@neuralis/brain-core 0.3.2 → 0.4.1

package/dist/src/git/GitRunner.js

@@ -2,19 +2,22 @@
  * GitRunner — the single, security-hardened entry point to git for a
  * git-backed source (porcelain-marten / G0).
  *
- * It is keyed on a RESOLVED CONTAINER CHECKOUT ROOT (`resolveLocalRoot()` — the
- * exact value the `local` connector mounts and the shell uri-policy gate keys
- * on) so git can never operate outside the source boundary. Every later git
- * increment (G1 badges, G2 SCM view, G3 hosted tools, G4 remote, G5 branches)
- * goes through this class — it is the floor they all build on.
+ * It is keyed on a RESOLVED CHECKOUT ROOT — the `host` connector's root, on
+ * this machine or on a paired device — so git can never operate outside the
+ * source boundary. Every git surface (badges, the Git Control panel, the
+ * routes-based git skill, remote ops) goes through this class: it is the floor
+ * they all build on.
  *
- * Trust: git runs IN-PROCESS as first-party trusted host code (D2), NOT inside
- * the Landlock shell sandbox. That makes the four containment requirements
- * below non-negotiable — a working tree (especially one cloned from an
- * untrusted remote in G4) is attacker-influenced data.
+ * Every op is ONE argv run through `#spawnGit` — never a shell, never a wrapper
+ * library. On this machine git runs IN-PROCESS as native trusted host code
+ * (D2), NOT inside the Landlock shell sandbox; on a device it runs through that
+ * device's broker (`transport.exec`), under the owner's ceiling and, for anyone
+ * but the device's owner, a live sandbox. The four containment requirements
+ * below hold IDENTICALLY on both — a working tree (especially one cloned from
+ * an untrusted remote) is attacker-influenced data.
  *
  * The four containment floors (architect Finding 2, porcelain-marten):
- *   1. ROOT BINDING — every op runs with `cwd = containerRoot`; sub-path args
+ *   1. ROOT BINDING — every op runs with `cwd = root`; sub-path args
  *      are guarded to stay inside it; `git rev-parse --show-toplevel` is
  *      clamped so a `.git` ABOVE the source is rejected, AND (G2.5) the
  *      EFFECTIVE `--absolute-git-dir` is clamped so a `.git` FILE / symlink
@@ -28,25 +31,31 @@
  *      hooks + fsmonitor + pager, closing the malicious-checkout RCE class.
  *   4. CONTROLLED ENV — ambient `GIT_DIR`/`GIT_WORK_TREE`/`GIT_CONFIG*` etc.
  *      are stripped and global/system config is neutralised, so no inherited
- *      env var can redirect the repo or inject config.
+ *      env var can redirect the repo or inject config (on a device the broker
+ *      strips them from its own base for every argv run).
+ *
+ * The hooks path and the neutralised config files name the NULL DEVICE of the
+ * machine git runs on (`gitNullDevice`: `/dev/null`, `NUL` on a Windows device).
  *
  * G4 (keyring-kestrel Slice 2): remote ops (fetch/push/pull) ARE implemented —
- * `fetch`/`push`/`pull`/`mergeFetched` route through `#spawnGitRemote` (raw
- * `node:child_process`, NEVER simple-git — J3), which prepends the full
+ * `fetch`/`push`/`pull`/`mergeFetched` route through `#spawnGitRemote` (this
+ * machine's raw `node:child_process`; on a device checkout they run on the device for its owner
+ * only, with the owner's own credential helpers and never a server token), which prepends the full
  * protected-config-aware remote-hardening `-c` set (S1 empty-reset-then-constant
  * credential helper, S3 askPass off, `protocol.{file,ext,git}.allow=never`,
- * pinned `remote.<n>.{upload,receive}pack`, `core.sshCommand=`/`core.gitProxy=`)
+ * `push.gpgSign=false`, pinned `remote.<n>.{upload,receive}pack`,
+ * `core.sshCommand=`/`core.gitProxy=`)
  * plus a CONSTANT host-matching credential helper reading the token from the
  * child env. NO clone, NO force-push (D6). The token is present ONLY on
  * network-only invocations (fetch/push), never a working-tree checkout/merge
  * (S4 — `pull` = `fetch` + a token-free `mergeFetched`).
  */
 var _a;
-import path from 'node:path';
 import { realpath } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
-import { simpleGit } from 'simple-git';
 import { resolveSearchBinaries } from '../search/binaryResolver.js';
+import { placePath, toGitPlace } from './gitPlace.js';
+import { transportRefusalReason } from '../connectors/HostConnector.js';
 // ---------------------------------------------------------------------------
 // Structured errors
 // ---------------------------------------------------------------------------
@@ -211,15 +220,61 @@ export function classifyGitOp(op, args = []) {
 // ---------------------------------------------------------------------------
 /**
  * `-c` overrides applied to EVERY git invocation (highest precedence — beats a
- * malicious repo-local `.git/config`). G4 additionally hardens the remote/clone
- * class (`protocol.file.allow=never`, `core.sshCommand`, `filter.*`,
- * `diff.external`) when it wires fetch/pull/push/clone.
+ * malicious repo-local `.git/config`). The remote ops add their own set on top
+ * (`#spawnGitRemote`).
+ */
+function hardeningConfig(nullDevice) {
+    return [
+        `core.hooksPath=${nullDevice}`, // no repo-local hook executes as the host process
+        'core.fsmonitor=false', // no repo-local fsmonitor command runs
+        'core.pager=cat', // never spawn a pager (belt; non-interactive anyway)
+        // A repo-local `commit.gpgSign` / `tag.gpgSign` + `gpg.program` would run a
+        // program of the repo's choosing on commit / tag (measured, git 2.43.0).
+        'commit.gpgSign=false',
+        'tag.gpgSign=false',
+    ];
+}
+/**
+ * Every CONFINED call also points git's default global ignore and attributes
+ * files at the null device. A null GIT_CONFIG_GLOBAL still leaves those defaults
+ * (`$XDG_CONFIG_HOME/git/…`, `~/.config/git/…`) in force; a sandboxed device
+ * spawn cannot open them, and git then dies with "cannot use … as an exclude
+ * file" on every `status` / `diff --cached`. Kept apart from `hardeningConfig`
+ * because the device owner's own fetch / push runs unconfined and its argv must
+ * equal the broker's fixed set (`host-broker/ownerRemoteGit.mjs`).
