@cerbur/clutch-dsh-worktree 0.1.16 → 0.1.18

package/lib/manage/manager-git-history.js

@@ -1,6 +1,11 @@
+import { isSafeBranchIdentity } from '../provider/git/branch-name.js';
+import { readBranchFacts, findBranchIdentity, canonicalBranchIdentity } from '../provider/git/branches.js';
+import { gitWorktreeRoot } from '../contract/index.js';
 import { WORKTREE_GIT_COMMIT_PATTERN, WORKTREE_GIT_SUMMARY, WORKTREE_GIT_WORKING_TREE, } from '../contract/index.js';
 import { providerError } from '../provider/types.js';
 import { isDirectory, requireWorkspace, samePhysicalPath } from './manager-support.js';
+import { projectWorktreePath } from '../provider/worktree-path.js';
+import { workspaceGitPaths } from './manager-git-paths.js';
 /** Shared with Contract/Provider/Client so commit-SHA validation cannot drift. */
 const COMMIT_PATTERN = WORKTREE_GIT_COMMIT_PATTERN;
 /**
@@ -56,14 +61,32 @@ async function findLiveWorktree(worktrees, absolutePath) {
     }
     return undefined;
 }
-async function resolveWorktree(context, input) {
+async function resolveWorktree(context, input, compareMain = true) {
     const workspace = await requireWorkspace(context, input.workspaceId);
     if (isMainWorktreeId(input.worktreeId, input.workspaceId)) {
         // The imported Workspace can be nested, while committed Git paths are root-relative.
         const repositoryRoot = context.git.resolveRepositoryRoot
             ? await context.git.resolveRepositoryRoot(workspace.rootPath, { signal: context.signal })
             : workspace.rootPath;
-        return { main: true, workspaceRoot: workspace.rootPath, repositoryRoot };
+        if (compareMain && input.baseBranch !== undefined) {
+            // A request-local checkout context reuses comparison and path authorization.
+            // It is never read from or written to the sidecar.
+            const headCommit = await gitRead(context, 'resolveCommit', input.worktreeId)(repositoryRoot, 'HEAD', { signal: context.signal });
+            return { main: false, value: {
+                    workspaceRoot: workspace.rootPath,
+                    repositoryRoot,
+                    record: {
+                        workspaceId: input.workspaceId, worktreeId: input.worktreeId,
+                        absolutePath: workspace.rootPath, gitRootPath: repositoryRoot,
+                        branch: 'HEAD', source: 'external', status: 'active',
+                    },
+                    live: { absolutePath: repositoryRoot, headCommit },
+                } };
+        }
+        const headCommit = compareMain && context.git.resolveCommit
+            ? await context.git.resolveCommit(repositoryRoot, 'HEAD', { signal: context.signal })
+            : undefined;
+        return { main: true, workspaceRoot: workspace.rootPath, repositoryRoot, headCommit };
     }
     const snapshot = await context.sidecar.read(input.workspaceId);
     if (snapshot.pendingOperation !== undefined || (snapshot.recoveryIssues?.length ?? 0) > 0) {
@@ -85,22 +108,22 @@ async function resolveWorktree(context, input) {
             worktreeId: input.worktreeId,
         });
     }
-    if (!(await isDirectory(record.absolutePath))) {
-        throw providerError('WORKTREE_NOT_FOUND', `Worktree directory is unavailable: ${record.absolutePath}`, {
+    if (!(await isDirectory(gitWorktreeRoot(record)))) {
+        throw providerError('WORKTREE_NOT_FOUND', `Worktree directory is unavailable: ${gitWorktreeRoot(record)}`, {
             workspaceId: input.workspaceId,
             worktreeId: input.worktreeId,
-            absolutePath: record.absolutePath,
+            absolutePath: gitWorktreeRoot(record),
         });
     }
     const repositoryRoot = context.git.resolveRepositoryRoot
         ? await context.git.resolveRepositoryRoot(workspace.rootPath, { signal: context.signal })
         : workspace.rootPath;
-    const live = await findLiveWorktree(await context.git.listWorktrees(repositoryRoot, { signal: context.signal }), record.absolutePath);
+    const live = await findLiveWorktree(await context.git.listWorktrees(repositoryRoot, { signal: context.signal }), gitWorktreeRoot(record));
     if (!live) {
-        throw providerError('WORKTREE_NOT_FOUND', `Git Worktree registration is unavailable: ${record.absolutePath}`, {
+        throw providerError('WORKTREE_NOT_FOUND', `Git Worktree registration is unavailable: ${gitWorktreeRoot(record)}`, {
             workspaceId: input.workspaceId,
             worktreeId: input.worktreeId,
-            absolutePath: record.absolutePath,
+            absolutePath: gitWorktreeRoot(record),
         });
     }
     return {
@@ -109,31 +132,16 @@ async function resolveWorktree(context, input) {
             workspaceRoot: workspace.rootPath,
             repositoryRoot,
             record,
-            live,
+            live: live.headCommit === undefined && context.git.resolveCommit
+                ? { ...live, headCommit: await context.git.resolveCommit(gitWorktreeRoot(record), 'HEAD', { signal: context.signal }) }
+                : live,
         },
     };
 }
-/** True when a branch name can be safely handed to Git as a ref argument. */
-function isSafeBranchName(branch) {
-    if (branch.length === 0 || branch.startsWith('-'))
-        return false;
-    // Only a local branch short name may be selected. A full ref path is an
-    // arbitrary-ref attempt and is rejected instead of degrading to unavailable.
