@gitkraken/core-gitlens 0.4.0 → 0.4.101

package/src/git/remotes/gitlab.ts

@@ -34,114 +34,112 @@ export class GitLabRemoteProvider extends RemoteProvider<GitLabRepositoryDescrip
 
 	private _autolinks: (AutolinkReference | DynamicAutolinkReference)[] | undefined;
 	override get autolinks(): (AutolinkReference | DynamicAutolinkReference)[] {
-		if (this._autolinks === undefined) {
-			this._autolinks = [
-				...super.autolinks,
-				{
-					prefix: '#',
-					url: this.issueLinkPattern,
-					alphanumeric: false,
-					ignoreCase: false,
-					title: `Open Issue #<num> on ${this.name}`,
-
-					type: 'issue',
-					description: `${this.name} Issue #<num>`,
-				},
-				{
-					prefix: '!',
-					url: `${this.baseUrl}/-/merge_requests/<num>`,
-					alphanumeric: false,
-					ignoreCase: false,
-					title: `Open Merge Request !<num> on ${this.name}`,
-
-					type: 'pullrequest',
-					description: `${this.name} Merge Request !<num>`,
-				},
-				{
-					descriptors: [
-						{
-							regex: autolinkFullIssuesRegex,
-							url: (repo, num) => `${this.protocol}://${this.domain}/${repo}/-/issues/${num}`,
-							title: (repo, num) => `Open Issue #${num} from ${repo} on ${this.name}`,
-							label: (repo, num) => `GitLab Issue ${repo}#${num}`,
-						},
-					],
-					parse: (text: string, autolinks: Map<string, Autolink>) => {
-						let ownerAndRepo: string;
-						let num: string;
-
-						let match;
-						do {
-							match = autolinkFullIssuesRegex.exec(text);
-							if (match == null) break;
-
-							[, ownerAndRepo, num] = match;
-
-							const [owner, repo] = ownerAndRepo.split('/', 2);
-							autolinks.set(num, {
-								provider: this,
-								id: num,
-								prefix: `${ownerAndRepo}#`,
-								url: `${this.protocol}://${this.domain}/${ownerAndRepo}/-/issues/${num}`,
-								alphanumeric: false,
-								ignoreCase: true,
-								title: `Open Issue #<num> from ${ownerAndRepo} on ${this.name}`,
-
-								type: 'issue',
-								description: `${this.name} Issue ${ownerAndRepo}#${num}`,
-								descriptor: {
-									key: this.remoteKey,
-									owner: owner,
-									name: repo,
-								} satisfies GitLabRepositoryDescriptor,
-							});
-						} while (true);
+		this._autolinks ??= [
+			...super.autolinks,
+			{
+				prefix: '#',
+				url: this.issueLinkPattern,
+				alphanumeric: false,
+				ignoreCase: false,
+				title: `Open Issue #<num> on ${this.name}`,
+
+				type: 'issue',
+				description: `${this.name} Issue #<num>`,
+			},
+			{
+				prefix: '!',
+				url: `${this.baseUrl}/-/merge_requests/<num>`,
+				alphanumeric: false,
+				ignoreCase: false,
+				title: `Open Merge Request !<num> on ${this.name}`,
+
+				type: 'pullrequest',
+				description: `${this.name} Merge Request !<num>`,
+			},
+			{
+				descriptors: [
+					{
+						regex: autolinkFullIssuesRegex,
+						url: (repo, num) => `${this.protocol}://${this.domain}/${repo}/-/issues/${num}`,
+						title: (repo, num) => `Open Issue #${num} from ${repo} on ${this.name}`,
+						label: (repo, num) => `GitLab Issue ${repo}#${num}`,
 					},
+				],
+				parse: (text: string, autolinks: Map<string, Autolink>) => {
+					let ownerAndRepo: string;
+					let num: string;
+
+					let match;
+					do {
+						match = autolinkFullIssuesRegex.exec(text);
+						if (match == null) break;
+
+						[, ownerAndRepo, num] = match;
+
