lumencode 1.2.0 → 1.3.1

package/lib/git.js

@@ -2,6 +2,14 @@ import { execSync, exec as execCb } from 'child_process';
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { aggregateAttribution, classifyAttribution } from './attribution.js';
+import {
+  normalizeCommitFilePath,
+  normalizePathForGit,
+  projectMatches as projectMatchesFromGitPaths,
+  toRepoRelativePath,
+} from './git-paths.js';
+import { resolveAttributionOptions } from './git-attribution-options.js';
+import { scoreSessionCandidate } from './git-attribution-candidates.js';
 
 // ── helpers ──
 
@@ -157,13 +165,6 @@ const AI_CONFIDENCE = {
   HIGH: 'high',
 };
 
-const CONFIDENCE_WEIGHTS = {
-  [AI_CONFIDENCE.HIGH]: 1.0,
-  [AI_CONFIDENCE.MEDIUM]: 0.7,
-  [AI_CONFIDENCE.LOW]: 0.2,
-  [AI_CONFIDENCE.NONE]: 0,
-};
-
 function isCountedAIConfidence(confidence) {
   return confidence === AI_CONFIDENCE.HIGH || confidence === AI_CONFIDENCE.MEDIUM;
 }
@@ -222,6 +223,21 @@ function buildEvidenceDetails({
   };
 }
 
+// 检测正则中可能导致回溯爆炸的危险模式
+function isSafeRegex(pattern) {
+  // 限制最大长度
+  if (pattern.length > 200) return false;
+  // 嵌套量词：如 (a+)+, (a*){2,}, (a{1,3})+
+  if (/\([^)]*[+*{][^)]*\)[+*{]/.test(pattern)) return false;
+  // 交替+量词：如 (a|b)*, (foo|bar)+
+  if (/\([^)]*\|[^)]*\)[+*{]/.test(pattern)) return false;
+  // 字符类后跟量词且字符类内含量词：如 [\w+]* — 模糊但潜在危险
+  if (/\[[^\]]+\][+*{]/.test(pattern) && /\[[^\]]*[*+]/.test(pattern)) return false;
+  // 重复量词：如 a** 或 a++ (有些引擎报错但不应依赖)
+  if (/[+*{]\s*[+*{]/.test(pattern)) return false;
+  return true;
+}
+
 function loadCustomPatterns() {
   try {
     const configPath = join(process.cwd(), 'ai-patterns.json');
@@ -229,6 +245,13 @@ function loadCustomPatterns() {
       const raw = JSON.parse(readFileSync(configPath, 'utf-8'));
       return raw
         .filter(p => typeof p.re === 'string' && typeof p.signal === 'string')
+        .filter(p => {
+          if (!isSafeRegex(p.re)) {
+            console.warn(`[git] 跳过不安全正则: ${p.re.slice(0, 50)}`);
+            return false;
+          }
+          return true;
+        })
         .map(p => ({ re: new RegExp(p.re, p.flags || 'i'), signal: p.signal }));
     }
   } catch { /* ignore */ }
@@ -392,57 +415,59 @@ function computeBaselineDeviation(commit, baseline) {
 
 // ── Composite continuous scoring ──
 
-function computeContinuousScore(commit) {
+function computeContinuousScore(commit, attributionOptions) {
   let score = 0;
   const signals = new Set(commit.aiSignals || []);
+  const weights = attributionOptions.scoreWeights;
 
   // Explicit signatures
-  if (signals.has('coAuthor') || signals.has('generatedWith') || signals.has('assistedBy')) score += 0.85;
-  if (signals.has('coAuthorCopilot') || signals.has('coAuthorCursor') || signals.has('coAuthorCodex')) score += 0.85;
-  if (signals.has('robotEmoji') || signals.has('coAuthorOpencode')) score += 0.85;
-  if (signals.has('authorClaude') || signals.has('authorBot')) score += 0.80;
-  if (signals.has('generatedWithAider') || signals.has('aiderTag')) score += 0.85;
-  if (signals.has('generatedWithCodex') || signals.has('coAuthorCodex')) score += 0.85;
-  if (signals.has('coAuthorWindsurf') || signals.has('coAuthorAugment') || signals.has('coAuthorCline')) score += 0.85;
-  if (signals.has('aiGenerated') || signals.has('generatedByAI') || signals.has('viaAI') || signals.has('aiTag')) score += 0.70;
+  if (signals.has('coAuthor') || signals.has('generatedWith') || signals.has('assistedBy')) score += weights.explicitSignature;
+  if (signals.has('coAuthorCopilot') || signals.has('coAuthorCursor') || signals.has('coAuthorCodex')) score += weights.explicitSignature;
+  if (signals.has('robotEmoji') || signals.has('coAuthorOpencode')) score += weights.explicitSignature;
+  if (signals.has('authorClaude') || signals.has('authorBot')) score += weights.explicitAuthor;
+  if (signals.has('generatedWithAider') || signals.has('aiderTag')) score += weights.explicitSignature;
+  if (signals.has('generatedWithCodex') || signals.has('coAuthorCodex')) score += weights.explicitSignature;
+  if (signals.has('coAuthorWindsurf') || signals.has('coAuthorAugment') || signals.has('coAuthorCline')) score += weights.explicitSignature;
+  if (signals.has('aiGenerated') || signals.has('generatedByAI') || signals.has('viaAI') || signals.has('aiTag')) score += weights.genericAISignature;
 
