@cerbur/clutch-dsh-worktree 0.1.17 → 0.1.18

package/lib/manage/manager-git-history.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager-git-history.d.ts","sourceRoot":"","sources":["../../src/manage/manager-git-history.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAElC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EAExB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AA4RnE,iFAAiF;AACjF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC,GACA,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAwRD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACjG,OAAO,CAAC,kBAAkB,CAAC,CA8C7B;AAuYD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAiEjC;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,mBAAmB,CAAC,CA0I9B"}
+{"version":3,"file":"manager-git-history.d.ts","sourceRoot":"","sources":["../../src/manage/manager-git-history.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,EAElC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAE/B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAuSnE,wFAAwF;AACxF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC,GACA,OAAO,CAAC,MAAM,CAAC,CAkFjB;AA4TD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAoE7B;AAwnBD,sGAAsG;AACtG,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,sBAAsB,CAAC,CAMjC;AAED,yGAAyG;AACzG,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,mBAAmB,CAAC,CAM9B"}

package/lib/manage/manager-git-history.js

@@ -1,7 +1,11 @@
+import { isSafeBranchIdentity } from '../provider/git/branch-name.js';
+import { readBranchFacts, findBranchIdentity, canonicalBranchIdentity } from '../provider/git/branches.js';
 import { gitWorktreeRoot } from '../contract/index.js';
 import { WORKTREE_GIT_COMMIT_PATTERN, WORKTREE_GIT_SUMMARY, WORKTREE_GIT_WORKING_TREE, } from '../contract/index.js';
 import { providerError } from '../provider/types.js';
 import { isDirectory, requireWorkspace, samePhysicalPath } from './manager-support.js';
+import { projectWorktreePath } from '../provider/worktree-path.js';
+import { workspaceGitPaths } from './manager-git-paths.js';
 /** Shared with Contract/Provider/Client so commit-SHA validation cannot drift. */
 const COMMIT_PATTERN = WORKTREE_GIT_COMMIT_PATTERN;
 /**
@@ -57,14 +61,32 @@ async function findLiveWorktree(worktrees, absolutePath) {
     }
     return undefined;
 }
-async function resolveWorktree(context, input) {
+async function resolveWorktree(context, input, compareMain = true) {
     const workspace = await requireWorkspace(context, input.workspaceId);
     if (isMainWorktreeId(input.worktreeId, input.workspaceId)) {
         // The imported Workspace can be nested, while committed Git paths are root-relative.
         const repositoryRoot = context.git.resolveRepositoryRoot
             ? await context.git.resolveRepositoryRoot(workspace.rootPath, { signal: context.signal })
             : workspace.rootPath;
-        return { main: true, workspaceRoot: workspace.rootPath, repositoryRoot };
+        if (compareMain && input.baseBranch !== undefined) {
+            // A request-local checkout context reuses comparison and path authorization.
+            // It is never read from or written to the sidecar.
+            const headCommit = await gitRead(context, 'resolveCommit', input.worktreeId)(repositoryRoot, 'HEAD', { signal: context.signal });
+            return { main: false, value: {
+                    workspaceRoot: workspace.rootPath,
+                    repositoryRoot,
+                    record: {
+                        workspaceId: input.workspaceId, worktreeId: input.worktreeId,
+                        absolutePath: workspace.rootPath, gitRootPath: repositoryRoot,
+                        branch: 'HEAD', source: 'external', status: 'active',
+                    },
+                    live: { absolutePath: repositoryRoot, headCommit },
+                } };
+        }
+        const headCommit = compareMain && context.git.resolveCommit
+            ? await context.git.resolveCommit(repositoryRoot, 'HEAD', { signal: context.signal })
+            : undefined;
+        return { main: true, workspaceRoot: workspace.rootPath, repositoryRoot, headCommit };
     }
     const snapshot = await context.sidecar.read(input.workspaceId);
     if (snapshot.pendingOperation !== undefined || (snapshot.recoveryIssues?.length ?? 0) > 0) {
@@ -110,31 +132,16 @@ async function resolveWorktree(context, input) {
             workspaceRoot: workspace.rootPath,
             repositoryRoot,
             record,
-            live,
+            live: live.headCommit === undefined && context.git.resolveCommit
+                ? { ...live, headCommit: await context.git.resolveCommit(gitWorktreeRoot(record), 'HEAD', { signal: context.signal }) }
+                : live,
         },
     };
 }
-/** True when a branch name can be safely handed to Git as a ref argument. */
-function isSafeBranchName(branch) {
-    if (branch.length === 0 || branch.startsWith('-'))
-        return false;
-    // Only a local branch short name may be selected. A full ref path is an
-    // arbitrary-ref attempt and is rejected instead of degrading to unavailable.
