@1agh/maude 0.35.0 → 0.36.1

package/apps/studio/git/service.ts

@@ -32,6 +32,56 @@ import git from 'isomorphic-git';
 import http from 'isomorphic-git/http/node';
 
 const USE_SYSTEM_GIT = /^(1|true|on|yes)$/i.test(process.env.MAUDE_USE_SYSTEM_GIT ?? '');
+// DDR-133 (DDR-107 end-state): auto-prefer a detected system `git` for the NETWORK
+// paths (gitFetchRemote / remoteAheadBehind — native fetch is instant + uses the
+// user's own credential helper / SSH agent) AND the READ paths (status / list-
+// branches / log / diff / show / unpushed / current-branch). The pure-JS iso engine
+// is genuinely slow on a real-world repo — and worse, `git.statusMatrix` /
+// `git.listBranches` can throw on some trees ("No obj for …") and wedge the 10 s
+// Bun.serve idle window, which is exactly what made the switcher's branch list
+// vanish + the dropdown hang. System git's `status --porcelain` / `for-each-ref`
+// are instant and don't have that failure mode. iso remains the fallback when no
+// `git` is on PATH (the zero-setup promise) and still backs the WRITE paths
+// (commit / checkout / branch / fold / push / pull) unless forced. MAUDE_USE_SYSTEM_GIT=1
+// forces system git everywhere; MAUDE_NO_SYSTEM_GIT=1 pins everything to iso
+// (escape hatch / deterministic test engine).
+// Read live (not a module-load const) so a test can scope MAUDE_NO_SYSTEM_GIT around
+// a single assertion to deterministically exercise the iso engine without leaking.
+const noSystemGit = (): boolean => /^(1|true|on|yes)$/i.test(process.env.MAUDE_NO_SYSTEM_GIT ?? '');
+let systemGitProbe: Promise<boolean> | undefined;
+/** True when a usable `git` binary is on PATH. Memoized per process — the sidecar
+ *  respawns per repo (DDR-132), so one `git --version` probe per process is correct
+ *  and cheap. The probe NEVER relaxes the DDR-131 transport gate: callers classify
+ *  the remote URL first; this only picks which engine runs an already-vetted op. */
+function systemGitAvailable(): Promise<boolean> {
+  if (USE_SYSTEM_GIT) return Promise.resolve(true);
+  if (noSystemGit()) return Promise.resolve(false);
+  if (!systemGitProbe) {
+    systemGitProbe = runGit(process.cwd(), ['--version'], undefined, 4000)
+      .then((r) => r.code === 0 && /git version/i.test(r.stdout))
+      .catch(() => false);
+  }
+  return systemGitProbe;
+}
+
+const TIMED_OUT = Symbol('maude-git-timeout');
+/** Race `p` against a timeout. Returns `TIMED_OUT` if the deadline wins; a late
+ *  rejection from the losing promise is swallowed so it never surfaces as an
+ *  unhandledRejection. */
+function withTimeout<T>(p: Promise<T>, ms: number): Promise<T | typeof TIMED_OUT> {
+  p.catch(() => {});
+  let timer: ReturnType<typeof setTimeout>;
+  const t = new Promise<typeof TIMED_OUT>((res) => {
+    timer = setTimeout(() => res(TIMED_OUT), ms);
+  });
+  return Promise.race([p, t]).finally(() => clearTimeout(timer));
+}
+
+/** Bounds for the two unbounded network paths (DDR-133). A stalled remote must
+ *  surface a fast, friendly result instead of hanging the popup / the unattended
+ *  status poll. */
+const FETCH_TIMEOUT_MS = 12_000;
+const PROBE_TIMEOUT_MS = 8_000;
 
 /** One changed file as the Changes panel renders it. `status` maps to the M/A/D/U
  *  badge (DDR-075 status hues): modified→M, added→A, deleted→D, untracked→U. */
@@ -214,13 +264,21 @@ interface RunResult {
   code: number;
   stdout: string;
   stderr: string;
+  /** True when `timeoutMs` elapsed and the child was killed (DDR-133). */
+  timedOut?: boolean;
 }
 
