@dungsil/dsh-plugin-ui-vcs 0.2.0 → 0.4.0

package/dist/index.js

@@ -1,8 +1,10 @@
 import { createRequire } from "node:module";
 import { clientRequestSchema } from "@deepseek-ai/dsh-client-connection";
-import { SessionId } from "@deepseek-ai/dsh-session";
+import { Session, SessionId } from "@deepseek-ai/dsh-session";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { Context, Service } from "@deepseek-ai/cordis";
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
 // \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -899,19 +901,82 @@ defineMethod("transform", [
 	"callback",
 	"preserve"
 ], ({ inner }, isInner) => inner.toString(isInner));
+// src/inspect-session.ts
+async function inspectSession(ctx, id, signal) {
+	signal.throwIfAborted();
+	const live = ctx.get("agents")?.get(id);
+	if (live) return live.session;
+	const inspection = await ctx.sessionController.inspect(id, signal);
+	signal.throwIfAborted();
+	return Session.create(id, inspection.events, inspection.meta, inspection.inheritedEventCount);
+}
+// ../../tools/async/src/index.ts
+function createTaskQueue({ concurrency, maxPending }) {
+	if (!Number.isSafeInteger(concurrency) || concurrency < 1 || !Number.isSafeInteger(maxPending) || maxPending < 0) throw new RangeError("Invalid task queue limits");
+	let active = 0;
+	const pending = /* @__PURE__ */ new Set();
+	const drain = () => {
+		while (active < concurrency && pending.size) pending.values().next().value.start();
+	};
+	return (signal, task) => {
+		if (signal.aborted) return Promise.reject(signal.reason);
+		if (active >= concurrency && pending.size >= maxPending) return Promise.reject(/* @__PURE__ */ new Error("busy"));
+		return new Promise((resolve, reject) => {
+			const entry = {
+				start() {
+					pending.delete(entry);
+					signal.removeEventListener("abort", entry.cancel);
+					active++;
+					(async () => {
+						try {
+							signal.throwIfAborted();
+							resolve(await task());
+						} catch (error) {
+							reject(error);
+						} finally {
+							active--;
+							drain();
+						}
+					})();
+				},
+				cancel() {
+					pending.delete(entry);
+					signal.removeEventListener("abort", entry.cancel);
+					reject(signal.reason);
+				}
+			};
+			pending.add(entry);
+			signal.addEventListener("abort", entry.cancel, { once: true });
+			drain();
+		});
+	};
+}
+// src/read-queue.ts
+const queues = /* @__PURE__ */ new WeakMap();
+function readQueue(provider) {
+	let queue = queues.get(provider);
+	if (!queue) {
+		queue = createTaskQueue({
+			concurrency: 2,
+			maxPending: 128
+		});
+		queues.set(provider, queue);
+	}
+	return queue;
+}
 // src/pull-requests-protocol.ts
 const channel$1 = "/api";
 const method = "dungsil-vcs/pull-requests/list";
 const actionMethod = "dungsil-vcs/pull-requests/action";
 // src/pull-requests.ts
 var pull_requests_exports = /* @__PURE__ */ __exportAll({
-	Config: () => Config,
-	apply: () => apply$2,
-	inject: () => inject$2,
-	name: () => name$2
+	Config: () => Config$1,
+	apply: () => apply$3,
+	inject: () => inject$3,
+	name: () => name$3
 });
-const name$2 = "dungsil-vcs-pull-requests";
-const inject$2 = [
+const name$3 = "dungsil-vcs-pull-requests";
+const inject$3 = [
 	"connection",
 	"sessionController",
 	"workingDirectory",
@@ -919,7 +984,7 @@ const inject$2 = [
 	"sandbox",
 	"sandboxPolicy"
 ];
-const Config = Schema.object({ provider: Schema.union([
+const Config$1 = Schema.object({ provider: Schema.union([
 	"auto",
 	"github",
 	"gitlab",
@@ -971,12 +1036,13 @@ function actionInput$1(value) {
 	].includes(input.strategy)) || input.action === "merge" && input.body !== void 0) throw new Error("invalid_payload");
 	return input;
 }
-function apply$2(ctx, config) {
