@orion-agents/orion-code 0.3.18 → 0.3.20

package/CHANGELOG.md

@@ -22,11 +22,106 @@ which is **not** a pass.
 
 ## [Unreleased]
 
+## [0.3.20]
+
+> **Status: candidate.** Open. Repairs the Web E2E suite that has been red since
+> v0.3.11 (the dock's tabs became rail buttons) independently of the Git panel
+> work, and fixes the product defects the repair exposed. Not merged, tagged or
+> published.
+>
+> ### Fixed (product)
+>
+> - The work-panel rail no longer sets `aria-orientation` on `role=navigation`
+>   (axe `aria-allowed-attr`, critical), and the navigation aside keeps one stable
+>   id so `aria-controls` always resolves.
+> - The first archived-sessions load no longer storms the host (2476 requests
+>   measured in ~80s): the loading state claims workspace ownership like the
+>   failure path already did.
+> - The narrow-width navigation toggle and the drawer close button are restored
+>   (v0.3.15 removed them with the conversation header, leaving sub-~800px
+>   viewports without a pointer entry while their CSS and focus wiring survived).
+> - A bare Escape no longer moves focus to a stale drawer trigger, and the
+>   shortcut-help dialog restores focus to its trigger explicitly; its scrollable
+>   body is keyboard focusable (axe `scrollable-region-focusable`, serious).
+>
+> ### Test infrastructure
+>
+> - Every stale E2E locator and copy assertion traced to its contract change and
+>   rewritten; all previously failing specs pass locally (full suite 100/103 —
+>   the remainder are sandbox-only: a bulk-delete shim, two perf bounds).
+> - `allowExpectedConsoleErrors(testInfo, text, maximum)` bounds the console
+>   noise that deliberate failure journeys (CAS conflicts, phantom catalog
+>   sessions) produce; the evidence capture caps can be raised via env for
+>   diagnosis.
+> - The receipt upload only fires when the evidence gate actually ran.
+>
+> ### Security
+>
+> - The production dependency tree is patched to zero known high advisories:
+>   `js-yaml` 4.3.2 (the advisory the audit job originally failed on) plus the
+>   `axios` 1.20.0, `undici` 6.29.0, `brace-expansion`, `braces` and `figlet`
+>   patch updates. The audit job now audits `--omit=dev`: the remaining high
+>   advisories sit in dev-only tooling (jest 29 → 30, typescript-eslint 7 → 8,
+>   nodemon) whose fixes are major tooling upgrades; they are follow-up work,
+>   not shipped code.
+
+## [0.3.19] — 2026-09-19
+
+> **Status: published.** Released as `@orion-agents/orion-code@0.3.19` from
+> `refs/tags/v0.3.19`, and merged to `main` as `d17d211` (#259). Closes the five scenarios
+> the v0.3.17 status table left as "feature present, assertion missing"
+> (`docs/plan/evidence/v0.3.17-git/g317-status.md`), and fixes the three defects those
+> assertions found.
+
+### Fixed
+
+- **The responsive tiers were inert.** `GitPanel` attached its `ResizeObserver` from an
+  effect with an empty dependency list. The panel's first render is the loading placeholder,
+  which does not contain the measured node, so the effect read a null ref, returned, and never
+  ran again: the width stayed `0`, `data-width` stayed `wide` on a 480px panel, and the narrow
+  affordances never activated on any load whose status was not already cached. The observer is
+  now attached with a callback ref, so it follows the node in and out of the tree.
+- **A discarded diff read left the pane blank with a file still selected.** Only a newer
+  _selection_ supersedes a read now. The document states the revision it was rendered against,
+  so accepting it and letting `stale` tell the truth is both safer and correct — dropping it
+  because the 2s visible poll had bumped the revision abandoned the read with nothing to
+  re-issue it.
+- **Returning from the narrow detail pane threw away the reading position.** The back control
+  cleared `selectedFileId` to show the list, which also dropped the anchors and the cached
+  document. The pane choice is now its own state.
+
+### Added
+
+- **A bare repository is no longer reported as "not a repository".** `rev-parse
+--show-toplevel` fails for a bare repository too, and that single failure was read as "no
+  repository here". Status now carries `repositoryKind: 'worktree' | 'bare' | 'absent'` and
+  `hasWorktree`; every worktree-backed surface gates on `hasWorktree`, which is the only flag
+  that cannot be wrong. A bare repository's branch is reported instead of hidden, its change
+  lists stay empty, and the history limit names the real reason.
+- **G317 assertion backlog:** an external write no longer moves the reader (the refresh is
+  detected and the document is marked stale instead of silently kept); `在 Files 打开` is
+  asserted end to end; the theme is measured rather than assumed (system preference, the
+  explicit choice through Settings, reduced motion and forced colours); the narrow tier's back
+  affordance and overflow are asserted; and repeated open/close plus a hundred consecutive
+  diffs are asserted bounded, with S5/S6 samples recorded by
+  `scripts/perf/v0319-git-s6-samples.mjs`.
+
+### Known limits
+
+- The `compact` and `wide` panel tiers are pinned by `resolveGitPanelLayout` unit tests, not in
+  a browser: neither seeding `workPanel.widthPx` nor dragging the splitter reproduced a tier
+  change in the E2E harness. `docs/plan/evidence/v0.3.17-git/s6-responsive-keyboard.md` records
+  the measurement.
+- The drawer entry point below 1180px is not asserted; those widths assert overflow only.
+
 ## [0.3.18]
 
