sfdx-git-delta 6.41.2 → 6.43.0

package/README.md

@@ -149,7 +149,7 @@ Generate incremental package manifest and source content
 ```
 USAGE
   $ sf sgd source delta -f <value> [--json] [--flags-dir <value>] [-t <value>] [-d] [-o <value>] [-r <value>] [-s
-    <value>...] [-i <value>] [-D <value>] [-n <value>] [-N <value>] [-M <value>] [-W] [-a <value>]
+    <value>...] [-i <value>] [-D <value>] [-n <value>] [-N <value>] [-M <value>] [-c <value>] [-W] [-a <value>]
 
 FLAGS
   -D, --ignore-destructive-file=<value>       file listing paths to explicitly ignore for any destructive actions
@@ -158,6 +158,8 @@ FLAGS
   -W, --ignore-whitespace                     ignore git diff whitespace (space, tab, eol) changes
   -a, --api-version=<value>                   salesforce metadata API version, default to sfdx-project.json
                                               "sourceApiVersion" attribute or latest version
+  -c, --changes-manifest=<value>              path to a JSON file grouping changed components by kind (add, modify,
+                                              delete, rename); setting this flag also enables git rename detection
   -d, --generate-delta                        generate delta files in [--output-dir] folder
   -f, --from=<value>                          (required) commit sha from where the diff is done
   -i, --ignore-file=<value>                   file listing paths to explicitly ignore for any diff actions
@@ -200,7 +202,7 @@ FLAG DESCRIPTIONS
     of a diff, in which case changes may still be picked up.
 ```
 
-_See code: [src/commands/sgd/source/delta.ts](https://github.com/scolladon/sfdx-git-delta/blob/v6.41.2/src/commands/sgd/source/delta.ts)_
+_See code: [src/commands/sgd/source/delta.ts](https://github.com/scolladon/sfdx-git-delta/blob/v6.43.0/src/commands/sgd/source/delta.ts)_
 <!-- commandsstop -->
 
 ### Windows users
@@ -518,6 +520,37 @@ To cover this need, parse the content of the package.xml file produced by SGD us
 
 `xq . < package/package.xml | jq '.Package.types | [.] | flatten | map(select(.name=="ApexClass")) | .[] | .members | [.] | flatten | map(select(. | index("*") | not)) | unique | join(",")'`
 
+### Review-centric: list components by change kind
+
+Package managers (1GP, unlocked, managed) and release reviewers often need to distinguish **newly added** components from **modified** ones — adding a new component to a managed package is a 1-way door that binds all subscribers. SGD groups `git diff` into Salesforce components, but its `package.xml` bundles additions and modifications together (as required for deployment).
+
+Use `--changes-manifest [-c]` to emit an additional JSON file that groups components by change kind. The file is written alongside `package.xml` / `destructiveChanges.xml` (no changes to the deployment manifests themselves).
+
+Two forms:
+
+```sh
+# Bare flag: writes to <output-dir>/changes.manifest.json
+sf sgd source delta --from "origin/development" --to HEAD --output-dir incremental --changes-manifest
+
+# Explicit path: resolved against cwd (or used as-is when absolute), same as --ignore-file
+sf sgd source delta --from "origin/development" --to HEAD --changes-manifest reports/changes.json
+```
+
+Produces (bare form example) `incremental/changes.manifest.json`. Setting `--changes-manifest` also turns on git's `-M` rename detection for this run, so components renamed at the file level show up in their own bucket instead of being split into a fake delete+add pair. Default sgd runs (without the flag) keep the pre-feature behaviour — renames still appear as a delete on the old path + an add on the new path.
+
+```json
+{
+  "add":    { "ApexClass": ["BrandNewClass"], "CustomObject": ["NewObject__c"] },
+  "modify": { "ApexClass": ["ExistingClass"], "CustomLabels": ["MyApp.Label1"] },
+  "delete": { "ApexTrigger": ["OldTrigger"] },
+  "rename": { "ApexClass": [{ "from": "OldName", "to": "NewName" }] }
+}
+```
+
+`package.xml` still lists `NewName` and `destructiveChanges.xml` still lists `OldName` for renames — the deployment contract is unchanged.
+
+Works for file-backed metadata, in-file sub-components (CustomLabels members, Workflow rules, etc.), decomposed metadata, in-resource bundles and in-folder metadata.
