model-eol 0.10.0 → 0.10.1

package/check.mjs

@@ -479,7 +479,7 @@ if (incompleteNotes.length && (command === 'check' || command === 'plan')) {
   if (!ALLOW_INCOMPLETE) return 2
 }
 
-const evaluateBase = ({ treeRoot, files, configFile, feedsDir, classificationPathFor }) => {
+const loadBase = ({ configFile, feedsDir }) => {
   let config = repositoryConfig
   let baseFeeds = feedData
   try {
@@ -498,13 +498,18 @@ const evaluateBase = ({ treeRoot, files, configFile, feedsDir, classificationPat
   }
   const basePolicyError = policyError(config, baseFeeds, values.via)
   if (basePolicyError) throw new BaseUnavailableError(`base policy: ${basePolicyError}`)
+  return { config, feeds: baseFeeds }
+}
+
+const evaluateBase = ({ treeRoot, files, configFile, feedsDir, inputs, classificationPathFor }) => {
+  const { config, feeds } = inputs ?? loadBase({ configFile, feedsDir })
   try {
     const base = evaluateTargets({
       targets: files,
       config,
       roots: [treeRoot],
       ignoredFiles: configFile ? [configFile] : [],
-      feedData: baseFeeds,
+      feedData: feeds,
       overrides,
       includeDocs: INCLUDE_DOCS,
       noGit: true,
@@ -517,9 +522,10 @@ const evaluateBase = ({ treeRoot, files, configFile, feedsDir, classificationPat
 }
 
 let changedFindings = checkFindings
+let changedStats
 if (CHANGED_BASE !== null) {
   try {
-    changedFindings = selectChangedFindings({
+    const selection = selectChangedFindings({
       targets,
       baseRef: CHANGED_BASE,
       findings,
@@ -527,12 +533,24 @@ if (CHANGED_BASE !== null) {
       scannedFiles: scan.files,
       configFile: configLocation.file,
       feedsDir: FEEDS_DIR,
+      head: { config: repositoryConfig, feeds: feedData, overrides, repoPathFor: file => repoPathForFile(file, configLocation.roots) },
+      loadBase,
       evaluateBase,
     })
+    changedFindings = selection.findings
+    changedStats = selection.stats
   } catch (e) {
     console.error(`--changed failed: ${e.message}`)
     return 2
   }
+  const statsFile = process.env.MODEL_EOL_CHANGED_STATS
+  if (statsFile) {
+    try {
+      fs.writeFileSync(statsFile, `${JSON.stringify({ schema: 'model-eol/changed-stats@0', ...changedStats, total_ms: Math.round(performance.now()) })}\n`)
+    } catch (e) {
+      console.error(printable(`model-eol: warning: could not write --changed stats to ${statsFile}: ${e.message}`))
+    }
+  }
 }
 const bad = changedFindings.filter(isBad)
 const inventory = () => buildInventory({ scan, findings, days: DAYS, via: VIA, scope: SCOPE, targets })

package/lib/changed.mjs

@@ -3,6 +3,7 @@ import os from 'node:os'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 
+import { configForRepoPath, mappedRoutesForRepoPath, repoPathMatches, routesForRepoPath } from './config.mjs'
 import { isBad } from './feeds.mjs'
 import { MAX_FILE_BYTES, SKIP_DIRS, baseLineFor, changedLinesForTargets, displayPath, incompleteScanNotes, isAddedLine } from './scanner.mjs'
 
@@ -130,9 +131,40 @@ const scannableTreePath = relative => relative.split('/').every(part =>
 const regularBlob = entry => entry.type === 'blob' && (entry.mode === '100644' || entry.mode === '100755')
 
 const untrackedFiles = (gitRoot, relativeTargets) => new Set(nulRecords(runGit(gitRoot, 'ls-files', [
-  '--literal-pathspecs', 'ls-files', '-z', '--others', '--exclude-standard', '--', ...relativeTargets,
+  '-c', 'core.fsmonitor=false', '--literal-pathspecs', 'ls-files', '-z', '--others', '--exclude-standard', '--', ...relativeTargets,
 ])).filter(relative => !relative.endsWith('/')).map(relative => path.resolve(gitRoot, relative)))
 
