@orion-agents/orion-code 0.3.15 → 0.3.17

package/CHANGELOG.md

@@ -22,6 +22,225 @@ which is **not** a pass.
 
 ## [Unreleased]
 
+## [0.3.17]
+
+> **Status: candidate.** Opening a local project is made fast and honest
+> (`docs/plan/v0.3.16-plan-v1.md`): the directory preview no longer waits on the
+> session catalog, the Finder browse action no longer occupies the global
+> Context mutation admission, and every entry point shares one
+> inspect → confirm → activate contract. Covers S2, S3 and S5; S1 (per-stage
+> telemetry) and S4 (staged activate baseline) are not implemented yet. Not
+> merged, tagged or published.
+>
+> **Update:** S1 (per-stage telemetry) and the S4 headline (the foreground
+> snapshot no longer gates the first render) also landed on this branch, plus a
+> bounded inspect probe. The measured Host-side receipt is in
+> `docs/plan/evidence/v0.3.17-open-baseline.md`.
+>
+> **Update 2:** the Git right-hand work panel (`docs/plan/v0.3.17-plan.md`,
+> S0–S6) is implemented on this branch as well. Evidence per stage is under
+> `docs/plan/evidence/v0.3.17-git/`, and the scenario matrix is
+> `g317-status.md`. All functional gaps are closed; the remaining items are
+> assertion and evidence backlog, listed under **Known gaps** below.
+
+### Added
+
+- **Per-stage open-path telemetry:** `WorkspaceOpenTelemetryV1` keeps a bounded
+  ring of `{ requestId, operation, outcome, stage ms, errorCode }` for the
+  picker, the inspect probe and the Context transition, and exposes it
+  read-only through Diagnostics as `workspaceOpen`. Traces never carry a path,
+  a label or file content.
+
+### Fixed
+
+- **The preview no longer blocks on the session catalog:** `inspect` used to
+  call `countSessionsByProject()`, which can rebuild the catalog and hold its
+  file lock for up to 10s before the confirmation card appeared. It now reads
+  the warm cache only (`peekCachedSessionCounts()`) and reports
+  `sessionCountStatus: 'deferred'` when the catalog is cold; the card stays
+  usable and shows 会话数读取中 instead of stalling.
+
+### Changed
+
+- **The native picker is browse admission, not a mutation:**
+  `POST /workspaces/pick-directory` no longer goes through `executeMutation()`,
+  so an open Finder dialog does not raise `activeMutationCount` or enter the
+  idempotency ledger and can no longer make a project switch look like a busy
+  Runtime. Single-flight (`picker_busy`) and the nonce/origin/content-type
+  guards are unchanged.
+- **One path contract:** the advanced manual entry and the pinned/recent rows
+  now go through the same inspect → confirm → activate state machine as the
+  Finder entry. Nothing activates without an explicit confirmation, and
+  availability plus the Git/Folder kind are always re-checked.
+- **The picker timeout is wired:** `timeoutMs` reaches the default `execFile`
+  runner, and a timeout reports its own `picker_timeout` reason code instead of
+  being folded into `picker_unavailable`.
+- **The preview probe is bounded:** `inspectDirectory` now uses asynchronous fs
+  raced against a 250ms budget, so a hung network mount or a broken symlink
+  cannot freeze the Node event loop; on timeout the directory is reported
+  `unreadable` with an `inspect_budget_exceeded` trace code.
+- **The foreground snapshot no longer gates the first render:** `loadBaseline`
+  dispatches the identity baseline (bootstrap, workspaces, sessions, settings)
+  before restoring the session, so the project shell and session list appear
+  while the transcript is still loading. The reducer already marks the active
+  session `loading`, so the Composer stays disabled until the snapshot settles.
+- **Activation no longer re-requests the workspace page:** the page returned by
+  `POST /workspaces/activate` is reused by the baseline when its `activeId`
+  matches the freshly bootstrapped Context, so opening a project issues one
+  fewer round-trip. A mismatch falls back to the normal request.
+- **The confirmation card reports discrete stages:** while opening, the card
+  shows `准备项目 → 加载本地 Runtime → 恢复会话（如有）` with only the stage the
+  Host actually reports marked `aria-current="step"`, instead of one vague
+  "正在打开…" label covering the whole wait.
+
+### Tests
+
+- `tests/web-workbench-workspace-picker.test.ts` — the preview never calls the
