@hienlh/ppm 0.9.85 → 0.9.87

package/260415-0932-git-graph-stash-rebase-conflicts/reports/code-reviewer-260415-1020-stash-rebase-conflicts.md

@@ -0,0 +1,288 @@
+# Code Review: Git Graph — Stash, Rebase, Conflicts
+
+**Date:** 2026-04-15  
+**Reviewer:** code-reviewer  
+**Scope:** 10 files changed, ~600 LOC net new
+
+## Scope
+
+| File | Role |
+|------|------|
+| `packages/ext-git-graph/src/types.ts` | Type definitions |
+| `packages/ext-git-graph/src/extension.ts` | Backend: stash/merge-state/conflict handlers |
+| `packages/ext-git-graph/src/webview-html.ts` | Webview: stash popover, merge banner, conflict UI |
+| `src/web/components/editor/conflict-editor.tsx` | NEW: Monaco conflict resolution editor |
+| `src/web/stores/tab-store.ts` | TabType union |
+| `src/web/stores/panel-utils.ts` | `deriveTabId` for conflict-editor |
+| `src/web/components/layout/editor-panel.tsx` | TAB_COMPONENTS registration |
+| `src/web/components/layout/tab-content.tsx` | TAB_COMPONENTS registration |
+| `src/web/components/layout/mobile-nav.tsx` | Icon mapping |
+| `src/web/components/layout/tab-bar.tsx` | Icon mapping |
+
+## Overall Assessment
+
+Well-structured feature addition. Security practices (assertSafeFilePaths, assertValidRef, escHtml) are consistently applied to the new surface area. Three blocking issues, four informational.
+
+---
+
+## Critical Issues
+
+### C1 — `detectMergeState` hardcodes `.git` path, breaks for worktrees
+
+**File:** `extension.ts:531-562`
+
+```typescript
+const rebaseMergeDir = `${projectPath}/.git/rebase-merge`;
+const checkMerge = await vscode.process.spawn("test", ["-f", `${projectPath}/.git/MERGE_HEAD`], ...);
+```
+
+For git worktrees, `.git` inside the worktree directory is a **file** (containing `gitdir: /path/to/main/.git/worktrees/<name>`), not a directory. The rebase/merge state is stored under `$GIT_DIR/rebase-merge`, where `$GIT_DIR` for a worktree is `<main>/.git/worktrees/<name>`. The current hardcoded path will always fail `test -d` / `test -f` for worktrees, silently returning `undefined` for `mergeState`.
+
+The PPM app already heavily uses worktrees (worktree CRUD is a major feature of this same extension). Merge conflicts inside a worktree will show files as conflicted but the banner will never appear.
+
+**Fix:** Use `git rev-parse --git-dir` to get the actual `GIT_DIR`, then construct paths from that:
+
+```typescript
+async function detectMergeState(vscode, projectPath) {
+  const gitDirResult = await spawnGit(vscode, ["rev-parse", "--git-dir"], projectPath, { timeout: 2000 });
+  if (gitDirResult.exitCode !== 0) return undefined;
+  const gitDir = gitDirResult.stdout.trim();
+  const absGitDir = gitDir.startsWith("/") ? gitDir : `${projectPath}/${gitDir}`;
+  
+  const checkRebase = await vscode.process.spawn("test", ["-d", `${absGitDir}/rebase-merge`], projectPath, { timeout: 2000 });
+  // ... rest of checks use absGitDir instead of `${projectPath}/.git`
+}
+```
+
+---
+
+### C2 — `getDisplayCommits` excludes virtual row for conflict-only state
+
+**File:** `webview-html.ts:1382-1383`
+
+```javascript
+function getDisplayCommits() {
+  const u = state.uncommitted;
+  if (!u || (u.staged.length === 0 && u.unstaged.length === 0)) return state.commits;
+  // virtual row only added if staged or unstaged files exist
+```
+
+When a merge conflict exists but no staged/unstaged changes (pure merge conflict during `git merge`), `conflicted.length > 0` but `staged.length === 0 && unstaged.length === 0`. The virtual uncommitted row is **not added to the commit list**. The user sees the merge banner but cannot click into the uncommitted detail panel to reach the conflict file list and the "open conflict editor" button.
