@rethunk/mcp-multi-root-git 2.4.0 → 2.6.0

package/AGENTS.md

@@ -22,7 +22,7 @@ IDEs injecting this as context: do not re-link from rules.
 | [`src/server/presets.ts`](src/server/presets.ts) | `PRESET_FILE_PATH`, `loadPresetsFromGitTop`, `presetLoadErrorPayload`, `applyPresetNestedRoots`, `applyPresetParityPairs`; Zod schemas must match [`git-mcp-presets.schema.json`](git-mcp-presets.schema.json) |
 | [`src/server/schemas.ts`](src/server/schemas.ts) | `WorkspacePickSchema`, `MAX_INVENTORY_ROOTS_DEFAULT`, **`MAX_ABSOLUTE_GIT_ROOTS`** (256), optional **`absoluteGitRoots`** on workspace pick |
 | [`src/server/inventory.ts`](src/server/inventory.ts) | `InventoryEntryJson`, `validateRepoPath`, `makeSkipEntry`, `buildInventorySectionMarkdown`, `collectInventoryEntry` |
-| [`src/server/git-refs.ts`](src/server/git-refs.ts) | `isProtectedBranch`, `isSafeGitRefToken`, `isSafeGitRangeToken`, `isSafeGitAncestorRef`; `getCurrentBranch`, `resolveRef`, `isWorkingTreeClean`, `isFullyMergedInto`, `commitListBetween`; `listWorktrees`, `worktreeForBranch`; `conflictPaths` |
+| [`src/server/git-refs.ts`](src/server/git-refs.ts) | `isProtectedBranch`, `isSafeGitRefToken`, `isSafeGitRangeToken`, `isSafeGitAncestorRef`; `getCurrentBranch`, `resolveRef`, `isWorkingTreeClean`, `isFullyMergedInto`, `isContentEquivalentlyMergedInto`, `commitListBetween`; `listWorktrees`, `worktreeForBranch`; `inferRemoteFromUpstream`; `conflictPaths` |
 | [`src/server/tools.ts`](src/server/tools.ts) | `registerRethunkGitTools` — dispatches to `register*` below |
 | [`src/server/git-status-tool.ts`](src/server/git-status-tool.ts) | `git_status` |
 | [`src/server/git-inventory-tool.ts`](src/server/git-inventory-tool.ts) | `git_inventory` |
@@ -48,7 +48,7 @@ IDEs injecting this as context: do not re-link from rules.
 ## Changing contracts
 
 - **No banner paragraphs** in shipped docs. Use normal titles + cross-links.
-- **JSON format version** (currently `"3"`, discoverable via MCP `initialize`): bump on incompatible JSON changes (renamed/nested/omitted fields). Document migration here + [docs/mcp-tools.md](docs/mcp-tools.md). v2 removed the `rethunkGitMcp` envelope; payloads are minified; optional fields omitted when empty/null/false. v3 changes in `git_log`: `sha7` → `sha` (full SHA), `workspace_root` → `workspaceRoot`, `ageRelative` removed, `email` omitted when empty.
+- **JSON format version** (currently `"3"`, exported as `MCP_JSON_FORMAT_VERSION` in `src/server.ts` and surfaced via the FastMCP `instructions` field — discoverable from the MCP `initialize` response): bump on incompatible JSON changes (renamed/nested/omitted fields). Document migration here + [docs/mcp-tools.md](docs/mcp-tools.md). v2 removed the `rethunkGitMcp` envelope; payloads are minified; optional fields omitted when empty/null/false. v3 changes in `git_log`: `sha7` → `sha` (full SHA), `workspace_root` → `workspaceRoot`, `ageRelative` removed, `email` omitted when empty.
 - **Preset file:** keep `presets.ts` Zod schemas aligned with [`git-mcp-presets.schema.json`](git-mcp-presets.schema.json).
 - **Public tool surface:** rename/add → update [docs/mcp-tools.md](docs/mcp-tools.md) + [README.md](README.md) (if mentioned), then regenerate the shipped schema artifacts (`tool-parameters.schema.json`, `schemas/index.json`, `schemas/*.json`). Install/client wiring → [docs/install.md](docs/install.md) only.
 
@@ -66,7 +66,7 @@ Rules for LLMs operating in or against this repository.
 