+  catalog rebuild entry point; the count is `ready` when the cache is warm.
+- `tests/session-catalog-peek.test.ts` — the peek answers `null` on a cold
+  module instead of loading or locking.
+- `tests/native-directory-picker.test.ts` — a timeout keeps its own reason code.
+- `tests/web-ui-workspace-picker.test.tsx` — the card stays actionable while the
+  count is deferred, and the stage list only appears after confirming.
+- `tests/workspace-open-telemetry.test.ts` — stage offsets, duplicate marks,
+  bounded retention, and that a serialized trace contains no path.
+- `tests/e2e/web-v0317-workspace-open.spec.ts` — W316P-01/02/04/08/09 driven by a
+  scripted picker: no browse side effects, inspect-then-confirm, cancellation,
+  the shared advanced-path contract, and the no-path-leak regression.
+- `tests/e2e/*` — the four manual-path specs confirm on the card before
+  activating.
+
+### Test seams
+
+- **`ORION_CODE_WEB_PICKER_FIXTURE`** points the Host at a JSON script file so
+  end-to-end runs never open a real Finder dialog (`{"path": …}` /
+  `{"paths": […]}` / `{"outcome": "cancelled" | "unavailable"}`). The script is
+  re-read on every invocation, and an absent or malformed file behaves like a
+  cancelled dialog. It is browse-only: the returned path still has to be
+  confirmed and passes through the same guarded activation flow.
+
+### Added — Git right-hand work panel (S0–S6)
+
+- **Change navigation:** staged / unstaged / untracked / conflict groups with a
+  host-side filter and search, counts that cover the whole matching set, and a
+  pagination cursor bound to the group and query it was issued for.
+- **Diff reading:** unified and side-by-side, old/new line numbers, continuous
+  hunks, fold state, line anchors, word-level diff (`--word-diff=plain`) and
+  ignore-all-space — the last two are bound into the pagination cursor, so a
+  page can never be continued under a different view.
+- **Writes through an index transaction:** every index change holds
+  `index.lock` (and only ever removes a lock it created), writes to a private
+  sibling index, verifies it, and publishes with a single atomic rename.
+  Hunk-level and line-level staging rebuild the patch on the Host from the
+  reviewed document — the browser only ever sends ids.
+- **Commit form and result recovery:** summary plus multi-line body, the
+  identity / signing / hook configuration that will actually run, a preview of
+  the real index (independent of list filters), the draft preserved on failure,
+  and idempotent replay by `requestId`.
+- **History:** search across the whole reachable history, commit details,
+  root commits compared with the empty tree, merge parents selectable and
+  labelled, file history with `--follow`, blame, historical blobs for files
+  that no longer exist locally, and a commit graph drawn by git itself.
+- **Branch and version comparison:** two-endpoint snapshot and diverged-from
+  (merge-base) modes; the resolved commit ids are part of the result so an open
+  comparison can be frozen, and a multi-merge-base pair is refused rather than
+  silently picking one.
+- **Conflict views:** base / ours / theirs read from index stages 1/2/3 plus
+  the working tree, with a stage that legitimately does not exist reported as
+  absent instead of being elided.
+- **Submodule and LFS:** recorded gitlink SHAs are shown without traversing
+  submodules, and LFS pointers are reported as state without fetching objects.
+- **Image versions:** a bounded, magic-byte-identified image becomes a data URL
+  so both versions of a picture can be shown without a download.
+- **Cross-panel links:** "open in Files" translates a Git token into a Files
+  token on the Host, and the composer reference carries the file, comparison
+  source, revision and line range into the draft without sending it.
+- **Responsive and keyboard:** three tiers keyed off the panel container (not
+  the window), with a narrow layout that never writes the downgrade back into
+  the stored preference; arrow keys, Enter, F7 / Shift+F7 change navigation,
+  Escape unwinding one layer at a time, and Space toggling selection only —
+  never a Git write.
+
+### Fixed — Git panel
+
+- **Staging could silently do nothing:** the private index copy received a