+ */
+function noGlobalFilesConfig(nullDevice) {
+    return [`core.excludesFile=${nullDevice}`, `core.attributesFile=${nullDevice}`];
+}
+/**
+ * The null device floors 3 and 4 point hooks and the global/system config at,
+ * in the flavour of the machine git RUNS on. A Windows device takes `NUL`: a
+ * `/dev/null` hooks directory there is an ordinary path on the current drive
+ * (`\dev\null\<hook>`) whoever can write that drive could fill, while `NUL` is
+ * a reserved device name no directory can carry. The Windows half is pinned by
+ * a unit on the argv the device transport receives; the on-machine run is a
+ * Windows owner row.
  */
-const HARDENING_CONFIG = [
-    'core.hooksPath=/dev/null', // no repo-local hook executes as the host process
-    'core.fsmonitor=false', // no repo-local fsmonitor command runs
-    'core.pager=cat', // never spawn a pager (belt; non-interactive anyway)
-];
+export function gitNullDevice(flavour) {
+    return flavour === 'win32' ? 'NUL' : '/dev/null';
+}
+/**
+ * The four fixed `GIT_*` values every call carries (floor 4) — constants, never
+ * an inherited value. Locally they ride `sanitizedGitEnv()`; on a device they are
+ * the request's named env, over the broker's base from which every ambient
+ * `GIT_*` and `UNSAFE_PLAIN_ENV` name is already gone (`host-broker/server.mjs`
+ * argv runs).
+ */
+export function gitFloorEnv(nullDevice) {
+    return {
+        GIT_CONFIG_GLOBAL: nullDevice,
+        GIT_CONFIG_SYSTEM: nullDevice,
+        // Never block on an interactive credential/askpass prompt.
+        GIT_TERMINAL_PROMPT: '0',
+        // Read-only-status floor — see `sanitizedGitEnv`.
+        GIT_OPTIONAL_LOCKS: '0',
+    };
+}
 /**
  * The CONSTANT (S2) credential-helper snippet installed on remote ops. It is
  * NEVER interpolated with any dynamic value — username/host/token arrive via the
@@ -284,8 +339,8 @@ const GIT_LOG_FS = '\x1f';
 /**
  * Env names OUTSIDE the `GIT_*` namespace that still drive git command
  * execution (git falls back to them when the GIT_ form is absent). These
- * command-bearing variables are stripped alongside the GIT_* sweep, never
- * allowed through simple-git's environment guard: a non-interactive hardened
+ * command-bearing variables are stripped alongside the GIT_* sweep (the device
+ * broker strips the same set for an argv run): a non-interactive hardened
  * runner needs none of them, even when its parent exports an editor command.
  */
 const UNSAFE_PLAIN_ENV = new Set(['EDITOR', 'VISUAL', 'PAGER', 'PREFIX', 'SSH_ASKPASS']);
@@ -305,11 +360,9 @@ function sanitizedGitEnv() {
             continue;
         env[key] = value;
     }
-    // Neutralise ambient global/system config injection (~/.gitconfig, /etc/gitconfig).
-    env.GIT_CONFIG_GLOBAL = '/dev/null';
-    env.GIT_CONFIG_SYSTEM = '/dev/null';
-    // Never block on an interactive credential/askpass prompt (G4 floor, harmless now).
-    env.GIT_TERMINAL_PROMPT = '0';
+    // Neutralise ambient global/system config injection (~/.gitconfig, /etc/gitconfig),
+    // never prompt, never take optional locks — the four constants of `gitFloorEnv`.
+    Object.assign(env, gitFloorEnv(gitNullDevice('posix')));
     // Read-only-status floor (MAJOR-4a, G2). git opportunistically takes the
     // `.git/index.lock` and REWRITES `.git/index` (stat-cache refresh) even on a
     // pure `status`/`diff` read — which, once the G2.2 `.git`-watcher is live,
@@ -317,41 +370,95 @@ function sanitizedGitEnv() {
     // loop. Disabling OPTIONAL locks makes read queries truly index-read-only; the
     // mutating ops (add/commit/…) still take their real locks, so this is harmless
     // to writes. Set here (env) rather than per-call so EVERY read path inherits it.
-    env.GIT_OPTIONAL_LOCKS = '0';
     return env;
 }
-/** Best-effort detection of simple-git's block-timeout rejection. */
-function isGitTimeout(err) {
-    if (!err || typeof err !== 'object')
-        return false;
-    const anyErr = err;
-    if (anyErr.plugin === 'timeout')
-        return true;
-    return typeof anyErr.message === 'string' && /timeout/i.test(anyErr.message);
+/**
+ * A git call on a paired device could not be asked (offline, outdated broker,
+ * the device's ceiling, an unconfined device for a non-owner). `reason` is the
+ * transport's FIXED code — never a path, never the broker's text.
+ */
+export class GitDeviceUnavailableError extends Error {
+    reason;
+    code = 'git_device_unavailable';
+    constructor(reason) {
+        super(`git could not run on the device (${reason})`);
+        this.reason = reason;
+        this.name = 'GitDeviceUnavailableError';
+    }
+}
+/**
+ * A server credential handed to a remote op on a paired device's folder. THIS
+ * server's push token (`NRS_GIT_TOKEN`) never crosses a device link — a
+ * device's remote ops use its owner's own git credentials there.
+ */
+export class GitRemoteOnDeviceError extends Error {
+    code = 'git_remote_on_device';
+    constructor() {
+        super("a server git credential never reaches a paired device");
+        this.name = 'GitRemoteOnDeviceError';
+    }
+}
+/**
+ * fetch / pull / push on a paired device's folder by anyone but the device's
+ * owner. The only credential there is the OWNER's own (their git credential
+ * helper on their machine); running it for another person would borrow it.
