@gitkraken/core-gitlens 0.3.0 → 0.4.0

package/src/git-cli/providers/graph.ts

@@ -32,9 +32,9 @@ import {
 	getRemoteNameFromBranchName,
 } from '../../git/utils/branch.utils.js';
 import { getChangedFilesCount } from '../../git/utils/commit.utils.js';
+import { createReachabilityTableBuilder } from '../../git/utils/reachability.utils.js';
 import { isUncommitted } from '../../git/utils/revision.utils.js';
 import { getSearchQueryComparisonKey, parseSearchQueryGitCommand } from '../../git/utils/search.utils.js';
-import { compareReachableRefs } from '../../git/utils/sorting.js';
 import { getTagId } from '../../git/utils/tag.utils.js';
 import { isUserMatch } from '../../git/utils/user.utils.js';
 import { getWorktreeId, groupWorktreesByBranch } from '../../git/utils/worktree.utils.js';
@@ -119,9 +119,14 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 		const [worktrees, worktreesByBranch] = getSettledValue(worktreesResult) ?? [[], new Map<string, GitWorktree>()];
 
 		let branchIdOfMainWorktree: string | undefined;
+		let mainWorktree: GitWorktree | undefined;
 		if (worktreesByBranch != null) {
-			branchIdOfMainWorktree = find(worktreesByBranch, ([, wt]) => wt.isDefault)?.[0];
-			if (branchIdOfMainWorktree != null) {
+			const defaultEntry = find(worktreesByBranch, ([, wt]) => wt.isDefault);
+			if (defaultEntry != null) {
+				[branchIdOfMainWorktree, mainWorktree] = defaultEntry;
+				// Remove the main/default worktree so the branch-row decoration shows `+checkedout`
+				// (not `+worktree`) for the main checkout. `mainWorktree` is retained below purely so
+				// Undo Commit can still reach the main worktree's HEAD from a secondary worktree's graph.
 				worktreesByBranch.delete(branchIdOfMainWorktree);
 			}
 		}
@@ -142,9 +147,62 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 		const avatars = new Map<string, string>();
 		const ids = new Set<string>();
 		const reachableFromHEAD = new Set<string>();
+		// SHAs on the first-parent chain from HEAD up to (excluding) the first merge commit — the only
+		// commits a plain (non-`--rebase-merges`) interactive rebase can safely rewrite. `headSha` seeds
+		// the chain; `rewriteableNextSha` tracks the next sha expected on it. Outer scope so they persist
+		// across `more()` pagination, like `reachableFromHEAD`.
+		const rewriteableFromHEAD = new Set<string>();
+		let headSha: string | undefined;
+		let rewriteableNextSha: string | undefined;
+		// Undo Commit is offered only on a worktree HEAD that is a LEAF (nothing is built on it) —
+		// undoing a commit other work is stacked on is unsafe. The leaf check is only needed for the
+		// undo-eligible tips (the active HEAD + each worktree's HEAD), so track just those shas rather
+		// than every commit, keeping this O(#worktrees) instead of O(#commits).
+		const undoableTipShas = new Set<string>();
+		if (headBranch?.sha != null) {
+			undoableTipShas.add(headBranch.sha);
+		}
+		for (const wt of worktrees) {
+			if (wt.sha != null) {
+				undoableTipShas.add(wt.sha);
+			}
+		}
+		// The subset of `undoableTipShas` that turn out to have a child (are an ancestor of another
+		// commit) — i.e. NOT leaves. Built newest-first during the walk, so by the time a tip's row is
+		// processed every newer commit (its only possible children) has been seen. Undo is withheld for
+		// shas recorded here. Stash rows are excluded (a stash sitting on a tip must not block undoing it).
+		const tipShasWithChildren = new Set<string>();
+		// SHAs reachable from HEAD's tracking upstream tip. Combined with `reachableFromHEAD`,
+		// this lets us mark commits as unpushed (reachable from HEAD but not from HEAD's upstream).
+		const reachableFromHeadUpstream = new Set<string>();
 