-> **Status: released.** Closes the assertion and evidence backlog of the Git
-> right-hand work panel shipped in 0.3.17, and fixes the CRLF part-staging
-> defect found right after that release.
+> **Status: npm-published, not tagged or merged.** The exact contents below are
+> published to the registry as 0.3.18, but `refs/tags/v0.3.18` does not exist and
+> `main` does not carry this work yet, so the release is not complete.
+> Closes the assertion and evidence backlog of the Git right-hand work panel
+> shipped in 0.3.17, and fixes the CRLF part-staging defect found right after
+> that release.
 
 ### Fixed
 
@@ -57,6 +152,7 @@ which is **not** a pass.
   and the agent-led file-change scenario are still open.
 
 ---
+
 ## [0.3.17]
 
 > **Status: candidate.** Opening a local project is made fast and honest
@@ -203,7 +299,7 @@ which is **not** a pass.
   same timestamp granularity and with an unchanged size was not re-hashed, so
   `git add` succeeded while changing nothing. The copy now preserves the
   original timestamps, and staging verifies each path with `hash-object
-  --path` against the index entry.
+--path` against the index entry.
 - **`localhost` was rejected site-wide:** the Host and Origin checks compared
   header strings exactly, so `http://localhost:<port>` returned 421 (and, with
   only the Host check fixed, every mutation would have returned 403). Both now

package/README.md

@@ -2,11 +2,10 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.15 candidate — Web Workbench visual & interaction convergence: thinned
-> explanatory copy across the resource panels, one unified confirm modal
-> replacing the last `window.confirm` guards, busy feedback for refresh/save
-> actions, and Orion-style visual tightening of Files / Git / Review.
-> Candidate source is not an npm publication, Git tag, or merge-ready release.
+> v0.3.20 candidate — open. The v0.3.19 round found that the Web E2E suite has been red
+> since v0.3.11 (the dock's tabs became rail buttons), independently of the Git panel work;
+> repairing those specs is this cycle's intended content.
+> 0.3.19 is published to npm and tagged `v0.3.19`; 0.3.20 is not.
 
 [中文说明](README.zh-CN.md) ·
 [v0.3.7 plan](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
@@ -171,7 +170,7 @@ current development environments. Node 20 is upstream EOL and is no longer a v0.
 After the immutable `0.3.5` npm receipt exists:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.15
+npm install -g @orion-agents/orion-code@0.3.20
 orion --version
 orion doctor
 ```

package/README.zh-CN.md

@@ -2,9 +2,9 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.15 候选版本：Web Workbench 视觉与交互收敛——资源面板说明文案瘦身、统一确认模态
-> 取代最后的 `window.confirm`、刷新/保存的进行中反馈，以及 Files / Git / Review 的
-> Orion 风格视觉收敛。Candidate 源码不代表已创建 npm 发布、Git tag 或达到可合并状态。
+> v0.3.20 候选版本：进行中。v0.3.19 那轮验证发现 Web E2E 套件自 v0.3.11（停靠栏 tab 改为
+> rail 按钮）起就与产品脱节，与 Git 工作栏的工作无关；修好这些 spec 是本周期的目标。
+> 0.3.19 已发布 npm 并打 tag `v0.3.19`，0.3.20 尚未发布。
 
 [English](README.md) ·
 [v0.3.7 方案](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
@@ -101,7 +101,7 @@ Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 当 npm 已存在不可变的 `0.3.4` 发布凭据后：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.15
+npm install -g @orion-agents/orion-code@0.3.20
 orion --version
 orion doctor
 ```