+						const [owner, repo] = ownerAndRepo.split('/', 2);
+						autolinks.set(num, {
+							provider: this,
+							id: num,
+							prefix: `${ownerAndRepo}#`,
+							url: `${this.protocol}://${this.domain}/${ownerAndRepo}/-/issues/${num}`,
+							alphanumeric: false,
+							ignoreCase: true,
+							title: `Open Issue #<num> from ${ownerAndRepo} on ${this.name}`,
+
+							type: 'issue',
+							description: `${this.name} Issue ${ownerAndRepo}#${num}`,
+							descriptor: {
+								key: this.remoteKey,
+								owner: owner,
+								name: repo,
+							} satisfies GitLabRepositoryDescriptor,
+						});
+					} while (true);
 				},
-				{
-					descriptors: [
-						{
-							regex: autolinkFullMergeRequestsRegex,
-							url: (repo, num) => `${this.protocol}://${this.domain}/${repo}/-/merge_requests/${num}`,
-							title: (repo, num) => `Open Merge Request !${num} from ${repo} on ${this.name}`,
-							label: (repo, num) => `${this.name} Merge Request ${repo}!${num}`,
-						},
-					],
-					parse: (text: string, autolinks: Map<string, Autolink>) => {
-						let ownerAndRepo: string;
-						let num: string;
-
-						let match;
-						do {
-							match = autolinkFullMergeRequestsRegex.exec(text);
-							if (match == null) break;
-
-							[, ownerAndRepo, num] = match;
-
-							const [owner, repo] = ownerAndRepo.split('/', 2);
-							autolinks.set(num, {
-								provider: this,
-								id: num,
-								prefix: `${ownerAndRepo}!`,
-								url: `${this.protocol}://${this.domain}/${ownerAndRepo}/-/merge_requests/${num}`,
-								alphanumeric: false,
-								ignoreCase: true,
-								title: `Open Merge Request !<num> from ${ownerAndRepo} on ${this.name}`,
-
-								type: 'pullrequest',
-								description: `${this.name} Merge Request !${num} from ${ownerAndRepo}`,
-
-								descriptor: {
-									key: this.remoteKey,
-									owner: owner,
-									name: repo,
-								} satisfies GitLabRepositoryDescriptor,
-							});
-						} while (true);
+			},
+			{
+				descriptors: [
+					{
+						regex: autolinkFullMergeRequestsRegex,
+						url: (repo, num) => `${this.protocol}://${this.domain}/${repo}/-/merge_requests/${num}`,
+						title: (repo, num) => `Open Merge Request !${num} from ${repo} on ${this.name}`,
+						label: (repo, num) => `${this.name} Merge Request ${repo}!${num}`,
 					},
+				],
+				parse: (text: string, autolinks: Map<string, Autolink>) => {
+					let ownerAndRepo: string;
+					let num: string;
+
+					let match;
+					do {
+						match = autolinkFullMergeRequestsRegex.exec(text);
+						if (match == null) break;
+
+						[, ownerAndRepo, num] = match;
+
+						const [owner, repo] = ownerAndRepo.split('/', 2);
+						autolinks.set(num, {
+							provider: this,
+							id: num,
+							prefix: `${ownerAndRepo}!`,
+							url: `${this.protocol}://${this.domain}/${ownerAndRepo}/-/merge_requests/${num}`,
+							alphanumeric: false,
+							ignoreCase: true,
+							title: `Open Merge Request !<num> from ${ownerAndRepo} on ${this.name}`,
+
+							type: 'pullrequest',
+							description: `${this.name} Merge Request !${num} from ${ownerAndRepo}`,
+
+							descriptor: {
+								key: this.remoteKey,
+								owner: owner,
+								name: repo,
+							} satisfies GitLabRepositoryDescriptor,
+						});
+					} while (true);
 				},
-			];
-		}
+			},
+		];
 		return this._autolinks;
 	}
 