 **End-user Git/MCP preference** (status/log/diff/commits): **`~/.claude/CLAUDE.md`** § **Git & GitHub** — same policy when dogfooding this server from a harness.
 
-**Mutating tools require workspace-root confirmation** — `git_fetch`, `batch_commit`, `git_push`, `git_merge`, `git_cherry_pick`, `git_reset_soft`, `git_tag`, and `git_stash_apply` operate only on roots confirmed by `requireGitAndRoots` / `requireSingleRepo`. Never pass caller-supplied absolute paths to mutating tools; use `workspaceRoot` or MCP roots.
+**Mutating tools use `workspaceRoot` as trusted operator input** — `git_fetch`, `batch_commit`, `git_push`, `git_merge`, `git_cherry_pick`, `git_reset_soft`, `git_tag`, and `git_stash_apply` operate on roots resolved via `requireGitAndRoots` / `requireSingleRepo`. Pass the target repo as `workspaceRoot` (trusted caller input) or via MCP roots. The `absoluteGitRoots` bulk multi-root parameter is not accepted by mutating tools — passing it is rejected.
 
 **`batch_commit` atomic staging — single call per logical change** — Do NOT attempt incremental staging across multiple `batch_commit` calls. Each call is self-contained: it stages all files in all entries, commits them sequentially, and the moment the call completes, all commits have landed. Include all related files (for all related commit entries) in a single `batch_commit` call. A call cannot be resumed or extended by a later call — each is an independent transaction. If entry N fails, entries before N remain committed; entries after N are skipped (not rolled back).
 
@@ -76,7 +76,7 @@ Rules for LLMs operating in or against this repository.
 
 **Never force-push** — `git_push` has no force-push mode by design. `git_merge` with `strategy: "ff-only"` will fail cleanly rather than force.
 
-**Contract bumps need documentation** — if a JSON output shape changes incompatibly, bump `MCP_JSON_FORMAT_VERSION` in `src/server.ts` and document the migration in both this file and [docs/mcp-tools.md](docs/mcp-tools.md).
+**Contract bumps need documentation** — if a JSON output shape changes incompatibly, bump the `MCP_JSON_FORMAT_VERSION` constant in `src/server.ts` (it is surfaced in the server `instructions` field and discoverable via MCP `initialize`) and document the migration in both this file and [docs/mcp-tools.md](docs/mcp-tools.md).
 
 **Path confinement** — any tool accepting file paths must use `resolvePathForRepo` / `assertRelativePathUnderTop` from [`src/repo-paths.ts`](src/repo-paths.ts) and include escaping-attempt tests.
 

package/CHANGELOG.md

@@ -2,7 +2,61 @@
 
 All notable changes to `@rethunk/mcp-multi-root-git` are documented here. Format loosely follows [Keep a Changelog](https://keepachangelog.com); the project uses [Semantic Versioning](https://semver.org).
 