 		// Map<sha, Map<refKey, ref>> — inner map deduplicates refs during propagation
 		const reachableRefs = new Map<string, Map<string, ReachableRef>>();
+
+		// Stable, append-only reachability table built as we walk — the PRIMARY representation shipped to
+		// consumers. Lives in the outer scope so it accumulates across `more()` pagination; indices
+		// already assigned never change, since git reachability only propagates to older (later-walked)
+		// commits. Per-row ref arrays are NOT retained — each row keeps only its set index
+		// (`contexts.reachabilityIndex`), and the working `reachableRefs` entry is dropped once emitted.
+		// The encoder lives next to its decoder in `reachability.utils` so the wire format can't drift.
+		const reachabilityBuilder = createReachabilityTableBuilder();
+
+		function finalizeRowReachability(
+			row: GitGraphRow,
+			sha: string,
+			refs: Map<string, ReachableRef> | undefined,
+		): void {
+			const setIndex = reachabilityBuilder.intern(refs?.values());
+			if (setIndex != null) {
+				(row.contexts ??= {}).reachabilityIndex = setIndex;
+			}
+			// Drop the transient per-row arrays so emitted rows don't retain reachability, and release the
+			// working entry — once a commit is emitted its children are all walked and its parents already
+			// seeded, so nothing reads `reachableRefs.get(sha)` again (orderings keep parents after children).
+			row.reachability = undefined;
+			reachableRefs.delete(sha);
+		}
+
 		const rowStats: GitGraphRowsStats = new Map<string, GitGraphRowStats>();
 		let pendingRowsStatsCount = 0;
 		let iterations = 0;
@@ -224,6 +282,12 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 								branchIdOfMainWorktree: branchIdOfMainWorktree,
 								stashes: gitStash?.stashes,
 								reachableFromHEAD: reachableFromHEAD,
+								rewriteableFromHEAD: rewriteableFromHEAD,
+								tipShasWithChildren: tipShasWithChildren,
+								// `undefined` when HEAD has no upstream, so the processor flags nothing as
+								// unpublished; otherwise the live set (mutated during the walk, read by ref).
+								reachableFromHeadUpstream:
+									headRefUpstreamName != null ? reachableFromHeadUpstream : undefined,
 								avatars: avatars,
 							}
 						: undefined;
@@ -288,6 +352,7 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 							if (tip.startsWith('HEAD')) {
 								head = true;
 								reachableFromHEAD.add(shaOrRemapped);
+								headSha ??= shaOrRemapped;
 
 								if (tip !== 'HEAD') {
 									tip = tip.substring(8);
@@ -302,12 +367,16 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 									if (branchName === 'HEAD') continue;
 
 									remoteBranchId = getBranchId(repoPath, true, tip);
+									const isHeadUpstream = tip === headRefUpstreamName;
+									if (isHeadUpstream) {
+										reachableFromHeadUpstream.add(shaOrRemapped);
+									}
 									refRemoteHead = {
 										id: remoteBranchId,
 										name: branchName,
 										owner: remote.name,
 										url: remote.url,
-										current: tip === headRefUpstreamName,
+										current: isHeadUpstream,
 										hostingServiceType: remote.provider?.gkProviderId,
 									};
 									refRemoteHeads.push(refRemoteHead);
@@ -318,7 +387,16 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 
 							branch = branchMap.get(tip);
 							branchId = branch?.id ?? getBranchId(repoPath, false, tip);
-							const worktree = worktreesByBranch?.get(branchId);
+							// `worktreesByBranch` has the main/default worktree removed (above), so recover it
+							// here — Undo Commit needs to reach the main worktree's HEAD even when the active
+							// workspace is a secondary worktree.
+							const worktree =
+								worktreesByBranch?.get(branchId) ??
+								(branchId === branchIdOfMainWorktree ? mainWorktree : undefined);
+							const worktreeRef =
+								worktree != null
+									? { id: getWorktreeId(repoPath, worktree.name), path: worktree.path }
+									: undefined;
 							refHead = {
 								id: branchId,
 								name: tip,
@@ -330,7 +408,12 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 												id: getBranchId(repoPath, true, branch.upstream.name),
 											}
 										: undefined,
-								worktreeId: worktree != null ? getWorktreeId(repoPath, worktree.name) : undefined,
+								worktree: worktreeRef,
+								// Mirror `worktree.id` for `@gitkraken/gitkraken-components` — its bundled renderer
+								// reads `head.worktreeId` to pick the WORKTREE vs HEAD ref-badge. Scope to NON-default
+								// worktrees so the main checkout keeps its HEAD badge even though `worktree` (above)
+								// is populated for it for Undo routing.
+								worktreeId: worktree?.isDefault === false ? worktreeRef?.id : undefined,
 							};
 							refHeads.push(refHead);
 							if (branch?.upstream?.name != null) {
@@ -353,6 +436,27 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 						}
 					}
 
