@gitkraken/core-gitlens 0.5.110 → 0.5.111

package/src/git-cli/providers/commits.ts

@@ -24,11 +24,13 @@ import type {
 	SearchCommitsResult,
 } from '../../git/providers/commits.js';
 import type { DiffRange } from '../../git/providers/types.js';
+import type { GitCommandPriority } from '../../git/run.types.js';
 import { createUncommittedChangesCommit } from '../../git/utils/commit.utils.js';
 import { isRevisionRange, isSha, isUncommitted, isUncommittedStaged } from '../../git/utils/revision.utils.js';
 import { parseSearchQueryGitCommand } from '../../git/utils/search.utils.js';
 import { compareReachableRefs } from '../../git/utils/sorting.js';
 import { isUserMatch } from '../../git/utils/user.utils.js';
+import { chunk as chunkArray } from '../../utils/array.js';
 import { CancellationError, isCancellationError } from '../../utils/cancellation.js';
 import { debug, trace } from '../../utils/decorators/log.js';
 import { createDisposable } from '../../utils/disposable.js';
@@ -37,7 +39,7 @@ import { getScopedLogger } from '../../utils/logger.scoped.js';
 import { isFolderGlob, normalizePath, splitPath, stripFolderGlob } from '../../utils/path.js';
 import type { CacheController } from '../../utils/promiseCache.js';
 import { maybeStopWatch } from '../../utils/stopwatch.js';
-import { escapeRegex } from '../../utils/string.js';
+import { escapeRegex, iterateByDelimiter } from '../../utils/string.js';
 import type { Uri } from '../../utils/uri.js';
 import { fileUri, joinUriPath, toFsPath } from '../../utils/uri.js';
 import type { CliGitProviderInternal } from '../cliGitProvider.js';
@@ -67,6 +69,8 @@ import { convertStashesToStdin } from './stash.js';
 
 const emptyPromise: Promise<GitBlame | ParsedGitDiffHunks | GitLog | undefined> = Promise.resolve(undefined);
 const reflogCommands = ['merge', 'pull'];
+/** Keeps `filterUnpublishedShas` well inside Windows' ~32K command-line cap (40 hex chars + separator each). */
+const maxShasPerRevListSpawn = 500;
 
 export class CommitsGitSubProvider implements GitCommitsSubProvider {
 	constructor(
@@ -114,23 +118,48 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 	}
 
 	@debug({ exit: true })
-	async getCommitCount(repoPath: string, rev: string, cancellation?: AbortSignal): Promise<number | undefined> {
-		const result = await this.git.run(
-			{ cwd: repoPath, cancellation: cancellation, errors: 'ignore' },
-			'rev-list',
-			'--count',
+	getCommitCount(repoPath: string, rev: string, cancellation?: AbortSignal): Promise<number | undefined> {
+		return this.cache.commitCount.getOrCreate(
+			repoPath,
 			rev,
-			'--',
-		);
-		if (result.completion.status === 'cancelled' || cancellation?.aborted) {
-			throw new CancellationError();
-		}
+			async (cacheable, signal) => {
+				// Bind the shared spawn to the aggregate `signal` (fires only when ALL current callers
+				// abort), not this-caller's `cancellation` — otherwise a superseded caller's abort would
+				// kill the shared command and reject concurrent riders that never cancelled.
+				const result = await this.git.run(
+					{ cwd: repoPath, cancellation: signal ?? cancellation, errors: 'ignore' },
+					'rev-list',
+					'--count',
+					rev,
+					'--',
+				);
+				if (result.completion.status === 'cancelled' || signal?.aborted) {
+					throw new CancellationError();
+				}
 