-## [Unreleased]
+## [2.6.0] — 2026-05-22
+
+Security-hardening and correctness release surfaced by a full-repo critical review.
+
+### Security
+
+- **Argument-injection hardening** — `git_show`, `git_log`, and `git_fetch` passed caller-supplied ref/branch/remote values straight into git argv. A value beginning with `-` is parsed by git as an option (`--output=<path>` writes an arbitrary file; `--upload-pack=<cmd>` on fetch runs a command). These read tools now validate those tokens against the argv-safe subset before invoking git, returning `unsafe_ref_token`, `unsafe_remote_token`, or `path_escapes_repo` on rejection — the same gate already applied to the mutating tools.
+- **`isProtectedBranch` normalization** — input is now normalized (trim, strip leading `refs/heads/`, lowercase) before matching, so `refs/heads/main`, `Main`, and `MAIN` are all recognized as protected. Previously the exact-name set was case-sensitive and a `refs/heads/` prefix evaded it entirely.
+
+### Fixed
+
+- **`batch_commit` linked worktrees** — hunk-level staging wrote its scratch patch under `${gitTop}/.git/`, which fails with `ENOTDIR` in a linked worktree (where `.git` is a file). The scratch path is now resolved via `git rev-parse --absolute-git-dir`, correct for both normal repos and worktrees.
+- **`batch_commit` dry run** — preview cleanup ran an unconditional `git reset HEAD --` over every touched path, silently unstaging work the caller had staged before invoking. A pre-staged snapshot is now taken first; cleanup resets only paths the dry run itself staged.
+- **`git_stash_list` index** — `index` was taken from the loop counter, so a malformed entry dropped by the parse guard shifted every later index and `git_stash_apply` could target the wrong stash. The index is now parsed from the canonical `stash@{N}` ref.
+- **`git_diff_summary` rename parsing** — the new path of a rename whose path contained the substring ` b/` was mis-reported because the greedy `diff --git` header regex split at the wrong point; the authoritative `rename to` body line is now used.
+- **`.gitmodules` parser** — `parseGitSubmodulePaths` matched any `path =` line regardless of INI section and ignored comments; it now tracks `[submodule]` sections and strips `;`/`#` comments.
+- **`git_inventory` / `git_parity` v3 JSON** — `workspace_root` field corrected to `workspaceRoot` (camelCase), completing the v3 contract rename already applied to `git_log`.
+
+### Changed
+
+- **`git_tag` error codes renamed** — `tag_empty` → `empty_tag_name`, `tag_unsafe` → `unsafe_tag_token`, `ref_unsafe` → `unsafe_ref_token`; consistent with the server-wide naming convention.
+- **`git_diff` multi-root parameters removed** — `absoluteGitRoots` and `allWorkspaceRoots` are no longer accepted by `git_diff`; it is now a pure single-repo tool (identical posture to `git_show`). Use `workspaceRoot` or `rootIndex` to select the target repo. `git_diff_summary` keeps single-entry `absoluteGitRoots` and drops only `allWorkspaceRoots`.
+- **`MCP_JSON_FORMAT_VERSION` constant** — `"3"` is now an exported constant in `src/server.ts` and surfaced in the FastMCP `instructions` field, making the format version discoverable from the MCP `initialize` response.
+- **CI** — the 20 published per-tool `schemas/*.json` artifacts are now drift-checked on every PR via a new `schema:individual:check` step; previously only `tool-parameters.schema.json` was gated.
+
+## [2.5.0] — 2026-05-15
+
+Bug-fix and documentation release; includes one new `git_log` output format.
+
+### Added
+
+- **`git_log` `format: "oneline"`** — minimal `<sha7> <subject>` output per commit for low-token post-commit verification. Multi-root output uses `### repo (branch)` separators; single-root output emits one line per commit with no headers.
+
+### Fixed
+
+- **`git_stash_list`**: format string used for-each-ref placeholders (`%(subject)`, `%(objectname:short)`) instead of git-log format (`%s`, `%h`), printing literal placeholder text as the stash message.
+- **`git_stash_list`**: stash message containing `|` caused the SHA field to be parsed as a mid-message fragment; SHA is now always the last pipe-separated field.
+- **`batch_commit`**: deleted tracked files (missing on disk) could not be staged; now staged via `git rm --cached`. Combining `{ path, lines }` with a deleted file is validated as an error.
+- **`batch_commit` hunk-level staging**: `newCount=0` pure-deletion hunks were excluded from line ranges that included the deletion point (`hunkEnd` was `newStart-1`); now `hunkEnd = newStart` for zero-count hunks.
+- **`git_diff_summary`**: diff header regex mis-parsed file paths containing ` b/` (e.g. `src/b/file.ts`), reporting wrong path and zero stats; now uses midpoint-symmetry split for non-renames, falls back to regex for renames.
+- **`git_diff_summary`**: `git diff --stat` bar-graph character counting is scaled to terminal width and under-reports for large files; replaced with `git diff --numstat` for exact addition/deletion counts.
+- **`git_cherry_pick`**: branch deletion after cherry-pick now uses patch-id equivalence by default so source branches with differing SHAs but identical content are correctly detected as merged. Pass `strictMergedRefEquality: true` for strict SHA-reachability semantics.
+- **`parseGitSubmodulePaths`**: non-regular files at `.gitmodules` (character devices, sockets — common in Claude Code / sandbox environments) are now rejected via `lstatSync().isFile()` before `readFileSync`, preventing `EACCES` errors.
+
+### Tests
+
+- Integration tests added for `git_stash_list`, `git_stash_apply`, `git_fetch`, `git_status`, `git_inventory`, and `git_parity` execute paths.
+- `isContentEquivalentlyMergedInto` integration tests via real git repos with cherry-picked and diverged histories.
+- `batch_commit` dryRun tests covering deleted-file unstaging.
+
+### Documentation
+
+- **`git_status`, `git_inventory`, `git_parity`, `list_presets`** now have complete parameter tables, JSON shape examples, and error code tables in `docs/mcp-tools.md`.
+- **`git_cherry_pick`** `strictMergedRefEquality` parameter added to docs; `deleteMergedBranches` description corrected (default is patch-id equivalence, not SHA-reachability).
+- **`batch_commit`** `files` parameter and `stage_failed` error code updated to document deleted-file staging path.
 