+  fresh mtime, which defeated Git’s racy-clean rule — a file edited within the
+  same timestamp granularity and with an unchanged size was not re-hashed, so
+  `git add` succeeded while changing nothing. The copy now preserves the
+  original timestamps, and staging verifies each path with `hash-object
+  --path` against the index entry.
+- **`localhost` was rejected site-wide:** the Host and Origin checks compared
+  header strings exactly, so `http://localhost:<port>` returned 421 (and, with
+  only the Host check fixed, every mutation would have returned 403). Both now
+  accept any loopback spelling of the same endpoint while still refusing
+  attacker-controlled names and a mismatched port.
+- **`git apply -` and `git commit -F -` blocked forever:** the async
+  `execFile` `input` option is silently ignored, so stdin was never closed.
+  Writes now use `spawn` and close stdin explicitly, and a timeout kills the
+  whole process group so a slow hook cannot be orphaned.
+- **Refs came back empty:** `for-each-ref` does not support the `%x1f` escapes
+  that `git log --format` does; it printed them literally. Refs are now parsed
+  from a space-separated format.
+- **A detached HEAD could be reported as a branch:** the check was "no ref
+  points at HEAD", which is wrong when detaching onto a branch tip. It now
+  asks git whether HEAD is a symbolic ref.
+
+### Known gaps
+
+- Assertion and evidence backlog for the Git panel: an end-to-end spec
+  (`tests/e2e/web-v0317-git-workspace.spec.ts`), automated assertions for the
+  Files cross-panel link, and scenario variants not yet covered (staging a
+  deletion or rename, CRLF line selection, signing failure, bare repository
+  and linked worktree cases, agent-led file changes).
+- Narrow-viewport and dark-theme screenshots, plus performance samples for the
+  reads added in S5 and S6.
+- `npm run typecheck:e2e` fails on this branch with 12 errors in the v0.3.12
+  and v0.3.13 specs; the same 12 errors reproduce on the v0.3.16 baseline, so
+  they are pre-existing and unrelated to the Git panel.
+
+## [0.3.16] — CANDIDATE
+
+> **Status: candidate.** LOCAL WORKSPACE opens a new project without typing a
+> path (`docs/plan/v0.3.16-plan.md`): a Host-side native folder picker, and a
+> read-only inspect step separated from activation. Covers slices S1 and S2;
+> controlled workspace-roots discovery (S3) is not implemented yet. No protocol
+> removals or dependency changes. Not merged, tagged or published.
+
+### Added
+
+- **Native folder picker (Host):** `POST /workspaces/pick-directory` runs the OS
+  directory chooser on the Host. The AppleScript is a fixed constant and the
+  prompt / default location travel as `argv` through `execFile`, so a chosen
+  path is never interpolated into a shell or script string. Cancelling is a
+  normal outcome, platforms without an adapter report `picker_unavailable`
+  rather than faking a selection, and only one picker may be open at a time.
+- **Read-only workspace inspect:** `POST /workspaces/inspect` resolves the
+  canonical path, availability (`available` / `missing` / `not_directory` /
+  `unreadable`) and Git-vs-folder kind, plus existing workspace id, session
+  count and pin order. It never registers a workspace, activates a Context or
+  reads file contents.
+- **Project picker dialog:** the LOCAL WORKSPACE dialog now leads with
+  `从 Finder 选择文件夹…`, groups pinned and recent projects, and shows a
+  confirmation card (canonical path, kind, availability, session count). The
+  manual absolute-path entry moved into a collapsed 高级 disclosure.
+
+### Changed
+
+- Browsing, searching, inspecting and cancelling never call `activateContext`,
+  pause the event stream or stop a running Session; only confirming 打开项目
+  enters the existing activation flow.
+
+### Tests
+
+- `tests/native-directory-picker.test.ts` — outcome mapping, argv isolation,
+  trailing-separator handling and non-macOS unavailability.
+- `tests/web-workbench-workspace-picker.test.ts` — inspect is strictly
+  read-only and the picker is single-in-flight.
+- `tests/web-ui-workspace-picker.test.tsx` — state-machine invariants (no
+  activation without a confirmed candidate) and the confirmation card.
+- `tests/e2e/*` — the four specs that filled the manual path now open the
+  advanced disclosure first.
+
 ## [0.3.15] — CANDIDATE
 