+					// First-parent rewriteable chain from HEAD: include each commit only while HEAD and
+					// every commit down to it has exactly one parent. Stops at (excludes) the first merge
+					// and the root — mirrors GitKraken's getDistinctCommitsFromHeadToFirstMergeCommit.
+					// Off-chain commits (a merge's other-parent ancestry, or anything below the first merge)
+					// are reachable-from-HEAD but NOT safely history-rewriteable by a plain interactive
+					// rebase. Relies on the same "commit emitted before its parents" ordering as above.
+					if (shaOrRemapped === headSha || shaOrRemapped === rewriteableNextSha) {
+						if (parents.length === 1) {
+							rewriteableFromHEAD.add(shaOrRemapped);
+							rewriteableNextSha = parents[0];
+						} else {
+							// A merge (>1 parents) or the root (0 parents) terminates the chain.
+							rewriteableNextSha = undefined;
+						}
+					}
+					if (reachableFromHeadUpstream.has(shaOrRemapped)) {
+						for (parent of parents) {
+							reachableFromHeadUpstream.add(parent);
+						}
+					}
+
 					// Seed reachability from all ref types on this commit
 					if (refHeads.length > 0 || refRemoteHeads.length > 0 || refTags.length > 0) {
 						let refs = reachableRefs.get(shaOrRemapped);
@@ -406,12 +510,13 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 							heads: refHeads,
 							remotes: refRemoteHeads,
 							tags: refTags,
-							reachability: refs?.size
-								? { partial: true, refs: [...refs.values()].sort(compareReachableRefs) }
-								: undefined,
+							// Transient: the row processor's `+unique` decision reads this; stripped just below.
+							// Unsorted (the consumer re-sorts after decoding) — order doesn't affect interning.
+							reachability: refs?.size ? { partial: true, refs: [...refs.values()] } : undefined,
 							isCurrentUser: true,
 						};
 						rowProcessor?.processRow(row, graphCtx!);
+						finalizeRowReachability(row, shaOrRemapped, refs);
 						rows.push(row);
 
 						if (stash.stats != null) {
@@ -424,6 +529,17 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 					} else {
 						isCurrentUser = isUserMatch(currentUser, commit.author, commit.authorEmail);
 
+						// Mark any undo-eligible tip that THIS (non-stash) commit builds on as non-leaf, so
+						// its Undo Commit is withheld. Uses the full parent set (incl. merge second-parents)
+						// but only records shas that are actually undo tips — newer commits are walked first,
+						// so a tip is recorded before its own row is processed. Stash rows are intentionally
+						// not handled here, so a stash based on a tip doesn't block undoing that tip.
+						for (parent of parents) {
+							if (undoableTipShas.has(parent)) {
+								tipShasWithChildren.add(parent);
+							}
+						}
+
 						const refs = reachableRefs.get(shaOrRemapped);
 						const row: GitGraphRow = {
 							sha: shaOrRemapped,
@@ -437,12 +553,13 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 							heads: refHeads,
 							remotes: refRemoteHeads,
 							tags: refTags,
-							reachability: refs?.size
-								? { partial: true, refs: [...refs.values()].sort(compareReachableRefs) }
-								: undefined,
+							// Transient: the row processor's `+unique` decision reads this; stripped just below.
+							// Unsorted (the consumer re-sorts after decoding) — order doesn't affect interning.
+							reachability: refs?.size ? { partial: true, refs: [...refs.values()] } : undefined,
 							isCurrentUser: isCurrentUser || undefined,
 						};
 						rowProcessor?.processRow(row, graphCtx!);
+						finalizeRowReachability(row, shaOrRemapped, refs);
 						rows.push(row);
 
 						if (commit.stats != null) {
@@ -460,7 +577,7 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 				if (deferStats) {
 					pendingRowsStatsCount++;
 