+ */
+export class GitRemoteOwnerOnlyError extends Error {
+    code = 'git_remote_owner_only';
+    constructor() {
+        super("only the device's owner fetches, pulls and pushes a folder on it");
+        this.name = 'GitRemoteOwnerOnlyError';
+    }
+}
+/** The credential-helper keys an owner's own git config may name — plain and URL-scoped (`credential.<url>.helper`). */
+const OWNER_HELPER_KEY_RE = /^credential(\.[^=\s]+)?\.helper$/i;
+/** A fixed transport code (`device_offline`, `others_denied`, …) off a thrown device error, else a generic one. */
+function deviceReasonOf(error) {
+    return transportRefusalReason(error) ?? 'device_unreachable';
 }
-// ---------------------------------------------------------------------------
-// GitRunner
-// ---------------------------------------------------------------------------
 export class GitRunner {
     #root;
-    #git;
-    /** The resolved git binary — reused by the direct-spawn stdin/capture path (`#spawnGit`). */
+    /** The machine's path arithmetic (a Windows device answers in `win32`). */
+    #path;
+    /** The resolved LOCAL git binary; `null` on a device checkout (the device's own `git` runs). */
     #bin;
-    /** Inactivity cap mirrored into `#spawnGit` (simple-git's `timeout.block` only covers its task API). */
+    /** A device checkout's exec seat; `null` for a checkout on this machine. */
+    #device;
+    #nullDevice;
+    /** The per-op timeout (an inactivity cap locally, the broker's wall-clock cap on a device). */
     #timeoutMs;
     #repoChecked = null;
-    constructor(root, git, bin, timeoutMs) {
-        this.#root = root;
-        this.#git = git;
-        this.#bin = bin;
-        this.#timeoutMs = timeoutMs && timeoutMs > 0 ? timeoutMs : undefined;
+    constructor(init) {
+        this.#root = init.root;
+        this.#path = init.path;
+        this.#bin = init.bin;
+        this.#device = init.device;
+        this.#nullDevice = gitNullDevice(init.device?.transport.flavour ?? 'posix');
+        this.#timeoutMs = init.timeoutMs && init.timeoutMs > 0 ? init.timeoutMs : undefined;
     }
-    /** The resolved container checkout root this runner is bound to. */
+    /** The checkout root this runner is bound to (a device path for a device checkout). */
     get root() {
         return this.#root;
     }
     static async create(options) {
-        const root = path.resolve(options.containerRoot);
+        const place = toGitPlace(options.root);
+        const p = placePath(place);
+        if (place.device) {
+            // A device spawn follows the device gate, never precedes it: a place built
+            // for a read-only probe carries no verdict and cannot run anything.
+            const { transport, owner } = place.device;
+            if (owner === undefined)
+                throw new GitArgumentError('a device checkout needs the device gate verdict');
+            if (!transport.exec)
+                throw new GitUnavailableError();
+            return new _a({
+                root: p.resolve(place.root),
+                path: p,
+                bin: null,
+                device: { transport, exec: transport.exec.bind(transport), owner },
+                ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+            });
+        }
         let bin = options.gitBin;
         if (!bin) {
             const bins = await resolveSearchBinaries();
@@ -359,74 +466,92 @@ export class GitRunner {
         }
         if (!bin)
             throw new GitUnavailableError();
-        const git = simpleGit({
-            baseDir: root,
-            binary: bin,
-            maxConcurrentProcesses: 1,
-            trimmed: false,
-            // Inactivity cap (G1 perf floor): if git produces no output for `block` ms
-            // it is killed and the op rejects — for a silent whole-tree scan this is an
-            // effective wall-clock cap. Only set when the caller asked (G1); untimed
-            // otherwise so G4 clone/fetch (legitimately long, bursty) is unaffected.
-            ...(options.timeoutMs && options.timeoutMs > 0
-                ? { timeout: { block: options.timeoutMs } }
-                : {}),
-            config: HARDENING_CONFIG,
-            // Only the sanitizer's four defensive Git overrides may cross v4's gate.
-            allowEnvironment: [
-                'GIT_CONFIG_GLOBAL',
-                'GIT_CONFIG_SYSTEM',
-                'GIT_TERMINAL_PROMPT',
-                'GIT_OPTIONAL_LOCKS',
-            ],
-            // simple-git blocks `-c core.hooksPath|fsmonitor|pager` because those are
-            // the exact keys an ATTACKER-supplied arg would abuse. Here the values are
-            // HARDCODED safe constants (HARDENING_CONFIG) set DEFENSIVELY, never
-            // caller-influenced — so the explicit opt-in is correct and required.
-            unsafe: {
-                allowUnsafeHooksPath: true,
-                allowUnsafeFsMonitor: true,
-                allowUnsafePager: true,
-                // We set GIT_CONFIG_GLOBAL/SYSTEM=/dev/null in the env (hardcoded safe
-                // constants) to neutralise ambient global/system gitconfig — simple-git
-                // flags that env as a config-path override, so opt in for our own value.
-                allowUnsafeConfigPaths: true,
-            },
-        }).env(sanitizedGitEnv());
-        return new _a(root, git, bin, options.timeoutMs);
+        return new _a({
+            root: p.resolve(place.root),
+            path: p,
+            bin,
+            device: null,
+            ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+        });
     }
     /**
-     * Run git DIRECTLY (bypassing the simple-git task API) for the ops that need
-     * real stdin/stdout plumbing (`git apply` fed a patch on STDIN, `git diff
-     * --no-index` which exits 1 when the files differ — callers pass
-     * `allowExitCodes:[1]`) AND (G2.4, MINOR-6) the potentially-large read paths
-     * (`diff`/`logGraph`/`show`/`cat-file`), which need the output accumulation
-     * bound: the whole output is buffered in-process, so the child is KILLED once
-     * stdout+stderr exceed `GIT_MAX_OUTPUT_BYTES` (→ `GitOutputLimitError`). The
-     * create-time `timeoutMs` is replicated here as the same INACTIVITY semantics
-     * simple-git's `timeout.block` has (resets per chunk → `GitTimeoutError`).
-     * The four containment floors are replicated by hand: cwd = the bound root,
-     * the hardcoded `-c` hardening prefix, and `sanitizedGitEnv()` (GIT_*
-     * stripped, global/system config neutralised). No shell — argv array,
-     * `shell:false` (spawn default). Output is chunk-concatenated as BYTES and
-     * decoded once (a per-chunk decode would corrupt multibyte content at chunk
-     * boundaries — `show` serves file content verbatim).
+     * Run ONE git command — every op of this class goes through here, argv only,
+     * never a shell. The four containment floors ride every call: cwd = the bound
+     * root, the hardcoded `-c` hardening prefix (in the flavour of the machine git
+     * runs on), and the controlled env (`sanitizedGitEnv()` locally; the
+     * `gitFloorEnv` constants over the broker's GIT-free base on a device). The
+     * output is bounded by `GIT_MAX_OUTPUT_BYTES` (→ `GitOutputLimitError`) and
+     * the runner's timeout (→ `GitTimeoutError`) on BOTH transports; callers that
+     * tolerate a nonzero exit (`git diff --no-index` exits 1 when the files differ)
+     * pass `allowExitCodes`.