+function apply$3(ctx, config) {
 	const lifetime = new AbortController();
 	const actionsInFlight = /* @__PURE__ */ new Set();
+	const read = readQueue(ctx.subprocess);
 	ctx.effect(() => () => lifetime.abort());
-	const list = async (agent, signal, action, requested, summary = false) => {
-		const cwd = ctx.workingDirectory.get(agent.session);
+	const list = async (session, signal, action, requested, summary = false) => {
+		const cwd = ctx.workingDirectory.get(session);
 		const run = async (executable, args, failure = "command_failed", allowed = [0], trim = true) => {
 			let resolved;
 			try {
@@ -985,7 +1051,7 @@ function apply$2(ctx, config) {
 				throw new Error(executable === "git" ? "repository" : "cli_missing");
 			}
 			const argv = [resolved, ...args];
-			const policy = ctx.sandboxPolicy.resolve({ session: agent.session });
+			const policy = ctx.sandboxPolicy.resolve({ session });
 			const command = policy.mode === "danger-full-access" ? argv : (await ctx.sandbox.confine(argv, {
 				...policy,
 				mode: policy.mode
@@ -1118,7 +1184,7 @@ function apply$2(ctx, config) {
 			if (requested.origin !== new URL(origin).origin || provider === "github" && repository.split("/").length !== 2 || !match || !Number.isSafeInteger(Number(match[2]))) throw new Error("unsupported");
 			if (provider === "github" ? match[1].toLowerCase() !== prefix.toLowerCase() : match[1] !== prefix) {
 				if (provider === "gitlab") throw new Error("unsupported");
-				const associated = await list(agent, signal, void 0, void 0, summary);
+				const associated = await list(session, signal, void 0, void 0, summary);
 				const linkedUrl = `${requested.origin}${match[1]}/${provider === "github" ? "pull" : forge ? "pulls" : "-/merge_requests"}/${match[2]}`;
 				if ("request" in associated && associated.request && (provider === "github" ? associated.request.url.toLowerCase() === linkedUrl.toLowerCase() : associated.request.url === linkedUrl)) return associated;
 				throw new Error("unsupported");
@@ -1713,14 +1779,24 @@ function apply$2(ctx, config) {
 					inFlight = action.sessionId;
 				}
 				const requested = route === "dungsil-vcs/pull-requests/list" && input.requestUrl !== void 0 ? lookupUrl(input.requestUrl) : void 0;
-				const resolved = await ctx.sessionController.resolveAgent(SessionId(input.sessionId));
-				if ("error" in resolved) throw new Error("unavailable");
 				const signal = AbortSignal.any([
 					request.signal,
 					lifetime.signal,
 					AbortSignal.timeout(2e4)
 				]);
-				const value = await list(resolved.agent, signal, action, requested, input.summary === true);
+				const sessionId = SessionId(input.sessionId);
+				const execute = async () => {
+					signal.throwIfAborted();
+					let session;
+					if (action) {
+						const resolved = await ctx.sessionController.resolveAgent(sessionId);
+						if ("error" in resolved) throw new Error("unavailable");
+						signal.throwIfAborted();
+						session = resolved.agent.session;
+					} else session = await inspectSession(ctx, sessionId, signal);
+					return list(session, signal, action, requested, input.summary === true);
+				};
+				const value = action ? await execute() : await read(signal, execute);
 				if (action && !("completed" in value)) throw new Error("stale_request");
 				return reply({
 					ok: true,
@@ -4514,14 +4590,23 @@ async function generateTexts(ctx, agent, operation, context, signal) {
 // src/protocol.ts
 const channel = "/api";
 const executeMethod = "dungsil-vcs/execute";
+function validCommitSettings(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const input = value;
+	return Object.keys(input).every((key) => [
+		"authorName",
+		"authorEmail",
+		"noSign"
