remove|refactor|implement|create|delete|replace|rename|move|extract|improve|optimize|simplify|restructure|rewrite|migrate|upgrade|downgrade|revert|bump|clean|format|lint|docs?|test|build|ci|chore|perf|style|init|setup|config|configure|enable|disable|support|handle|ensure|validate|verify|check|detect|parse|compute|merge|split|group|sort|filter|map|reduce|export|import|load|save|read|write|reset|toggle|switch|convert|transform|wrap|unwrap|escape|unescape|encode|decode|serialize|deserialize|compress|decompress|encrypt|decrypt|hash|sign|verify|auth|login|logout|register|unregister|subscribe|unsubscribe|connect|disconnect|bind|unbind|attach|detach|mount|unmount|open|close|show|hide|display|render|draw|paint|print|log|trace|debug|info|warn|error|fatal|throw|catch|retry|abort|cancel|timeout|expire|flush|clear|reset|restore|backup|archive|deploy|release|publish|install|uninstall)\b/i;
+
+function detectStyleSignals(subject, body) {
+  const signals = [];
+  let score = 0;
+
+  // Bullet list: 3+ lines starting with "- " or "* "
+  const bulletLines = (body || '').split('\n').filter(l => /^\s*[-*]\s+\S/.test(l));
+  if (bulletLines.length >= 3) {
+    signals.push('styleBulletList');
+    score += 2;
+  }
+
+  // Conventional commit with scope: type(scope): subject
+  if (CONVENTIONAL_RE.test(subject)) {
+    const m = subject.match(CONVENTIONAL_RE);
+    if (m && m[2]) {
+      signals.push('styleConventionalScope');
+      score += 1;
+    }
+  }
+
+  // Long structured body: >150 chars with 3+ non-empty lines
+  const bodyLines = (body || '').split('\n').filter(l => l.trim());
+  if ((body || '').length > 150 && bodyLines.length >= 3) {
+    signals.push('styleLongStructuredBody');
+    score += 1;
+  }
+
+  // Technical detail: body contains file paths or parenthetical notes
+  if (/[a-zA-Z0-9_-]+\/[a-zA-Z0-9_-]+\.[a-z]{1,4}/.test(body) || /\([^)]{10,}\)/.test(body)) {
+    signals.push('styleTechnicalDetail');
+    score += 1;
+  }
+
+  // Imperative mood: 3+ body lines start with imperative verbs (strip bullet prefix first)
+  const imperativeCount = bodyLines.filter(l => IMPERATIVE_VERBS.test(l.trim().replace(/^[-*]\s+/, ''))).length;
+  if (imperativeCount >= 3) {
+    signals.push('styleImperativeMood');
+    score += 1;
+  }
+
+  return { signals, score };
+}
+
+// ── Negative signals (reduce false positives) ──
+
+const WIP_RE = /\b(?:wip|draft|todo|temp|tmp|hack|quick)\b/i;
+const MERGE_RE = /^Merge\s+(?:branch|pull|remote|tag)/i;
+
+export function detectNegativeSignals(subject, body, linesAdded, linesDeleted, fileCount) {
+  const signals = [];
+  const trimmedBody = (body || '').trim();
+  const trimmedSubject = (subject || '').trim();
+  const totalLines = (linesAdded || 0) + (linesDeleted || 0);
+  const files = fileCount || 0;
+
+  // Informal: very short subject AND body, no conventional commit prefix
+  const isConventional = CONVENTIONAL_RE.test(trimmedSubject);
+  if (trimmedSubject.length <= 10 && trimmedBody.length <= 10 && !/\n/.test(trimmedBody) && !isConventional) {
+    signals.push('humanInformal');
+  }
+  if (MERGE_RE.test(trimmedSubject)) {
+    signals.push('humanMergeCommit');
+  }
+  if (totalLines <= 2 && files <= 1) {
+    signals.push('humanSmallScope');
+  }
+  if (WIP_RE.test(trimmedSubject)) {
+    signals.push('humanWIP');
+  }
+  return signals;
+}
+
+// ── Developer behavioral baseline ──
+
+function computeAuthorBaseline(commitList) {
+  const authorStats = new Map();
+  for (const c of commitList || []) {
+    const email = c.author || 'unknown';
+    if (!authorStats.has(email)) {
+      authorStats.set(email, {
+        count: 0, totalSubjectLen: 0, totalBodyLen: 0,
+        bulletCount: 0, convCount: 0, totalFiles: 0, totalLines: 0,
+      });
+    }
+    const s = authorStats.get(email);
+    s.count++;
+    s.totalSubjectLen += (c.subject || '').length;
+    s.totalBodyLen += (c.body || '').length;
+    s.totalFiles += (c.files || []).length;
+    s.totalLines += (c.linesAdded || 0) + (c.linesDeleted || 0);
+    if (/^\s*[-*]\s+\S/m.test(c.body || '')) s.bulletCount++;
+    if (CONVENTIONAL_RE.test(c.subject)) s.convCount++;
+  }
+  const baselines = new Map();
+  for (const [email, s] of authorStats) {
+    if (s.count < 3) { baselines.set(email, null); continue; }
+    baselines.set(email, {
+      avgSubjectLen: s.totalSubjectLen / s.count,
+      avgBodyLen: s.totalBodyLen / s.count,
+      bulletRatio: s.bulletCount / s.count,
+      convRatio: s.convCount / s.count,
+      avgFiles: s.totalFiles / s.count,
+      avgLines: s.totalLines / s.count,
+    });
+  }
+  return baselines;
+}
+
+function computeBaselineDeviation(commit, baseline) {
+  if (!baseline) return 0;
+  let deviation = 0;
+  let factors = 0;
+  const body = commit.body || '';
+
+  if (baseline.avgBodyLen > 0) {
+    const ratio = body.length / baseline.avgBodyLen;
+    deviation += ratio > 2 ? 0.3 : (ratio > 1.5 ? 0.15 : 0);
+    factors++;
+  }
+  const hasBullets = /^\s*[-*]\s+\S/m.test(body);
+  if (baseline.bulletRatio < 0.1 && hasBullets) { deviation += 0.3; factors++; }
+  const fileCount = (commit.files || []).length;
+  if (baseline.avgFiles > 0) {
