pi-webdesk 0.1.0

package/dist/extensions/webdesk.js

@@ -0,0 +1,34 @@
+// extensions/webdesk.ts
+import { bootstrapUrl, launchPita, launcherStateDir, openBrowser } from "../apps/daemon/src/launcher.js";
+import { requestLauncherControl } from "../apps/daemon/src/launcher-control.js";
+function webdeskExtension(pi) {
+  const command = {
+    description: "Open the Webdesk workspace, or /webdesk status / /webdesk stop",
+    handler: async (args, ctx) => {
+      const command2 = args.trim() || "open";
+      if (!["open", "status", "stop"].includes(command2)) {
+        ctx.ui.notify("Usage: /webdesk [open|status|stop]", "info");
+        return;
+      }
+      try {
+        if (command2 === "open") {
+          const url = bootstrapUrl(await launchPita());
+          const opened = await openBrowser(url);
+          ctx.ui.notify(`${opened ? "Webdesk opened." : "Open Webdesk in your browser:"}
+${url}
+The link expires in 15 minutes. /webdesk stop stops the daemon and task runtimes.`, "info");
+        } else {
+          const reply = await requestLauncherControl(launcherStateDir(), command2);
+          ctx.ui.notify(reply ? `Webdesk ${reply.status} at ${reply.origin}` : "Webdesk is not running.", "info");
+        }
+      } catch (error) {
+        ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");
+      }
+    }
+  };
+  pi.registerCommand("webdesk", command);
+  pi.registerCommand("pita", { ...command, description: "Alias for /webdesk" });
+}
+export {
+  webdeskExtension as default
+};

package/dist/packages/git/src/commit.js

@@ -0,0 +1,675 @@
+// packages/git/src/commit.ts
+import { createHash } from "node:crypto";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { GitServiceError, boundedDetailText, isGitServiceError } from "./errors.js";
+import { inspectRepository, COMMIT_SHA_PATTERN } from "./repository.js";
+import {
+  READ_ONLY_GIT_FLAGS,
+  parseStatusOutput,
+  sameRepositoryIdentity
+} from "./review.js";
+import {
+  defaultGitRunner,
+  runGitExpectingSuccess
+} from "./runner.js";
+var DEFAULT_COMMIT_MAX_FILES = 200;
+var DEFAULT_COMMIT_MAX_DIFF_CHARS_PER_FILE = 2e4;
+var DEFAULT_COMMIT_MAX_TOTAL_DIFF_CHARS = 2e5;
+var DEFAULT_COMMIT_MAX_DURATION_MS = 2e4;
+var DEFAULT_COMMIT_MAX_ENTRIES = 2e3;
+var DEFAULT_COMMIT_SIGNING_TIMEOUT_MS = 3e4;
+var MAX_COMMIT_MESSAGE_CHARS = 1e5;
+var COMMIT_DIFF_TIMEOUT_MS = 2e3;
+var DIFF_FLAGS = [
+  "--no-color",
+  "--no-ext-diff",
+  "--no-textconv",
+  "--unified=3"
+];
+async function publicationState(runner, cwd, branch, commit, parentCommit) {
+  try {
+    const result = await runner(
+      ["rev-parse", "--verify", `refs/heads/${branch}`],
+      { cwd }
+    );
+    if (result.exitCode !== 0) return "unknown";
+    const tip = singleOid(result.stdout, "branch tip");
+    if (tip === commit) return "published";
+    if (tip === parentCommit) return "unmoved";
+    return "moved";
+  } catch {
+    return "unknown";
+  }
+}
+function positiveBound(value, label) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new GitServiceError("GIT_STATE_TOO_LARGE", `${label} must be a positive safe integer`);
+  }
+  return value;
+}
+var OID_PATTERN = COMMIT_SHA_PATTERN;
+function singleOid(stdout, label) {
+  const value = stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+  if (!OID_PATTERN.test(value)) {
+    throw new GitServiceError("GIT_COMMAND_FAILED", `git returned an unexpected ${label}`, {
+      details: { value: boundedDetailText(value, 80) }