+	].includes(key)) && typeof input.authorName === "string" && input.authorName.length <= 200 && !/[<>]/.test(input.authorName) && !Array.from(input.authorName).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) && typeof input.authorEmail === "string" && input.authorEmail.length <= 254 && (input.authorEmail === "" || /^[^\s<>@]+@[^\s<>@]+$/.test(input.authorEmail)) && !Array.from(input.authorEmail).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127) && (input.authorName === "" ? input.authorEmail === "" : !!input.authorName.trim() && !!input.authorEmail) && typeof input.noSign === "boolean";
+}
 // src/commands.ts
 var commands_exports = /* @__PURE__ */ __exportAll({
-	apply: () => apply$1,
-	inject: () => inject$1,
-	name: () => name$1
+	apply: () => apply$2,
+	inject: () => inject$2,
+	name: () => name$2
 });
-const name$1 = "dungsil-vcs-commands";
-const inject$1 = [
+const name$2 = "dungsil-vcs-commands";
+const inject$2 = [
 	"connection",
 	"sessionController",
 	"workingDirectory",
@@ -4546,7 +4631,7 @@ function actionInput(value) {
 	].includes(input.operation) || typeof input.requestId !== "string" || !/^[a-zA-Z0-9-]{16,100}$/.test(input.requestId)) throw new Error("invalid");
 	return input;
 }
-function apply$1(ctx, config) {
+function apply$2(ctx, config) {
 	const lifetime = new AbortController();
 	const pending = /* @__PURE__ */ new Set();
 	const repositories = /* @__PURE__ */ new Set();
@@ -4561,6 +4646,12 @@ function apply$1(ctx, config) {
 		}
 	});
 	const execute = async (agent, input, signal) => {
+		const settings = {
+			authorName: config.authorName ?? "",
+			authorEmail: config.authorEmail ?? "",
+			noSign: config.noSign ?? false
+		};
+		if (!validCommitSettings(settings)) throw new Error("invalid");
 		if (ctx.sandboxPolicy.resolve({ session: agent.session }).mode === "read-only") throw new Error("read_only");
 		const cwd = await ctx.workingDirectory.ensure(agent, signal);
 		if (cwd !== input.cwd) throw new Error("conflict");
@@ -4810,6 +4901,8 @@ function apply$1(ctx, config) {
 				]);
 				await git([
 					"commit",
+					...settings.authorName ? [`--author=${settings.authorName} <${settings.authorEmail}>`] : [],
+					...settings.noSign ? ["--no-gpg-sign"] : [],
 					"--only",
 					"-m",
 					texts.commitMessage,
@@ -4906,6 +4999,303 @@ function apply$1(ctx, config) {
 		}
 	}), "ui-vcs: owner-only commands");
 }
+// src/cli-status.ts
+function object(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid_status");
+	return value;
+}
+function parse(output) {
+	if (output.length > 1048576) throw new Error("invalid_status");
+	return JSON.parse(output);
+}
+function safe(value) {
+	return typeof value === "string" && !/(?:gh[pousr]_|github_pat_|gl(?:pat|oas|rt|cbt|ptt|ft|soat|dt)-|Bearer|eyJ)/i.test(value) && !/[a-f0-9]{20,}/i.test(value) && !/[a-z0-9_+-]{32,}/i.test(value);
+}
+function host(value) {
+	if (!safe(value) || value.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?::[0-9]{1,5})?$/i.test(value)) throw new Error("invalid_identity");
+	return value.toLowerCase();
+}
+function account(hostname, login, source) {
+	if (!safe(login) || !/^[a-z0-9][a-z0-9_.-]{0,99}$/i.test(login)) throw new Error("invalid_identity");
+	const result = {
+		host: host(hostname),
+		login
+	};
+	if ([
+		"GH_TOKEN",
+		"GITHUB_TOKEN",
+		"GH_ENTERPRISE_TOKEN",
+		"GITHUB_ENTERPRISE_TOKEN",
+		"environment"
+	].includes(String(source))) result.method = "environment";
+	else if (source === "keyring") result.method = "keyring";
+	else if (source === "config_file" || typeof source === "string" && /(?:^|[/\\])hosts\.yml$/.test(source)) result.method = "config-file";
+	return result;
+}
+async function inspectAuth(cli, run) {
+	const data = object(parse(await run(cli, cli === "gh" ? [
