@adhdev/daemon-core 0.9.82-rc.8 → 0.9.82-rc.81

package/src/config/chat-history.ts

@@ -1387,22 +1387,23 @@ function callProviderNativeHistoryRead(
     agentType: string,
     canonicalHistory: ProviderCanonicalHistoryConfig | undefined,
     scripts: ProviderNativeHistoryScripts | undefined,
-    historySessionId: string,
+    historySessionId: string | undefined,
     workspace?: string,
 ): ProviderNativeHistoryReadResult | null {
     const fn = getProviderNativeHistoryScript(scripts, canonicalHistory, 'readSession');
     if (!fn) return null;
+    const normalizedSessionId = normalizeSavedHistorySessionId(historySessionId || '');
     const result = fn({
         agentType,
-        sessionId: historySessionId,
-        historySessionId,
+        sessionId: normalizedSessionId,
+        historySessionId: normalizedSessionId,
         workspace,
         format: canonicalHistory?.format,
         watchPath: canonicalHistory?.watchPath,
-        args: { sessionId: historySessionId, historySessionId, workspace },
+        args: { sessionId: normalizedSessionId, historySessionId: normalizedSessionId, workspace },
     });
     if (!result || typeof result !== 'object') return null;
-    const records = normalizeProviderNativeHistoryRecords(agentType, historySessionId, (result as any).messages || (result as any).records);
+    const records = normalizeProviderNativeHistoryRecords(agentType, normalizedSessionId, (result as any).messages || (result as any).records);
     if (records.length === 0) return null;
     return {
         records,
@@ -1419,7 +1420,8 @@ function buildNativeHistoryReadResult(
     workspace?: string,
 ): ProviderNativeHistoryReadResult | null {
     const normalizedSessionId = normalizeSavedHistorySessionId(historySessionId || '');
-    if (!canonicalHistory || !normalizedSessionId || !isNativeSourceCanonicalHistory(canonicalHistory)) return null;
+    const normalizedWorkspace = typeof workspace === 'string' ? workspace.trim() : '';
+    if (!canonicalHistory || (!normalizedSessionId && !normalizedWorkspace) || !isNativeSourceCanonicalHistory(canonicalHistory)) return null;
     return callProviderNativeHistoryRead(agentType, canonicalHistory, scripts, normalizedSessionId, workspace);
 }
 
@@ -1478,7 +1480,7 @@ export function readProviderChatHistory(
         scripts?: ProviderNativeHistoryScripts;
     } = {},
 ): { messages: HistoryMessage[]; hasMore: boolean; source: 'provider-native' | 'adhdev-mirror' | 'native-unavailable'; sourcePath?: string; sourceMtimeMs?: number } {
-    if (isNativeSourceCanonicalHistory(options.canonicalHistory) && options.historySessionId) {
+    if (isNativeSourceCanonicalHistory(options.canonicalHistory) && (options.historySessionId || options.workspace)) {
         const nativeResult = buildNativeHistoryReadResult(agentType, options.canonicalHistory, options.scripts, options.historySessionId, options.workspace);
         if (!nativeResult) return { messages: [], hasMore: false, source: 'native-unavailable' };
         return {

package/src/config/mesh-config.ts

@@ -8,7 +8,7 @@
 
 import { existsSync, readFileSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { randomUUID } from 'crypto';
+import { createHash, randomBytes, randomUUID } from 'crypto';
 import { getConfigDir } from './config.js';
 import type {
     LocalMeshConfig,
@@ -18,8 +18,11 @@ import type {
     RepoMeshNodePolicy,
     RepoMeshNodeCapabilities,
     RepoMeshCoordinatorConfig,
+    RepoMeshHostMetadata,
+    RepoMeshDaemonRole,
 } from '../repo-mesh-types.js';
 import { DEFAULT_MESH_POLICY } from '../repo-mesh-types.js';
+import { createDefaultMeshHostMetadata } from '../mesh/mesh-host-ownership.js';
 