package/src/git/run.types.ts

@@ -1,13 +1,61 @@
 import type { CacheController } from '../utils/promiseCache.js';
+import type { GitWarningKey } from './errors.js';
 
 export type GitErrorHandling = 'throw' | 'ignore';
 
+/**
+ * Why a run was aborted. DIAGNOSTIC ONLY — log it, never branch control flow on it. A timeout kill and a
+ * caller abort both terminate the process with SIGTERM and surface as the same error, so this is derived
+ * from a duration heuristic and can be wrong near the timeout boundary.
+ */
+export type GitRunCancellation = 'aborted' | 'timeout' | 'unknown';
+
+/**
+ * Why a run produced no answer. Every value is structurally distinguishable, so these are safe to branch on.
+ *
+ * There is deliberately no `untrusted` member: an untrusted workspace is refused before the command is ever
+ * attempted, so it REJECTS with `WorkspaceUntrustedError` rather than resolving a result.
+ */
+export type GitRunFailure =
+	/** Terminated by a signal other than SIGTERM. Any `stdout` is partial. */
+	| 'signal'
+	/** No process ever ran — queue rejection, spawn failure (e.g. ENOENT). */
+	| 'unstarted';
+
+/**
+ * How a run ended — the answer to "can I trust `stdout`?", which `exitCode` alone cannot give.
+ *
+ * A non-zero exit is NOT a failure: `diff --quiet` exits 1 for "differences found", `merge-base
+ * --is-ancestor` for "no". Those are answers, and they're `exited`. What callers must not do is read the
+ * empty `stdout` of a `warned`/`cancelled`/`failed` run as a real result — which is what a bare
+ * `exitCode === 0` check does, since several failure paths report zero.
+ */
+export type GitRunCompletion =
+	/** Ran to completion. Interpreting `code` is the caller's business; `stdout` is trustworthy. */
+	| { readonly status: 'exited'; readonly code: number }
+	/**
+	 * Exited non-zero, but stderr matched a known-benign pattern, so the error was swallowed and `stdout`
+	 * is empty. Whether that empty is a real ANSWER (`noCommits` on a fresh repo) or a failure
+	 * (`notARepository`) depends on `warning` — it is never safe to read as a plain empty result.
+	 *
+	 * `warning` is `undefined` for a swallow that matched no table entry; treat that like any warning you
+	 * haven't explicitly whitelisted, i.e. not an answer. The process did exit, so `exitCode` is present
+	 * whenever git reported a numeric one.
+	 */
+	| { readonly status: 'warned'; readonly warning: GitWarningKey | undefined; readonly error: Error }
+	| { readonly status: 'cancelled'; readonly reason: GitRunCancellation; readonly error: Error }
+	| { readonly status: 'failed'; readonly reason: GitRunFailure; readonly error: Error };
+
 export type GitResult<T extends string | Buffer | unknown = string> = {
-	readonly exitCode: number;
+	/**
+	 * The process's exit code. ABSENT when no process exited — see {@link completion}. Deliberately optional:
+	 * defaulting to `0` made a failed run indistinguishable from a clean success.
+	 */
+	readonly exitCode?: number;
 	readonly stdout: T;
 	readonly stderr?: T;
 
-	readonly cancelled?: boolean;
+	readonly completion: GitRunCompletion;
 };
 
 /**
@@ -18,8 +66,10 @@ export interface GitResultCache {
 	getOrCreate(
 		repoPath: string,
 		key: string,
-		factory: (cacheable: CacheController) => Promise<GitResult<unknown>>,
-		options?: { createTTL?: number; accessTTL?: number },
+		// `signal` is the aggregate cancellation — it fires only when every current caller has aborted.
+		// Bind shared work to it (not any single caller's signal) so one caller's abort can't reject riders.
+		factory: (cacheable: CacheController, signal?: AbortSignal) => Promise<GitResult<unknown>>,
+		options?: { createTTL?: number; accessTTL?: number; cancellation?: AbortSignal },
 	): Promise<GitResult<unknown>>;
 }
 

package/src/git/utils/branch.utils.ts

@@ -3,7 +3,18 @@ import type { GitBranch, GitTrackingUpstream } from '../models/branch.js';
 import type { GitBranchReference, GitReference } from '../models/reference.js';
 import { shortenRevision } from './revision.utils.js';
 
-const detachedHEADRegex = /^(HEAD|\(.*\))$/;
+/**
+ * The names git uses where a branch name would go when HEAD isn't on a branch — `(HEAD detached
+ * at|from <rev>)`, `(no branch)`, `(no branch, rebasing <name>)`, `(no branch, bisect started on
+ * <name>)`, and `git status --porcelain=v2`'s `branch.head` token `(detached)` — plus bare `HEAD`
+ * and our own {@link formatDetachedHeadName} output (`(<rev>...)`).
+ *
+ * Deliberately NOT "anything parenthesized": parentheses are legal in ref names, so `(release)`,
+ * `v1.0(rc)` and `feat/(wip)` are all real branches a user can be on. Matching those made
+ * `GitBranch` rewrite a genuine branch's `name` to the synthesized `(sha…)` label and re-key its
+ * `id` by SHA, which corrupts its identity for every downstream consumer.
+ */
+const detachedHEADRegex = /^(?:HEAD|\(detached\)|\(HEAD detached (?:at|from) .+\)|\(no branch.*\)|\(.+\.\.\.\))$/;
 
 export function formatDetachedHeadName(sha: string): string {
 	return `(${shortenRevision(sha)}...)`;

package/src/git/utils/contributor.utils.ts

@@ -27,10 +27,10 @@ export function calculateContributionScore(
 	stats: GitCommitStats | undefined,
 	timestamp: number,
 	options: ContributorScoreOptions = defaultContributorScoreOptions,
+	now: number = Date.now(),
 ): number {
 	if (stats == null) return 0;
 
