@gitkraken/core-gitlens 0.3.1 → 0.4.100

package/src/git/utils/reachability.utils.ts

@@ -1,17 +1,62 @@
 import { base64, fromBase64 } from '../../utils/base64.js';
-import type { GraphReachabilityTable } from '../models/graph.js';
+import type { GraphContext, GraphReachabilityTable } from '../models/graph.js';
+import { GitGraphRowContextFlags } from '../models/graph.js';
 import type { GitCommitReachability } from '../providers/commits.js';
 
 type ReachableRef = GitCommitReachability['refs'][number];
 
+/**
+ * Computes the compact {@link GitGraphRowContextFlags} bitfield for a commit row from its reachable-ref
+ * set and the walk's HEAD-derived sets. Single-sourced so the host row processor
+ * (`GlGraphRowProcessor`), the R6b incremental fast path, and the equivalence harness all compute
+ * byte-identical flags (no manual mirrors that can drift). Stash rows carry no flags — callers skip this
+ * for `stash-node` rows. See {@link GitGraphRowContextFlags} for the per-bit semantics.
+ */
+export function computeGraphRowContextFlags(
+	sha: string,
+	reachableRefs: Iterable<ReachableRef> | undefined,
+	ctx: Pick<
+		GraphContext,
+		'reachableFromHEAD' | 'rewriteableFromHEAD' | 'tipShasWithChildren' | 'reachableFromHeadUpstream'
+	>,
+): GitGraphRowContextFlags {
+	// Allocation-free "exactly one local branch reachable" check → `+unique`.
+	let localBranches = 0;
+	if (reachableRefs != null) {
+		for (const r of reachableRefs) {
+			if (r.refType === 'branch' && !r.remote && ++localBranches > 1) break;
+		}
+	}
+	// Unpublished (ahead) = reachable from HEAD but not from HEAD's upstream tip. Unpulled (behind) is its
+	// exact mirror over the same two sets: on the upstream tip but not on HEAD, i.e. `HEAD..@{u}`. Both are
+	// derived from `reachableFromHeadUpstream`, which is undefined when HEAD has no upstream — so neither
+	// is ever flagged in that case, and the two can never both be set for one sha.
+	const upstream = ctx.reachableFromHeadUpstream;
+	const reachableFromHead = ctx.reachableFromHEAD.has(sha);
+	const onUpstream = upstream?.has(sha) ?? false;
+	const isUnpublished = upstream != null && reachableFromHead && !onUpstream;
+	const isUnpulled = onUpstream && !reachableFromHead;
+	return (
+		(reachableFromHead ? GitGraphRowContextFlags.ReachableFromHead : 0) |
+		(ctx.rewriteableFromHEAD.has(sha) ? GitGraphRowContextFlags.RewriteableFromHead : 0) |
+		(localBranches === 1 ? GitGraphRowContextFlags.UniqueToBranch : 0) |
+		(ctx.tipShasWithChildren.has(sha) ? GitGraphRowContextFlags.HasChildren : 0) |
+		(isUnpublished ? GitGraphRowContextFlags.Unpublished : 0) |
+		(isUnpulled ? GitGraphRowContextFlags.Unpulled : 0)
+	);
+}
+
 /**
  * Canonical dictionary key for a reachable ref. The `r`/`l` discriminator keeps a remote branch from
  * colliding with a local branch of the same name; the `refType` prefix separates tags from branches.
+ * `current` is part of the key so a builder SEEDED from a prior generation's table can't hand back a
+ * stale dictionary entry after the checked-out branch changes — the updated ref interns as a new
+ * entry instead (within a single walk `current` can't change, so the wider key is behavior-neutral).
  * Single-sourced here so the encoder ({@link createReachabilityTableBuilder}) and any future consumer
  * can't drift on the convention.
  */
 export function reachableRefKey(ref: ReachableRef): string {
-	return `${ref.refType}:${ref.refType === 'branch' && ref.remote ? 'r' : 'l'}:${ref.name}`;
+	return `${ref.refType}:${ref.refType === 'branch' && ref.remote ? 'r' : 'l'}:${ref.current ? 'c' : 'n'}:${ref.name}`;
 }
 