+const HASH_CHUNK_BYTES = 64 * 1024
+
+// Hashes raw bytes with paths as literal arguments: --stdin-paths unquotes names, and filters would run PR-routed drivers.
+const rawOids = (gitRoot, relatives) => {
+  const oids = []
+  for (let start = 0; start < relatives.length;) {
+    let end = start
+    let bytes = 0
+    while (end < relatives.length && (end === start || bytes + relatives[end].length < HASH_CHUNK_BYTES)) bytes += relatives[end++].length + 1
+    const chunk = relatives.slice(start, end)
+    let output = []
+    try {
+      output = runGit(gitRoot, 'hash-object', ['hash-object', '--no-filters', '--', ...chunk]).toString('utf8').split('\n')
+    } catch {
+    }
+    for (let index = 0; index < chunk.length; index++) oids.push(output[index] ?? null)
+    start = end
+  }
+  return oids
+}
+
+// git diff trusts index stat data and skips assume-unchanged and skip-worktree entries, so compare the bytes the scanner reads.
+const editedWithoutHunks = (gitRoot, checks, baseListing) => {
+  if (!checks.length) return new Set()
+  const listing = baseListing()
+  const hashable = checks.filter(check => listing.get(check.baseRelative)?.type === 'blob')
+  const oids = rawOids(gitRoot, hashable.map(check => check.headRelative))
+  const same = new Set(hashable.filter((check, index) => oids[index] === listing.get(check.baseRelative).oid).map(check => check.absolute))
+  return new Set(checks.filter(check => !same.has(check.absolute)).map(check => check.absolute))
+}
+
 const parseTree = output => {
   const entries = new Map()
   for (const record of nulRecords(output)) {
@@ -359,61 +391,176 @@ const baseSummary = finding => ({
   effective_scope: finding.effective_scope,
 })
 
