threadlines 0.2.21 → 0.2.23

package/dist/git/diff.js

@@ -145,11 +145,22 @@ async function getCommitAuthor(repoRoot, sha) {
  * Get diff for a PR/MR context in CI environments.
  *
  * This is a shared implementation for CI environments that do shallow clones.
- * It fetches the target branch on-demand and compares it against HEAD.
+ * Uses three-dots logic (merge base) to show only the developer's changes,
+ * avoiding drift from main moving forward.
  *
  * Strategy:
  * 1. Fetch target branch: origin/${targetBranch}:refs/remotes/origin/${targetBranch}
- * 2. Diff: origin/${targetBranch}..HEAD (two dots = direct comparison)
+ * 2. Find merge base (common ancestor) using git merge-base (plumbing command)
+ * 3. Fetch merge base commit (always fetch, assume not available)
+ * 4. Diff: ${mergeBase}..HEAD (shows only developer's changes, not changes from main)
+ *
+ * Why three dots (merge base) instead of two dots (direct comparison)?
+ * - Two dots: Shows all differences between target branch tip and HEAD
+ *   - Includes changes that happened in main since branching (drift)
+ *   - Can show files the developer didn't touch
+ * - Three dots: Shows only changes from merge base to HEAD
+ *   - Shows only what the developer actually changed
+ *   - Industry standard for "change detection" in PR/MR reviews
  *
  * Why HEAD instead of origin/${sourceBranch}?
  * - CI shallow clones only have HEAD available by default
@@ -175,12 +186,42 @@ async function getPRDiff(repoRoot, targetBranch, logger) {
             `This is required for PR/MR diff comparison. ` +
             `Error: ${fetchError instanceof Error ? fetchError.message : 'Unknown error'}`);
     }
-    // Use two dots (..) for direct comparison (same as GitHub)
-    // Two dots: shows all changes in HEAD that aren't in origin/${targetBranch}
-    // Three dots: requires finding merge base which can fail with shallow clones
-    logger?.debug(`Comparing origin/${targetBranch}..HEAD`);
-    const diff = await git.diff([`origin/${targetBranch}..HEAD`, '-U200']);
-    const diffSummary = await git.diffSummary([`origin/${targetBranch}..HEAD`]);
+    // Find merge base (common ancestor) using plumbing command
+    // Three dots logic: compare against merge base to show only developer's changes
+    // This avoids drift from main moving forward (two dots would include those changes)
+    let mergeBase;
+    try {
+        mergeBase = (0, child_process_1.execSync)(`git merge-base origin/${targetBranch} HEAD`, {
+            encoding: 'utf-8',
+            cwd: repoRoot
+        }).trim();
+        if (!mergeBase || mergeBase.length !== 40) {
+            throw new Error(`Invalid merge base SHA: "${mergeBase}"`);
+        }
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to find merge base between origin/${targetBranch} and HEAD. ` +
+            `This is required to show only the developer's changes (avoids drift from main). ` +
+            `Error: ${errorMessage}`);
+    }
+    // Always fetch merge base (assume it's not available, fetch is fast/no-op if it is)
+    // This ensures we have the merge base available for diff comparison
+    logger?.debug(`Fetching merge base: ${mergeBase}`);
+    try {
+        await git.fetch(['origin', mergeBase, '--depth=1']);
+    }
+    catch (fetchError) {
+        throw new Error(`Failed to fetch merge base ${mergeBase} from origin. ` +
+            `This is required for PR/MR diff comparison in shallow clones. ` +
+            `Ensure 'origin' remote is configured and accessible. ` +
+            `Error: ${fetchError instanceof Error ? fetchError.message : 'Unknown error'}`);
+    }
+    // Use merge base for diff (three dots logic: shows only developer's changes)
+    // git diff is plumbing command, ignores shallow boundaries
+    logger?.debug(`Comparing ${mergeBase}..HEAD (merge base vs PR branch)`);
+    const diff = await git.diff([`${mergeBase}..HEAD`, '-U200']);
+    const diffSummary = await git.diffSummary([`${mergeBase}..HEAD`]);
     const changedFiles = diffSummary.files.map(f => f.file);
     return {
         diff: diff || '',
@@ -190,7 +231,7 @@ async function getPRDiff(repoRoot, targetBranch, logger) {
 /**
  * Get diff for a specific commit (or HEAD if no SHA provided).
  *
- * Fetches the parent commit on-demand to ensure git show can generate a proper diff.
+ * Uses plumbing commands consistently to work reliably in shallow clones.
  * This works regardless of CI checkout depth settings (depth=1 or depth=2).
