@loicngr/kobo 1.11.26 → 1.11.28

package/dist/server/routes/workspaces.js

@@ -44,6 +44,7 @@ import * as gitOps from '../utils/git-ops.js';
 import { logError } from '../utils/logger.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
 import * as safePath from '../utils/safe-path.js';
+import { resolveExtractedName } from '../utils/workspace-name.js';
 import { resolveSiblingWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 /** Hono sub-router for workspace CRUD, tasks, agent lifecycle, git operations, and PR creation. */
 const app = new Hono();
@@ -231,26 +232,6 @@ function parsePrNumberFromUrl(prUrl) {
     }
     return number;
 }
-// Mirrors the private `WORKSPACE_NAME_MAX_LENGTH` in workspace-service.ts —
-// duplicated rather than exported to avoid coupling this route to that
-// module's internals (and the many `vi.mock(workspace-service.js, factory)`
-// test files that would otherwise need updating for an export nothing else
-// consumes).
-const WORKSPACE_NAME_MAX_LENGTH = 200;
-/**
- * Cap an auto-derived title (Notion page title, Sentry issue title, PR/MR
- * title) before handing it to `updateWorkspaceName`. That function throws on
- * anything longer — the right behaviour for a name the user typed
- * themselves, but titles pulled from an external source (a long exception
- * message, a verbose PR title) are not user input: truncating them is the
- * sane default, matching the existing `slugifyBranchSegment` precedent for
- * auto-derived branch names.
- */
-function truncateWorkspaceName(name) {
-    if (name.length <= WORKSPACE_NAME_MAX_LENGTH)
-        return name;
-    return `${name.slice(0, WORKSPACE_NAME_MAX_LENGTH - 1)}…`;
-}
 app.get('/', (c) => {
     try {
         const workspaces = workspaceService.listWorkspaces();
@@ -265,7 +246,7 @@ app.get('/', (c) => {
 app.post('/:id/engine-handoff-preview', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         const workspace = workspaceService.getWorkspaceWithTasks(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -282,7 +263,9 @@ app.post('/:id/engine-handoff-preview', migrationGuard, async (c) => {
 app.post('/:id/switch-engine', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         const workspace = workspaceService.getWorkspaceWithTasks(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -340,7 +323,9 @@ app.post('/', migrationGuard, async (c) => {
     // can read it to decide whether the setup-script caveat applies.
     let setupScriptConfigured = false;
     try {
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         // workingBranch is derived from git when worktreePath is provided, so
         // it's not required in that flow. The other 3 fields stay mandatory.
         if (!body.name || !body.projectPath || !body.sourceBranch) {
@@ -357,6 +342,14 @@ app.post('/', migrationGuard, async (c) => {
         if (body.workingBranch && !gitOps.isValidBranchName(body.workingBranch)) {
             return c.json({ error: `Invalid working branch name: ${body.workingBranch}` }, 400);
         }
+        // Same reasoning for the source branch, which is always caller-supplied and
+        // reaches `git fetch <remote> <sourceBranch>` as a bare argument.
+        if (!gitOps.isValidBranchName(body.sourceBranch)) {
+            return c.json({ error: `Invalid source branch name: ${body.sourceBranch}` }, 400);
+        }
+        if (body.comparisonId !== undefined && typeof body.comparisonId !== 'string') {
+            return c.json({ error: 'comparisonId must be a string' }, 400);
+        }
         creationId = typeof body.creationId === 'string' && body.creationId.length > 0 ? body.creationId : undefined;
         currentStep = 'validate';
         emitCreateProgress(creationId, currentStep);
@@ -397,7 +390,7 @@ app.post('/', migrationGuard, async (c) => {
         let baseRef = `origin/${body.sourceBranch}`;
         let usedLocalFallback = false;
         try {
-            gitOps.fetchSourceBranch(body.projectPath, body.sourceBranch);
+            await gitOps.fetchSourceBranchOrThrowAsync(body.projectPath, body.sourceBranch);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -603,7 +596,13 @@ app.post('/', migrationGuard, async (c) => {
                     .replace(/^-|-$/g, '')
                     .substring(0, 50);
                 const safeSlug = titleSlug || 'task';
-                workingBranch = ticketPrefix ? `${typePrefix}${ticketPrefix}--${safeSlug}` : `${typePrefix}${safeSlug}`;
+                // An engine comparison posts here once per engine with the same
+                // ticket: without the suffix both halves collapse onto one branch and
+                // the second gets a random hash instead of its engine.