   // Session signals
-  if (commit.sessionAttribution === 'strong') score += 0.40;
-  else if (commit.sessionAttribution === 'cross-day') score += 0.25;
-  else if (commit.sessionAttribution === 'weak') score += 0.15;
-  else if (commit.sessionAttribution === 'cross-day-weak') score += 0.10;
+  if (commit.sessionAttribution === 'strong') score += weights.sessionStrong;
+  else if (commit.sessionAttribution === 'cross-day') score += weights.sessionCrossDay;
+  else if (commit.sessionAttribution === 'weak') score += weights.sessionWeak;
+  else if (commit.sessionAttribution === 'cross-day-weak') score += weights.sessionCrossDayWeak;
 
   // File overlap
   const overlap = commit.aiEvidenceDetails?.fileOverlapRatio || 0;
-  score += overlap * 0.30;
+  score += overlap * weights.fileOverlap;
 
   // Style heuristic
-  if (signals.has('styleBulletList')) score += 0.15;
-  if (signals.has('styleConventionalScope')) score += 0.05;
-  if (signals.has('styleImperativeMood')) score += 0.10;
-  if (signals.has('styleLongStructuredBody')) score += 0.05;
+  if (signals.has('styleBulletList')) score += weights.styleBulletList;
+  if (signals.has('styleConventionalScope')) score += weights.styleConventionalScope;
+  if (signals.has('styleImperativeMood')) score += weights.styleImperativeMood;
+  if (signals.has('styleLongStructuredBody')) score += weights.styleLongStructuredBody;
 
   // Baseline deviation
-  if (signals.has('baselineDeviationHigh')) score += 0.15;
-  else if (signals.has('baselineDeviationMedium')) score += 0.08;
+  if (signals.has('baselineDeviationHigh')) score += weights.baselineDeviationHigh;
+  else if (signals.has('baselineDeviationMedium')) score += weights.baselineDeviationMedium;
 
   // Negative signals
   const negSignals = new Set(commit.negativeSignals || []);
-  if (negSignals.has('humanMergeCommit')) score -= 0.50;
-  if (negSignals.has('humanInformal')) score -= 0.20;
-  if (negSignals.has('humanSmallScope')) score -= 0.15;
-  if (negSignals.has('humanWIP')) score -= 0.15;
+  if (negSignals.has('humanMergeCommit')) score += weights.negativeMergeCommit;
+  if (negSignals.has('humanInformal')) score += weights.negativeInformal;
+  if (negSignals.has('humanSmallScope')) score += weights.negativeSmallScope;
+  if (negSignals.has('humanWIP')) score += weights.negativeWIP;
 
   // Baseline match (human pattern)
-  if (signals.has('humanBaselineMatch')) score -= 0.10;
+  if (signals.has('humanBaselineMatch')) score += weights.humanBaselineMatch;
 
   return Math.max(0, Math.min(1, score));
 }
 
-function scoreToConfidence(score) {
-  if (score >= 0.75) return AI_CONFIDENCE.HIGH;
-  if (score >= 0.45) return AI_CONFIDENCE.MEDIUM;
-  if (score >= 0.20) return AI_CONFIDENCE.LOW;
+function scoreToConfidence(score, attributionOptions) {
+  const thresholds = attributionOptions.confidenceThresholds;
+  if (score >= thresholds.high) return AI_CONFIDENCE.HIGH;
+  if (score >= thresholds.medium) return AI_CONFIDENCE.MEDIUM;
+  if (score >= thresholds.low) return AI_CONFIDENCE.LOW;
   return AI_CONFIDENCE.NONE;
 }
 
@@ -514,7 +539,7 @@ export function detectAICommit(subject = '', author = '', body = '') {
 
 // ── 聚合函数 ──
 
-export function computeAIContribution(commits, toolFilter = null) {
+export function computeAIContribution(commits, toolFilter = null, options = {}) {
   let aiCommits = 0, aiLinesAdded = 0, aiLinesDeleted = 0;
   let possibleAICommits = 0, possibleAILinesAdded = 0, possibleAILinesDeleted = 0;
   let weightedAILinesAdded = 0, weightedAILinesDeleted = 0;
@@ -522,6 +547,8 @@ export function computeAIContribution(commits, toolFilter = null) {
   let aiFileLinesAdded = 0, aiFileLinesDeleted = 0;
   let highConfidenceCommits = 0, mediumConfidenceCommits = 0, lowConfidenceCommits = 0;
   let totalLinesAdded = 0, totalLinesDeleted = 0;
+  const attributionOptions = resolveAttributionOptions(options.attribution || options);
+  const confidenceWeights = attributionOptions.confidenceWeights;
   const allCommits = commits || [];
   for (const c of allCommits) {
     totalLinesAdded += c.linesAdded || 0;
@@ -552,6 +579,12 @@ export function computeAIContribution(commits, toolFilter = null) {
       fileDeleted = c.linesDeleted || 0;
     }
 