+    });
+  }
+  return value;
+}
+function isBinaryDiff(diff) {
+  return diff.split("\n").some((line) => line.startsWith("Binary files ") && line.endsWith(" differ"));
+}
+function withDeadline(runner, deadlineMs, now, perCommandLimitMs) {
+  return async (args, options = {}) => {
+    const remainingMs = Math.floor(deadlineMs - now());
+    if (remainingMs < 1) {
+      throw new GitServiceError(
+        "GIT_STATE_DEADLINE_EXCEEDED",
+        "The commit preflight exceeded its overall time budget"
+      );
+    }
+    const callerLimitMs = options.timeoutMs ?? Number.POSITIVE_INFINITY;
+    const commandLimitMs = perCommandLimitMs ?? Number.POSITIVE_INFINITY;
+    const aggregateIsLimit = remainingMs <= callerLimitMs && remainingMs <= commandLimitMs;
+    try {
+      return await runner(args, {
+        ...options,
+        timeoutMs: Math.min(remainingMs, callerLimitMs, commandLimitMs)
+      });
+    } catch (error) {
+      if (aggregateIsLimit && isGitServiceError(error, "GIT_COMMAND_TERMINATED")) {
+        throw new GitServiceError(
+          "GIT_STATE_DEADLINE_EXCEEDED",
+          "The commit preflight exceeded its overall time budget",
+          { cause: error }
+        );
+      }
+      throw error;
+    }
+  };
+}
+async function requireCommitIdentity(runner, cwd) {
+  for (const key of ["user.name", "user.email"]) {
+    const result = await runner(["config", "--get", key], { cwd });
+    if (result.exitCode === 1 || result.exitCode === 0 && result.stdout.trim() === "") {
+      throw new GitServiceError(
+        "GIT_COMMIT_IDENTITY_MISSING",
+        `Git identity is not configured (${key}); set user.name and user.email before committing`,
+        { details: { key } }
+      );
+    }
+    if (result.exitCode !== 0) {
+      throw new GitServiceError("GIT_COMMAND_FAILED", "git config exited unexpectedly", {
+        details: { key, exitCode: result.exitCode, stderr: boundedDetailText(result.stderr) }
+      });
+    }
+  }
+}
+async function readGpgSignConfig(runner, cwd) {
+  const result = await runner(["config", "--type=bool", "--get", "commit.gpgsign"], { cwd });
+  if (result.exitCode === 1) return false;
+  if (result.exitCode !== 0) {
+    throw new GitServiceError(
+      "GIT_COMMAND_FAILED",
+      "git config could not read commit.gpgSign as a boolean",
+      { details: { exitCode: result.exitCode, stderr: boundedDetailText(result.stderr) } }
+    );
+  }
+  return result.stdout.trim() === "true";
+}
+var STATUS_KIND = {
+  A: "added",
+  M: "modified",
+  D: "deleted",
+  R: "renamed",
+  C: "copied",
+  T: "type-changed"
+};
+function diffTreeParseFailure(reason, sample) {
+  return new GitServiceError(
+    "GIT_COMMAND_FAILED",
+    `git diff-tree returned unexpected output: ${reason}`,
+    { details: { sample: boundedDetailText(sample, 200) } }
+  );
+}
+function parseDiffTreeOutput(stdout) {
+  const tokens = stdout.split("\0");
+  const records = [];
+  for (let index = 0; index < tokens.length; index++) {
+    const meta = tokens[index];
+    if (meta === "") continue;
+    if (!meta.startsWith(":")) {
+      throw diffTreeParseFailure("record does not start with ':'", meta);
+    }
+    const fields = meta.slice(1).split(" ");
+    const oldMode = fields[0];
+    const newMode = fields[1];
+    const statusField = fields[4];
+    if (fields.length < 5 || statusField === void 0 || statusField.length === 0 || oldMode === void 0 || newMode === void 0 || !/^[0-7]{6}$/.test(oldMode) || !/^[0-7]{6}$/.test(newMode)) {