 // Monotonic generation counter — each builder (i.e. each fresh graph walk) gets a distinct id, while a
@@ -28,16 +73,29 @@ let nextReachabilityTableId = 0;
  *
  * Append-only by construction: an index, once assigned, is never reused — so a builder kept alive
  * across paginated loads accumulates a table whose existing indices stay valid as it grows.
+ *
+ * Pass a prior generation's table as `seed` to CONTINUE it: identical ref sets re-intern to their
+ * seeded indices and the table keeps the seed's `id`, so rows retained across a rebuild keep valid
+ * `reachabilityIndex` values and the host's same-id delta shipping applies (only appended entries go
+ * over the wire). Entries the new walk never re-interns stay in the table unreferenced — harmless,
+ * and bounded by per-session ref churn.
  */
-export function createReachabilityTableBuilder(): {
+export function createReachabilityTableBuilder(seed?: GraphReachabilityTable): {
 	intern: (refs: Iterable<ReachableRef> | undefined) => number | undefined;
 	build: () => GraphReachabilityTable | undefined;
 } {
-	const id = ++nextReachabilityTableId;
-	const dictionary: GitCommitReachability['refs'] = [];
-	const refKeyToIndex = new Map<string, number>();
-	const sets: string[] = [];
-	const setKeyToIndex = new Map<string, number>();
+	const id = seed?.id ?? ++nextReachabilityTableId;
+	const dictionary: GitCommitReachability['refs'] = seed != null ? [...seed.dictionary] : [];
+	const refKeyToIndex = new Map<string, number>(dictionary.map((ref, i) => [reachableRefKey(ref), i]));
+	const sets: string[] = seed != null ? [...seed.sets] : [];
+	const setKeyToIndex = new Map<string, number>(sets.map((encoded, i) => [encoded, i]));
+
+	// Reachability is monotone, so a graph walk interns long runs of IDENTICAL sets (thousands of
+	// consecutive trunk rows share one set). Remembering the previous call's indices skips the
+	// bitmap-pack + base64 for those runs; a same-membership-different-order call just falls through
+	// to the (still correct) slow path.
+	let lastIndices: number[] | undefined;
+	let lastSetIndex: number | undefined;
 
 	return {
 		/** Interns a ref set, returning its index into `sets`, or undefined when the set is empty. */
@@ -61,6 +119,17 @@ export function createReachabilityTableBuilder(): {
 			}
 			if (indices.length === 0) return undefined;
 
+			if (lastIndices != null && indices.length === lastIndices.length) {
+				let same = true;
+				for (let i = 0; i < indices.length; i++) {
+					if (indices[i] !== lastIndices[i]) {
+						same = false;
+						break;
+					}
+				}
+				if (same) return lastSetIndex;
+			}
+
 			// Pack into a bitset sized to this set's high-water dictionary index, then intern by base64.
 			const bytes = new Uint8Array((maxIndex >> 3) + 1);
 			for (const index of indices) {
@@ -73,6 +142,8 @@ export function createReachabilityTableBuilder(): {
 				setKeyToIndex.set(encoded, setIndex);
 				sets.push(encoded);
 			}
+			lastIndices = indices;
+			lastSetIndex = setIndex;
 			return setIndex;
 		},
 