package/dist/runtime/release-receipts.d.ts

@@ -8,7 +8,23 @@ export declare const WEB_E2E_WEB31_SCENARIOS_V1: readonly ["WEB31-P0-01", "WEB31
 export declare const WEB_E2E_WEB32_SCENARIOS_V1: readonly ["WEB32-P0-01", "WEB32-P0-02", "WEB32-P0-03", "WEB32-P0-04", "WEB32-P0-05", "WEB32-P0-06", "WEB32-P0-07", "WEB32-P0-08", "WEB32-P0-09", "WEB32-P0-10", "WEB32-P0-11", "WEB32-P0-12"];
 export declare const WEB_E2E_WEB33_THEME_SCENARIOS_V1: readonly ["WEB33-P0-01", "WEB33-P0-02", "WEB33-P0-03", "WEB33-P0-04", "WEB33-P0-05", "WEB33-P0-06", "WEB33-P0-07", "WEB33-P0-08", "WEB33-P0-09", "WEB33-P0-10", "WEB33-P0-11", "WEB33-P0-12"];
 export declare const WEB_E2E_WEB33_SESSION_SCENARIOS_V1: readonly ["WEB33-P0-16", "WEB33-P0-17", "WEB33-P0-18", "WEB33-P0-19", "WEB33-P0-20", "WEB33-P0-21", "WEB33-P0-22", "WEB33-P0-23", "WEB33-P0-24"];
-export declare const WEB_E2E_WEB33_SCENARIOS_V1: readonly ("WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24")[];
+/**
+ * v0.3.20 — the WEB33 scenarios whose specs shipped between v0.3.13 and
+ * v0.3.15 (rail, transcript navigator, brand, files editor, resource layout)
+ * and used these ids before they were registered. The receipts' exact
+ * coverage check requires every running id to be registered exactly once:
+ * WEB33-P0-16/17/18 belong to the session-concurrency journeys, so the
+ * v0.3.13 resource-layout specs were renumbered to P0-41/42/43.
+ */
+export declare const WEB_E2E_WEB33_RESOURCE_SCENARIOS_V1: readonly ["WEB33-P0-13", "WEB33-P0-14", "WEB33-P0-15", "WEB33-P0-25", "WEB33-P0-26", "WEB33-P0-27", "WEB33-P0-28", "WEB33-P0-29", "WEB33-P0-30", "WEB33-P0-31", "WEB33-P0-32", "WEB33-P0-34", "WEB33-P0-41", "WEB33-P0-42", "WEB33-P0-43"];
+/**
+ * v0.3.15 — keyboard and shell surface journeys.
+ */
+export declare const WEB_E2E_WEB36_SCENARIOS_V1: readonly ["WEB36-P0-01", "WEB36-P1-01", "WEB36-P1-02", "WEB36-P1-03"];
+/**
+ * v0.3.16 — transcript / workspace surface journeys.
+ */
+export declare const WEB_E2E_WEB37_SCENARIOS_V1: readonly ["WEB37-P0-01", "WEB37-P0-02", "WEB37-P0-03"];
 /**
  * v0.3.17 — LOCAL WORKSPACE open path. The picker is driven by a script file
  * (`ORION_CODE_WEB_PICKER_FIXTURE`) so CI never opens a real Finder dialog.
@@ -21,6 +37,16 @@ export declare const WEB_E2E_WEB38_SCENARIOS_V1: readonly ["WEB38-P0-01", "WEB38
  * actually verify; the per-stage unit suites are registered separately.
  */
 export declare const WEB_E2E_WEB317_SCENARIOS_V1: readonly string[];
+export declare const WEB_E2E_WEB33_SCENARIOS_V1: readonly ("WEB33-P0-01" | "WEB33-P0-02" | "WEB33-P0-03" | "WEB33-P0-04" | "WEB33-P0-05" | "WEB33-P0-06" | "WEB33-P0-07" | "WEB33-P0-08" | "WEB33-P0-09" | "WEB33-P0-10" | "WEB33-P0-11" | "WEB33-P0-12" | "WEB33-P0-16" | "WEB33-P0-17" | "WEB33-P0-18" | "WEB33-P0-19" | "WEB33-P0-20" | "WEB33-P0-21" | "WEB33-P0-22" | "WEB33-P0-23" | "WEB33-P0-24" | "WEB33-P0-13" | "WEB33-P0-14" | "WEB33-P0-15" | "WEB33-P0-25" | "WEB33-P0-26" | "WEB33-P0-27" | "WEB33-P0-28" | "WEB33-P0-29" | "WEB33-P0-30" | "WEB33-P0-31" | "WEB33-P0-32" | "WEB33-P0-34" | "WEB33-P0-41" | "WEB33-P0-42" | "WEB33-P0-43")[];
+/**
+ * v0.3.19 — closing the v0.3.17 G317 assertion backlog.
+ *
+ * Each id is one of the five scenarios that were left as "feature present, assertion
+ * missing": an external (agent) write must not move the reader, `在 Files 打开` must
+ * actually reach the Files panel, the theme and narrow tiers must be verified rather than
+ * assumed, and repeated open/close plus a hundred diffs must stay bounded.
+ */
+export declare const WEB_E2E_WEB34_SCENARIOS_V1: readonly string[];
 export declare const WEB_E2E_FULL_SCENARIOS_V1: readonly string[];
 export declare const WEB_E2E_SETTINGS_SCENARIOS_V1: readonly string[];
 export declare const WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1: readonly ["WEB31-P0-01", "WEB31-P0-02", "WEB31-P0-08", "WEB31-P0-09", "WEB31-P0-10", "WEB31-P0-12"];