-    if (branch.startsWith('refs/'))
-        return false;
-    for (const character of branch) {
-        const code = character.codePointAt(0) ?? 0;
-        if (code < 0x20 || code === 0x7f)
-            return false;
-    }
-    return true;
-}
 /**
- * Resolve one local branch tip for the Dashboard baseline. The branch must exist
- * under `refs/heads/`, so tags, remote-tracking branches, and arbitrary refs are
- * rejected even though the browser may send any string.
+ * Resolve only enumerated branch identities. Tags and arbitrary revision expressions are rejected.
  */
-async function resolveLocalBranchCommit(context, resolved, baseBranch, options = {}) {
+async function resolveBranchCommit(context, resolved, baseBranch, options = {}) {
     const unavailable = () => {
         throw providerError('WORKTREE_STATE_CONFLICT', 'Selected baseline branch is unavailable: ' + baseBranch, {
             worktreeId: resolved.record.worktreeId,
@@ -142,20 +150,20 @@ async function resolveLocalBranchCommit(context, resolved, baseBranch, options =
     };
     // An unsafe ref is always a hard failure: arbitrary refs must never resolve,
     // even for a read that is allowed to degrade to an unavailable projection.
-    if (!isSafeBranchName(baseBranch))
+    if (!isSafeBranchIdentity(baseBranch))
         unavailable();
-    const listBranches = gitRead(context, 'listBranches', resolved.record.worktreeId);
     const resolveCommit = gitRead(context, 'resolveCommit', resolved.record.worktreeId);
-    const branches = await listBranches(resolved.repositoryRoot, { signal: context.signal });
+    const branches = await readBranchFacts(context.git, resolved.repositoryRoot, { signal: context.signal });
+    const branch = findBranchIdentity(branches, baseBranch);
     // A baseline branch that no longer exists is an expected unavailable state for
     // reads, so the Dashboard can show an honest empty projection instead of a
     // generic Git failure. Writes keep the strict behaviour.
-    if (!branches.includes(baseBranch)) {
+    if (branch === undefined) {
         if (options.allowUnavailable === true)
             return undefined;
         unavailable();
     }
-    const commit = await resolveCommit(resolved.record.absolutePath, baseBranch, {
+    const commit = await resolveCommit(gitWorktreeRoot(resolved.record), branch?.ref ?? baseBranch, {
         signal: context.signal,
     });
     if (!COMMIT_PATTERN.test(commit)) {
@@ -164,25 +172,26 @@ async function resolveLocalBranchCommit(context, resolved, baseBranch, options =
             baseBranch,
         });
     }
-    return commit;
+    return { commit, branch: branch };
 }
 async function resolveSelectedBaseline(context, resolved, rawBranch) {
     const baseBranch = rawBranch.trim();
     if (baseBranch.length === 0)
         return undefined;
     // A vanished baseline branch degrades to an unavailable projection for reads.
-    const commit = await resolveLocalBranchCommit(context, resolved, baseBranch, {
+    const selected = await resolveBranchCommit(context, resolved, baseBranch, {
         allowUnavailable: true,
     });
-    if (commit === undefined)
+    if (selected === undefined)
         return undefined;
+    const { commit } = selected;
     // A selected branch can move after the Worktree was created. Match GitHub's
     // pull-request range by diffing from the two heads' merge base to Worktree
     // HEAD, while retaining the selected branch tip for ahead/behind counts.
