@gitkraken/core-gitlens 0.4.0 → 0.4.101

package/src/git/watching/watchSession.ts

@@ -45,6 +45,12 @@ export interface WatchSessionOptions {
 	 * global event forwarding without affecting lifecycle callbacks.
 	 */
 	readonly onDidFireRepoChange?: (event: WatcherRepoChangeEvent) => void;
+	/**
+	 * Called whenever a debounced working-tree change is dispatched to subscribers. Like
+	 * {@link onDidFireRepoChange}, does NOT count as a subscriber — used by WatchService for global
+	 * event forwarding (the single point that drives the cache's status clock for working-tree edits).
+	 */
+	readonly onDidFireWorkingTreeChange?: (repoPath: string) => void;
 }
 
 const defaultRepoDelay = 250;
@@ -82,6 +88,7 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 
 	private readonly lifecycle?: WatchSessionLifecycle;
 	private readonly onDidFireRepoChangeCallback?: (event: WatcherRepoChangeEvent) => void;
+	private readonly onDidFireWorkingTreeChangeCallback?: (repoPath: string) => void;
 
 	constructor(options: WatchSessionOptions) {
 		this.repoPath = options.repoPath;
@@ -91,6 +98,7 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 		this.effectiveWorkingTreeMs = this.defaultWorkingTreeMs;
 		this.lifecycle = options.lifecycle;
 		this.onDidFireRepoChangeCallback = options.onDidFireRepoChange;
+		this.onDidFireWorkingTreeChangeCallback = options.onDidFireWorkingTreeChange;
 		this._suspended = options.suspended ?? false;
 	}
 
@@ -274,7 +282,12 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 	fireChangeImmediate(...changes: RepositoryChange[]): void {
 		if (this._disposed || changes.length === 0) return;
 
-		this.repoEmitter.fire(new WatcherRepoChangeEvent(this.repoPath, changes));
+		const event = new WatcherRepoChangeEvent(this.repoPath, changes);
+		// Same contract as `flushRepo`: notify the global forwarder (which advances the cache's status clock) BEFORE
+		// subscribers. Skipping it here would route changes to subscribers that no one advanced the clock for —
+		// subscribers see them as session-routed and (correctly) don't re-advance, so the cache would go stale.
+		this.onDidFireRepoChangeCallback?.(event);
+		this.repoEmitter.fire(event);
 	}
 
 	/** Push interpreted repo changes into the pipeline */
@@ -321,8 +334,10 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 		if (event == null) return;
 
 		this.pendingRepoEvent = undefined;
-		this.repoEmitter.fire(event);
+		// Advance any cache clock BEFORE notifying subscribers (same rationale as `flushWorkingTree`): a subscriber
+		// that synchronously reads status must see the post-change generation, not a joinable pre-change run.
 		this.onDidFireRepoChangeCallback?.(event);
+		this.repoEmitter.fire(event);
 	}
 
 	private scheduleRepoFlush(delayOverride?: number): void {
@@ -351,6 +366,9 @@ export class RepositoryWatchSession implements UnifiedDisposable {
 
 		const paths = this.pendingWorkingTreePaths;
 		this.pendingWorkingTreePaths = new Set();
+		// Advance the cache's status clock (via WatchService's global forwarding) BEFORE notifying subscribers,
+		// so a subscriber that synchronously reads status sees the post-change generation, not a joinable pre-change run.
+		this.onDidFireWorkingTreeChangeCallback?.(this.repoPath);
 		this.workingTreeEmitter.fire({ repoPath: this.repoPath, paths: paths });
 	}
 