+		"auth",
+		"status",
+		"--json",
+		"hosts"
+	] : [
+		"auth",
+		"status",
+		"--all",
+		"--output",
+		"json"
+	])));
+	const rows = cli === "gh" ? Object.values(object(data.hosts)).flatMap((entries) => {
+		if (!Array.isArray(entries)) throw new Error("invalid_status");
+		return entries;
+	}) : data.hosts;
+	if (!Array.isArray(rows)) throw new Error("invalid_status");
+	const accounts = [];
+	let failed = false;
+	for (const row of rows) {
+		const entry = object(row);
+		if (entry.state === "success") try {
+			accounts.push(account(entry.host, cli === "gh" ? entry.login : entry.user, cli === "gh" ? entry.tokenSource : entry.token_source));
+		} catch {
+			failed = true;
+		}
+		else if (entry.state !== "refresh_expired") failed = true;
+	}
+	return {
+		cli,
+		status: failed ? "error" : accounts.length ? "authenticated" : "unauthenticated",
+		accounts
+	};
+}
+async function inspectTea(run) {
+	const logins = parse(await run("tea", [
+		"login",
+		"list",
+		"--output",
+		"json"
+	]));
+	if (!Array.isArray(logins)) throw new Error("invalid_status");
+	const accounts = [];
+	let failed = false;
+	for (const row of logins) try {
+		const entry = object(row);
+		if (typeof entry.name !== "string" || !entry.name || entry.name.length > 256 || entry.name.split("").some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw new Error("invalid_status");
+		if (typeof entry.url !== "string") throw new Error("invalid_status");
+		const url = new URL(entry.url);
+		if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error("invalid_identity");
+		const hostname = host(url.host);
+		const user = object(parse(await run("tea", [
+			"api",
+			"--method",
+			"GET",
+			"--login",
+			entry.name,
+			"user"
+		])));
+		if (typeof user.id !== "number" || !Number.isSafeInteger(user.id) || user.id <= 0) throw new Error("invalid_user");
+		accounts.push(account(hostname, user.login));
+	} catch (error) {
+		if (error instanceof Error && error.message === "cli_missing") throw error;
+		failed = true;
+	}
+	return {
+		cli: "tea",
+		status: failed ? "error" : accounts.length ? "authenticated" : "unauthenticated",
+		accounts
+	};
+}
+/** The runner must reject resolution failures with Error('cli_missing'), and
+* reject nonzero exits, policy failures and timeouts with any other error.
+* It must bound execution/output and disable prompts. No stdout/stderr is ever
+* returned, including when older CLIs do not support these structured queries.
+*/
+async function inspectCliStatus(run) {
+	return Promise.all([
+		"gh",
+		"glab",
+		"tea"
+	].map(async (cli) => {
+		try {
+			return await (cli === "tea" ? inspectTea(run) : inspectAuth(cli, run));
+		} catch (error) {
+			return {
+				cli,
+				status: error instanceof Error && error.message === "cli_missing" ? "unavailable" : "error",
+				accounts: []
+			};
+		}
+	}));
+}
+// src/settings.ts
+var settings_exports = /* @__PURE__ */ __exportAll({
+	Config: () => Config,
+	apply: () => apply$1,
+	inject: () => inject$1,
+	name: () => name$1
+});
+const name$1 = "dungsil-vcs-settings";
+const inject$1 = [
+	"connection",
+	"configEditor",
+	"subprocess",
+	"sandbox",
+	"sandboxPolicy"
+];
+const Config = Schema.object({
+	provider: Schema.union([
+		"auto",
+		"github",
+		"gitlab",
+		"gitea",
+		"forgejo"
+	]).default("auto"),
+	authorName: Schema.string().default(""),
+	authorEmail: Schema.string().default(""),
+	noSign: Schema.boolean().default(false)
+});
+function apply$1(ctx) {
+	const editor = ctx.configEditor;
+	const lifetime = new AbortController();
+	ctx.effect(() => () => lifetime.abort());
+	const entry = () => {
+		const entries = editor.entries().filter((item) => item.options.name === "@dungsil/dsh-plugin-ui-vcs");