-	const now = Date.now();
 	const ageInDays = (now - timestamp) / (24 * 3600 * 1000);
 
 	// Time decay factor (exponential decay)

package/src/git/utils/fileStatus.utils.ts

@@ -53,3 +53,10 @@ const conflictStatuses = new Set<string>(['U', 'AA', 'AU', 'UA', 'DD', 'DU', 'UD
 export function isConflictStatus(status: string | undefined): status is 'U' | GitFileConflictStatus {
 	return status != null && conflictStatuses.has(status);
 }
+
+/** Repo-relative pathspec entries for a file. Renames/copies need BOTH sides: git applies pathspec limiting
+ *  before rename detection, so `git diff -- <new>` drops the old path's deletion and the patch reads as a
+ *  bare add (applying it duplicates the file instead of renaming it). */
+export function getFileDiffPathspecs(file: { path: string; originalPath?: string }): string[] {
+	return file.originalPath ? [file.path, file.originalPath] : [file.path];
+}

package/src/git/utils/graph.utils.ts

@@ -0,0 +1,46 @@
+import type { GitGraphRow } from '../models/graph.js';
+
+/**
+ * Cursor-anchored concatenation of an accumulated rows window with a freshly-paged set — the SAME
+ * cursor-anchored append the graph webview's reducer performs: keep prior rows up to and including the
+ * cursor sha (trimming anything below it), then append the page; a cursor missing from the prior rows
+ * appends after all of them (the reducer's fallthrough).
+ *
+ * Owns the canonical cursor-trim rule for the provider-side accumulated window (`GitGraphSession.window`)
+ * and the host's rows mirror. Its ledger analogue (`appendRowsLedger` in the graph webview's
+ * `graphRowsSplice.ts`) MUST stay in lockstep with this so the row mirror and its fingerprint ledger
+ * can't drift.
+ */
+export function appendRowsAtCursor(
+	prior: readonly GitGraphRow[],
+	startingCursor: string,
+	page: readonly GitGraphRow[],
+): GitGraphRow[] {
+	const cursorIndex = prior.findIndex(r => r.sha === startingCursor);
+	const keep = cursorIndex >= 0 ? cursorIndex + 1 : prior.length;
+	// Single-pass copy: preallocate the exact length, copy the kept prefix, then append the page — avoids
+	// the intermediate array a `slice` + double-spread allocates.
+	const result = new Array<GitGraphRow>(keep + page.length);
+	for (let i = 0; i < keep; i++) {
+		result[i] = prior[i];
+	}
+	for (let i = 0; i < page.length; i++) {
+		result[keep + i] = page[i];
+	}
+	return result;
+}
+
+/**
+ * Write-once cross-generation avatar merge: carry a prior graph generation's resolved avatar URLs forward into
+ * a fresh generation's map WITHOUT overwriting its own entries. Resolved URLs are cheap to keep across a
+ * rebuild/page and the fresh map's entries always win, so a stale carry-forward can never clobber current data.
+ */
+export function mergeAvatarsForward(prior: ReadonlyMap<string, string>, incoming: Map<string, string>): void {
+	if (prior.size === 0) return;
+
+	for (const [email, url] of prior) {
+		if (!incoming.has(email)) {
+			incoming.set(email, url);
+		}
+	}
+}

package/src/git/utils/issue.utils.ts

@@ -30,6 +30,7 @@ export function serializeIssue(value: IssueShape): IssueShape {
 		},
 		id: value.id,
 		nodeId: value.nodeId,
+		issueType: value.issueType,
 		title: value.title,
 		url: value.url,
 		createdDate: value.createdDate,