+    const ratio = fileCount / baseline.avgFiles;
+    deviation += ratio > 3 ? 0.2 : (ratio > 2 ? 0.1 : 0);
+    factors++;
+  }
+  const lineCount = (commit.linesAdded || 0) + (commit.linesDeleted || 0);
+  if (baseline.avgLines > 0) {
+    const ratio = lineCount / baseline.avgLines;
+    deviation += ratio > 3 ? 0.2 : (ratio > 2 ? 0.1 : 0);
+    factors++;
+  }
+
+  return factors > 0 ? Math.min(deviation / factors, 1) : 0;
+}
+
+// ── Composite continuous scoring ──
+
+function computeContinuousScore(commit, attributionOptions) {
+  let score = 0;
+  const signals = new Set(commit.aiSignals || []);
+  const weights = attributionOptions.scoreWeights;
+
+  // Explicit signatures
+  if (signals.has('coAuthor') || signals.has('generatedWith') || signals.has('assistedBy')) score += weights.explicitSignature;
+  if (signals.has('coAuthorCopilot') || signals.has('coAuthorCursor') || signals.has('coAuthorCodex')) score += weights.explicitSignature;
+  if (signals.has('robotEmoji') || signals.has('coAuthorOpencode')) score += weights.explicitSignature;
+  if (signals.has('authorClaude') || signals.has('authorBot')) score += weights.explicitAuthor;
+  if (signals.has('generatedWithAider') || signals.has('aiderTag')) score += weights.explicitSignature;
+  if (signals.has('generatedWithCodex') || signals.has('coAuthorCodex')) score += weights.explicitSignature;
+  if (signals.has('coAuthorWindsurf') || signals.has('coAuthorAugment') || signals.has('coAuthorCline')) score += weights.explicitSignature;
+  if (signals.has('aiGenerated') || signals.has('generatedByAI') || signals.has('viaAI') || signals.has('aiTag')) score += weights.genericAISignature;
+
+  // Session signals
+  if (commit.sessionAttribution === 'strong') score += weights.sessionStrong;
+  else if (commit.sessionAttribution === 'cross-day') score += weights.sessionCrossDay;
+  else if (commit.sessionAttribution === 'weak') score += weights.sessionWeak;
+  else if (commit.sessionAttribution === 'cross-day-weak') score += weights.sessionCrossDayWeak;
+
+  // File overlap
+  const overlap = commit.aiEvidenceDetails?.fileOverlapRatio || 0;
+  score += overlap * weights.fileOverlap;
+
+  // Style heuristic
+  if (signals.has('styleBulletList')) score += weights.styleBulletList;
+  if (signals.has('styleConventionalScope')) score += weights.styleConventionalScope;
+  if (signals.has('styleImperativeMood')) score += weights.styleImperativeMood;
+  if (signals.has('styleLongStructuredBody')) score += weights.styleLongStructuredBody;
+
+  // Baseline deviation
+  if (signals.has('baselineDeviationHigh')) score += weights.baselineDeviationHigh;
+  else if (signals.has('baselineDeviationMedium')) score += weights.baselineDeviationMedium;
+
+  // Negative signals
+  const negSignals = new Set(commit.negativeSignals || []);
+  if (negSignals.has('humanMergeCommit')) score += weights.negativeMergeCommit;
+  if (negSignals.has('humanInformal')) score += weights.negativeInformal;
+  if (negSignals.has('humanSmallScope')) score += weights.negativeSmallScope;
+  if (negSignals.has('humanWIP')) score += weights.negativeWIP;
+
+  // Baseline match (human pattern)
+  if (signals.has('humanBaselineMatch')) score += weights.humanBaselineMatch;
+
+  return Math.max(0, Math.min(1, score));
+}
+
+function scoreToConfidence(score, attributionOptions) {
+  const thresholds = attributionOptions.confidenceThresholds;
+  if (score >= thresholds.high) return AI_CONFIDENCE.HIGH;
+  if (score >= thresholds.medium) return AI_CONFIDENCE.MEDIUM;
+  if (score >= thresholds.low) return AI_CONFIDENCE.LOW;
+  return AI_CONFIDENCE.NONE;
+}
+
 export function detectAICommit(subject = '', author = '', body = '') {
   const haystack = `${subject}\n${body}`;
   const signals = [];
@@ -285,12 +508,38 @@ export function detectAICommit(subject = '', author = '', body = '') {
       detectedTool,
     });
   }
+
+  // Negative signals: skip style heuristic for obvious human patterns
+  // Only check message-level signals here (line/file counts not available)
+  const subjectNeg = (subject || '').trim();
+  const bodyNeg = (body || '').trim();
+  const negSignals = [];
+  const isConvSubject = CONVENTIONAL_RE.test(subjectNeg);
+  if (subjectNeg.length <= 10 && bodyNeg.length <= 10 && !/\n/.test(bodyNeg) && !isConvSubject) negSignals.push('humanInformal');
+  if (/^Merge\s+(?:branch|pull|remote|tag)/i.test(subjectNeg)) negSignals.push('humanMergeCommit');
+  if (/\b(?:wip|draft|todo|temp|tmp|hack|quick)\b/i.test(subjectNeg)) negSignals.push('humanWIP');
+  if (negSignals.length > 0) {
+    return createAIAttribution({ negativeSignals: negSignals });
+  }
+
+  // Fallback: style-based heuristic detection
+  const { signals: styleSignals, score } = detectStyleSignals(subject, body);
+  if (styleSignals.length > 0 && score >= 4) {
+    const confidence = score >= 6 ? AI_CONFIDENCE.MEDIUM : AI_CONFIDENCE.LOW;
+    return createAIAttribution({
+      confidence,
+      signals: styleSignals,
+      attributionType: score >= 6 ? 'style_heuristic_strong' : 'style_heuristic',
+      detectedTool: null,
+    });
+  }
+
   return createAIAttribution();
 }
 