+		if (entries.length !== 1) throw new Error("unavailable");
+		return entries[0];
+	};
+	const snapshot = () => {
+		const current = entry().options.config;
+		return {
+			revision: createHash("sha256").update(JSON.stringify(current ?? {})).digest("hex"),
+			settings: {
+				authorName: current?.authorName ?? "",
+				authorEmail: current?.authorEmail ?? "",
+				noSign: current?.noSign ?? false
+			}
+		};
+	};
+	for (const endpoint of [
+		"settings",
+		"save-settings",
+		"cli-status"
+	]) {
+		const method = `dungsil-vcs/${endpoint}`;
+		ctx.effect(() => ctx.connection.fetch.register({
+			path: `${channel}/${method}`,
+			methods: ["POST"],
+			requestBody: "buffered",
+			async fetch(request) {
+				let rpcId = "";
+				let result;
+				try {
+					const body = clientRequestSchema.parse(await request.json());
+					rpcId = body.rpcId;
+					if (body.method !== method) throw new Error("invalid");
+					const signal = AbortSignal.any([
+						request.signal,
+						lifetime.signal,
+						AbortSignal.timeout(3e4)
+					]);
+					signal.throwIfAborted();
+					if (endpoint === "settings") result = {
+						ok: true,
+						value: snapshot()
+					};
+					else if (endpoint === "save-settings") {
+						const input = body.payload;
+						if (!input || typeof input.revision !== "string" || !validCommitSettings(input.settings)) throw new Error("invalid");
+						const settings = input.settings;
+						await editor.edit(entry(), (current) => {
+							if (snapshot().revision !== input.revision) throw new Error("conflict");
+							return {
+								...current,
+								...settings
+							};
+						});
+						result = {
+							ok: true,
+							value: snapshot()
+						};
+					} else {
+						const value = await inspectCliStatus(async (executable, args) => {
+							const bounded = AbortSignal.any([signal, AbortSignal.timeout(1e4)]);
+							let path;
+							try {
+								path = await ctx.subprocess.resolveExecutable(executable, void 0, bounded);
+							} catch (error) {
+								if (error instanceof Error && error.name === "SubprocessExecutableNotFoundError") throw new Error("cli_missing");
+								throw error;
+							}
+							const argv = [path, ...args];
+							const policy = ctx.sandboxPolicy.resolve();
+							const command = policy.mode === "danger-full-access" ? argv : (await ctx.sandbox.confine(argv, {
+								...policy,
+								mode: policy.mode
+							}, bounded)).argv;
+							const child = ctx.subprocess.spawn({
+								argv: command,
+								cwd: homedir(),
+								signal: bounded,
+								graceMs: 1e3,
+								env: {
+									GH_PROMPT_DISABLED: "1",
+									GLAB_PROMPT_DISABLED: "1",
+									NO_COLOR: "1",
+									GH_HOST: void 0,
+									GH_REPO: void 0,
+									GITLAB_HOST: void 0,
+									GITLAB_REPO: void 0,
+									TEA_LOGIN: void 0,
+									TEA_REPO: void 0,
+									...executable === "tea" ? {
+										GH_TOKEN: void 0,
+										GITEA_TOKEN: void 0,
+										GITEA_INSTANCE_URL: void 0,
+										GITEA_INSTANCE_SSH_HOST: void 0,
+										GITEA_INSTANCE_INSECURE: void 0
+									} : {}
+								},
+								stdio: {
+									stdin: "ignore",
+									stdout: { maxBytes: 131072 },
+									stderr: { maxBytes: 16384 }
+								}
+							});
+							try {
+								const outcome = await child.done;
+								bounded.throwIfAborted();
+								const output = child.collected.stdout.readFrom(0);
+								if (outcome.exitCode !== 0 || output.lossy) throw new Error("command_failed");
+								return output.text;
+							} finally {
+								child.terminate();
+								await child.waitForExit();
+							}
+						});
+						signal.throwIfAborted();
+						result = {
+							ok: true,
+							value
+						};
+					}
+				} catch (error) {