-					// eslint-disable-next-line no-async-promise-executor
+					// oxlint-disable-next-line no-async-promise-executor
 					const promise = new Promise<void>(async resolve => {
 						try {
 							const args = [...statsParser.arguments];
@@ -514,6 +631,8 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 					worktrees: worktrees,
 					worktreesByBranch: worktreesByBranch,
 					reachableFromHEAD: reachableFromHEAD,
+					rewriteableFromHEAD: rewriteableFromHEAD,
+					reachability: reachabilityBuilder.build(),
 					rows: rows,
 					id: sha ?? rev,
 					rowsStats: rowStats,
@@ -538,7 +657,19 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 			}
 		}
 
-		return getCommitsForGraphCore.call(this, defaultLimit, selectSha, undefined, cancellation);
+		let graph = await getCommitsForGraphCore.call(this, defaultLimit, selectSha, undefined, cancellation);
+
+		// Spurious-empty guard: the repo has branches (so `git log --all` should yield commits) yet the
+		// log returned no rows. That's an inconsistent result — almost always a transient ref-read race
+		// while a concurrent git operation rewrites refs/packed-refs — not a genuinely empty repo.
+		// Returning it would flash "No commits" in the graph. Retry once (transient glitches clear within
+		// ms). A truly empty repo has no branches and is left untouched.
+		if (graph.rows.length === 0 && branches?.length && !cancellation?.aborted) {
+			scope?.warn(`graph returned 0 rows but repo has ${branches.length} branches; retrying`);
+			graph = await getCommitsForGraphCore.call(this, defaultLimit, selectSha, undefined, cancellation);
+		}
+
+		return graph;
 	}
 
 	@debug({

package/src/git-cli/providers/operations.ts

@@ -25,6 +25,7 @@ import { getBranchNameAndRemote, getBranchTrackingWithoutRemote } from '../../gi
 import { isBranchReference } from '../../git/utils/reference.utils.js';
 import { debug } from '../../utils/decorators/log.js';
 import { sequentialize } from '../../utils/decorators/sequentialize.js';
+import { chunkByStringLength } from '../../utils/iterable.js';
 import { Logger } from '../../utils/logger.js';
 import { getScopedLogger } from '../../utils/logger.scoped.js';
 import { normalizePath, splitPath } from '../../utils/path.js';
@@ -51,124 +52,26 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 	async checkout(
 		repoPath: string,
 		ref: string,
-		options?: { createBranch?: string } | { path?: string },
+		options?: { createBranch?: string; noTracking?: boolean },
 		runOptions?: GitOperationRunOptions,
 	): Promise<void> {
 		const scope = getScopedLogger();
 
-		try {
-			await this.checkoutCore(repoPath, ref, options, runOptions);
-			this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status');
-			this.context.hooks?.repository?.onChanged?.(repoPath, ['head', 'heads', 'index']);
-		} catch (ex) {
-			scope?.error(ex);
-			throw ex;
-		}
-	}
-
-	private async checkoutCore(
-		repoPath: string,
-		ref: string,
-		{ createBranch, path }: { createBranch?: string; path?: string } = {},
-		runOptions?: GitOperationRunOptions,
-	): Promise<void> {
 		const params = ['checkout'];
-		if (createBranch) {
-			params.push('-b', createBranch, ref, '--');
+		if (options?.createBranch) {
+			params.push('-b', options.createBranch);
+			if (options.noTracking) {
+				params.push('--no-track');
+			}
+			params.push(ref, '--');
 		} else {
 			params.push(ref, '--');
-
-			if (path) {
-				[path, repoPath] = splitPath(path, repoPath, true);
-				params.push(path);
-			}
-		}
-
-		try {
-			await this.git.run({ cwd: repoPath, ...runOptions }, ...params);
-		} catch (ex) {
-			throw getGitCommandError(
-				'checkout',
-				ex,
-				reason =>
-					new CheckoutError(
-						{ reason: reason ?? 'other', ref: ref, gitCommand: { repoPath: repoPath, args: params } },
-						ex,
-					),
-			);
-		}
-	}
-
-	@debug()
-	async checkoutConflictedPath(
-		repoPath: string,
-		path: string,
-		side: 'ours' | 'theirs',
-		runOptions?: GitOperationRunOptions,
-	): Promise<void> {
-		const scope = getScopedLogger();
-
-		[path, repoPath] = splitPath(path, repoPath, true);
-		const params = ['checkout', `--${side}`, '--', path];
-
-		try {
-			await this.git.run({ cwd: repoPath, ...runOptions }, ...params);
-			this.context.hooks?.cache?.onReset?.(repoPath, 'status');
-			this.context.hooks?.repository?.onChanged?.(repoPath, ['index']);
-		} catch (ex) {
-			scope?.error(ex);
-			throw getGitCommandError(
-				'checkout',
-				ex,
-				reason =>
-					new CheckoutError(
-						{ reason: reason ?? 'other', ref: side, gitCommand: { repoPath: repoPath, args: params } },
-						ex,
-					),
-			);
-		}
-	}
-
-	@debug()
-	async checkoutConflictedPaths(
-		repoPath: string,
-		paths: string[],
-		side: 'ours' | 'theirs',
-		runOptions?: GitOperationRunOptions,
-	): Promise<void> {
-		if (!paths.length) return;
-
-		const scope = getScopedLogger();
-		const normalized = paths.map(p => splitPath(p, repoPath, true)[0]);
-
-		// Build batches by accumulating the length of each path + a small per-arg overhead (separator +
-		// possible quoting), so a single long path — or just the overhead itself — can't push a batch
-		// past the CLI length limit. Always keep at least one path per batch, even if a lone path is
-		// longer than the limit (the OS may still accept it on some platforms).
-		const perArgOverhead = 3;
-		const batches: string[][] = [];
-		let current: string[] = [];
-		let currentLen = 0;
-		for (const p of normalized) {
-			const cost = p.length + perArgOverhead;
-			if (current.length > 0 && currentLen + cost > maxGitCliLength) {
-				batches.push(current);
-				current = [];
-				currentLen = 0;
-			}
-			current.push(p);
-			currentLen += cost;
-		}
-		if (current.length) {
-			batches.push(current);
 		}
 