package/src/git/utils/pullRequest.utils.ts

@@ -92,7 +92,9 @@ export function serializePullRequest(value: PullRequest): PullRequestShape {
 		},
 		id: value.id,
 		nodeId: value.nodeId,
+		number: value.number,
 		title: value.title,
+		body: value.body,
 		url: value.url,
 		createdDate: value.createdDate,
 		updatedDate: value.updatedDate,
@@ -116,6 +118,9 @@ export function serializePullRequest(value: PullRequest): PullRequestShape {
 						sha: value.refs.head.sha,
 						branch: value.refs.head.branch,
 						url: value.refs.head.url,
+						cloneHttps: value.refs.head.cloneHttps,
+						cloneSsh: value.refs.head.cloneSsh,
+						isFork: value.refs.head.isFork,
 					},
 					base: {
 						exists: value.refs.base.exists,
@@ -124,6 +129,9 @@ export function serializePullRequest(value: PullRequest): PullRequestShape {
 						sha: value.refs.base.sha,
 						branch: value.refs.base.branch,
 						url: value.refs.base.url,
+						cloneHttps: value.refs.base.cloneHttps,
+						cloneSsh: value.refs.base.cloneSsh,
+						isFork: value.refs.base.isFork,
 					},
 					isCrossRepository: value.refs.isCrossRepository,
 				}
@@ -136,6 +144,7 @@ export function serializePullRequest(value: PullRequest): PullRequestShape {
 		reviewDecision: value.reviewDecision,
 		reviewRequests: value.reviewRequests,
 		assignees: value.assignees,
+		authoredByMe: value.authoredByMe,
 		project: value.project
 			? {
 					id: value.project.id,

package/src/git/utils/reachability.utils.ts

@@ -1,17 +1,62 @@
 import { base64, fromBase64 } from '../../utils/base64.js';
-import type { GraphReachabilityTable } from '../models/graph.js';
+import type { GraphContext, GraphReachabilityTable } from '../models/graph.js';
+import { GitGraphRowContextFlags } from '../models/graph.js';
 import type { GitCommitReachability } from '../providers/commits.js';
 
 type ReachableRef = GitCommitReachability['refs'][number];
 
+/**
+ * Computes the compact {@link GitGraphRowContextFlags} bitfield for a commit row from its reachable-ref
+ * set and the walk's HEAD-derived sets. Single-sourced so the host row processor
+ * (`GlGraphRowProcessor`), the R6b incremental fast path, and the equivalence harness all compute
+ * byte-identical flags (no manual mirrors that can drift). Stash rows carry no flags — callers skip this
+ * for `stash-node` rows. See {@link GitGraphRowContextFlags} for the per-bit semantics.
+ */
+export function computeGraphRowContextFlags(
+	sha: string,
+	reachableRefs: Iterable<ReachableRef> | undefined,
+	ctx: Pick<
+		GraphContext,
+		'reachableFromHEAD' | 'rewriteableFromHEAD' | 'tipShasWithChildren' | 'reachableFromHeadUpstream'
+	>,
+): GitGraphRowContextFlags {
+	// Allocation-free "exactly one local branch reachable" check → `+unique`.
+	let localBranches = 0;
+	if (reachableRefs != null) {
+		for (const r of reachableRefs) {
+			if (r.refType === 'branch' && !r.remote && ++localBranches > 1) break;
+		}
+	}
+	// Unpublished (ahead) = reachable from HEAD but not from HEAD's upstream tip. Unpulled (behind) is its
+	// exact mirror over the same two sets: on the upstream tip but not on HEAD, i.e. `HEAD..@{u}`. Both are
+	// derived from `reachableFromHeadUpstream`, which is undefined when HEAD has no upstream — so neither
+	// is ever flagged in that case, and the two can never both be set for one sha.
+	const upstream = ctx.reachableFromHeadUpstream;
+	const reachableFromHead = ctx.reachableFromHEAD.has(sha);
+	const onUpstream = upstream?.has(sha) ?? false;
+	const isUnpublished = upstream != null && reachableFromHead && !onUpstream;
+	const isUnpulled = onUpstream && !reachableFromHead;
+	return (
+		(reachableFromHead ? GitGraphRowContextFlags.ReachableFromHead : 0) |
+		(ctx.rewriteableFromHEAD.has(sha) ? GitGraphRowContextFlags.RewriteableFromHead : 0) |
+		(localBranches === 1 ? GitGraphRowContextFlags.UniqueToBranch : 0) |
+		(ctx.tipShasWithChildren.has(sha) ? GitGraphRowContextFlags.HasChildren : 0) |
+		(isUnpublished ? GitGraphRowContextFlags.Unpublished : 0) |
+		(isUnpulled ? GitGraphRowContextFlags.Unpulled : 0)
+	);
+}
+
 /**
  * Canonical dictionary key for a reachable ref. The `r`/`l` discriminator keeps a remote branch from
  * colliding with a local branch of the same name; the `refType` prefix separates tags from branches.
+ * `current` is part of the key so a builder SEEDED from a prior generation's table can't hand back a
+ * stale dictionary entry after the checked-out branch changes — the updated ref interns as a new
+ * entry instead (within a single walk `current` can't change, so the wider key is behavior-neutral).
  * Single-sourced here so the encoder ({@link createReachabilityTableBuilder}) and any future consumer
  * can't drift on the convention.
  */
 export function reachableRefKey(ref: ReachableRef): string {
-	return `${ref.refType}:${ref.refType === 'branch' && ref.remote ? 'r' : 'l'}:${ref.name}`;
+	return `${ref.refType}:${ref.refType === 'branch' && ref.remote ? 'r' : 'l'}:${ref.current ? 'c' : 'n'}:${ref.name}`;
 }
 