-    if (branch.startsWith('refs/'))
-        return false;
-    for (const character of branch) {
-        const code = character.codePointAt(0) ?? 0;
-        if (code < 0x20 || code === 0x7f)
-            return false;
-    }
-    return true;
-}
 /**
- * Resolve one local branch tip for the Dashboard baseline. The branch must exist
- * under `refs/heads/`, so tags, remote-tracking branches, and arbitrary refs are
- * rejected even though the browser may send any string.
+ * Resolve only enumerated branch identities. Tags and arbitrary revision expressions are rejected.
  */
-async function resolveLocalBranchCommit(context, resolved, baseBranch, options = {}) {
+async function resolveBranchCommit(context, resolved, baseBranch, options = {}) {
     const unavailable = () => {
         throw providerError('WORKTREE_STATE_CONFLICT', 'Selected baseline branch is unavailable: ' + baseBranch, {
             worktreeId: resolved.record.worktreeId,
@@ -143,20 +150,20 @@ async function resolveLocalBranchCommit(context, resolved, baseBranch, options =
     };
     // An unsafe ref is always a hard failure: arbitrary refs must never resolve,
     // even for a read that is allowed to degrade to an unavailable projection.
-    if (!isSafeBranchName(baseBranch))
+    if (!isSafeBranchIdentity(baseBranch))
         unavailable();
-    const listBranches = gitRead(context, 'listBranches', resolved.record.worktreeId);
     const resolveCommit = gitRead(context, 'resolveCommit', resolved.record.worktreeId);
-    const branches = await listBranches(resolved.repositoryRoot, { signal: context.signal });
+    const branches = await readBranchFacts(context.git, resolved.repositoryRoot, { signal: context.signal });
+    const branch = findBranchIdentity(branches, baseBranch);
     // A baseline branch that no longer exists is an expected unavailable state for
     // reads, so the Dashboard can show an honest empty projection instead of a
     // generic Git failure. Writes keep the strict behaviour.
-    if (!branches.includes(baseBranch)) {
+    if (branch === undefined) {
         if (options.allowUnavailable === true)
             return undefined;
         unavailable();
     }
-    const commit = await resolveCommit(gitWorktreeRoot(resolved.record), baseBranch, {
+    const commit = await resolveCommit(gitWorktreeRoot(resolved.record), branch?.ref ?? baseBranch, {
         signal: context.signal,
     });
     if (!COMMIT_PATTERN.test(commit)) {
@@ -165,18 +172,19 @@ async function resolveLocalBranchCommit(context, resolved, baseBranch, options =
             baseBranch,
         });
     }
-    return commit;
+    return { commit, branch: branch };
 }
 async function resolveSelectedBaseline(context, resolved, rawBranch) {
     const baseBranch = rawBranch.trim();
     if (baseBranch.length === 0)
         return undefined;
     // A vanished baseline branch degrades to an unavailable projection for reads.
-    const commit = await resolveLocalBranchCommit(context, resolved, baseBranch, {
+    const selected = await resolveBranchCommit(context, resolved, baseBranch, {
         allowUnavailable: true,
     });
-    if (commit === undefined)
+    if (selected === undefined)
         return undefined;
+    const { commit } = selected;
     // A selected branch can move after the Worktree was created. Match GitHub's
     // pull-request range by diffing from the two heads' merge base to Worktree
     // HEAD, while retaining the selected branch tip for ahead/behind counts.