-export const selectChangedFindings = ({ targets, baseRef, findings, checkFindings, scannedFiles, configFile, feedsDir, evaluateBase }) => {
+// Waiver order, reason, and owner never change whether a finding is bad; route order does (the last match wins).
+const policyKey = (config, repoPath, overrides) => {
+  const policy = configForRepoPath(config, repoPath)
+  return JSON.stringify({
+    days: overrides.days === undefined ? policy.days : null,
+    scope: overrides.scope === undefined ? policy.scope : null,
+    via: overrides.via === undefined ? policy.via : null,
+    ignore_models: [...policy.ignore.models].sort(),
+    excluded: repoPathMatches(repoPath, policy.ignore.paths),
+    waivers: policy.waivers.map(({ model, via = null, expires }) => JSON.stringify([model, via, expires])).sort(),
+    routes: routesForRepoPath(config, repoPath).map(({ via, match = null, model = null }) => [via, match, model]),
+  })
+}
+
+const feedRecords = feeds =>
+  new Map([...feeds.entries.values()].map(record => [record.entry.id, JSON.stringify([record.publisher, record.entry])]))
+
+const changedFeedIds = (head, base) => {
+  const headRecords = feedRecords(head)
+  const baseRecords = feedRecords(base)
+  return new Set([...headRecords.keys(), ...baseRecords.keys()].filter(id => headRecords.get(id) !== baseRecords.get(id)))
+}
+
+const changedFeedKeys = (head, base) =>
+  new Set([...head.keys, ...base.keys].filter(key => head.entries.get(key)?.entry.id !== base.entries.get(key)?.entry.id))
+
+const inputNarrowing = ({ head, base, findings }) => {
+  const ids = changedFeedIds(head.feeds, base.feeds)
+  const keys = changedFeedKeys(head.feeds, base.feeds)
+  const changedTarget = key => keys.has(key) || ids.has(head.feeds.entries.get(key)?.entry.id)
+  const byFile = new Map()
+  for (const finding of findings) {
+    const absolute = path.resolve(finding.file)
+    if (!byFile.has(absolute)) byFile.set(absolute, [])
+    byFile.get(absolute).push(finding)
+  }
+  return {
+    config: ({ absolute, baseRepoPath }) => baseRepoPath === null ||
+      policyKey(head.config, head.repoPathFor(absolute), head.overrides) !== policyKey(base.config, baseRepoPath, head.overrides),
+    feeds: ({ absolute }) => {
+      const fileFindings = byFile.get(absolute) ?? []
+      return fileFindings.some(finding => ids.has(finding.id) || keys.has(finding.matched)) ||
+        (fileFindings.length > 0 && mappedRoutesForRepoPath(head.config, head.repoPathFor(absolute)).some(route => changedTarget(route.model)))
+    },
+  }
+}
+
+const materializeInputs = ({ tempRoot, baseRef, config, feeds }) => {
+  const treeRoot = path.join(tempRoot, 'tree')
+  fs.mkdirSync(treeRoot)
+  const replacements = [[`${treeRoot}${path.sep}`, `${baseRef}:`], [treeRoot, `${baseRef}:`]]
+  let configFile
+  if (config.changed) {
+    configFile = null
+    if (config.bytes !== null) {
+      configFile = path.join(tempRoot, 'config', path.posix.basename(config.location))
+      fs.mkdirSync(path.dirname(configFile))
+      fs.writeFileSync(configFile, config.bytes, { flag: 'wx' })
+      replacements.unshift([configFile, `${baseRef}:${config.location}`])
+    }
+  }
+  let feedsDir
+  if (feeds.changed) {
+    feedsDir = path.join(tempRoot, 'feeds')
+    fs.mkdirSync(feedsDir)
+    for (const [name, bytes] of feeds.files) fs.writeFileSync(path.join(feedsDir, name), bytes, { flag: 'wx' })
+    replacements.unshift([`${feedsDir}${path.sep}`, `${baseRef}:${feeds.location ? `${feeds.location}/` : ''}`], [feedsDir, `${baseRef}:${feeds.location || '.'}`])
+  }
+  return { treeRoot, configFile, feedsDir, replacements }
+}
+
+const AFFECTED_INPUTS = ['config', 'feeds', 'rename', 'file', 'untracked']
+
+export const selectChangedFindings = ({ targets, baseRef, findings, checkFindings, scannedFiles, configFile, feedsDir, head, loadBase, evaluateBase }) => {
   const diff = changedLinesForTargets(targets, baseRef)
   const { gitRoot, baseCommit } = diff
   const tree = baseTreeReader(gitRoot, baseCommit)
   const untracked = untrackedFiles(gitRoot, diff.relativeTargets)
   const config = configInput({ gitRoot, tree, configFile })
   const feeds = feedsInput({ gitRoot, tree, feedsDir })
-  const sharedInputs = [...(config.changed ? ['config'] : []), ...(feeds.changed ? ['feeds'] : [])]
-
-  const affected = new Map()
-  for (const file of scannedFiles) {
-    const absolute = path.resolve(file)
-    const record = diff.files.get(absolute)
-    const isUntracked = untracked.has(absolute)
-    const inputs = [
-      ...sharedInputs,
-      ...(record?.renamed ? ['rename'] : []),
-      ...(record?.hunks.length ? ['file'] : []),
-      ...(isUntracked ? ['untracked'] : []),
-    ]
-    if (!inputs.length) continue
-    affected.set(absolute, {
-      inputs,
-      baseRelative: isUntracked ? null : record ? record.basePath : repoRelative(gitRoot, absolute),
-      hunks: record?.hunks ?? [],
-    })
+  let unavailable = (config.changed && config.unavailable) || (feeds.changed && feeds.unavailable) || null
+  const stats = {
+    scanned_files: scannedFiles.length,
+    affected_files: 0,
+    affected_by: Object.fromEntries(AFFECTED_INPUTS.map(input => [input, 0])),
+    candidate_findings: 0,
+    base_materialized_files: 0,
+    base_scan_ms: 0,
   }
 