-		const data = result.stdout.trim();
-		if (!data) return undefined;
+				// `errors: 'ignore'` turns a failed run (unknown rev, a transient `index.lock`) into an
+				// empty stdout rather than a throw. That's indistinguishable from a real answer here, so
+				// don't let it become a cached one — this entry has a sliding hour-long TTL, and repeated
+				// access would keep a transient failure alive indefinitely. The pre-cache implementation
+				// simply retried on the next call; invalidating restores that.
+				//
+				// BOTH conditions, not either alone. `exitCode !== 0` catches "git ran and said no" (a bad
+				// rev exits 128); `status !== 'exited'` catches "git never answered" — a queue rejection or
+				// spawn failure (no exit code at all), or a swallowed `GitWarnings` match, which carries git's
+				// real code and so can slip past the exit-code test on its own.
+				if (result.completion.status !== 'exited' || result.exitCode !== 0) {
+					cacheable.invalidate();
+					return undefined;
+				}
+
+				const data = result.stdout.trim();
+				if (!data) return undefined;
 
-		const count = parseInt(data, 10);
-		return isNaN(count) ? undefined : count;
+				const count = parseInt(data, 10);
+				return isNaN(count) ? undefined : count;
+			},
+			{ cancellation: cancellation },
+		);
 	}
 
 	@debug({ exit: true })
@@ -157,6 +186,68 @@ export class CommitsGitSubProvider implements GitCommitsSubProvider {
 		return result.stdout.trim().length > 0;
 	}
 
+	@debug({
+		args: (repoPath, shas) => ({ repoPath: repoPath, shas: `${shas.length} value(s)` }),
+		exit: r => `${r.size} unpublished`,
+	})
+	async filterUnpublishedShas(
+		repoPath: string,
+		shas: readonly string[],
+		options?: { priority?: GitCommandPriority },
+		cancellation?: AbortSignal,
+	): Promise<Set<string>> {
+		const unpublished = new Set<string>();
+		if (!shas.length) return unpublished;
+
+		// One walk answers every sha: `<shas…> --not --remotes` yields the commits reachable from any of them
+		// but not from any remote-tracking ref, so a sha is unpublished exactly when it appears in the output.
+		// Callers pass tips from sibling worktrees — safe from a single `cwd` because the object store and
+		// `refs/remotes` are shared across a repo's worktrees (unlike the index/working tree, which are not).
+		//
+		// NOT `--no-walk`: it "has no effect if a range is specified", and `--not --remotes` makes this a range,
+		// so it would silently walk anyway and return the whole unpublished history instead of just these tips.
+		// The walk is bounded by divergence from the remotes, not by repo size; callers skip this entirely when
+		// the repo has no remotes (where every local commit would qualify).
+		// Chunked so a repo with a very large number of worktrees can't overflow the platform's argument
+		// limit (Windows' `CreateProcess` caps the whole command line at ~32K characters).
+		// Deliberately NOT `errors: 'ignore'`: this answers for EVERY sha at once, so a swallowed failure
+		// would return an empty set the caller can't distinguish from "nothing is unpublished", publishing a
+		// confident `hasUnpushed: false` across every worktree in the batch. Letting it throw degrades the
+		// caller to "unknown", which omits the field and leaves the client's last-known value in place.
+		for (const chunk of chunkArray([...shas], maxShasPerRevListSpawn)) {
+			const result = await this.git.run(
+				{
+					cwd: repoPath,
+					cancellation: cancellation,
+					...(options?.priority != null ? { priority: options.priority } : undefined),
+				},
+				'rev-list',
+				...chunk,
+				'--not',
+				'--remotes',
+				'--',
+			);
+			// Anything but a clean exit leaves empty stdout, which this function would otherwise read as
+			// "every sha is published" — publishing a definite, wrong `hasUnpushed: false` for the whole
+			// batch. Dropping `errors: 'ignore'` was not enough on its own: a stderr matching `GitWarnings`
+			// (a repo path that briefly vanished, an unknown rev) is swallowed by the default handler and
+			// resolves rather than throwing. Rethrow so the caller degrades to "unknown".
+			if (result.completion.status !== 'exited') throw result.completion.error;
+			if (cancellation?.aborted) throw new CancellationError();
+
+			const candidates = new Set(chunk);
+			for (const line of iterateByDelimiter(result.stdout, '\n')) {
+				const sha = line.trim();
+				// The walk emits ancestors too; keep only the tips we were asked about.
+				if (sha.length && candidates.has(sha)) {
+					unpublished.add(sha);
+				}
+			}
+		}
+
+		return unpublished;
+	}
+
 	@debug({ exit: true })
 	async getCommitDates(
 		repoPath: string,