package/src/git-cli/exec/git.ts

@@ -8,6 +8,7 @@ import type {
 	CommitErrorReason,
 	FetchErrorReason,
 	GitCommandError,
+	GitWarningKey,
 	MergeErrorReason,
 	PausedOperationAbortErrorReason,
 	PausedOperationContinueErrorReason,
@@ -24,8 +25,9 @@ import type {
 	WorktreeCreateErrorReason,
 	WorktreeDeleteErrorReason,
 } from '../../git/errors.js';
-import { WorkspaceUntrustedError } from '../../git/errors.js';
+import { GitWarnings, WorkspaceUntrustedError } from '../../git/errors.js';
 import type { SigningFormat } from '../../git/models/signature.js';
+import type { GitRunCancellation } from '../../git/run.types.js';
 import { CancellationError, getAbortSignalId, isCancellationError } from '../../utils/cancellation.js';
 import { getScopedCounter } from '../../utils/counter.js';
 import { getDurationMilliseconds, hrtime } from '../../utils/hrtime.js';
@@ -126,26 +128,16 @@ export const GitErrors = {
 	unsafeRepository:
 		/(?:^fatal:\s*detected dubious ownership in repository at '([^']+)'|unsafe repository \('([^']+)' is owned by someone else\))[\s\S]*(git config --global --add safe\.directory [^\n•]+)/m,
 	unstagedChanges: /You have unstaged changes/i,
+	// Matches both variants: with a lock reason (`..., lock reason: <reason>`) and without (`...;`)
+	worktreeLocked: /fatal:\s*cannot remove a locked working tree/i,
+	// Only matches the variant where Git reports a lock reason; the reason is free text, so capture the whole line
+	worktreeLockedReason: /cannot remove a locked working tree,[ \t]*lock reason:[ \t]*(.*)/i,
 } as const;
 
-export const GitWarnings = {
-	notARepository: /Not a git repository/i,
-	outsideRepository: /is outside repository/i,
-	noPath: /no such path/i,
-	noCommits: /does not have any commits/i,
-	notFound: /Path '.*?' does not exist in/i,
-	foundButNotInRevision: /Path '.*?' exists on disk, but not in/i,
-	headNotABranch: /HEAD does not point to a branch/i,
-	noUpstream: /no upstream configured for branch '(.*?)'/i,
-	unknownRevision:
-		/ambiguous argument '.*?': unknown revision or path not in the working tree|not stored as a remote-tracking branch/i,
-	mustRunInWorkTree: /this operation must be run in a work tree/i,
-	patchWithConflicts: /Applied patch to '.*?' with conflicts/i,
-	noRemoteRepositorySpecified: /No remote repository specified\./i,
-	remoteConnectionError: /Could not read from remote repository/i,
-	notAGitCommand: /'.+' is not a git command/i,
-	tipBehind: /tip of your current branch is behind/i,
-} as const;
+// `GitWarnings` moved to `@gitlens/git/errors.js` so the shared run contract can name its keys; re-exported
+// here because it's long-established as part of this module's surface.
+export { GitWarnings };
+export type { GitWarningKey } from '../../git/errors.js';
 