-  const occurrences = new Map()
-  const seen = new Map()
-  for (const finding of findings) {
-    const key = findingKey(path.resolve(finding.file), finding.line, finding.id, finding.matched)
-    const index = seen.get(key) ?? 0
-    seen.set(key, index + 1)
-    occurrences.set(finding, index)
-  }
+  let tempRoot = null
+  let materialized = null
+  try {
+    let baseInputs
+    let narrowing = null
+    if ((config.changed || feeds.changed) && unavailable === null) {
+      try {
+        tempRoot = temporaryRoot(gitRoot)
+        materialized = materializeInputs({ tempRoot, baseRef, config, feeds })
+        baseInputs = loadBase({ configFile: materialized.configFile, feedsDir: materialized.feedsDir })
+        narrowing = inputNarrowing({ head, base: baseInputs, findings })
+      } catch {
+        // No narrowing: every file stays affected and the base step below succeeds or fails as it did before.
+        if (tempRoot !== null) fs.rmSync(tempRoot, { recursive: true, force: true })
+        tempRoot = null
+        materialized = null
+        baseInputs = undefined
+        narrowing = null
+      }
+    }
 
-  const candidates = checkFindings.filter(finding =>
-    !isAddedLine(diff.added, finding.file, finding.line) && isBad(finding) && affected.has(path.resolve(finding.file)))
-  const baseRelatives = [...new Set(candidates
-    .map(finding => affected.get(path.resolve(finding.file)).baseRelative)
-    .filter(relative => relative !== null))]
+    let listing = null
+    const baseListing = () => (listing ??= tree.lsTree(diff.relativeTargets, { recursive: true }))
+    const unaddedBad = checkFindings.filter(finding => !isAddedLine(diff.added, finding.file, finding.line) && isBad(finding))
+    const contentChecks = [...new Set(unaddedBad.map(finding => path.resolve(finding.file)))].flatMap(absolute => {
+      const record = diff.files.get(absolute)
+      const headRelative = repoRelative(gitRoot, absolute)
+      const baseRelative = record ? record.basePath : headRelative
+      return record?.hunks.length || untracked.has(absolute) || headRelative === null || baseRelative === null ? [] : [{ absolute, headRelative, baseRelative }]
+    })
+    const edited = editedWithoutHunks(gitRoot, contentChecks, baseListing)
+
+    const affected = new Map()
+    for (const file of scannedFiles) {
+      const absolute = path.resolve(file)
+      const record = diff.files.get(absolute)
+      const isUntracked = untracked.has(absolute)
+      const baseRelative = isUntracked ? null : record ? record.basePath : repoRelative(gitRoot, absolute)
+      const location = { absolute, baseRepoPath: baseRelative ?? repoRelative(gitRoot, absolute) }
+      const inputs = [
+        ...(config.changed && (narrowing === null || narrowing.config(location)) ? ['config'] : []),
+        ...(feeds.changed && (narrowing === null || narrowing.feeds(location)) ? ['feeds'] : []),
+        ...(record?.renamed ? ['rename'] : []),
+        ...(record?.hunks.length || edited.has(absolute) ? ['file'] : []),
+        ...(isUntracked ? ['untracked'] : []),
+      ]
+      if (!inputs.length) continue
+      for (const input of inputs) stats.affected_by[input]++
+      affected.set(absolute, { inputs, baseRelative, hunks: record?.hunks ?? [] })
+    }
+    stats.affected_files = affected.size
+
+    const occurrences = new Map()
+    const seen = new Map()
+    for (const finding of findings) {
+      const key = findingKey(path.resolve(finding.file), finding.line, finding.id, finding.matched)
+      const index = seen.get(key) ?? 0
+      seen.set(key, index + 1)
+      occurrences.set(finding, index)
+    }
 