+
+The conflict panel is properly rendered in `renderUncommittedDetail` (checks `u.conflicted`) but is unreachable because `selectCommit('uncommitted')` is only triggered by clicking the virtual row.
+
+**Fix:**
+
+```javascript
+if (!u || (u.staged.length === 0 && u.unstaged.length === 0 && (!u.conflicted || u.conflicted.length === 0))) 
+  return state.commits;
+```
+
+And update the virtual commit message:
+```javascript
+const totalFiles = u.staged.length + u.unstaged.length + (u.conflicted?.length || 0);
+message: `Uncommitted Changes (${totalFiles} files)${u.conflicted?.length ? ' ⚠ conflicts' : ''}`,
+```
+
+---
+
+### C3 — Style injection in `ConflictEditor.handleMount` is not idempotent
+
+**File:** `conflict-editor.tsx:286-301`
+
+```typescript
+const handleMount: OnMount = (editor, monaco) => {
+  // ...
+  const styleEl = document.createElement("style");
+  styleEl.textContent = `...conflict styles...`;
+  editor.getDomNode()?.ownerDocument?.head?.appendChild(styleEl);
+```
+
+`handleMount` fires each time the Monaco editor mounts. If the conflict editor tab is opened, closed, and reopened, the style tag accumulates in `<head>`. This doesn't cause broken behavior (CSS rules are idempotent) but leaks DOM nodes.
+
+**Fix:** Add an ID guard:
+```typescript
+const DOC_STYLE_ID = "conflict-editor-styles";
+if (!editor.getDomNode()?.ownerDocument?.getElementById(DOC_STYLE_ID)) {
+  const styleEl = document.createElement("style");
+  styleEl.id = DOC_STYLE_ID;
+  styleEl.textContent = `...`;
+  editor.getDomNode()?.ownerDocument?.head?.appendChild(styleEl);
+}
+```
+
+---
+
+## High Priority
+
+### H1 — Content widget removal uses an invalid fake object
+
+**File:** `conflict-editor.tsx:145-148`
+
+```typescript
+for (const wid of widgetIdsRef.current) {
+  const w = editor.getLayoutInfo() && { getId: () => wid } as MonacoType.editor.IContentWidget;
+  try { editor.removeContentWidget(w); } catch { /* ignore */ }
+}
+```
+
+`editor.getLayoutInfo()` always returns a truthy object when the editor is alive; `&&` effectively just evaluates to `{ getId: () => wid }`. Monaco's `removeContentWidget` accepts `IContentWidget`, which requires `getDomNode()` and `getPosition()` methods. Monaco's implementation internally looks up widgets by their ID string, so this happens to work — but it is type-unsafe and relies on Monaco's internal implementation detail.
+
+The silent `try/catch` hides any future Monaco version breaking this. The real widgets are never stored, so they cannot be properly removed.
+
+**Fix:** Store actual widget references:
+```typescript
+const widgetsRef = useRef<MonacoType.editor.IContentWidget[]>([]);
+
+// In refreshConflicts — removal:
+for (const w of widgetsRef.current) {
+  editor.removeContentWidget(w);
+}
+widgetsRef.current = [];
+
+// When adding:
+editor.addContentWidget(widget);
+widgetsRef.current.push(widget);
+```
+
+---
+
+### H2 — `ResizeObserver` re-subscribes unnecessarily on `loading`/`error` changes
+
+**File:** `conflict-editor.tsx:109-117`
+
+```typescript
+useEffect(() => {
+  const el = containerRef.current;
+  if (!el) return;
+  const ro = new ResizeObserver(...);
+  ro.observe(el);
+  return () => ro.disconnect();
+}, [loading, error]);  // ← problem
+```
+
+The dependency array `[loading, error]` causes the `ResizeObserver` to be torn down and recreated every time loading/error state changes. The intent is to observe after the container renders (post-loading). However, the container `<div ref={containerRef}>` is always mounted (it wraps the Monaco editor), so `containerRef.current` is stable. The correct approach is `[]` (observe once on mount):
+
+```typescript
+}, []);  // containerRef is stable; re-observe not needed on state changes
+```
+
+---
+
+## Medium Priority
+
+### M1 — `acceptConflict` resolves by region ID but re-parses the full file
+
+**File:** `conflict-editor.tsx:224-263`
+
+```typescript
+const acceptConflict = useCallback((regionId: number, ...) => {
+  const value = model.getValue();
+  const regions = parseConflicts(value);
+  const region = regions.find((r) => r.id === regionId);
+```
+
+Region IDs are assigned sequentially (0, 1, 2, ...) in `parseConflicts`. After resolving region `id=0`, the model is updated, then `refreshConflicts` re-parses — and the remaining regions are now renumbered starting from 0. If the user clicks "Accept Current" on region 1 (now rendered as `conflict-widget-1`), then resolves region 0 without refreshing, the ID lookup will still find the correct region because `acceptConflict` re-parses the current model state. This is actually correct.