 export class GitError extends Error {
 	readonly cmd: string | undefined;
@@ -393,6 +385,8 @@ const errorToReasonMap = new Map<GitCommand, [RegExp, GitCommandToReasonMap[GitC
 	[
 		'worktree-delete',
 		[
+			// Must come first -- a locked worktree's lock reason is free text that can otherwise match the errors below
+			[GitErrors.worktreeLocked, 'locked'],
 			[GitErrors.mainWorkingTree, 'defaultWorkingTree'],
 			[GitErrors.uncommittedChanges, 'uncommittedChanges'],
 			[GitErrors.failedToDeleteDirectoryNotEmpty, 'directoryNotEmpty'],
@@ -653,14 +647,37 @@ export class Git {
 			return options.caching.cache.getOrCreate(
 				options.caching.commonPath ?? options.cwd!,
 				gitCommand,
-				async cacheable => {
-					const result = await this.runCore<T>({ ...options, caching: undefined }, runArgs, gitCommand);
-					if (result.exitCode !== 0) {
+				async (cacheable, signal) => {
+					// Bind the shared spawn to the aggregate `signal` (fires only when ALL current callers
+					// abort), not this-caller's `options.cancellation` — otherwise a superseded caller's
+					// abort would kill the shared command and reject concurrent riders that never cancelled.
+					const result = await this.runCore<T>(
+						{ ...options, caching: undefined, cancellation: signal ?? options.cancellation },
+						runArgs,
+						gitCommand,
+					);
+					// Never cache a result that isn't a genuine command outcome. Under `errors: 'ignore'` a
+					// cancelled/aborted run RESOLVES an empty result, which — left cached — would be served as a
+					// real empty result for the full TTL (e.g. a valid merge-base read back as "none").
+					// Invalidate on anything that isn't a clean exit, or whenever the aggregate signal aborted,
+					// so the entry self-evicts instead of poisoning later callers.
+					//
+					// `status !== 'exited'` is what catches the case a bare `exitCode` check cannot. A swallowed
+					// `GitWarnings` match used to report `exitCode: 0` UNCONDITIONALLY — the old code read it off
+					// a `result` that is only ever assigned on the non-throwing path, so it was always the `?? 0`
+					// fallback — which meant `exitCode !== 0` could never fire and every swallowed failure was
+					// cached. A `warned` result now carries git's real code, so it's the status, not the code,
+					// that has to do the work here. The `exitCode !== 0` half is kept as-is — a non-zero exit is
+					// a real answer and arguably cacheable, but it isn't cached today and this isn't the change
+					// to start.
+					if (result.completion.status !== 'exited' || result.exitCode !== 0 || signal?.aborted) {
 						cacheable.invalidate();
 					}
 					return result;
 				},
-				options.caching.options,
+				// Forward this caller's cancellation so `getOrCreate` races each caller's own wait — an
+				// aborting caller rejects only itself, leaving the shared work (and its riders) intact.
+				{ ...options.caching.options, cancellation: options.cancellation },
 			);
 		}
 
@@ -746,12 +763,42 @@ export class Git {
 		let result;
 		try {
 			result = await promise;
+			// A normal `runSpawn` only resolves on a clean exit — `code !== 0 || signal` rejects — but the
+			// `exitCodeOnly` overload resolves unconditionally, INCLUDING for a signalled run (no code, partial
+			// or absent stdout). Coercing that to `0` would report a killed command as a clean success, so
+			// classify it as the failure it is.
+			if (result.exitCode == null) {
+				// SIGTERM is how BOTH a timeout kill and a caller abort terminate, so it has to group with
+				// cancellations here exactly as it does on the reject path — `failed`/`signal` is for every
+				// OTHER signal. Only `exitCodeOnly` reaches this: a native spawn `timeout` fires
+				// `close(null, 'SIGTERM')` with no `error` event, so it resolves instead of rejecting.
+				// Throwing hands it to the catch below, which owns the timeout-vs-abort heuristic, the ABORTED
+				// log, and the `onAborted` hook — none of which a branch here would fire.
+				if (result.signal === 'SIGTERM') {
+					throw new CancelledRunError(gitCommand, true, undefined, result.signal);
+				}
+
+				return {
+					stdout: result.stdout,
+					stderr: result.stderr,
+					completion: {
+						status: 'failed',
+						reason: result.signal != null ? 'signal' : 'unstarted',
+						error: new Error(
+							`Command terminated without an exit code${result.signal != null ? ` (${result.signal})` : ''}`,
+						),
+					},
+				};
+			}
+
 			return {
 				stdout: result.stdout,
 				stderr: result.stderr,
-				exitCode: result.exitCode ?? 0,
+				exitCode: result.exitCode,
+				completion: { status: 'exited', code: result.exitCode },
 			};
 		} catch (ex) {
+			let cancellationReason: GitRunCancellation = 'unknown';
 			if (ex instanceof CancelledRunError) {
 				const duration = getDurationMilliseconds(start);
 				const timeout = runOpts.timeout ?? 0;
@@ -761,6 +808,9 @@ export class Git {
 						: cancellation?.aborted
 							? 'cancellation'
 							: 'unknown';
+				// Also surfaced on the result, but DIAGNOSTIC ONLY — a timeout kill and a caller abort are both
+				// SIGTERM, so this duration heuristic can be wrong near the boundary. Never gate behavior on it.
+				cancellationReason = reason === 'cancellation' ? 'aborted' : reason;
 				Logger.warn(
 					`${formatLoggableScopeBlock('GIT')} ${gitCommand} \u00b7 ABORTED after ${duration}ms (${reason})`,
 				);
@@ -774,19 +824,44 @@ export class Git {
 