 /** Run `git <args>` in `dir`. `tokenRemote` (when given) replaces the `origin`
  *  URL's userinfo with the token for this one invocation via `-c` config so the
  *  PAT never lands in the on-disk remote URL or the process title's argv beyond
- *  the ephemeral child. */
-function runGit(dir: string, args: string[], env?: Record<string, string>): Promise<RunResult> {
+ *  the ephemeral child. `timeoutMs` (DDR-133) hard-kills a stalled child so the
+ *  network paths can never hang the UI / the unattended poll. */
+function runGit(
+  dir: string,
+  args: string[],
+  env?: Record<string, string>,
+  timeoutMs?: number
+): Promise<RunResult> {
   return new Promise((resolveRun) => {
     const child = spawn('git', args, {
       cwd: dir,
@@ -229,14 +287,28 @@ function runGit(dir: string, args: string[], env?: Record<string, string>): Prom
     });
     let stdout = '';
     let stderr = '';
+    let timedOut = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    if (timeoutMs && timeoutMs > 0) {
+      timer = setTimeout(() => {
+        timedOut = true;
+        child.kill('SIGKILL');
+      }, timeoutMs);
+    }
     child.stdout.on('data', (d) => {
       stdout += d.toString();
     });
     child.stderr.on('data', (d) => {
       stderr += d.toString();
     });
-    child.on('error', (e) => resolveRun({ code: 127, stdout, stderr: String(e) }));
-    child.on('close', (code) => resolveRun({ code: code ?? 1, stdout, stderr }));
+    child.on('error', (e) => {
+      if (timer) clearTimeout(timer);
+      resolveRun({ code: 127, stdout, stderr: String(e), timedOut });
+    });
+    child.on('close', (code) => {
+      if (timer) clearTimeout(timer);
+      resolveRun({ code: timedOut ? 124 : (code ?? 1), stdout, stderr, timedOut });
+    });
   });
 }
 
@@ -247,7 +319,9 @@ export async function gitStatus(dir: string, opts: GitStatusOpts = {}): Promise<
     return { repo: false, branch: null, files: [], clean: true, unpushed: 0 };
   }
   const prefix = normPrefix(opts.designPrefix);
-  const result = USE_SYSTEM_GIT ? await statusSystem(dir, prefix) : await statusIso(dir, prefix);
+  const result = (await systemGitAvailable())
+    ? await statusSystem(dir, prefix)
+    : await statusIso(dir, prefix);
 
   // Local "saved but not published" count — no network (uses the cached
   // remote-tracking ref). Lets the panel offer Publish even on a clean tree.
@@ -434,28 +508,171 @@ export async function gitDiscard(
 // `.git/HEAD` watcher already turns into a Yjs flush + reload prompt (DDR-051) —
 // this module does NOT duplicate that.
 