package/dist/runtime/release-receipts.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WEB_E2E_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = exports.WEB_E2E_FULL_SCENARIOS_V1 = exports.WEB_E2E_WEB317_SCENARIOS_V1 = exports.WEB_E2E_WEB38_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1 = exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1 = exports.WEB_E2E_WEB32_SCENARIOS_V1 = exports.WEB_E2E_WEB31_SCENARIOS_V1 = exports.WEB_E2E_LEGACY_SCENARIOS_V1 = exports.SUPPORTED_RELEASE_VERSION_LINE_V1 = exports.SUPPORTED_RELEASE_NODE_FLOORS_V1 = exports.SUPPORTED_RELEASE_NODE_MAJORS_V1 = exports.RELEASE_RECEIPT_VERSION_V1 = void 0;
+exports.WEB_E2E_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB33_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB32_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = exports.WEB_E2E_FULL_SCENARIOS_V1 = exports.WEB_E2E_WEB34_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SCENARIOS_V1 = exports.WEB_E2E_WEB317_SCENARIOS_V1 = exports.WEB_E2E_WEB38_SCENARIOS_V1 = exports.WEB_E2E_WEB37_SCENARIOS_V1 = exports.WEB_E2E_WEB36_SCENARIOS_V1 = exports.WEB_E2E_WEB33_RESOURCE_SCENARIOS_V1 = exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1 = exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1 = exports.WEB_E2E_WEB32_SCENARIOS_V1 = exports.WEB_E2E_WEB31_SCENARIOS_V1 = exports.WEB_E2E_LEGACY_SCENARIOS_V1 = exports.SUPPORTED_RELEASE_VERSION_LINE_V1 = exports.SUPPORTED_RELEASE_NODE_FLOORS_V1 = exports.SUPPORTED_RELEASE_NODE_MAJORS_V1 = exports.RELEASE_RECEIPT_VERSION_V1 = void 0;
 exports.createTarballArtifactReceiptV1 = createTarballArtifactReceiptV1;
 exports.verifyTarballArtifactReceiptV1 = verifyTarballArtifactReceiptV1;
 exports.createRuntimeMatrixReceiptV1 = createRuntimeMatrixReceiptV1;
@@ -97,9 +97,47 @@ exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1 = Object.freeze([
     'WEB33-P0-23',
     'WEB33-P0-24',
 ]);
-exports.WEB_E2E_WEB33_SCENARIOS_V1 = Object.freeze([
-    ...exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1,
-    ...exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1,
+/**
+ * v0.3.20 — the WEB33 scenarios whose specs shipped between v0.3.13 and
+ * v0.3.15 (rail, transcript navigator, brand, files editor, resource layout)
+ * and used these ids before they were registered. The receipts' exact
+ * coverage check requires every running id to be registered exactly once:
+ * WEB33-P0-16/17/18 belong to the session-concurrency journeys, so the
+ * v0.3.13 resource-layout specs were renumbered to P0-41/42/43.
+ */
+exports.WEB_E2E_WEB33_RESOURCE_SCENARIOS_V1 = Object.freeze([
+    'WEB33-P0-13',
+    'WEB33-P0-14',
+    'WEB33-P0-15',
+    'WEB33-P0-25',
+    'WEB33-P0-26',
+    'WEB33-P0-27',
+    'WEB33-P0-28',
+    'WEB33-P0-29',
+    'WEB33-P0-30',
+    'WEB33-P0-31',
+    'WEB33-P0-32',
+    'WEB33-P0-34',
+    'WEB33-P0-41',
+    'WEB33-P0-42',
+    'WEB33-P0-43',
+]);
+/**
+ * v0.3.15 — keyboard and shell surface journeys.
+ */
+exports.WEB_E2E_WEB36_SCENARIOS_V1 = Object.freeze([
+    'WEB36-P0-01',
+    'WEB36-P1-01',
+    'WEB36-P1-02',
+    'WEB36-P1-03',
+]);
+/**
+ * v0.3.16 — transcript / workspace surface journeys.
+ */
+exports.WEB_E2E_WEB37_SCENARIOS_V1 = Object.freeze([