+					result = {
+						ok: false,
+						error: {
+							code: error instanceof Error && ["invalid", "conflict"].includes(error.message) ? error.message : "unavailable",
+							message: "Could not confirm VCS settings.",
+							details: {}
+						}
+					};
+				}
+				return Response.json({
+					type: "server-response",
+					rpcId,
+					result
+				}, { headers: { "Cache-Control": "no-store" } });
+			}
+		}), `ui-vcs: owner-only ${endpoint}`);
+	}
+}
 // src/index.ts
 const name = "dungsil-ui-vcs";
 const inject = [
@@ -4917,8 +5307,12 @@ const inject = [
 	"workingDirectory"
 ];
 function apply(ctx, config) {
+	const lifetime = new AbortController();
+	const read = readQueue(ctx.subprocess);
+	ctx.effect(() => () => lifetime.abort(), "ui-vcs: cancel context reads");
 	ctx.plugin(pull_requests_exports, config);
 	ctx.plugin(commands_exports, config);
+	ctx.plugin(settings_exports);
 	ctx.effect(() => ctx.connection.fetch.register({
 		path: "/api/dungsil-vcs/describe",
 		methods: ["POST"],
@@ -4940,100 +5334,104 @@ function apply(ctx, config) {
 				if (body.method !== "dungsil-vcs/describe") throw new Error("Invalid method");
 				const sessionId = body.payload?.sessionId;
 				if (typeof sessionId !== "string" || !sessionId) throw new Error("Invalid session");
-				const resolved = await ctx.sessionController.resolveAgent(SessionId(sessionId));
-				if ("error" in resolved) throw new Error("Session unavailable");
-				const { agent } = resolved;
-				const signal = AbortSignal.any([request.signal, AbortSignal.timeout(1e4)]);
-				const cwd = await ctx.workingDirectory.ensure(agent, signal);
-				const git = async (args) => {
-					const argv = [
-						await ctx.subprocess.resolveExecutable("git", void 0, signal),
-						"-c",
-						"core.fsmonitor=false",
-						"-c",
-						"core.hooksPath=/dev/null",
-						...args
-					];
-					const policy = ctx.sandboxPolicy.resolve({ session: agent.session });
-					const command = policy.mode === "danger-full-access" ? argv : (await ctx.sandbox.confine(argv, {
-						...policy,
-						mode: policy.mode
-					}, signal)).argv;
-					const child = ctx.subprocess.spawn({
-						argv: command,
-						cwd,
-						signal,
-						graceMs: 1e3,
-						env: {
-							...Object.fromEntries(Object.keys(process.env).filter((key) => key.startsWith("GIT_")).map((key) => [key, void 0])),
-							GIT_TERMINAL_PROMPT: "0",
-							GIT_OPTIONAL_LOCKS: "0",
-							GIT_NO_LAZY_FETCH: "1"
-						},
-						stdio: {
-							stdin: "ignore",
-							stdout: { maxBytes: 65536 },
-							stderr: { maxBytes: 4096 }
-						}
-					});
-					try {
-						const outcome = await child.done;
-						signal.throwIfAborted();
-						const output = child.collected.stdout.readFrom(0);
-						if (outcome.exitCode !== 0 || output.lossy) throw new Error("Git read failed");
-						return output.text.replace(/\r?\n$/, "");
-					} finally {
-						child.terminate();
-						await child.waitForExit();
-					}
-				};
-				const gitDir = await git([
-					"rev-parse",
-					"--path-format=absolute",
-					"--git-dir"
-				]);
-				const commonDir = await git([
-					"rev-parse",
-					"--path-format=absolute",
-					"--git-common-dir"
+				const signal = AbortSignal.any([
+					request.signal,
+					lifetime.signal,
+					AbortSignal.timeout(1e4)
 				]);
-				let operation = "pr";
-				if (gitDir === commonDir) {
-					const branch = await git([
-						"symbolic-ref",
-						"--quiet",
-						"--short",
-						"HEAD"
+				result = await read(signal, async () => {
+					const session = await inspectSession(ctx, SessionId(sessionId), signal);
+					const cwd = ctx.workingDirectory.get(session);
+					const git = async (args) => {
+						const argv = [