+
+However, the `setTimeout(() => refreshConflicts(), 50)` is a fragile way to wait for model stabilization. Monaco's `pushEditOperations` is synchronous; the model is updated before the call returns. `refreshConflicts` can be called directly:
+
+```typescript
+saveFile(model.getValue());
+refreshConflicts(); // synchronous - no timeout needed
+```
+
+### M2 — Merge banner `action.includes('Abort')` is fragile string matching
+
+**File:** `webview-html.ts:927`
+
+```javascript
+const action = btn.dataset.mergeAction;
+if (action.includes('Abort')) {
+```
+
+This works for the current action names (`rebaseAbort`, `mergeAbort`, `cherryPickAbort`) but is fragile if new actions are added. Prefer an explicit set:
+
+```javascript
+const ABORT_ACTIONS = new Set(['rebaseAbort', 'mergeAbort', 'cherryPickAbort']);
+if (ABORT_ACTIONS.has(action)) {
+```
+
+### M3 — Stash popover and worktree popover do not close each other
+
+**File:** `webview-html.ts:763-764, 953-954`
+
+Two separate `document.addEventListener('click', ...)` handlers: one closes the worktree popover when clicking outside `.worktree-dropdown`, another closes the stash popover when clicking outside `.stash-dropdown`. But clicking the stash button while the worktree popover is open does NOT close the worktree popover (the stash button is inside `.stash-dropdown`, not `.worktree-dropdown`, so the worktree handler runs and closes it). Actually this works correctly by accident — the worktree click handler fires on every click and checks `closest('.worktree-dropdown')`.
+
+Testing shows this is fine, but it's worth adding a mutual close for clarity:
+```javascript
+btnStash.addEventListener('click', (e) => {
+  wtPopover.classList.add('hidden'); // close sibling
+  // ...
+});
+```
+
+---
+
+## Low Priority
+
+### L1 — `conflict-editor.tsx`: `filePath.split("/")` is not cross-platform
+
+**File:** `conflict-editor.tsx:306`
+
+```typescript
+const fileName = filePath?.split("/").pop() ?? "unknown";
+```
+
+On Windows paths use `\`. Prefer a regex: `.split(/[\\/]/).pop()`. (Consistent with the extension's existing pattern.)
+
+### L2 — Empty conflict resolution leaves a blank line
+
+When "Accept Current" or "Accept Incoming" is used on a conflict where one side is empty (e.g., `<<<<<<< HEAD\n=======\n>>>>>>> branch`), `replacement` = `""` and `text: "" + "\n"` inserts a single blank line. Minor but can leave stray newlines in the file. Low impact.
+
+### L3 — `parseConflicts` doesn't handle diff3-style conflicts
+
+`git` can be configured to use `diff3` style which adds a base section between `<<<` and `===`. The parser looks for `=======` but diff3 adds `||||||| base` between `<<<<` and `=====`. In diff3 mode, the parser would put the base content into `currentContent` and miss the real separator. Not broken but results in "Accept Current" keeping the diff3 base section too.
+
+---
+
+## Edge Cases Found
+
+1. **Conflict-only state (C2 above):** No virtual uncommitted row = no access to conflict file list. Blocking.
+2. **Worktree rebase detection (C1 above):** Hardcoded `.git/rebase-merge` fails for all worktrees.
+3. **Empty conflict sides:** Resolving an empty-vs-content conflict inserts a blank line (L2).
+4. **diff3 style conflicts:** Parser misidentifies `||||||| base` as current content (L3).
+5. **stash popover and worktree popover open simultaneously:** Both can be visible together until a click. Minor UX.