 > **Status: candidate.** Web Workbench visual & interaction convergence

package/dist/runtime/release-receipts.d.ts

@@ -9,12 +9,24 @@ export declare const WEB_E2E_WEB32_SCENARIOS_V1: readonly ["WEB32-P0-01", "WEB32
 export declare const WEB_E2E_WEB33_THEME_SCENARIOS_V1: readonly ["WEB33-P0-01", "WEB33-P0-02", "WEB33-P0-03", "WEB33-P0-04", "WEB33-P0-05", "WEB33-P0-06", "WEB33-P0-07", "WEB33-P0-08", "WEB33-P0-09", "WEB33-P0-10", "WEB33-P0-11", "WEB33-P0-12"];
 export declare const WEB_E2E_WEB33_SESSION_SCENARIOS_V1: readonly ["WEB33-P0-16", "WEB33-P0-17", "WEB33-P0-18", "WEB33-P0-19", "WEB33-P0-20", "WEB33-P0-21", "WEB33-P0-22", "WEB33-P0-23", "WEB33-P0-24"];
 export declare const WEB_E2E_WEB33_SCENARIOS_V1: readonly ("WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
-export declare const WEB_E2E_FULL_SCENARIOS_V1: readonly ("E2E-P0-01" | "E2E-P0-02" | "E2E-P0-03" | "E2E-P0-04" | "E2E-P0-05" | "E2E-P0-06" | "E2E-P0-07" | "E2E-P0-08" | "SET-P0-01" | "SET-P0-02" | "SET-P0-03" | "SET-P0-04" | "SET-P0-05" | "SET-P0-06" | "SET-P0-07" | "SET-P0-08" | "SET-P0-09" | "SET-P0-10" | "SET-P0-11" | "SET-P0-12" | "SET-P0-13" | "SET-P0-14" | "WEB31-P0-01" | "WEB31-P0-02" | "WEB31-P0-03" | "WEB31-P0-04" | "WEB31-P0-05" | "WEB31-P0-06" | "WEB31-P0-07" | "WEB31-P0-08" | "WEB31-P0-09" | "WEB31-P0-10" | "WEB31-P0-11" | "WEB31-P0-12" | "WEB32-P0-01" | "WEB32-P0-02" | "WEB32-P0-03" | "WEB32-P0-04" | "WEB32-P0-05" | "WEB32-P0-06" | "WEB32-P0-07" | "WEB32-P0-08" | "WEB32-P0-09" | "WEB32-P0-10" | "WEB32-P0-11" | "WEB32-P0-12" | "WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
-export declare const WEB_E2E_SETTINGS_SCENARIOS_V1: readonly ("E2E-P0-01" | "E2E-P0-02" | "E2E-P0-03" | "E2E-P0-04" | "E2E-P0-05" | "E2E-P0-06" | "E2E-P0-07" | "E2E-P0-08" | "SET-P0-01" | "SET-P0-02" | "SET-P0-03" | "SET-P0-04" | "SET-P0-05" | "SET-P0-06" | "SET-P0-07" | "SET-P0-08" | "SET-P0-09" | "SET-P0-10" | "SET-P0-11" | "SET-P0-12" | "SET-P0-13" | "SET-P0-14" | "WEB31-P0-01" | "WEB31-P0-02" | "WEB31-P0-03" | "WEB31-P0-04" | "WEB31-P0-05" | "WEB31-P0-06" | "WEB31-P0-07" | "WEB31-P0-08" | "WEB31-P0-09" | "WEB31-P0-10" | "WEB31-P0-11" | "WEB31-P0-12" | "WEB32-P0-01" | "WEB32-P0-02" | "WEB32-P0-03" | "WEB32-P0-04" | "WEB32-P0-05" | "WEB32-P0-06" | "WEB32-P0-07" | "WEB32-P0-08" | "WEB32-P0-09" | "WEB32-P0-10" | "WEB32-P0-11" | "WEB32-P0-12" | "WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
+/**
+ * v0.3.17 — LOCAL WORKSPACE open path. The picker is driven by a script file
+ * (`ORION_CODE_WEB_PICKER_FIXTURE`) so CI never opens a real Finder dialog.
+ */
+export declare const WEB_E2E_WEB38_SCENARIOS_V1: readonly ["WEB38-P0-01", "WEB38-P0-02", "WEB38-P0-03", "WEB38-P0-04", "WEB38-P0-05"];
+/**
+ * v0.3.17 — Git right-hand work panel (`docs/plan/v0.3.17-plan.md`).
+ *
+ * One id per user-visible capability the plan calls P0/P1 and that a browser can
+ * actually verify; the per-stage unit suites are registered separately.
+ */
+export declare const WEB_E2E_WEB317_SCENARIOS_V1: readonly string[];
+export declare const WEB_E2E_FULL_SCENARIOS_V1: readonly string[];
+export declare const WEB_E2E_SETTINGS_SCENARIOS_V1: readonly string[];
 export declare const WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1: readonly ["WEB31-P0-01", "WEB31-P0-02", "WEB31-P0-08", "WEB31-P0-09", "WEB31-P0-10", "WEB31-P0-12"];
 export declare const WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1: readonly ["WEB32-P0-01", "WEB32-P0-04", "WEB32-P0-05", "WEB32-P0-06", "WEB32-P0-09", "WEB32-P0-11", "WEB32-P0-12"];
 export declare const WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1: readonly ["WEB33-P0-01", "WEB33-P0-03", "WEB33-P0-08", "WEB33-P0-10", "WEB33-P0-12", "WEB33-P0-16", "WEB33-P0-17", "WEB33-P0-18", "WEB33-P0-20", "WEB33-P0-21", "WEB33-P0-23", "WEB33-P0-24"];
-export declare const WEB_E2E_CRITICAL_SCENARIOS_V1: readonly ("E2E-P0-01" | "E2E-P0-02" | "E2E-P0-03" | "E2E-P0-04" | "E2E-P0-05" | "E2E-P0-06" | "E2E-P0-07" | "E2E-P0-08" | "SET-P0-01" | "SET-P0-02" | "SET-P0-03" | "SET-P0-04" | "SET-P0-05" | "SET-P0-06" | "SET-P0-07" | "SET-P0-08" | "SET-P0-09" | "SET-P0-10" | "SET-P0-11" | "SET-P0-12" | "SET-P0-13" | "SET-P0-14" | "WEB31-P0-01" | "WEB31-P0-02" | "WEB31-P0-03" | "WEB31-P0-04" | "WEB31-P0-05" | "WEB31-P0-06" | "WEB31-P0-07" | "WEB31-P0-08" | "WEB31-P0-09" | "WEB31-P0-10" | "WEB31-P0-11" | "WEB31-P0-12" | "WEB32-P0-01" | "WEB32-P0-02" | "WEB32-P0-03" | "WEB32-P0-04" | "WEB32-P0-05" | "WEB32-P0-06" | "WEB32-P0-07" | "WEB32-P0-08" | "WEB32-P0-09" | "WEB32-P0-10" | "WEB32-P0-11" | "WEB32-P0-12" | "WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
+export declare const WEB_E2E_CRITICAL_SCENARIOS_V1: readonly string[];
 export type ReleaseGateDecisionV1 = 'GO' | 'NO_GO';
 export interface TarballArtifactReceiptV1 {
     readonly version: typeof RELEASE_RECEIPT_VERSION_V1;