+    // Step blame override: use precise line-level attribution when available
+    if (c.lineBlame) {
+      fileAdded = c.lineBlame.aiLines || 0;
+      fileDeleted = c.lineBlame.aiDeletedLines || 0;
+    }
+
     if (isCountedAIConfidence(confidence)) {
       aiCommits++;
       aiCommitLinesAdded += c.linesAdded || 0;
@@ -565,7 +598,7 @@ export function computeAIContribution(commits, toolFilter = null) {
     }
 
     // 加权计算：所有归因的 commit 都参与（包括 LOW）
-    const weight = CONFIDENCE_WEIGHTS[confidence] || 0;
+    const weight = confidenceWeights[confidence] || 0;
     if (weight > 0) {
       weightedAILinesAdded += fileAdded * weight;
       weightedAILinesDeleted += fileDeleted * weight;
@@ -652,7 +685,9 @@ export function parseGitLogOutput(output, repo = '') {
 
   const flush = () => {
     if (!current) return;
-    const dateKey = current.date.slice(0, 10);
+    // 使用本地日期做 daily stats key（用户期望看到的日期），
+    // UTC 日期（current.date）仅用于与 session 时间戳比较
+    const dateKey = current.dateLocal || current.date.slice(0, 10);
     // 注入 conventional 类型 + AI 信号
     const conv = parseConventional(current.subject);
     const ai = detectAICommit(current.subject, current.author, current.body || '');
@@ -700,7 +735,9 @@ export function parseGitLogOutput(output, repo = '') {
       const parts = header.split('|');
       const hash = parts[0] || '';
       const dateRaw = (parts[1] || '');
-      // Normalize to UTC ISO for consistent comparison with session dates
+      // 保留本地日期用于 commitsByDate（用户看到的日期）
+      const dateLocal = dateRaw.slice(0, 10) || '';
+      // Normalize to UTC ISO for consistent comparison with session timestamps
       const dateMs = Date.parse(dateRaw);
       const date = Number.isFinite(dateMs)
         ? new Date(dateMs).toISOString().slice(0, 19) + 'Z'
@@ -711,6 +748,7 @@ export function parseGitLogOutput(output, repo = '') {
         repo,
         hash,
         date,
+        dateLocal,
         author,
         subject,
         body: '',
@@ -769,15 +807,14 @@ function sanitizeArg(s) {
   return String(s || '').replace(/[`$"\\|;&<>!\n\r]/g, '');
 }
 
-function buildGitArgs(since, until, author) {
-  const sinceFull = since.includes('T') ? since : since + 'T00:00:00';
-  const safeSince = sanitizeArg(sinceFull);
-  const safeUntil = sanitizeArg(until);
-  const authorArg = author ? ` --author="${sanitizeArg(author)}"` : '';
-  // 格式：哨兵行(subject) → body 行(可多行) → ENDBODY 行 → numstat 行
-  const pretty = `--pretty=format:"${COMMIT_SENTINEL}%H|%ad|%ae|%s%n%B${BODY_END}"`;
-  return `--all --no-renames ${pretty} --date=iso-strict --numstat --since="${safeSince}" --until="${safeUntil}"${authorArg}`;
-}
+function buildGitArgs(since, until) {
+  const sinceFull = since.includes('T') ? since : since + 'T00:00:00';
+  const safeSince = sanitizeArg(sinceFull);
+  const safeUntil = sanitizeArg(until);
+  // 格式：哨兵行(subject) → body 行(可多行) → ENDBODY 行 → numstat 行
+  const pretty = `--pretty=format:"${COMMIT_SENTINEL}%H|%ad|%ae|%s%n%B${BODY_END}"`;
+  return `--all --no-renames ${pretty} --date=iso-strict --numstat --since="${safeSince}" --until="${safeUntil}"`;
+}
 
 function mergeGitStats(target, source) {
   target.commits += source.commits;
@@ -800,37 +837,105 @@ function mergeGitStats(target, source) {
   // filesChanged 在 merge 完后由 finalize 重新计算（跨 repo 去重）
 }
 