 // ── 聚合函数 ──
 
-export function computeAIContribution(commits, toolFilter = null) {
+export function computeAIContribution(commits, toolFilter = null, options = {}) {
   let aiCommits = 0, aiLinesAdded = 0, aiLinesDeleted = 0;
   let possibleAICommits = 0, possibleAILinesAdded = 0, possibleAILinesDeleted = 0;
   let weightedAILinesAdded = 0, weightedAILinesDeleted = 0;
@@ -298,6 +547,8 @@ export function computeAIContribution(commits, toolFilter = null) {
   let aiFileLinesAdded = 0, aiFileLinesDeleted = 0;
   let highConfidenceCommits = 0, mediumConfidenceCommits = 0, lowConfidenceCommits = 0;
   let totalLinesAdded = 0, totalLinesDeleted = 0;
+  const attributionOptions = resolveAttributionOptions(options.attribution || options);
+  const confidenceWeights = attributionOptions.confidenceWeights;
   const allCommits = commits || [];
   for (const c of allCommits) {
     totalLinesAdded += c.linesAdded || 0;
@@ -328,6 +579,12 @@ export function computeAIContribution(commits, toolFilter = null) {
       fileDeleted = c.linesDeleted || 0;
     }
 
+    // Step blame override: use precise line-level attribution when available
+    if (c.lineBlame) {
+      fileAdded = c.lineBlame.aiLines || 0;
+      fileDeleted = c.lineBlame.aiDeletedLines || 0;
+    }
+
     if (isCountedAIConfidence(confidence)) {
       aiCommits++;
       aiCommitLinesAdded += c.linesAdded || 0;
@@ -341,7 +598,7 @@ export function computeAIContribution(commits, toolFilter = null) {
     }
 
     // 加权计算：所有归因的 commit 都参与（包括 LOW）
-    const weight = CONFIDENCE_WEIGHTS[confidence] || 0;
+    const weight = confidenceWeights[confidence] || 0;
     if (weight > 0) {
       weightedAILinesAdded += fileAdded * weight;
       weightedAILinesDeleted += fileDeleted * weight;
@@ -428,7 +685,9 @@ export function parseGitLogOutput(output, repo = '') {
 
   const flush = () => {
     if (!current) return;
-    const dateKey = current.date.slice(0, 10);
+    // 使用本地日期做 daily stats key（用户期望看到的日期），
+    // UTC 日期（current.date）仅用于与 session 时间戳比较
+    const dateKey = current.dateLocal || current.date.slice(0, 10);
     // 注入 conventional 类型 + AI 信号
     const conv = parseConventional(current.subject);
     const ai = detectAICommit(current.subject, current.author, current.body || '');
@@ -442,6 +701,7 @@ export function parseGitLogOutput(output, repo = '') {
     current.aiEvidence = ai.aiEvidence;
     current.attributionType = ai.attributionType;
     current.detectedTool = ai.detectedTool || null;
+    current.negativeSignals = ai.negativeSignals || [];
     current.sessionId = null; // 由 finalize 阶段填充
 
     result.commits++;
@@ -474,13 +734,21 @@ export function parseGitLogOutput(output, repo = '') {
       const header = line.slice(COMMIT_SENTINEL.length);
       const parts = header.split('|');
       const hash = parts[0] || '';
-      const date = (parts[1] || '').slice(0, 19);
+      const dateRaw = (parts[1] || '');
+      // 保留本地日期用于 commitsByDate（用户看到的日期）
+      const dateLocal = dateRaw.slice(0, 10) || '';
+      // Normalize to UTC ISO for consistent comparison with session timestamps
+      const dateMs = Date.parse(dateRaw);
+      const date = Number.isFinite(dateMs)
+        ? new Date(dateMs).toISOString().slice(0, 19) + 'Z'
+        : dateRaw.slice(0, 19);
       const author = parts[2] || '';
       const subject = parts.slice(3).join('|');
       current = {
         repo,
         hash,
         date,
+        dateLocal,
         author,
         subject,
         body: '',
@@ -539,15 +807,14 @@ function sanitizeArg(s) {
   return String(s || '').replace(/[`$"\\|;&<>!\n\r]/g, '');
 }
 