 ## [2.4.0] — 2026-05-07
 

package/dist/server/batch-commit-tool.js

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import { z } from "zod";
 import { isStrictlyUnderGitTop, resolvePathForRepo } from "../repo-paths.js";
 import { spawnGitAsync } from "./git.js";
@@ -22,7 +23,9 @@ const CommitEntrySchema = z.object({
     files: z
         .array(FileEntrySchema)
         .min(1)
-        .describe("Paths to stage, relative to the git root. Each can be a string path or { path, lines } for hunk-level staging."),
+        .describe("Paths to stage, relative to the git root. Each can be a string path or { path, lines } for hunk-level staging. " +
+        "Deleted files (missing on disk but tracked in HEAD) are staged as removals via `git rm --cached`. " +
+        "Combining { path, lines } with a deleted file is an error."),
 });
 const PushModeSchema = z
     .enum(["never", "after"])
@@ -74,7 +77,9 @@ function extractOverlappingHunks(diffContent, fromLine, toLine) {
         if (hunkMatch) {
             const newStart = Number.parseInt(hunkMatch[1] || "0", 10);
             const newCount = Number.parseInt(hunkMatch[2] || "1", 10);
-            const hunkEnd = newStart + newCount - 1;
+            // newCount=0 means pure deletion; hunkEnd must equal newStart so ranges
+            // that include newStart correctly capture the deletion.
+            const hunkEnd = newCount === 0 ? newStart : newStart + newCount - 1;
             // Check if hunk overlaps with requested line range
             const hasOverlap = !(hunkEnd < fromLine || newStart > toLine);
             if (hasOverlap) {
@@ -123,6 +128,23 @@ function extractOverlappingHunks(diffContent, fromLine, toLine) {
  * overlapping the range are staged via a partial patch. Otherwise, stages the whole file.
  */
 async function stageFile(gitTop, filePath, lines) {
+    const absPath = resolvePathForRepo(filePath, gitTop);
+    const fileOnDisk = existsSync(absPath);
+    if (!fileOnDisk) {
+        if (lines) {
+            return { ok: false, error: "cannot stage line range for deleted file" };
+        }
+        // File missing on disk — stage as removal if tracked in HEAD
+        const lsResult = await spawnGitAsync(gitTop, ["ls-files", "--error-unmatch", "--", filePath]);
+        if (!lsResult.ok) {
+            return { ok: false, error: `pathspec '${filePath}' did not match any files` };
+        }
+        const rmResult = await spawnGitAsync(gitTop, ["rm", "--cached", "--", filePath]);
+        return {
+            ok: rmResult.ok,
+            error: rmResult.ok ? undefined : (rmResult.stderr || rmResult.stdout).trim(),
+        };
+    }
     if (!lines) {
         // Simple case: stage the whole file
         const addResult = await spawnGitAsync(gitTop, ["add", "--", filePath]);
@@ -140,8 +162,14 @@ async function stageFile(gitTop, filePath, lines) {
     if (!partialPatch) {
         return { ok: false, error: "No hunks found in line range" };
     }
-    // Write partial patch to temp file in the git repo and apply it to the index
-    const tempPatchFile = `${gitTop}/.git/.mcp-patch-${Date.now()}-${Math.random().toString(36).slice(2)}.patch`;
+    // Resolve the real git dir (works for linked worktrees where .git is a file, not a dir)
+    const gitDirResult = await spawnGitAsync(gitTop, ["rev-parse", "--absolute-git-dir"]);
+    if (!gitDirResult.ok) {
+        return { ok: false, error: (gitDirResult.stderr || gitDirResult.stdout).trim() };
+    }
+    const gitDir = gitDirResult.stdout.trim();
+    // Write partial patch to temp file in the git dir and apply it to the index
+    const tempPatchFile = `${gitDir}/.mcp-patch-${Date.now()}-${Math.random().toString(36).slice(2)}.patch`;
     const { writeFileSync, unlinkSync } = await import("node:fs");
     writeFileSync(tempPatchFile, partialPatch, "utf8");
     const applyResult = await spawnGitAsync(gitTop, ["apply", "--cached", tempPatchFile]);
@@ -217,6 +245,18 @@ export function registerBatchCommitTool(server) {
             const gitTop = pre.gitTop;
             const results = [];
             const stagedFilesForCleanup = new Set();
+            // Snapshot already-staged paths BEFORE the preview loop so dry-run cleanup
+            // doesn't unstage files the caller had staged before invoking.
+            let preStagedPaths = new Set();
+            if (args.dryRun) {
+                const snapResult = await spawnGitAsync(gitTop, ["diff", "--cached", "--name-only"]);
+                if (snapResult.ok) {
+                    preStagedPaths = new Set(snapResult.stdout
+                        .split("\n")
+                        .map((s) => s.trim())
+                        .filter(Boolean));
+                }
+            }
             for (let i = 0; i < args.commits.length; i++) {
                 const entry = args.commits[i];
                 if (!entry)
@@ -276,10 +316,13 @@ export function registerBatchCommitTool(server) {
                     });
                     break;
                 }
-                // Track staged files for cleanup in dry-run
+                // Track staged files for cleanup in dry-run, excluding paths that were
+                // already staged before this call (so pre-existing staged state survives).
                 if (args.dryRun) {
                     for (const path of filePaths) {
-                        stagedFilesForCleanup.add(path);
+                        if (!preStagedPaths.has(path)) {
+                            stagedFilesForCleanup.add(path);
+                        }
                     }
                 }
                 // --- Dry-run mode: collect preview and unstage ---