 // ─── Persistence ────────────────────────────────
 
@@ -112,6 +115,7 @@ export interface CreateMeshOptions {
     defaultBranch?: string;
     policy?: Partial<RepoMeshPolicy>;
     coordinator?: RepoMeshCoordinatorConfig;
+    meshHost?: RepoMeshHostMetadata;
 }
 
 export function createMesh(opts: CreateMeshOptions): LocalMeshEntry {
@@ -133,6 +137,7 @@ export function createMesh(opts: CreateMeshOptions): LocalMeshEntry {
         defaultBranch: opts.defaultBranch,
         policy: mergeMeshPolicy(undefined, opts.policy),
         coordinator: opts.coordinator || {},
+        meshHost: opts.meshHost || createDefaultMeshHostMetadata(),
         nodes: [],
         createdAt: now,
         updatedAt: now,
@@ -148,6 +153,7 @@ export interface UpdateMeshOptions {
     defaultBranch?: string;
     policy?: Partial<RepoMeshPolicy>;
     coordinator?: RepoMeshCoordinatorConfig;
+    meshHost?: RepoMeshHostMetadata;
 }
 
 export function updateMesh(meshId: string, opts: UpdateMeshOptions): LocalMeshEntry | undefined {
@@ -159,6 +165,7 @@ export function updateMesh(meshId: string, opts: UpdateMeshOptions): LocalMeshEn
     if (opts.defaultBranch !== undefined) mesh.defaultBranch = opts.defaultBranch;
     if (opts.policy) mesh.policy = mergeMeshPolicy(mesh.policy, opts.policy);
     if (opts.coordinator) mesh.coordinator = opts.coordinator;
+    if (opts.meshHost) mesh.meshHost = opts.meshHost;
     mesh.updatedAt = new Date().toISOString();
 
     saveMeshConfig(config);
@@ -174,6 +181,240 @@ export function deleteMesh(meshId: string): boolean {
     return true;
 }
 