package/src/git-cli/providers/config.ts

@@ -1,7 +1,7 @@
 import { promises as fs } from 'fs';
 import { hostname, userInfo } from 'os';
 import { env as process_env } from 'process';
-import type { Cache, GkConfigInvalidationTarget } from '../../git/cache.js';
+import type { Cache, GkConfigInvalidationTarget, GkReconcileOutcome } from '../../git/cache.js';
 import type { GitServiceContext } from '../../git/context.js';
 import { WorkspaceUntrustedError } from '../../git/errors.js';
 import type { GitDir } from '../../git/models/repository.js';
@@ -16,6 +16,7 @@ import type {
 } from '../../git/providers/config.js';
 import { gate } from '../../utils/decorators/gate.js';
 import { debug, trace } from '../../utils/decorators/log.js';
+import { first, some } from '../../utils/iterable.js';
 import { Logger } from '../../utils/logger.js';
 import { getScopedLogger } from '../../utils/logger.scoped.js';
 import { dirname, getBestPath, isAbsolute, joinPaths, normalizePath } from '../../utils/path.js';
@@ -79,7 +80,17 @@ export class ConfigGitSubProvider implements GitConfigSubProvider {
 		private readonly git: Git,
 		private readonly cache: Cache,
 		private readonly provider: CliGitProviderInternal,
-	) {}
+	) {
+		this.cache.setGkConfigReconciler((repoPath, priorSnapshot) => this.reconcileGkConfig(repoPath, priorSnapshot));
+	}
+
+	/**
+	 * In-flight gk-config reconciles keyed by commonPath. `pending` records that another `'gkConfig'`
+	 * event landed mid-pass, so one trailing pass runs after the current one settles. `paths` holds every
+	 * worktree path that reported the change, mapped to its close generation at that moment — the pass
+	 * reads through one that's still open and notifies all of them.
+	 */
+	private readonly _gkConfigReconciles = new Map<string, { pending: boolean; paths: Map<string, number> }>();
 
 	/**
 	 * Pending `setGkConfig` writes keyed by `(commonPath, key, value, skip-option)`. Concurrent
@@ -358,13 +369,40 @@ export class ConfigGitSubProvider implements GitConfigSubProvider {
 		// clearCaches('gkConfig'), which would otherwise evict the in-flight gkConfigMap entry the
 		// cache wrapper synchronously stored and force a redundant bulk re-read.
 		await this.migrateGkConfigFromGitConfig(this.cache.getCommonPath(repoPath));
-		return this.cache.getGkConfigMap(repoPath, () => this.getGkConfigRegexCore(repoPath, gkConfigAllPattern));
+		return this.cache.getGkConfigMap(repoPath, async cacheable => {
+			const { map, failed } = await this.getGkConfigRegexCore(repoPath, gkConfigAllPattern);
+			// This map has no TTL and everything gk-related reads through it, so a failed read cached as an
+			// empty map would report every branch as having no stored base or merge target for the session —
+			// and would make the section-cleanup pre-checks skip real work. Only cache a read that happened.
+			if (failed) {
+				cacheable.invalidate();
+			}
+			return map;
+		});
 	}
 