+                const engineSuffix = body.comparisonId && body.engine ? `-${body.engine}` : '';
+                workingBranch = ticketPrefix
+                    ? `${typePrefix}${ticketPrefix}--${safeSlug}${engineSuffix}`
+                    : `${typePrefix}${safeSlug}${engineSuffix}`;
             }
         }
         // Compute the project slug once and reuse it for both the prospective
@@ -661,6 +660,9 @@ app.post('/', migrationGuard, async (c) => {
             reasoningEffort: body.reasoningEffort,
             agentPermissionMode: resolveCreateAgentPermissionMode(body.agentPermissionMode, body.projectPath, globalSettings, body.engine ?? 'claude-code'),
             engine: body.engine,
+            // Set by the engine-comparison flow, which posts here once per engine
+            // with the same id so the resulting workspaces can find each other.
+            comparisonId: body.comparisonId,
             ...(useReusedWorktree ? {} : { worktreesPath: globalSettings.worktreesPath }),
         });
         createdWorkspace = workspace;
@@ -706,9 +708,11 @@ app.post('/', migrationGuard, async (c) => {
         // a custom name and Notion hasn't already filled it. Prefix with the Sentry
         // short-id (e.g. "SEKUR-IOS-9 | TypeError: …") so the workspace stays
         // identifiable in the sidebar without opening the panel.
-        if (sentryContent?.title && !notionContent?.title && workspace.name === 'workspace') {
+        if (sentryContent?.title && !notionContent?.title) {
             const prefix = sentryContent.issueId ? `${sentryContent.issueId} | ` : '';
-            workspace = workspaceService.updateWorkspaceName(workspace.id, truncateWorkspaceName(`${prefix}${sentryContent.title}`));
+            const renamed = resolveExtractedName(workspace.name, `${prefix}${sentryContent.title}`);
+            if (renamed)
+                workspace = workspaceService.updateWorkspaceName(workspace.id, renamed);
         }
         currentStep = 'create-tasks';
         emitCreateProgress(creationId, currentStep);
@@ -732,16 +736,20 @@ app.post('/', migrationGuard, async (c) => {
             // Update workspace name with Notion page title only if user didn't
             // provide a custom name. Prefix with the Notion unique-id (e.g.
             // Use the Notion page title when the user left the generic placeholder.
-            if (notionContent.title && workspace.name === 'workspace') {
-                workspace = workspaceService.updateWorkspaceName(workspace.id, truncateWorkspaceName(notionContent.title));
+            if (notionContent.title) {
+                const renamed = resolveExtractedName(workspace.name, notionContent.title);
+                if (renamed)
+                    workspace = workspaceService.updateWorkspaceName(workspace.id, renamed);
             }
         }
         // Update workspace name with the PR/MR title if the user did not provide
         // a custom name and neither Notion nor Sentry already claimed it. This
         // makes the PR a THIRD context source, lowest priority of the three
         // (Notion > Sentry > PR), consistent with the checks above.
-        if (prContent && !notionContent?.title && !sentryContent?.title && workspace.name === 'workspace') {
-            workspace = workspaceService.updateWorkspaceName(workspace.id, truncateWorkspaceName(prContent.title));
+        if (prContent && !notionContent?.title && !sentryContent?.title) {
+            const renamed = resolveExtractedName(workspace.name, prContent.title);
+            if (renamed)
+                workspace = workspaceService.updateWorkspaceName(workspace.id, renamed);
         }
         // Create manual tasks/criteria if no Notion content was extracted
         if (!notionContent && (Array.isArray(body.tasks) || Array.isArray(body.acceptanceCriteria))) {
@@ -814,6 +822,11 @@ app.post('/', migrationGuard, async (c) => {
                 ['.ai/thoughts/', 'thoughts/'],
                 ['.ai/images/', 'images/'],
                 ['.ai/.setup-script.tmp', '.setup-script.tmp'],
+                ['.ai/.cleanup-script.tmp', '.cleanup-script.tmp'],
+                ['.ai/.archive-script.tmp', '.archive-script.tmp'],
+                // A crash mid-hook leaves the temp script behind; the next agent
+                // would otherwise happily commit it.