      */
     #spawnGit(args, opts = {}) {
-        const fullArgs = [...HARDENING_CONFIG.flatMap((c) => ['-c', c]), ...args];
-        return this.#execSpawn(fullArgs, sanitizedGitEnv(), opts);
+        const config = [...hardeningConfig(this.#nullDevice), ...noGlobalFilesConfig(this.#nullDevice)];
+        const fullArgs = [...config.flatMap((c) => ['-c', c]), ...args];
+        return this.#exec(fullArgs, {}, opts);
+    }
+    /** The transport fork: this machine's spawn, or the device's broker. */
+    #exec(fullArgs, extraEnv, opts) {
+        if (this.#device)
+            return this.#execDevice(this.#device, fullArgs, extraEnv, opts);
+        return this.#execSpawn(fullArgs, { ...sanitizedGitEnv(), ...extraEnv }, opts);
+    }
+    /**
+     * The device half: `git <argv>` through the broker's ONE spawn planner
+     * (`/exec` argv mode) — the owner's ceiling, and for anyone but the device's
+     * owner a live sandbox plus the owner's per-folder "others" level
+     * (`actor:'other'`, derived by the client from `requireConfinement`).
+     */
+    async #execDevice(seat, fullArgs, extraEnv, opts) {
+        let result;
+        // `ownerGlobalConfig` = the ONE read that may see the owner's own global and
+        // system config (`#ownerCredentialHelpers`, owner-only); every other call
+        // neutralises both.
+        const floor = gitFloorEnv(this.#nullDevice);
+        if (opts.ownerGlobalConfig) {
+            delete floor.GIT_CONFIG_GLOBAL;
+            delete floor.GIT_CONFIG_SYSTEM;
+        }
+        try {
+            result = await seat.exec({
+                argv: ['git', ...fullArgs],
+                cwd: this.#root,
+                env: { ...floor, ...extraEnv },
+                ...(opts.stdin !== undefined ? { stdin: opts.stdin } : {}),
+                ...(this.#timeoutMs !== undefined ? { timeoutMs: this.#timeoutMs } : {}),
+                maxOutputBytes: GIT_MAX_OUTPUT_BYTES,
+                // `ownerRemote` = the owner's fetch / push / helper read: the device's
+                // broker runs exactly that fixed argv outside its sandbox (the owner's
+                // helpers live in their home and keychain); every other op stays confined.
+                ...(opts.ownerRemote && seat.owner ? { ownerRemoteGit: true } : {}),
+            }, { owner: seat.owner });
+        }
+        catch (error) {
+            throw new GitDeviceUnavailableError(deviceReasonOf(error));
+        }
+        if (result.timedOut)
+            throw new GitTimeoutError(this.#root);
+        if (result.truncated)
+            throw new GitOutputLimitError(this.#root);
+        const ok = result.exitCode === 0 || (opts.allowExitCodes?.includes(result.exitCode) ?? false);
+        if (ok)
+            return result.stdout;
+        const cmd = fullArgs.find((a, i) => fullArgs[i - 1] !== '-c' && !a.startsWith('-')) ?? '';
+        throw new GitApplyError(result.stderr.trim() || `git ${cmd} exited with code ${result.exitCode}`);
     }
     /**
-     * The shared spawn executor for BOTH the local direct-spawn path (`#spawnGit`)
+     * The local spawn executor for BOTH the local direct-spawn path (`#spawnGit`)
      * and the remote-op path (`#spawnGitRemote`): the timeout + output-accumulation
      * bound + exit-code handling, over a caller-composed argv + env. Isolating it
      * keeps the two callers from drifting on the containment plumbing while letting
-     * the remote path compose its OWN hardening `-c` set + credential env (which
-     * MUST NOT go through simple-git — J3).
+     * the remote path compose its OWN hardening `-c` set + credential env.
      */
     #execSpawn(fullArgs, env, opts = {}) {
+        const bin = this.#bin;
+        if (bin === null)
+            return Promise.reject(new GitUnavailableError());
         return new Promise((resolve, reject) => {
-            const child = spawn(this.#bin, fullArgs, {
+            const child = spawn(bin, fullArgs, {
                 cwd: this.#root,
                 env,
                 stdio: [opts.stdin !== undefined ? 'pipe' : 'ignore', 'pipe', 'pipe'],
@@ -490,15 +615,20 @@ export class GitRunner {
         });
     }
     /**
-     * The REMOTE-op spawn variant (G4 keyring-kestrel Slice 2). Raw
-     * `node:child_process` — NEVER simple-git: `HARDENING_CONFIG` is the simple-git
-     * constructor's `config:`, and simple-git v3 blocks `-c credential.helper` /
-     * `core.sshCommand` / `filter.*` / `protocol.*` unless opted in, so routing the
-     * remote `-c` set through simple-git would throw EVERY task (incl.
-     * `#assertRepoInsideSource`'s `rev-parse`) — unit-green, boot-dead (J3). The
-     * raw path needs ZERO simple-git opt-ins.
+     * The REMOTE-op spawn variant (G4 keyring-kestrel Slice 2) — this machine's
+     * raw `node:child_process`, or a paired device's broker for its OWNER only
+     * (`GitRemoteOwnerOnlyError` for anyone else). A server credential on a
+     * device refuses (`GitRemoteOnDeviceError`): the token never crosses a link.
+     * On a device the owner's own credential helpers (`ownerHelpers`, read from
+     * their global/system config) take the place of the constant helper, after
+     * the same empty reset; every other key below is identical on both. That op
+     * (and the helper read) is the one a SANDBOXED device's broker runs outside
+     * its sandbox, after judging it exactly this fixed argv
+     * (`host-broker/ownerRemoteGit.mjs`) — the owner's own trust: nothing an agent
+     * types reaches the argv or its config, and the keys below neutralise the
+     * repo-local exec vectors. The GAP-HTTP probe and the pull's merge stay confined.
      *
-     * It prepends, IN ADDITION to `HARDENING_CONFIG`, the full protected-config-aware
+     * It prepends, IN ADDITION to `hardeningConfig(<null device>)`, the full protected-config-aware
      * remote-hardening `-c` set (only 4 git config keys are protected; every other
      * key is honored from a hostile repo-local `.git/config`, and `-c` = command
      * scope wins over repo-local):
@@ -510,7 +640,8 @@ export class GitRunner {
      *     `core.askPass` is consulted BEFORE the `GIT_TERMINAL_PROMPT=0` gate).
      *   - `core.sshCommand=` / `core.gitProxy=` (RCE keys; HTTPS-only makes them moot,
      *     pinned anyway); `protocol.{file,ext,git}.allow=never` (a repo-local
-     *     `protocol.ext.allow=always` self-enables `ext::` RCE).
+     *     `protocol.ext.allow=always` self-enables `ext::` RCE); `push.gpgSign=false`
+     *     (a repo-local signing program runs on push, the credential in its env).
      *   - `remote.<name>.{upload,receive}pack` pinned (the remote NAME is
      *     server-known, so these ARE pinnable) — belt with `protocol.file.allow=never`.
      * NOT `url.*.insteadOf`/`pushInsteadOf` (un-`-c`-clearable — closed by the
@@ -524,10 +655,25 @@ export class GitRunner {
      * (fetch/push). `mergeFetched` calls this with NO credential (S4).