 			if (errorHandling === 'ignore') {
 				if (ex instanceof RunError) {
+					// `code` is `string | number | undefined`: a numeric string is a real exit code, but an errno
+					// (`'ENOENT'`) means the spawn itself failed, and `undefined` means the process never exited
+					// normally. Only the numeric case is an exit; the rest previously became `0` or `NaN`.
+					const code = typeof ex.code === 'number' ? ex.code : ex.code != null ? parseInt(ex.code, 10) : NaN;
+					const exited = Number.isInteger(code);
+
 					return {
 						stdout: ex.stdout,
 						stderr: ex.stderr,
-						exitCode: ex.code != null ? (typeof ex.code === 'number' ? ex.code : parseInt(ex.code, 10)) : 0,
-						cancelled: ex instanceof CancelledRunError,
+						...(exited ? { exitCode: code } : {}),
+						completion:
+							ex instanceof CancelledRunError
+								? { status: 'cancelled', reason: cancellationReason, error: ex }
+								: exited
+									? { status: 'exited', code: code }
+									: {
+											status: 'failed',
+											// A signal means it ran and was killed (partial `stdout` may exist);
+											// no signal and no numeric code means it never got that far.
+											reason: ex.signal != null ? 'signal' : 'unstarted',
+											error: ex,
+										},
 					};
 				}
 
+				// No cancellation branch here: `CancelledRunError extends RunError`, so reaching this at all
+				// proves `ex` is neither.
 				return {
 					stdout: '',
 					stderr: undefined,
-					exitCode: 0,
-					cancelled: ex instanceof CancelledRunError,
+					completion: {
+						status: 'failed',
+						// No `RunError` means no process was ever spawned — a queue rejection or a
+						// failure before `spawn` returned. (Not an untrusted workspace: `run` refuses
+						// those up front, so they never reach this catch.)
+						reason: 'unstarted',
+						error: ex instanceof Error ? ex : new Error(String(ex)),
+					},
 				};
 			}
 
@@ -797,9 +872,31 @@ export class Git {
 			}
 			if (errorHandling === 'throw') throw exception;
 
-			defaultExceptionHandler(exception, options.cwd, start);
+			// Rethrows unless the message matches a `GitWarnings` pattern, in which case it logs and returns the
+			// key that matched. Capture the error first — `exception` is cleared to keep it out of the `finally`
+			// log, but the result still needs to carry it.
+			const swallowed = exception;
+			const warning = defaultExceptionHandler(exception, options.cwd, start);
 			exception = undefined;
-			return { stdout: '', stderr: result?.stderr, exitCode: result?.exitCode ?? 0 };
+			// The command did NOT produce this empty stdout — a warning was swallowed. Say so, or the caller
+			// can't tell a genuinely empty answer (`noCommits`) from a read that never happened
+			// (`notARepository`).
+			//
+			// The process DID exit though (a warning is only ever swallowed for a non-zero exit), so report the
+			// code. `GitError.exitCode` is `number | string | undefined` — same normalization as the
+			// `errors: 'ignore'` path above, since only the numeric case is a real exit.
+			const rawCode = swallowed instanceof GitError ? swallowed.exitCode : undefined;
+			const code = typeof rawCode === 'number' ? rawCode : rawCode != null ? parseInt(rawCode, 10) : NaN;
+
+			// No `stderr`: it belongs to the error here. The top-level field is the channel for runs that
+			// completed WITHOUT one (`exited` carries no error, so a successful command's stderr has nowhere
+			// else to go) — a swallowed warning always has a `GitError`, and it carries the stderr. Reading
+			// `result?.stderr` would be dead anyway: `result` is only assigned on the non-throwing path.
+			return {
+				stdout: '',
+				...(Number.isInteger(code) ? { exitCode: code } : {}),
+				completion: { status: 'warned', warning: warning, error: swallowed },
+			};
 		} finally {
 			this.logGitCommandComplete(gitCommand, exception, getDurationMilliseconds(start), waiting);
 		}
@@ -826,13 +923,7 @@ export class Git {
 