+/** The default remote a managed Maude project tracks (DDR-111 clone). */
+const DEFAULT_REMOTE = 'origin';
+
+/** How we'll transport-fetch a remote, derived from its URL:
+ *   - `http`   → isomorphic-git (HTTP-only) OR system git with a token header.
+ *   - `ssh`    → system git only (user's own ssh-agent creds), NEVER a token.
+ *     Covers `ssh://` / `git://` / the scp-like `git@github.com:org/repo` form.
+ *   - `none`   → no remote configured; nothing to fetch (benign).
+ *   - `unsafe` → REFUSE — never hand to the git binary. The `ext::` / `fd::` /
+ *     `transport::` helpers make `git fetch` run an ARBITRARY SHELL COMMAND from the
+ *     config URL. A poisoned `.git/config` (which rides a folder/clone and no
+ *     file-review sees) would otherwise be RCE the moment the unattended status
+ *     poll fires. Also refuses `file://` / local-path (local-read vector) and any
+ *     unknown scheme. See DDR-131 hardening + the adversarial review of 75a2f0d. */
+type RemoteTransport = 'http' | 'ssh' | 'none' | 'unsafe';
+
+function classifyRemoteUrl(url: string): RemoteTransport {
+  const u = (url || '').trim();
+  if (!u) return 'none';
+  // Transport helpers embed `::` (ext::, fd::, transport::) → arbitrary command. Reject first.
+  if (u.includes('::')) return 'unsafe';
+  if (/^https?:\/\//i.test(u)) return 'http';
+  if (/^(?:ssh|git):\/\//i.test(u)) return 'ssh';
+  // scp-like `user@host:path` (no scheme) — the common `git@github.com:org/repo` form.
+  if (/^[\w.+-]+@[\w.-]+:[^/]/.test(u)) return 'ssh';
+  // file://, bare local paths, and anything else: REFUSE. A managed project tracks
+  // a github.com http/ssh remote; a local/file transport is both unusual and a
+  // local-read vector, so we don't hand it to the git binary at all.
+  return 'unsafe';
+}
+
+/** Read a remote's configured URL (empty string when missing). */
+async function readRemoteUrl(dir: string, remote: string): Promise<string> {
+  return (await git.getConfig({ fs, dir, path: `remote.${remote}.url` }).catch(() => null)) || '';
+}
+
+/** The GitHub PAT (keychain) may ONLY be attached to a request bound for GitHub —
+ *  never to an arbitrary HTTPS host an attacker put in `remote.origin.url` (PAT
+ *  exfil / SSRF). HTTP(S) urls only; ssh carries no token regardless. */
+function isTrustedTokenHost(url: string): boolean {
+  try {
+    const h = new URL(url).hostname.toLowerCase();
+    return h === 'github.com' || h.endsWith('.github.com');
+  } catch {
+    return false;
+  }
+}
+
+/** Defense-in-depth for any `runGit` that resolves a config remote URL: disable the
+ *  command-EXECUTING transports at the git layer too (`classifyRemoteUrl` already
+ *  refuses them before we spawn — this is the backstop). Deliberately does NOT
+ *  block `file`/local object transfer (legitimate local-repo fetch), only the
+ *  shell-spawning helpers. */
+const HARDENED_REMOTE_FLAGS = ['-c', 'protocol.ext.allow=never', '-c', 'protocol.fd.allow=never'];
+
+/** Non-empty, trimmed lines of a git stdout block. */
+function splitLines(stdout: string): string[] {
+  return stdout
+    .split('\n')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+/** Fold a remote-tracking ref into the merged draft map: a name already seen
+ *  locally becomes `both` (recents = the newer of the two commit times); a name
+ *  seen only on the remote becomes a `remote`-only draft. */
+function mergeRemote(merged: Map<string, GitBranch>, name: string, updatedAt: number): void {
+  const existing = merged.get(name);
+  if (existing) {
+    merged.set(name, {
+      ...existing,
+      where: 'both',
+      updatedAt: Math.max(existing.updatedAt, updatedAt),
+    });
+  } else {
+    merged.set(name, { name, current: false, updatedAt, where: 'remote' });
+  }
+}
+
 export interface GitBranch {
   name: string;
   current: boolean;
+  /** Last-commit time on this branch, unix seconds — drives the "recents" sort in
+   *  the switcher. 0 when unknown (resolution failed / empty branch). */
+  updatedAt: number;
+  /** Where this draft lives. `local` = only here, `remote` = only on the team's
+   *  remote (not downloaded yet — switching creates a tracking branch), `both` =
+   *  present in both. The UI labels `remote` drafts "from your team". */
+  where: 'local' | 'remote' | 'both';
 }
 