-function recomputeFilesChanged(stats) {
-  const set = new Set();
-  for (const c of stats.commitList || []) {
-    for (const f of c.files || []) set.add((c.repo || '') + '::' + f.path);
-  }
-  stats.filesChanged = set.size;
-}
+function recomputeFilesChanged(stats) {
+  const set = new Set();
+  for (const c of stats.commitList || []) {
+    for (const f of c.files || []) set.add((c.repo || '') + '::' + f.path);
+  }
+  stats.filesChanged = set.size;
+}
+
+function recomputeStatsFromCommitList(stats) {
+  stats.commits = 0;
+  stats.filesChanged = 0;
+  stats.linesAdded = 0;
+  stats.linesDeleted = 0;
+  stats.commitsByDate = {};
+  stats.linesByDate = {};
+
+  for (const c of stats.commitList || []) {
+    const dateKey = c.dateLocal || (c.date || '').slice(0, 10);
+    stats.commits++;
+    stats.commitsByDate[dateKey] = (stats.commitsByDate[dateKey] || 0) + 1;
+    if (!stats.linesByDate[dateKey]) stats.linesByDate[dateKey] = { added: 0, deleted: 0, files: 0 };
+    stats.linesByDate[dateKey].added += c.linesAdded || 0;
+    stats.linesByDate[dateKey].deleted += c.linesDeleted || 0;
+    stats.linesByDate[dateKey].files += (c.files || []).length;
+    stats.linesAdded += c.linesAdded || 0;
+    stats.linesDeleted += c.linesDeleted || 0;
+  }
+  recomputeFilesChanged(stats);
+}
+
+function markAuthorOwnership(stats, expectedAuthor) {
+  const normalizedExpected = (expectedAuthor || '').toLowerCase();
+  for (const c of stats.commitList || []) {
+    c.expectedAuthor = expectedAuthor || null;
+    c.authorMatchesConfig = normalizedExpected
+      ? (c.author || '').toLowerCase() === normalizedExpected
+      : null;
+  }
+}
+
+function hasLocalSessionEvidence(commit) {
+  if (!commit.sessionId) return false;
+  if (commit.sessionAttribution === 'strong') return true;
+  return (commit.aiEvidenceDetails?.matchedFileCount || 0) > 0;
+}
+
+function filterCommitsForUser(stats) {
+  const commits = stats.commitList || [];
+  const hasAuthorOwnershipMetadata = commits.some(c => c.expectedAuthor || c.authorMatchesConfig !== undefined);
+
+  for (const c of commits) {
+    c.countedForUser = !hasAuthorOwnershipMetadata
+      || c.authorMatchesConfig === true
+      || hasLocalSessionEvidence(c);
+  }
+
+  if (!hasAuthorOwnershipMetadata) return;
+  stats.commitList = commits.filter(c => c.countedForUser);
+  recomputeStatsFromCommitList(stats);
+}
 
 // ── async versions (server) with cache ──
 
 const gitCache = new Map();
+const GIT_CACHE_MAX = 500;
+const GIT_CACHE_TTL = 60_000;
 const CACHE_VERSION = 'v3';
 
-async function getGitStatsAsync(repoPath, since, until, author = null) {
-  const cacheKey = `${repoPath}|${since}|${until}|${CACHE_VERSION}`;
-  const cached = gitCache.get(cacheKey);
-  if (cached && Date.now() - cached.ts < 60_000) return cached.stats;
+function evictGitCache() {
+  const now = Date.now();
+  for (const [key, val] of gitCache) {
+    if (now - val.ts > GIT_CACHE_TTL) gitCache.delete(key);
+  }
+  while (gitCache.size > GIT_CACHE_MAX) {
+    const oldest = gitCache.keys().next().value;
+    gitCache.delete(oldest);
+  }
+}
+
+async function getGitStatsAsync(repoPath, since, until, author = null) {
+  const cacheKey = `${repoPath}|${since}|${until}|${CACHE_VERSION}`;
+  const cached = gitCache.get(cacheKey);
+  if (cached && Date.now() - cached.ts < GIT_CACHE_TTL) return cached.stats;
 
   try {
     await execAsync('git rev-parse --git-dir', { cwd: repoPath });
   } catch {
     return emptyResult();
   }
-
-  try {
-    const output = await execAsync(`git log ${buildGitArgs(since, until, author)}`, {
-      cwd: repoPath, encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024,
-    });
-    const stats = parseGitLogOutput(output, repoPath);
-    gitCache.set(cacheKey, { stats, ts: Date.now() });
-    return stats;
+
+  try {
+    const output = await execAsync(`git log ${buildGitArgs(since, until)}`, {
+      cwd: repoPath, encoding: 'utf-8', maxBuffer: 50 * 1024 * 1024,
+    });
+    const stats = parseGitLogOutput(output, repoPath);
+    markAuthorOwnership(stats, author);
+    gitCache.set(cacheKey, { stats, ts: Date.now() });
+    evictGitCache();
+    return stats;
   } catch {
     return emptyResult();
   }
@@ -867,31 +972,6 @@ export function invalidateGitCache() {
 