package/src/git/utils/sshKey.utils.ts

@@ -0,0 +1,30 @@
+// Strict allowlist of OpenSSH public-key types valid in an `allowed_signers`/`.pub` entry, including security-key
+// (`sk-`) and certificate (`-cert-v01@openssh.com`) variants. Used to reject attacker-controllable key types embedded
+// in commit SSH signatures (or returned by a provider) before they're written to a trust-sensitive file.
+const sshKeyTypeRegex =
+	/^(?:sk-)?(?:ssh-ed25519|ssh-rsa|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))(?:-cert-v01)?(?:@openssh\.com)?$/;
+
+// A base64 blob with no embedded whitespace/newlines (length must be a multiple of 4, standard base64 alphabet).
+const base64Regex = /^[A-Za-z0-9+/]+={0,2}$/;
+
+// A principal safe to write as the first token of an `allowed_signers` line. Beyond whitespace/control characters
+// (which would inject extra tokens or whole lines), it also rejects the principal-list meta-characters `,` (separator),
+// `*`/`?` (wildcards), `!` (negation), and `"`/`\` (quoting) — any of which could broaden a single identity into a
+// list or pattern that matches signers it shouldn't.
+// eslint-disable-next-line no-control-regex
+const principalRegex = /^[^\s\x00-\x1f\x7f,*?!"\\]+$/;
+
+/** Whether `keyType` is a recognized OpenSSH public-key type (strict allowlist, not a prefix match). */
+export function isValidSshKeyType(keyType: string): boolean {
+	return sshKeyTypeRegex.test(keyType);
+}
+
+/** Whether `keyData` is a well-formed base64 public-key blob with no embedded whitespace or newlines. */
+export function isValidSshKeyData(keyData: string): boolean {
+	return keyData.length % 4 === 0 && base64Regex.test(keyData);
+}
+
+/** Whether `principal` is safe to write as an `allowed_signers` principal (non-empty, no whitespace/control chars). */
+export function isValidAllowedSignerPrincipal(principal: string): boolean {
+	return principalRegex.test(principal);
+}

package/src/git/watching/watchService.ts

@@ -69,6 +69,13 @@ export class RepositoryWatchService implements UnifiedDisposable {
 		return this._onDidChangeRepository.event;
 	}
 
+	private readonly _onDidChangeWorkingTree = new Emitter<string>();
+	/** Global multiplexed working-tree change event (repo path) for ALL watched repos. Fires once per
+	 *  debounced flush per session — the single point that drives the cache's status clock for working-tree edits. */
+	get onDidChangeWorkingTree(): Event<string> {
+		return this._onDidChangeWorkingTree.event;
+	}
+
 	private readonly defaultRepoDelayMs?: number;
 	private readonly defaultWorkingTreeDelayMs?: number;
 	private readonly getIgnoreFilter?: (repoPath: string, gitDirPath: string) => GitIgnoreFilter | undefined;
@@ -113,6 +120,7 @@ export class RepositoryWatchService implements UnifiedDisposable {
 		this.wtWatchers.clear();
 
 		this._onDidChangeRepository.dispose();
+		this._onDidChangeWorkingTree.dispose();
 	}
 
 	/**
@@ -164,6 +172,9 @@ export class RepositoryWatchService implements UnifiedDisposable {
 				onDidFireRepoChange: (event): void => {
 					this._onDidChangeRepository.fire(event);
 				},
+				onDidFireWorkingTreeChange: (repoPath): void => {
+					this._onDidChangeWorkingTree.fire(repoPath);
+				},
 			});
 
 			const watchHooksSet = new Set<WatchHooks>();
@@ -331,7 +342,11 @@ export class RepositoryWatchService implements UnifiedDisposable {
 				for (const h of watchHooks) {
 					h.onGitIgnoreChanged?.(repoPath);
 				}
-				// Don't push .gitignore itself as a working tree change
+				// Route the ignore-rule change through the repo channel as an `ignores` change (like `info/exclude`),
+				// so it reaches EVERY session subscriber — including a closed secondary worktree's `watch()` `repoSub`,
+				// which has no `onGitIgnoreChanged` hook and would otherwise keep a stale untracked-file list. Coalesces
+				// with any hook-fired `ignores` above, so open repos don't double. (.gitignore itself is not a WT change.)
+				session.pushRepoChanges(['ignores']);
 				return;
 			}
 