-function buildGitArgs(since, until, author) {
-  const sinceFull = since.includes('T') ? since : since + 'T00:00:00';
-  const safeSince = sanitizeArg(sinceFull);
-  const safeUntil = sanitizeArg(until);
-  const authorArg = author ? ` --author="${sanitizeArg(author)}"` : '';
-  // 格式：哨兵行(subject) → body 行(可多行) → ENDBODY 行 → numstat 行
-  const pretty = `--pretty=format:"${COMMIT_SENTINEL}%H|%ad|%ae|%s%n%B${BODY_END}"`;
-  return `--all --no-renames ${pretty} --date=iso-strict --numstat --since="${safeSince}" --until="${safeUntil}"${authorArg}`;
-}
+function buildGitArgs(since, until) {
+  const sinceFull = since.includes('T') ? since : since + 'T00:00:00';
+  const safeSince = sanitizeArg(sinceFull);
+  const safeUntil = sanitizeArg(until);
+  // 格式：哨兵行(subject) → body 行(可多行) → ENDBODY 行 → numstat 行
+  const pretty = `--pretty=format:"${COMMIT_SENTINEL}%H|%ad|%ae|%s%n%B${BODY_END}"`;
+  return `--all --no-renames ${pretty} --date=iso-strict --numstat --since="${safeSince}" --until="${safeUntil}"`;
+}
 
 function mergeGitStats(target, source) {
   target.commits += source.commits;
@@ -570,37 +837,105 @@ function mergeGitStats(target, source) {
   // filesChanged 在 merge 完后由 finalize 重新计算（跨 repo 去重）
 }
 
-function recomputeFilesChanged(stats) {
-  const set = new Set();
-  for (const c of stats.commitList || []) {
-    for (const f of c.files || []) set.add((c.repo || '') + '::' + f.path);
-  }
-  stats.filesChanged = set.size;
-}
+function recomputeFilesChanged(stats) {
+  const set = new Set();
+  for (const c of stats.commitList || []) {
+    for (const f of c.files || []) set.add((c.repo || '') + '::' + f.path);
+  }
+  stats.filesChanged = set.size;
+}
+
+function recomputeStatsFromCommitList(stats) {
+  stats.commits = 0;
+  stats.filesChanged = 0;
+  stats.linesAdded = 0;
+  stats.linesDeleted = 0;
+  stats.commitsByDate = {};
+  stats.linesByDate = {};
+
+  for (const c of stats.commitList || []) {
+    const dateKey = c.dateLocal || (c.date || '').slice(0, 10);
+    stats.commits++;
+    stats.commitsByDate[dateKey] = (stats.commitsByDate[dateKey] || 0) + 1;
+    if (!stats.linesByDate[dateKey]) stats.linesByDate[dateKey] = { added: 0, deleted: 0, files: 0 };
+    stats.linesByDate[dateKey].added += c.linesAdded || 0;
+    stats.linesByDate[dateKey].deleted += c.linesDeleted || 0;
+    stats.linesByDate[dateKey].files += (c.files || []).length;
+    stats.linesAdded += c.linesAdded || 0;
+    stats.linesDeleted += c.linesDeleted || 0;
+  }
+  recomputeFilesChanged(stats);
+}
+
+function markAuthorOwnership(stats, expectedAuthor) {
+  const normalizedExpected = (expectedAuthor || '').toLowerCase();
+  for (const c of stats.commitList || []) {
+    c.expectedAuthor = expectedAuthor || null;
+    c.authorMatchesConfig = normalizedExpected
+      ? (c.author || '').toLowerCase() === normalizedExpected
+      : null;
+  }
+}
+
+function hasLocalSessionEvidence(commit) {
+  if (!commit.sessionId) return false;
+  if (commit.sessionAttribution === 'strong') return true;
+  return (commit.aiEvidenceDetails?.matchedFileCount || 0) > 0;
+}
+
+function filterCommitsForUser(stats) {
+  const commits = stats.commitList || [];
+  const hasAuthorOwnershipMetadata = commits.some(c => c.expectedAuthor || c.authorMatchesConfig !== undefined);
+
+  for (const c of commits) {
+    c.countedForUser = !hasAuthorOwnershipMetadata
+      || c.authorMatchesConfig === true
+      || hasLocalSessionEvidence(c);
+  }
+
+  if (!hasAuthorOwnershipMetadata) return;
+  stats.commitList = commits.filter(c => c.countedForUser);
+  recomputeStatsFromCommitList(stats);
+}
 
 // ── async versions (server) with cache ──
 
 const gitCache = new Map();
+const GIT_CACHE_MAX = 500;
+const GIT_CACHE_TTL = 60_000;
 const CACHE_VERSION = 'v3';
 