     const headCommit = await baselineHeadCommit(context, resolved);
     const findMergeBase = gitReadOptional(context, 'findMergeBase');
     const mergeBase = headCommit !== undefined && findMergeBase !== undefined
-        ? await findMergeBase(resolved.record.absolutePath, commit, headCommit, { signal: context.signal })
+        ? await findMergeBase(gitWorktreeRoot(resolved.record), commit, headCommit, { signal: context.signal })
         : undefined;
     if (mergeBase !== undefined && !COMMIT_PATTERN.test(mergeBase)) {
         throw providerError('GIT_OPERATION_FAILED', 'Git returned an invalid selected branch merge base', {
@@ -200,14 +209,14 @@ async function resolveSelectedBaseline(context, resolved, rawBranch) {
         treeBaseCommit: mergeBase ?? commit,
     };
 }
-/** Persist a user-selected local branch as the Worktree's Dashboard baseline. */
+/** Persist a user-selected local or fetched remote branch as the Dashboard baseline. */
 export async function updateWorktreeBaseBranch(context, input) {
     if (typeof input.baseBranch !== 'string') {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The baseline branch must be a string', {
             worktreeId: input.worktreeId,
         });
     }
-    const baseBranch = input.baseBranch.trim();
+    let baseBranch = input.baseBranch.trim();
     if (baseBranch.length === 0) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The baseline branch cannot be empty', {
             worktreeId: input.worktreeId,
@@ -219,7 +228,7 @@ export async function updateWorktreeBaseBranch(context, input) {
         });
     }
     const expectedBaseBranch = input.expectedBaseBranch?.trim() || undefined;
-    const resolved = await resolveWorktree(context, input);
+    const resolved = await resolveWorktree(context, input, false);
     if (resolved.main) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The local Workspace has no editable baseline', {
             workspaceId: input.workspaceId,
@@ -234,7 +243,13 @@ export async function updateWorktreeBaseBranch(context, input) {
     }
     // Resolve the replacement branch against the pinned repository root before the
     // sidecar mutation, so an unavailable branch fails closed without a write.
-    await resolveLocalBranchCommit(context, resolved.value, baseBranch);
+    const selected = await resolveBranchCommit(context, resolved.value, baseBranch);
+    if (selected.branch.kind !== 'remote' && selected.branch.name === currentBranch) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'The baseline branch cannot be the current Worktree branch', {
+            worktreeId: input.worktreeId, baseBranch,
+        });
+    }
+    baseBranch = canonicalBranchIdentity(selected.branch, baseBranch);
     return context.sidecar.mutate(input.workspaceId, (snapshot) => {
         if (snapshot.pendingOperation !== undefined || (snapshot.recoveryIssues?.length ?? 0) > 0) {
             throw providerError('WORKTREE_RECOVERY_REQUIRED', 'Workspace Worktree state needs recovery: ' + input.workspaceId, { workspaceId: input.workspaceId });
@@ -284,7 +299,7 @@ async function resolveBaseline(context, resolved, requestedBaseBranch) {
             });
         }
         const commit = context.git.resolveCommit
-            ? await context.git.resolveCommit(record.absolutePath, record.baseCommit, { signal: context.signal })
+            ? await context.git.resolveCommit(gitWorktreeRoot(record), record.baseCommit, { signal: context.signal })
             : record.baseCommit;
         return {
             baseline: {
@@ -305,7 +320,7 @@ async function resolveBaseline(context, resolved, requestedBaseBranch) {
     if (currentBranch === undefined || currentBranch === record.baseBranch || context.git.findMergeBase === undefined) {
         return undefined;
     }
-    const commit = await context.git.findMergeBase(record.absolutePath, record.baseBranch, 'HEAD', { signal: context.signal });
+    const commit = await context.git.findMergeBase(gitWorktreeRoot(record), record.baseBranch, 'HEAD', { signal: context.signal });
     if (commit === undefined)
         return undefined;
     if (!COMMIT_PATTERN.test(commit)) {
@@ -326,7 +341,7 @@ async function resolveBaseline(context, resolved, requestedBaseBranch) {
 async function requireBaseline(context, resolved, requestedBaseBranch) {
     const baseline = await resolveBaseline(context, resolved, requestedBaseBranch);
     if (baseline === undefined) {
-        throw providerError('WORKTREE_STATE_CONFLICT', 'Select a local baseline branch before reading Git changes', { worktreeId: resolved.record.worktreeId });
+        throw providerError('WORKTREE_STATE_CONFLICT', 'Select a baseline branch before reading Git changes', { worktreeId: resolved.record.worktreeId });
     }
     return baseline;
 }
@@ -336,7 +351,7 @@ async function baselineHeadCommit(context, resolved) {
     const resolveCommit = gitReadOptional(context, 'resolveCommit');
     return resolveCommit === undefined
         ? undefined
-        : await resolveCommit(resolved.record.absolutePath, 'HEAD', { signal: context.signal });
+        : await resolveCommit(gitWorktreeRoot(resolved.record), 'HEAD', { signal: context.signal });
 }
 /** Count commits unique to each head for one resolved comparison boundary. */
 async function readCommitDivergence(context, resolved, comparison, head) {
@@ -345,18 +360,14 @@ async function readCommitDivergence(context, resolved, comparison, head) {
         return undefined;
     // Count each branch from its current tip. The tree boundary may be the
     // merge base, but ahead/behind must include commits unique to both heads.
-    return getCommitDivergence(resolved.record.absolutePath, comparison.baseHeadCommit, head, { signal: context.signal });
+    return getCommitDivergence(gitWorktreeRoot(resolved.record), comparison.baseHeadCommit, head, { signal: context.signal });
 }
 /**
  * Authorize commit SHAs against one pinned comparison projection.