package/src/git/watching/watchSession.ts

@@ -45,6 +45,12 @@ export interface WatchSessionOptions {
 	 * global event forwarding without affecting lifecycle callbacks.
 	 */
 	readonly onDidFireRepoChange?: (event: WatcherRepoChangeEvent) => void;
+	/**
+	 * Called whenever a debounced working-tree change is dispatched to subscribers. Like
+	 * {@link onDidFireRepoChange}, does NOT count as a subscriber — used by WatchService for global
+	 * event forwarding (the single point that drives the cache's status clock for working-tree edits).
+	 */
+	readonly onDidFireWorkingTreeChange?: (repoPath: string) => void;
 }
 
 const defaultRepoDelay = 250;
@@ -82,6 +88,7 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 
 	private readonly lifecycle?: WatchSessionLifecycle;
 	private readonly onDidFireRepoChangeCallback?: (event: WatcherRepoChangeEvent) => void;
+	private readonly onDidFireWorkingTreeChangeCallback?: (repoPath: string) => void;
 
 	constructor(options: WatchSessionOptions) {
 		this.repoPath = options.repoPath;
@@ -91,6 +98,7 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 		this.effectiveWorkingTreeMs = this.defaultWorkingTreeMs;
 		this.lifecycle = options.lifecycle;
 		this.onDidFireRepoChangeCallback = options.onDidFireRepoChange;
+		this.onDidFireWorkingTreeChangeCallback = options.onDidFireWorkingTreeChange;
 		this._suspended = options.suspended ?? false;
 	}
 
@@ -274,7 +282,12 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 	fireChangeImmediate(...changes: RepositoryChange[]): void {
 		if (this._disposed || changes.length === 0) return;
 
-		this.repoEmitter.fire(new WatcherRepoChangeEvent(this.repoPath, changes));
+		const event = new WatcherRepoChangeEvent(this.repoPath, changes);
+		// Same contract as `flushRepo`: notify the global forwarder (which advances the cache's status clock) BEFORE
+		// subscribers. Skipping it here would route changes to subscribers that no one advanced the clock for —
+		// subscribers see them as session-routed and (correctly) don't re-advance, so the cache would go stale.
+		this.onDidFireRepoChangeCallback?.(event);
+		this.repoEmitter.fire(event);
 	}
 
 	/** Push interpreted repo changes into the pipeline */
@@ -321,8 +334,10 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 		if (event == null) return;
 
 		this.pendingRepoEvent = undefined;
-		this.repoEmitter.fire(event);
+		// Advance any cache clock BEFORE notifying subscribers (same rationale as `flushWorkingTree`): a subscriber
+		// that synchronously reads status must see the post-change generation, not a joinable pre-change run.
 		this.onDidFireRepoChangeCallback?.(event);
+		this.repoEmitter.fire(event);
 	}
 
 	private scheduleRepoFlush(delayOverride?: number): void {
@@ -351,6 +366,9 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 
 		const paths = this.pendingWorkingTreePaths;
 		this.pendingWorkingTreePaths = new Set();
+		// Advance the cache's status clock (via WatchService's global forwarding) BEFORE notifying subscribers,
+		// so a subscriber that synchronously reads status sees the post-change generation, not a joinable pre-change run.
+		this.onDidFireWorkingTreeChangeCallback?.(this.repoPath);
 		this.workingTreeEmitter.fire({ repoPath: this.repoPath, paths: paths });
 	}
 