-	private async getGkConfigRegexCore(repoPath: string, pattern: string): Promise<Map<string, string>> {
+	private async getGkConfigRegexCore(
+		repoPath: string,
+		pattern: string,
+	): Promise<{ map: Map<string, string>; failed: boolean }> {
 		const gkConfigPath = await this.getGkConfigPath(repoPath);
-		if (!gkConfigPath) return new Map();
-		return this.getConfigRegexCore(repoPath, pattern, { runGitLocally: true, file: gkConfigPath });
+		// No `.git/gk/config` yet is a real answer, not a failure — a repo GitLens has never written to.
+		if (!gkConfigPath) return { map: new Map(), failed: false };
+
+		const result = await this.git.run(
+			{ cwd: repoPath, errors: 'ignore', runLocally: true },
+			'config',
+			'--get-regex',
+			'-f',
+			gkConfigPath,
+			pattern,
+		);
+		// `--get-regex` exits 1 when nothing matches, which IS an answer (an empty gk config).
+		const exited = result.completion.status === 'exited';
+		return {
+			map: parseConfigRegexOutput(result.stdout.trim()),
+			failed: !exited || (result.exitCode !== 0 && result.exitCode !== 1),
+		};
 	}
 
 	@debug()
@@ -412,9 +450,192 @@ export class ConfigGitSubProvider implements GitConfigSubProvider {
 		await this.setConfigCore(repoPath, key, value, { file: gkConfigPath });
 