+function normalizeManualHostAddress(hostAddress: string): string {
+    const normalized = hostAddress.trim().replace(/\/+$/, '');
+    if (!normalized) throw new Error('hostAddress required');
+    let parsed: URL;
+    try {
+        parsed = new URL(normalized);
+    } catch {
+        throw new Error('hostAddress must be a valid http(s) or ws(s) URL');
+    }
+    if (!['http:', 'https:', 'ws:', 'wss:'].includes(parsed.protocol)) {
+        throw new Error('hostAddress must use http, https, ws, or wss');
+    }
+    return normalized;
+}
+
+export function tokenIdForManualPairing(token: string): string {
+    return `tok_${createHash('sha256').update(token).digest('hex').slice(0, 16)}`;
+}
+
+function normalizeTokenExpiry(value: unknown): string | undefined {
+    if (typeof value !== 'string' || !value.trim()) return undefined;
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime())) throw new Error('expiresAt must be a valid ISO date');
+    return date.toISOString();
+}
+
+function assertPairingTokenValid(pairing: RepoMeshHostMetadata['pairing'], rawToken: string, nowIso: string): { ok: true; tokenId: string } | { ok: false; reason: string; expectedTokenId?: string; presentedTokenId?: string } {
+    const token = rawToken.trim();
+    if (!token) return { ok: false, reason: 'token required' };
+    const presentedTokenId = tokenIdForManualPairing(token);
+    const expectedTokenId = pairing?.tokenId;
+    if (!expectedTokenId || pairing?.status === 'not_configured' || pairing?.status === 'revoked') {
+        return { ok: false, reason: 'host pairing token is not configured', presentedTokenId };
+    }
+    if (pairing.expiresAt && new Date(pairing.expiresAt).getTime() <= new Date(nowIso).getTime()) {
+        return { ok: false, reason: 'host pairing token expired', expectedTokenId, presentedTokenId };
+    }
+    if (presentedTokenId !== expectedTokenId) {
+        return { ok: false, reason: 'invalid pairing token', expectedTokenId, presentedTokenId };
+    }
+    return { ok: true, tokenId: presentedTokenId };
+}
+
+export interface ConfigureMeshHostPairingOptions {
+    hostAddress: string;
+    token: string;
+    now?: string;
+}
+
+export function configureMeshHostPairing(
+    meshId: string,
+    opts: ConfigureMeshHostPairingOptions,
+): { mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata; hostAddress: string } | undefined {
+    const hostAddress = normalizeManualHostAddress(opts.hostAddress);
+    const token = opts.token.trim();
+    if (!token) throw new Error('token required');
+
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+
+    const now = opts.now || new Date().toISOString();
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    const meshHost: RepoMeshHostMetadata = {
+        ...previous,
+        role: 'member',
+        hostAddress,
+        pairing: {
+            status: 'pairing',
+            tokenId: tokenIdForManualPairing(token),
+            lastPairedAt: now,
+        },
+    };
+
+    mesh.meshHost = meshHost;
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { mesh, meshHost, hostAddress };
+}
+
+export interface CreateMeshHostPairingTokenOptions {
+    token?: string;
+    expiresAt?: string;
+    now?: string;
+}
+
+export function createMeshHostPairingToken(
+    meshId: string,
+    opts: CreateMeshHostPairingTokenOptions = {},
+): { mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata; token: string; tokenId: string; expiresAt?: string } | undefined {
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+    const now = opts.now || new Date().toISOString();
+    const token = (opts.token || `mhj_${randomBytes(24).toString('base64url')}`).trim();
+    if (!token) throw new Error('token required');
+    const tokenId = tokenIdForManualPairing(token);
+    const expiresAt = normalizeTokenExpiry(opts.expiresAt);
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    if (previous.role === 'member') {
+        throw new Error('Mesh Host daemon required to create host pairing tokens; member daemons cannot mint host join tokens.');
+    }
+    const meshHost: RepoMeshHostMetadata = {
+        ...previous,
+        role: 'host',
+        pairing: {
+            status: 'pairing',
+            tokenId,
+            lastPairedAt: now,
+            ...(expiresAt ? { expiresAt } : {}),
+        },
+    };
+    mesh.meshHost = meshHost;
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { mesh, meshHost, token, tokenId, ...(expiresAt ? { expiresAt } : {}) };
+}
+
+export interface MeshHostJoinMemberNodeInput {
+    id?: string;
+    workspace: string;
+    repoRoot?: string;
+    daemonId?: string;
+    machineId?: string;
+    userOverrides?: Partial<RepoMeshNodeCapabilities>;
+    policy?: RepoMeshNodePolicy;
+    role?: RepoMeshDaemonRole;
+}
+
+export interface ApplyMeshHostJoinOptions {
+    token: string;
+    memberNode: MeshHostJoinMemberNodeInput;
+    memberMeshId?: string;
+    now?: string;
+}
+
+export function applyMeshHostJoinRequest(
+    meshId: string,
+    opts: ApplyMeshHostJoinOptions,
+): { accepted: true; mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata; node: LocalMeshNodeEntry; tokenId: string } | { accepted: false; mesh?: LocalMeshEntry; meshHost?: RepoMeshHostMetadata; tokenId?: string; reason: string } | undefined {
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+    const now = opts.now || new Date().toISOString();
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    if (previous.role === 'member') {
+        return { accepted: false, mesh, meshHost: previous, reason: 'Mesh Host daemon required to accept join requests' };
+    }
+    const meshHost: RepoMeshHostMetadata = { ...previous, role: 'host' };
+    const validation = assertPairingTokenValid(meshHost.pairing, opts.token, now);
+    if (!validation.ok) {
+        mesh.meshHost = {
+            ...meshHost,
+            pairing: {
+                ...(meshHost.pairing || { status: 'not_configured' as const }),
+                status: 'rejected',
+                lastRejectedAt: now,
+            },
+        };
+        mesh.updatedAt = now;
+        saveMeshConfig(config);
+        return { accepted: false, mesh, meshHost: mesh.meshHost, tokenId: validation.presentedTokenId, reason: validation.reason };
+    }
+
+    const workspace = opts.memberNode.workspace.trim();
+    if (!workspace) throw new Error('memberNode.workspace required');
+    const memberId = opts.memberNode.id?.trim();
+    let node = mesh.nodes.find(n => (memberId && n.id === memberId) || n.workspace === workspace);
+    if (node) {
+        node.workspace = workspace;
+        node.repoRoot = opts.memberNode.repoRoot;
+        node.daemonId = opts.memberNode.daemonId;
+        node.machineId = opts.memberNode.machineId;
+        node.userOverrides = opts.memberNode.userOverrides || node.userOverrides || {};
+        node.policy = { ...(node.policy || {}), ...(opts.memberNode.policy || {}) };
+        node.role = 'member';
+    } else {
+        if (mesh.nodes.length >= 10) throw new Error('Maximum 10 nodes per mesh');
+        node = {
+            id: memberId || `node_${randomUUID().replace(/-/g, '')}`,
+            workspace,
+            repoRoot: opts.memberNode.repoRoot,
+            daemonId: opts.memberNode.daemonId,
+            machineId: opts.memberNode.machineId,
+            userOverrides: opts.memberNode.userOverrides || {},
+            policy: opts.memberNode.policy || {},
+            role: 'member',
+        };
+        mesh.nodes.push(node);
+    }
+    mesh.meshHost = {
+        ...meshHost,
+        pairing: {
+            ...(meshHost.pairing || {}),
+            status: 'paired',
+            tokenId: validation.tokenId,
+            joinedAt: now,
+            lastPairedAt: meshHost.pairing?.lastPairedAt || now,
+            ...(meshHost.pairing?.expiresAt ? { expiresAt: meshHost.pairing.expiresAt } : {}),
+        },
+    };
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { accepted: true, mesh, meshHost: mesh.meshHost, node, tokenId: validation.tokenId };
+}
+
+export function markMeshHostPairingJoined(
+    meshId: string,
+    opts: { hostDaemonId?: string; hostNodeId?: string; joinedAt?: string; token?: string; tokenId?: string },
+): { mesh: LocalMeshEntry; meshHost: RepoMeshHostMetadata } | undefined {
+    const config = loadMeshConfig();
+    const mesh = config.meshes.find(m => m.id === meshId);
+    if (!mesh) return undefined;
+    const now = opts.joinedAt || new Date().toISOString();
+    const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+    const tokenId = opts.tokenId || (opts.token ? tokenIdForManualPairing(opts.token) : previous.pairing?.tokenId);
+    mesh.meshHost = {
+        ...previous,
+        role: 'member',
+        ...(opts.hostDaemonId ? { hostDaemonId: opts.hostDaemonId } : {}),
+        ...(opts.hostNodeId ? { hostNodeId: opts.hostNodeId } : {}),
+        pairing: {
+            ...(previous.pairing || {}),
+            status: 'paired',
+            ...(tokenId ? { tokenId } : {}),
+            joinedAt: now,
+            lastPairedAt: previous.pairing?.lastPairedAt || now,
+        },
+    };
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { mesh, meshHost: mesh.meshHost };
+}
+
 // ─── Node Operations ────────────────────────────
 