+      throw diffTreeParseFailure("missing status or mode field", meta);
+    }
+    const letter = statusField[0];
+    const kind = STATUS_KIND[letter];
+    if (kind === void 0) {
+      throw diffTreeParseFailure("unsupported status letter", meta);
+    }
+    const first = tokens[++index];
+    if (first === void 0 || first === "") {
+      throw diffTreeParseFailure("missing path field", meta);
+    }
+    if (letter === "R" || letter === "C") {
+      const second = tokens[++index];
+      if (second === void 0 || second === "") {
+        throw diffTreeParseFailure("rename record is missing its destination path", meta);
+      }
+      records.push({ status: kind, path: second, previousPath: first, oldMode, newMode, raw: meta });
+    } else {
+      records.push({ status: kind, path: first, previousPath: null, oldMode, newMode, raw: meta });
+    }
+  }
+  return records;
+}
+function commitEntryId(record) {
+  return createHash("sha256").update(record.raw).update("\0").update(record.path).update("\0").update(record.previousPath ?? "").digest("hex");
+}
+function validateCommitEntries(entries, maxEntries) {
+  if (entries.length === 0) {
+    throw new GitServiceError(
+      "GIT_COMMIT_NOTHING_TO_COMMIT",
+      "The worktree has no staged, unstaged, or untracked changes to commit"
+    );
+  }
+  if (entries.length > maxEntries) {
+    throw new GitServiceError(
+      "GIT_STATE_TOO_LARGE",
+      `The worktree has ${entries.length} changed entries, more than the ${maxEntries}-entry commit bound`,
+      { details: { entries: entries.length, maxEntries } }
+    );
+  }
+  for (const entry of entries) {
+    if (entry.record === "unmerged") {
+      throw new GitServiceError(
+        "GIT_COMMIT_CONFLICTED",
+        "The worktree has unresolved merge conflicts; resolve them before committing",
+        { details: { path: boundedDetailText(entry.path, 200) } }
+      );
+    }
+    if (entry.sub.startsWith("S")) {
+      throw new GitServiceError(
+        "GIT_COMMIT_STATE_UNSUPPORTED",
+        "Dirty or moved submodules cannot be committed safely by Webdesk",
+        { details: { path: boundedDetailText(entry.path, 200) } }
+      );
+    }
+    if (entry.path.endsWith("/")) {
+      throw new GitServiceError(
+        "GIT_COMMIT_STATE_UNSUPPORTED",
+        "An embedded repository or directory-shaped change cannot be committed safely by Webdesk",
+        { details: { path: boundedDetailText(entry.path, 200) } }
+      );
+    }
+  }
+}
+async function prepareCommitTree(options) {
+  const maxFiles = positiveBound(options.maxFiles ?? DEFAULT_COMMIT_MAX_FILES, "Commit file limit");
+  const maxDiffCharsPerFile = positiveBound(
+    options.maxDiffCharsPerFile ?? DEFAULT_COMMIT_MAX_DIFF_CHARS_PER_FILE,
+    "Per-file diff limit"
+  );
+  const maxTotalDiffChars = positiveBound(
+    options.maxTotalDiffChars ?? DEFAULT_COMMIT_MAX_TOTAL_DIFF_CHARS,
+    "Total diff limit"
+  );
+  const maxDurationMs = positiveBound(
+    options.maxDurationMs ?? DEFAULT_COMMIT_MAX_DURATION_MS,
+    "Commit preflight duration limit"
+  );
+  const maxEntries = positiveBound(
+    options.maxEntries ?? DEFAULT_COMMIT_MAX_ENTRIES,
+    "Commit entry limit"
+  );
+  const now = options.now ?? Date.now;
+  const deadlineMs = now() + maxDurationMs;
+  const runner = withDeadline(options.runner ?? defaultGitRunner, deadlineMs, now);