  *
- * One bounded `listCommits` read yields exactly the authorized set: commits
- * reachable from the Worktree HEAD and not reachable from the resolved baseline
- * head. That is the same membership the previous per-SHA ancestry walks proved,
- * but a wide multi-commit selection now costs one projection read instead of
- * several Git processes per candidate SHA. The visible projection is therefore
- * the authorization boundary, matching the truncated 200-commit history the
- * browser can actually select from.
+ * Candidates must be reachable from HEAD and excluded from baseline ancestry,
+ * independently of which 50-commit page the browser has loaded. Legacy adapters
+ * without the membership capability retain bounded projection authorization.
  */
 async function authorizeCommits(context, resolved, comparison, candidates) {
     const worktreeId = resolved.record.worktreeId;
@@ -368,8 +379,13 @@ async function authorizeCommits(context, resolved, comparison, candidates) {
         }
         return candidate;
     });
+    const headCommit = resolved.live.headCommit;
+    if (headCommit !== undefined && (context.git.containsCommits || context.git.containsCommit)) {
+        await authorizeMembership(context, gitWorktreeRoot(resolved.record), worktreeId, requested, headCommit, comparison.baseHeadCommit);
+        return requested;
+    }
     const listCommits = gitRead(context, 'listCommits', worktreeId);
-    const history = await listCommits(resolved.record.absolutePath, comparison.baseHeadCommit, {
+    const history = await listCommits(gitWorktreeRoot(resolved.record), comparison.baseHeadCommit, {
         signal: context.signal,
     });
     const members = new Set(history.commits.map((commit) => commit.sha));
@@ -383,6 +399,22 @@ async function authorizeCommits(context, resolved, comparison, candidates) {
     }
     return requested;
 }
+/** Share a fixed checkout identity across all membership checks in a request. */
+async function authorizeMembership(context, root, worktreeId, commits, headCommit, baseCommit) {
+    const options = { signal: context.signal };
+    const allowed = context.git.containsCommits
+        ? await context.git.containsCommits(root, commits, headCommit, baseCommit, options)
+        : await (async () => {
+            for (const commit of commits) {
+                if (!await context.git.containsCommit(root, commit, headCommit, baseCommit, options))
+                    return false;
+            }
+            return true;
+        })();
+    if (!allowed) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'The requested commits are outside this checkout history', { worktreeId });
+    }
+}
 async function authorizeCommit(context, resolved, commitInput, requestedBaseBranch) {
     const comparison = await requireBaseline(context, resolved, requestedBaseBranch);
     const [commit] = await authorizeCommits(context, resolved, comparison, [commitInput]);
@@ -395,13 +427,13 @@ async function authorizeWorkingTree(context, resolved, requestedBaseBranch) {
     await requireBaseline(context, resolved, requestedBaseBranch);
 }
 /** Read Main's bounded HEAD history and expose live Workspace-root changes first. */
-async function listMainCommits(context, workspaceRoot, worktreeId) {
+async function listMainCommits(context, workspaceRoot, worktreeId, offset = 0) {
     const listCommits = gitRead(context, 'listCommits', worktreeId);
     const readWorkingTreePaths = gitReadOptional(context, 'listWorkingTreeChangedPaths')
         ?? gitReadOptional(context, 'listWorkingTreeFiles');
     const [history, workingTreeFiles] = await Promise.all([
-        listCommits(workspaceRoot, undefined, { signal: context.signal }),
-        readWorkingTreePaths === undefined
+        listCommits(workspaceRoot, undefined, { signal: context.signal, offset }),
+        offset > 0 || readWorkingTreePaths === undefined
             ? Promise.resolve({ files: [], truncated: false })
             : readWorkingTreePaths(workspaceRoot, { signal: context.signal }),
     ]);
@@ -413,12 +445,16 @@ async function listMainCommits(context, workspaceRoot, worktreeId) {
             : history.commits,
     };
 }
-async function authorizeMainCommit(context, workspaceRoot, worktreeId, commitInput) {
+async function authorizeMainCommit(context, workspaceRoot, worktreeId, commitInput, headCommit) {
     if (typeof commitInput !== 'string' || !COMMIT_PATTERN.test(commitInput)) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The requested commit is not a valid commit SHA', {
             worktreeId,
         });
     }
+    if (headCommit !== undefined && (context.git.containsCommits || context.git.containsCommit)) {
+        await authorizeMembership(context, workspaceRoot, worktreeId, [commitInput], headCommit);
+        return commitInput;
+    }
     const history = await listMainCommits(context, workspaceRoot, worktreeId);
     if (!history.commits.some((commit) => commit.sha === commitInput)) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The requested commit is outside the visible Main history', {