+							await ctx.subprocess.resolveExecutable("git", void 0, signal),
+							"-c",
+							"core.fsmonitor=false",
+							"-c",
+							"core.hooksPath=/dev/null",
+							...args
+						];
+						const policy = ctx.sandboxPolicy.resolve({ session });
+						const command = policy.mode === "danger-full-access" ? argv : (await ctx.sandbox.confine(argv, {
+							...policy,
+							mode: policy.mode
+						}, signal)).argv;
+						const child = ctx.subprocess.spawn({
+							argv: command,
+							cwd,
+							signal,
+							graceMs: 1e3,
+							env: {
+								...Object.fromEntries(Object.keys(process.env).filter((key) => key.startsWith("GIT_")).map((key) => [key, void 0])),
+								GIT_TERMINAL_PROMPT: "0",
+								GIT_OPTIONAL_LOCKS: "0",
+								GIT_NO_LAZY_FETCH: "1"
+							},
+							stdio: {
+								stdin: "ignore",
+								stdout: { maxBytes: 65536 },
+								stderr: { maxBytes: 4096 }
+							}
+						});
+						try {
+							const outcome = await child.done;
+							signal.throwIfAborted();
+							const output = child.collected.stdout.readFrom(0);
+							if (outcome.exitCode !== 0 || output.lossy) throw new Error("Git read failed");
+							return output.text.replace(/\r?\n$/, "");
+						} finally {
+							child.terminate();
+							await child.waitForExit();
+						}
+					};
+					const gitDir = await git([
+						"rev-parse",
+						"--path-format=absolute",
+						"--git-dir"
 					]);
-					const upstream = await git([
-						"for-each-ref",
-						"--format=%(upstream:remotename)",
-						`refs/heads/${branch}`
+					const commonDir = await git([
+						"rev-parse",
+						"--path-format=absolute",
+						"--git-common-dir"
 					]);
-					const remotes = (await git(["remote"])).split("\n").filter(Boolean);
-					const remote = upstream && upstream !== "." ? upstream : remotes.includes("origin") ? "origin" : remotes.length === 1 ? remotes[0] : void 0;
-					if (!remote) throw new Error("Default remote unknown");
-					operation = await git([
-						"symbolic-ref",
-						"--quiet",
-						`refs/remotes/${remote}/HEAD`
-					]) === `refs/remotes/${remote}/${branch}` ? "push" : "pr";
-				}
-				const headSha = await git(["rev-parse", "HEAD"]);
-				const dirty = !!await git([
-					"status",
-					"--porcelain",
-					"--untracked-files=normal"
-				]);
-				result = {
-					ok: true,
-					value: {
-						operation,
-						headSha,
-						dirty
+					let operation = "pr";
+					if (gitDir === commonDir) {
+						const branch = await git([
+							"symbolic-ref",
+							"--quiet",
+							"--short",
+							"HEAD"
+						]);
+						const upstream = await git([
+							"for-each-ref",
+							"--format=%(upstream:remotename)",
+							`refs/heads/${branch}`
+						]);
+						const remotes = (await git(["remote"])).split("\n").filter(Boolean);
+						const remote = upstream && upstream !== "." ? upstream : remotes.includes("origin") ? "origin" : remotes.length === 1 ? remotes[0] : void 0;
+						if (!remote) throw new Error("Default remote unknown");
+						operation = await git([
+							"symbolic-ref",
+							"--quiet",
+							`refs/remotes/${remote}/HEAD`
+						]) === `refs/remotes/${remote}/${branch}` ? "push" : "pr";
 					}
-				};
-				if (ctx.workingDirectory.get(agent.session) !== cwd) throw new Error("Working directory changed");
+					const headSha = await git(["rev-parse", "HEAD"]);
+					const dirty = !!await git([
+						"status",
+						"--porcelain",
+						"--untracked-files=normal"
+					]);
+					if (ctx.workingDirectory.get(session) !== cwd) throw new Error("Working directory changed");
+					return {
+						ok: true,
+						value: {
+							operation,
+							headSha,
+							dirty
+						}
+					};
+				});
 			} catch {
 				result = failure;
 			}