package/dist/server/git-cherry-pick-tool.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { spawnGitAsync } from "./git.js";
-import { commitListBetween, conflictPaths, getCurrentBranch, isFullyMergedInto, isProtectedBranch, isSafeGitRangeToken, isSafeGitRefToken, isWorkingTreeClean, resolveRef, worktreeForBranch, } from "./git-refs.js";
+import { commitListBetween, conflictPaths, getCurrentBranch, isContentEquivalentlyMergedInto, isFullyMergedInto, isProtectedBranch, isSafeGitRangeToken, isSafeGitRefToken, isWorkingTreeClean, resolveRef, worktreeForBranch, } from "./git-refs.js";
 import { jsonRespond, spreadDefined, spreadWhen } from "./json.js";
 import { requireSingleRepo } from "./roots.js";
 import { WorkspacePickSchema } from "./schemas.js";
@@ -96,8 +96,11 @@ export function registerGitCherryPickTool(server) {
         description: "Play commits from one or more sources onto a destination. Sources may be SHAs, " +
             "`A..B` ranges, or branch names (expanded to `onto..<branch>`, oldest-first). " +
             "Commits already reachable from the destination are skipped. Refuses on dirty tree; " +
-            "stops on the first conflict and reports paths. Optional flags auto-delete fully " +
-            "merged source branches and their worktrees, skipping protected names.",
+            "stops on the first conflict and reports paths. Optional flags auto-delete source " +
+            "branches and worktrees after success; deletion uses patch-id equivalence by default " +
+            "(content-identical commits with different SHAs are treated as merged, which is the " +
+            "normal cherry-pick outcome). Pass `strictMergedRefEquality: true` for strict `git branch -d` " +
+            "ancestry semantics. Protected branch names always skipped.",
         annotations: {
             readOnlyHint: false,
             destructiveHint: false,
@@ -127,6 +130,15 @@ export function registerGitCherryPickTool(server) {
                 .default(false)
                 .describe("After success, remove any local worktree attached to a branch-kind source " +
                 "(`git worktree remove`). Protected tails always skipped."),
+            strictMergedRefEquality: z
+                .boolean()
+                .optional()
+                .default(false)
+                .describe("When false (default), branch deletion uses patch-id equivalence: a source branch " +
+                "is deleted when every commit it contains has a content-equivalent commit on the " +
+                "destination (same diff, different SHA — the normal cherry-pick outcome). " +
+                "Set to true to require strict ref ancestry (`git branch -d` semantics), which " +
+                "will refuse deletion after a cherry-pick because the SHA differs."),
         }),
         execute: async (args) => {
             const pre = requireSingleRepo(server, args);
@@ -221,11 +233,23 @@ export function registerGitCherryPickTool(server) {
                         }
                     }
                     if (args.deleteMergedBranches) {
-                        const merged = await isFullyMergedInto(gitTop, src.raw, onto);
-                        if (merged) {
-                            const r = await spawnGitAsync(gitTop, ["branch", "-d", src.raw]);
-                            if (r.ok)
-                                src.branchDeleted = true;
+                        if (args.strictMergedRefEquality) {
+                            const merged = await isFullyMergedInto(gitTop, src.raw, onto);
+                            if (merged) {
+                                const r = await spawnGitAsync(gitTop, ["branch", "-d", src.raw]);
+                                if (r.ok)
+                                    src.branchDeleted = true;
+                            }
+                        }
+                        else {
+                            const merged = await isContentEquivalentlyMergedInto(gitTop, src.raw, onto);
+                            if (merged) {
+                                // -D required: git branch -d checks ref ancestry (fails after cherry-pick),
+                                // but we've already verified content equivalence via patch-id.
+                                const r = await spawnGitAsync(gitTop, ["branch", "-D", src.raw]);
+                                if (r.ok)
+                                    src.branchDeleted = true;
+                            }
                         }
                     }
                 }