 		// Invalidate the bulk map (so the next read re-fetches) and the derived caches for this key's
-		// ref. The `.git/gk/config` file-watcher also fires `'gkConfig'` shortly after, which clears
-		// the same caches coarsely — both paths are idempotent.
+		// ref. The `.git/gk/config` file-watcher also fires `'gkConfig'` shortly after, which reconciles
+		// the same change (see `reconcileGkConfig`) — recording our own write here keeps that later
+		// reconcile from re-diffing this key as an external change.
 		this.cache.deleteGkConfig(repoPath, key, options);
+		this.cache.recordGkConfigWrite(repoPath, key, value);
+	}
+
+	@debug()
+	async removeGkConfigBranchSection(repoPath: string, ref: string): Promise<void> {
+		await this.runGkConfigSectionCommand(repoPath, ref, '--remove-section', `branch.${ref}`);
+	}
+
+	@debug()
+	async renameGkConfigBranchSection(repoPath: string, oldRef: string, newRef: string): Promise<void> {
+		// Clear the destination first, unconditionally. `--rename-section` onto a section that already
+		// exists APPENDS rather than replaces, leaving duplicate keys — and git resolves a duplicated key
+		// to its LAST value, so the orphan left by an earlier branch of this name would win over the
+		// metadata being moved. Doing this outside `runGkConfigSectionCommand` also covers the case where
+		// the source has no gk keys at all, where its pre-check would otherwise skip the whole call and
+		// leave the orphan in place for the renamed branch to inherit.
+		await this.removeGkConfigBranchSection(repoPath, newRef);
+		await this.runGkConfigSectionCommand(
+			repoPath,
+			oldRef,
+			'--rename-section',
+			`branch.${oldRef}`,
+			`branch.${newRef}`,
+		);
+	}
+
+	/**
+	 * Runs a section-level `git config` against `.git/gk/config` for `ref`'s section, skipping the
+	 * subprocess entirely when the bulk map (already cached on any warm path) shows that ref has no gk
+	 * keys — the overwhelmingly common case, since most branches never get gk metadata written at all.
+	 *
+	 * Never throws: callers invoke this as bookkeeping after a branch op has already succeeded, so a
+	 * failure here must not be reported as (or roll back) the branch/checkout/worktree operation itself.
+	 * The worst case is metadata that stays behind until the next op on that name.
+	 */
+	private async runGkConfigSectionCommand(repoPath: string, ref: string, ...args: string[]): Promise<void> {
+		const scope = getScopedLogger();
+		try {
+			const prefix = `branch.${ref}.`;
+			const map = await this.getGkConfigMap(repoPath);
+			// The shortcut needs a map with CONTENT to be trustworthy. A failed bulk read resolves empty
+			// (see `getGkConfigMap`) — the cache refuses it, but this caller still holds it — and an empty map
+			// read as authoritative would skip the removal entirely, leaving a deleted branch's base,
+			// disposition and issue links behind for the next branch reusing that name. When it's empty, run
+			// the command: worst case is a no-op on a section that isn't there.
+			if (map.size && !some(map.keys(), k => k.startsWith(prefix))) return;
+
+			const gkConfigPath = await this.getGkConfigPath(repoPath);
+			if (!gkConfigPath) return;
+			// `getGkConfigPath` only joins a path, so check the file: with no `.git/gk/config` there is
+			// genuinely nothing to remove, and running the command would fail with a fatal we'd then warn
+			// about on every branch delete in a repo that has never had gk metadata.
+			if (!(await fsExists(gkConfigPath))) return;
+
+			const result = await this.git.run(
+				{ cwd: repoPath, runLocally: true, errors: 'ignore' },
+				'config',
+				'-f',
+				gkConfigPath,
+				...args,
+			);
+			// `errors: 'ignore'` is deliberate — see the note above on why this must never throw — but that
+			// also means the `catch` below never sees a failed write, so without this the metadata silently
+			// stays behind (or, on a rename, stays under the old name) with nothing recorded anywhere.
+			// Reported, not thrown: the branch op it follows has already succeeded.
+			if (result.completion.status !== 'exited' || result.exitCode !== 0) {
+				scope?.warn(
+					`Failed to update gk config section for '${ref}' in '${repoPath}': ${
+						result.completion.status === 'exited'
+							? `git config exited ${result.exitCode}`
+							: `${result.completion.status} · ${result.completion.error.message}`
+					}`,
+				);
+			}
+			// A whole section moved or vanished, which the per-key `deleteGkConfig` cascade can't express.
+			// Drop the bulk map so the next read hits disk; the derived caches for the affected ref are
+			// evicted by the caller's own `deleteBaseBranchName` plus the `'branches'` cascade it fires.
+			this.cache.deleteGkConfigMap(repoPath);
+		} catch (ex) {
+			scope?.error(ex, `Failed to update gk config section for '${ref}' in '${repoPath}'`);
+		}
+	}
+
+	/**