+
 ### Condition deployment on package.xml and destructiveChange content
 
 SGD does not always generate content in the package.xml (or destructiveChanges.xml). Sometimes the commit range contains changes only within files to ignore (using .sgdignore and `--i` parameter).

package/lib/adapter/GitAdapter.d.ts

@@ -1,9 +1,11 @@
+import { type Readable } from 'node:stream';
 import { SimpleGit } from 'simple-git';
 import type { Config } from '../types/config.js';
 import type { FileGitRef } from '../types/git.js';
 import { GitBatchCatFile } from './gitBatchCatFile.js';
+import type { GitBlobReader, SpawnFn } from './gitBlobReader.js';
 import { TreeIndex } from './treeIndex.js';
-export default class GitAdapter {
+export default class GitAdapter implements GitBlobReader {
     protected readonly config: Config;
     private static instances;
     private static keyFor;
@@ -11,21 +13,68 @@ export default class GitAdapter {
     protected readonly simpleGit: SimpleGit;
     protected readonly treeIndex: Map<string, TreeIndex>;
     protected batchCatFile: GitBatchCatFile | null;
+    private readonly streamingChildren;
+    private static readonly STDERR_BUFFER_CAP;
+    private static readonly LFS_POINTER_CAP;
+    private spawnFn;
     private constructor();
+    /**
+     * Testability seam: lets unit tests swap in a fake spawn for streaming
+     * subprocesses. Production always uses `child_process.spawn`.
+     */
+    setSpawnFn(spawnFn: SpawnFn): void;
     protected getBatchCatFile(): GitBatchCatFile;
     closeBatchProcess(): void;
     static closeAll(): void;
     configureRepository(): Promise<void>;
     parseRev(ref: string): Promise<string>;
     preBuildTreeIndex(revision: string, scopePaths: string[]): Promise<void>;
+    /**
+     * Spawns `git <args>`, streams stdout through a readline interface, and
+     * yields one line at a time. Replaces the old "run command, split on EOL"
+     * pattern that accumulated a multi-MB string for megarepo diffs / tree
+     * listings before any downstream consumer ran.
+     *
+     * The spawned child is pushed into streamingChildren so closeAll()
+     * kills it if teardown happens mid-stream. stderr is drained to the
+     * debug log; a non-zero exit code rejects the iterator on next read.
+     */
+    protected _spawnLines(args: string[]): AsyncGenerator<string>;
+    private _trackChild;
     protected pathExistsImpl(path: string, revision: string): boolean;
     pathExists(path: string, revision?: string): Promise<boolean>;
     getFirstCommitRef(): Promise<string>;
     getBufferContent(forRef: FileGitRef): Promise<Buffer>;
+    getBufferContentOrEscalate(forRef: FileGitRef): Promise<Buffer>;
+    /**
+     * Streams a directory from `revision` as `git archive --format=tar`
+     * entries. Yields `{ path, stream }` per file entry (directories are
+     * skipped). The tar subprocess is registered in streamingChildren so
+     * closeAll kills it on teardown.
+     *
+     * Callers MUST consume each entry's stream — even when skipping the
+     * entry — otherwise tar-stream back-pressures and halts parsing. For
+     * skip cases use `stream.resume()` to drain-and-discard.
+     */
+    streamArchive(path: string, revision: string): AsyncGenerator<{
+        path: string;
+        stream: Readable;
+    }>;
+    /**
+     * Spawns a dedicated `git cat-file blob <oid>` subprocess and returns a
+     * Readable that peeks the first chunks for LFS pointer magic. On match,
+     * the spawned subprocess is killed and the Readable is fed from the
+     * resolved LFS object file. Otherwise bytes are forwarded as-is.