-async function getGitStatsAsync(repoPath, since, until, author = null) {
-  const cacheKey = `${repoPath}|${since}|${until}|${CACHE_VERSION}`;
-  const cached = gitCache.get(cacheKey);
-  if (cached && Date.now() - cached.ts < 60_000) return cached.stats;
+function evictGitCache() {
+  const now = Date.now();
+  for (const [key, val] of gitCache) {
+    if (now - val.ts > GIT_CACHE_TTL) gitCache.delete(key);
+  }
+  while (gitCache.size > GIT_CACHE_MAX) {
+    const oldest = gitCache.keys().next().value;
+    gitCache.delete(oldest);
+  }
+}
+
+async function getGitStatsAsync(repoPath, since, until, author = null) {
+  const cacheKey = `${repoPath}|${since}|${until}|${CACHE_VERSION}`;
+  const cached = gitCache.get(cacheKey);
+  if (cached && Date.now() - cached.ts < GIT_CACHE_TTL) return cached.stats;
 
   try {
     await execAsync('git rev-parse --git-dir', { cwd: repoPath });
   } catch {
     return emptyResult();
   }
-
-  try {
-    const output = await execAsync(`git log ${buildGitArgs(since, until, author)}`, {
-      cwd: repoPath, encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024,
-    });
-    const stats = parseGitLogOutput(output, repoPath);
-    gitCache.set(cacheKey, { stats, ts: Date.now() });
-    return stats;
+
+  try {
+    const output = await execAsync(`git log ${buildGitArgs(since, until)}`, {
+      cwd: repoPath, encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024,
+    });
+    const stats = parseGitLogOutput(output, repoPath);
+    markAuthorOwnership(stats, author);
+    gitCache.set(cacheKey, { stats, ts: Date.now() });
+    evictGitCache();
+    return stats;
   } catch {
     return emptyResult();
   }
@@ -637,31 +972,6 @@ export function invalidateGitCache() {
 
 // ── Session ↔ Commit 关联 ──
 
-function normalizePath(p) {
-  if (!p) return '';
-  return p.replace(/\\/g, '/').replace(/\/+/g, '/').replace(/\/$/, '').toLowerCase();
-}
-
-function toRelativeRepoPath(filePath, repoPath) {
-  const fileN = normalizePath(filePath);
-  const repoN = normalizePath(repoPath);
-  if (!fileN) return '';
-  if (!repoN) return normalizeCommitFilePath(fileN.replace(/^[a-z]:\//i, ''));
-  if (fileN === repoN) return '';
-  if (fileN.startsWith(repoN + '/')) return fileN.slice(repoN.length + 1);
-  const repoTail = repoN.split('/').filter(Boolean).pop();
-  if (repoTail) {
-    const marker = `/${repoTail}/`;
-    const idx = fileN.indexOf(marker);
-    if (idx >= 0) return fileN.slice(idx + marker.length);
-  }
-  return fileN;
-}
-
-function normalizeCommitFilePath(filePath) {
-  return normalizePath(filePath).replace(/^\.?\//, '');
-}
-
 function looksLikeFilePath(value) {
   if (typeof value !== 'string') return false;
   const v = value.trim();
@@ -754,21 +1064,43 @@ function extractTouchedFilesFromSession(session) {
   const repoPath = session.project || '';
   const files = new Set();
   for (const tc of session.toolSequence || []) {
-    // Write/Edit/NotebookEdit/MultiEdit 工具
-    if (['Write', 'Edit', 'NotebookEdit', 'MultiEdit'].includes(tc.name)) {
-      const rawPaths = collectFilePaths(tc.input);
+    const name = tc.name || '';
+    const input = tc.input || {};
+
+    // Claude 内置工具：Write/Edit/NotebookEdit/MultiEdit
+    if (name === 'Write' || name === 'Edit' || name === 'NotebookEdit' || name === 'MultiEdit') {
+      const rawPaths = collectFilePaths(input);
+      for (const rawPath of rawPaths) {
+        const relative = normalizeCommitFilePath(toRepoRelativePath(rawPath, repoPath));
+        if (relative) files.add(relative);
+      }
+      continue;
+    }
+
+    // MCP Serena 工具：replace_content, replace_symbol_body, insert_before/after_symbol 等
+    // 以及其他带 relative_path/file_path 的 MCP 工具
+    if (name.startsWith('mcp__serena') || name.startsWith('mcp__')) {
+      // Serena 使用 relative_path，其他 MCP 工具可能使用 file_path/path
+      const filePath = input.relative_path || input.file_path || input.path || '';
+      if (filePath && typeof filePath === 'string') {
+        const relative = normalizeCommitFilePath(toRepoRelativePath(filePath, repoPath));
+        if (relative) files.add(relative);
+      }
+      // 部分 MCP 工具在 input 中嵌套了目标文件
+      const rawPaths = collectFilePaths(input);
       for (const rawPath of rawPaths) {
-        const relative = normalizeCommitFilePath(toRelativeRepoPath(rawPath, repoPath));
+        const relative = normalizeCommitFilePath(toRepoRelativePath(rawPath, repoPath));
         if (relative) files.add(relative);
       }
       continue;
     }
+
     // Bash 工具 — 从命令中提取文件路径
-    if (tc.name === 'Bash') {
-      const cmd = tc.input?.command || '';
+    if (name === 'Bash') {
+      const cmd = input.command || '';
       const rawPaths = extractFilePathsFromBashCommand(cmd);
       for (const rawPath of rawPaths) {
-        const relative = normalizeCommitFilePath(toRelativeRepoPath(rawPath, repoPath));
+        const relative = normalizeCommitFilePath(toRepoRelativePath(rawPath, repoPath));
         if (relative) files.add(relative);
       }
     }
@@ -792,34 +1124,45 @@ function computeFileOverlap(sessionTouchedFiles, commitFiles) {
   });
 }
 