-  const baseFindings = new Map()
-  const incomplete = new Set()
-  let unavailable = (config.changed && config.unavailable) || (feeds.changed && feeds.unavailable) || null
-  if (baseRelatives.length && unavailable === null) {
-    const tempRoot = temporaryRoot(gitRoot)
-    try {
-      const treeRoot = path.join(tempRoot, 'tree')
-      fs.mkdirSync(treeRoot)
-      const listing = tree.lsTree(diff.relativeTargets, { recursive: true })
+    const candidates = checkFindings.filter(finding =>
+      !isAddedLine(diff.added, finding.file, finding.line) && isBad(finding) && affected.has(path.resolve(finding.file)))
+    stats.candidate_findings = candidates.length
+    const baseRelatives = [...new Set(candidates
+      .map(finding => affected.get(path.resolve(finding.file)).baseRelative)
+      .filter(relative => relative !== null))]
+
+    const baseFindings = new Map()
+    const incomplete = new Set()
+    if (baseRelatives.length && unavailable === null) {
+      if (tempRoot === null) {
+        tempRoot = temporaryRoot(gitRoot)
+        materialized = materializeInputs({ tempRoot, baseRef, config, feeds })
+      }
+      const { treeRoot, replacements } = materialized
+      const baseEntries = baseListing()
       const writes = []
       for (const relative of baseRelatives) {
-        const entry = listing.get(relative)
+        const entry = baseEntries.get(relative)
         if (!entry || !scannableTreePath(relative)) continue
         if (!regularBlob(entry) || entry.size > MAX_FILE_BYTES) {
           incomplete.add(relative)
@@ -432,32 +579,17 @@ export const selectChangedFindings = ({ targets, baseRef, findings, checkFinding
           incomplete.add(write.relative)
         }
       }
-      const replacements = [[`${treeRoot}${path.sep}`, `${baseRef}:`], [treeRoot, `${baseRef}:`]]
-      let baseConfigFile
-      if (config.changed) {
-        baseConfigFile = null
-        if (config.bytes !== null) {
-          baseConfigFile = path.join(tempRoot, 'config', path.posix.basename(config.location))
-          fs.mkdirSync(path.dirname(baseConfigFile))
-          fs.writeFileSync(baseConfigFile, config.bytes, { flag: 'wx' })
-          replacements.unshift([baseConfigFile, `${baseRef}:${config.location}`])
-        }
-      }
-      let baseFeedsDir
-      if (feeds.changed) {
-        baseFeedsDir = path.join(tempRoot, 'feeds')
-        fs.mkdirSync(baseFeedsDir)
-        for (const [name, bytes] of feeds.files) fs.writeFileSync(path.join(baseFeedsDir, name), bytes, { flag: 'wx' })
-        replacements.unshift([`${baseFeedsDir}${path.sep}`, `${baseRef}:${feeds.location ? `${feeds.location}/` : ''}`], [baseFeedsDir, `${baseRef}:${feeds.location || '.'}`])
-      }
+      stats.base_materialized_files = files.length
       if (files.length) {
         const relativeToTree = file => path.relative(treeRoot, path.resolve(file)).split(path.sep).join('/')
+        const started = performance.now()
         try {
           const base = evaluateBase({
             treeRoot,
             files,
-            configFile: baseConfigFile,
-            feedsDir: baseFeedsDir,
+            configFile: materialized.configFile,
+            feedsDir: materialized.feedsDir,
+            inputs: baseInputs,
             classificationPathFor: file => displayPath(path.join(gitRoot, ...relativeToTree(file).split('/'))),
           })
           for (const note of incompleteScanNotes(base.notes)) if (note.file) incomplete.add(relativeToTree(note.file))
@@ -470,24 +602,26 @@ export const selectChangedFindings = ({ targets, baseRef, findings, checkFinding
           if (!(error instanceof BaseUnavailableError)) throw error
           unavailable = replacements.reduce((message, [from, to]) => message.split(from).join(to), error.message)
         }
+        stats.base_scan_ms = Math.round(performance.now() - started)
       }
-    } finally {
-      fs.rmSync(tempRoot, { recursive: true, force: true })
     }
-  }
 