 // ── Session ↔ Commit 关联 ──
 
-function normalizePath(p) {
-  if (!p) return '';
-  return p.replace(/\\/g, '/').replace(/\/+/g, '/').replace(/\/$/, '').toLowerCase();
-}
-
-function toRelativeRepoPath(filePath, repoPath) {
-  const fileN = normalizePath(filePath);
-  const repoN = normalizePath(repoPath);
-  if (!fileN) return '';
-  if (!repoN) return normalizeCommitFilePath(fileN.replace(/^[a-z]:\//i, ''));
-  if (fileN === repoN) return '';
-  if (fileN.startsWith(repoN + '/')) return fileN.slice(repoN.length + 1);
-  const repoTail = repoN.split('/').filter(Boolean).pop();
-  if (repoTail) {
-    const marker = `/${repoTail}/`;
-    const idx = fileN.indexOf(marker);
-    if (idx >= 0) return fileN.slice(idx + marker.length);
-  }
-  return fileN;
-}
-
-function normalizeCommitFilePath(filePath) {
-  return normalizePath(filePath).replace(/^\.?\//, '');
-}
-
 function looksLikeFilePath(value) {
   if (typeof value !== 'string') return false;
   const v = value.trim();
@@ -984,21 +1064,43 @@ function extractTouchedFilesFromSession(session) {
   const repoPath = session.project || '';
   const files = new Set();
   for (const tc of session.toolSequence || []) {
-    // Write/Edit/NotebookEdit/MultiEdit 工具
-    if (['Write', 'Edit', 'NotebookEdit', 'MultiEdit'].includes(tc.name)) {
-      const rawPaths = collectFilePaths(tc.input);
+    const name = tc.name || '';
+    const input = tc.input || {};
+
+    // Claude 内置工具：Write/Edit/NotebookEdit/MultiEdit
+    if (name === 'Write' || name === 'Edit' || name === 'NotebookEdit' || name === 'MultiEdit') {
+      const rawPaths = collectFilePaths(input);
       for (const rawPath of rawPaths) {
-        const relative = normalizeCommitFilePath(toRelativeRepoPath(rawPath, repoPath));
+        const relative = normalizeCommitFilePath(toRepoRelativePath(rawPath, repoPath));
         if (relative) files.add(relative);
       }
       continue;
     }
+
+    // MCP Serena 工具：replace_content, replace_symbol_body, insert_before/after_symbol 等
+    // 以及其他带 relative_path/file_path 的 MCP 工具
+    if (name.startsWith('mcp__serena') || name.startsWith('mcp__')) {
+      // Serena 使用 relative_path，其他 MCP 工具可能使用 file_path/path
+      const filePath = input.relative_path || input.file_path || input.path || '';
+      if (filePath && typeof filePath === 'string') {
+        const relative = normalizeCommitFilePath(toRepoRelativePath(filePath, repoPath));
+        if (relative) files.add(relative);
+      }
+      // 部分 MCP 工具在 input 中嵌套了目标文件
+      const rawPaths = collectFilePaths(input);
+      for (const rawPath of rawPaths) {
+        const relative = normalizeCommitFilePath(toRepoRelativePath(rawPath, repoPath));
+        if (relative) files.add(relative);
+      }
+      continue;
+    }
+
     // Bash 工具 — 从命令中提取文件路径
-    if (tc.name === 'Bash') {
-      const cmd = tc.input?.command || '';
+    if (name === 'Bash') {
+      const cmd = input.command || '';
       const rawPaths = extractFilePathsFromBashCommand(cmd);
       for (const rawPath of rawPaths) {
-        const relative = normalizeCommitFilePath(toRelativeRepoPath(rawPath, repoPath));
+        const relative = normalizeCommitFilePath(toRepoRelativePath(rawPath, repoPath));
         if (relative) files.add(relative);
       }
     }
@@ -1022,34 +1124,45 @@ function computeFileOverlap(sessionTouchedFiles, commitFiles) {
   });
 }
 
-// 用于 commit.repo 与 session.project 之间宽松对齐：
-// decodeProjectName 把 `-` 解码为 `/`（D--foo-bar → D://foo/bar），
-// 所以将 `-` 和 `_` 统一转为 `/`，再以 `/` 为分隔符保留路径语义。
-// 这样 d:/foo-bar 和 d:/foo/bar 匹配（同一项目的解码差异），
-// 但 d:/foobar 和 d:/foo/bar 不匹配（不同项目）。
-function projectKey(p) {
-  return normalizePath(p).replace(/[-_]/g, '/').replace(/\/+/g, '/').replace(/\/$/, '').replace(/[^a-z0-9/]/g, '');
-}
-
-// 精确路径包含：parent 是 child 的前缀，且后面紧跟 '/' 或完全匹配
-function pathContains(parent, child) {
-  if (parent === child) return true;
-  return child.startsWith(parent + '/');
-}
-
-function projectMatches(commitRepoN, sessionProjectN) {
-  if (!commitRepoN || !sessionProjectN) return true;
-  // 精确路径匹配（双向：commit repo 可能是 session project 的子目录或反之）
-  if (pathContains(commitRepoN, sessionProjectN) || pathContains(sessionProjectN, commitRepoN)) return true;
-  // 宽松 key 对比（兜底：处理路径解码差异）
-  const a = projectKey(commitRepoN);
-  const b = projectKey(sessionProjectN);
-  return a && b && (a === b);
+function sortAttributionCandidates(candidates) {
+  return candidates.sort((a, b) => {
+    if (b.score !== a.score) return b.score - a.score;
+    return a.distanceMs - b.distanceMs;
+  });
 }
 