 export interface AddNodeOptions {
@@ -186,6 +427,7 @@ export interface AddNodeOptions {
     isLocalWorktree?: boolean;
     worktreeBranch?: string;
     clonedFromNodeId?: string;
+    role?: RepoMeshDaemonRole;
 }
 
 export function addNode(meshId: string, opts: AddNodeOptions): LocalMeshNodeEntry | undefined {
@@ -213,6 +455,7 @@ export function addNode(meshId: string, opts: AddNodeOptions): LocalMeshNodeEntr
         isLocalWorktree: opts.isLocalWorktree,
         worktreeBranch: opts.worktreeBranch,
         clonedFromNodeId: opts.clonedFromNodeId,
+        role: opts.role,
     };
 
     mesh.nodes.push(node);

package/src/daemon/dev-cli-debug.ts

@@ -802,7 +802,16 @@ export async function handleCliSend(ctx: DevServerContext, req: http.IncomingMes
   }
 
   try {
-    ctx.instanceManager!.sendEvent(target.instanceId, 'send_message', { text });
+    if (target.category === 'cli') {
+      const bundle = getCliTargetBundle(ctx, type, instanceId);
+      if (!bundle) {
+        ctx.json(res, 404, { error: `No running CLI adapter found for: ${type || instanceId}` });
+        return;
+      }
+      await bundle.adapter.sendMessage(text);
+    } else {
+      ctx.instanceManager!.sendEvent(target.instanceId, 'send_message', { text });
+    }
     ctx.json(res, 200, { sent: true, type: target.type, instanceId: target.instanceId });
   } catch (e: any) {
     ctx.json(res, 500, { error: `Send failed: ${e.message}` });

package/src/detection/ide-detector.ts

@@ -7,8 +7,10 @@
  * Migrated from @adhdev/core — this is now the single source of truth.
  */
 