+  const diffRunner = withDeadline(
+    options.runner ?? defaultGitRunner,
+    deadlineMs,
+    now,
+    COMMIT_DIFF_TIMEOUT_MS
+  );
+  const worktree = await inspectRepository(options.worktreePath, { runner });
+  if (worktree.branch === null) {
+    throw new GitServiceError(
+      "GIT_COMMIT_DETACHED_HEAD",
+      "The worktree is on a detached HEAD; Webdesk only commits to the task branch"
+    );
+  }
+  if (worktree.branch !== options.expectedBranch) {
+    throw new GitServiceError(
+      "GIT_COMMIT_BRANCH_MISMATCH",
+      "The worktree is not on the task's recorded branch",
+      {
+        details: {
+          expectedBranch: boundedDetailText(options.expectedBranch, 200),
+          actualBranch: boundedDetailText(worktree.branch, 200)
+        }
+      }
+    );
+  }
+  await requireCommitIdentity(runner, worktree.root);
+  const status = await runGitExpectingSuccess(
+    runner,
+    [...READ_ONLY_GIT_FLAGS, "status", "--porcelain=v2", "-z", "--untracked-files=all"],
+    { cwd: worktree.root }
+  );
+  const entries = parseStatusOutput(status.stdout);
+  validateCommitEntries(entries, maxEntries);
+  const stagedPathSet = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    stagedPathSet.add(entry.path);
+    if (entry.previousPath !== null) stagedPathSet.add(entry.previousPath);
+  }
+  const stagedPaths = [...stagedPathSet].sort();
+  const stagedDivergence = entries.some(
+    (entry) => entry.record === "untracked" || entry.y !== "."
+  );
+  const parentCommit = worktree.headCommit;
+  const parentTree = singleOid(
+    (await runGitExpectingSuccess(runner, ["rev-parse", "--verify", `${parentCommit}^{tree}`], {
+      cwd: worktree.root
+    })).stdout,
+    "parent tree id"
+  );
+  const tempDir = await mkdtemp(path.join(os.tmpdir(), "pita-commit-index-"));
+  let treeOid;
+  try {
+    const indexEnv = { GIT_INDEX_FILE: path.join(tempDir, "index") };
+    await runGitExpectingSuccess(runner, [...READ_ONLY_GIT_FLAGS, "read-tree", parentTree], {
+      cwd: worktree.root,
+      extraEnv: indexEnv
+    });
+    await runGitExpectingSuccess(
+      runner,
+      [...READ_ONLY_GIT_FLAGS, "update-index", "--add", "--remove", "-z", "--stdin"],
+      {
+        cwd: worktree.root,
+        extraEnv: indexEnv,
+        stdin: stagedPaths.map((entryPath) => `${entryPath}\0`).join("")
+      }
+    );
+    treeOid = singleOid(
+      (await runGitExpectingSuccess(runner, [...READ_ONLY_GIT_FLAGS, "write-tree"], {
+        cwd: worktree.root,
+        extraEnv: indexEnv
+      })).stdout,
+      "tree id"
+    );
+  } finally {
+    await rm(tempDir, { recursive: true, force: true }).catch(() => void 0);
+  }
+  if (treeOid === parentTree) {
+    throw new GitServiceError(
+      "GIT_COMMIT_NOTHING_TO_COMMIT",
+      "After clean filters, the changeset produces exactly the parent commit's tree; there is nothing to commit"
+    );
+  }
+  const rawDiff = await runGitExpectingSuccess(
+    runner,
+    [...READ_ONLY_GIT_FLAGS, "diff-tree", "-r", "-z", "--find-renames", parentCommit, treeOid],
+    { cwd: worktree.root }
+  );
+  const records = parseDiffTreeOutput(rawDiff.stdout);
+  records.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const totalFiles = records.length;
+  const selected = records.slice(0, maxFiles);
+  let remainingChars = maxTotalDiffChars;
+  let totalDiffTruncated = false;
+  const files = [];
+  for (const record of records.slice(0, maxFiles)) {