  *
  * Strategy:
@@ -199,8 +240,11 @@ async function getPRDiff(repoRoot, targetBranch, logger) {
  *    - Porcelain commands (git show) respect shallow boundaries and hide parents in shallow clones
  *    - This is critical for CI environments that use shallow clones (depth=1)
  * 2. Parse first parent line (handles standard commits and merge commits)
- * 3. Fetch parent commit if available (git fetch origin <parentSHA> --depth=1)
- * 4. Use git show to get diff (now parent is available for comparison)
+ * 3. Fetch parent commit (git fetch origin <parentSHA> --depth=1)
+ * 4. Use git diff <PARENT_SHA> HEAD to get diff (plumbing command, ignores shallow boundaries)
+ *    - git show HEAD still respects .git/shallow even after fetching parent
+ *    - git diff <PARENT_SHA> HEAD compares tree objects directly, ignoring shallow boundaries
+ *    - This is the key fix: must use plumbing commands consistently, not mix with porcelain
  *
  * Used by:
  * - All CI environments for push/commit context (GitHub, GitLab, Bitbucket, Vercel)
@@ -235,9 +279,14 @@ async function getCommitDiff(repoRoot, sha = 'HEAD') {
             throw new Error(`Commit ${sha} has no parent (it might be the root commit of the repository)`);
         }
         // Extract SHA from "parent <sha>" line
-        parentSha = parentLine.split(' ')[1].trim();
+        // Format: "parent <40-char-sha>"
+        const parts = parentLine.split(' ');
+        if (parts.length < 2 || !parts[1]) {
+            throw new Error(`Malformed parent line in commit object: "${parentLine}"`);
+        }
+        parentSha = parts[1].trim();
         if (!parentSha || parentSha.length !== 40) {
-            throw new Error(`Invalid parent SHA format: "${parentSha}"`);
+            throw new Error(`Invalid parent SHA format: "${parentSha}" (expected 40 characters)`);
         }
     }
     catch (error) {
@@ -246,33 +295,31 @@ async function getCommitDiff(repoRoot, sha = 'HEAD') {
             `This is required to generate a proper diff. ` +
             `Error: ${errorMessage}`);
     }
-    // Fetch parent commit (root commits have no parent, so this won't execute for them)
-    if (parentSha && parentSha.length === 40) {
-        try {
-            // Fetch just this one commit (depth=1 is fine, we only need the parent)
-            await git.fetch(['origin', parentSha, '--depth=1']);
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            throw new Error(`Failed to fetch parent commit ${parentSha} from origin. ` +
-                `This is required to generate a proper diff in shallow clones. ` +
-                `Ensure 'origin' remote is configured and accessible. ` +
-                `Error: ${errorMessage}`);
-        }
+    // Fetch parent commit (we've already validated parentSha is valid above)
+    // If we get here, parentSha is guaranteed to be a valid 40-character SHA
+    try {
+        // Fetch just this one commit (depth=1 is fine, we only need the parent)
+        await git.fetch(['origin', parentSha, '--depth=1']);
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to fetch parent commit ${parentSha} from origin. ` +
+            `This is required to generate a proper diff in shallow clones. ` +
+            `Ensure 'origin' remote is configured and accessible. ` +
+            `Error: ${errorMessage}`);
     }
-    // If no parent (root commit), git show will show the full commit content
-    // This is expected behavior for root commits
-    // Get diff using git show (now parent should be available)
+    // Get diff using plumbing command (git diff) instead of porcelain (git show)
+    // git show respects .git/shallow boundaries and will still treat HEAD as root commit
+    // git diff <PARENT_SHA> HEAD ignores shallow boundaries and compares tree objects directly
+    // This is critical for shallow clones - we must use plumbing commands consistently
     let diff;
     let changedFiles;
     try {
-        diff = await git.show([sha, '--format=', '--no-color', '-U200']);
-        // Get changed files using git show --name-only
-        const commitFiles = await git.show([sha, '--name-only', '--format=', '--pretty=format:']);
-        changedFiles = commitFiles
-            .split('\n')
-            .filter(line => line.trim().length > 0)
-            .map(line => line.trim());
+        // Use git diff to compare parent against HEAD (plumbing command, ignores shallow boundaries)
+        diff = await git.diff([`${parentSha}..${sha}`, '-U200']);
+        // Get changed files using git diff --name-only
+        const diffSummary = await git.diffSummary([`${parentSha}..${sha}`]);
+        changedFiles = diffSummary.files.map(f => f.file);
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : 'Unknown error';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "threadlines",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "Threadlines CLI - AI-powered linter based on your natural language documentation",
   "main": "dist/index.js",
   "bin": {