-import { execSync } from 'child_process';
-import { existsSync } from 'fs';
+import { exec } from 'child_process';
+import { promisify } from 'util';
+const execAsync = promisify(exec);
+import { existsSync, statSync } from 'fs';
 import { platform, homedir } from 'os';
 import * as path from 'path';
 import type { ProviderLoader } from '../providers/provider-loader.js';
@@ -73,25 +75,33 @@ function findCliCommand(command: string): string | null {
         const resolved = path.isAbsolute(candidate) ? candidate : path.resolve(candidate);
         return existsSync(resolved) ? resolved : null;
     }
-    try {
-        const result = execSync(
-            platform() === 'win32' ? `where ${trimmed}` : `which ${trimmed}`,
-            { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }
-        ).trim();
-        return result.split('\n')[0] || null;
-    } catch {
-        return null;
+    const isWin = platform() === 'win32';
+    const paths = (process.env.PATH || '').split(isWin ? ';' : ':');
+    const exes = isWin ? ['.exe', '.cmd', '.bat', ''] : [''];
+    for (const p of paths) {
+        if (!p) continue;
+        for (const ext of exes) {
+            const fullPath = path.join(p, trimmed + ext);
+            try {
+                if (existsSync(fullPath)) {
+                    const stat = statSync(fullPath);
+                    if (stat.isFile() && (isWin || (stat.mode & 0o111))) {
+                        return fullPath;
+                    }
+                }
+            } catch { }
+        }
     }
+    return null;
 }
 
-function getIdeVersion(cliCommand: string): string | null {
+async function getIdeVersion(cliCommand: string): Promise<string | null> {
     try {
-        const result = execSync(`"${cliCommand}" --version`, {
+        const { stdout } = await execAsync(`"${cliCommand}" --version`, {
             encoding: 'utf-8',
             timeout: 10000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        return result.split('\n')[0] || null;
+        });
+        return stdout.trim().split('\n')[0] || null;
     } catch {
         return null;
     }
@@ -152,7 +162,7 @@ export async function detectIDEs(providerLoader?: ProviderLoader): Promise<IDEIn
         const installed = os === 'darwin'
             ? !!(resolvedCli || appPath)
             : !!resolvedCli;
-        const version = resolvedCli ? getIdeVersion(resolvedCli) : null;
+        const version = resolvedCli ? await getIdeVersion(resolvedCli) : null;
 
         results.push({
             id: def.id,

package/src/git/git-commands.ts

@@ -62,7 +62,7 @@ export interface GitPushResult extends GitRepoIdentity {
 }
 
 export interface GitCommandServices {
-  getStatus?: (params: { workspace: string }) => Promise<GitRepoStatus> | GitRepoStatus;
+  getStatus?: (params: { workspace: string; refreshUpstream?: boolean }) => Promise<GitRepoStatus> | GitRepoStatus;
   getDiffSummary?: (params: { workspace: string; staged?: boolean }) => Promise<GitDiffSummary> | GitDiffSummary;
   getDiffFile?: (params: { workspace: string; path: string; staged?: boolean }) => Promise<GitFileDiff> | GitFileDiff;
   createSnapshot?: (params: {
@@ -171,7 +171,7 @@ const defaultSnapshotStore = createGitSnapshotStore({
 
 export function createDefaultGitCommandServices(): GitCommandServices {
   return {
-    getStatus: ({ workspace }) => getGitRepoStatus(workspace),
+    getStatus: ({ workspace, refreshUpstream }) => getGitRepoStatus(workspace, { refreshUpstream }),
     getDiffSummary: ({ workspace }) => getGitDiffSummary(workspace),
     getDiffFile: ({ workspace, path: filePath }) => getGitFileDiff(workspace, filePath),
     createSnapshot: ({ workspace, reason, sessionId, turnId }) => defaultSnapshotStore.create({
@@ -290,7 +290,7 @@ export async function handleGitCommand(
   switch (command) {
     case 'git_status': {
       if (!services.getStatus) return serviceNotImplemented(command);
-      const status = await runService(() => services.getStatus!({ workspace }));
+      const status = await runService(() => services.getStatus!({ workspace, refreshUpstream: optionalBoolean(args?.refreshUpstream) }));
       return 'success' in status ? status : { success: true, status };
     }
 

package/src/git/git-status.ts

@@ -1,12 +1,25 @@
-import type { GitRepoStatus, GitSubmoduleStatus } from './git-types.js';
+import type { GitRepoStatus, GitSubmoduleStatus, GitUpstreamFreshness } from './git-types.js';
 import { GitCommandError, resolveGitRepository, runGit } from './git-executor.js';
 