 		try {
-			for (const batch of batches) {
-				await this.git.run({ cwd: repoPath, ...runOptions }, 'checkout', `--${side}`, '--', ...batch);
-			}
-			this.context.hooks?.cache?.onReset?.(repoPath, 'status');
-			this.context.hooks?.repository?.onChanged?.(repoPath, ['index']);
+			await this.git.run({ cwd: repoPath, errors: 'throw', ...runOptions }, ...params);
+			this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status');
+			this.context.hooks?.repository?.onChanged?.(repoPath, ['head', 'heads', 'index']);
 		} catch (ex) {
 			scope?.error(ex);
 			throw getGitCommandError(
@@ -176,11 +79,7 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 				ex,
 				reason =>
 					new CheckoutError(
-						{
-							reason: reason ?? 'other',
-							ref: side,
-							gitCommand: { repoPath: repoPath, args: ['checkout', `--${side}`, '--', ...normalized] },
-						},
+						{ reason: reason ?? 'other', ref: ref, gitCommand: { repoPath: repoPath, args: params } },
 						ex,
 					),
 			);
@@ -288,6 +187,13 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		if (options?.date) {
 			params.push(`--date=${options.date}`);
 		}
+		// Host-level override (e.g. VS Code's `git.enableCommitSigning`) — request signing explicitly
+		// via `-S`. Implicit repo-config signing (`commit.gpgsign=true`) needs no flag, and `-S`
+		// alongside it is harmless, so the override can only enable signing, never force it off.
+		const sign = this.context.config?.signing?.enabled === true;
+		if (sign) {
+			params.push('-S');
+		}
 		// Read commit message from stdin via -F - to avoid shell escaping issues
 		params.push('-F', '-');
 
@@ -298,6 +204,15 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 			);
 			this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status');
 			this.context.hooks?.repository?.onChanged?.(repoPath, ['head', 'heads', 'index']);
+			if (sign) {
+				// `-S` was passed and the commit succeeded, so signing is confirmed — fire the
+				// explicit-sign hook (same contract as the patch provider's `commit-tree -S` path).
+				let format: SigningFormat | undefined;
+				try {
+					format = (await this.provider.config.getSigningConfig?.(repoPath))?.format;
+				} catch {}
+				this.context.hooks?.commits?.onSigned?.(format ?? 'gpg', options?.source);
+			}
 		} catch (ex) {
 			scope?.error(ex);
 			await this.throwIfSigningError(repoPath, params, ex, options?.source);
@@ -383,7 +298,7 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		}
 