package/src/git-cli/exec/git.ts

@@ -8,6 +8,7 @@ import type {
 	CommitErrorReason,
 	FetchErrorReason,
 	GitCommandError,
+	GitWarningKey,
 	MergeErrorReason,
 	PausedOperationAbortErrorReason,
 	PausedOperationContinueErrorReason,
@@ -24,8 +25,9 @@ import type {
 	WorktreeCreateErrorReason,
 	WorktreeDeleteErrorReason,
 } from '../../git/errors.js';
-import { WorkspaceUntrustedError } from '../../git/errors.js';
+import { GitWarnings, WorkspaceUntrustedError } from '../../git/errors.js';
 import type { SigningFormat } from '../../git/models/signature.js';
+import type { GitRunCancellation } from '../../git/run.types.js';
 import { CancellationError, getAbortSignalId, isCancellationError } from '../../utils/cancellation.js';
 import { getScopedCounter } from '../../utils/counter.js';
 import { getDurationMilliseconds, hrtime } from '../../utils/hrtime.js';
@@ -126,26 +128,16 @@ export const GitErrors = {
 	unsafeRepository:
 		/(?:^fatal:\s*detected dubious ownership in repository at '([^']+)'|unsafe repository \('([^']+)' is owned by someone else\))[\s\S]*(git config --global --add safe\.directory [^\n•]+)/m,
 	unstagedChanges: /You have unstaged changes/i,
+	// Matches both variants: with a lock reason (`..., lock reason: <reason>`) and without (`...;`)
+	worktreeLocked: /fatal:\s*cannot remove a locked working tree/i,
+	// Only matches the variant where Git reports a lock reason; the reason is free text, so capture the whole line
+	worktreeLockedReason: /cannot remove a locked working tree,[ \t]*lock reason:[ \t]*(.*)/i,
 } as const;
 
-export const GitWarnings = {
-	notARepository: /Not a git repository/i,
-	outsideRepository: /is outside repository/i,
-	noPath: /no such path/i,
-	noCommits: /does not have any commits/i,
-	notFound: /Path '.*?' does not exist in/i,
-	foundButNotInRevision: /Path '.*?' exists on disk, but not in/i,
-	headNotABranch: /HEAD does not point to a branch/i,
-	noUpstream: /no upstream configured for branch '(.*?)'/i,
-	unknownRevision:
-		/ambiguous argument '.*?': unknown revision or path not in the working tree|not stored as a remote-tracking branch/i,
-	mustRunInWorkTree: /this operation must be run in a work tree/i,
-	patchWithConflicts: /Applied patch to '.*?' with conflicts/i,
-	noRemoteRepositorySpecified: /No remote repository specified\./i,
-	remoteConnectionError: /Could not read from remote repository/i,
-	notAGitCommand: /'.+' is not a git command/i,
-	tipBehind: /tip of your current branch is behind/i,
-} as const;
+// `GitWarnings` moved to `@gitlens/git/errors.js` so the shared run contract can name its keys; re-exported
+// here because it's long-established as part of this module's surface.
+export { GitWarnings };
+export type { GitWarningKey } from '../../git/errors.js';
 