+                ['.ai/.hook-*.tmp', '.hook-*.tmp'],
                 ['.mcp.json', ''],
             ];
             const toAdd = [];
@@ -1401,6 +1414,31 @@ app.get('/info', (c) => {
         return c.json({ error: message }, 500);
     }
 });
+// GET /api/workspaces/:id/comparison — the workspaces running the same task on
+// another engine, with the diff each one produced. Reads the git-stats cache the
+// pr-watcher already maintains rather than shelling out to git twice per request.
+app.get('/:id/comparison', (c) => {
+    const id = c.req.param('id');
+    try {
+        const workspace = workspaceService.getWorkspace(id);
+        if (!workspace)
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        if (!workspace.comparisonId)
+            return c.json({ comparisonId: null, members: [] });
+        const stats = getAllGitStats();
+        const members = workspaceService.listComparisonMembers(workspace.comparisonId).map((member) => ({
+            workspace: member,
+            // Null, not zeros: "not measured yet" and "changed nothing" are
+            // different answers, and only one of them is true here.
+            gitStats: stats[member.id] ?? null,
+        }));
+        return c.json({ comparisonId: workspace.comparisonId, members });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ error: message }, 500);
+    }
+});
 // POST /api/workspaces/pr-snapshot/refresh/:id — on-demand refresh of a single
 // workspace's PR snapshot, driven by the Git tab refresh button. Static prefix
 // keeps it ahead of `/:id` in the Hono matcher.
@@ -1458,7 +1496,13 @@ app.get('/auto-loop-states', (c) => {
 // GET /api/workspaces/:id/auto-loop — current auto-loop status for one workspace.
 app.get('/:id/auto-loop', (c) => {
     try {
-        return c.json(autoLoopService.getStatus(c.req.param('id')));
+        const id = c.req.param('id');
+        // getStatus returns a default row for an unknown id, so without this the
+        // caller gets a cheerful `auto_loop: false` for a workspace that does not
+        // exist — the neighbouring handlers all 404.
+        if (!workspaceService.getWorkspace(id))
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        return c.json(autoLoopService.getStatus(id));
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -1821,13 +1865,18 @@ app.delete('/:id/events/:eventId', (c) => {
         const db = getDb();
         // Capture the session BEFORE deleting: since v36 there is no AFTER DELETE
         // trigger, so the metrics of that session must be recomputed once, here.
-        const row = db
-            .prepare('SELECT session_id FROM ws_events WHERE id = ? AND workspace_id = ?')
-            .get(eventId, workspaceId);
-        db.prepare('DELETE FROM ws_events WHERE id = ? AND workspace_id = ?').run(eventId, workspaceId);
-        if (row?.session_id) {
-            workspaceService.recomputeSessionMetrics(workspaceId, row.session_id);
-        }
+        // Transactional for the same reason deleteSession is: a crash between the
+        // delete and the recompute must not leave stale metrics behind.
+        const transaction = db.transaction(() => {
+            const row = db
+                .prepare('SELECT session_id FROM ws_events WHERE id = ? AND workspace_id = ?')
+                .get(eventId, workspaceId);
+            db.prepare('DELETE FROM ws_events WHERE id = ? AND workspace_id = ?').run(eventId, workspaceId);
+            if (row?.session_id) {
+                workspaceService.recomputeSessionMetrics(workspaceId, row.session_id);
+            }
+        });
+        transaction();
         return c.json({ ok: true });
     }
     catch (err) {
@@ -1843,7 +1892,9 @@ app.post('/:id/tasks', async (c) => {
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         if (!body.title?.trim()) {
             return c.json({ error: 'Title is required' }, 400);
         }
@@ -1874,7 +1925,9 @@ app.patch('/:id/tasks/:taskId', async (c) => {
         if (!task) {
             return c.json({ error: `Task '${taskId}' not found in workspace '${id}'` }, 404);
         }
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         if (body.status === undefined && body.title === undefined) {
             return c.json({ error: 'At least one of status or title is required' }, 400);
         }
@@ -1992,6 +2045,10 @@ app.post('/:id/tasks/:taskId/notify-done', (c) => {
         return c.json({ error: message }, 500);
     }
 });
+// Cap how many recent rows one search may scan: the LIKE below cannot use an
+// index past the workspace_id prefix, and better-sqlite3 is synchronous — an
+// unbounded scan of a months-old workspace blocks every request and WS emit.