@@ -429,7 +465,7 @@ async function authorizeMainCommit(context, workspaceRoot, worktreeId, commitInp
     return commitInput;
 }
 const MAX_AGGREGATE_COMMITS = 200;
-async function authorizeMainAggregate(context, workspaceRoot, worktreeId, selection) {
+async function authorizeMainAggregate(context, workspaceRoot, worktreeId, selection, headCommit) {
     if (selection.kind !== 'commits') {
         throw providerError('WORKTREE_STATE_CONFLICT', 'Main Git supports committed selections only', {
             worktreeId,
@@ -453,6 +489,10 @@ async function authorizeMainAggregate(context, workspaceRoot, worktreeId, select
             worktreeId,
         });
     }
+    if (headCommit !== undefined && (context.git.containsCommits || context.git.containsCommit)) {
+        await authorizeMembership(context, workspaceRoot, worktreeId, requested, headCommit);
+        return { selection: { kind: 'commits', commits: requested }, commits: requested };
+    }
     const history = await listMainCommits(context, workspaceRoot, worktreeId);
     const members = new Set(history.commits
         .filter((commit) => commit.kind !== 'working-tree')
@@ -471,10 +511,26 @@ async function authorizeMainAggregate(context, workspaceRoot, worktreeId, select
     };
 }
 export async function listWorktreeCommits(context, input) {
+    const offset = input.offset ?? 0;
+    if (!Number.isSafeInteger(offset) || offset < 0 ||
+        (offset > 0 && (input.expectedHeadCommit === undefined ||
+            (input.baseBranch !== undefined && input.expectedBaselineCommit === undefined)))) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'Invalid history page', { worktreeId: input.worktreeId });
+    }
+    const checkProjection = (head, baseline) => {
+        if ((input.expectedHeadCommit !== undefined && input.expectedHeadCommit !== head) ||
+            (input.expectedBaselineCommit !== undefined && input.expectedBaselineCommit !== baseline)) {
+            throw providerError('WORKTREE_STATE_CONFLICT', 'Git history changed; refresh before loading more', {
+                worktreeId: input.worktreeId,
+            });
+        }
+    };
     const resolved = await resolveWorktree(context, input);
     if (resolved.main) {
-        const history = await listMainCommits(context, resolved.workspaceRoot, input.worktreeId);
+        const history = await listMainCommits(context, resolved.repositoryRoot, input.worktreeId, offset);
+        checkProjection(history.headCommit);
         return {
+            ...(history.nextOffset === undefined ? {} : { nextOffset: history.nextOffset }),
             headCommit: history.headCommit,
             commits: history.commits,
             truncated: history.truncated,
@@ -487,17 +543,23 @@ export async function listWorktreeCommits(context, input) {
             ? 'baseline-unselected'
             : 'baseline-unknown');
     }
+    if (offset > 0 && input.expectedBaselineCommit === undefined) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'A comparison page requires its baseline commit', {
+            worktreeId: input.worktreeId,
+        });
+    }
     const listCommits = gitRead(context, 'listCommits', input.worktreeId);
     // The working-tree entry only needs the changed-path projection here; its file
     // list and line counts are read on demand when the entry is selected.
     const readWorkingTreePaths = gitReadOptional(context, 'listWorkingTreeChangedPaths')
         ?? gitReadOptional(context, 'listWorkingTreeFiles');
     const [history, workingTreeFiles] = await Promise.all([
-        listCommits(resolved.value.record.absolutePath, baseline.baseHeadCommit, { signal: context.signal }),
-        readWorkingTreePaths === undefined
+        listCommits(gitWorktreeRoot(resolved.value.record), baseline.baseHeadCommit, { signal: context.signal, offset }),
+        offset > 0 || readWorkingTreePaths === undefined
             ? Promise.resolve({ files: [], truncated: false })
-            : readWorkingTreePaths(resolved.value.record.absolutePath, { signal: context.signal }),
+            : readWorkingTreePaths(gitWorktreeRoot(resolved.value.record), { signal: context.signal }),
     ]);
+    checkProjection(history.headCommit, baseline.baseline.commit);
     const divergence = await readCommitDivergence(context, resolved.value, baseline, history.headCommit);
     return {
         ...history,
@@ -609,7 +671,7 @@ async function authorizeLiveSummaryHead(context, resolved) {
     const resolveCommit = gitReadOptional(context, 'resolveCommit');
     if (resolveCommit === undefined)
         return;
-    const currentHead = await resolveCommit(resolved.record.absolutePath, 'HEAD', { signal: context.signal });
+    const currentHead = await resolveCommit(gitWorktreeRoot(resolved.record), 'HEAD', { signal: context.signal });
     if (!COMMIT_PATTERN.test(currentHead)) {
         throw providerError('GIT_OPERATION_FAILED', 'Git returned an invalid live Worktree HEAD', {
             worktreeId: resolved.record.worktreeId,
@@ -620,19 +682,19 @@ async function listSummaryFiles(context, resolved, selection, baseCommit, headCo
     if (selection.includeWorkingTree === true) {