 		try {
-			await this.git.run({ cwd: repoPath, ...runOptions }, ...params);
+			await this.git.run({ cwd: repoPath, errors: 'throw', ...runOptions }, ...params);
 		} catch (ex) {
 			throw getGitCommandError(
 				'fetch',
@@ -530,7 +445,7 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		}
 
 		try {
-			await this.git.run({ cwd: repoPath, configs: gitConfigsPull, ...runOptions }, ...params);
+			await this.git.run({ cwd: repoPath, configs: gitConfigsPull, errors: 'throw', ...runOptions }, ...params);
 		} catch (ex) {
 			await this.throwIfSigningError(repoPath, params, ex, options.source);
 			throw getGitCommandError(
@@ -574,12 +489,17 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 			const branch = await this.provider.branches.getBranch(repoPath);
 			if (branch == null) return;
 
-			branchName =
-				options?.reference != null
-					? `${options.reference.ref}:${
-							options?.publish != null ? 'refs/heads/' : ''
-						}${branch.nameWithoutRemote}`
-					: branch.name;
+			if (options?.reference != null) {
+				branchName = `${options.reference.ref}:${
+					options?.publish != null ? 'refs/heads/' : ''
+				}${branch.nameWithoutRemote}`;
+			} else {
+				const tracking = options?.publish == null ? branch.trackingWithoutRemote : undefined;
+				branchName =
+					tracking != null && tracking !== branch.nameWithoutRemote
+						? `${branch.name}:${tracking}`
+						: branch.name;
+			}
 			remoteName = branch.remoteName ?? options?.publish?.remote;
 			upstreamName = options?.reference == null && options?.publish != null ? branch.name : undefined;
 
@@ -599,10 +519,12 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 
 		let forceOpts: PushForceOptions | undefined;
 		if (options?.force) {
-			forceOpts = {
-				withLease: true,
-				ifIncludes: true,
-			};
+			// Honor the host's force-push preferences (e.g. VS Code's `git.useForcePushWithLease` /
+			// `git.useForcePushIfIncludes`); fall back to the safer `--force-with-lease` behavior.
+			const useForceWithLease = this.context.config?.push?.useForceWithLease ?? true;
+			forceOpts = useForceWithLease
+				? { withLease: true, ifIncludes: this.context.config?.push?.useForceIfIncludes ?? true }
+				: { withLease: false };
 		}
 
 		try {
@@ -688,7 +610,7 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		}
 
 		try {
-			await this.git.run({ cwd: repoPath, ...runOptions }, ...params);
+			await this.git.run({ cwd: repoPath, errors: 'throw', ...runOptions }, ...params);
 		} catch (ex) {
 			const error = getGitCommandError(
 				'push',
@@ -758,6 +680,8 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 			branch?: string;
 			editor?: string;
 			interactive?: boolean;
+			programmaticEditor?: boolean;
+			messageEditor?: string;
 			onto?: string;
 			updateRefs?: boolean;
 			source?: unknown;
@@ -767,7 +691,7 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		const scope = getScopedLogger();
 
 		const args = ['rebase'];
-		let configs: string[] | undefined;
+		const configs: string[] = [];
 
 		if (options?.autoStash !== false) {
 			args.push('--autostash');
@@ -777,10 +701,26 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 			args.push('--interactive');
 
 			if (options.editor) {
-				configs = ['-c', `sequence.editor=${options.editor}`];
+				configs.push('-c', `sequence.editor=${options.editor}`);
+			}
+
+			// A script-based sequence editor rewrites the todo by command word + SHA, so git must emit a
+			// plain, natural-order todo regardless of the user's rebase config: `rebase.autosquash` would
+			// reorder commits and rewrite `pick`→`fixup`, and `rebase.abbreviateCommands` would emit `p`.
+			if (options.programmaticEditor) {
+				configs.push('-c', 'rebase.autosquash=false', '-c', 'rebase.abbreviateCommands=false');
 			}
 		}
 