+    const base = {
+      entryId: commitEntryId(record),
+      path: record.path,
+      previousPath: record.previousPath,
+      kind: record.status
+    };
+    if (remainingChars <= 0) {
+      totalDiffTruncated = true;
+      files.push({
+        ...base,
+        binary: false,
+        diff: null,
+        diffTruncated: false,
+        diffOmittedReason: "total-budget"
+      });
+      continue;
+    }
+    let produced;
+    try {
+      produced = await diffRunner(
+        [
+          ...READ_ONLY_GIT_FLAGS,
+          "diff-tree",
+          "-r",
+          "-p",
+          ...DIFF_FLAGS,
+          "--find-renames",
+          parentCommit,
+          treeOid,
+          "--",
+          record.path,
+          ...record.previousPath === null ? [] : [record.previousPath]
+        ],
+        { cwd: worktree.root }
+      );
+    } catch (error) {
+      if (isGitServiceError(error, "GIT_OUTPUT_OVERFLOW")) {
+        files.push({
+          ...base,
+          binary: false,
+          diff: null,
+          diffTruncated: false,
+          diffOmittedReason: "too-large"
+        });
+        continue;
+      }
+      if (isGitServiceError(error, "GIT_STATE_DEADLINE_EXCEEDED") || isGitServiceError(error, "GIT_COMMAND_TERMINATED")) {
+        totalDiffTruncated = true;
+        files.push({
+          ...base,
+          binary: false,
+          diff: null,
+          diffTruncated: false,
+          diffOmittedReason: "review-budget"
+        });
+        continue;
+      }
+      throw error;
+    }
+    if (produced.exitCode !== 0) {
+      files.push({
+        ...base,
+        binary: false,
+        diff: null,
+        diffTruncated: false,
+        diffOmittedReason: "diff-failed"
+      });
+      continue;
+    }
+    if (isBinaryDiff(produced.stdout)) {
+      files.push({
+        ...base,
+        binary: true,
+        diff: null,
+        diffTruncated: false,
+        diffOmittedReason: "binary"
+      });
+      continue;
+    }
+    const perFileLimit = Math.min(maxDiffCharsPerFile, remainingChars);
+    let text = produced.stdout;
+    let truncated = false;
+    if (text.length > perFileLimit) {
+      if (perFileLimit < maxDiffCharsPerFile) totalDiffTruncated = true;
+      text = text.slice(0, perFileLimit);
+      truncated = true;
+    }
+    remainingChars -= text.length;
+    files.push({
+      ...base,
+      binary: false,
+      diff: text,
+      diffTruncated: truncated,
+      diffOmittedReason: null
+    });
+  }
+  const verified = await inspectRepository(worktree.root, { runner });
+  if (!sameRepositoryIdentity(worktree, verified)) {
+    throw new GitServiceError(
+      "GIT_REPOSITORY_CHANGED_DURING_CAPTURE",
+      "The worktree branch or HEAD changed during commit preflight; retry to observe the new state",
+      {
+        details: {
+          beforeHead: worktree.headCommit,
+          afterHead: verified.headCommit,
+          beforeBranch: worktree.branch,
+          afterBranch: verified.branch
+        }
+      }
+    );
+  }
+  return {
+    worktree,
+    branch: worktree.branch,
+    parentCommit,
+    treeOid,
+    stagedPaths,
+    files,
+    totalFiles,
+    omittedFiles: totalFiles - selected.length,
+    totalDiffTruncated,
+    stagedDivergence
+  };
+}
+async function commitPreparedTree(options) {
+  const runner = options.runner ?? defaultGitRunner;
+  const signingTimeoutMs = positiveBound(