-const BASH_GIT_COMMIT_RE = /\bgit\s+commit\b/i;
-const STRONG_WINDOW_BEFORE_MS = 30 * 1000;       // 30s before bash invocation
-const STRONG_WINDOW_AFTER_MS = 5 * 60 * 1000;    // 5min after
+function candidateFromSession(commit, session, distanceMs) {
+  const overlap = computeFileOverlap(session.touchedFiles || [], commit.files || []);
+  return scoreSessionCandidate(commit, session, {
+    distanceMs,
+    fileOverlapRatio: overlap.fileOverlapRatio,
+    matchedFiles: overlap.matchedFiles,
+    projectMatches: true,
+  });
+}
+
+function getStepSessionIdCandidates(sessionId, session) {
+  if (!sessionId) return [];
+  const candidates = [sessionId];
+  if (sessionId.includes(':')) return candidates;
+
+  const originByTool = {
+    claude: 'claude_code',
+    codex: 'codex_cli',
+  };
+  const origin = originByTool[session?.primaryTool];
+  if (origin) {
+    candidates.push(`${origin}:${sessionId}`);
+  } else {
+    candidates.push(`claude_code:${sessionId}`, `codex_cli:${sessionId}`);
+  }
+
+  return [...new Set(candidates)];
+}
+
+const BASH_GIT_COMMIT_RE = /\bgit\s+commit\b/i;
+const STRONG_WINDOW_BEFORE_MS = 30 * 1000;       // 30s before bash invocation
+const STRONG_WINDOW_AFTER_MS = 5 * 60 * 1000;    // 5min after
 
 function toMs(iso) {
   if (!iso) return NaN;
@@ -1071,18 +1184,22 @@ function extractCommitBashTimestamps(session) {
   return ts;
 }
 
-export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 * 60 * 1000 } = {}) {
+export function attributeCommitsToSessions(commits, sessions, options = {}) {
   const result = { sessionCommitMap: {} };
   if (!commits?.length || !sessions?.length) return result;
+  const attributionOptions = resolveAttributionOptions(options.attribution || options);
+  const bufferMs = options.bufferMs ?? attributionOptions.windows.weakWindowMinutes * 60 * 1000;
+  const crossDayMs = attributionOptions.windows.crossDayWindowDays * 24 * 3600 * 1000;
 
   // 预计算每个 session 的 ms 范围 + 项目归一化 + bash commit 时间戳
   const sIndex = sessions.map(s => ({
     id: s.id,
-    projectN: normalizePath(s.project || ''),
+    projectN: normalizePathForGit(s.project || ''),
     startMs: toMs(s.startTime),
     endMs: toMs(s.endTime),
     bashTs: extractCommitBashTimestamps(s),
     touchedFiles: extractTouchedFilesFromSession(s),
+    primaryTool: s.primaryTool,
   }));
 
   // 阶段 1：重置 + 强信号匹配（Bash git commit）
@@ -1090,13 +1207,13 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
     c.sessionId = null;
     c.sessionAttribution = null;
     const commitMs = toMs(c.date);
-    const commitRepoN = normalizePath(c.repo || '');
+    const commitRepoN = normalizePathForGit(c.repo || '');
     if (!Number.isFinite(commitMs)) continue;
 
     let matched = null;
     for (const s of sIndex) {
       if (!s.bashTs.length) continue;
-      if (!projectMatches(commitRepoN, s.projectN)) continue;
+      if (!projectMatchesFromGitPaths(commitRepoN, s.projectN)) continue;
       for (const bts of s.bashTs) {
         if (commitMs >= bts - STRONG_WINDOW_BEFORE_MS && commitMs <= bts + STRONG_WINDOW_AFTER_MS) {
           matched = s;
@@ -1129,14 +1246,13 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
   for (const c of commits) {
     if (c.sessionAttribution) continue;
     const commitMs = toMs(c.date);
-    const commitRepoN = normalizePath(c.repo || '');
+    const commitRepoN = normalizePathForGit(c.repo || '');
     if (!Number.isFinite(commitMs)) continue;
 