         const listWorkingTreeDiffFiles = gitRead(context, 'listWorkingTreeDiffFiles', resolved.record.worktreeId);
         await authorizeLiveSummaryHead(context, resolved);
-        return listWorkingTreeDiffFiles(resolved.record.absolutePath, baseCommit, { signal: context.signal });
+        return listWorkingTreeDiffFiles(gitWorktreeRoot(resolved.record), baseCommit, { signal: context.signal });
     }
     const listDiffFiles = gitRead(context, 'listDiffFiles', resolved.record.worktreeId);
-    return listDiffFiles(resolved.record.absolutePath, baseCommit, headCommit, { signal: context.signal });
+    return listDiffFiles(gitWorktreeRoot(resolved.record), baseCommit, headCommit, { signal: context.signal });
 }
 async function readSummaryFileDiff(context, resolved, selection, baseCommit, headCommit, filePath) {
     if (selection.includeWorkingTree === true) {
         const readWorkingTreeDiffFileDiff = gitRead(context, 'readWorkingTreeDiffFileDiff', resolved.record.worktreeId);
         await authorizeLiveSummaryHead(context, resolved);
-        return readWorkingTreeDiffFileDiff(resolved.record.absolutePath, baseCommit, filePath, { signal: context.signal });
+        return readWorkingTreeDiffFileDiff(gitWorktreeRoot(resolved.record), baseCommit, filePath, { signal: context.signal });
     }
     const readDiffFileDiff = gitRead(context, 'readDiffFileDiff', resolved.record.worktreeId);
-    return readDiffFileDiff(resolved.record.absolutePath, baseCommit, headCommit, filePath, { signal: context.signal });
+    return readDiffFileDiff(gitWorktreeRoot(resolved.record), baseCommit, headCommit, filePath, { signal: context.signal });
 }
 async function selectedAggregateFileDiff(context, absolutePath, worktreeId, selection, commits, requestedPath) {
     if (requestedPath.length === 0) {
@@ -671,17 +733,17 @@ async function selectedAggregateFileDiff(context, absolutePath, worktreeId, sele
         segments,
     };
 }
-async function aggregateMainFileDiff(context, workspaceRoot, repositoryRoot, worktreeId, selection, requestedPath) {
+async function aggregateMainFileDiff(context, workspaceRoot, repositoryRoot, worktreeId, selection, requestedPath, headCommit) {
     if (typeof requestedPath !== 'string' || requestedPath.length === 0) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'A changed file path is required', {
             worktreeId,
         });
     }
-    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection);
+    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection, headCommit);
     return selectedAggregateFileDiff(context, repositoryRoot, worktreeId, authorized.selection, authorized.commits, requestedPath);
 }
-async function listMainAggregateFiles(context, workspaceRoot, repositoryRoot, worktreeId, selection) {
-    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection);
+async function listMainAggregateFiles(context, workspaceRoot, repositoryRoot, worktreeId, selection, headCommit) {
+    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection, headCommit);
     const groups = await selectedCommitFiles(context, repositoryRoot, worktreeId, authorized.commits);
     return {
         commit: authorized.commits[0],
@@ -701,7 +763,7 @@ async function listAggregateFiles(context, resolved, selection, requestedBaseBra
             ...(read.truncated ? { truncated: true } : {}),
         };
     }
-    const groups = await selectedCommitFiles(context, resolved.record.absolutePath, resolved.record.worktreeId, authorized.commits);
+    const groups = await selectedCommitFiles(context, gitWorktreeRoot(resolved.record), resolved.record.worktreeId, authorized.commits);
     return {
         commit: authorized.commits[0],
         selection: authorized.selection,
@@ -733,25 +795,24 @@ async function aggregateFileDiff(context, resolved, selection, requestedPath, re
             selection: authorized.selection,
         };
     }
-    return selectedAggregateFileDiff(context, resolved.record.absolutePath, resolved.record.worktreeId, authorized.selection, authorized.commits, requestedPath);
+    return selectedAggregateFileDiff(context, gitWorktreeRoot(resolved.record), resolved.record.worktreeId, authorized.selection, authorized.commits, requestedPath);
 }
-export async function listWorktreeCommitFiles(context, input) {
-    const resolved = await resolveWorktree(context, input);
+async function listCheckoutCommitFiles(context, input, resolved) {
     const requested = requestedDiff(input, input.worktreeId);
     if (resolved.main) {
         if (requested.kind === 'aggregate') {
-            return listMainAggregateFiles(context, resolved.workspaceRoot, resolved.repositoryRoot, input.worktreeId, requested.selection);
+            return listMainAggregateFiles(context, resolved.repositoryRoot, resolved.repositoryRoot, input.worktreeId, requested.selection, resolved.headCommit);
         }
         if (requested.commit === WORKTREE_GIT_WORKING_TREE) {
             const listWorkingTreeFiles = gitRead(context, 'listWorkingTreeFiles', input.worktreeId);
-            const read = await listWorkingTreeFiles(resolved.workspaceRoot, { signal: context.signal });