-// 用于 commit.repo 与 session.project 之间宽松对齐：
-// decodeProjectName 把 `-` 解码为 `/`（D--foo-bar → D://foo/bar），
-// 所以将 `-` 和 `_` 统一转为 `/`，再以 `/` 为分隔符保留路径语义。
-// 这样 d:/foo-bar 和 d:/foo/bar 匹配（同一项目的解码差异），
-// 但 d:/foobar 和 d:/foo/bar 不匹配（不同项目）。
-function projectKey(p) {
-  return normalizePath(p).replace(/[-_]/g, '/').replace(/\/+/g, '/').replace(/\/$/, '').replace(/[^a-z0-9/]/g, '');
-}
-
-// 精确路径包含：parent 是 child 的前缀，且后面紧跟 '/' 或完全匹配
-function pathContains(parent, child) {
-  if (parent === child) return true;
-  return child.startsWith(parent + '/');
-}
-
-function projectMatches(commitRepoN, sessionProjectN) {
-  if (!commitRepoN || !sessionProjectN) return true;
-  // 精确路径匹配（双向：commit repo 可能是 session project 的子目录或反之）
-  if (pathContains(commitRepoN, sessionProjectN) || pathContains(sessionProjectN, commitRepoN)) return true;
-  // 宽松 key 对比（兜底：处理路径解码差异）
-  const a = projectKey(commitRepoN);
-  const b = projectKey(sessionProjectN);
-  return a && b && (a === b);
+function sortAttributionCandidates(candidates) {
+  return candidates.sort((a, b) => {
+    if (b.score !== a.score) return b.score - a.score;
+    return a.distanceMs - b.distanceMs;
+  });
 }
 
-const BASH_GIT_COMMIT_RE = /\bgit\s+commit\b/i;
-const STRONG_WINDOW_BEFORE_MS = 30 * 1000;       // 30s before bash invocation
-const STRONG_WINDOW_AFTER_MS = 5 * 60 * 1000;    // 5min after
+function candidateFromSession(commit, session, distanceMs) {
+  const overlap = computeFileOverlap(session.touchedFiles || [], commit.files || []);
+  return scoreSessionCandidate(commit, session, {
+    distanceMs,
+    fileOverlapRatio: overlap.fileOverlapRatio,
+    matchedFiles: overlap.matchedFiles,
+    projectMatches: true,
+  });
+}
+
+function getStepSessionIdCandidates(sessionId, session) {
+  if (!sessionId) return [];
+  const candidates = [sessionId];
+  if (sessionId.includes(':')) return candidates;
+
+  const originByTool = {
+    claude: 'claude_code',
+    codex: 'codex_cli',
+  };
+  const origin = originByTool[session?.primaryTool];
+  if (origin) {
+    candidates.push(`${origin}:${sessionId}`);
+  } else {
+    candidates.push(`claude_code:${sessionId}`, `codex_cli:${sessionId}`);
+  }
+
+  return [...new Set(candidates)];
+}
+
+const BASH_GIT_COMMIT_RE = /\bgit\s+commit\b/i;
+const STRONG_WINDOW_BEFORE_MS = 30 * 1000;       // 30s before bash invocation
+const STRONG_WINDOW_AFTER_MS = 5 * 60 * 1000;    // 5min after
 
 function toMs(iso) {
   if (!iso) return NaN;
@@ -841,18 +1184,22 @@ function extractCommitBashTimestamps(session) {
   return ts;
 }
 
-export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 * 60 * 1000 } = {}) {
+export function attributeCommitsToSessions(commits, sessions, options = {}) {
   const result = { sessionCommitMap: {} };
   if (!commits?.length || !sessions?.length) return result;
+  const attributionOptions = resolveAttributionOptions(options.attribution || options);
+  const bufferMs = options.bufferMs ?? attributionOptions.windows.weakWindowMinutes * 60 * 1000;
+  const crossDayMs = attributionOptions.windows.crossDayWindowDays * 24 * 3600 * 1000;
 
   // 预计算每个 session 的 ms 范围 + 项目归一化 + bash commit 时间戳
   const sIndex = sessions.map(s => ({
     id: s.id,
-    projectN: normalizePath(s.project || ''),
+    projectN: normalizePathForGit(s.project || ''),
     startMs: toMs(s.startTime),
     endMs: toMs(s.endTime),
     bashTs: extractCommitBashTimestamps(s),
     touchedFiles: extractTouchedFilesFromSession(s),
+    primaryTool: s.primaryTool,
   }));
 
   // 阶段 1：重置 + 强信号匹配（Bash git commit）
@@ -860,13 +1207,13 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
     c.sessionId = null;
     c.sessionAttribution = null;
     const commitMs = toMs(c.date);
-    const commitRepoN = normalizePath(c.repo || '');
+    const commitRepoN = normalizePathForGit(c.repo || '');
     if (!Number.isFinite(commitMs)) continue;
 
     let matched = null;
     for (const s of sIndex) {
       if (!s.bashTs.length) continue;
-      if (!projectMatches(commitRepoN, s.projectN)) continue;
+      if (!projectMatchesFromGitPaths(commitRepoN, s.projectN)) continue;
       for (const bts of s.bashTs) {
         if (commitMs >= bts - STRONG_WINDOW_BEFORE_MS && commitMs <= bts + STRONG_WINDOW_AFTER_MS) {
           matched = s;
@@ -899,14 +1246,13 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
   for (const c of commits) {
     if (c.sessionAttribution) continue;
     const commitMs = toMs(c.date);
-    const commitRepoN = normalizePath(c.repo || '');
+    const commitRepoN = normalizePathForGit(c.repo || '');
     if (!Number.isFinite(commitMs)) continue;
 