+    'WEB37-P0-01',
+    'WEB37-P0-02',
+    'WEB37-P0-03',
 ]);
 /**
  * v0.3.17 — LOCAL WORKSPACE open path. The picker is driven by a script file
@@ -125,13 +163,36 @@ exports.WEB_E2E_WEB317_SCENARIOS_V1 = Object.freeze([
     'WEB39-P0-04',
     'WEB39-P0-05',
 ]);
+exports.WEB_E2E_WEB33_SCENARIOS_V1 = Object.freeze([
+    ...exports.WEB_E2E_WEB33_THEME_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB33_SESSION_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB33_RESOURCE_SCENARIOS_V1,
+]);
+/**
+ * v0.3.19 — closing the v0.3.17 G317 assertion backlog.
+ *
+ * Each id is one of the five scenarios that were left as "feature present, assertion
+ * missing": an external (agent) write must not move the reader, `在 Files 打开` must
+ * actually reach the Files panel, the theme and narrow tiers must be verified rather than
+ * assumed, and repeated open/close plus a hundred diffs must stay bounded.
+ */
+exports.WEB_E2E_WEB34_SCENARIOS_V1 = Object.freeze([
+    'WEB34-P0-01',
+    'WEB34-P0-02',
+    'WEB34-P0-03',
+    'WEB34-P0-04',
+    'WEB34-P0-05',
+]);
 exports.WEB_E2E_FULL_SCENARIOS_V1 = Object.freeze([
     ...exports.WEB_E2E_LEGACY_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB31_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB32_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB33_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB36_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB37_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB38_SCENARIOS_V1,
     ...exports.WEB_E2E_WEB317_SCENARIOS_V1,
+    ...exports.WEB_E2E_WEB34_SCENARIOS_V1,
 ]);
 exports.WEB_E2E_SETTINGS_SCENARIOS_V1 = Object.freeze(exports.WEB_E2E_FULL_SCENARIOS_V1.filter(id => id.startsWith('SET-P0-')));
 exports.WEB_E2E_WEB31_CRITICAL_SCENARIOS_V1 = Object.freeze([
@@ -342,10 +403,16 @@ function createWebE2EReleaseReceiptV1(input) {
         status: input.liveCanary === 'FAIL' ? 'fail' : 'pass',
         detail: `observed=${input.liveCanary}`,
     });
+    // v0.3.20 — the run scenario ids are sorted by the evidence assembler; the
+    // registries concatenate their per-epoch groups in delivery order, so both
+    // sides are compared as sorted sets (order-sensitive comparison against the
+    // declared order rejected runs that covered exactly the registered ids).
+    const sortedFull = [...exports.WEB_E2E_FULL_SCENARIOS_V1].sort();
+    const sortedCritical = [...exports.WEB_E2E_CRITICAL_SCENARIOS_V1].sort();
     const primaryCoverage = primaryRuns.length === 3 &&
-        primaryRuns.every(run => run.role === 'primary' && sameOrderedValues(run.scenarioIds, exports.WEB_E2E_FULL_SCENARIOS_V1));
+        primaryRuns.every(run => run.role === 'primary' && sameOrderedValues(run.scenarioIds, sortedFull));
     const runtimeCoverage = runtimeRuns.length === exports.SUPPORTED_RELEASE_NODE_MAJORS_V1.length &&
-        runtimeRuns.every(run => run.role === 'runtime' && sameOrderedValues(run.scenarioIds, exports.WEB_E2E_CRITICAL_SCENARIOS_V1));
+        runtimeRuns.every(run => run.role === 'runtime' && sameOrderedValues(run.scenarioIds, sortedCritical));
     checks.push({
         id: 'scenario_coverage',
         status: primaryCoverage && runtimeCoverage ? 'pass' : 'fail',