package/dist/runtime/release-receipts.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WEB_E2E_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = exports.WEB_E2E_FULL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1 = exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1 = exports.WEB_E2E_WEB32_SCENARIOS_V1 = exports.WEB_E2E_WEB31_SCENARIOS_V1 = exports.WEB_E2E_LEGACY_SCENARIOS_V1 = exports.SUPPORTED_RELEASE_VERSION_LINE_V1 = exports.SUPPORTED_RELEASE_NODE_FLOORS_V1 = exports.SUPPORTED_RELEASE_NODE_MAJORS_V1 = exports.RELEASE_RECEIPT_VERSION_V1 = void 0;
+exports.WEB_E2E_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = exports.WEB_E2E_FULL_SCENARIOS_V1 = exports.WEB_E2E_WEB317_SCENARIOS_V1 = exports.WEB_E2E_WEB38_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1 = exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1 = exports.WEB_E2E_WEB32_SCENARIOS_V1 = exports.WEB_E2E_WEB31_SCENARIOS_V1 = exports.WEB_E2E_LEGACY_SCENARIOS_V1 = exports.SUPPORTED_RELEASE_VERSION_LINE_V1 = exports.SUPPORTED_RELEASE_NODE_FLOORS_V1 = exports.SUPPORTED_RELEASE_NODE_MAJORS_V1 = exports.RELEASE_RECEIPT_VERSION_V1 = void 0;
 exports.createTarballArtifactReceiptV1 = createTarballArtifactReceiptV1;
 exports.verifyTarballArtifactReceiptV1 = verifyTarballArtifactReceiptV1;
 exports.createRuntimeMatrixReceiptV1 = createRuntimeMatrixReceiptV1;
@@ -101,11 +101,37 @@ exports.WEB_E2E_WEB33_SCENARIOS_V1 = Object.freeze([
     ...exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1,
 ]);
+/**
+ * v0.3.17 — LOCAL WORKSPACE open path. The picker is driven by a script file
+ * (`ORION_CODE_WEB_PICKER_FIXTURE`) so CI never opens a real Finder dialog.
+ */
+exports.WEB_E2E_WEB38_SCENARIOS_V1 = Object.freeze([
+    'WEB38-P0-01',
+    'WEB38-P0-02',
+    'WEB38-P0-03',
+    'WEB38-P0-04',
+    'WEB38-P0-05',
+]);
+/**
+ * v0.3.17 — Git right-hand work panel (`docs/plan/v0.3.17-plan.md`).
+ *
+ * One id per user-visible capability the plan calls P0/P1 and that a browser can
+ * actually verify; the per-stage unit suites are registered separately.
+ */
+exports.WEB_E2E_WEB317_SCENARIOS_V1 = Object.freeze([
+    'WEB39-P0-01',
+    'WEB39-P0-02',
+    'WEB39-P0-03',
+    'WEB39-P0-04',
+    'WEB39-P0-05',
+]);
 exports.WEB_E2E_FULL_SCENARIOS_V1 = Object.freeze([
     ...exports.WEB_E2E_LEGACY_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB31_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB32_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB33_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB38_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB317_SCENARIOS_V1,
 ]);
 exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = Object.freeze(exports.WEB_E2E_FULL_SCENARIOS_V1.filter(id => id.startsWith('SET-P0-')));
 exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = Object.freeze([

package/dist/services/session-storage.d.ts

@@ -620,6 +620,15 @@ export declare function listSessions(limit?: number): SessionMeta[];
  * Sessions are excluded so the picker count matches the default listing.
  */
 export declare function countSessionsByProject(): ReadonlyMap<string, number>;
+/**
+ * v0.3.17 — Counts **only when the catalog is already warm**.
+ *
+ * Previewing a directory must never make the user wait for a catalog rebuild or
+ * a file-lock acquisition (the lock ceiling is 10s). This validates the
+ * in-memory cache with a cheap `stat` — no scan, no lock, no write — and
+ * returns `null` otherwise so callers can defer the count instead of blocking.
+ */
+export declare function peekCachedSessionCounts(): ReadonlyMap<string, number> | null;
 /**
  * List sessions for a single canonical project (default listings exclude
  * archived sessions).