+     */
+    streamContent(forRef: FileGitRef): Readable;
+    private _wireStreamContent;
+    private _handoffToLfs;
     getStringContent(forRef: FileGitRef): Promise<string>;
     protected getFilesPathCached(path: string, revision: string): string[];
     getFilesPath(paths: string | string[], revision?: string): Promise<string[]>;
     listDirAtRevision(dir: string, revision: string): Promise<string[]>;
     gitGrep(pattern: string, path: string | string[], revision?: string): Promise<string[]>;
-    getDiffLines(): Promise<string[]>;
+    streamDiffLines(): AsyncGenerator<string>;
+    protected _getNumstatLines(changeType: string, detectRenames: boolean): Promise<string[]>;
+    private _getRenameLines;
 }

package/lib/adapter/GitAdapter.js

@@ -1,9 +1,14 @@
 import { __decorate } from "tslib";
+import { spawn } from 'node:child_process';
+import { createReadStream } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path/posix';
+import { createInterface } from 'node:readline';
+import { PassThrough } from 'node:stream';
 import { simpleGit } from 'simple-git';
+import { TAB } from '../constant/cliConstants.js';
 import { UTF8_ENCODING } from '../constant/fsConstants.js';
-import { ADDITION, DELETION, HEAD, IGNORE_WHITESPACE_PARAMS, MODIFICATION, NUM_STAT_CHANGE_INFORMATION, } from '../constant/gitConstants.js';
+import { ADDITION, DELETION, HEAD, IGNORE_WHITESPACE_PARAMS, MODIFICATION, NUM_STAT_CHANGE_INFORMATION, RENAMED, } from '../constant/gitConstants.js';
 import { pushAll } from '../utils/arrayUtils.js';
 import { getErrorMessage } from '../utils/errorUtils.js';
 import { treatPathSep } from '../utils/fsUtils.js';
@@ -12,6 +17,7 @@ import { log } from '../utils/LoggingDecorator.js';
 import { Logger, lazy } from '../utils/LoggingService.js';
 import { GitBatchCatFile } from './gitBatchCatFile.js';
 import { TreeIndex } from './treeIndex.js';
+const LFS_MAGIC = Buffer.from('version https://git-lfs.github.com/spec/v1\n');
 const EOL = /\r?\n/;
 const ROOT_PATHS = new Set(['', '.', './']);
 export default class GitAdapter {
@@ -33,20 +39,49 @@ export default class GitAdapter {
     simpleGit;
     treeIndex;
     batchCatFile = null;
+    // Live-only list of streaming subprocesses: children are appended when
+    // spawned and spliced on `close` so long-running invocations don't
+    // accumulate dead process references. Iterated at closeAll() teardown and
+    // kill()ed if still alive.
+    streamingChildren = [];
+    // Cap on stderr buffered per-subprocess: long-running git processes that
+    // emit progress to stderr would otherwise grow this without bound. The
+    // final error message truncates at this size.
+    static STDERR_BUFFER_CAP = 8 * 1024;
+    // Cap on LFS pointer buffering: real pointers are < 200 bytes; a crafted
+    // blob with the LFS magic prefix followed by gigabytes of content should
+    // not OOM the process before validation fails.
+    static LFS_POINTER_CAP = 1024;
+    spawnFn = spawn;
     constructor(config) {
         this.config = config;
         this.simpleGit = simpleGit({ baseDir: config.repo, trimmed: true });
         this.treeIndex = new Map();
     }
+    /**
+     * Testability seam: lets unit tests swap in a fake spawn for streaming
+     * subprocesses. Production always uses `child_process.spawn`.
+     */
+    setSpawnFn(spawnFn) {
+        this.spawnFn = spawnFn;
+    }
     getBatchCatFile() {
         if (!this.batchCatFile) {
-            this.batchCatFile = new GitBatchCatFile(this.config.repo);
+            this.batchCatFile = new GitBatchCatFile(this.config.repo, {
+                spawnFn: this.spawnFn,
+            });
         }
         return this.batchCatFile;
     }
     closeBatchProcess() {
         this.batchCatFile?.close();
         this.batchCatFile = null;
+        for (const child of this.streamingChildren) {
+            if (child.exitCode === null && !child.killed) {
+                child.kill();
+            }
+        }
+        this.streamingChildren.length = 0;
     }
     static closeAll() {
         for (const instance of GitAdapter.instances.values()) {
@@ -70,9 +105,8 @@ export default class GitAdapter {
             if (scopePaths.length > 0) {
                 args.push('--', ...scopePaths);
             }
-            const output = await this.simpleGit.raw(args);
             const index = new TreeIndex();
-            for (const line of output.split(EOL)) {
+            for await (const line of this._spawnLines(args)) {
                 if (line)
                     index.add(treatPathSep(line));
             }
@@ -82,6 +116,66 @@ export default class GitAdapter {
             Logger.debug(lazy `preBuildTreeIndex: scoped ls-tree for '${revision}' failed: ${() => getErrorMessage(error)}`);
         }
     }
+    /**
+     * Spawns `git <args>`, streams stdout through a readline interface, and
+     * yields one line at a time. Replaces the old "run command, split on EOL"
+     * pattern that accumulated a multi-MB string for megarepo diffs / tree
+     * listings before any downstream consumer ran.