@@ -201,14 +209,14 @@ async function resolveSelectedBaseline(context, resolved, rawBranch) {
         treeBaseCommit: mergeBase ?? commit,
     };
 }
-/** Persist a user-selected local branch as the Worktree's Dashboard baseline. */
+/** Persist a user-selected local or fetched remote branch as the Dashboard baseline. */
 export async function updateWorktreeBaseBranch(context, input) {
     if (typeof input.baseBranch !== 'string') {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The baseline branch must be a string', {
             worktreeId: input.worktreeId,
         });
     }
-    const baseBranch = input.baseBranch.trim();
+    let baseBranch = input.baseBranch.trim();
     if (baseBranch.length === 0) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The baseline branch cannot be empty', {
             worktreeId: input.worktreeId,
@@ -220,7 +228,7 @@ export async function updateWorktreeBaseBranch(context, input) {
         });
     }
     const expectedBaseBranch = input.expectedBaseBranch?.trim() || undefined;
-    const resolved = await resolveWorktree(context, input);
+    const resolved = await resolveWorktree(context, input, false);
     if (resolved.main) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The local Workspace has no editable baseline', {
             workspaceId: input.workspaceId,
@@ -235,7 +243,13 @@ export async function updateWorktreeBaseBranch(context, input) {
     }
     // Resolve the replacement branch against the pinned repository root before the
     // sidecar mutation, so an unavailable branch fails closed without a write.
-    await resolveLocalBranchCommit(context, resolved.value, baseBranch);
+    const selected = await resolveBranchCommit(context, resolved.value, baseBranch);
+    if (selected.branch.kind !== 'remote' && selected.branch.name === currentBranch) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'The baseline branch cannot be the current Worktree branch', {
+            worktreeId: input.worktreeId, baseBranch,
+        });
+    }
+    baseBranch = canonicalBranchIdentity(selected.branch, baseBranch);
     return context.sidecar.mutate(input.workspaceId, (snapshot) => {
         if (snapshot.pendingOperation !== undefined || (snapshot.recoveryIssues?.length ?? 0) > 0) {
             throw providerError('WORKTREE_RECOVERY_REQUIRED', 'Workspace Worktree state needs recovery: ' + input.workspaceId, { workspaceId: input.workspaceId });
@@ -327,7 +341,7 @@ async function resolveBaseline(context, resolved, requestedBaseBranch) {
 async function requireBaseline(context, resolved, requestedBaseBranch) {
     const baseline = await resolveBaseline(context, resolved, requestedBaseBranch);
     if (baseline === undefined) {
-        throw providerError('WORKTREE_STATE_CONFLICT', 'Select a local baseline branch before reading Git changes', { worktreeId: resolved.record.worktreeId });
+        throw providerError('WORKTREE_STATE_CONFLICT', 'Select a baseline branch before reading Git changes', { worktreeId: resolved.record.worktreeId });
     }
     return baseline;
 }
@@ -351,13 +365,9 @@ async function readCommitDivergence(context, resolved, comparison, head) {
 /**
  * Authorize commit SHAs against one pinned comparison projection.
  *
- * One bounded `listCommits` read yields exactly the authorized set: commits
- * reachable from the Worktree HEAD and not reachable from the resolved baseline
- * head. That is the same membership the previous per-SHA ancestry walks proved,
- * but a wide multi-commit selection now costs one projection read instead of
- * several Git processes per candidate SHA. The visible projection is therefore
- * the authorization boundary, matching the truncated 200-commit history the
- * browser can actually select from.
+ * Candidates must be reachable from HEAD and excluded from baseline ancestry,
+ * independently of which 50-commit page the browser has loaded. Legacy adapters
+ * without the membership capability retain bounded projection authorization.