+            const read = await listWorkingTreeFiles(resolved.repositoryRoot, { signal: context.signal });
             return {
                 commit: WORKTREE_GIT_WORKING_TREE,
                 files: read.files,
                 ...(read.truncated ? { truncated: true } : {}),
             };
         }
-        const commit = await authorizeMainCommit(context, resolved.workspaceRoot, input.worktreeId, requested.commit);
+        const commit = await authorizeMainCommit(context, resolved.repositoryRoot, input.worktreeId, requested.commit, resolved.headCommit);
         const listCommitFiles = gitRead(context, 'listCommitFiles', input.worktreeId);
         const read = await listCommitFiles(resolved.repositoryRoot, commit, { signal: context.signal });
         return {
@@ -767,7 +828,7 @@ export async function listWorktreeCommitFiles(context, input) {
     if (commit === WORKTREE_GIT_WORKING_TREE) {
         await authorizeWorkingTree(context, resolved.value, input.baseBranch);
         const listWorkingTreeFiles = gitRead(context, 'listWorkingTreeFiles', input.worktreeId);
-        const read = await listWorkingTreeFiles(resolved.value.record.absolutePath, { signal: context.signal });
+        const read = await listWorkingTreeFiles(gitWorktreeRoot(resolved.value.record), { signal: context.signal });
         return {
             commit: WORKTREE_GIT_WORKING_TREE,
             files: read.files,
@@ -776,15 +837,14 @@ export async function listWorktreeCommitFiles(context, input) {
     }
     const authorized = await authorizeCommit(context, resolved.value, commit, input.baseBranch);
     const listCommitFiles = gitRead(context, 'listCommitFiles', input.worktreeId);
-    const read = await listCommitFiles(resolved.value.record.absolutePath, authorized.commit, { signal: context.signal });
+    const read = await listCommitFiles(gitWorktreeRoot(resolved.value.record), authorized.commit, { signal: context.signal });
     return {
         commit: authorized.commit,
         files: read.files,
         ...(read.truncated ? { truncated: true } : {}),
     };
 }
-export async function getWorktreeCommitFileDiff(context, input) {
-    const resolved = await resolveWorktree(context, input);
+async function getCheckoutCommitFileDiff(context, input, resolved) {
     const requested = requestedDiff(input, input.worktreeId);
     if (resolved.main) {
         if (requested.kind === 'aggregate') {
@@ -793,7 +853,7 @@ export async function getWorktreeCommitFileDiff(context, input) {
                     worktreeId: input.worktreeId,
                 });
             }
-            return aggregateMainFileDiff(context, resolved.workspaceRoot, resolved.repositoryRoot, input.worktreeId, requested.selection, input.path);
+            return aggregateMainFileDiff(context, resolved.repositoryRoot, resolved.repositoryRoot, input.worktreeId, requested.selection, input.path, resolved.headCommit);
         }
         if (typeof input.path !== 'string' || input.path.length === 0) {
             throw providerError('WORKTREE_STATE_CONFLICT', 'A changed file path is required', {
@@ -804,7 +864,7 @@ export async function getWorktreeCommitFileDiff(context, input) {
             const readWorkingTreeFileDiff = gitRead(context, 'readWorkingTreeFileDiff', input.worktreeId);
             const readChangedPaths = gitReadOptional(context, 'listWorkingTreeChangedPaths')
                 ?? gitRead(context, 'listWorkingTreeFiles', input.worktreeId);
-            const readPaths = await readChangedPaths(resolved.workspaceRoot, { signal: context.signal });
+            const readPaths = await readChangedPaths(resolved.repositoryRoot, { signal: context.signal });
             const changedFile = findChangedFile(readPaths.files, input.path);
             if (changedFile === undefined) {
                 throw providerError('WORKTREE_STATE_CONFLICT', 'The requested path is not changed in the Main working tree', {
@@ -813,10 +873,10 @@ export async function getWorktreeCommitFileDiff(context, input) {
                     path: input.path,
                 });
             }
-            const diff = await readWorkingTreeFileDiff(resolved.workspaceRoot, changedFile.path, { signal: context.signal });
+            const diff = await readWorkingTreeFileDiff(resolved.repositoryRoot, changedFile.path, { signal: context.signal });
             return { ...diff, commit: WORKTREE_GIT_WORKING_TREE, path: input.path };
         }
-        const commit = await authorizeMainCommit(context, resolved.workspaceRoot, input.worktreeId, requested.commit);
+        const commit = await authorizeMainCommit(context, resolved.repositoryRoot, input.worktreeId, requested.commit, resolved.headCommit);
         const listCommitFiles = gitRead(context, 'listCommitFiles', input.worktreeId);
         const filesRead = await listCommitFiles(resolved.repositoryRoot, commit, { signal: context.signal });
         const changedFile = findChangedFile(filesRead.files, input.path);
@@ -848,7 +908,7 @@ export async function getWorktreeCommitFileDiff(context, input) {
         // untracked file on each file click.