package/dist/server/git-diff-summary-tool.js

@@ -24,23 +24,25 @@ const DEFAULT_EXCLUDE_PATTERNS = [
 // Helpers
 // ---------------------------------------------------------------------------
 /**
- * Parse `git diff --stat` output into per-file stats.
- * Format: " path/to/file | N ++++---"
- * Final line: " N files changed, N insertions(+), N deletions(-)"
+ * Parse `git diff --numstat` output into exact per-file counts.
+ * Format per line: "<additions>\t<deletions>\t<path>"
+ * Binary files emit "-\t-\t<path>" and are recorded as 0/0.
  */
-function parseStatOutput(stat) {
+function parseNumstatOutput(numstat) {
     const result = new Map();
-    for (const line of stat.split("\n")) {
-        // Skip the summary line and blank lines
-        if (!line.includes("|"))
+    for (const line of numstat.split("\n")) {
+        const parts = line.split("\t");
+        if (parts.length < 3)
             continue;
-        const pipeIdx = line.indexOf("|");
-        const filePart = line.slice(0, pipeIdx).trim();
-        const statPart = line.slice(pipeIdx + 1).trim();
-        // statPart looks like "5 ++---" or "3 +++", count + and -
-        const additions = (statPart.match(/\+/g) ?? []).length;
-        const deletions = (statPart.match(/-/g) ?? []).length;
-        result.set(filePart, { additions, deletions });
+        const [addStr, delStr, ...pathParts] = parts;
+        const filePath = pathParts.join("\t");
+        if (!filePath)
+            continue;
+        const additions = addStr === "-" ? 0 : Number.parseInt(addStr ?? "0", 10);
+        const deletions = delStr === "-" ? 0 : Number.parseInt(delStr ?? "0", 10);
+        if (!Number.isNaN(additions) && !Number.isNaN(deletions)) {
+            result.set(filePath, { additions, deletions });
+        }
     }
     return result;
 }
@@ -68,10 +70,26 @@ function parseDiffOutput(diff) {
  * Body may contain "rename from", "rename to", "new file mode", "deleted file mode".
  */
 function extractFileInfo(header, body) {
-    // Parse "diff --git a/X b/Y"
-    const headerMatch = /^diff --git a\/(.+) b\/(.+)$/.exec(header);
-    const aPath = headerMatch?.[1] ?? "";
-    const bPath = headerMatch?.[2] ?? aPath;
+    // Parse "diff --git a/X b/Y". For non-renames X === Y; use midpoint split so
+    // paths containing " b/" (e.g. "src/b/file.ts") are not mis-parsed by a greedy regex.
+    const prefix = "diff --git a/";
+    const raw = header.startsWith(prefix) ? header.slice(prefix.length) : "";
+    const midLen = (raw.length - " b/".length) / 2;
+    let aPath = "";
+    let bPath = "";
+    if (Number.isInteger(midLen) && midLen > 0) {
+        const candidate = raw.slice(0, midLen);
+        if (raw.slice(midLen) === ` b/${candidate}`) {
+            aPath = candidate;
+            bPath = candidate;
+        }
+    }
+    if (!aPath) {
+        // Fall back for renames (aPath ≠ bPath); rename paths also come from body lines.
+        const headerMatch = /^diff --git a\/(.+) b\/(.+)$/.exec(header);
+        aPath = headerMatch?.[1] ?? "";
+        bPath = headerMatch?.[2] ?? aPath;
+    }
     let status = "modified";
     let oldPath;
     if (/^new file mode/m.test(body)) {
@@ -84,6 +102,12 @@ function extractFileInfo(header, body) {
         status = "renamed";
         const fromMatch = /^rename from (.+)$/m.exec(body);
         oldPath = fromMatch?.[1];
+        // Prefer the authoritative "rename to <path>" body line over the greedy
+        // header regex split, which mis-parses paths containing the literal " b/".
+        const toMatch = /^rename to (.+)$/m.exec(body);
+        if (toMatch?.[1]) {
+            bPath = toMatch[1];
+        }
     }
     const path = status === "deleted" ? aPath : bPath;
     return { path, oldPath, status };
@@ -160,7 +184,7 @@ export function registerGitDiffSummaryTool(server) {
         annotations: {
             readOnlyHint: true,
         },
-        parameters: WorkspacePickSchema.extend({
+        parameters: WorkspacePickSchema.omit({ allWorkspaceRoots: true }).extend({
             range: z
                 .string()
                 .optional()
@@ -202,15 +226,15 @@ export function registerGitDiffSummaryTool(server) {
                 return jsonRespond({ error: diffArgsResult.error });
             }
             const diffArgs = diffArgsResult.args;
-            // --- Run git diff --stat ---
-            const statResult = await spawnGitAsync(gitTop, ["diff", "--stat", ...diffArgs]);
+            // --- Run git diff --numstat for exact addition/deletion counts ---
+            const statResult = await spawnGitAsync(gitTop, ["diff", "--numstat", ...diffArgs]);
             if (!statResult.ok) {
                 return jsonRespond({
                     error: "git_diff_failed",
                     detail: (statResult.stderr || statResult.stdout).trim(),
                 });
             }
-            const statMap = parseStatOutput(statResult.stdout);
+            const statMap = parseNumstatOutput(statResult.stdout);
             // --- Run git diff ---
             const diffResult = await spawnGitAsync(gitTop, ["diff", ...diffArgs]);
             if (!diffResult.ok) {