+    options.signingTimeoutMs ?? DEFAULT_COMMIT_SIGNING_TIMEOUT_MS,
+    "Signing timeout"
+  );
+  if (!OID_PATTERN.test(options.parentCommit) || !OID_PATTERN.test(options.treeOid)) {
+    throw new GitServiceError("GIT_COMMAND_FAILED", "Commit execution requires exact object ids");
+  }
+  if (typeof options.message !== "string" || options.message.trim().length === 0 || options.message.length > MAX_COMMIT_MESSAGE_CHARS) {
+    throw new GitServiceError(
+      "GIT_COMMAND_FAILED",
+      "Commit execution requires a non-empty bounded message"
+    );
+  }
+  if (options.reflogReason.length === 0 || options.reflogReason.length > 200 || [...options.reflogReason].some((character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code < 32 || code === 127;
+  })) {
+    throw new GitServiceError(
+      "GIT_COMMAND_FAILED",
+      "Commit execution requires a bounded, control-character-free reflog reason"
+    );
+  }
+  const worktree = await inspectRepository(options.worktreePath, { runner });
+  if (worktree.branch === null) {
+    throw new GitServiceError(
+      "GIT_COMMIT_DETACHED_HEAD",
+      "The worktree is on a detached HEAD; Webdesk only commits to the task branch"
+    );
+  }
+  if (worktree.branch !== options.branch) {
+    throw new GitServiceError(
+      "GIT_COMMIT_BRANCH_MISMATCH",
+      "The worktree is no longer on the branch that was approved",
+      {
+        details: {
+          expectedBranch: boundedDetailText(options.branch, 200),
+          actualBranch: boundedDetailText(worktree.branch, 200)
+        }
+      }
+    );
+  }
+  if (worktree.headCommit !== options.parentCommit) {
+    throw new GitServiceError(
+      "GIT_COMMIT_PARENT_MOVED",
+      "The branch moved since the approved preflight; review the current state and preflight again",
+      {
+        details: {
+          approvedParent: options.parentCommit,
+          currentHead: worktree.headCommit
+        }
+      }
+    );
+  }
+  await requireCommitIdentity(runner, worktree.root);
+  const sign = await readGpgSignConfig(runner, worktree.root);
+  const message = options.message.endsWith("\n") ? options.message : `${options.message}
+`;
+  const commitResult = await runner(
+    [
+      "commit-tree",
+      ...sign ? ["-S"] : [],
+      "-p",
+      options.parentCommit,
+      options.treeOid
+    ],
+    {
+      cwd: worktree.root,
+      stdin: message,
+      ...sign ? { timeoutMs: signingTimeoutMs } : {}
+    }
+  ).catch((error) => {
+    if (sign && isGitServiceError(error, "GIT_COMMAND_TERMINATED")) {
+      throw new GitServiceError(
+        "GIT_COMMIT_SIGNING_FAILED",
+        "Commit signing did not complete within its time bound; no ref was moved",
+        { cause: error }
+      );
+    }
+    throw error;
+  });
+  if (commitResult.exitCode !== 0) {
+    if (sign) {
+      throw new GitServiceError(
+        "GIT_COMMIT_SIGNING_FAILED",
+        "Commit signing failed; no ref was moved",
+        { details: { stderr: boundedDetailText(commitResult.stderr) } }
+      );
+    }
+    throw new GitServiceError("GIT_COMMAND_FAILED", "git commit-tree exited unexpectedly", {
+      details: {
+        exitCode: commitResult.exitCode,
+        stderr: boundedDetailText(commitResult.stderr)
+      }
+    });
+  }
+  const commit = singleOid(commitResult.stdout, "commit id");
+  const commitTree = singleOid(
+    (await runGitExpectingSuccess(runner, ["rev-parse", "--verify", `${commit}^{tree}`], {