-  return checkFindings.flatMap(finding => {
-    if (isAddedLine(diff.added, finding.file, finding.line)) return [{ ...finding, changed: { reason: 'added-line' } }]
-    const file = isBad(finding) ? affected.get(path.resolve(finding.file)) : null
-    if (!file) return []
-    const newlyActionable = base => [{ ...finding, changed: { reason: 'newly-actionable', inputs: [...file.inputs], base } }]
-    if (file.baseRelative === null) return newlyActionable(null)
-    if (unavailable !== null) return [{ ...finding, changed: { reason: 'base-unavailable', message: unavailable } }]
-    const baseLine = baseLineFor(file.hunks, finding.line)
-    if (baseLine === null || incomplete.has(file.baseRelative)) return newlyActionable(null)
-    const match = baseFindings.get(findingKey(file.baseRelative, baseLine, finding.id, finding.matched))?.[occurrences.get(finding)]
-    if (!match) return newlyActionable(null)
-    if (isBad(match) && inCheckScope(match)) return []
-    return newlyActionable(baseSummary(match))
-  })
+    const selected = checkFindings.flatMap(finding => {
+      if (isAddedLine(diff.added, finding.file, finding.line)) return [{ ...finding, changed: { reason: 'added-line' } }]
+      const file = isBad(finding) ? affected.get(path.resolve(finding.file)) : null
+      if (!file) return []
+      const newlyActionable = base => [{ ...finding, changed: { reason: 'newly-actionable', inputs: [...file.inputs], base } }]
+      if (file.baseRelative === null) return newlyActionable(null)
+      if (unavailable !== null) return [{ ...finding, changed: { reason: 'base-unavailable', message: unavailable } }]
+      const baseLine = baseLineFor(file.hunks, finding.line)
+      if (baseLine === null || incomplete.has(file.baseRelative)) return newlyActionable(null)
+      const match = baseFindings.get(findingKey(file.baseRelative, baseLine, finding.id, finding.matched))?.[occurrences.get(finding)]
+      if (!match) return newlyActionable(null)
+      if (isBad(match) && inCheckScope(match)) return []
+      return newlyActionable(baseSummary(match))
+    })
+    return { findings: selected, stats }
+  } finally {
+    if (tempRoot !== null) fs.rmSync(tempRoot, { recursive: true, force: true })
+  }
 }

package/lib/config.mjs

@@ -242,12 +242,17 @@ export const normalizeConfig = (raw, { defaults = DEFAULT_CONFIG } = {}) => {
   return config
 }
 
-export const configForRepoPath = (config, repoPath) => {
+export const repoPathMatches = (repoPath, patterns) => {
   const normalizedPath = normalizeRepoPath(repoPath)
-  const matchesPath = patterns => matchesAnyGlob(normalizedPath, patterns) || patterns.some(pattern => {
+  return matchesAnyGlob(normalizedPath, patterns) || patterns.some(pattern => {
     const normalizedPattern = normalizeRepoPath(pattern).replace(/\/+$/, '')
     return normalizedPattern && !/[*?]/.test(normalizedPattern) && normalizedPath.startsWith(`${normalizedPattern}/`)
   })
+}
+
+export const configForRepoPath = (config, repoPath) => {
+  const normalizedPath = normalizeRepoPath(repoPath)
+  const matchesPath = patterns => repoPathMatches(repoPath, patterns)
   const applicableWaivers = waivers => (waivers ?? []).filter(waiver => waiver.paths === undefined || matchesPath(waiver.paths))
   const policy = {
     days: config.days,
@@ -288,14 +293,14 @@ export const routeForRepoReference = (config, repoPath, { matched = null, id = n
   return selected
 }
 
-export const mappedRoutesForRepoPath = (config, repoPath) => {
+export const routesForRepoPath = (config, repoPath) => {
   const normalizedPath = normalizeRepoPath(repoPath)
-  return (config.routes ?? []).flatMap((route, index) =>
-    route.match !== undefined && route.model !== undefined && matchesAnyGlob(normalizedPath, route.paths)
-      ? [{ ...route, index }]
-      : [])
+  return (config.routes ?? []).flatMap((route, index) => matchesAnyGlob(normalizedPath, route.paths) ? [{ ...route, index }] : [])
 }
 
+export const mappedRoutesForRepoPath = (config, repoPath) =>
+  routesForRepoPath(config, repoPath).filter(route => route.match !== undefined && route.model !== undefined)
+
 export const configuredVias = config => [
   config.via,
   ...(config.overrides ?? []).map(override => override.via),

package/lib/glob.mjs

@@ -29,7 +29,15 @@ export const globRegex = pattern => {
   return new RegExp(`^${source}$`)
 }
 
-export const matchesGlob = (file, pattern) => globRegex(pattern).test(normalizeRepoPath(file))
+const compiledGlobs = new Map()
+const compiledGlob = pattern => {
+  if (!compiledGlobs.has(pattern)) compiledGlobs.set(pattern, globRegex(pattern))
+  return compiledGlobs.get(pattern)
+}
+
+export const matchesGlob = (file, pattern) => compiledGlob(pattern).test(normalizeRepoPath(file))
 