  */
 async function authorizeCommits(context, resolved, comparison, candidates) {
     const worktreeId = resolved.record.worktreeId;
@@ -369,6 +379,11 @@ async function authorizeCommits(context, resolved, comparison, candidates) {
         }
         return candidate;
     });
+    const headCommit = resolved.live.headCommit;
+    if (headCommit !== undefined && (context.git.containsCommits || context.git.containsCommit)) {
+        await authorizeMembership(context, gitWorktreeRoot(resolved.record), worktreeId, requested, headCommit, comparison.baseHeadCommit);
+        return requested;
+    }
     const listCommits = gitRead(context, 'listCommits', worktreeId);
     const history = await listCommits(gitWorktreeRoot(resolved.record), comparison.baseHeadCommit, {
         signal: context.signal,
@@ -384,6 +399,22 @@ async function authorizeCommits(context, resolved, comparison, candidates) {
     }
     return requested;
 }
+/** Share a fixed checkout identity across all membership checks in a request. */
+async function authorizeMembership(context, root, worktreeId, commits, headCommit, baseCommit) {
+    const options = { signal: context.signal };
+    const allowed = context.git.containsCommits
+        ? await context.git.containsCommits(root, commits, headCommit, baseCommit, options)
+        : await (async () => {
+            for (const commit of commits) {
+                if (!await context.git.containsCommit(root, commit, headCommit, baseCommit, options))
+                    return false;
+            }
+            return true;
+        })();
+    if (!allowed) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'The requested commits are outside this checkout history', { worktreeId });
+    }
+}
 async function authorizeCommit(context, resolved, commitInput, requestedBaseBranch) {
     const comparison = await requireBaseline(context, resolved, requestedBaseBranch);
     const [commit] = await authorizeCommits(context, resolved, comparison, [commitInput]);
@@ -396,13 +427,13 @@ async function authorizeWorkingTree(context, resolved, requestedBaseBranch) {
     await requireBaseline(context, resolved, requestedBaseBranch);
 }
 /** Read Main's bounded HEAD history and expose live Workspace-root changes first. */
-async function listMainCommits(context, workspaceRoot, worktreeId) {
+async function listMainCommits(context, workspaceRoot, worktreeId, offset = 0) {
     const listCommits = gitRead(context, 'listCommits', worktreeId);
     const readWorkingTreePaths = gitReadOptional(context, 'listWorkingTreeChangedPaths')
         ?? gitReadOptional(context, 'listWorkingTreeFiles');
     const [history, workingTreeFiles] = await Promise.all([
-        listCommits(workspaceRoot, undefined, { signal: context.signal }),
-        readWorkingTreePaths === undefined
+        listCommits(workspaceRoot, undefined, { signal: context.signal, offset }),
+        offset > 0 || readWorkingTreePaths === undefined
             ? Promise.resolve({ files: [], truncated: false })
             : readWorkingTreePaths(workspaceRoot, { signal: context.signal }),
     ]);
@@ -414,12 +445,16 @@ async function listMainCommits(context, workspaceRoot, worktreeId) {
             : history.commits,
     };
 }
-async function authorizeMainCommit(context, workspaceRoot, worktreeId, commitInput) {
+async function authorizeMainCommit(context, workspaceRoot, worktreeId, commitInput, headCommit) {
     if (typeof commitInput !== 'string' || !COMMIT_PATTERN.test(commitInput)) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The requested commit is not a valid commit SHA', {
             worktreeId,
         });
     }
+    if (headCommit !== undefined && (context.git.containsCommits || context.git.containsCommit)) {
+        await authorizeMembership(context, workspaceRoot, worktreeId, [commitInput], headCommit);
+        return commitInput;
+    }
     const history = await listMainCommits(context, workspaceRoot, worktreeId);
     if (!history.commits.some((commit) => commit.sha === commitInput)) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'The requested commit is outside the visible Main history', {
@@ -430,7 +465,7 @@ async function authorizeMainCommit(context, workspaceRoot, worktreeId, commitInp
     return commitInput;
 }