+     *
+     * The spawned child is pushed into streamingChildren so closeAll()
+     * kills it if teardown happens mid-stream. stderr is drained to the
+     * debug log; a non-zero exit code rejects the iterator on next read.
+     */
+    async *_spawnLines(args) {
+        const child = this.spawnFn('git', args, {
+            cwd: this.config.repo,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        this._trackChild(child);
+        const stderrChunks = [];
+        let stderrLen = 0;
+        child.stderr.on('data', (chunk) => {
+            if (stderrLen >= GitAdapter.STDERR_BUFFER_CAP)
+                return;
+            stderrChunks.push(chunk);
+            stderrLen += chunk.length;
+        });
+        const rl = createInterface({
+            input: child.stdout,
+            crlfDelay: Number.POSITIVE_INFINITY,
+        });
+        const exitPromise = new Promise((resolve, reject) => {
+            child.once('error', reject);
+            child.once('close', resolve);
+        });
+        try {
+            for await (const line of rl) {
+                yield line;
+            }
+            const code = await exitPromise;
+            if (code !== 0 && code !== null) {
+                const stderr = Buffer.concat(stderrChunks)
+                    .subarray(0, GitAdapter.STDERR_BUFFER_CAP)
+                    .toString('utf8')
+                    .trim();
+                throw new Error(`git ${args[0]} exited ${code}${stderr ? `: ${stderr}` : ''}`);
+            }
+        }
+        finally {
+            rl.close();
+            if (!child.killed && child.exitCode === null)
+                child.kill();
+        }
+    }
+    _trackChild(child) {
+        this.streamingChildren.push(child);
+        child.once('close', () => {
+            const idx = this.streamingChildren.indexOf(child);
+            /* v8 ignore next -- defensive: the close listener is once-only and bound to the tracked child; idx is always >= 0 here */
+            if (idx !== -1)
+                this.streamingChildren.splice(idx, 1);
+        });
+    }
     pathExistsImpl(path, revision) {
         const index = this.treeIndex.get(revision);
         if (!index)
@@ -99,11 +193,171 @@ export default class GitAdapter {
     async getBufferContent(forRef) {
         let content = await this.getBatchCatFile().getContent(forRef.oid, forRef.path);
         if (isLFS(content)) {
-            const lsfPath = getLFSObjectContentPath(content);
-            content = await readFile(join(this.config.repo, lsfPath));
+            const lfsPath = getLFSObjectContentPath(content);
+            content = await readFile(join(this.config.repo, lfsPath));
+        }
+        return content;
+    }
+    async getBufferContentOrEscalate(forRef) {
+        let content = await this.getBatchCatFile().getContentOrEscalate(forRef.oid, forRef.path);
+        if (isLFS(content)) {
+            const lfsPath = getLFSObjectContentPath(content);
+            content = await readFile(join(this.config.repo, lfsPath));
         }
         return content;
     }
+    /**
+     * Streams a directory from `revision` as `git archive --format=tar`
+     * entries. Yields `{ path, stream }` per file entry (directories are
+     * skipped). The tar subprocess is registered in streamingChildren so
+     * closeAll kills it on teardown.
+     *
+     * Callers MUST consume each entry's stream — even when skipping the
+     * entry — otherwise tar-stream back-pressures and halts parsing. For
+     * skip cases use `stream.resume()` to drain-and-discard.