 export class GitError extends Error {
 	readonly cmd: string | undefined;
@@ -393,6 +385,8 @@ const errorToReasonMap = new Map<GitCommand, [RegExp, GitCommandToReasonMap[GitC
 	[
 		'worktree-delete',
 		[
+			// Must come first -- a locked worktree's lock reason is free text that can otherwise match the errors below
+			[GitErrors.worktreeLocked, 'locked'],
 			[GitErrors.mainWorkingTree, 'defaultWorkingTree'],
 			[GitErrors.uncommittedChanges, 'uncommittedChanges'],
 			[GitErrors.failedToDeleteDirectoryNotEmpty, 'directoryNotEmpty'],
@@ -653,14 +647,37 @@ export class Git {
 			return options.caching.cache.getOrCreate(
 				options.caching.commonPath ?? options.cwd!,
 				gitCommand,
-				async cacheable => {
-					const result = await this.runCore<T>({ ...options, caching: undefined }, runArgs, gitCommand);
-					if (result.exitCode !== 0) {
+				async (cacheable, signal) => {
+					// Bind the shared spawn to the aggregate `signal` (fires only when ALL current callers
+					// abort), not this-caller's `options.cancellation` — otherwise a superseded caller's
+					// abort would kill the shared command and reject concurrent riders that never cancelled.
+					const result = await this.runCore<T>(
+						{ ...options, caching: undefined, cancellation: signal ?? options.cancellation },
+						runArgs,
+						gitCommand,
+					);
+					// Never cache a result that isn't a genuine command outcome. Under `errors: 'ignore'` a
+					// cancelled/aborted run RESOLVES an empty result, which — left cached — would be served as a
+					// real empty result for the full TTL (e.g. a valid merge-base read back as "none").
+					// Invalidate on anything that isn't a clean exit, or whenever the aggregate signal aborted,
+					// so the entry self-evicts instead of poisoning later callers.
+					//
+					// `status !== 'exited'` is what catches the case a bare `exitCode` check cannot. A swallowed
+					// `GitWarnings` match used to report `exitCode: 0` UNCONDITIONALLY — the old code read it off
+					// a `result` that is only ever assigned on the non-throwing path, so it was always the `?? 0`
+					// fallback — which meant `exitCode !== 0` could never fire and every swallowed failure was
+					// cached. A `warned` result now carries git's real code, so it's the status, not the code,
+					// that has to do the work here. The `exitCode !== 0` half is kept as-is — a non-zero exit is
+					// a real answer and arguably cacheable, but it isn't cached today and this isn't the change
+					// to start.
+					if (result.completion.status !== 'exited' || result.exitCode !== 0 || signal?.aborted) {
 						cacheable.invalidate();
 					}
 					return result;
 				},
-				options.caching.options,
+				// Forward this caller's cancellation so `getOrCreate` races each caller's own wait — an
+				// aborting caller rejects only itself, leaving the shared work (and its riders) intact.
+				{ ...options.caching.options, cancellation: options.cancellation },
 			);
 		}
 
@@ -746,12 +763,42 @@ export class Git {
 		let result;
 		try {
 			result = await promise;
+			// A normal `runSpawn` only resolves on a clean exit — `code !== 0 || signal` rejects — but the
+			// `exitCodeOnly` overload resolves unconditionally, INCLUDING for a signalled run (no code, partial
+			// or absent stdout). Coercing that to `0` would report a killed command as a clean success, so
+			// classify it as the failure it is.
+			if (result.exitCode == null) {
+				// SIGTERM is how BOTH a timeout kill and a caller abort terminate, so it has to group with
+				// cancellations here exactly as it does on the reject path — `failed`/`signal` is for every
+				// OTHER signal. Only `exitCodeOnly` reaches this: a native spawn `timeout` fires
+				// `close(null, 'SIGTERM')` with no `error` event, so it resolves instead of rejecting.
+				// Throwing hands it to the catch below, which owns the timeout-vs-abort heuristic, the ABORTED
+				// log, and the `onAborted` hook — none of which a branch here would fire.
+				if (result.signal === 'SIGTERM') {
+					throw new CancelledRunError(gitCommand, true, undefined, result.signal);
+				}
+
+				return {
+					stdout: result.stdout,
+					stderr: result.stderr,
+					completion: {
+						status: 'failed',
+						reason: result.signal != null ? 'signal' : 'unstarted',
+						error: new Error(
+							`Command terminated without an exit code${result.signal != null ? ` (${result.signal})` : ''}`,
+						),
+					},
+				};
+			}
+
 			return {
 				stdout: result.stdout,
 				stderr: result.stderr,
-				exitCode: result.exitCode ?? 0,
+				exitCode: result.exitCode,
+				completion: { status: 'exited', code: result.exitCode },
 			};
 		} catch (ex) {
+			let cancellationReason: GitRunCancellation = 'unknown';
 			if (ex instanceof CancelledRunError) {
 				const duration = getDurationMilliseconds(start);
 				const timeout = runOpts.timeout ?? 0;
@@ -761,6 +808,9 @@ export class Git {
 						: cancellation?.aborted
 							? 'cancellation'
 							: 'unknown';
+				// Also surfaced on the result, but DIAGNOSTIC ONLY — a timeout kill and a caller abort are both
+				// SIGTERM, so this duration heuristic can be wrong near the boundary. Never gate behavior on it.
+				cancellationReason = reason === 'cancellation' ? 'aborted' : reason;
 				Logger.warn(
 					`${formatLoggableScopeBlock('GIT')} ${gitCommand} \u00b7 ABORTED after ${duration}ms (${reason})`,
 				);
@@ -774,19 +824,44 @@ export class Git {
 