package/dist/server/git-diff-tool.js

@@ -61,7 +61,10 @@ export function registerGitDiffTool(server) {
         annotations: {
             readOnlyHint: true,
         },
-        parameters: WorkspacePickSchema.extend({
+        parameters: WorkspacePickSchema.omit({
+            absoluteGitRoots: true,
+            allWorkspaceRoots: true,
+        }).extend({
             base: z
                 .string()
                 .optional()

package/dist/server/git-fetch-tool.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { spawnGitAsync } from "./git.js";
+import { isSafeGitUpstreamToken, spawnGitAsync } from "./git.js";
 import { jsonRespond } from "./json.js";
 import { requireSingleRepo } from "./roots.js";
 import { WorkspacePickSchema } from "./schemas.js";
@@ -78,6 +78,13 @@ export function registerGitFetchTool(server) {
             const branch = args.branch?.trim();
             const prune = args.prune === true;
             const tags = args.tags === true;
+            // Validate remote and branch to prevent argument injection.
+            if (!isSafeGitUpstreamToken(remote)) {
+                return jsonRespond({ error: "unsafe_remote_token", remote });
+            }
+            if (branch && !isSafeGitUpstreamToken(branch)) {
+                return jsonRespond({ error: "unsafe_ref_token", branch });
+            }
             // Build git fetch command
             const fetchArgs = ["fetch"];
             if (prune) {