+	 * Reconciles a watcher-observed `'gkConfig'` change — registered with the shared `Cache` as its
+	 * gk-config reconciler (see the constructor). Re-reads the bulk map (hard-evicted by
+	 * `Cache.handleGkConfigChanged`, so this hits disk) and diffs it against `priorSnapshot` to cascade
+	 * `baseBranchName`/`branchOverviews` only for refs whose merge-relevant keys actually changed.
+	 *
+	 * Serialized per commonPath: a reconcile is a read-then-diff against a single shared baseline, so
+	 * two overlapping passes would both diff against the same snapshot and the later change could fall
+	 * out entirely. An event arriving mid-pass instead queues one trailing pass, which re-reads and
+	 * diffs against the baseline the previous pass just established.
+	 *
+	 * `.git/gk/config` lives in the common dir, so the watcher delivers one event per worktree sharing it
+	 * (see `WatchGroup.onCommonEvent`). Siblings never run concurrently — the later ones fold into the
+	 * in-flight pass — but folding in arms the trailing pass, so a fan-out costs one extra read that
+	 * re-reads and diffs an unchanged file. However many siblings land while a pass is running, they
+	 * coalesce into that single trailing pass; the cost is the price of never dropping a real change.
+	 * Every reporting path is retained because `Repository` matches the follow-up change event on exact
+	 * path, and a sibling worktree that never receives one would sit on stale derived values.
+	 */
+	private reconcileGkConfig(
+		repoPath: string,
+		priorSnapshot: ReadonlyMap<string, string> | undefined,
+	): GkReconcileOutcome | Promise<GkReconcileOutcome> {
+		const commonPath = this.cache.getCommonPath(repoPath);
+
+		const inflight = this._gkConfigReconciles.get(commonPath);
+		if (inflight != null) {
+			inflight.paths.set(repoPath, this.cache.getCloseGeneration(repoPath));
+			inflight.pending = true;
+			// Handed to the in-flight pass's trailing loop, so it IS being reconciled — just not by this
+			// call. Reporting a failure here would coarse-clear on every write in a burst.
+			return 'deferred';
+		}
+
+		const entry = { pending: false, paths: new Map([[repoPath, this.cache.getCloseGeneration(repoPath)]]) };
+		this._gkConfigReconciles.set(commonPath, entry);
+		return this.runGkConfigReconcile(commonPath, priorSnapshot, entry);
+	}
+
+	/** Drops paths that closed since they reported the change; returns whichever remain. */
+	private pruneClosedReconcilePaths(paths: Map<string, number>): Map<string, number> {
+		for (const [path, generation] of paths) {
+			if (this.cache.getCloseGeneration(path) !== generation) {
+				paths.delete(path);
+			}
+		}
+		return paths;
+	}
+
+	private async runGkConfigReconcile(
+		commonPath: string,
+		priorSnapshot: ReadonlyMap<string, string> | undefined,
+		entry: { pending: boolean; paths: Map<string, number> },
+	): Promise<GkReconcileOutcome> {
+		const scope = getScopedLogger();
+		let snapshot = priorSnapshot;
+
+		try {
+			do {
+				entry.pending = false;
+
+				// Read through a path that's still open — one worktree closing must not drop the event for
+				// its still-open siblings, which is why this reads from the surviving set rather than from
+				// whichever path happened to report first.
+				const readPath = first(this.pruneClosedReconcilePaths(entry.paths).keys());
+				// Every path that reported the change has since closed — nothing left to reconcile, and
+				// nothing left holding a stale derived value either.
+				if (readPath == null) return 'reconciled';
+
+				// A trailing pass must not reuse the entry the pass before it installed.
+				this.cache.deleteGkConfigMap(readPath);
+				const freshMap = await this.getGkConfigMap(readPath);
+				// Paths may have closed while the re-read was in flight; if every one did, there's nothing
+				// left to reconcile against.
+				if (!this.pruneClosedReconcilePaths(entry.paths).size) return 'reconciled';
+
+				if (this.cache.reconcileGkConfigMap(readPath, snapshot, freshMap)) {
+					// Fire a follow-up change: a consumer that re-read on the original event may have done so
+					// before this async cascade landed, so it would otherwise hold a stale derived value with
+					// nothing left to prompt another re-read.
+					for (const path of entry.paths.keys()) {
+						this.context.hooks?.repository?.onChanged?.(path, ['gkConfig']);
+					}
+				}
+
+				// `reconcileGkConfigMap` advanced the stored baseline to what we just read; a trailing pass
+				// diffs its own read against that.
+				snapshot = this.cache.getGkConfigMergeSnapshot(readPath);
+			} while (entry.pending);
+
+			return 'reconciled';
+		} catch (ex) {
+			scope?.error(ex, `Failed to reconcile gk config for '${commonPath}'`);
+			// The caller falls back to the coarse clear — derived caches are otherwise left holding
+			// pre-change values with nothing to correct them.
+			return 'failed';
+		} finally {
+			this._gkConfigReconciles.delete(commonPath);
+		}
 	}
 