+      cwd: worktree.root
+    })).stdout,
+    "commit tree id"
+  );
+  if (commitTree !== options.treeOid) {
+    throw new GitServiceError(
+      "GIT_COMMIT_TREE_MISMATCH",
+      "The created commit does not carry the approved tree; no ref was moved",
+      { details: { approvedTree: options.treeOid, commitTree } }
+    );
+  }
+  let publishFailure = null;
+  try {
+    const publish = await runner(
+      [
+        "update-ref",
+        "-m",
+        options.reflogReason,
+        `refs/heads/${options.branch}`,
+        commit,
+        options.parentCommit
+      ],
+      { cwd: worktree.root }
+    );
+    if (publish.exitCode !== 0) {
+      publishFailure = new GitServiceError(
+        "GIT_COMMIT_REF_CAS_FAILED",
+        "git update-ref did not report a successful publication",
+        { details: { stderr: boundedDetailText(publish.stderr) } }
+      );
+    }
+  } catch (error) {
+    publishFailure = error;
+  }
+  if (publishFailure !== null) {
+    const state = await publicationState(
+      runner,
+      worktree.root,
+      options.branch,
+      commit,
+      options.parentCommit
+    );
+    if (state !== "published") {
+      if (state === "unknown") {
+        throw new GitServiceError(
+          "GIT_COMMIT_PUBLICATION_UNKNOWN",
+          "Git stopped before Webdesk could determine whether the approved commit was published; inspect the branch before retrying",
+          {
+            cause: publishFailure,
+            details: { branch: options.branch, commit }
+          }
+        );
+      }
+      throw new GitServiceError(
+        "GIT_COMMIT_REF_CAS_FAILED",
+        state === "unmoved" ? "The approved parent is still current; Webdesk did not publish the commit" : "The branch moved before publication; Webdesk did not replace the newer tip",
+        { cause: publishFailure }
+      );
+    }
+  }
+  let headVerified = false;
+  try {
+    const verified = await inspectRepository(worktree.root, { runner });
+    headVerified = verified.headCommit === commit && verified.branch === options.branch;
+  } catch {
+    headVerified = false;
+  }
+  let indexSynced = false;
+  if (headVerified) {
+    try {
+      const sync = await runner(
+        [
+          ...READ_ONLY_GIT_FLAGS,
+          "restore",
+          "--staged",
+          `--source=${commit}`,
+          "--pathspec-from-file=-",
+          "--pathspec-file-nul"
+        ],
+        {
+          cwd: worktree.root,
+          stdin: options.stagedPaths.map((entryPath) => `${entryPath}\0`).join("")
+        }
+      );
+      indexSynced = sync.exitCode === 0;
+    } catch {
+      indexSynced = false;
+    }
+  }
+  try {
+    const verified = await inspectRepository(worktree.root, { runner });
+    headVerified = verified.headCommit === commit && verified.branch === options.branch;
+  } catch {
+    headVerified = false;
+  }
+  return {
+    commit,
+    treeOid: options.treeOid,
+    parentCommit: options.parentCommit,
+    branch: options.branch,
+    signed: sign,
+    indexSynced,
+    headVerified
+  };
+}
+export {
+  DEFAULT_COMMIT_MAX_DIFF_CHARS_PER_FILE,
+  DEFAULT_COMMIT_MAX_DURATION_MS,
+  DEFAULT_COMMIT_MAX_ENTRIES,
+  DEFAULT_COMMIT_MAX_FILES,
+  DEFAULT_COMMIT_MAX_TOTAL_DIFF_CHARS,
+  DEFAULT_COMMIT_SIGNING_TIMEOUT_MS,
+  MAX_COMMIT_MESSAGE_CHARS,
+  commitEntryId,
+  commitPreparedTree,
+  parseDiffTreeOutput,
+  prepareCommitTree,
+  readGpgSignConfig,
+  requireCommitIdentity
+};