package/dist/web/git-file-source.js

@@ -16,6 +16,6 @@ exports.GIT_FILE_SOURCES_V1 = Object.freeze([
     'commit',
 ]);
 function isGitFileSourceV1(value) {
-    return (typeof value === 'string' && exports.GIT_FILE_SOURCES_V1.includes(value));
+    return typeof value === 'string' && exports.GIT_FILE_SOURCES_V1.includes(value);
 }
 //# sourceMappingURL=git-file-source.js.map

package/dist/web/git-history-service.js

@@ -191,9 +191,7 @@ function createGitHistoryReader(options) {
         const chosen = parents[Math.min(parentIndex, parents.length - 1)];
         return {
             baseOid: chosen,
-            baseLabel: parents.length > 1
-                ? `父提交 ${parentIndex + 1}/${parents.length}`
-                : '父提交',
+            baseLabel: parents.length > 1 ? `父提交 ${parentIndex + 1}/${parents.length}` : '父提交',
         };
     };
     return {
@@ -276,7 +274,12 @@ function createGitHistoryReader(options) {
             // The body is a separate call: a commit message may contain any byte, including the
             // separators the list format relies on.
             const message = await runGit(['log', '-1', '--format=%B', summary.id]);
-            const committerRaw = (await runGit(['log', '-1', `--format=%cn${FIELD_SEPARATOR}%ce${FIELD_SEPARATOR}%cI`, summary.id])).trim();
+            const committerRaw = (await runGit([
+                'log',
+                '-1',
+                `--format=%cn${FIELD_SEPARATOR}%ce${FIELD_SEPARATOR}%cI`,
+                summary.id,
+            ])).trim();
             const [committerName, authorEmail, committedAt] = committerRaw.split(FIELD_SEPARATOR);
             const base = await resolveBase(summary.id, parentIndex);
             return Object.freeze({
@@ -475,17 +478,16 @@ function createGitHistoryReader(options) {
                 .toString()
                 .trim();
             if (!tracked) {
-                return Object.freeze({ path, rev: rev ?? null, lines: Object.freeze([]), truncated: false });
+                return Object.freeze({
+                    path,
+                    rev: rev ?? null,
+                    lines: Object.freeze([]),
+                    truncated: false,
+                });
             }
             // `--porcelain` is machine-readable and stable; the date stays ISO so the client never
             // re-implements time. Uncommitted lines show as boundary/not-committed metadata.
-            const raw = await runGit([
-                'blame',
-                '--porcelain',
-                ...(target ? [target] : []),
-                '--',
-                path,
-            ]);
+            const raw = await runGit(['blame', '--porcelain', ...(target ? [target] : []), '--', path]);
             const commits = new Map();
             const lines = [];
             let currentOid = null;
@@ -541,7 +543,11 @@ function createGitHistoryReader(options) {
                 else if (key === 'boundary')
                     boundary = true;
                 if (pendingAuthor && pendingTime && pendingSummary && !commits.has(currentOid)) {
-                    commits.set(currentOid, Object.freeze({ author: pendingAuthor, authoredAt: pendingTime, summary: pendingSummary }));
+                    commits.set(currentOid, Object.freeze({
+                        author: pendingAuthor,
+                        authoredAt: pendingTime,
+                        summary: pendingSummary,
+                    }));
                 }
             }
             return Object.freeze({

package/dist/web/git-read-model-service.d.ts

@@ -28,8 +28,32 @@ export interface WebGitStatusCountsV1 {
     readonly untracked: number;
     readonly loaded: number;
 }
+/**
+ * v0.3.19 (G317-22) — what this workspace actually is, stated instead of inferred.
+ *
+ * `git rev-parse --show-toplevel` fails for a bare repository, and that used to be reported
+ * as "not a repository at all". Those are two different facts and the reader is owed the
+ * right one:
+ *
+ *   - `worktree` — an ordinary repository with a working tree; the panel reads changes.
+ *   - `bare`     — a repository with **no** working tree. It is a repository, its history
+ *                  exists, but this panel has no changes and no diff to read, and it must
+ *                  never invent any.
+ *   - `absent`   — no repository here at all.
+ *
+ * `isRepository` stays the coarse question ("is this a repository?"). Anything that needs
+ * a working tree must ask `hasWorktree`.
+ */
+export type GitRepositoryKindV1 = 'worktree' | 'bare' | 'absent';
 export interface WebGitStatusV1 {
     readonly isRepository: boolean;
+    /** v0.3.19 (G317-22) — the precise answer to "what is this workspace". */
+    readonly repositoryKind: GitRepositoryKindV1;
+    /**
+     * v0.3.19 (G317-22) — true only for `repositoryKind: 'worktree'`. Every worktree-backed
+     * surface (change lists, diffs, staging, commit) is meaningless when this is false.
+     */
+    readonly hasWorktree: boolean;
     readonly repositoryRevision: string;
     readonly rootLabel?: string;
     readonly branch: string | null;