 // Monotonic generation counter — each builder (i.e. each fresh graph walk) gets a distinct id, while a
@@ -28,16 +73,29 @@ let nextReachabilityTableId = 0;
  *
  * Append-only by construction: an index, once assigned, is never reused — so a builder kept alive
  * across paginated loads accumulates a table whose existing indices stay valid as it grows.
+ *
+ * Pass a prior generation's table as `seed` to CONTINUE it: identical ref sets re-intern to their
+ * seeded indices and the table keeps the seed's `id`, so rows retained across a rebuild keep valid
+ * `reachabilityIndex` values and the host's same-id delta shipping applies (only appended entries go
+ * over the wire). Entries the new walk never re-interns stay in the table unreferenced — harmless,
+ * and bounded by per-session ref churn.
  */
-export function createReachabilityTableBuilder(): {
+export function createReachabilityTableBuilder(seed?: GraphReachabilityTable): {
 	intern: (refs: Iterable<ReachableRef> | undefined) => number | undefined;
 	build: () => GraphReachabilityTable | undefined;
 } {
-	const id = ++nextReachabilityTableId;
-	const dictionary: GitCommitReachability['refs'] = [];
-	const refKeyToIndex = new Map<string, number>();
-	const sets: string[] = [];
-	const setKeyToIndex = new Map<string, number>();
+	const id = seed?.id ?? ++nextReachabilityTableId;
+	const dictionary: GitCommitReachability['refs'] = seed != null ? [...seed.dictionary] : [];
+	const refKeyToIndex = new Map<string, number>(dictionary.map((ref, i) => [reachableRefKey(ref), i]));
+	const sets: string[] = seed != null ? [...seed.sets] : [];
+	const setKeyToIndex = new Map<string, number>(sets.map((encoded, i) => [encoded, i]));
+
+	// Reachability is monotone, so a graph walk interns long runs of IDENTICAL sets (thousands of
+	// consecutive trunk rows share one set). Remembering the previous call's indices skips the
+	// bitmap-pack + base64 for those runs; a same-membership-different-order call just falls through
+	// to the (still correct) slow path.
+	let lastIndices: number[] | undefined;
+	let lastSetIndex: number | undefined;
 
 	return {
 		/** Interns a ref set, returning its index into `sets`, or undefined when the set is empty. */
@@ -61,6 +119,17 @@ export function createReachabilityTableBuilder(): {
 			}
 			if (indices.length === 0) return undefined;
 
+			if (lastIndices != null && indices.length === lastIndices.length) {
+				let same = true;
+				for (let i = 0; i < indices.length; i++) {
+					if (indices[i] !== lastIndices[i]) {
+						same = false;
+						break;
+					}
+				}
+				if (same) return lastSetIndex;
+			}
+
 			// Pack into a bitset sized to this set's high-water dictionary index, then intern by base64.
 			const bytes = new Uint8Array((maxIndex >> 3) + 1);
 			for (const index of indices) {
@@ -73,6 +142,8 @@ export function createReachabilityTableBuilder(): {
 				setKeyToIndex.set(encoded, setIndex);
 				sets.push(encoded);
 			}
+			lastIndices = indices;
+			lastSetIndex = setIndex;
 			return setIndex;
 		},
 