         const readChangedPaths = gitReadOptional(context, 'listWorkingTreeChangedPaths')
             ?? gitRead(context, 'listWorkingTreeFiles', input.worktreeId);
-        const readPaths = await readChangedPaths(resolved.value.record.absolutePath, { signal: context.signal });
+        const readPaths = await readChangedPaths(gitWorktreeRoot(resolved.value.record), { signal: context.signal });
         const changedFile = findChangedFile(readPaths.files, input.path);
         if (changedFile === undefined) {
             throw providerError('WORKTREE_STATE_CONFLICT', 'The requested path is not changed in the working tree', {
@@ -857,7 +917,7 @@ export async function getWorktreeCommitFileDiff(context, input) {
                 path: input.path,
             });
         }
-        const diff = await readWorkingTreeFileDiff(resolved.value.record.absolutePath, changedFile.path, { signal: context.signal });
+        const diff = await readWorkingTreeFileDiff(gitWorktreeRoot(resolved.value.record), changedFile.path, { signal: context.signal });
         return {
             ...diff,
             commit: WORKTREE_GIT_WORKING_TREE,
@@ -869,7 +929,7 @@ export async function getWorktreeCommitFileDiff(context, input) {
     const listCommitFiles = gitRead(context, 'listCommitFiles', input.worktreeId);
     // The changed-file projection is the authorization boundary for the path, so
     // the diff is only read for an exact member of that projection.
-    const filesRead = await listCommitFiles(resolved.value.record.absolutePath, authorized.commit, { signal: context.signal });
+    const filesRead = await listCommitFiles(gitWorktreeRoot(resolved.value.record), authorized.commit, { signal: context.signal });
     const changedFile = findChangedFile(filesRead.files, input.path);
     if (changedFile === undefined) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The requested path is not changed by this commit', {
@@ -878,11 +938,45 @@ export async function getWorktreeCommitFileDiff(context, input) {
             path: input.path,
         });
     }
-    const diff = await readCommitFileDiff(resolved.value.record.absolutePath, authorized.commit, changedFile.path, { signal: context.signal });
+    const diff = await readCommitFileDiff(gitWorktreeRoot(resolved.value.record), authorized.commit, changedFile.path, { signal: context.signal });
     return {
         ...diff,
         commit: authorized.commit,
         path: input.path,
     };
 }
+async function pathsFor(resolved) {
+    if (resolved.main)
+        return workspaceGitPaths(resolved.repositoryRoot, resolved.workspaceRoot);
+    const { record, workspaceRoot, repositoryRoot } = resolved.value;
+    const projected = await projectWorktreePath(record, workspaceRoot, repositoryRoot);
+    return workspaceGitPaths(gitWorktreeRoot(projected), projected.absolutePath);
+}
+/** Reject a projection if checkout HEAD moved during authorization or file reads. */
+async function assertCheckoutHead(context, resolved, worktreeId) {
+    const headCommit = resolved.main ? resolved.headCommit : resolved.value.live.headCommit;
+    if (headCommit === undefined || context.git.resolveCommit === undefined)
+        return;
+    const root = resolved.main ? resolved.repositoryRoot : gitWorktreeRoot(resolved.value.record);
+    const current = await context.git.resolveCommit(root, 'HEAD', { signal: context.signal });
+    if (current !== headCommit) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'Checkout HEAD changed; refresh Git data', { worktreeId });
+    }
+}
+/** Public changed-file identities always start at the Workspace directory, including ../ siblings. */
+export async function listWorktreeCommitFiles(context, input) {
+    const resolved = await resolveWorktree(context, input);
+    const paths = await pathsFor(resolved);
+    const read = await listCheckoutCommitFiles(context, input, resolved);
+    await assertCheckoutHead(context, resolved, input.worktreeId);
+    return paths.projectFiles(read);
+}
+/** Translate exactly once, then keep the existing changed-file authorization in checkout coordinates. */
+export async function getWorktreeCommitFileDiff(context, input) {
+    const resolved = await resolveWorktree(context, input);
+    const paths = await pathsFor(resolved);
+    const diff = await getCheckoutCommitFileDiff(context, { ...input, path: paths.toCheckout(input.path) }, resolved);
+    await assertCheckoutHead(context, resolved, input.worktreeId);
+    return { ...diff, path: input.path };
+}
 //# sourceMappingURL=manager-git-history.js.map