+type ResolvedGitRepo = { workspace: string; repoRoot: string | null; isGitRepo: boolean };
+
 export interface GitStatusOptions {
   timeoutMs?: number;
   /** When true, include submodule status in the result. Defaults to true. */
   includeSubmodules?: boolean;
   /** Optional filter to exclude specific submodule paths from status */
   submoduleIgnorePaths?: string[];
+  /**
+   * When true, refresh the tracked remote before trusting ahead/behind.
+   * Callers should opt into this only for convergence-critical surfaces.
+   */
+  refreshUpstream?: boolean;
+}
+
+interface GitUpstreamProbe {
+  upstreamStatus: GitUpstreamFreshness;
+  upstreamFetchedAt?: number;
+  upstreamFetchError?: string;
 }
 
 export async function getGitRepoStatus(
@@ -18,8 +31,16 @@ export async function getGitRepoStatus(
 
   try {
     const repo = await resolveGitRepository(workspace, options);
-    const statusOutput = await runGit(repo, ['status', '--porcelain=v2', '--branch'], options);
-    const parsed = parsePorcelainV2Status(statusOutput.stdout);
+    let parsed = await readPorcelainStatus(repo, options);
+    let upstreamProbe: GitUpstreamProbe = getInitialUpstreamProbe(parsed);
+
+    if (options.refreshUpstream) {
+      upstreamProbe = await refreshTrackedUpstream(repo, parsed, options);
+      if (upstreamProbe.upstreamStatus === 'fresh') {
+        parsed = await readPorcelainStatus(repo, options);
+      }
+    }
+
     const head = await readHead(repo, options);
     const stashCount = await readStashCount(repo, options);
 
@@ -36,6 +57,9 @@ export async function getGitRepoStatus(
       headCommit: head.commit,
       headMessage: head.message,
       upstream: parsed.upstream,
+      upstreamStatus: parsed.upstream ? upstreamProbe.upstreamStatus : 'no_upstream',
+      upstreamFetchedAt: upstreamProbe.upstreamFetchedAt,
+      upstreamFetchError: upstreamProbe.upstreamFetchError,
       ahead: parsed.ahead,
       behind: parsed.behind,
       staged: parsed.staged,
@@ -74,6 +98,72 @@ interface ParsedPorcelainStatus {
   conflictFiles: string[];
 }
 
+async function readPorcelainStatus(repo: ResolvedGitRepo, options: GitStatusOptions): Promise<ParsedPorcelainStatus> {
+  const statusOutput = await runGit(repo, ['status', '--porcelain=v2', '--branch'], options);
+  return parsePorcelainV2Status(statusOutput.stdout);
+}
+
+function getInitialUpstreamProbe(parsed: ParsedPorcelainStatus): GitUpstreamProbe {
+  return {
+    upstreamStatus: parsed.upstream ? 'unchecked' : 'no_upstream',
+  };
+}
+
+async function refreshTrackedUpstream(
+  repo: ResolvedGitRepo,
+  parsed: ParsedPorcelainStatus,
+  options: GitStatusOptions,
+): Promise<GitUpstreamProbe> {
+  if (!parsed.upstream || !parsed.branch) {
+    return { upstreamStatus: 'no_upstream' };
+  }
+
+  const remoteName = (await readBranchRemote(repo, parsed.branch, options)) ?? inferRemoteName(parsed.upstream);
+  if (!remoteName) {
+    return {
+      upstreamStatus: 'stale',
+      upstreamFetchError: `Unable to resolve remote for upstream '${parsed.upstream}'`,
+    };
+  }
+
+  try {
+    await runGit(repo, ['fetch', '--quiet', '--prune', '--no-tags', remoteName], options);
+    return {
+      upstreamStatus: 'fresh',
+      upstreamFetchedAt: Date.now(),
+    };
+  } catch (error) {
+    return {
+      upstreamStatus: 'stale',
+      upstreamFetchError: formatGitError(error),
+    };
+  }
+}
+
+async function readBranchRemote(repo: ResolvedGitRepo, branch: string, options: GitStatusOptions): Promise<string | null> {
+  try {
+    const result = await runGit(repo, ['config', '--get', `branch.${branch}.remote`], options);
+    return result.stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+function inferRemoteName(upstream: string): string | null {
+  const [remoteName] = upstream.split('/');
+  return remoteName?.trim() || null;
+}
+
+function formatGitError(error: unknown): string {
+  if (error instanceof GitCommandError) {
+    return error.stderr || error.message;
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}
+
 export function parsePorcelainV2Status(output: string): ParsedPorcelainStatus {
   const parsed: ParsedPorcelainStatus = {
     branch: null,
@@ -145,7 +235,7 @@ export function parsePorcelainV2Status(output: string): ParsedPorcelainStatus {
 }
 