      */
     #spawnGitRemote(args, opts = {}) {
-        const hardening = [...HARDENING_CONFIG];
+        if (this.#device) {
+            if (opts.credential)
+                return Promise.reject(new GitRemoteOnDeviceError());
+            if (!this.#device.owner)
+                return Promise.reject(new GitRemoteOwnerOnlyError());
+        }
+        else if (opts.ownerHelpers) {
+            return Promise.reject(new GitArgumentError('owner credential helpers are a device-only input'));
+        }
+        const hardening = hardeningConfig(this.#nullDevice);
+        if (opts.ownerHelpers === undefined)
+            hardening.push(...noGlobalFilesConfig(this.#nullDevice));
         hardening.push('core.askPass=', 'credential.interactive=false'); // S3
         hardening.push('core.sshCommand=', 'core.gitProxy=');
         hardening.push('protocol.file.allow=never', 'protocol.ext.allow=never', 'protocol.git.allow=never');
+        // A repo-local `push.gpgSign` + `gpg.program` runs a program of the repo's
+        // choosing on push (measured, git 2.43.0, against a receiver that asks for
+        // a push certificate) — with the push credential in its environment.
+        hardening.push('push.gpgSign=false');
         if (opts.remoteName !== undefined) {
             const remote = _a.#guardRemoteName(opts.remoteName);
             hardening.push(`remote.${remote}.uploadpack=git-upload-pack`, `remote.${remote}.receivepack=git-receive-pack`);
@@ -556,8 +702,18 @@ export class GitRunner {
             env.NRS_GIT_USER = opts.credential.username;
             env.NRS_GIT_TOKEN = opts.credential.token;
         }
+        if (opts.ownerHelpers) {
+            // S1 on the device: the same empty reset FIRST (a hostile repo-local helper
+            // never runs and never receives the owner's credential), then the owner's own.
+            hardening.push('credential.helper=', ...opts.ownerHelpers);
+        }
         const fullArgs = [...hardening.flatMap((c) => ['-c', c]), ...args];
-        return this.#execSpawn(fullArgs, env, opts.allowExitCodes ? { allowExitCodes: opts.allowExitCodes } : {});
+        const exit = opts.allowExitCodes ? { allowExitCodes: opts.allowExitCodes } : {};
+        // The owner's own fetch / push (it alone carries their helpers) is the op a
+        // sandboxed device runs unconfined; the GAP-HTTP probe and the pull's merge stay confined.
+        if (this.#device)
+            return this.#execDevice(this.#device, fullArgs, {}, { ...exit, ownerRemote: opts.ownerHelpers !== undefined });
+        return this.#execSpawn(fullArgs, env, exit);
     }
     // --- Containment guards (floors 1 & 2) ----------------------------------
     /** Reject a caller ref that could be parsed as an option or carries a NUL. */
@@ -594,12 +750,24 @@ export class GitRunner {
         if (p.startsWith('-')) {
             throw new GitArgumentError(`git path may not begin with '-': "${p}"`);
         }
-        const resolved = path.resolve(this.#root, p);
-        if (resolved !== this.#root && !resolved.startsWith(this.#root + path.sep)) {
+        const resolved = this.#path.resolve(this.#root, p);
+        if (!this.#within(this.#root, resolved)) {
             throw new GitOutsideSourceError(this.#root, resolved);
         }
         return p; // pass the ORIGINAL token to git (cwd is already the root)
     }
+    /**
+     * `child` at or below `parent` in the checkout machine's own path arithmetic —
+     * a Windows device compares case-insensitively, and git answers there with
+     * forward slashes (`C:/x`), which `win32.resolve` normalizes.
+     */
+    #within(parent, child) {
+        const p = this.#path;
+        const fold = (s) => (p.sep === '\\' ? p.resolve(s).toLowerCase() : p.resolve(s));
+        const a = fold(parent);
+        const b = fold(child);
+        return a === b || b.startsWith(a.endsWith(p.sep) ? a : a + p.sep);
+    }
     /**
      * Verify the repo's toplevel is at or below the source root — a `.git`
      * ABOVE the source (source is a subdir of a bigger repo) is rejected so git
@@ -617,11 +785,14 @@ export class GitRunner {
                 // realpath check on the `.git` entry's own location — is caught here.
                 let lines;
                 try {
-                    lines = (await this.#git.raw(['rev-parse', '--show-toplevel', '--absolute-git-dir']))
+                    lines = (await this.#spawnGit(['rev-parse', '--show-toplevel', '--absolute-git-dir']))
                         .trim()
-                        .split('\n');
+                        .split(/\r?\n/);
                 }
-                catch {
+                catch (error) {
+                    // "Could not ask the device" is not "not a repository".
+                    if (error instanceof GitDeviceUnavailableError)
+                        throw error;
                     throw new GitNotARepoError(this.#root);
                 }
                 const toplevel = (lines[0] ?? '').trim();
@@ -634,8 +805,8 @@ export class GitRunner {
                 // (bind-mount REAL paths, no symlink component) — floor 1b below is what
                 // makes containment symlink-robust, canonicalizing the root for the
                 // git-dir clamp (`--absolute-git-dir` is itself git-canonicalized).
-                const realTop = path.resolve(toplevel);
-                if (realTop !== this.#root && !realTop.startsWith(this.#root + path.sep)) {
+                const realTop = this.#path.resolve(toplevel);
+                if (!this.#within(this.#root, realTop)) {
                     throw new GitOutsideSourceError(this.#root, realTop);
                 }
                 // Floor 1b (G2.5) — the EFFECTIVE git-dir at/below the source root.
@@ -644,9 +815,12 @@ export class GitRunner {
                 // legitimately symlinked mount path (the same reason discovery realpaths
                 // its root) would false-reject a normal `<root>/.git`. Fail-closed: a
                 // redirect OUTSIDE the canonical root throws (readers degrade to null).
-                const realGitDir = path.resolve(gitDir);
-                const canonRoot = await realpath(this.#root).catch(() => this.#root);
-                if (realGitDir !== canonRoot && !realGitDir.startsWith(canonRoot + path.sep)) {
+                // On a device this process cannot `realpath` the root: it is compared as
+                // stored, so a device root spelled through a symlink fails CLOSED (no git
+                // there), never open.