-    let best = null;
-    let bestDist = Infinity;
+    const candidates = [];
     for (const s of sIndex) {
       if (!Number.isFinite(s.startMs) || !Number.isFinite(s.endMs)) continue;
-      if (!projectMatches(commitRepoN, s.projectN)) continue;
+      if (!projectMatchesFromGitPaths(commitRepoN, s.projectN)) continue;
 
       // author 一致性校验：session 有已知 author 时，commit author 必须匹配
       const knownAuthors = sessionAuthors.get(s.id);
@@ -1147,13 +1263,13 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
       if (commitMs < lo || commitMs > hi) continue;
       const mid = (s.startMs + s.endMs) / 2;
       const dist = Math.abs(commitMs - mid);
-      if (dist < bestDist) {
-        best = s;
-        bestDist = dist;
-      }
+      candidates.push(candidateFromSession(c, s, dist));
     }
 
-    if (best) {
+    if (candidates.length) {
+      const ranked = sortAttributionCandidates(candidates);
+      const best = sIndex.find(s => s.id === ranked[0].sessionId);
+      c.attributionCandidates = ranked.slice(0, 3);
       c.sessionId = best.id;
       c.sessionAttribution = 'weak';
       if (!result.sessionCommitMap[best.id]) result.sessionCommitMap[best.id] = [];
@@ -1166,29 +1282,28 @@ export function attributeCommitsToSessions(commits, sessions, { bufferMs = 30 *
   for (const c of commits) {
     if (c.sessionAttribution) continue;
     const commitMs = toMs(c.date);
-    const commitRepoN = normalizePath(c.repo || '');
+    const commitRepoN = normalizePathForGit(c.repo || '');
     if (!Number.isFinite(commitMs)) continue;
 
-    let best = null;
-    let bestDist = Infinity;
+    const candidates = [];
     for (const s of sIndex) {
-      if (!projectMatches(commitRepoN, s.projectN)) continue;
+      if (!projectMatchesFromGitPaths(commitRepoN, s.projectN)) continue;
       if (!Number.isFinite(s.endMs)) continue;
       // commit 必须在 session 结束之后（不能是之前漏掉的）
       if (commitMs < s.endMs) continue;
       const dist = commitMs - s.endMs;
       // 最多跨 3 天
-      if (dist > 3 * 24 * 3600 * 1000) continue;
+      if (dist > crossDayMs) continue;
       // author 校验：session 有已知 author 时，commit author 必须匹配
       const knownAuthors = sessionAuthors.get(s.id);
       if (knownAuthors?.size && c.author && !knownAuthors.has(c.author.toLowerCase())) continue;
-      if (dist < bestDist) {
-        best = s;
-        bestDist = dist;
-      }
+      candidates.push(candidateFromSession(c, s, dist));
     }
 
-    if (best) {
+    if (candidates.length) {
+      const ranked = sortAttributionCandidates(candidates);
+      const best = sIndex.find(s => s.id === ranked[0].sessionId);
+      c.attributionCandidates = ranked.slice(0, 3);
       // 文件交集前置检查：无交集时标记为 cross-day-weak
       const commitFiles = (c.files || []).map(f => (f.path || '').replace(/\\/g, '/'));
       const sessionFiles = best.touchedFiles || [];
@@ -1231,15 +1346,17 @@ export function attachCommitsToSessions(sessions, commitList) {
 }
 
 // 一次性收尾：跑 attribution + 三个聚合
-export function finalizeGitStats(merged, sessions = [], options = {}) {
-  if (!merged) return merged;
-  const fileOverrides = loadAttributionOverrides();
+export async function finalizeGitStats(merged, sessions = [], options = {}) {
+  if (!merged) return merged;
+  const attributionOptions = resolveAttributionOptions(options.attribution || options);
+  const stepTrackingOptions = options.stepTracking || {};
+  const fileOverrides = loadAttributionOverrides();
   const inputOverrides = options.overrides || {};
   const mergedOverrides = {
     commits: { ...fileOverrides.commits, ...(inputOverrides.commits || {}) },
     files: { ...fileOverrides.files, ...(inputOverrides.files || {}) },
   };
-  const { sessionCommitMap } = attributeCommitsToSessions(merged.commitList, sessions);
+  const { sessionCommitMap } = attributeCommitsToSessions(merged.commitList, sessions, { attribution: attributionOptions });
   merged.sessionCommitMap = sessionCommitMap;
   const sessionsById = new Map((sessions || []).map(s => [s.id, s]));
   for (const s of sessions || []) {
@@ -1261,7 +1378,71 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
     }
   }
 