+     */
+    async *streamArchive(path, revision) {
+        if (path.startsWith('-') || revision.startsWith('-')) {
+            throw new Error(`Refusing to spawn git archive for ${path}`);
+        }
+        const { extract } = await import('tar-stream');
+        const extractor = extract();
+        const child = this.spawnFn('git', ['archive', '--format=tar', revision, '--', path], { cwd: this.config.repo, stdio: ['ignore', 'pipe', 'pipe'] });
+        this._trackChild(child);
+        child.on('error', err => extractor.destroy(err));
+        child.stderr.on('data', (chunk) => {
+            Logger.debug(lazy `streamArchive stderr for ${path}@${revision}: ${() => chunk.toString()}`);
+        });
+        child.stdout.pipe(extractor);
+        try {
+            for await (const entry of extractor) {
+                if (entry.header.type !== 'file') {
+                    entry.resume();
+                    continue;
+                }
+                yield { path: entry.header.name, stream: entry };
+            }
+        }
+        finally {
+            if (!child.killed && child.exitCode === null)
+                child.kill();
+        }
+    }
+    /**
+     * Spawns a dedicated `git cat-file blob <oid>` subprocess and returns a
+     * Readable that peeks the first chunks for LFS pointer magic. On match,
+     * the spawned subprocess is killed and the Readable is fed from the
+     * resolved LFS object file. Otherwise bytes are forwarded as-is.
+     */
+    streamContent(forRef) {
+        const out = new PassThrough();
+        // Defense in depth: `git cat-file blob <ref>` treats a ref starting
+        // with `-` as an option. Refs come from git diff output so this
+        // shouldn't happen in normal operation, but a malicious diff or a
+        // path with a leading dash would give git an option it respects.
+        // Fail fast with a clear error rather than trust the subprocess.
+        if (forRef.path.startsWith('-') || forRef.oid.startsWith('-')) {
+            process.nextTick(() => out.destroy(new Error(`Refusing to spawn git cat-file for ${forRef.path}`)));
+            return out;
+        }
+        const child = this.spawnFn('git', ['cat-file', 'blob', `${forRef.oid}:${forRef.path}`], { cwd: this.config.repo, stdio: ['ignore', 'pipe', 'pipe'] });
+        this._trackChild(child);
+        this._wireStreamContent(child, out, forRef);
+        return out;
+    }
+    _wireStreamContent(child, out, forRef) {
+        let peeked = [];
+        let peekedLen = 0;
+        let decided = false;
+        const forwardPeeked = () => {
+            const head = Buffer.concat(peeked, peekedLen);
+            peeked = [];
+            peekedLen = 0;
+            return head;
+        };
+        const onChunk = (chunk) => {
+            if (decided) {
+                /* v8 ignore next -- defensive: PassThrough rarely returns false here; backpressure handled at write time, drain listener resumes */
+                if (!out.write(chunk))
+                    child.stdout.pause();
+                return;
+            }
+            peeked.push(chunk);
+            peekedLen += chunk.length;
+            if (peekedLen < LFS_MAGIC.length)
+                return;
+            decided = true;
+            const head = forwardPeeked();
+            if (head.subarray(0, LFS_MAGIC.length).equals(LFS_MAGIC)) {
+                this._handoffToLfs(child, out, head);
+                return;
+            }
+            /* v8 ignore next -- defensive: PassThrough rarely returns false here; backpressure handled at write time, drain listener resumes */
+            if (!out.write(head))
+                child.stdout.pause();
+        };
+        child.stdout.on('data', onChunk);
+        out.on('drain', () => child.stdout.resume());
+        child.stdout.on('end', () => {
+            if (!decided && peekedLen > 0) {
+                out.write(forwardPeeked());
+            }
+            /* v8 ignore next -- defensive: forwardPeeked above zeroes peekedLen, so the second arm always evaluates true after a flush */
+            if (decided || peekedLen === 0)
+                out.end();
+        });
+        child.stderr.on('data', (chunk) => {
+            Logger.debug(lazy `streamContent stderr for ${forRef.path}: ${() => chunk.toString()}`);
+        });
+        child.on('error', err => out.destroy(err));
+        child.on('close', code => {
+            // Intentional kills during LFS handoff close with a null/non-zero
+            // code; destroying `out` here would truncate the piped LFS stream
+            // the handoff just started.
+            if (code !== 0 && code !== null && !child.killed && !out.destroyed) {
+                out.destroy(new Error(`git cat-file blob exited ${code}`));
+            }
+        });
+    }
+    _handoffToLfs(child, out, head) {
+        const pointerParts = [head];
+        let pointerLen = head.length;
+        let aborted = false;
+        // Replace both data and end listeners from _wireStreamContent: the
+        // original end listener calls out.end() when decided===true, which would
+        // close `out` before the LFS file stream begins piping into it and the
+        // consumer would receive an empty/truncated payload.