 	@debug()

package/src/git-cli/providers/contributors.ts

@@ -301,7 +301,11 @@ export class ContributorsGitSubProvider implements GitContributorsSubProvider {
 
 		const scope = getScopedLogger();
 
-		const getCore = async (commonPath: string, signal?: AbortSignal): Promise<GitContributorsStats | undefined> => {
+		const getCore = async (
+			commonPath: string,
+			_cacheable?: CacheController,
+			signal?: AbortSignal,
+		): Promise<GitContributorsStats | undefined> => {
 			try {
 				const args = ['shortlog', '-s', '--all'];
 

package/src/git-cli/providers/graph.ts

@@ -221,22 +221,27 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 	/**
 	 * Current ref tips (canonical refname → PEELED commit sha), for the R6b fast path's gate. Peeled so an
 	 * annotated tag maps to the commit its badge sits on — the same convention {@link GraphIncrementalSeed.tips}
-	 * uses — and so the seed↔current diff is by commit identity. Skips nothing; the caller filters to the
-	 * moveable ref classes it cares about.
+	 * uses — and so the seed↔current diff is by commit identity. Covers heads/remotes/tags/replace (all the
+	 * namespaces the gate consumers read); the caller filters to the ref classes it cares about.
 	 */
 	private async getCurrentRefTips(repoPath: string, cancellation?: AbortSignal): Promise<Map<string, string>> {
-		const result = await this.git.run(
-			{ cwd: repoPath, configs: gitConfigsLog, cancellation: cancellation, errors: 'ignore' },
-			'for-each-ref',
-			'--format=%(objectname) %(*objectname) %(refname)',
-		);
 		const tips = new Map<string, string>();
-		for (const line of result.stdout.split('\n')) {
-			// `<objectname> <peeled-objectname-or-empty> <refname>`; peeled is set only for annotated tags.
-			const match = /^(\S+) (\S*) (.+)$/.exec(line);
-			if (match == null) continue;
-
-			tips.set(match[3], match[2] || match[1]);
+		try {
+			// `force: true` invalidates the shared refs cache so this spawns fresh (this gate needs a
+			// point-in-time read, not a possibly-stale cached one) while ALSO repopulating that cache —
+			// one `for-each-ref` serves both this gate and any sibling `getRefs`/`getBranches`/`getTags`
+			// call racing it (they attach to the same in-flight spawn).
+			const records = await this.provider.refs.getRefs(repoPath, cancellation, { force: true });
+			for (const record of records) {
+				if (!record.name) continue;
+
+				// Peeled objectname is set only for annotated tags; everything else uses objectname.
+				tips.set(record.name, record.peeledObjectname || record.objectname);
+			}
+		} catch {
+			// Preserve the prelude's "never rejects" contract (see the bare `await` at the call site):
+			// a per-caller cancellation race through the shared cache (or any other failure) degrades
+			// to no tips, same as the direct `errors: 'ignore'` spawn this replaced.
 		}
 		return tips;
 	}
@@ -388,6 +393,14 @@ export class GraphGitSubProvider implements GitGraphSubProvider {
 		// single `for-each-ref`, off the rows-walk critical path). Attached to the returned graph as `refTips`
 		// so the host can seed the NEXT rebuild's tip diff; the R6b fast path also reuses this same map for its
 		// own tip-diff gate (so there's exactly one `for-each-ref` per call whether it goes fast or full).
+		// ALWAYS forced, including on a cold build. It's tempting to skip the force when there's no seed to
+		// diff against — the cold build only records these tips for the NEXT build — but the tips it records
+		// must describe the same repo state the rows walk observed, and the rows walk always reads live git.
+		// A cached (stale) enumeration breaks that pairing in a way a later build can't detect: if a ref moves
+		// A→B before the cold load and is then reverted B→A, the seed says A, the next forced read says A, the
+		// tip diff sees no change and takes the fast path — while the cached rows were built at B and still
+		// carry the discarded commit. Staleness here is not "more work, never wrong"; only the seed side can
+		// be stale, so a move-and-revert admits a genuinely wrong fast path.
 		const refTipsPromise = this.getCurrentRefTips(repoPath, cancellation);
 