package/dist/services/session-storage.js

@@ -53,6 +53,7 @@ exports.loadSessionHistoryWithDiagnostics = loadSessionHistoryWithDiagnostics;
 exports.loadSessionRestoreBundle = loadSessionRestoreBundle;
 exports.listSessions = listSessions;
 exports.countSessionsByProject = countSessionsByProject;
+exports.peekCachedSessionCounts = peekCachedSessionCounts;
 exports.listProjectSessions = listProjectSessions;
 exports.listArchivedProjectSessions = listArchivedProjectSessions;
 exports.findSession = findSession;
@@ -2233,8 +2234,33 @@ function listSessions(limit) {
  * Sessions are excluded so the picker count matches the default listing.
  */
 function countSessionsByProject() {
+    return countSessionsByProjectFromCatalog(loadOrRebuildSessionCatalog());
+}
+/**
+ * v0.3.17 — Counts **only when the catalog is already warm**.
+ *
+ * Previewing a directory must never make the user wait for a catalog rebuild or
+ * a file-lock acquisition (the lock ceiling is 10s). This validates the
+ * in-memory cache with a cheap `stat` — no scan, no lock, no write — and
+ * returns `null` otherwise so callers can defer the count instead of blocking.
+ */
+function peekCachedSessionCounts() {
+    const cache = sessionCatalogCache;
+    if (!cache)
+        return null;
+    try {
+        const stat = (0, fs_1.statSync)(cache.path);
+        if (stat.mtimeMs !== cache.mtimeMs || stat.size !== cache.size)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return countSessionsByProjectFromCatalog(cache.catalog);
+}
+function countSessionsByProjectFromCatalog(catalog) {
     const counts = new Map();
-    for (const session of Object.values(loadOrRebuildSessionCatalog().sessions)) {
+    for (const session of Object.values(catalog.sessions)) {
         if (session.archivedAt)
             continue;
         counts.set(session.projectPath, (counts.get(session.projectPath) ?? 0) + 1);

package/dist/web/git-compare-service.d.ts

@@ -0,0 +1,45 @@
+export type GitCompareModeV1 = 'snapshot' | 'merge-base';
+export interface GitCompareFileV1 {
+    readonly path: string;
+    readonly renamedFrom: string | null;
+    readonly additions: number;
+    readonly deletions: number;
+    readonly binary: boolean;
+    readonly sensitive: boolean;
+}
+export interface GitCompareResultV1 {
+    readonly mode: GitCompareModeV1;
+    readonly requestedBaseRef: string;
+    readonly requestedHeadRef: string;
+    /** The commits the comparison actually used; the UI freezes the result against these. */
+    readonly baseOid: string;
+    readonly headOid: string;
+    readonly baseLabel: string;
+    readonly headLabel: string;
+    /** Set only in merge-base mode: the divergence point that was used. */
+    readonly mergeBaseOid: string | null;
+    readonly files: readonly GitCompareFileV1[];
+    readonly additions: number;
+    readonly deletions: number;
+    readonly truncated: boolean;
+}
+export interface GitCompareReaderOptions {
+    readonly runGit: (args: readonly string[]) => Promise<string>;
+}
+export declare function createGitCompareReader(options: GitCompareReaderOptions): {
+    /** Validates a pair of refs and returns their commits, without computing anything yet. */
+    resolvePair(baseRef: string, headRef: string): Promise<Readonly<{
+        baseRef: string;
+        headRef: string;
+        baseOid: string;
+        headOid: string;
+        baseLabel: string;
+        headLabel: string;
+    }>>;
+    compare(input: {
+        readonly baseRef: string;
+        readonly headRef: string;
+        readonly mode: GitCompareModeV1;
+    }): Promise<GitCompareResultV1>;
+};
+//# sourceMappingURL=git-compare-service.d.ts.map