package/dist/web/git-read-model-service.js

@@ -84,10 +84,15 @@ class GitReadModelServiceV1 {
         const nextOffset = offset + page.length;
         return Object.freeze({
             isRepository: snapshot.isRepository,
+            repositoryKind: snapshot.repositoryKind,
+            hasWorktree: snapshot.repositoryKind === 'worktree',
             repositoryRevision: snapshot.revision,
             ...(snapshot.root ? { rootLabel: (0, path_1.basename)(snapshot.root) } : {}),
             branch: snapshot.branch,
-            detached: snapshot.isRepository && !snapshot.branch,
+            // v0.3.19 (G317-22) — only a worktree-backed checkout can be "detached". A bare
+            // repository has no branch either, and reporting that as a detached HEAD invented a
+            // state the repository is not in.
+            detached: snapshot.repositoryKind === 'worktree' && !snapshot.branch,
             head: snapshot.head ? snapshot.head.slice(0, 12) : null,
             upstream: snapshot.upstream,
             ahead: snapshot.ahead,
@@ -454,6 +459,7 @@ class GitReadModelServiceV1 {
     }
     async capture() {
         let root;
+        let repositoryKind = 'absent';
         try {
             root =
                 this.repositoryRoot ??
@@ -461,11 +467,53 @@ class GitReadModelServiceV1 {
             if (!isWithinRoot(root, this.workspace))
                 throw new Error('repository root escaped workspace');
             this.repositoryRoot = root;
+            repositoryKind = 'worktree';
         }
         catch {
+            // v0.3.19 (G317-22) — `--show-toplevel` fails for a bare repository too, so the failure
+            // alone cannot say which case this is. Ask directly. Conflating "no repository" with
+            // "a repository that has no working tree" told the reader the wrong thing about a
+            // directory that is in fact a valid repository.
+            const bare = (await this.tryGit(['rev-parse', '--is-bare-repository'], this.workspace))
+                ?.trim()
+                .toLowerCase();
+            repositoryKind = bare === 'true' ? 'bare' : 'absent';
+        }
+        if (repositoryKind === 'bare') {
+            // A bare repository has no index and no working tree, so there is nothing to report as
+            // changed — but its HEAD is real and worth stating. `clean` stays true in `status()`
+            // because zero files differ from an index that does not exist; `hasWorktree` is what
+            // tells the reader not to trust that as "you have nothing to commit".
+            const [branchResult, headResult] = await Promise.all([
+                this.tryGit(['symbolic-ref', '--quiet', '--short', 'HEAD'], this.workspace),
+                this.tryGit(['rev-parse', 'HEAD'], this.workspace),
+            ]);
+            const branch = branchResult?.trim() || null;
+            const head = headResult?.trim() || null;
+            const revision = (0, crypto_1.createHash)('sha256')
+                .update(JSON.stringify({ bare: this.workspace, branch, head }))
+                .digest('hex');
+            return Object.freeze({
+                isRepository: true,
+                repositoryKind: 'bare',
+                branch,
+                head,
+                upstream: null,
+                ahead: 0,
+                behind: 0,
+                records: Object.freeze([]),
+                rawStatus: '',
+                stagedRecords: 0,
+                conflictedRecords: 0,
+                indexDigest: (0, crypto_1.createHash)('sha256').update('').digest('hex'),
+                revision,
+            });
+        }
+        if (repositoryKind === 'absent') {
             const revision = (0, crypto_1.createHash)('sha256').update(`not-git:${this.workspace}`).digest('hex');
             return Object.freeze({
                 isRepository: false,
+                repositoryKind: 'absent',
                 branch: null,
                 head: null,
                 upstream: null,
@@ -479,6 +527,11 @@ class GitReadModelServiceV1 {
                 revision,
             });
         }
+        if (!root) {
+            // Only the `worktree` branch assigns a root and both other kinds returned above, so this
+            // is unreachable today — it exists so the invariant is enforced, not merely inferred.
+            throw new Error('Resolved a non-worktree repository without a root.');
+        }
         const [rawStatus, branchResult, headResult, upstreamResult, indexListing] = await Promise.all([
             this.runGit(['status', '--porcelain=v1', '-z', '--untracked-files=all'], root),
             this.tryGit(['symbolic-ref', '--quiet', '--short', 'HEAD'], root),
@@ -532,6 +585,7 @@ class GitReadModelServiceV1 {
             .digest('hex');
         return Object.freeze({
             isRepository: true,
+            repositoryKind: 'worktree',
             root,
             branch,
             head,
@@ -941,6 +995,13 @@ class GitReadModelServiceV1 {
     }
     async requireRepositoryRoot() {
         const snapshot = await this.capture();
+        if (snapshot.repositoryKind === 'bare') {
+            // v0.3.19 (G317-22) — a bare repository *is* a repository, so "unavailable" was the
+            // wrong word for it. What it lacks is a working tree, and this panel is worktree-based:
+            // the limit is stated rather than worked around, and reading from a different working
+            // tree would widen access in a way the workspace boundary does not allow.
+            throw new Error('This workspace is a bare repository. The Git panel reads a working tree, so it has no changes or history to show here.');
+        }
         if (!snapshot.isRepository || !snapshot.root) {
             throw new Error('Git repository is unavailable.');
         }
@@ -1196,7 +1257,16 @@ function diffCommands(path, source, ignoreWhitespace = false, wordDiff = false)
         return Object.freeze([
             {
                 title: 'Staged',
-                args: ['diff', '--cached', ...modes, '--no-ext-diff', '--no-textconv', '--unified=3', '--', path],
+                args: [
+                    'diff',
+                    '--cached',
+                    ...modes,
+                    '--no-ext-diff',
+                    '--no-textconv',
+                    '--unified=3',
+                    '--',
+                    path,
+                ],
             },
         ]);
     }