+const HISTORY_SEARCH_SCAN_CAP = 20_000;
 // GET /api/workspaces/:id/history-search — full-workspace persisted conversation search.
 app.get('/:id/history-search', (c) => {
     try {
@@ -2004,10 +2061,13 @@ app.get('/:id/history-search', (c) => {
         const limit = Math.min(parseInt(c.req.query('limit') ?? '30', 10) || 30, 100);
         const needle = `%${query.replace(/[%_]/g, '\\$&')}%`;
         const rows = getDb()
-            .prepare(`SELECT id, session_id, type, payload, created_at FROM ws_events
-         WHERE workspace_id = ? AND payload LIKE ? ESCAPE '\\'
-         ORDER BY rowid DESC LIMIT ?`)
-            .all(id, needle, limit * 4);
+            .prepare(`SELECT id, session_id, type, payload, created_at FROM (
+           SELECT rowid AS rid, id, session_id, type, payload, created_at FROM ws_events
+           WHERE workspace_id = ? ORDER BY rowid DESC LIMIT ?
+         )
+         WHERE payload LIKE ? ESCAPE '\\'
+         ORDER BY rid DESC LIMIT ?`)
+            .all(id, HISTORY_SEARCH_SCAN_CAP, needle, limit * 4);
         const normalized = rows.flatMap((row) => {
             const result = readableHistorySearchResult(row.type, row.payload, query);
             if (!result)
@@ -2063,6 +2123,59 @@ function readableHistorySearchResult(type, rawPayload, query) {
         snippet: `${start > 0 ? '…' : ''}${text.slice(start, end).replace(/\s+/g, ' ').trim()}${end < text.length ? '…' : ''}`,
     };
 }
+/**
+ * GET /api/workspaces/:id/sessions/:sessionId/summary — why a session ended.
+ *
+ * A session can stop for many reasons (quota, transient failure, drain
+ * watchdog, auto-loop stall, failed resume, manual stop, natural end) and none
+ * of them were legible after the fact: you had to read the event feed to work
+ * out what happened overnight. Everything here is already collected —
+ * `agent_sessions` and `session_event_metrics` — it was just never put in one
+ * place. Note that `end_reason` itself only records four values (completed /
+ * error / killed / watchdog); quota, stall and failed resume are visible
+ * through the workspace status and the auto-loop events, not through it.
+ */
+app.get('/:id/sessions/:sessionId/summary', (c) => {
+    try {
+        const id = c.req.param('id');
+        const sessionId = c.req.param('sessionId');
+        if (!workspaceService.getWorkspace(id))
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        const db = getDb();
+        const session = db
+            .prepare(`SELECT id, engine, model, status, end_reason, started_at, ended_at
+           FROM agent_sessions WHERE id = ? AND workspace_id = ?`)
+            .get(sessionId, id);
+        if (!session)
+            return c.json({ error: `Session '${sessionId}' not found` }, 404);
+        const metrics = db
+            .prepare(`SELECT tool_calls, errors, input_tokens, output_tokens
+           FROM session_event_metrics WHERE workspace_id = ? AND session_id = ?`)
+            .get(id, sessionId);
+        const startedAt = Date.parse(session.started_at);
+        const endedAt = session.ended_at ? Date.parse(session.ended_at) : null;
+        return c.json({
+            sessionId: session.id,
+            engine: session.engine,
+            model: session.model,
+            status: session.status,
+            // Null for sessions that ended before this was recorded, and for one
+            // still running. The client says "unknown" rather than inventing a cause.