-    let best = null;
-    let bestDist = Infinity;
+    const candidates = [];
     for (const s of sIndex) {
       if (!Number.isFinite(s.startMs) || !Number.isFinite(s.endMs)) continue;
-      if (!projectMatches(commitRepoN, s.projectN)) continue;
+      if (!projectMatchesFromGitPaths(commitRepoN, s.projectN)) continue;
 
       // author 一致性校验：session 有已知 author 时，commit author 必须匹配
       const knownAuthors = sessionAuthors.get(s.id);
@@ -917,13 +1263,13 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
       if (commitMs < lo || commitMs > hi) continue;
       const mid = (s.startMs + s.endMs) / 2;
       const dist = Math.abs(commitMs - mid);
-      if (dist < bestDist) {
-        best = s;
-        bestDist = dist;
-      }
+      candidates.push(candidateFromSession(c, s, dist));
     }
 
-    if (best) {
+    if (candidates.length) {
+      const ranked = sortAttributionCandidates(candidates);
+      const best = sIndex.find(s => s.id === ranked[0].sessionId);
+      c.attributionCandidates = ranked.slice(0, 3);
       c.sessionId = best.id;
       c.sessionAttribution = 'weak';
       if (!result.sessionCommitMap[best.id]) result.sessionCommitMap[best.id] = [];
@@ -936,29 +1282,28 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
   for (const c of commits) {
     if (c.sessionAttribution) continue;
     const commitMs = toMs(c.date);
-    const commitRepoN = normalizePath(c.repo || '');
+    const commitRepoN = normalizePathForGit(c.repo || '');
     if (!Number.isFinite(commitMs)) continue;
 
-    let best = null;
-    let bestDist = Infinity;
+    const candidates = [];
     for (const s of sIndex) {
-      if (!projectMatches(commitRepoN, s.projectN)) continue;
+      if (!projectMatchesFromGitPaths(commitRepoN, s.projectN)) continue;
       if (!Number.isFinite(s.endMs)) continue;
       // commit 必须在 session 结束之后（不能是之前漏掉的）
       if (commitMs < s.endMs) continue;
       const dist = commitMs - s.endMs;
       // 最多跨 3 天
-      if (dist > 3 * 24 * 3600 * 1000) continue;
+      if (dist > crossDayMs) continue;
       // author 校验：session 有已知 author 时，commit author 必须匹配
       const knownAuthors = sessionAuthors.get(s.id);
       if (knownAuthors?.size && c.author && !knownAuthors.has(c.author.toLowerCase())) continue;
-      if (dist < bestDist) {
-        best = s;
-        bestDist = dist;
-      }
+      candidates.push(candidateFromSession(c, s, dist));
     }
 
-    if (best) {
+    if (candidates.length) {
+      const ranked = sortAttributionCandidates(candidates);
+      const best = sIndex.find(s => s.id === ranked[0].sessionId);
+      c.attributionCandidates = ranked.slice(0, 3);
       // 文件交集前置检查：无交集时标记为 cross-day-weak
       const commitFiles = (c.files || []).map(f => (f.path || '').replace(/\\/g, '/'));
       const sessionFiles = best.touchedFiles || [];
@@ -1001,15 +1346,17 @@ export function attachCommitsToSessions(sessions, commitList) {
 }
 
 // 一次性收尾：跑 attribution + 三个聚合
-export function finalizeGitStats(merged, sessions = [], options = {}) {
-  if (!merged) return merged;
-  const fileOverrides = loadAttributionOverrides();
+export async function finalizeGitStats(merged, sessions = [], options = {}) {
+  if (!merged) return merged;
+  const attributionOptions = resolveAttributionOptions(options.attribution || options);
+  const stepTrackingOptions = options.stepTracking || {};
+  const fileOverrides = loadAttributionOverrides();
   const inputOverrides = options.overrides || {};
   const mergedOverrides = {
     commits: { ...fileOverrides.commits, ...(inputOverrides.commits || {}) },
     files: { ...fileOverrides.files, ...(inputOverrides.files || {}) },
   };
-  const { sessionCommitMap } = attributeCommitsToSessions(merged.commitList, sessions);
+  const { sessionCommitMap } = attributeCommitsToSessions(merged.commitList, sessions, { attribution: attributionOptions });
   merged.sessionCommitMap = sessionCommitMap;
   const sessionsById = new Map((sessions || []).map(s => [s.id, s]));
   for (const s of sessions || []) {
@@ -1031,6 +1378,73 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
     }
   }
 