+
+---
+
+## Positive Observations
+
+- `assertSafeFilePaths` is applied to `openConflictFile` consistently.
+- `escHtml` is applied to all user-visible git data in the webview (stash messages, branch names, file paths).
+- `assertValidRef` correctly blocks the commit hash passed to `rebase` from the context menu (no injection possible).
+- Stash message parsing correctly handles pipe characters in stash messages via `.slice(2).join("|")`.
+- The 500-file limit in `handleUncommittedStatus` applies globally, preventing unbounded memory use.
+- ResizeObserver cleanup (`return () => ro.disconnect()`) is present.
+- Git stash index is always a safe integer (enforced by both parsing paths).
+- Stash drop/abort operations correctly use confirmation dialogs.
+- `rebaseContinue`/`rebaseAbort`/`mergeAbort` correctly added to `buildGitActionArgs` with no extra args needed (safe).
+
+---
+
+## Recommended Actions
+
+1. **[C1 — BLOCK]** Fix `detectMergeState` to use `git rev-parse --git-dir` before constructing paths.
+2. **[C2 — BLOCK]** Fix `getDisplayCommits` to include virtual row when `conflicted.length > 0`.
+3. **[C3 — BLOCK]** Add ID guard to style injection in `handleMount`.
+4. **[H1]** Store actual widget references instead of fake objects for `removeContentWidget`.
+5. **[H2]** Change ResizeObserver dependency to `[]`.
+6. **[M1]** Remove `setTimeout` before `refreshConflicts` call in `acceptConflict`.
+7. **[M2]** Replace `action.includes('Abort')` with a `Set` check.
+
+---
+
+## Unresolved Questions
+
+1. Is the git graph webview ever shown for a worktree project path? If not, C1 is lower priority, but the worktree feature exists so it should be assumed yes.
+2. Is diff3 conflict style expected to be supported? If users have `merge.conflictstyle=diff3` in their gitconfig, the parser will silently produce wrong results.
+3. Should "Accept Both" include a separator between current and incoming content? Some editors insert `--- current ---` / `--- incoming ---` comments when accepting both.

package/260415-0932-git-graph-stash-rebase-conflicts/reports/tester-260415-1020-build-check.md

@@ -0,0 +1,117 @@
+# Tester Report — Build & Test Check
+**Date:** 2026-04-15  
+**Scope:** git-graph extension + conflict editor component changes  
+**Mode:** Diff-aware
+
+---
+
+## Diff-Aware Mode
+
+Analyzed 10 changed files:
+
+**Changed:**
+- `packages/ext-git-graph/src/types.ts`
+- `packages/ext-git-graph/src/extension.ts`
+- `packages/ext-git-graph/src/webview-html.ts`
+- `src/web/components/editor/conflict-editor.tsx` (NEW)
+- `src/web/stores/tab-store.ts`
+- `src/web/stores/panel-utils.ts`
+- `src/web/components/layout/editor-panel.tsx`
+- `src/web/components/layout/tab-content.tsx`
+- `src/web/components/layout/mobile-nav.tsx`
+- `src/web/components/layout/tab-bar.tsx`
+
+**Mapped → Tests (Strategy A/Co-located):**
+- `packages/ext-git-graph/src/extension-parsers.test.ts`
+- `packages/ext-git-graph/src/git-log-parser.test.ts`
+- `packages/ext-git-graph/src/extension-integration.test.ts`
+- `packages/ext-git-graph/src/webview-html.test.ts`
+
+**Unmapped (no test files found):**
+- `src/web/components/editor/conflict-editor.tsx`
+- `src/web/stores/tab-store.ts`
+- `src/web/stores/panel-utils.ts`
+- `src/web/components/layout/editor-panel.tsx`
+- `src/web/components/layout/tab-content.tsx`
+- `src/web/components/layout/mobile-nav.tsx`
+- `src/web/components/layout/tab-bar.tsx`
+
+---
+
+## TypeScript Check
+
+**Result: PASS** — only 3 known pre-existing errors in:
+- `src/providers/claude-agent-sdk.ts` (TS2322 `"session_migrated"` type mismatch)
+- `src/services/upgrade.service.ts` (TS2532 x2, possibly undefined)
+
+**No new TypeScript errors introduced by the changes.**
+
+---
+
+## Build
+
+**Result: PASS** — `bun run build:web` succeeded in 851ms, 4314 modules transformed.