-/** List local branches (drafts). Returns [] when `dir` isn't a repo. */
+/** List drafts (branches) — LOCAL plus the remote-tracking refs already on disk
+ *  (populated by the original clone / a prior fetch; a fresh teammate draft only
+ *  appears after `gitFetchRemote`). Each carries its last-commit time so the UI
+ *  can sort by recents, and a `where` tag so it can mark remote-only drafts.
+ *  Returns [] when `dir` isn't a repo. */
 export async function gitListBranches(dir: string): Promise<GitBranch[]> {
   if (!isRepo(dir)) return [];
   try {
-    if (USE_SYSTEM_GIT) {
+    const merged = new Map<string, GitBranch>();
+    if (await systemGitAvailable()) {
       const cur = (await runGit(dir, ['rev-parse', '--abbrev-ref', 'HEAD'])).stdout.trim();
-      const r = await runGit(dir, ['for-each-ref', '--format=%(refname:short)', 'refs/heads']);
-      if (r.code !== 0) return [];
-      return r.stdout
-        .split('\n')
-        .map((s) => s.trim())
-        .filter(Boolean)
-        .map((name) => ({ name, current: name === cur }));
+      // Tab-separated so a branch name (no tabs/newlines, charset-guarded) can't
+      // collide with the delimiter; committerdate:unix is the recents key.
+      const fmt = '--format=%(refname:short)%09%(committerdate:unix)';
+      const local = await runGit(dir, ['for-each-ref', fmt, 'refs/heads']);
+      if (local.code !== 0) return [];
+      for (const line of splitLines(local.stdout)) {
+        const [name, ts] = line.split('\t');
+        merged.set(name, {
+          name,
+          current: name === cur,
+          updatedAt: Number(ts) || 0,
+          where: 'local',
+        });
+      }
+      // Remote refs come back as "origin/<name>" — strip the prefix, skip origin/HEAD.
+      // NB: `%(refname:short)` collapses the symbolic ref refs/remotes/origin/HEAD to
+      // the bare remote name ("origin"), so skip that too or it shows as a phantom branch.
+      const remote = await runGit(dir, ['for-each-ref', fmt, `refs/remotes/${DEFAULT_REMOTE}`]);
+      if (remote.code === 0) {
+        for (const line of splitLines(remote.stdout)) {
+          const [full, ts] = line.split('\t');
+          if (!full || full === DEFAULT_REMOTE) continue; // origin/HEAD short form
+          const name = full.startsWith(`${DEFAULT_REMOTE}/`)
+            ? full.slice(DEFAULT_REMOTE.length + 1)
+            : full;
+          if (!name || name === 'HEAD') continue;
+          mergeRemote(merged, name, Number(ts) || 0);
+        }
+      }
+      return [...merged.values()];
     }
+    // iso engine (default): merge local heads with refs/remotes/<remote>/*.
     const cur = (await git.currentBranch({ fs, dir, fullname: false })) ?? null;
-    const names = await git.listBranches({ fs, dir });
-    return names.map((name) => ({ name, current: name === cur }));
+    const at = async (ref: string): Promise<number> => {
+      try {
+        const oid = await git.resolveRef({ fs, dir, ref });
+        const { commit } = await git.readCommit({ fs, dir, oid });
+        return commit.committer?.timestamp || 0;
+      } catch {
+        return 0; // empty / unresolvable ref — sorts last
+      }
+    };
+    const localNames = await git.listBranches({ fs, dir });
+    await Promise.all(
+      localNames.map(async (name) => {
+        merged.set(name, {
+          name,
+          current: name === cur,
+          updatedAt: await at(name),
+          where: 'local',
+        });
+      })
+    );
+    // Remote enumeration is best-effort: a repo with no remote yields [].
+    const remoteNames = (
+      await git.listBranches({ fs, dir, remote: DEFAULT_REMOTE }).catch(() => [])
+    ).filter((n) => n && n !== 'HEAD');
+    await Promise.all(
+      remoteNames.map(async (name) => {
+        mergeRemote(merged, name, await at(`refs/remotes/${DEFAULT_REMOTE}/${name}`));