+            endReason: session.end_reason,
+            startedAt: session.started_at,
+            endedAt: session.ended_at,
+            durationMs: endedAt !== null && !Number.isNaN(startedAt) ? endedAt - startedAt : null,
+            toolCalls: metrics?.tool_calls ?? 0,
+            errors: metrics?.errors ?? 0,
+            inputTokens: metrics?.input_tokens ?? 0,
+            outputTokens: metrics?.output_tokens ?? 0,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ error: message }, 500);
+    }
+});
 // GET /api/workspaces/:id/session-metrics — compact observability data for the timeline.
 app.get('/:id/session-metrics', (c) => {
     try {
@@ -2106,15 +2219,22 @@ app.get('/:id/diagnostic.json', (c) => {
         const sessions = db
             .prepare('SELECT id, engine_session_id, status, started_at, ended_at, model, name FROM agent_sessions WHERE workspace_id = ? ORDER BY started_at ASC')
             .all(id);
+        // Bounded on purpose: better-sqlite3 is synchronous, so an unbounded read
+        // materialises every event the workspace ever produced and blocks the
+        // event loop while `c.json` serialises them. A diagnostic bundle wants a
+        // representative trace, not the entire history.
+        const DIAGNOSTIC_EVENT_LIMIT = 50_000;
         const events = db
-            .prepare('SELECT id, session_id, type, created_at FROM ws_events WHERE workspace_id = ? ORDER BY rowid ASC')
-            .all(id);
+            .prepare('SELECT id, session_id, type, created_at FROM ws_events WHERE workspace_id = ? ORDER BY rowid ASC LIMIT ?')
+            .all(id, DIAGNOSTIC_EVENT_LIMIT);
+        const eventsTruncated = events.length === DIAGNOSTIC_EVENT_LIMIT;
         c.header('Content-Disposition', `attachment; filename="${workspace.name.replace(/[^a-z0-9]+/gi, '-').toLowerCase() || id}-diagnostic.json"`);
         return c.json({
             generatedAt: new Date().toISOString(),
             workspace: { id, name: workspace.name, engine: workspace.engine },
             sessions,
             events,
+            eventsTruncated,
         });
     }
     catch (err) {
@@ -2206,21 +2326,24 @@ app.get('/:id/events', (c) => {
                 if (firstRow) {
                     const older = session
                         ? db
-                            .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) AND rowid < ?')
+                            .prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) AND rowid < ? LIMIT 1')
                             .get(id, session, firstRow.rowid)
                         : db
-                            .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND rowid < ?')
+                            .prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? AND rowid < ? LIMIT 1')
                             .get(id, firstRow.rowid);
-                    hasMore = older.c > 0;
+                    hasMore = older !== undefined;
                 }
             }
             else {
-                const total = session
+                // `LIMIT 1 OFFSET <page size>` answers "is there anything past this
+                // page?" by reading one row, where COUNT(*) walked every event the
+                // workspace ever produced — on each page, synchronously.
+                const beyond = session
                     ? db
-                        .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL)')
-                        .get(id, session)
-                    : db.prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ?').get(id);
-                hasMore = total.c > rows.length;
+                        .prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) LIMIT 1 OFFSET ?')
+                        .get(id, session, rows.length)
+                    : db.prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? LIMIT 1 OFFSET ?').get(id, rows.length);
+                hasMore = beyond !== undefined;
             }
         }
         return c.json({ events, hasMore });
@@ -2415,7 +2538,7 @@ app.delete('/:id/pr-watch-disabled', async (c) => {
 app.put('/:id/tags', async (c) => {
     const { id } = c.req.param();
     try {
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!Array.isArray(body.tags)) {
             return c.json({ error: 'tags must be an array of strings' }, 400);
         }
@@ -2652,26 +2775,31 @@ app.post('/:id/run-setup-script', async (c) => {
         if (setupScriptRunning.has(id)) {
             return c.json({ error: 'Setup script is already running for this workspace' }, 409);
         }
-        // Stop the running agent before re-running the setup script — the script
-        // rewrites the worktree the agent may still be writing to.
-        try {
-            if (agentManager.getAgentStatus(id)) {
-                await agentManager.stopAgentAndWait(id);
-            }
-        }
-        catch (err) {
-            console.error(`[workspaces] stopAgentAndWait before setup script failed for '${id}':`, err);
-        }
-        const effectiveSettings = settingsService.getEffectiveSettings(workspace.projectPath);
-        if (!effectiveSettings.setupScript) {
-            return c.json({ error: 'No setup script configured' }, 400);
-        }
-        const worktreePath = workspace.worktreePath;
-        if (!fs.existsSync(worktreePath)) {
-            return c.json({ error: `Worktree path does not exist: ${worktreePath}` }, 400);
-        }
+        // Claim before the first await. Checking here and claiming after the agent
+        // stop below let two concurrent calls both pass the check and then run the
+        // user's script twice, concurrently, in the same worktree.
         setupScriptRunning.add(id);
+        // Everything below releases the claim, including the validation failures:
+        // a workspace left marked as running would refuse every later attempt.
         try {
+            // Stop the running agent before re-running the setup script — the script
+            // rewrites the worktree the agent may still be writing to.