+
+Warnings (pre-existing, not new):
+- `[INEFFECTIVE_DYNAMIC_IMPORT]` for `keybindings-store.ts` and `settings-tab.tsx` — dynamic imports ineffective due to static imports elsewhere
+- Large chunks (>500kB): `index-D4xwwuhE.js` (544kB), `markdown-renderer` (794kB) — pre-existing
+
+Confirms `conflict-editor.tsx` was successfully bundled: `conflict-editor-BIAHaSMw.js` (6.89kB / 2.83kB gzip).
+
+---
+
+## Test Results
+
+**Diff-targeted (ext-git-graph):**
+```
+Ran 62 tests across 4 files — 62 pass, 0 fail [2.43s]
+```
+
+**Full suite:**
+```
+Ran 1587 tests across 99 files — 1569 pass, 5 fail [204.80s]
+```
+
+### Failing Tests (all pre-existing, unrelated to changed files)
+
+| Test | File | Duration | Root Cause |
+|------|------|----------|------------|
+| Cloud WS Client > queues messages when disconnected... | `tests/integration/cloud-ws-client.test.ts` | 3098ms | Timing/reconnect flakiness |
+| Cloud WS Client > invokes command handler on inbound command | `tests/integration/cloud-ws-client.test.ts` | 3071ms | Timing/reconnect flakiness |
+| Logs endpoint > GET /api/logs/recent returns last log lines | `tests/integration/api/server-health-logs.test.ts` | 1ms | Log file path issue |
+| Logs endpoint > GET /api/logs/recent redacts sensitive data | `tests/integration/api/server-health-logs.test.ts` | 0.25ms | Log file path issue |
+| Logs endpoint > GET /api/logs/recent returns empty when no log file | `tests/integration/api/server-health-logs.test.ts` | 0.3ms | Log file path issue |
+
+All 5 failures exist on `main` before these changes — none of those test files were modified by the current changeset.
+
+---
+
+## Coverage Gaps (Unmapped Files)
+
+[!] No tests found for `src/web/components/editor/conflict-editor.tsx` — NEW component with no test coverage. Consider adding tests for:
+- Conflict block parsing and rendering (ours/theirs/base sections)
+- "Accept ours / Accept theirs" action handlers
+- Keyboard navigation between conflict markers
+
+[!] No tests found for `src/web/stores/tab-store.ts` — critical state management with no unit tests. Consider:
+- Tab open/close/switch transitions
+- Conflict editor tab type handling
+
+[!] No tests found for `src/web/stores/panel-utils.ts`, `editor-panel.tsx`, `tab-content.tsx`, `mobile-nav.tsx`, `tab-bar.tsx` — consistent with project pattern (no frontend component tests exist).
+
+---
+
+## Summary
+
+| Check | Result |
+|-------|--------|
+| TypeScript (`bunx tsc --noEmit`) | PASS — no new errors |
+| Vite build (`bun run build:web`) | PASS |
+| ext-git-graph unit tests | 62/62 pass |
+| Full test suite | 1569/1574 pass (5 pre-existing failures) |
+
+---
+
+**Unresolved Questions:**
+1. The 2 `cloud-ws-client` failures are timing-sensitive — are they known flaky tests scheduled for fix?
+2. The 3 `server-health-logs` failures suggest log file path misconfiguration in test env — is this being tracked?

package/260415-1150-ext-silent-failure-debugging/reports/code-reviewer-260415-1159-ext-error-reporting-review.md

@@ -0,0 +1,205 @@
+# Code Review: Extension Error Reporting & Logging
+
+## Scope
+- **Files**: 7 (extension.service.ts, ws/extensions.ts, extension-store.ts, use-extension-ws.ts, extension-webview.tsx, extension-host-worker.ts, ext-git-graph/extension.ts)
+- **LOC changed**: ~270 additions across error tracking, toast notifications, breadcrumb logs, stash/conflict features
+- **Focus**: Error propagation, type safety, memory, race conditions, toast spam
+
+## Overall Assessment
+
+Solid improvement to extension debugging. The silent failure path is now surfaced end-to-end: activation errors stored server-side, sent to clients on connect and broadcast, displayed in webview UI with retry. Breadcrumb logs added at each layer. A few issues need attention.