 const MAX_AGGREGATE_COMMITS = 200;
-async function authorizeMainAggregate(context, workspaceRoot, worktreeId, selection) {
+async function authorizeMainAggregate(context, workspaceRoot, worktreeId, selection, headCommit) {
     if (selection.kind !== 'commits') {
         throw providerError('WORKTREE_STATE_CONFLICT', 'Main Git supports committed selections only', {
             worktreeId,
@@ -454,6 +489,10 @@ async function authorizeMainAggregate(context, workspaceRoot, worktreeId, select
             worktreeId,
         });
     }
+    if (headCommit !== undefined && (context.git.containsCommits || context.git.containsCommit)) {
+        await authorizeMembership(context, workspaceRoot, worktreeId, requested, headCommit);
+        return { selection: { kind: 'commits', commits: requested }, commits: requested };
+    }
     const history = await listMainCommits(context, workspaceRoot, worktreeId);
     const members = new Set(history.commits
         .filter((commit) => commit.kind !== 'working-tree')
@@ -472,10 +511,26 @@ async function authorizeMainAggregate(context, workspaceRoot, worktreeId, select
     };
 }
 export async function listWorktreeCommits(context, input) {
+    const offset = input.offset ?? 0;
+    if (!Number.isSafeInteger(offset) || offset < 0 ||
+        (offset > 0 && (input.expectedHeadCommit === undefined ||
+            (input.baseBranch !== undefined && input.expectedBaselineCommit === undefined)))) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'Invalid history page', { worktreeId: input.worktreeId });
+    }
+    const checkProjection = (head, baseline) => {
+        if ((input.expectedHeadCommit !== undefined && input.expectedHeadCommit !== head) ||
+            (input.expectedBaselineCommit !== undefined && input.expectedBaselineCommit !== baseline)) {
+            throw providerError('WORKTREE_STATE_CONFLICT', 'Git history changed; refresh before loading more', {
+                worktreeId: input.worktreeId,
+            });
+        }
+    };
     const resolved = await resolveWorktree(context, input);
     if (resolved.main) {
-        const history = await listMainCommits(context, resolved.workspaceRoot, input.worktreeId);
+        const history = await listMainCommits(context, resolved.repositoryRoot, input.worktreeId, offset);
+        checkProjection(history.headCommit);
         return {
+            ...(history.nextOffset === undefined ? {} : { nextOffset: history.nextOffset }),
             headCommit: history.headCommit,
             commits: history.commits,
             truncated: history.truncated,
@@ -488,17 +543,23 @@ export async function listWorktreeCommits(context, input) {
             ? 'baseline-unselected'
             : 'baseline-unknown');
     }
+    if (offset > 0 && input.expectedBaselineCommit === undefined) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'A comparison page requires its baseline commit', {
+            worktreeId: input.worktreeId,
+        });
+    }
     const listCommits = gitRead(context, 'listCommits', input.worktreeId);
     // The working-tree entry only needs the changed-path projection here; its file
     // list and line counts are read on demand when the entry is selected.
     const readWorkingTreePaths = gitReadOptional(context, 'listWorkingTreeChangedPaths')
         ?? gitReadOptional(context, 'listWorkingTreeFiles');
     const [history, workingTreeFiles] = await Promise.all([
-        listCommits(gitWorktreeRoot(resolved.value.record), baseline.baseHeadCommit, { signal: context.signal }),
-        readWorkingTreePaths === undefined
+        listCommits(gitWorktreeRoot(resolved.value.record), baseline.baseHeadCommit, { signal: context.signal, offset }),
+        offset > 0 || readWorkingTreePaths === undefined
             ? Promise.resolve({ files: [], truncated: false })
             : readWorkingTreePaths(gitWorktreeRoot(resolved.value.record), { signal: context.signal }),
     ]);
+    checkProjection(history.headCommit, baseline.baseline.commit);
     const divergence = await readCommitDivergence(context, resolved.value, baseline, history.headCommit);
     return {
         ...history,
@@ -672,17 +733,17 @@ async function selectedAggregateFileDiff(context, absolutePath, worktreeId, sele
         segments,