package/dist/web/git-compare-service.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createGitCompareReader = createGitCompareReader;
+/**
+ * v0.3.17 S5 — branch and version comparison (plan G5).
+ *
+ * Two modes, and the difference between them is the whole point:
+ *   - `snapshot`: the tree difference between A and B;
+ *   - `merge-base`: what B introduced since the branches diverged.
+ *
+ * Semantics this module is responsible for:
+ *   - refs are resolved to **commits** before anything else, and the resolved OIDs are part of
+ *     the result, so the UI can detect that a ref moved and freeze the opened result instead
+ *     of silently comparing against a different tree (plan G5);
+ *   - `merge-base --all` with more than one answer is refused — picking one candidate would
+ *     present an arbitrary choice as if it were the unique divergence point, so the caller is
+ *     told to use the two-endpoint mode instead (plan G5);
+ *   - no common ancestor and a shallow clone with missing objects produce distinct, explicit
+ *     errors rather than an empty file list that looks like a legitimate answer;
+ *   - a ref name is validated before it ever reaches argv: revision expressions, ranges and
+ *     pathspec magic are refused.
+ */
+const redaction_1 = require("../services/redaction");
+const errors_1 = require("./errors");
+const REF_NAME_PATTERN = /^[0-9A-Za-z](?:[0-9A-Za-z._/-]{0,250}[0-9A-Za-z])?$/u;
+const COMPARE_FILE_LIMIT = 2000;
+/** Resolves a ref-ish name to a commit, refusing anything that is not a plain ref name. */
+function assertRefName(value, name) {
+    if (typeof value !== 'string' || !REF_NAME_PATTERN.test(value) || value.includes('..')) {
+        throw new errors_1.WebWorkbenchError(400, `${name} must be a branch, tag or commit hash.`, 'git_ref_invalid');
+    }
+    return value;
+}
+async function resolveCommit(runGit, ref) {
+    const resolved = (await runGit(['rev-parse', '--verify', '--quiet', `${ref}^{commit}`]).catch(() => ''))
+        .toString()
+        .trim();
+    if (!/^[0-9a-f]{7,64}$/iu.test(resolved)) {
+        throw new errors_1.WebWorkbenchError(404, `The ref ${ref} could not be resolved to a commit.`, 'git_ref_not_found');
+    }
+    return resolved;
+}
+function createGitCompareReader(options) {
+    const { runGit } = options;
+    const numstat = async (base, head) => {
+        const raw = await runGit([
+            'diff',
+            '--numstat',
+            '-z',
+            '--no-ext-diff',
+            '--no-textconv',
+            base,
+            head,
+        ]);
+        const files = [];
+        const fields = raw.split('\0');
+        let index = 0;
+        while (index < fields.length) {
+            const record = fields[index];
+            index += 1;
+            if (!record)
+                continue;
+            const [added, deleted, inlinePath] = record.split('\t');
+            let path = inlinePath ?? '';
+            let renamedFrom = null;
+            if (path === '' && index + 1 < fields.length) {
+                renamedFrom = fields[index];
+                path = fields[index + 1];
+                index += 2;
+            }
+            if (!path)
+                continue;
+            const binary = added === '-' || deleted === '-';
+            files.push(Object.freeze({
+                path,
+                renamedFrom: renamedFrom || null,
+                additions: binary ? 0 : Number(added) || 0,
+                deletions: binary ? 0 : Number(deleted) || 0,
+                binary,
+                sensitive: (0, redaction_1.isSensitiveFilePath)(path),
+            }));
+            if (files.length >= COMPARE_FILE_LIMIT)
+                break;
+        }
+        return Object.freeze({
+            files,
+            additions: files.reduce((sum, file) => sum + file.additions, 0),
+            deletions: files.reduce((sum, file) => sum + file.deletions, 0),
+            truncated: files.length >= COMPARE_FILE_LIMIT,
+        });
+    };
+    return {
+        /** Validates a pair of refs and returns their commits, without computing anything yet. */
+        async resolvePair(baseRef, headRef) {
+            const base = assertRefName(baseRef, 'base');
+            const head = assertRefName(headRef, 'head');
+            const [baseOid, headOid] = await Promise.all([
+                resolveCommit(runGit, base),
+                resolveCommit(runGit, head),
+            ]);
+            return Object.freeze({
+                baseRef: base,
+                headRef: head,
+                baseOid,
+                headOid,
+                baseLabel: base,
+                headLabel: head,
+            });
+        },
+        async compare(input) {
+            const pair = await this.resolvePair(input.baseRef, input.headRef);
+            const mode = input.mode === 'merge-base' ? 'merge-base' : 'snapshot';
+            let baseOid = pair.baseOid;
+            let mergeBaseOid = null;
+            if (mode === 'merge-base') {
+                // `--all` is the honest way to ask: a single answer means one divergence point, and
+                // more than one means the question has no unique answer.
+                const raw = await runGit(['merge-base', '--all', pair.baseOid, pair.headOid]).catch(error => {
+                    const message = error instanceof Error ? error.message : '';
+                    if (/missing|bad object/iu.test(message)) {
+                        throw new errors_1.WebWorkbenchError(409, 'The repository does not contain the objects needed for this comparison (a shallow clone?).', 'git_shallow_history');
+                    }
+                    // git exits non-zero with no candidates when the histories are unrelated, and with
+                    // a diagnostic when objects are missing — those are different failures.
+                    throw new errors_1.WebWorkbenchError(409, 'The two refs have no common ancestor; use the two-endpoint comparison instead.', 'git_merge_base_missing');
+                });
+                const candidates = raw
+                    .split('\n')
+                    .map(line => line.trim())
+                    .filter(line => /^[0-9a-f]{7,64}$/iu.test(line));
+                if (candidates.length === 0) {
+                    throw new errors_1.WebWorkbenchError(409, 'The two refs have no common ancestor; use the two-endpoint comparison instead.', 'git_merge_base_missing');
+                }
+                if (candidates.length > 1) {
+                    throw new errors_1.WebWorkbenchError(409, `These refs have ${candidates.length} merge bases, so there is no unique divergence point. Use the two-endpoint comparison instead.`, 'git_merge_base_multiple');
+                }
+                mergeBaseOid = candidates[0];
+                baseOid = mergeBaseOid;
+            }
+            const stats = await numstat(baseOid, pair.headOid);
+            return Object.freeze({
+                mode,
+                requestedBaseRef: pair.baseRef,
+                requestedHeadRef: pair.headRef,
+                baseOid,
+                headOid: pair.headOid,
+                baseLabel: mode === 'merge-base' && mergeBaseOid !== null
+                    ? `共同祖先 ${mergeBaseOid.slice(0, 10)}`
+                    : pair.baseLabel,
+                headLabel: pair.headLabel,
+                mergeBaseOid,
+                files: stats.files,
+                additions: stats.additions,
+                deletions: stats.deletions,
+                truncated: stats.truncated,
+            });
+        },
+    };
+}
+//# sourceMappingURL=git-compare-service.js.map