+  // Step 1.5: Enrich commits with line-level step blame when available
+  const stepTrackers = new Map();
+  if (stepTrackingOptions.enabled !== false) try {
+    const { StepTracker } = await import('./step-tracker.js');
+    const projectRoots = [...new Set((sessions || []).map(s => s.project).filter(Boolean))];
+    // Also check repo paths from commits
+    for (const c of merged.commitList || []) {
+      if (c.repo) projectRoots.push(c.repo);
+    }
+    for (const root of [...new Set(projectRoots.map(normalizePathForGit))]) {
+      if (!root) continue;
+      const tracker = new StepTracker(root, {
+        dbPath: stepTrackingOptions.dbPath,
+        maxFileSize: stepTrackingOptions.maxFileSize,
+      });
+      if (await tracker.isAvailableAsync()) {
+        await tracker.open();
+        stepTrackers.set(root, tracker);
+      }
+    }
+  } catch {
+    for (const tracker of stepTrackers.values()) tracker.close();
+    stepTrackers.clear();
+  }
+
+  if (stepTrackers.size > 0) {
+    for (const c of merged.commitList || []) {
+      if (!c.sessionId) continue;
+      const candidateRoots = [
+        c.repo,
+        sessionsById.get(c.sessionId)?.project,
+      ].filter(Boolean);
+      let stepTracker = null;
+      for (const candidateRoot of candidateRoots) {
+        const normalizedCandidate = normalizePathForGit(candidateRoot);
+        for (const [root, tracker] of stepTrackers.entries()) {
+          if (projectMatchesFromGitPaths(root, normalizedCandidate)) {
+            stepTracker = tracker;
+            break;
+          }
+        }
+        if (stepTracker) break;
+      }
+      if (!stepTracker && stepTrackers.size === 1) {
+        stepTracker = stepTrackers.values().next().value;
+      }
+      if (!stepTracker) continue;
+      try {
+        const session = sessionsById.get(c.sessionId);
+        for (const stepSessionId of getStepSessionIdCandidates(c.sessionId, session)) {
+          const lineBlame = stepTracker.getLineAttributionForCommit({
+            ...c,
+            sessionId: stepSessionId,
+          });
+          if (lineBlame) {
+            c.lineBlame = lineBlame;
+            break;
+          }
+        }
+      } catch { /* best effort */ }
+    }
+    for (const tracker of stepTrackers.values()) tracker.close();
+  }
+
+  // Step 1.6: compute developer behavioral baselines
+  const authorBaselines = computeAuthorBaseline(merged.commitList);
+
   // Step 2: 信心度评估（保持现有逻辑）
   for (const c of merged.commitList || []) {
     if (!c.sessionId || c.attributionType === 'explicit') continue;
@@ -1096,6 +1510,30 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
       signals.push('strongWithoutFileOverlap');
     }
 
+    // Developer baseline deviation
+    const baseline = authorBaselines.get(c.author);
+    const deviation = computeBaselineDeviation(c, baseline);
+    if (deviation >= 0.4) {
+      signals.push('baselineDeviationHigh');
+      if (confidence === AI_CONFIDENCE.MEDIUM) confidence = pickHigherConfidence(confidence, AI_CONFIDENCE.HIGH);
+    } else if (deviation >= 0.2) {
+      signals.push('baselineDeviationMedium');
+    } else if (deviation <= 0.05 && baseline && c.attributionType !== 'explicit') {
+      signals.push('humanBaselineMatch');
+    }
+
+    // Negative signals: downgrade confidence
+    const negSignals = detectNegativeSignals(c.subject, c.body, c.linesAdded, c.linesDeleted, (c.files || []).length);
+    if (negSignals.includes('humanMergeCommit')) {
+      confidence = AI_CONFIDENCE.NONE;
+      attributionType = 'human_merge';
+    } else if (negSignals.length > 0) {
+      if (confidence === AI_CONFIDENCE.HIGH) confidence = AI_CONFIDENCE.MEDIUM;
+      else if (confidence === AI_CONFIDENCE.MEDIUM) confidence = AI_CONFIDENCE.LOW;
+      else if (confidence === AI_CONFIDENCE.LOW) confidence = AI_CONFIDENCE.NONE;
+      c.negativeSignals = negSignals;
+    }
+
     const ai = createAIAttribution({
       confidence,
       signals,
@@ -1109,8 +1547,22 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
     c.attributionType = ai.attributionType;
   }
 
-  const attributionItems = [];
-  for (const c of merged.commitList || []) {
+  // Step 2.5: composite continuous scoring for all commits
+  for (const c of merged.commitList || []) {
+    c.aiScore = computeContinuousScore(c, attributionOptions);
+    const mappedConfidence = scoreToConfidence(c.aiScore, attributionOptions);
+    // Only override if no explicit signature and continuous score disagrees
+    if (c.attributionType !== 'explicit') {
+      c.aiConfidence = pickHigherConfidence(c.aiConfidence, mappedConfidence);
+      c.isAI = isCountedAIConfidence(c.aiConfidence);
+      c.aiAssisted = c.aiConfidence !== AI_CONFIDENCE.NONE;
+    }
+  }
+
+  filterCommitsForUser(merged);
+
+  const attributionItems = [];
+  for (const c of merged.commitList || []) {
     const commitOverride = mergedOverrides.commits[c.hash] || null;
     const fileOverride = (c.files || []).find(f => mergedOverrides.files[`${c.hash}:${f.path}`]);
     const fileOverrideValue = fileOverride ? mergedOverrides.files[`${c.hash}:${fileOverride.path}`] : null;
@@ -1140,7 +1592,7 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
   }
 
   // Step 3: 全局 + 按工具聚合
-  merged.aiContribution = computeAIContribution(merged.commitList);
+  merged.aiContribution = computeAIContribution(merged.commitList, null, attributionOptions);
   // 动态收集所有出现的 attributedTool，确保新工具自动覆盖
   const toolSet = new Set();
   for (const c of merged.commitList || []) {
@@ -1150,7 +1602,7 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
   for (const t of ['claude', 'codex', 'opencode', 'generic-ai']) toolSet.add(t);
   merged.aiContributionByTool = {};
   for (const tool of toolSet) {
-    merged.aiContributionByTool[tool] = computeAIContribution(merged.commitList, tool);
+    merged.aiContributionByTool[tool] = computeAIContribution(merged.commitList, tool, attributionOptions);
   }
   merged.attributionSummary = aggregateAttribution(attributionItems);
   merged.commitTypes = computeCommitTypes(merged.commitList);