 		// Fixes https://github.com/gitkraken/vscode-gitlens/issues/73 & https://github.com/gitkraken/vscode-gitlens/issues/161
 		// See https://stackoverflow.com/questions/4144417/how-to-handle-asian-characters-in-file-names-in-git-on-os-x
-		runArgs.unshift(
-			'-c',
-			'core.quotepath=false',
-			'-c',
-			'color.ui=false',
-			...(configs !== undefined ? configs : emptyArray),
-		);
+		runArgs.unshift('-c', 'core.quotepath=false', '-c', 'color.ui=false', ...(configs ?? emptyArray));
 
 		if (process.platform === 'win32') {
 			runArgs.unshift('-c', 'core.longpaths=true');
@@ -962,7 +1053,7 @@ export class Git {
 		// Ensure cleanup happens immediately when the generator is explicitly closed (e.g., via break or return)
 		// This is called by JavaScript when the generator is abandoned, ensuring logGitCommand is called
 		// synchronously rather than waiting for garbage collection.
-		// eslint-disable-next-line @typescript-eslint/no-meaningless-void-operator
+		// oxlint-disable-next-line typescript/no-meaningless-void-operator
 		return void cleanup();
 	}
 
@@ -1114,12 +1205,21 @@ export class Git {
 	}
 }
 
-export function defaultExceptionHandler(ex: Error, cwd: string | undefined, start?: [number, number]): void {
+/**
+ * Swallows an error whose message matches a known-benign {@link GitWarnings} pattern, returning WHICH one
+ * matched so the caller can record it — the distinction matters, since `noCommits` is a real answer while
+ * `notARepository` is a failed read. Rethrows anything else.
+ */
+export function defaultExceptionHandler(
+	ex: Error,
+	cwd: string | undefined,
+	start?: [number, number],
+): GitWarningKey | undefined {
 	if (isCancellationError(ex)) throw ex;
 
 	const msg = ex.message || ex.toString();
 	if (msg) {
-		for (const warning of Object.values(GitWarnings)) {
+		for (const [key, warning] of Object.entries(GitWarnings) as [GitWarningKey, RegExp][]) {
 			if (warning.test(msg)) {
 				const duration = start !== undefined ? ` [${getDurationMilliseconds(start)}ms]` : '';
 				Logger.warn(
@@ -1128,7 +1228,7 @@ export function defaultExceptionHandler(ex: Error, cwd: string | undefined, star
 						.replace(/fatal:\s*/g, '')
 						.replace(/\r?\n|\r/g, ' \u00b7 ')}${duration}`,
 				);
-				return;
+				return key;
 			}
 		}
 
@@ -1137,7 +1237,9 @@ export function defaultExceptionHandler(ex: Error, cwd: string | undefined, star
 			const [, ref] = match;
 
 			// Since looking up a ref with ^3 (e.g. looking for untracked files in a stash) can error on some versions of git just ignore it
-			if (ref?.endsWith('^3')) return;
+			// Swallowed, but it matched no `GitWarnings` entry — `undefined` records "unclassified", which
+			// callers must treat as "not a real answer" exactly like any warning they don't whitelist.
+			if (ref?.endsWith('^3')) return undefined;
 		}
 	}
 

package/src/git-cli/parsers/logParser.ts

@@ -76,7 +76,7 @@ const graphMapping = {
 	message: '%B',
 };
 