+        child.stdout.removeAllListeners('data');
+        child.stdout.removeAllListeners('end');
+        child.stdout.on('data', (c) => {
+            if (aborted)
+                return;
+            pointerParts.push(c);
+            pointerLen += c.length;
+            if (pointerLen > GitAdapter.LFS_POINTER_CAP) {
+                aborted = true;
+                out.destroy(new Error('LFS pointer exceeds expected size'));
+            }
+        });
+        child.stdout.on('end', () => {
+            if (aborted)
+                return;
+            try {
+                const pointer = Buffer.concat(pointerParts, pointerLen);
+                const lfsPath = getLFSObjectContentPath(pointer);
+                createReadStream(join(this.config.repo, lfsPath))
+                    .on('error', err => out.destroy(err))
+                    .pipe(out);
+            }
+            catch (err) {
+                /* v8 ignore next -- defensive: getLFSObjectContentPath / createReadStream throw Error instances in practice; the String() fallback exists for non-Error throws */
+                out.destroy(err instanceof Error ? err : new Error(String(err)));
+            }
+        });
+        /* v8 ignore next -- defensive: _handoffToLfs is reached after the first peek; the child is alive at this point */
+        if (!child.killed)
+            child.kill();
+    }
     async getStringContent(forRef) {
         const content = await this.getBufferContent(forRef);
         return content.toString(UTF8_ENCODING);
@@ -156,49 +410,121 @@ export default class GitAdapter {
         }
     }
     // Fast path (no whitespace ignore): one `git diff --name-status` call.
+    // Rename detection (`-M` + `R` filter) is gated behind
+    // `config.changesManifest` so the default sgd pipeline emits the same
+    // A/M/D line shape as before this feature. When enabled, renames surface
+    // as `R<score>\tfrom\tto` lines that RepoGitDiff splits into synthetic
+    // A/D while recording the rename pair for ChangeSet.
+    //
+    // Whitespace path: three (or four, when rename detection is on) parallel
+    // `git diff --numstat` calls, one per --diff-filter. `--name-status` does
+    // NOT honor `--ignore-all-space` (git decides A/M/D from blob SHAs for
+    // that mode, so a whitespace-only change still appears as `M`). Only
+    // `--numstat` computes a real content diff under the whitespace flags,
+    // so files with 0/0 line changes drop out naturally. When rename
+    // detection is enabled the R call uses `-z` so it can sidestep numstat's
+    // brace/arrow rename-path encoding.
     //
-    // Whitespace path: three parallel `git diff --numstat --diff-filter=X`
-    // calls. `--name-status` does NOT honor `--ignore-all-space` — git decides
-    // A/M/D from blob SHAs for that mode, so a whitespace-only change still
-    // appears as `M`. Only `--numstat` computes a real content diff under the
-    // whitespace flags, so files with 0/0 line changes drop out naturally.
-    // A and D can't produce whitespace-only false positives, so the expensive
-    // path is only needed to correctly filter M.
-    async getDiffLines() {
+    // The Promise.all fans out to 4 items with rename detection on. That's a
+    // localised exception to the CLAUDE.local.md ≤3 bounded-Promise.all
+    // guideline: the four `--diff-filter`s are the canonical per-kind split,
+    // so hiding R as an out-of-band sequential await just obscures the real
+    // symmetric fan-out without changing the resource footprint.