+      })
+    );
+    return [...merged.values()];
   } catch {
     return [];
   }
@@ -498,21 +715,43 @@ export async function gitCheckout(dir: string, name: string): Promise<GitBranchR
   if (!isSafeGitPositional(name)) return { ok: false, error: 'Invalid draft name.' };
   try {
     if (USE_SYSTEM_GIT) {
+      // System git DWIMs `git checkout <name>` into a tracking branch when <name>
+      // exists on exactly one remote, so the local + remote-only cases share a path.
       const r = await runGit(dir, ['checkout', name]);
       if (r.code !== 0) {
         const blob = `${r.stderr} ${r.stdout}`.toLowerCase();
         if (blob.includes('would be overwritten') || blob.includes('local changes'))
           return { ok: false, error: 'Save your changes before switching drafts.' };
+        if (
+          blob.includes('did not match') ||
+          blob.includes('pathspec') ||
+          blob.includes('invalid reference')
+        )
+          return { ok: false, error: "Couldn't find that draft — try Refresh." };
         return { ok: false, error: r.stderr.trim() || 'Could not switch drafts.' };
       }
     } else {
-      await git.checkout({ fs, dir, ref: name });
+      // iso-git does NOT DWIM: a local ref checks out directly, but a remote-only
+      // draft must be created as a tracking branch from refs/remotes/<remote>/<name>.
+      const localNames = await git.listBranches({ fs, dir });
+      if (localNames.includes(name)) {
+        await git.checkout({ fs, dir, ref: name });
+      } else {
+        const remoteNames = await git
+          .listBranches({ fs, dir, remote: DEFAULT_REMOTE })
+          .catch(() => []);
+        if (!remoteNames.includes(name))
+          return { ok: false, error: "Couldn't find that draft — try Refresh." };
+        await git.checkout({ fs, dir, ref: name, remote: DEFAULT_REMOTE, track: true });
+      }
     }
     return { ok: true, branch: name };
   } catch (e) {
     const msg = errMsg(e);
     if (/overwrit|local change|conflict/i.test(msg))
       return { ok: false, error: 'Save your changes before switching drafts.' };
+    if (/not ?found|did not match|resolve/i.test(msg))
+      return { ok: false, error: "Couldn't find that draft — try Refresh." };
     return { ok: false, error: msg };
   }
 }
@@ -543,6 +782,7 @@ export async function gitFoldDraft(
 ): Promise<GitFoldResult> {
   if (!isRepo(dir)) return { ok: false, error: 'This project is not versioned yet.' };
   if (!isSafeGitPositional(draftName)) return { ok: false, error: 'Invalid draft name.' };
+  invalidateRemoteProbe(dir); // a fold changes ahead/behind — re-probe next status
   const remote = opts.remote || 'origin';
   const branches = await gitListBranches(dir);
   const shared = branches.find((b) => SHARED_BRANCHES.has(b.name))?.name;
@@ -635,6 +875,7 @@ export async function gitPush(
   opts: { remote?: string; ref?: string } = {}
 ): Promise<GitPushResult> {
   if (!isRepo(dir)) return { ok: false, error: 'This project is not versioned yet.' };
+  invalidateRemoteProbe(dir); // a publish changes ahead/behind — re-probe next status
   const remote = opts.remote || 'origin';
   return USE_SYSTEM_GIT
     ? pushSystem(dir, token, remote, opts.ref)
@@ -747,6 +988,7 @@ export async function gitPull(
   opts: { remote?: string; ref?: string } = {}
 ): Promise<GitPullResult> {
   if (!isRepo(dir)) return { ok: false, error: 'This project is not versioned yet.' };
+  invalidateRemoteProbe(dir); // a pull changes ahead/behind — re-probe next status
   return USE_SYSTEM_GIT
     ? pullSystem(dir, token, opts.remote || 'origin', opts.ref)
     : pullIso(dir, token, opts.remote || 'origin', opts.ref);
@@ -805,6 +1047,118 @@ async function pullSystem(
   return { ok: false, error: r.stderr.trim() || 'Get latest failed.' };
 }
 