 		// Shallow state (peeled off the same prelude, off the rows-walk critical path) — stamped on the returned

package/src/git-cli/providers/operations.ts

@@ -70,6 +70,10 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 
 		try {
 			await this.git.run({ cwd: repoPath, errors: 'throw', ...runOptions }, ...params);
+			if (options?.createBranch) {
+				// Evict the cached base only — see `createBranch` on why the persisted keys stay.
+				this.cache.deleteBaseBranchName(repoPath, options.createBranch);
+			}
 			this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status');
 			this.context.hooks?.repository?.onChanged?.(repoPath, ['head', 'heads', 'index']);
 		} catch (ex) {
@@ -393,15 +397,23 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 				);
 				if (worktree != null) {
 					// Branch is checked out in a worktree — run git pull in that worktree's directory
-					await this.pullCore(
-						normalizePath(worktree.uri.fsPath),
-						{
-							rebase: options?.rebase,
-							tags: options?.tags,
-							source: options?.source,
-						},
-						runOptions,
-					);
+					// Any rebase state (e.g. from `pull.rebase=true`) appears under the worktree path
+					const worktreePath = normalizePath(worktree.uri.fsPath);
+					this.context.hooks?.operations?.onRebaseCapableOperation?.(worktreePath, 'pull', 'started');
+					try {
+						await this.pullCore(
+							worktreePath,
+							{
+								rebase: options?.rebase,
+								tags: options?.tags,
+								source: options?.source,
+							},
+							runOptions,
+						);
+					} finally {
+						this.context.hooks?.operations?.onRebaseCapableOperation?.(worktreePath, 'pull', 'ended');
+					}
+
 					this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status', 'tags');
 					this.context.hooks?.repository?.onChanged?.(repoPath, ['head', 'heads', 'remotes', 'index']);
 				} else {
@@ -411,15 +423,20 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 				return;
 			}
 
-			await this.pullCore(
-				repoPath,
-				{
-					rebase: options?.rebase,
-					tags: options?.tags,
-					source: options?.source,
-				},
-				runOptions,
-			);
+			this.context.hooks?.operations?.onRebaseCapableOperation?.(repoPath, 'pull', 'started');
+			try {
+				await this.pullCore(
+					repoPath,
+					{
+						rebase: options?.rebase,
+						tags: options?.tags,
+						source: options?.source,
+					},
+					runOptions,
+				);
+			} finally {
+				this.context.hooks?.operations?.onRebaseCapableOperation?.(repoPath, 'pull', 'ended');
+			}
 
 			this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status', 'tags');
 			this.context.hooks?.repository?.onChanged?.(repoPath, ['head', 'heads', 'remotes', 'index']);
@@ -721,8 +738,10 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 			env = { ...env, GIT_EDITOR: options.messageEditor };
 		}
 
-		if (options?.updateRefs) {
+		if (options?.updateRefs === true) {
 			args.push('--update-refs');
+		} else if (options?.updateRefs === false) {
+			args.push('--no-update-refs');
 		}
 
 		if (options?.onto) {
@@ -735,6 +754,9 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 			args.push(options.branch);
 		}
 
+		// Fired before the process runs — `git rebase` exits 0 when stopping at `edit`/`break`,
+		// so the result can't be used to detect that a rebase started
+		this.context.hooks?.operations?.onRebaseCapableOperation?.(repoPath, 'rebase', 'started');
 		try {
 			await this.git.run(
 				// Avoid a timeout since rebases can take a long time (set to 0 to disable)
@@ -761,9 +783,12 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 					),
 			);
 			if (RebaseError.is(mapped, 'conflicts')) {
-				return this.createConflictResult(repoPath, 'rebase');
+				return await this.createConflictResult(repoPath, 'rebase');
 			}
 			throw mapped;
+		} finally {
+			// The command exited (success, pause, or failure) — any rebase it left behind is on disk now
+			this.context.hooks?.operations?.onRebaseCapableOperation?.(repoPath, 'rebase', 'ended');
 		}
 	}