+    async *streamDiffLines() {
+        const detectRenames = Boolean(this.config.changesManifest);
         if (!this.config.ignoreWhitespace) {
-            const output = await this.simpleGit.raw([
+            const args = [
                 'diff',
                 '--name-status',
-                '--no-renames',
-                '--diff-filter=AMD',
+                ...(detectRenames ? ['-M'] : ['--no-renames']),
+                `--diff-filter=${detectRenames ? 'AMDR' : 'AMD'}`,
                 this.config.from,
                 this.config.to,
                 '--',
                 ...this.config.source,
-            ]);
-            return output
-                .split(EOL)
-                .filter(Boolean)
-                .map(line => treatPathSep(line));
+            ];
+            for await (const line of this._spawnLines(args)) {
+                if (line)
+                    yield treatPathSep(line);
+            }
+            return;
         }
-        const results = await Promise.all([ADDITION, MODIFICATION, DELETION].map(async (changeType) => {
-            const output = await this.simpleGit.raw([
-                'diff',
-                '--numstat',
-                '--no-renames',
-                ...IGNORE_WHITESPACE_PARAMS,
-                `--diff-filter=${changeType}`,
-                this.config.from,
-                this.config.to,
-                '--',
-                ...this.config.source,
-            ]);
-            return output
-                .split(EOL)
-                .filter(Boolean)
-                .map(line => treatPathSep(line.replace(NUM_STAT_CHANGE_INFORMATION, `${changeType}\t`)));
-        }));
-        return results.flat();
+        // When rename detection is on, the A/M/D filters also run with -M so
+        // renamed files drop out (reclassified to R by git), and the dedicated
+        // R call is the single source of rename lines — no dedup needed.
+        // Without rename detection, A/M/D keep their pre-feature line shape via
+        // --no-renames.
+        const filters = detectRenames
+            ? [ADDITION, MODIFICATION, DELETION, RENAMED]
+            : [ADDITION, MODIFICATION, DELETION];
+        // Numstat path runs one git invocation per change-type; we still emit
+        // each batch as it lands so downstream filters can begin work before
+        // every filter has finished.
+        for (const changeType of filters) {
+            for (const line of await this._getNumstatLines(changeType, detectRenames)) {
+                yield line;
+            }
+        }
+    }
+    // Per-filter numstat call. The R branch uses `-z` because numstat
+    // otherwise encodes rename paths in three format variants within the
+    // path column (`{a => b}`, `a/{b => c}/d`, or bare `old => new`). `-z`
+    // emits `N<TAB>M<TAB>\0<src>\0<dst>\0` for each rename, so we stride-3
+    // over the NUL-split tokens and synthesise `R<TAB><src><TAB><dst>`
+    // lines that RepoGitDiff._expandRenames already understands.
+    //
+    // A/M/D: streamed via _spawnLines + readline, per-line transform strips
+    // the leading `N\tM\t` counts and rewrites them to the status prefix.
+    // R (NUL-delimited): buffered via simpleGit.raw because readline is
+    // newline-oriented and the whole-string split remains cheap for the
+    // rare rename set.
+    async _getNumstatLines(changeType, detectRenames) {
+        if (changeType === RENAMED) {
+            return this._getRenameLines();
+        }
+        const args = [
+            'diff',
+            '--numstat',
+            ...(detectRenames ? ['-M'] : ['--no-renames']),
+            ...IGNORE_WHITESPACE_PARAMS,
+            `--diff-filter=${changeType}`,
+            this.config.from,
+            this.config.to,
+            '--',
+            ...this.config.source,
+        ];
+        const lines = [];
+        for await (const line of this._spawnLines(args)) {
+            /* v8 ignore next -- defensive: _spawnLines splits on EOL; trailing/empty lines from git numstat are filtered here */
+            if (!line)
+                continue;
+            lines.push(treatPathSep(line.replace(NUM_STAT_CHANGE_INFORMATION, `${changeType}\t`)));
+        }
+        return lines;
+    }
+    async _getRenameLines() {
+        const output = await this.simpleGit.raw([
+            'diff',
+            '--numstat',
+            '-M',
+            '-z',
+            ...IGNORE_WHITESPACE_PARAMS,
+            `--diff-filter=${RENAMED}`,
+            this.config.from,
+            this.config.to,
+            '--',
+            ...this.config.source,
+        ]);
+        const tokens = output.split('\0');
+        const lines = [];
+        for (let i = 0; i + 2 < tokens.length; i += 3) {
+            const src = tokens[i + 1];
+            const dst = tokens[i + 2];
+            if (!src || !dst)
+                continue;
+            lines.push(treatPathSep(`${RENAMED}${TAB}${src}${TAB}${dst}`));
+        }
+        return lines;
     }
 }
 __decorate([
@@ -230,5 +556,5 @@ __decorate([
 ], GitAdapter.prototype, "gitGrep", null);
 __decorate([
     log
-], GitAdapter.prototype, "getDiffLines", null);
+], GitAdapter.prototype, "streamDiffLines", null);
 //# sourceMappingURL=GitAdapter.js.map