+
+---
+
+## Critical Issues
+
+None found.
+
+---
+
+## High Priority
+
+### H1. Type bypass: `activationErrors` piggybacked outside `ExtServerMsg` union
+
+**Files**: `extensions.ts:78-79`, `use-extension-ws.ts:43-44`, `extension.service.ts:269-272`
+
+The `activationErrors` field is added to `contributions:update` messages via `Record<string, unknown>` or `(msg as any).activationErrors`, bypassing the `ExtServerMsg` discriminated union type. The type definition at `extension-messages.ts:54` does not include this field.
+
+**Impact**: Any future refactor touching `ExtServerMsg` won't catch this field. TypeScript provides zero safety on the consumer side. If the field name changes server-side, the client silently receives nothing.
+
+**Fix**: Extend the union member:
+```ts
+// extension-messages.ts
+| { type: "contributions:update"; contributions: ExtensionContributes; activationErrors?: Record<string, string> }
+```
+Then remove all `(msg as any).activationErrors` casts and `Record<string, unknown>` intermediate types.
+
+### H2. Toast spam on every `contributions:update` broadcast
+
+**File**: `use-extension-ws.ts:43-49`
+
+Every `contributions:update` with `activationErrors` fires `toast.error()` for each error entry. This message is broadcast on every `activate()` AND `deactivate()` call (both call `broadcastContributions()`). If 3 extensions fail on startup and then any extension activates/deactivates later, all 3 error toasts fire again.
+
+**Impact**: Users see repeated error toasts for errors they already acknowledged. With N failing extensions and M subsequent operations, toast count = N * M.
+
+**Fix**: Track which errors have already been toasted (e.g., compare previous `activationErrors` keys before showing new toasts):
+```ts
+case "contributions:update":
+  store.setContributions(msg.contributions);
+  if (msg.activationErrors) {
+    const prev = store.activationErrors;
+    const errors = msg.activationErrors;
+    store.setActivationErrors(errors);
+    // Only toast NEW errors
+    for (const [extId, error] of Object.entries(errors)) {
+      if (!prev[extId]) {
+        toast.error(`Extension "${extId}" failed to activate: ${error}`);
+      }
+    }
+  }
+  break;
+```
+
+### H3. `activationErrors` Map never cleared on `terminateWorker()` / `shutdown()`
+
+**File**: `extension.service.ts:55-63`
+
+`terminateWorker()` clears `activatedIds`, `extensionPaths`, `bundledIds` but not `activationErrors`. After a shutdown + restart cycle, stale errors from the previous session persist and get broadcast to new clients.
+
+**Fix**: Add `this.activationErrors.clear()` inside `terminateWorker()`.
+
+---
+
+## Medium Priority
+
+### M1. Retry loop fires commands indefinitely until panel appears
+
+**File**: `extension-webview.tsx:86-94`
+
+The `setInterval` fires `ext:command:execute` every 2 seconds with no upper bound (except the 10s timeout that just shows an error message, but does NOT stop the interval). The cleanup function only runs on unmount or dependency change (`[panel, viewType, projectName]`).
+
+If the extension is broken (e.g., activation failed), this dispatches a command every 2s forever while the tab is open.
+
+**Impact**: Wasted network/CPU; if the command triggers server-side side effects (e.g., webview creation), could cause resource leaks.
+
+**Fix**: Cap retries (e.g., 5 attempts) or clear the interval when `timedOut` becomes true:
+```ts
+let attempts = 0;
+const retryTimer = setInterval(() => {
+  if (!cancelled && attempts++ < 5) attempt();
+  else clearInterval(retryTimer);
+}, 2_000);
+```
+
+### M2. `activationError` matching in extension-webview.tsx is fragile
+
+**File**: `extension-webview.tsx:122-128`
+
+```ts
+if (extId.includes(viewType) || viewType.includes(extId.replace(/^ext-/, "")))
+```
+
+This substring matching can produce false positives. Example: viewType `"graph"` would match extId `"ext-git-graph"` and also hypothetically `"ext-graph-viz"`, `"ext-photography"`. Also, an extId like `"ext-editor"` stripped to `"editor"` would match a viewType of `"editor-settings"`.