+// ── fetch (Refresh drafts) ──────────────────────────────────────────────────
+
+export interface GitFetchResult {
+  ok: boolean;
+  /** Unix seconds the refresh completed — the UI shows it as "as of <time>". */
+  fetchedAt?: number;
+  /** See GitPushResult.authRequired — a tokenless refresh on the iso engine. */
+  authRequired?: boolean;
+  /** The fetch exceeded FETCH_TIMEOUT_MS and was bounded (DDR-133). */
+  timedOut?: boolean;
+  error?: string;
+}
+
+/** Refresh the team's drafts: fetch ALL remote heads (no singleBranch) so brand-new
+ *  teammate drafts surface in `gitListBranches`. Prunes deleted remotes. Same
+ *  optional-token model as gitPull. Explicit user gesture only — never auto-run. */
+export async function gitFetchRemote(
+  dir: string,
+  token: string | undefined,
+  opts: { remote?: string } = {}
+): Promise<GitFetchResult> {
+  if (!isRepo(dir)) return { ok: false, error: 'This project is not versioned yet.' };
+  const remote = opts.remote || DEFAULT_REMOTE;
+  if (!isSafeGitPositional(remote)) return { ok: false, error: 'Invalid remote name.' };
+  // SECURITY (DDR-131 hardening): classify the configured remote URL BEFORE spawning
+  // git. iso-git speaks HTTP(S) only, so an ssh/git remote must go to the system
+  // binary — but a command-executing (`ext::`) / local (`file://`) URL must be
+  // REFUSED, never handed to `git fetch` (it would run as the user). And the GitHub
+  // token may only ride a github.com HTTPS request, never an attacker-chosen host.
+  const url = await readRemoteUrl(dir, remote);
+  const transport = classifyRemoteUrl(url);
+  if (transport === 'none') return { ok: false, error: 'This project has no remote to refresh.' };
+  if (transport === 'unsafe')
+    return { ok: false, error: 'Maude can only refresh github.com (HTTPS or SSH) projects.' };
+  const trustedHttp = transport === 'http' && isTrustedTokenHost(url);
+  // Token/host POLICY is engine-independent (DDR-133): an HTTPS remote must be
+  // github.com (token-host = fetch-host — never lend the PAT to another host) and
+  // requires sign-in; an ssh remote uses the user's own key against whatever host
+  // they configured. The engine choice below only decides HOW a vetted fetch runs.
+  if (transport === 'http' && !trustedHttp)
+    return { ok: false, error: 'Maude can only refresh github.com projects.' };
+  // Tokenless github HTTPS: the iso engine can't authenticate (→ sign in), but system
+  // git uses the developer's own credential helper, so only block when there's no
+  // system git to fall back on (DDR-133). With system git, a tokenless fetch Just Works.
+  if (transport === 'http' && !token && !(await systemGitAvailable()))
+    return { ok: false, authRequired: true, error: 'Sign in with GitHub to refresh.' };
+  try {
+    if ((await systemGitAvailable()) || transport === 'ssh') {
+      // System git (auto-preferred when present — DDR-133): attach the token header
+      // ONLY for a trusted-host HTTPS remote (else fall back to the user's own
+      // credential helper); an ssh remote authenticates with the user's own key.
+      const args = trustedHttp ? tokenHeaderArgs(token) : [];
+      args.push(...HARDENED_REMOTE_FLAGS, 'fetch', '--prune', remote);
+      const r = await runGit(dir, args, undefined, FETCH_TIMEOUT_MS);
+      if (r.timedOut)
+        return {
+          ok: false,
+          timedOut: true,
+          error: 'Refresh timed out — check your connection and try again.',
+        };
+      if (r.code === 127)
+        return {
+          ok: false,
+          error: 'Refresh needs the git command-line tool for this project’s connection.',
+        };
+      if (r.code !== 0) {
+        const blob = `${r.stderr}\n${r.stdout}`.toLowerCase();
+        if (transport === 'http' && /auth|denied|credential|terminal prompts disabled/.test(blob))
+          return { ok: false, authRequired: true, error: 'Sign in with GitHub to refresh.' };
+        if (
+          /permission denied|publickey|host key|authenticity|could not read from remote/.test(blob)
+        )
+          return {
+            ok: false,
+            error: 'Couldn’t reach the remote — check your connection or SSH key.',
+          };
+        return { ok: false, error: r.stderr.trim() || 'Could not refresh drafts.' };
+      }
+    } else {
+      // iso engine: github HTTPS with a token (guaranteed by the policy guards above).
+      const fetched = await withTimeout(
+        git.fetch({
+          fs,
+          http,
+          dir,
+          remote,
+          prune: true,
+          onAuth: () => ({ username: token ?? '', password: '' }),
+        }),
+        FETCH_TIMEOUT_MS
+      );
+      if (fetched === TIMED_OUT)
+        return {
+          ok: false,
+          timedOut: true,
+          error: 'Refresh timed out — check your connection and try again.',
+        };
+    }
+    return { ok: true, fetchedAt: Math.floor(Date.now() / 1000) };
+  } catch (e) {
+    const msg = errMsg(e);
+    if (/unrecognized transport|unsupported|protocol/i.test(msg))
+      return {
+        ok: false,
+        error: 'Refresh needs the git command-line tool for this project’s connection.',
+      };
+    if (/auth|denied|credential|401|403/i.test(msg))
+      return { ok: false, authRequired: true, error: 'Sign in with GitHub to refresh.' };
+    return { ok: false, error: msg };
+  }
+}
+
 // ── resolve (finish a Get-latest merge that hit a conflict) ─────────────────
 