 			if (errorHandling === 'ignore') {
 				if (ex instanceof RunError) {
+					// `code` is `string | number | undefined`: a numeric string is a real exit code, but an errno
+					// (`'ENOENT'`) means the spawn itself failed, and `undefined` means the process never exited
+					// normally. Only the numeric case is an exit; the rest previously became `0` or `NaN`.
+					const code = typeof ex.code === 'number' ? ex.code : ex.code != null ? parseInt(ex.code, 10) : NaN;
+					const exited = Number.isInteger(code);
+
 					return {
 						stdout: ex.stdout,
 						stderr: ex.stderr,
-						exitCode: ex.code != null ? (typeof ex.code === 'number' ? ex.code : parseInt(ex.code, 10)) : 0,
-						cancelled: ex instanceof CancelledRunError,
+						...(exited ? { exitCode: code } : {}),
+						completion:
+							ex instanceof CancelledRunError
+								? { status: 'cancelled', reason: cancellationReason, error: ex }
+								: exited
+									? { status: 'exited', code: code }
+									: {
+											status: 'failed',
+											// A signal means it ran and was killed (partial `stdout` may exist);
+											// no signal and no numeric code means it never got that far.
+											reason: ex.signal != null ? 'signal' : 'unstarted',
+											error: ex,
+										},
 					};
 				}
 
+				// No cancellation branch here: `CancelledRunError extends RunError`, so reaching this at all
+				// proves `ex` is neither.
 				return {
 					stdout: '',
 					stderr: undefined,
-					exitCode: 0,
-					cancelled: ex instanceof CancelledRunError,
+					completion: {
+						status: 'failed',
+						// No `RunError` means no process was ever spawned — a queue rejection or a
+						// failure before `spawn` returned. (Not an untrusted workspace: `run` refuses
+						// those up front, so they never reach this catch.)
+						reason: 'unstarted',
+						error: ex instanceof Error ? ex : new Error(String(ex)),
+					},
 				};
 			}
 
@@ -797,9 +872,31 @@ export class Git {
 			}
 			if (errorHandling === 'throw') throw exception;
 
-			defaultExceptionHandler(exception, options.cwd, start);
+			// Rethrows unless the message matches a `GitWarnings` pattern, in which case it logs and returns the
+			// key that matched. Capture the error first — `exception` is cleared to keep it out of the `finally`
+			// log, but the result still needs to carry it.
+			const swallowed = exception;
+			const warning = defaultExceptionHandler(exception, options.cwd, start);
 			exception = undefined;
-			return { stdout: '', stderr: result?.stderr, exitCode: result?.exitCode ?? 0 };
+			// The command did NOT produce this empty stdout — a warning was swallowed. Say so, or the caller
+			// can't tell a genuinely empty answer (`noCommits`) from a read that never happened
+			// (`notARepository`).
+			//
+			// The process DID exit though (a warning is only ever swallowed for a non-zero exit), so report the
+			// code. `GitError.exitCode` is `number | string | undefined` — same normalization as the
+			// `errors: 'ignore'` path above, since only the numeric case is a real exit.
+			const rawCode = swallowed instanceof GitError ? swallowed.exitCode : undefined;
+			const code = typeof rawCode === 'number' ? rawCode : rawCode != null ? parseInt(rawCode, 10) : NaN;
+
+			// No `stderr`: it belongs to the error here. The top-level field is the channel for runs that
+			// completed WITHOUT one (`exited` carries no error, so a successful command's stderr has nowhere
+			// else to go) — a swallowed warning always has a `GitError`, and it carries the stderr. Reading
+			// `result?.stderr` would be dead anyway: `result` is only assigned on the non-throwing path.
+			return {
+				stdout: '',
+				...(Number.isInteger(code) ? { exitCode: code } : {}),
+				completion: { status: 'warned', warning: warning, error: swallowed },
+			};
 		} finally {
 			this.logGitCommandComplete(gitCommand, exception, getDurationMilliseconds(start), waiting);
 		}
@@ -826,13 +923,7 @@ export class Git {
 