-export const matchesAnyGlob = (file, patterns = []) =>
-  patterns.some(pattern => matchesGlob(file, pattern))
+export const matchesAnyGlob = (file, patterns = []) => {
+  const normalized = normalizeRepoPath(file)
+  return patterns.some(pattern => compiledGlob(pattern).test(normalized))
+}

package/lib/scanner.mjs

@@ -20,6 +20,7 @@ export const SKIP_DIRS = new Set([
   '.tox', '.terraform', 'target', 'vendor', 'coverage', 'logs', 'tmp',
 ])
 export const MAX_FILE_BYTES = 2 * 1024 * 1024
+export const GIT_MAX_BUFFER = 1024 * 1024 * 1024
 export const MAX_FILES = 100_000
 export const INCOMPLETE_SCAN_REASONS = new Set([
   'file-too-large',
@@ -291,7 +292,7 @@ export const changedLinesForTargets = (targets, baseRef) => {
   const { gitRoot, baseCommit, relativeTargets } = resolveChangedRepository(targets, baseRef)
   const { GIT_DIFF_OPTS, ...env } = process.env
   const result = spawnSync('git', [
-    '-c', 'core.quotePath=true', '-c', 'diff.relative=false', '--literal-pathspecs',
+    '-c', 'core.quotePath=true', '-c', 'diff.relative=false', '-c', 'core.fsmonitor=false', '--literal-pathspecs',
     'diff', '--no-color', '--src-prefix=a/', '--dst-prefix=b/', '--find-renames',
     '--diff-algorithm=myers', '--indent-heuristic', '--inter-hunk-context=0',
     '--text', '--no-ext-diff', '--no-textconv', '--unified=0', baseCommit, '--', ...relativeTargets,
@@ -300,9 +301,10 @@ export const changedLinesForTargets = (targets, baseRef) => {
     encoding: 'utf8',
     env,
     stdio: ['ignore', 'pipe', 'pipe'],
+    maxBuffer: GIT_MAX_BUFFER,
   })
   if (result.error || result.status !== 0) {
-    const detail = (result.stderr ?? '').trim()
+    const detail = (result.stderr ?? '').trim() || result.error?.message || ''
     throw new Error(`--changed git diff failed for base ref "${baseRef}"${detail ? `: ${detail}` : ''}`)
   }
 
@@ -548,6 +550,7 @@ const collectFilesDetailed = (targets, {
       cwd: gitRoot,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
+      maxBuffer: GIT_MAX_BUFFER,
     })
     if (result.error || result.status !== 0) {
       const detail = result.error?.message || result.stderr?.trim() || `exit ${result.status}`
@@ -564,6 +567,7 @@ const collectFilesDetailed = (targets, {
       cwd: gitRoot,
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
+      maxBuffer: GIT_MAX_BUFFER,
     })
     if (tracked.error || tracked.status !== 0) {
       const detail = tracked.error?.message || tracked.stderr?.trim() || `exit ${tracked.status}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "model-eol",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "AI model deprecation feeds with a zero-dependency checker, inventory CLI, and migration bot.",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
     "model-eol-bot": "bot/bot.mjs"
   },
   "scripts": {
-    "test": "node test/run.mjs && node refresh/test/run.mjs && node bot/test/run.mjs && node scripts/test-action-contract.mjs && node scripts/test-document-validation.mjs && node scripts/test-receipts.mjs && node scripts/test-verify.mjs && node scripts/test-eval-harness.mjs && node bot/test/package.mjs && node scripts/test-feed-changelog.mjs && node scripts/test-public-site.mjs"
+    "test": "node test/run.mjs && node refresh/test/run.mjs && node bot/test/run.mjs && node scripts/test-action-contract.mjs && node scripts/test-document-validation.mjs && node scripts/test-receipts.mjs && node scripts/test-verify.mjs && node scripts/test-eval-harness.mjs && node bot/test/package.mjs && node scripts/test-feed-changelog.mjs && node scripts/test-public-site.mjs && node scripts/test-e2e-changed.mjs"
   },
   "repository": {
     "type": "git",