+                const realGitDir = this.#path.resolve(gitDir);
+                const canonRoot = this.#device ? this.#root : await realpath(this.#root).catch(() => this.#root);
+                if (!this.#within(canonRoot, realGitDir)) {
                     throw new GitOutsideSourceError(this.#root, realGitDir);
                 }
             })();
@@ -668,20 +842,11 @@ export class GitRunner {
      */
     async status(subPath) {
         await this.#assertRepoInsideSource();
-        const args = ['--untracked-files=all'];
+        const args = ['status', '--porcelain=v2', '--branch', '--untracked-files=all', '-z'];
         if (subPath !== undefined && subPath !== '') {
             args.push('--', this.#guardPath(subPath));
         }
-        let result;
-        try {
-            result = await this.#git.status(args);
-        }
-        catch (err) {
-            if (isGitTimeout(err))
-                throw new GitTimeoutError(this.#root);
-            throw err;
-        }
-        return normalizeStatus(result);
+        return parseStatusPorcelainV2(await this.#spawnGit(args));
     }
     /**
      * Diff WT↔Index (default), Index↔HEAD (`staged`), or ref↔ref. Paths (if any)
@@ -814,7 +979,7 @@ export class GitRunner {
     async isUntracked(p) {
         await this.#assertRepoInsideSource();
         const safe = this.#guardPath(p);
-        const out = await this.#git.raw(['ls-files', '--', safe]);
+        const out = await this.#spawnGit(['ls-files', '--', safe]);
         return out.trim().length === 0;
     }
     /**
@@ -831,19 +996,23 @@ export class GitRunner {
     }
     async log(opts = {}) {
         await this.#assertRepoInsideSource();
-        const options = {};
+        const args = ['log', `--pretty=format:%H${GIT_LOG_FS}%ai${GIT_LOG_FS}%s${GIT_LOG_FS}%an${GIT_LOG_FS}%ae%x00`];
         if (opts.maxCount && opts.maxCount > 0)
-            options.maxCount = opts.maxCount;
+            args.push(`--max-count=${Math.floor(opts.maxCount)}`);
         if (opts.ref)
-            options.from = _a.#guardRef(opts.ref);
-        const result = await this.#git.log(options);
-        return result.all.map((entry) => ({
-            hash: entry.hash,
-            date: entry.date,
-            message: entry.message,
-            author: entry.author_name,
-            email: entry.author_email,
-        }));
+            args.push(_a.#guardRef(opts.ref));
+        const out = await this.#spawnGit(args);
+        const entries = [];
+        for (const raw of out.split('\x00')) {
+            const record = raw.replace(/^\n+/, '');
+            if (!record)
+                continue;
+            const [hash, date, message, author, email] = record.split(GIT_LOG_FS);
+            if (!hash)
+                continue;
+            entries.push({ hash, date: date ?? '', message: message ?? '', author: author ?? '', email: email ?? '' });
+        }
+        return entries;
     }
     /**
      * The commit DAG for the custom SVG commit graph (G2.3 / `GET /git/log`), WITH
@@ -987,7 +1156,7 @@ export class GitRunner {
         await this.#assertRepoInsideSource();
         let headSha;
         try {
-            headSha = (await this.#git.revparse(['--verify', '--quiet', 'HEAD'])).trim();
+            headSha = (await this.#spawnGit(['rev-parse', '--verify', '--quiet', 'HEAD'])).trim();
         }
         catch {
             return null;
@@ -996,7 +1165,7 @@ export class GitRunner {
             return null;
         let upstreamSha = null;
         try {
-            const up = (await this.#git.revparse(['--verify', '--quiet', '@{u}'])).trim();
+            const up = (await this.#spawnGit(['rev-parse', '--verify', '--quiet', '@{u}'])).trim();
             upstreamSha = up || null;
         }
         catch {
@@ -1066,12 +1235,12 @@ export class GitRunner {
     }
     async branchList() {
         await this.#assertRepoInsideSource();
-        const summary = await this.#git.branchLocal();
-        return summary.all.map((name) => ({
-            name,
-            current: name === summary.current,
-            commit: summary.branches[name]?.commit ?? '',
-        }));
+        const out = await this.#spawnGit([
+            'for-each-ref',
+            `--format=%(HEAD)${GIT_LOG_FS}%(refname:short)${GIT_LOG_FS}%(objectname:short)`,
+            'refs/heads',
+        ]);
+        return parseBranchList(out);
     }
     /**
      * The current branch name — CHEAP: `git rev-parse --abbrev-ref HEAD` reads
@@ -1084,7 +1253,7 @@ export class GitRunner {
     async currentBranch() {
         await this.#assertRepoInsideSource();
         try {
-            const out = (await this.#git.revparse(['--abbrev-ref', 'HEAD'])).trim();
+            const out = (await this.#spawnGit(['rev-parse', '--abbrev-ref', 'HEAD'])).trim();
             if (!out || out === 'HEAD')
                 return null;
             return out;
@@ -1099,7 +1268,7 @@ export class GitRunner {
     async add(paths) {
         await this.#assertRepoInsideSource();
         const safe = paths.map((p) => this.#guardPath(p));
-        await this.#git.add(safe);
+        await this.#spawnGit(['add', '--', ...safe]);
     }
     /**
      * Reset the index. Whole-tree mode/ref reset (`git reset [--mode] [ref]`) OR —
@@ -1111,7 +1280,7 @@ export class GitRunner {
         await this.#assertRepoInsideSource();
         if (opts.paths?.length) {
             const safe = opts.paths.map((p) => this.#guardPath(p));
-            await this.#git.raw(['reset', '-q', '--', ...safe]);
+            await this.#spawnGit(['reset', '-q', '--', ...safe]);
             return;
         }
         const args = [];
@@ -1119,14 +1288,14 @@ export class GitRunner {
             args.push(`--${opts.mode}`);
         if (opts.ref)
             args.push(_a.#guardRef(opts.ref));
-        await this.#git.raw(['reset', ...args]);
+        await this.#spawnGit(['reset', ...args]);
     }
     async checkout(ref, paths) {
         await this.#assertRepoInsideSource();
         const args = [_a.#guardRef(ref)];
         if (paths?.length)
             args.push('--', ...paths.map((p) => this.#guardPath(p)));
-        await this.#git.checkout(args);
+        await this.#spawnGit(['checkout', ...args]);
     }
     /**
      * Discard working-tree changes for `paths` by restoring them from the index
@@ -1140,15 +1309,15 @@ export class GitRunner {
         if (!paths.length)
             throw new GitArgumentError('restore requires at least one path');
         const safe = paths.map((p) => this.#guardPath(p));
-        await this.#git.raw(['checkout', '-q', '--', ...safe]);
+        await this.#spawnGit(['checkout', '-q', '--', ...safe]);
     }
     async commit(message, opts = {}) {
         await this.#assertRepoInsideSource();
         // `-m` consumes the message as its value → a leading-dash message is safe.