     };
 }
-async function aggregateMainFileDiff(context, workspaceRoot, repositoryRoot, worktreeId, selection, requestedPath) {
+async function aggregateMainFileDiff(context, workspaceRoot, repositoryRoot, worktreeId, selection, requestedPath, headCommit) {
     if (typeof requestedPath !== 'string' || requestedPath.length === 0) {
         throw providerError('WORKTREE_STATE_CONFLICT', 'A changed file path is required', {
             worktreeId,
         });
     }
-    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection);
+    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection, headCommit);
     return selectedAggregateFileDiff(context, repositoryRoot, worktreeId, authorized.selection, authorized.commits, requestedPath);
 }
-async function listMainAggregateFiles(context, workspaceRoot, repositoryRoot, worktreeId, selection) {
-    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection);
+async function listMainAggregateFiles(context, workspaceRoot, repositoryRoot, worktreeId, selection, headCommit) {
+    const authorized = await authorizeMainAggregate(context, workspaceRoot, worktreeId, selection, headCommit);
     const groups = await selectedCommitFiles(context, repositoryRoot, worktreeId, authorized.commits);
     return {
         commit: authorized.commits[0],
@@ -736,23 +797,22 @@ async function aggregateFileDiff(context, resolved, selection, requestedPath, re
     }
     return selectedAggregateFileDiff(context, gitWorktreeRoot(resolved.record), resolved.record.worktreeId, authorized.selection, authorized.commits, requestedPath);
 }
-export async function listWorktreeCommitFiles(context, input) {
-    const resolved = await resolveWorktree(context, input);
+async function listCheckoutCommitFiles(context, input, resolved) {
     const requested = requestedDiff(input, input.worktreeId);
     if (resolved.main) {
         if (requested.kind === 'aggregate') {
-            return listMainAggregateFiles(context, resolved.workspaceRoot, resolved.repositoryRoot, input.worktreeId, requested.selection);
+            return listMainAggregateFiles(context, resolved.repositoryRoot, resolved.repositoryRoot, input.worktreeId, requested.selection, resolved.headCommit);
         }
         if (requested.commit === WORKTREE_GIT_WORKING_TREE) {
             const listWorkingTreeFiles = gitRead(context, 'listWorkingTreeFiles', input.worktreeId);
-            const read = await listWorkingTreeFiles(resolved.workspaceRoot, { signal: context.signal });
+            const read = await listWorkingTreeFiles(resolved.repositoryRoot, { signal: context.signal });
             return {
                 commit: WORKTREE_GIT_WORKING_TREE,
                 files: read.files,
                 ...(read.truncated ? { truncated: true } : {}),
             };
         }
-        const commit = await authorizeMainCommit(context, resolved.workspaceRoot, input.worktreeId, requested.commit);
+        const commit = await authorizeMainCommit(context, resolved.repositoryRoot, input.worktreeId, requested.commit, resolved.headCommit);
         const listCommitFiles = gitRead(context, 'listCommitFiles', input.worktreeId);
         const read = await listCommitFiles(resolved.repositoryRoot, commit, { signal: context.signal });
         return {
@@ -784,8 +844,7 @@ export async function listWorktreeCommitFiles(context, input) {
         ...(read.truncated ? { truncated: true } : {}),
     };
 }
-export async function getWorktreeCommitFileDiff(context, input) {
-    const resolved = await resolveWorktree(context, input);
+async function getCheckoutCommitFileDiff(context, input, resolved) {
     const requested = requestedDiff(input, input.worktreeId);
     if (resolved.main) {
         if (requested.kind === 'aggregate') {
@@ -794,7 +853,7 @@ export async function getWorktreeCommitFileDiff(context, input) {
                     worktreeId: input.worktreeId,
                 });
             }
-            return aggregateMainFileDiff(context, resolved.workspaceRoot, resolved.repositoryRoot, input.worktreeId, requested.selection, input.path);
+            return aggregateMainFileDiff(context, resolved.repositoryRoot, resolved.repositoryRoot, input.worktreeId, requested.selection, input.path, resolved.headCommit);
         }