+		// Drive per-commit message editing (the combined message a `squash` produces, or a `reword`).
+		// `GIT_EDITOR` (not `core.editor`) is what git's interactive-rebase backend honors for the `reword`
+		// amend step, so set it on the environment; also set `core.editor` config as a fallback.
+		let env = runOptions?.env;
+		if (options?.messageEditor) {
+			configs.push('-c', `core.editor=${options.messageEditor}`);
+			env = { ...env, GIT_EDITOR: options.messageEditor };
+		}
+
 		if (options?.updateRefs) {
 			args.push('--update-refs');
 		}
@@ -798,7 +738,7 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		try {
 			await this.git.run(
 				// Avoid a timeout since rebases can take a long time (set to 0 to disable)
-				{ cwd: repoPath, errors: 'throw', configs: configs, timeout: 0, ...runOptions },
+				{ cwd: repoPath, errors: 'throw', configs: configs, timeout: 0, ...runOptions, env: env },
 				...args,
 			);
 			this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status');
@@ -859,7 +799,7 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		params.push(rev, '--');
 
 		try {
-			await this.git.run({ cwd: repoPath, ...runOptions }, ...params);
+			await this.git.run({ cwd: repoPath, errors: 'throw', ...runOptions }, ...params);
 		} catch (ex) {
 			throw getGitCommandError(
 				'reset',
@@ -870,6 +810,74 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		}
 	}
 
+	@sequentialize({ getQueueKey: rp => rp })
+	@debug()
+	async restore(
+		repoPath: string,
+		path: string | string[],
+		options?: { ref?: string; side?: 'ours' | 'theirs' },
+		runOptions?: GitOperationRunOptions,
+	): Promise<void> {
+		const paths = Array.isArray(path) ? path : [path];
+		if (!paths.length) return;
+
+		const scope = getScopedLogger();
+		const normalized = paths.map(p => splitPath(p, repoPath, true)[0]);
+
+		// `side` and `ref` are mutually exclusive in git (--ours/--theirs apply during conflict
+		// resolution and take no source ref); side takes precedence if both are somehow supplied.
+		// Use a truthy check on `ref` so an empty string falls through to index-restore rather than
+		// producing a malformed `git checkout '' -- …`. Implemented via `checkout` rather than
+		// `git restore` for compatibility with the minimum supported git (2.7.2); `git restore`
+		// only landed in 2.23.
+		const selector = options?.side != null ? `--${options.side}` : options?.ref || undefined;
+		const prefix = selector != null ? ['checkout', selector, '--'] : ['checkout', '--'];
+
+		try {
+			if (await this.git.supports('git:checkout:pathspec-from-file')) {
+				// Git ≥ 2.26: stream all pathspecs via stdin (NUL-separated) in a single invocation —
+				// no CLI-length limit (so no batching), and robust for paths with spaces/newlines.
+				// Pathspecs come from the file rather than argv, so `--` isn't used.
+				const args = ['checkout'];
+				if (selector != null) {
+					args.push(selector);
+				}
+				args.push('--pathspec-from-file=-', '--pathspec-file-nul');
+				await this.git.run(
+					{ cwd: repoPath, errors: 'throw', ...runOptions, stdin: normalized.join('\0') },
+					...args,
+				);
+			} else {
+				// Older git: pass pathspecs as args, one git invocation per chunk (collapsing N
+				// path-mode checkouts into ⌈N / chunk⌉ spawns). Reserve the command prefix length and
+				// a per-arg overhead (separator + possible quoting) so the assembled command line
+				// can't exceed the OS limit even with many short paths.
+				const perArgOverhead = 3;
+				const prefixLength = prefix.reduce((sum, arg) => sum + arg.length + perArgOverhead, 0);
+				for (const batch of chunkByStringLength(normalized, maxGitCliLength - prefixLength, perArgOverhead)) {
+					await this.git.run({ cwd: repoPath, errors: 'throw', ...runOptions }, ...prefix, ...batch);
+				}
+			}
+			this.context.hooks?.cache?.onReset?.(repoPath, 'status');
+			this.context.hooks?.repository?.onChanged?.(repoPath, ['index']);
+		} catch (ex) {
+			scope?.error(ex);
+			throw getGitCommandError(
+				'checkout',
+				ex,
+				reason =>
+					new CheckoutError(
+						{
+							reason: reason ?? 'other',
+							ref: options?.side ?? options?.ref,
+							gitCommand: { repoPath: repoPath, args: [...prefix, ...normalized] },
+						},
+						ex,
+					),
+			);
+		}
+	}
+
 	@sequentialize({ getQueueKey: rp => rp })
 	@debug()
 	async revert(