-        const result = opts.amend
-            ? await this.#git.commit(message, [], { '--amend': null })
-            : await this.#git.commit(message);
-        return result.commit;
+        if (typeof message !== 'string')
+            throw new GitArgumentError('commit message must be a string');
+        await this.#spawnGit(['commit', '-q', '-m', message, ...(opts.amend ? ['--amend'] : [])]);
+        return (await this.#spawnGit(['rev-parse', '--short', 'HEAD'])).trim();
     }
     /**
      * Apply a unified-diff PATCH fed on STDIN (`git apply`) — the G2.3 whole-hunk
@@ -1188,9 +1357,9 @@ export class GitRunner {
         let sha = null;
         try {
             const target = opts.ref ? _a.#guardRef(opts.ref) : 'HEAD';
-            const resolved = (await this.#git.raw(['rev-parse', '--verify', '--quiet', target])).trim();
+            const resolved = (await this.#spawnGit(['rev-parse', '--verify', '--quiet', target])).trim();
             if (resolved) {
-                await this.#git.raw(['update-ref', ref, resolved]);
+                await this.#spawnGit(['update-ref', ref, resolved]);
                 sha = resolved;
             }
         }
@@ -1200,9 +1369,9 @@ export class GitRunner {
         // 2. Capture working-tree+index content WITHOUT mutating the tree (discard recovery).
         let stash = null;
         try {
-            const created = (await this.#git.raw(['stash', 'create', `nrs-rescue/${safe}`])).trim();
+            const created = (await this.#spawnGit(['stash', 'create', `nrs-rescue/${safe}`])).trim();
             if (created) {
-                await this.#git.raw(['stash', 'store', '-m', `nrs-rescue/${safe}`, created]);
+                await this.#spawnGit(['stash', 'store', '-m', `nrs-rescue/${safe}`, created]);
                 stash = created;
             }
         }
@@ -1227,7 +1396,7 @@ export class GitRunner {
      */
     async restoreBranch(name, ref) {
         await this.#assertRepoInsideSource();
-        await this.#git.raw(['branch', _a.#guardRef(name), _a.#guardRef(ref)]);
+        await this.#spawnGit(['branch', _a.#guardRef(name), _a.#guardRef(ref)]);
     }
     /**
      * Re-materialize working-tree content discarded by `discard`, from its rescue
@@ -1237,23 +1406,23 @@ export class GitRunner {
      */
     async restoreStash(stashRef) {
         await this.#assertRepoInsideSource();
-        await this.#git.raw(['stash', 'apply', _a.#guardRef(stashRef)]);
+        await this.#spawnGit(['stash', 'apply', _a.#guardRef(stashRef)]);
     }
     async stash(args = ['push']) {
         await this.#assertRepoInsideSource();
         // Only the leading subcommand is caller-influenceable in G3; refs guarded there.
-        await this.#git.stash(args);
+        await this.#spawnGit(['stash', ...args]);
     }
     async branchCreate(name, startPoint) {
         await this.#assertRepoInsideSource();
         const args = [_a.#guardRef(name)];
         if (startPoint)
             args.push(_a.#guardRef(startPoint));
-        await this.#git.branch(args);
+        await this.#spawnGit(['branch', ...args]);
     }
     async branchDelete(name, force = false) {
         await this.#assertRepoInsideSource();
-        await this.#git.branch([force ? '-D' : '-d', _a.#guardRef(name)]);
+        await this.#spawnGit(['branch', force ? '-D' : '-d', _a.#guardRef(name)]);
     }
     // --- Remote primitives (G4 keyring-kestrel Slice 2) ----------------------
     // fetch / push / pull, each through `#spawnGitRemote` (raw child_process,
@@ -1357,8 +1526,12 @@ export class GitRunner {
         }
     }
     async fetch(opts = {}) {
-        await this.#assertRepoInsideSource();
         const remote = opts.remote ?? 'origin';
+        if (this.#device) {
+            await this.#deviceOwnerRemote(['fetch', _a.#guardRemoteName(remote)], remote, false, opts.credential);
+            return;
+        }
+        await this.#assertRepoInsideSource();
         if (opts.credential)
             await this.#assertSafeRemoteHttpConfig(remote, opts.credential.host, false);
         await this.#spawnGitRemote(['fetch', _a.#guardRemoteName(remote)], {
@@ -1366,14 +1539,78 @@ export class GitRunner {
             ...(opts.credential ? { credential: opts.credential } : {}),
         });
     }
+    /**
+     * fetch / push on a paired device's folder: its OWNER only, with the owner's
+     * own credential helpers, the same hardening `-c` set, the same HTTPS-only
+     * remote and the same GAP-HTTP probe as this machine's ops. A server
+     * credential is refused before anything runs; a non-owner is refused before
+     * the owner's config is read.
+     */
+    async #deviceOwnerRemote(args, remote, push, credential) {
+        if (credential)
+            throw new GitRemoteOnDeviceError();
+        if (!this.#device?.owner)
+            throw new GitRemoteOwnerOnlyError();
+        const host = await this.remoteHost(remote, { push });
+        if (!host)
+            throw new GitArgumentError('a device remote op needs an HTTPS remote');
+        await this.#assertSafeRemoteHttpConfig(remote, host, push);
+        const ownerHelpers = await this.#ownerCredentialHelpers();
+        await this.#spawnGitRemote(args, { remoteName: remote, httpHost: host, ownerHelpers });
+    }
+    /**
+     * The device owner's own credential helpers — the ONE place the global and
+     * system config neutralisation is lifted, and only for the
+     * `credential[.<url>].helper` keys of those two scopes (`--system`, then
+     * `--global`: git's own order). Every other key of the owner's config stays
+     * unread; the op itself runs with both neutralised. The read is `-z` (key,
+     * newline, value, NUL), so a value carrying a newline is refused WHOLE — a
+     * line read would carry its first line as a truncated helper. A device that
+     * cannot run the read refuses the op (`GitDeviceUnavailableError`); any other
+     * failure of one scope carries nothing from it.