         if (typeof input.path !== 'string' || input.path.length === 0) {
             throw providerError('WORKTREE_STATE_CONFLICT', 'A changed file path is required', {
@@ -805,7 +864,7 @@ export async function getWorktreeCommitFileDiff(context, input) {
             const readWorkingTreeFileDiff = gitRead(context, 'readWorkingTreeFileDiff', input.worktreeId);
             const readChangedPaths = gitReadOptional(context, 'listWorkingTreeChangedPaths')
                 ?? gitRead(context, 'listWorkingTreeFiles', input.worktreeId);
-            const readPaths = await readChangedPaths(resolved.workspaceRoot, { signal: context.signal });
+            const readPaths = await readChangedPaths(resolved.repositoryRoot, { signal: context.signal });
             const changedFile = findChangedFile(readPaths.files, input.path);
             if (changedFile === undefined) {
                 throw providerError('WORKTREE_STATE_CONFLICT', 'The requested path is not changed in the Main working tree', {
@@ -814,10 +873,10 @@ export async function getWorktreeCommitFileDiff(context, input) {
                     path: input.path,
                 });
             }
-            const diff = await readWorkingTreeFileDiff(resolved.workspaceRoot, changedFile.path, { signal: context.signal });
+            const diff = await readWorkingTreeFileDiff(resolved.repositoryRoot, changedFile.path, { signal: context.signal });
             return { ...diff, commit: WORKTREE_GIT_WORKING_TREE, path: input.path };
         }
-        const commit = await authorizeMainCommit(context, resolved.workspaceRoot, input.worktreeId, requested.commit);
+        const commit = await authorizeMainCommit(context, resolved.repositoryRoot, input.worktreeId, requested.commit, resolved.headCommit);
         const listCommitFiles = gitRead(context, 'listCommitFiles', input.worktreeId);
         const filesRead = await listCommitFiles(resolved.repositoryRoot, commit, { signal: context.signal });
         const changedFile = findChangedFile(filesRead.files, input.path);
@@ -886,4 +945,38 @@ export async function getWorktreeCommitFileDiff(context, input) {
         path: input.path,
     };
 }
+async function pathsFor(resolved) {
+    if (resolved.main)
+        return workspaceGitPaths(resolved.repositoryRoot, resolved.workspaceRoot);
+    const { record, workspaceRoot, repositoryRoot } = resolved.value;
+    const projected = await projectWorktreePath(record, workspaceRoot, repositoryRoot);
+    return workspaceGitPaths(gitWorktreeRoot(projected), projected.absolutePath);
+}
+/** Reject a projection if checkout HEAD moved during authorization or file reads. */
+async function assertCheckoutHead(context, resolved, worktreeId) {
+    const headCommit = resolved.main ? resolved.headCommit : resolved.value.live.headCommit;
+    if (headCommit === undefined || context.git.resolveCommit === undefined)
+        return;
+    const root = resolved.main ? resolved.repositoryRoot : gitWorktreeRoot(resolved.value.record);
+    const current = await context.git.resolveCommit(root, 'HEAD', { signal: context.signal });
+    if (current !== headCommit) {
+        throw providerError('WORKTREE_STATE_CONFLICT', 'Checkout HEAD changed; refresh Git data', { worktreeId });
+    }
+}
+/** Public changed-file identities always start at the Workspace directory, including ../ siblings. */
+export async function listWorktreeCommitFiles(context, input) {
+    const resolved = await resolveWorktree(context, input);
+    const paths = await pathsFor(resolved);
+    const read = await listCheckoutCommitFiles(context, input, resolved);
+    await assertCheckoutHead(context, resolved, input.worktreeId);
+    return paths.projectFiles(read);
+}
+/** Translate exactly once, then keep the existing changed-file authorization in checkout coordinates. */
+export async function getWorktreeCommitFileDiff(context, input) {
+    const resolved = await resolveWorktree(context, input);
+    const paths = await pathsFor(resolved);
+    const diff = await getCheckoutCommitFileDiff(context, { ...input, path: paths.toCheckout(input.path) }, resolved);
+    await assertCheckoutHead(context, resolved, input.worktreeId);
+    return { ...diff, path: input.path };
+}
 //# sourceMappingURL=manager-git-history.js.map