 		// Fixes https://github.com/gitkraken/vscode-gitlens/issues/73 & https://github.com/gitkraken/vscode-gitlens/issues/161
 		// See https://stackoverflow.com/questions/4144417/how-to-handle-asian-characters-in-file-names-in-git-on-os-x
-		runArgs.unshift(
-			'-c',
-			'core.quotepath=false',
-			'-c',
-			'color.ui=false',
-			...(configs !== undefined ? configs : emptyArray),
-		);
+		runArgs.unshift('-c', 'core.quotepath=false', '-c', 'color.ui=false', ...(configs ?? emptyArray));
 
 		if (process.platform === 'win32') {
 			runArgs.unshift('-c', 'core.longpaths=true');
@@ -962,7 +1053,7 @@ export class Git {
 		// Ensure cleanup happens immediately when the generator is explicitly closed (e.g., via break or return)
 		// This is called by JavaScript when the generator is abandoned, ensuring logGitCommand is called
 		// synchronously rather than waiting for garbage collection.
-		// eslint-disable-next-line @typescript-eslint/no-meaningless-void-operator
+		// oxlint-disable-next-line typescript/no-meaningless-void-operator
 		return void cleanup();
 	}
 
@@ -1114,12 +1205,21 @@ export class Git {
 	}
 }
 
-export function defaultExceptionHandler(ex: Error, cwd: string | undefined, start?: [number, number]): void {
+/**
+ * Swallows an error whose message matches a known-benign {@link GitWarnings} pattern, returning WHICH one
+ * matched so the caller can record it — the distinction matters, since `noCommits` is a real answer while
+ * `notARepository` is a failed read. Rethrows anything else.
+ */
+export function defaultExceptionHandler(
+	ex: Error,
+	cwd: string | undefined,
+	start?: [number, number],
+): GitWarningKey | undefined {
 	if (isCancellationError(ex)) throw ex;
 
 	const msg = ex.message || ex.toString();
 	if (msg) {
-		for (const warning of Object.values(GitWarnings)) {
+		for (const [key, warning] of Object.entries(GitWarnings) as [GitWarningKey, RegExp][]) {
 			if (warning.test(msg)) {
 				const duration = start !== undefined ? ` [${getDurationMilliseconds(start)}ms]` : '';
 				Logger.warn(
@@ -1128,7 +1228,7 @@ export function defaultExceptionHandler(ex: Error, cwd: string | undefined, star
 						.replace(/fatal:\s*/g, '')
 						.replace(/\r?\n|\r/g, ' \u00b7 ')}${duration}`,
 				);
-				return;
+				return key;
 			}
 		}
 
@@ -1137,7 +1237,9 @@ export function defaultExceptionHandler(ex: Error, cwd: string | undefined, star
 			const [, ref] = match;
 
 			// Since looking up a ref with ^3 (e.g. looking for untracked files in a stash) can error on some versions of git just ignore it
-			if (ref?.endsWith('^3')) return;
+			// Swallowed, but it matched no `GitWarnings` entry — `undefined` records "unclassified", which
+			// callers must treat as "not a real answer" exactly like any warning they don't whitelist.
+			if (ref?.endsWith('^3')) return undefined;
 		}
 	}