package/src/git/utils/sshKey.utils.ts

@@ -0,0 +1,30 @@
+// Strict allowlist of OpenSSH public-key types valid in an `allowed_signers`/`.pub` entry, including security-key
+// (`sk-`) and certificate (`-cert-v01@openssh.com`) variants. Used to reject attacker-controllable key types embedded
+// in commit SSH signatures (or returned by a provider) before they're written to a trust-sensitive file.
+const sshKeyTypeRegex =
+	/^(?:sk-)?(?:ssh-ed25519|ssh-rsa|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))(?:-cert-v01)?(?:@openssh\.com)?$/;
+
+// A base64 blob with no embedded whitespace/newlines (length must be a multiple of 4, standard base64 alphabet).
+const base64Regex = /^[A-Za-z0-9+/]+={0,2}$/;
+
+// A principal safe to write as the first token of an `allowed_signers` line. Beyond whitespace/control characters
+// (which would inject extra tokens or whole lines), it also rejects the principal-list meta-characters `,` (separator),
+// `*`/`?` (wildcards), `!` (negation), and `"`/`\` (quoting) — any of which could broaden a single identity into a
+// list or pattern that matches signers it shouldn't.
+// eslint-disable-next-line no-control-regex
+const principalRegex = /^[^\s\x00-\x1f\x7f,*?!"\\]+$/;
+
+/** Whether `keyType` is a recognized OpenSSH public-key type (strict allowlist, not a prefix match). */
+export function isValidSshKeyType(keyType: string): boolean {
+	return sshKeyTypeRegex.test(keyType);
+}
+
+/** Whether `keyData` is a well-formed base64 public-key blob with no embedded whitespace or newlines. */
+export function isValidSshKeyData(keyData: string): boolean {
+	return keyData.length % 4 === 0 && base64Regex.test(keyData);
+}
+
+/** Whether `principal` is safe to write as an `allowed_signers` principal (non-empty, no whitespace/control chars). */
+export function isValidAllowedSignerPrincipal(principal: string): boolean {
+	return principalRegex.test(principal);
+}

package/src/git/watching/watchService.ts

@@ -69,6 +69,13 @@ export class RepositoryWatchService implements UnifiedDisposable {
 		return this._onDidChangeRepository.event;
 	}
 
+	private readonly _onDidChangeWorkingTree = new Emitter<string>();
+	/** Global multiplexed working-tree change event (repo path) for ALL watched repos. Fires once per
+	 *  debounced flush per session — the single point that drives the cache's status clock for working-tree edits. */
+	get onDidChangeWorkingTree(): Event<string> {
+		return this._onDidChangeWorkingTree.event;
+	}
+
 	private readonly defaultRepoDelayMs?: number;
 	private readonly defaultWorkingTreeDelayMs?: number;
 	private readonly getIgnoreFilter?: (repoPath: string, gitDirPath: string) => GitIgnoreFilter | undefined;
@@ -113,6 +120,7 @@ export class RepositoryWatchService implements UnifiedDisposable {
 		this.wtWatchers.clear();
 
 		this._onDidChangeRepository.dispose();
+		this._onDidChangeWorkingTree.dispose();
 	}
 
 	/**
@@ -164,6 +172,9 @@ export class RepositoryWatchService implements UnifiedDisposable {
 				onDidFireRepoChange: (event): void => {
 					this._onDidChangeRepository.fire(event);
 				},
+				onDidFireWorkingTreeChange: (repoPath): void => {
+					this._onDidChangeWorkingTree.fire(repoPath);
+				},
 			});
 
 			const watchHooksSet = new Set<WatchHooks>();
@@ -331,7 +342,11 @@ export class RepositoryWatchService implements UnifiedDisposable {
 				for (const h of watchHooks) {
 					h.onGitIgnoreChanged?.(repoPath);
 				}
-				// Don't push .gitignore itself as a working tree change
+				// Route the ignore-rule change through the repo channel as an `ignores` change (like `info/exclude`),
+				// so it reaches EVERY session subscriber — including a closed secondary worktree's `watch()` `repoSub`,
+				// which has no `onGitIgnoreChanged` hook and would otherwise keep a stale untracked-file list. Coalesces
+				// with any hook-fired `ignores` above, so open repos don't double. (.gitignore itself is not a WT change.)
+				session.pushRepoChanges(['ignores']);
 				return;
 			}