 /** Finish the merge `gitPull` left unresolved, applying one CHOICE to every
@@ -1001,7 +1355,9 @@ function mineCopyPath(rel: string): string {
  *  design tree). */
 export async function gitLog(dir: string, limit = 30, filepath?: string): Promise<GitLogEntry[]> {
   if (!isRepo(dir)) return [];
-  return USE_SYSTEM_GIT ? logSystem(dir, limit, filepath) : logIso(dir, limit, filepath);
+  return (await systemGitAvailable())
+    ? logSystem(dir, limit, filepath)
+    : logIso(dir, limit, filepath);
 }
 
 async function logIso(dir: string, limit: number, filepath?: string): Promise<GitLogEntry[]> {
@@ -1061,7 +1417,7 @@ export async function gitDiff(
 ): Promise<GitDiffEntry[]> {
   if (!isRepo(dir)) return [];
   const prefix = normPrefix(opts.designPrefix);
-  return USE_SYSTEM_GIT ? diffSystem(dir, sha, prefix) : diffIso(dir, sha, prefix);
+  return (await systemGitAvailable()) ? diffSystem(dir, sha, prefix) : diffIso(dir, sha, prefix);
 }
 
 async function diffIso(dir: string, sha: string, prefix: string): Promise<GitDiffEntry[]> {
@@ -1128,7 +1484,7 @@ export async function gitShowFile(
   const rel = repoRelPath.replace(/\\/g, '/');
   if (!isContainedRepoPath(dir, rel)) return null;
   try {
-    if (USE_SYSTEM_GIT) {
+    if (await systemGitAvailable()) {
       const r = await runGit(dir, ['show', `${sha}:${rel}`]);
       return r.code === 0 ? r.stdout : null;
     }
@@ -1152,7 +1508,7 @@ async function localUnpushed(dir: string, branch: string | null, remote: string)
   // server-derived today, but never interpolate an unguarded positional into git
   // argv (defense-in-depth so a future caller can't re-open the injection class).
   if (!isSafeGitPositional(branch) || !isSafeGitPositional(remote)) return 0;
-  if (USE_SYSTEM_GIT) {
+  if (await systemGitAvailable()) {
     const r = await runGit(dir, ['rev-list', '--count', `${remote}/${branch}..HEAD`]);
     if (r.code === 0) return Number(r.stdout.trim()) || 0;
     // No tracking ref — count all commits if a remote exists, else 0.
@@ -1182,26 +1538,110 @@ async function localUnpushed(dir: string, branch: string | null, remote: string)
 