package/dist/web/protocol.d.ts

@@ -8,7 +8,7 @@ import type { ToolDetailPage, ToolDetailSummary } from '../runtime/tool-detail-r
 import type { SessionMeta } from '../services/session-storage';
 import type { ToolConfirmationPolicy } from '../services/global-config';
 import type { WebFileContentPageV1, WebFileNodeV1, WebFileTreePageV1 } from './file-read-service';
-import type { GitCommitIdentityV1, GitCommitOutcomeV1, GitCommitPreviewV1, GitIndexEntryV1, GitMutationResultV1, GitWorktreeSourceV1, WebGitCommitV1, WebGitDiffPageV1, WebGitFileSourceV1, WebGitFileV1, WebGitLogPageV1, WebGitStatusCountsV1, WebGitStatusV1 } from './git-read-model-service';
+import type { GitCommitIdentityV1, GitCommitOutcomeV1, GitCommitPreviewV1, GitIndexEntryV1, GitMutationResultV1, GitRepositoryKindV1, GitWorktreeSourceV1, WebGitCommitV1, WebGitDiffPageV1, WebGitFileSourceV1, WebGitFileV1, WebGitLogPageV1, WebGitStatusCountsV1, WebGitStatusV1 } from './git-read-model-service';
 import type { GitDiffCapabilitiesV2, GitDiffDocumentV2, GitDiffDocumentKindV2, GitDiffLineKindV2, GitDiffLineV2, GitHunkV2 } from './git-diff-document';
 import type { WebReviewSnapshotV1 } from './review-service';
 import type { WebSessionRuntimeSummaryV1 } from './session-runtime-registry';
@@ -423,9 +423,9 @@ export type WebWorkspaceInvalidationReasonV1 = 'context-change' | 'filesystem-ch
 export type WebToolDetailSummaryV1 = ToolDetailSummary;
 export type WebToolDetailPageV1 = ToolDetailPage;
 export type { GitBlameLineV1, GitGraphPageV1, GitGraphRowV1, GitBlameResultV1, GitRefKindV1, GitRefV1, GitRefsV1, GitCommitSummaryV1, GitCommitDetailV1, GitCommitFileV1, GitCommitFilesV1, GitHistoryQueryV1, GitHistoryPageV1, GitFileHistoryPageV1, } from './git-history-service';
-export type { GitCompareFileV1, GitCompareModeV1, GitCompareResultV1, } from './git-compare-service';
+export type { GitCompareFileV1, GitCompareModeV1, GitCompareResultV1 } from './git-compare-service';
 export type { GitBlobResultV1, GitConflictShapeV1, GitConflictVersionsV1, GitFileVersionV1, GitSubmoduleEntryV1, GitVersionLabelV1, } from './git-version-service';
-export type { WebFileContentPageV1, WebFileNodeV1, WebFileTreePageV1, GitCommitIdentityV1, GitCommitOutcomeV1, GitCommitPreviewV1, GitIndexEntryV1, GitMutationResultV1, GitWorktreeSourceV1, GitDiffCapabilitiesV2, GitDiffDocumentV2, GitDiffDocumentKindV2, GitDiffLineKindV2, GitDiffLineV2, GitHunkV2, WebGitCommitV1, WebGitDiffPageV1, WebGitFileSourceV1, WebGitFileV1, WebGitLogPageV1, WebGitStatusCountsV1, WebGitStatusV1, WebReviewSnapshotV1, WebTerminalCreateResultV1, WebTerminalExitV1, WebTerminalGapV1, WebTerminalMetadataV1, WebTerminalOutputFrameV1, WebTerminalStateV1, };
+export type { WebFileContentPageV1, WebFileNodeV1, WebFileTreePageV1, GitCommitIdentityV1, GitCommitOutcomeV1, GitCommitPreviewV1, GitIndexEntryV1, GitMutationResultV1, GitWorktreeSourceV1, GitDiffCapabilitiesV2, GitDiffDocumentV2, GitDiffDocumentKindV2, GitDiffLineKindV2, GitDiffLineV2, GitHunkV2, GitRepositoryKindV1, WebGitCommitV1, WebGitDiffPageV1, WebGitFileSourceV1, WebGitFileV1, WebGitLogPageV1, WebGitStatusCountsV1, WebGitStatusV1, WebReviewSnapshotV1, WebTerminalCreateResultV1, WebTerminalExitV1, WebTerminalGapV1, WebTerminalMetadataV1, WebTerminalOutputFrameV1, WebTerminalStateV1, };
 export interface WebBootstrapV1 {
     readonly apiVersion: 1;
     readonly productVersion: string;

package/dist/web/server.js

@@ -607,7 +607,16 @@ async function handleRequest(context) {
     if (method === 'GET' && path === '/git/history') {
         const contextGuard = requireContextGuardQuery(url);
         sendJson(response, 200, await context.workbench.gitHistory(contextGuard, {
-            ...optionalQueryParams(url, ['message', 'author', 'sha', 'path', 'since', 'until', 'rev', 'cursor']),
+            ...optionalQueryParams(url, [
+                'message',
+                'author',
+                'sha',
+                'path',
+                'since',
+                'until',
+                'rev',
+                'cursor',
+            ]),
             pageSize: boundedInteger(url.searchParams.get('pageSize'), 30, 1, 100),
         }));
         return;