+     */
+    async #ownerCredentialHelpers() {
+        const seat = this.#device;
+        if (!seat?.owner)
+            throw new GitRemoteOwnerOnlyError();
+        const helpers = [];
+        for (const scope of ['--system', '--global']) {
+            let out = '';
+            try {
+                out = await this.#execDevice(seat, [...hardeningConfig(this.#nullDevice).flatMap((c) => ['-c', c]), 'config', scope, '-z', '--get-regexp', '^credential(\\..+)?\\.helper$'], {}, { allowExitCodes: [1], ownerGlobalConfig: true, ownerRemote: true });
+            }
+            catch (error) {
+                if (error instanceof GitDeviceUnavailableError)
+                    throw error;
+                continue; // no such scope on this machine — nothing to carry
+            }
+            for (const entry of out.split('\0')) {
+                const nl = entry.indexOf('\n');
+                if (nl <= 0)
+                    continue;
+                const key = entry.slice(0, nl);
+                const value = entry.slice(nl + 1);
+                if (!OWNER_HELPER_KEY_RE.test(key) || /[\0\r\n]/.test(value))
+                    continue;
+                helpers.push(`${key}=${value}`);
+            }
+        }
+        return helpers;
+    }
     /**
      * Push the CURRENT branch to `remote` (`git push <remote> HEAD` — no refspec
      * from the caller, no `--force`/`--force-with-lease`, D6). The token rides the
      * child env (network-only invocation). `remote` defaults to `origin`, guarded.
      */
     async push(opts) {
-        await this.#assertRepoInsideSource();
         const remote = opts.remote ?? 'origin';
+        if (this.#device) {
+            await this.#deviceOwnerRemote(['push', _a.#guardRemoteName(remote), 'HEAD'], remote, true, opts.credential);
+            return;
+        }
+        if (!opts.credential)
+            throw new GitArgumentError('a push needs the connected remote credential');
+        await this.#assertRepoInsideSource();
         await this.#assertSafeRemoteHttpConfig(remote, opts.credential.host, true);
         await this.#spawnGitRemote(['push', _a.#guardRemoteName(remote), 'HEAD'], {
             remoteName: remote,
@@ -1398,6 +1635,8 @@ export class GitRunner {
      * spawning a merge-driver / creating a merge commit silently.
      */
     async mergeFetched() {
+        if (this.#device && !this.#device.owner)
+            throw new GitRemoteOwnerOnlyError();
         await this.#assertRepoInsideSource();
         await this.#spawnGitRemote(['merge', '--ff-only', 'FETCH_HEAD']);
     }
@@ -1519,28 +1758,101 @@ export function parseHttpsRemoteHost(url) {
 }
 /** A syntactically-plausible remote host (defense-in-depth on the parse). */
 const GIT_REMOTE_HOST_RE = /^[a-z0-9.-]{1,255}$/;
-/** Map a simple-git StatusResult into our staged/unstaged-explicit shape. */
-export function normalizeStatus(result) {
-    const entries = result.files.map((file) => {
-        const index = file.index ?? ' ';
-        const workingTree = file.working_dir ?? ' ';
-        const untracked = index === '?' && workingTree === '?';
-        return {
-            path: file.path,
+/** `.` (unmodified) in a porcelain-v2 XY pair reads as the v1 blank. */
+function xyChar(c) {
+    return !c || c === '.' ? ' ' : c;
+}
+/**
+ * Parse `git status --porcelain=v2 --branch --untracked-files=all -z` into our
+ * staged/unstaged-explicit shape. Pure — unit-tested standalone, and the ONE
+ * status reader on both transports.
+ *
+ * The `-z` stream is NUL-separated records: `# branch.head|upstream|ab` headers,
+ * `1 XY sub mH mI mW hH hI <path>` (ordinary), `2 XY … X<score> <path>` FOLLOWED
+ * BY one more record, the ORIGINAL path (rename/copy — the row carries the NEW
+ * path, as before), `u XY sub m1 m2 m3 mW h1 h2 h3 <path>` (unmerged), `? <path>`
+ * (untracked) and `! <path>` (ignored — never listed). A path may contain
+ * spaces, so the fixed fields are taken by position and the rest is the path.
+ * `branch` is `null` for a detached HEAD; `upstream`/`ahead`/`behind` only when
+ * git reported an upstream.
+ */
+export function parseStatusPorcelainV2(out) {
+    let branch = null;
+    let upstream = null;
+    let ahead = 0;
+    let behind = 0;
+    const entries = [];
+    const records = out.split('\0');
+    const push = (xy, filePath) => {
+        const index = xyChar(xy[0]);
+        const workingTree = xyChar(xy[1]);
+        entries.push({
+            path: filePath,
             index,
             workingTree,
-            staged: !untracked && index !== ' ',
-            unstaged: !untracked && workingTree !== ' ',
-            untracked,
-        };
-    });
+            staged: index !== ' ',
+            unstaged: workingTree !== ' ',
+            untracked: false,
+        });
+    };
+    for (let i = 0; i < records.length; i++) {
+        const record = records[i];
+        if (!record)
+            continue;
+        if (record.startsWith('# ')) {
+            const [key, ...rest] = record.slice(2).split(' ');
+            const value = rest.join(' ');
+            if (key === 'branch.head')
+                branch = value === '(detached)' ? null : value;
+            else if (key === 'branch.upstream')
+                upstream = value;
+            else if (key === 'branch.ab') {
+                const m = /^\+(\d+) -(\d+)$/.exec(value);
+                if (m) {
+                    ahead = Number(m[1]);
+                    behind = Number(m[2]);
+                }
+            }
+            continue;
+        }
+        const kind = record[0];
+        const fields = record.split(' ');
+        if (kind === '1')
+            push(fields[1] ?? '..', fields.slice(8).join(' '));
+        else if (kind === '2') {
+            push(fields[1] ?? '..', fields.slice(9).join(' '));
+            i += 1; // the next record is the rename/copy SOURCE path
+        }
+        else if (kind === 'u')
+            push(fields[1] ?? '..', fields.slice(10).join(' '));
+        else if (kind === '?') {
+            entries.push({ path: record.slice(2), index: '?', workingTree: '?', staged: false, unstaged: false, untracked: true });
+        }
+    }
     return {
-        branch: result.current ?? null,
-        upstream: result.tracking ?? null,
-        ahead: result.ahead ?? 0,
-        behind: result.behind ?? 0,
+        branch,
+        upstream,
+        ahead: upstream ? ahead : 0,
+        behind: upstream ? behind : 0,
         entries,
         clean: entries.length === 0,
     };
 }
+/**
+ * Parse the `for-each-ref --format=%(HEAD)<US>%(refname:short)<US>%(objectname:short)`
+ * listing of `refs/heads` (one branch per line; `*` marks the checked-out one).
+ * Pure — unit-tested standalone.
+ */
+export function parseBranchList(out) {
+    const branches = [];
+    for (const line of out.split(/\r?\n/)) {
+        if (!line)
+            continue;
+        const [head, name, commit] = line.split(GIT_LOG_FS);
+        if (!name)
+            continue;
+        branches.push({ name, current: head === '*', commit: commit ?? '' });
+    }
+    return branches;
+}
 //# sourceMappingURL=GitRunner.js.map