-type GraphLogParser = LogParser<typeof graphMapping>;
+export type GraphLogParser = LogParser<typeof graphMapping>;
 let _graphParser: GraphLogParser | undefined;
 type GraphWithStatsLogParser = LogParserWithStats<typeof graphMapping>;
 let _graphWithStatsParser: GraphWithStatsLogParser | undefined;
@@ -223,6 +223,14 @@ export type AsyncParser<T> = {
 	separators: { record: string; field: string };
 	parse: (data: string | Iterable<string> | undefined) => Generator<T> | Iterable<T>;
 	parseAsync: (stream: AsyncGenerator<string>) => AsyncGenerator<T>;
+	/**
+	 * Like `parseAsync` but yields one ARRAY of entries per stream chunk, scanning each chunk
+	 * synchronously with plain `indexOf` (no per-field iterator machinery). Bulk consumers (the
+	 * graph walk) avoid two promise hops per record — thousands of awaited yields collapse to one
+	 * per chunk. Only the plain parser implements it; per-record `parseAsync` remains the
+	 * general-purpose path.
+	 */
+	parseAsyncBatched?: (stream: AsyncGenerator<string>) => AsyncGenerator<T[]>;
 };
 
 export type LogParser<T> = AsyncParser<LogParsedEntry<T>>;
@@ -280,6 +288,20 @@ const recordFormatSep = '%x1E';
 const fieldSep = '\x1D'; // ASCII Group Separator character
 const fieldFormatSep = '%x1D';
 
+// A complete record terminates every mapped field with a field separator — a cancelled/early-closed
+// stream resolves cleanly with a truncated tail missing at least the final terminator.
+function isCompleteRecord(record: string, requiredFields: number): boolean {
+	let count = 0;
+	let index = -1;
+	while (count < requiredFields) {
+		index = record.indexOf(fieldSep, index + 1);
+		if (index === -1) return false;
+
+		count++;
+	}
+	return true;
+}
+
 export function createLogParser<T extends Record<string, string>>(mapping: ExtractAll<T, string>): LogParser<T> {
 	let format = recordFormatSep;
 	const keys: (keyof ExtractAll<T, string>)[] = [];
@@ -339,6 +361,8 @@ export function createLogParser<T extends Record<string, string>>(mapping: Extra
 
 		for await (const record of records) {
 			if (!record.length) continue;
+			// Drop a truncated tail (cancelled/early-closed stream) instead of yielding undefined/partial fields.
+			if (!isCompleteRecord(record, keys.length)) continue;
 
 			entry = {} as unknown as LogParsedEntry<T>;
 			fields = iterateByDelimiter(record, fieldSep);
@@ -361,11 +385,65 @@ export function createLogParser<T extends Record<string, string>>(mapping: Extra
 		sw?.stop({ suffix: ` parsed ${count} records` });
 	}
 
+	// Builds one entry from a complete record with a plain `indexOf` walk. Matches `parseAsync`'s
+	// semantics exactly: fields beyond the mapping are ignored, and every mapped field is
+	// terminated by a field separator (the format string appends one after each field).
+	function parseRecord(record: string): LogParsedEntry<T> {
+		const entry = {} as unknown as LogParsedEntry<T>;
+		let start = 0;
+		for (const key of keys) {
+			const end = record.indexOf(fieldSep, start);
+			if (end === -1) break;
+
+			entry[key] = record.substring(start, end) as T[keyof T];
+			start = end + 1;
+		}
+		return entry;
+	}
+
+	async function* parseAsyncBatched(stream: AsyncGenerator<string>): AsyncGenerator<LogParsedEntry<T>[]> {
+		using sw = maybeStopWatch('Git.LogParser.parseAsyncBatched', { log: { onlyExit: true, level: 'debug' } });
+
+		let count = 0;
+		let buffer = '';
+		for await (const chunk of stream) {
+			buffer += chunk;
+
+			let batch: LogParsedEntry<T>[] | undefined;
+			let start = 0;
+			while (true) {
+				const end = buffer.indexOf(recordSep, start);
+				if (end === -1) break;
+
+				if (end > start) {
+					(batch ??= []).push(parseRecord(buffer.substring(start, end)));
+					count++;
+				}
+				start = end + 1;
+			}
+			if (start > 0) {
+				buffer = buffer.substring(start);
+			}
+			if (batch != null) {
+				yield batch;
+			}
+		}
+		// Trailing record (the stream doesn't end with a record separator); a truncated tail from a
+		// cancelled/early-closed stream is missing a field terminator and must be dropped, not parsed.
+		if (buffer.length > 0 && isCompleteRecord(buffer, keys.length)) {
+			count++;
+			yield [parseRecord(buffer)];
+		}
+
+		sw?.stop({ suffix: ` parsed ${count} records` });
+	}
+
 	return {
 		arguments: args,
 		separators: { record: recordSep, field: fieldSep },
 		parse: parse,
 		parseAsync: parseAsync,
+		parseAsyncBatched: parseAsyncBatched,
 	};
 }
 