+
+**Fix**: Use exact matching or a registry-based lookup:
+```ts
+const extensionId = metadata?.extensionId as string | undefined;
+const activationError = useExtensionStore((s) =>
+  extensionId ? s.activationErrors[extensionId] : undefined
+);
+```
+
+### M3. `detectMergeState` path construction not Windows-safe
+
+**File**: `ext-git-graph/extension.ts:543`
+
+```ts
+if (!gitDir.startsWith("/")) gitDir = `${projectPath}/${gitDir}`;
+```
+
+On Windows, git returns paths with backslashes or drive letters (e.g., `C:\...`). The `startsWith("/")` check fails. String concatenation with `/` produces mixed separators.
+
+Per project memory (`feedback_cross_platform_paths.md`): file/path features must work on Windows too.
+
+**Fix**: Use `path.resolve()` or `path.isAbsolute()`:
+```ts
+const path = require("path");
+if (!path.isAbsolute(gitDir)) gitDir = path.resolve(projectPath, gitDir);
+```
+
+### M4. `getActivationErrors()` returns mutable reference
+
+**File**: `extension.service.ts:263`
+
+```ts
+getActivationErrors(): Map<string, string> { return this.activationErrors; }
+```
+
+Callers (ws/extensions.ts) get a direct reference to the internal Map. If any consumer mutates it, the service state is corrupted silently.
+
+**Fix**: Return a snapshot:
+```ts
+getActivationErrors(): Map<string, string> { return new Map(this.activationErrors); }
+```
+
+---
+
+## Low Priority
+
+### L1. `broadcastExtMsg` type mismatch with `Record<string, unknown>`
+
+**File**: `extensions.ts:78-80`
+
+`readyMsg` is typed as `Record<string, unknown>` but passed to `ws.send(JSON.stringify(readyMsg))` directly, bypassing the `broadcastExtMsg(msg: ExtServerMsg)` type check. This is consistent with the H1 issue -- fixing H1 resolves this.
+
+### L2. Error messages in command:execute notifications could leak internal paths
+
+**File**: `extensions.ts:98, 112-116`
+
+`result?.error` and `e.message` are sent directly to browser clients. These can contain stack traces with server file paths (e.g., `/Users/hienlh/Projects/ppm/...`).
+
+**Fix**: Truncate or sanitize error messages before broadcasting:
+```ts
+const safeMsg = (msg: string) => msg.split('\n')[0].slice(0, 200);
+```
+
+### L3. `broadcastExtMsg` used for command errors sends to ALL clients
+
+**File**: `extensions.ts:94-116`
+
+When one client's command fails, the error notification is broadcast to all connected clients via `broadcastExtMsg`. Only the requesting client should see the error.
+
+**Fix**: Send error only to the requesting socket:
+```ts
+ws.send(JSON.stringify({ type: "notification", ... }));
+```
+
+---
+
+## Positive Observations
+
+1. **Breadcrumb logging** at each layer (ExtService, ExtHost, ExtWS, extension) creates clear trail for debugging
+2. **Activation error storage** with Map allows per-extension tracking and clearing on successful retry
+3. **Error display in webview** with retry button is good UX -- users get actionable feedback
+4. **Existing security**: `assertSafeFilePaths` properly validates all user-supplied paths in git-graph
+5. **Timeout handling** in activation (10s in worker) and webview loading (10s in UI) prevents indefinite hangs
+6. **Stash and conflict detection** implementations are clean and well-structured
+
+---
+
+## Recommended Actions (Priority Order)
+
+1. **[H1]** Add `activationErrors?` to `ExtServerMsg` type union, remove `as any` casts
+2. **[H2]** Deduplicate toasts by tracking previously shown errors
+3. **[H3]** Clear `activationErrors` in `terminateWorker()`
+4. **[M1]** Cap retry attempts in extension-webview reload loop
+5. **[M2]** Use exact extension ID matching instead of substring
+6. **[M3]** Fix Windows path handling in `detectMergeState`
+7. **[M4]** Return Map copy from `getActivationErrors()`
+
+---
+
+## Unresolved Questions
+
+- Is there an intentional reason `activationErrors` is not part of the `ExtServerMsg` type? If so, document the rationale.
+- Should `activationErrors` be cleared when an extension is uninstalled/removed? Currently `remove()` calls `deactivate()` but doesn't touch `activationErrors`.