+            try {
+                if (agentManager.getAgentStatus(id)) {
+                    await agentManager.stopAgentAndWait(id);
+                }
+            }
+            catch (err) {
+                console.error(`[workspaces] stopAgentAndWait before setup script failed for '${id}':`, err);
+            }
+            const effectiveSettings = settingsService.getEffectiveSettings(workspace.projectPath);
+            if (!effectiveSettings.setupScript) {
+                return c.json({ error: 'No setup script configured' }, 400);
+            }
+            const worktreePath = workspace.worktreePath;
+            if (!fs.existsSync(worktreePath)) {
+                return c.json({ error: `Worktree path does not exist: ${worktreePath}` }, 400);
+            }
             const result = await runSetupScript(workspace.id, worktreePath, effectiveSettings.setupScript, {
                 workspaceName: workspace.name,
                 branchName: workspace.workingBranch,
@@ -2790,7 +2918,7 @@ async function deleteWorkspaceWithSideEffects(workspace, opts) {
     // a few lines below: firing and forgetting here pulled the directory from
     // under an agent still writing to it, destroying uncommitted work.
     try {
-        await agentManager.stopAgentAndWait(workspace.id);
+        await agentManager.stopAgentAndWait(workspace.id, undefined, 'delete');
     }
     catch (err) {
         console.error(`[workspaces] stopAgentAndWait during delete failed for '${workspace.name}':`, err);
@@ -2866,6 +2994,11 @@ async function deleteWorkspaceWithSideEffects(workspace, opts) {
     }
     // Delete workspace from DB (cascades to tasks, sessions, events)
     workspaceService.deleteWorkspace(workspace.id);
+    // Announce the deletion so any other tab with this workspace open (or a
+    // live terminal attached to it) can react — mirrors workspace:archived's
+    // cross-tab-sync purpose. Ephemeral: a deleted workspace has no future
+    // ws_events history to replay, so persisting this would be pointless.
+    wsService.emitEphemeral(workspace.id, 'workspace:deleted', { workspaceId: workspace.id });
     return warnings;
 }
 // DELETE /api/workspaces/archived — bulk-delete every archived workspace.
@@ -3168,7 +3301,7 @@ app.post('/:id/rollback-file', async (c) => {
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         const filePath = typeof body?.path === 'string' ? body.path.trim() : '';
         if (!filePath) {
             return c.json({ error: 'Missing or invalid `path` field' }, 400);
@@ -3410,10 +3543,10 @@ app.post('/:id/push', async (c) => {
             // no-options call shape identical to before for callers/tests that
             // assert on argument count.
             if (force) {
-                gitOps.pushBranch(worktreePath, workspace.workingBranch, { force: true });
+                await gitOps.pushBranchAsync(worktreePath, workspace.workingBranch, { force: true });
             }
             else {
-                gitOps.pushBranch(worktreePath, workspace.workingBranch);
+                await gitOps.pushBranchAsync(worktreePath, workspace.workingBranch);
             }
         }
         catch (err) {
@@ -3432,14 +3565,14 @@ app.post('/:id/push', async (c) => {
 });
 // POST /api/workspaces/:id/fetch — git fetch the workspace repo (all branches of origin).
 // Read-only: updates remote-tracking refs, never touches the working tree.