@@ -605,6 +683,8 @@ function createLogParserWithFilesAndStats<T extends Record<string, string> | voi
 
 		for await (const record of records) {
 			if (!record.length) continue;
+			// Drop a truncated tail (cancelled/early-closed stream) instead of yielding undefined/partial fields.
+			if (!isCompleteRecord(record, keys.length)) continue;
 
 			count++;
 			entry = {} as unknown as LogParsedEntryWithFilesAndStats<T>;
@@ -955,6 +1035,8 @@ function createLogParserWithPatch<T extends Record<string, string>>(
 
 		for await (const record of records) {
 			if (!record.length) continue;
+			// Drop a truncated tail (cancelled/early-closed stream) instead of yielding undefined/partial fields.
+			if (!isCompleteRecord(record, keys.length)) continue;
 
 			count++;
 			entry = {} as unknown as LogParsedEntryWithFiles<T>;

package/src/git-cli/parsers/sshSignatureParser.ts

@@ -0,0 +1,85 @@
+import type { SshPublicKey } from '../../git/models/signature.js';
+import { isValidSshKeyData, isValidSshKeyType } from '../../git/utils/sshKey.utils.js';
+
+const sshSigMagic = 'SSHSIG';
+const gpgSigHeaderRegex = /^gpgsig(?:-sha256)? /;
+const sshSigArmorRegex = /-----BEGIN SSH SIGNATURE-----\n([\s\S]*?)\n-----END SSH SIGNATURE-----/;
+// A commit header line: `committer Display Name <email> <unix-ts> <tz>`.
+const committerRegex = /^committer (.*) <([^>]*)> \d+ [-+]\d+$/m;
+
+/**
+ * Extracts the committer's name and raw email from a commit object. The raw email (not a mailmapped one) is the
+ * principal Git checks an SSH signature against, so it's what an `allowed_signers` entry must use.
+ */
+export function extractCommitterFromCommitObject(commitObject: string): { name: string; email: string } | undefined {
+	const match = committerRegex.exec(commitObject);
+	if (match == null) return undefined;
+
+	return { name: match[1], email: match[2] };
+}
+
+/**
+ * Extracts the signer's full SSH public key from a commit object's `gpgsig` SSH signature.
+ *
+ * A commit signed with `gpg.format=ssh` stores an armored `-----BEGIN SSH SIGNATURE-----` (SSHSIG) blob in its
+ * `gpgsig` header, and the SSHSIG wire format embeds the signer's full public key — exactly what an `allowed_signers`
+ * entry requires. (`git log`'s signature fields only expose the key fingerprint, never the full key.)
+ *
+ * @param commitObject Raw commit object text, as produced by `git cat-file commit <sha>`
+ * @returns The key type and base64 public-key blob, or `undefined` if the commit isn't SSH-signed or can't be parsed.
+ */
+export function extractSshPublicKeyFromCommitObject(commitObject: string): SshPublicKey | undefined {
+	const armored = extractArmoredSignature(commitObject);
+	if (armored == null) return undefined;
+
+	const buffer = Buffer.from(armored, 'base64');
+
+	// SSHSIG wire format (see OpenSSH PROTOCOL.sshsig):
+	//   byte[6] MAGIC "SSHSIG" | uint32 version | string publickey | string namespace | ...
+	// where each `string` is a big-endian uint32 length followed by that many bytes.
+	if (buffer.length < 10 || buffer.toString('latin1', 0, 6) !== sshSigMagic) return undefined;
+
+	// `publickey` is the first length-prefixed string, after the 6-byte magic and 4-byte version.