 async function readHead(
-  repo: { workspace: string; repoRoot: string | null; isGitRepo: boolean },
+  repo: ResolvedGitRepo,
   options: GitStatusOptions,
 ): Promise<{ commit: string | null; message: string | null }> {
   try {
@@ -163,7 +253,7 @@ async function readHead(
 }
 
 async function readStashCount(
-  repo: { workspace: string; repoRoot: string | null; isGitRepo: boolean },
+  repo: ResolvedGitRepo,
   options: GitStatusOptions,
 ): Promise<number> {
   try {
@@ -187,6 +277,7 @@ function emptyStatus(workspace: string, lastCheckedAt: number, error: GitCommand
     headCommit: null,
     headMessage: null,
     upstream: null,
+    upstreamStatus: 'unavailable',
     ahead: 0,
     behind: 0,
     staged: 0,
@@ -206,7 +297,7 @@ function emptyStatus(workspace: string, lastCheckedAt: number, error: GitCommand
 // ─── Submodule Status ───────────────────────────
 
 async function getSubmoduleStatuses(
-  repo: { workspace: string; repoRoot: string | null; isGitRepo: boolean },
+  repo: ResolvedGitRepo,
   options: GitStatusOptions,
 ): Promise<GitSubmoduleStatus[]> {
   if (!repo.repoRoot) return [];

package/src/git/git-summary.ts

@@ -22,6 +22,9 @@ export function createGitCompactSummary(status: GitRepoStatus, diffSummary?: Git
     isGitRepo: status.isGitRepo,
     repoRoot: status.repoRoot,
     branch: status.branch,
+    upstreamStatus: status.upstreamStatus,
+    upstreamFetchedAt: status.upstreamFetchedAt,
+    upstreamFetchError: status.upstreamFetchError,
     dirty:
       status.staged > 0 ||
       status.modified > 0 ||

package/src/git/git-types.ts

@@ -40,11 +40,19 @@ export interface GitSubmoduleStatus {
   error?: string;
 }
 
+export type GitUpstreamFreshness = 'fresh' | 'unchecked' | 'stale' | 'no_upstream' | 'unavailable';
+
 export interface GitRepoStatus extends GitRepoIdentity {
   branch: string | null;
   headCommit: string | null;
   headMessage: string | null;
   upstream: string | null;
+  /** Whether ahead/behind was verified against a freshly fetched upstream ref. */
+  upstreamStatus: GitUpstreamFreshness;
+  /** Timestamp for the fetch that refreshed upstream refs when upstreamStatus === 'fresh'. */
+  upstreamFetchedAt?: number;
+  /** Error from the last refresh attempt when upstreamStatus === 'stale'. */
+  upstreamFetchError?: string;
   ahead: number;
   behind: number;
   staged: number;
@@ -134,6 +142,9 @@ export interface GitCompactSummary {
   isGitRepo: boolean;
   repoRoot: string | null;
   branch: string | null;
+  upstreamStatus: GitUpstreamFreshness;
+  upstreamFetchedAt?: number;
+  upstreamFetchError?: string;
   dirty: boolean;
   changedFiles: number;
   ahead: number;