package/dist/web/git-diff-document.d.ts

@@ -0,0 +1,83 @@
+/**
+ * v0.3.17 S2 — structured Git diff document.
+ *
+ * The v1 diff page exposed raw unified-diff text lines and a `## Staged` style section
+ * banner. That shape made line numbers, side-by-side rendering, hunk folding and the
+ * "jump to next change" navigation impossible without re-parsing text in the browser.
+ *
+ * This module parses the raw lines the Host already produces into a hunk/line model with
+ * real old/new line numbers, a stable line id, per-hunk completeness, and the write
+ * capabilities that apply to the selected comparison source.
+ *
+ * Deliberate limits for S2:
+ *   - No hunk or line level writes. `capabilities.stageHunk` / `stageLines` are always
+ *     false and carry a reason; staging granularity is S3 (plan §10).
+ *   - Word level highlighting and ignore-whitespace views are S5. This model preserves the
+ *     original text so those can be computed later without a protocol change.
+ */
+import type { WebGitFileSourceV1 } from './git-file-source';
+export type GitDiffLineKindV2 = 'context' | 'addition' | 'deletion' | 'meta';
+export interface GitDiffLineV2 {
+    /** Stable inside one document: `<hunkId>#<index>`. */
+    readonly lineId: string;
+    readonly kind: GitDiffLineKindV2;
+    readonly oldLineNumber: number | null;
+    readonly newLineNumber: number | null;
+    /** Content without the leading `+`/`-`/space marker. */
+    readonly text: string;
+    /** The original line including its marker, so copy never loses fidelity. */
+    readonly raw: string;
+}
+export interface GitHunkV2 {
+    readonly hunkId: string;
+    readonly header: string;
+    readonly oldStart: number;
+    readonly oldLines: number;
+    readonly newStart: number;
+    readonly newLines: number;
+    readonly contextLabel: string;
+    readonly lines: readonly GitDiffLineV2[];
+    /** False when pagination cut this hunk; partial hunks must not be written (plan G3). */
+    readonly complete: boolean;
+}
+export type GitDiffDocumentKindV2 = 'text' | 'binary' | 'symlink' | 'submodule' | 'metadata';
+export interface GitDiffCapabilitiesV2 {
+    readonly stageFile: boolean;
+    readonly unstageFile: boolean;
+    readonly stageHunk: boolean;
+    readonly unstageHunk: boolean;
+    readonly stageLines: boolean;
+    readonly reason?: string;
+}
+export interface GitDiffDocumentV2 {
+    readonly schemaVersion: 2;
+    readonly fileToken: string;
+    readonly path: string;
+    readonly source: WebGitFileSourceV1;
+    /** Set only for a historical comparison: the base tree and how it was chosen. */
+    readonly baseOid?: string;
+    readonly baseLabel?: string;
+    readonly repositoryRevision: string;
+    readonly kind: GitDiffDocumentKindV2;
+    readonly binary: boolean;
+    readonly hunks: readonly GitHunkV2[];
+    /** Metadata lines that are not part of any hunk (file headers, mode changes, …). */
+    readonly meta: readonly string[];
+    readonly completeness: 'complete' | 'paged' | 'limited';
+    readonly additions: number;
+    readonly deletions: number;
+    readonly lineCount: number;
+    readonly nextCursor: string | null;
+    readonly capabilities: GitDiffCapabilitiesV2;
+}
+export declare function parseGitDiffDocument(input: {
+    readonly fileToken: string;
+    readonly path: string;
+    readonly source: WebGitFileSourceV1;
+    readonly repositoryRevision: string;
+    readonly lines: readonly string[];
+    readonly hasMore: boolean;
+    /** Host-signed continuation cursor, or null. Never synthesised here. */
+    readonly nextCursor: string | null;
+}): GitDiffDocumentV2;
+//# sourceMappingURL=git-diff-document.d.ts.map