-app.post('/:id/fetch', (c) => {
+app.post('/:id/fetch', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
-        gitOps.fetchAllBranches(workspace.worktreePath);
+        await gitOps.fetchAllBranchesAsync(workspace.worktreePath);
         return c.json({ ok: true });
     }
     catch (err) {
@@ -3448,7 +3581,7 @@ app.post('/:id/fetch', (c) => {
     }
 });
 // POST /api/workspaces/:id/pull — pull working branch from origin (fast-forward only)
-app.post('/:id/pull', (c) => {
+app.post('/:id/pull', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -3458,7 +3591,7 @@ app.post('/:id/pull', (c) => {
         const worktreePath = workspace.worktreePath;
         const autostash = c.req.query('autostash') === '1';
         try {
-            gitOps.pullBranch(worktreePath, workspace.workingBranch, 'origin', { autostash });
+            await gitOps.pullBranchAsync(worktreePath, workspace.workingBranch, 'origin', { autostash });
         }
         catch (err) {
             if (err instanceof gitOps.DirtyWorktreeError) {
@@ -3478,7 +3611,7 @@ app.post('/:id/pull', (c) => {
     }
 });
 /** Rebase the workspace branch onto its source branch. */
-app.post('/:id/rebase', (c) => {
+app.post('/:id/rebase', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -3486,7 +3619,7 @@ app.post('/:id/rebase', (c) => {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         const autostash = c.req.query('autostash') === '1';
         const worktreePath = workspace.worktreePath;
-        gitOps.rebaseBranch(worktreePath, workspace.sourceBranch, { autostash });
+        await gitOps.rebaseBranchAsync(worktreePath, workspace.sourceBranch, { autostash });
         return c.json({ success: true });
     }
     catch (err) {
@@ -3501,7 +3634,7 @@ app.post('/:id/rebase', (c) => {
     }
 });
 /** Merge the source branch into the workspace branch (non-fast-forward). */
-app.post('/:id/merge', (c) => {
+app.post('/:id/merge', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -3509,7 +3642,7 @@ app.post('/:id/merge', (c) => {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         const autostash = c.req.query('autostash') === '1';
         const worktreePath = workspace.worktreePath;
-        gitOps.mergeBranch(worktreePath, workspace.sourceBranch, { autostash });
+        await gitOps.mergeBranchAsync(worktreePath, workspace.sourceBranch, { autostash });
         return c.json({ success: true });
     }
     catch (err) {
@@ -3702,9 +3835,14 @@ Start now.`;
 app.post('/:id/change-pr-base', async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.base)
             return c.json({ error: 'Missing base parameter' }, 400);
+        // Forwarded to `gh pr edit --base <base>` / the GitLab equivalent, so a
+        // name starting with `-` would read as a CLI option rather than a branch.
+        if (!gitOps.isValidBranchName(body.base)) {
+            return c.json({ error: `Invalid base branch name: ${body.base}` }, 400);
+        }
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -3797,9 +3935,14 @@ app.post('/:id/change-source-branch', async (c) => {
     const id = c.req.param('id');
     const workspace = workspaceService.getWorkspace(id);
     try {
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.newBase)
             return c.json({ error: 'Missing newBase parameter' }, 400);
+        // Reaches git (fetch/reset/cherry-pick) and the forge CLI as a bare
+        // argument, and is exported to the custom script as KOBO_NEW_BASE.
+        if (!gitOps.isValidBranchName(body.newBase)) {
+            return c.json({ error: `Invalid source branch name: ${body.newBase}` }, 400);
+        }
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         const result = await changeSourceBranch(id, body.newBase);
@@ -3830,9 +3973,15 @@ app.post('/:id/change-source-branch', async (c) => {
 app.post('/:id/cancel-source-change', async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.previousBase)
             return c.json({ error: 'Missing previousBase parameter' }, 400);
+        // Persisted as the workspace source branch, and from there it reaches
+        // `git fetch origin <sourceBranch>` as a bare argument — including from a
+        // plain visit to the Diff tab, with no further user action.
+        if (!gitOps.isValidBranchName(body.previousBase)) {
+            return c.json({ error: `Invalid source branch name: ${body.previousBase}` }, 400);
+        }
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -3860,13 +4009,13 @@ app.post('/:id/cancel-source-change', async (c) => {
     }
 });
 /** Force-push the working branch with --force-with-lease (after a history rewrite). */
-app.post('/:id/force-push', (c) => {
+app.post('/:id/force-push', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
-        gitOps.pushBranch(workspace.worktreePath, workspace.workingBranch, { force: true });
+        await gitOps.pushBranchAsync(workspace.worktreePath, workspace.workingBranch, { force: true });
         return c.json({ success: true });
     }
     catch (err) {