 // ── remote ahead/behind (Get latest nudge) ─────────────────────────────────
 
+interface AheadBehind {
+  ahead: number;
+  behind: number;
+}
+
+// In-memory TTL cache + in-flight dedupe for the network probe (DDR-132). A
+// Changes-panel toggle, a 60 s tick, and effect re-runs all call status?remote=1;
+// without this they each fire a fresh `git fetch`. The cache is per FRESH process
+// — a repo switch respawns the sidecar (fresh process ⇒ one fresh probe), which is
+// exactly the desired semantics, so it deliberately never persists to disk.
+const REMOTE_PROBE_TTL_MS = 45_000;
+const probeCache = new Map<string, { at: number; val: AheadBehind }>();
+const probeInflight = new Map<string, Promise<AheadBehind>>();
+
+/** Drop any cached/in-flight probe for `dir` so the next status re-fetches —
+ *  called after a push/pull/fold so the "Get latest" nudge updates immediately. */
+export function invalidateRemoteProbe(dir: string): void {
+  const prefix = `${dir}\0`;
+  for (const k of probeCache.keys()) if (k.startsWith(prefix)) probeCache.delete(k);
+  for (const k of probeInflight.keys()) if (k.startsWith(prefix)) probeInflight.delete(k);
+}
+
+/** Resolve the current branch with the active engine — local-only, no network. */
+async function currentBranchOf(dir: string): Promise<string> {
+  if (await systemGitAvailable()) {
+    const r = await runGit(dir, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    return r.stdout.trim() || 'main';
+  }
+  return (await git.currentBranch({ fs, dir, fullname: false })) || 'main';
+}
+
 /** Fetch the tracking remote and count commits ahead (local-only) / behind
  *  (remote-only). `behind > 0` is what surfaces the "Get latest" banner. Network;
- *  callers guard with try/catch so an offline poll never breaks local status. */
+ *  callers guard with try/catch so an offline poll never breaks local status.
+ *
+ *  TTL-cached + in-flight-deduped per `dir\0remote\0branch` (DDR-132): a value
+ *  younger than the TTL is served without a fetch, and concurrent callers share
+ *  one in-flight promise. Only the RESOLVED value is cached — a throw clears the
+ *  in-flight slot so a later call retries (failures are never cached). */
 export async function remoteAheadBehind(
   dir: string,
   token: string | undefined,
   remote = 'origin'
-): Promise<{ ahead: number; behind: number }> {
-  if (USE_SYSTEM_GIT) return remoteAheadBehindSystem(dir, token, remote);
-  const branch = (await git.currentBranch({ fs, dir, fullname: false })) || 'main';
-  await git.fetch({
-    fs,
-    http,
-    dir,
-    remote,
-    ref: branch,
-    singleBranch: true,
-    tags: false,
-    onAuth: () => ({ username: token ?? '', password: '' }),
-  });
+): Promise<AheadBehind> {
+  const branch = await currentBranchOf(dir);
+  const key = `${dir}\0${remote}\0${branch}`;
+  const hit = probeCache.get(key);
+  if (hit && Date.now() - hit.at < REMOTE_PROBE_TTL_MS) return hit.val;
+  const existing = probeInflight.get(key);
+  if (existing) return existing;
+  const p = remoteAheadBehindUncached(dir, token, remote, branch)
+    .then((val) => {
+      probeCache.set(key, { at: Date.now(), val });
+      return val;
+    })
+    .finally(() => {
+      probeInflight.delete(key);
+    });
+  probeInflight.set(key, p);
+  return p;
+}
+
+async function remoteAheadBehindUncached(
+  dir: string,
+  token: string | undefined,
+  remote: string,
+  branch: string
+): Promise<AheadBehind> {
+  // SECURITY (DDR-131 hardening): this probe runs UNATTENDED (status?remote=1 on a
+  // 60s tick / post-action), so it's the highest-value RCE sink — classify the
+  // remote URL before touching the git binary. A command-executing (`ext::`) or
+  // local (`file://`) URL is refused (return 0/0, no spawn); the token rides only a
+  // github.com HTTPS request, never an attacker-chosen host.
+  const url = await readRemoteUrl(dir, remote);
+  const transport = classifyRemoteUrl(url);
+  if (transport === 'none' || transport === 'unsafe') return { ahead: 0, behind: 0 };
+  const trustedHttp = transport === 'http' && isTrustedTokenHost(url);
+  // SECURITY (DDR-133 fix — adversarial review F1): the host-allowlist MUST gate this
+  // UNATTENDED probe BEFORE the engine branch, mirroring gitFetchRemote (`:1089`). With
+  // system git now auto-preferred, an http transport otherwise reached the system path
+  // for ANY host — turning a poisoned non-github `remote.origin.url` into an unattended
+  // `git fetch` SSRF/beacon (the old `!trustedHttp` guard sat AFTER the engine branch,
+  // so it only ever protected the now-dead iso path). github-only for http; ssh uses the
+  // user's own key (DDR-131-accepted, same as the explicit Refresh).
+  if (transport === 'http' && !trustedHttp) return { ahead: 0, behind: 0 };
+  if ((await systemGitAvailable()) || transport === 'ssh')
+    return remoteAheadBehindSystem(dir, trustedHttp ? token : undefined, remote, branch);
+  // iso engine, HTTP(S) to github (trustedHttp guaranteed by the guard above).
+  // Bounded (DDR-133): a timeout THROWS so the wrapper never caches it — the next
+  // poll retries, and local status is unaffected (caller try/catches).
+  const fetched = await withTimeout(
+    git.fetch({
+      fs,
+      http,
+      dir,
+      remote,
+      ref: branch,
+      singleBranch: true,
+      tags: false,
+      onAuth: () => ({ username: token ?? '', password: '' }),
+    }),
+    PROBE_TIMEOUT_MS
+  );
+  if (fetched === TIMED_OUT) throw new Error('remote probe timed out');
   const localOid = await git.resolveRef({ fs, dir, ref: branch });
   const remoteOid = await git
     .resolveRef({ fs, dir, ref: `refs/remotes/${remote}/${branch}` })
@@ -1224,15 +1664,18 @@ export async function remoteAheadBehind(
 async function remoteAheadBehindSystem(
   dir: string,
   token: string | undefined,
-  remote: string
+  remote: string,
+  branch: string
 ): Promise<{ ahead: number; behind: number }> {
-  const branch = (await runGit(dir, ['rev-parse', '--abbrev-ref', 'HEAD'])).stdout.trim() || 'main';
   if (!isSafeGitPositional(remote) || !isSafeGitPositional(branch)) {
     throw new Error('invalid remote or branch');
   }
-  const args = tokenHeaderArgs(token);
-  args.push('fetch', remote, branch);
-  const f = await runGit(dir, args);
+  // Token only when the caller vetted a trusted HTTPS host; harden the transport
+  // allowlist at the git layer too (defense-in-depth behind classifyRemoteUrl).
+  const args = token ? tokenHeaderArgs(token) : [];
+  args.push(...HARDENED_REMOTE_FLAGS, 'fetch', remote, branch);
+  const f = await runGit(dir, args, undefined, PROBE_TIMEOUT_MS);
+  if (f.timedOut) throw new Error('remote probe timed out');
   if (f.code !== 0) throw new Error(f.stderr.trim() || 'fetch failed');
   const counts = await runGit(dir, [
     'rev-list',