+	const pubKeyBlob = readSshString(buffer, 10);
+	if (pubKeyBlob == null) return undefined;
+
+	// The public-key blob itself begins with its key type as a length-prefixed string.
+	const keyType = readSshString(pubKeyBlob, 0)?.toString('utf8');
+	if (!keyType) return undefined;
+
+	const keyData = pubKeyBlob.toString('base64');
+	// The signature blob is attacker-controllable (Git stores it verbatim and never verifies it on read), so reject
+	// anything that isn't a recognized key type / well-formed base64 before it can become an `allowed_signers` entry.
+	if (!isValidSshKeyType(keyType) || !isValidSshKeyData(keyData)) return undefined;
+
+	return { keyType: keyType, keyData: keyData };
+}
+
+/** Extracts and concatenates the base64 body of the armored SSH signature from a commit's `gpgsig` header. */
+function extractArmoredSignature(commitObject: string): string | undefined {
+	const lines = commitObject.split('\n');
+	const start = lines.findIndex(l => gpgSigHeaderRegex.test(l));
+	if (start === -1) return undefined;
+
+	// The header value, followed by continuation lines (each indented with a single leading space).
+	const block = [lines[start].replace(gpgSigHeaderRegex, '')];
+	for (let i = start + 1; i < lines.length; i++) {
+		if (!lines[i].startsWith(' ')) break;
+
+		block.push(lines[i].slice(1));
+	}
+
+	const match = sshSigArmorRegex.exec(block.join('\n'));
+	return match != null ? match[1].replace(/\s+/g, '') : undefined;
+}
+
+/** Reads a length-prefixed SSH wire-format string (big-endian uint32 length + bytes) at `offset`. */
+function readSshString(buffer: Buffer, offset: number): Buffer | undefined {
+	if (offset + 4 > buffer.length) return undefined;
+
+	const start = offset + 4;
+	const end = start + buffer.readUInt32BE(offset);
+	if (end > buffer.length) return undefined;
+
+	return buffer.subarray(start, end);
+}

package/src/git-cli/parsers/worktreeParser.ts

@@ -39,8 +39,6 @@ export function parseGitWorktrees(
 	let index: number;
 	let key: string;
 	let value: string;
-	let locked: string;
-	let prunable: string;
 	let main = true; // the first worktree is the main worktree
 
 	for (line of iterateByDelimiter(data, '\n')) {
@@ -54,7 +52,7 @@ export function parseGitWorktrees(
 		}
 
 		if (!key && entry != null) {
-			// eslint-disable-next-line no-loop-func
+			// oxlint-disable-next-line no-loop-func
 			const branch = entry.branch ? branches?.find(b => b.name === entry!.branch) : undefined;
 			const uri = fileUri(entry.path!);
 
@@ -96,13 +94,13 @@ export function parseGitWorktrees(
 			case 'detached':
 				entry.detached = true;
 				break;
+			// `value` is the whole reason, which is only present when the locker/Git provides one.
+			// Reasons with unusual characters (e.g. newlines) come through C-quoted, per `core.quotePath`
 			case 'locked':
-				[, locked] = value.split(' ', 2);
-				entry.locked = locked?.trim() || true;
+				entry.locked = value.trim() || true;
 				break;
 			case 'prunable':
-				[, prunable] = value.split(' ', 2);
-				entry.prunable = prunable?.trim() || true;
+				entry.prunable = value.trim() || true;
 				break;
 		}
 	}