-  // Step 1.5: compute developer behavioral baselines
+  // Step 1.5: Enrich commits with line-level step blame when available
+  const stepTrackers = new Map();
+  if (stepTrackingOptions.enabled !== false) try {
+    const { StepTracker } = await import('./step-tracker.js');
+    const projectRoots = [...new Set((sessions || []).map(s => s.project).filter(Boolean))];
+    // Also check repo paths from commits
+    for (const c of merged.commitList || []) {
+      if (c.repo) projectRoots.push(c.repo);
+    }
+    for (const root of [...new Set(projectRoots.map(normalizePathForGit))]) {
+      if (!root) continue;
+      const tracker = new StepTracker(root, {
+        dbPath: stepTrackingOptions.dbPath,
+        maxFileSize: stepTrackingOptions.maxFileSize,
+      });
+      if (await tracker.isAvailableAsync()) {
+        await tracker.open();
+        stepTrackers.set(root, tracker);
+      }
+    }
+  } catch {
+    for (const tracker of stepTrackers.values()) tracker.close();
+    stepTrackers.clear();
+  }
+
+  if (stepTrackers.size > 0) {
+    for (const c of merged.commitList || []) {
+      if (!c.sessionId) continue;
+      const candidateRoots = [
+        c.repo,
+        sessionsById.get(c.sessionId)?.project,
+      ].filter(Boolean);
+      let stepTracker = null;
+      for (const candidateRoot of candidateRoots) {
+        const normalizedCandidate = normalizePathForGit(candidateRoot);
+        for (const [root, tracker] of stepTrackers.entries()) {
+          if (projectMatchesFromGitPaths(root, normalizedCandidate)) {
+            stepTracker = tracker;
+            break;
+          }
+        }
+        if (stepTracker) break;
+      }
+      if (!stepTracker && stepTrackers.size === 1) {
+        stepTracker = stepTrackers.values().next().value;
+      }
+      if (!stepTracker) continue;
+      try {
+        const session = sessionsById.get(c.sessionId);
+        for (const stepSessionId of getStepSessionIdCandidates(c.sessionId, session)) {
+          const lineBlame = stepTracker.getLineAttributionForCommit({
+            ...c,
+            sessionId: stepSessionId,
+          });
+          if (lineBlame) {
+            c.lineBlame = lineBlame;
+            break;
+          }
+        }
+      } catch { /* best effort */ }
+    }
+    for (const tracker of stepTrackers.values()) tracker.close();
+  }
+
+  // Step 1.6: compute developer behavioral baselines
   const authorBaselines = computeAuthorBaseline(merged.commitList);
 
   // Step 2: 信心度评估（保持现有逻辑）
@@ -1367,19 +1548,21 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
   }
 
   // Step 2.5: composite continuous scoring for all commits
-  for (const c of merged.commitList || []) {
-    c.aiScore = computeContinuousScore(c);
-    const mappedConfidence = scoreToConfidence(c.aiScore);
-    // Only override if no explicit signature and continuous score disagrees
-    if (c.attributionType !== 'explicit') {
+  for (const c of merged.commitList || []) {
+    c.aiScore = computeContinuousScore(c, attributionOptions);
+    const mappedConfidence = scoreToConfidence(c.aiScore, attributionOptions);
+    // Only override if no explicit signature and continuous score disagrees
+    if (c.attributionType !== 'explicit') {
       c.aiConfidence = pickHigherConfidence(c.aiConfidence, mappedConfidence);
       c.isAI = isCountedAIConfidence(c.aiConfidence);
-      c.aiAssisted = c.aiConfidence !== AI_CONFIDENCE.NONE;
-    }
-  }
-
-  const attributionItems = [];
-  for (const c of merged.commitList || []) {
+      c.aiAssisted = c.aiConfidence !== AI_CONFIDENCE.NONE;
+    }
+  }
+
+  filterCommitsForUser(merged);
+
+  const attributionItems = [];
+  for (const c of merged.commitList || []) {
     const commitOverride = mergedOverrides.commits[c.hash] || null;
     const fileOverride = (c.files || []).find(f => mergedOverrides.files[`${c.hash}:${f.path}`]);
     const fileOverrideValue = fileOverride ? mergedOverrides.files[`${c.hash}:${fileOverride.path}`] : null;
@@ -1409,7 +1592,7 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
   }
 
   // Step 3: 全局 + 按工具聚合
-  merged.aiContribution = computeAIContribution(merged.commitList);
+  merged.aiContribution = computeAIContribution(merged.commitList, null, attributionOptions);
   // 动态收集所有出现的 attributedTool，确保新工具自动覆盖
   const toolSet = new Set();
   for (const c of merged.commitList || []) {
@@ -1419,7 +1602,7 @@ export function finalizeGitStats(merged, sessions = [], options = {}) {
   for (const t of ['claude', 'codex', 'opencode', 'generic-ai']) toolSet.add(t);
   merged.aiContributionByTool = {};
   for (const tool of toolSet) {
-    merged.aiContributionByTool[tool] = computeAIContribution(merged.commitList, tool);
+    merged.aiContributionByTool[tool] = computeAIContribution(merged.commitList, tool, attributionOptions);
   }
   merged.attributionSummary = aggregateAttribution(attributionItems);
   merged.commitTypes = computeCommitTypes(merged.commitList);