package/dist/server/git-inventory-tool.js

@@ -57,7 +57,7 @@ export function registerGitInventoryTool(server) {
                     const err = { error: "not_a_git_repository", path: workspaceRoot };
                     if (args.format === "json") {
                         allJson.push({
-                            workspace_root: workspaceRoot,
+                            workspaceRoot: workspaceRoot,
                             ...(upstream.mode === "fixed" ? { upstream } : {}),
                             entries: [
                                 makeSkipEntry(workspaceRoot, workspaceRoot, upstream.mode, JSON.stringify(err)),
@@ -117,7 +117,7 @@ export function registerGitInventoryTool(server) {
                 }
                 if (args.format === "json") {
                     allJson.push({
-                        workspace_root: top,
+                        workspaceRoot: top,
                         ...spreadDefined("presetSchemaVersion", presetSchemaVersion),
                         ...spreadWhen(nestedRootsTruncated, {
                             nestedRootsTruncated: true,

package/dist/server/git-log-tool.js

@@ -1,6 +1,7 @@
 import { basename } from "node:path";
 import { z } from "zod";
 import { asyncPool, GIT_SUBPROCESS_PARALLELISM, gitTopLevel, spawnGitAsync } from "./git.js";
+import { isSafeGitAncestorRef } from "./git-refs.js";
 import { jsonRespond, spreadDefined, spreadWhen } from "./json.js";
 import { requireGitAndRoots } from "./roots.js";
 import { WorkspacePickSchema } from "./schemas.js";
@@ -133,6 +134,22 @@ async function runGitLog(opts) {
 // ---------------------------------------------------------------------------
 // Markdown rendering
 // ---------------------------------------------------------------------------
+function renderLogOneline(group, multiRoot) {
+    const lines = [];
+    if (multiRoot) {
+        lines.push(`### ${group.repo} (${group.branch})`);
+    }
+    for (const c of group.commits) {
+        lines.push(`${c.sha.slice(0, 7)} ${c.subject}`);
+    }
+    if (group.commits.length === 0) {
+        lines.push("(no commits)");
+    }
+    if (group.truncated) {
+        lines.push(`(+${group.omittedCount} more)`);
+    }
+    return lines.join("\n");
+}
 function renderLogMarkdown(group, filterSummary) {
     const lines = [];
     lines.push(`### ${group.repo} (${group.branch})${filterSummary ? `  —  ${filterSummary}` : ""}`);
@@ -164,6 +181,13 @@ export function registerGitLogTool(server) {
             readOnlyHint: true,
         },
         parameters: WorkspacePickSchema.extend({
+            format: z
+                .enum(["markdown", "json", "oneline"])
+                .optional()
+                .default("markdown")
+                .describe("`markdown` (default): headed sections per root. " +
+                "`json`: structured groups array. " +
+                "`oneline`: `<sha7> <subject>` per line, no headers (single-root) or `### repo (branch)` separator per group (multi-root). Lowest-token option for post-commit verification."),
             since: z
                 .string()
                 .optional()
@@ -208,6 +232,10 @@ export function registerGitLogTool(server) {
                     return jsonRespond({ error: "invalid_paths", path: p });
                 }
             }
+            // Validate branch — reject leading-dash and other injection attempts.
+            if (args.branch && !isSafeGitAncestorRef(args.branch)) {
+                return jsonRespond({ error: "unsafe_ref_token", branch: args.branch });
+            }
             const maxCommits = Math.min(args.maxCommits ?? DEFAULT_MAX_COMMITS, MAX_COMMITS_HARD_CAP);
             // Fan out across roots.
             const jobs = pre.roots.map((rootInput) => ({ rootInput }));
@@ -258,6 +286,20 @@ export function registerGitLogTool(server) {
                 });
                 return jsonRespond({ groups });
             }
+            // Oneline
+            if (args.format === "oneline") {
+                const multiRoot = results.length > 1;
+                const chunks = [];
+                for (const r of results) {
+                    if (r._error) {
+                        chunks.push(multiRoot ? `### ${r.workspaceRoot}\n(error: ${r.error})` : `(error: ${r.error})`);
+                        continue;
+                    }
+                    const { _error: _e, ...group } = r;
+                    chunks.push(renderLogOneline(group, multiRoot));
+                }
+                return chunks.join("\n\n");
+            }
             // Markdown
             const mdChunks = ["# Git log"];
             for (const r of results) {

package/dist/server/git-parity-tool.js

@@ -37,7 +37,7 @@ export function registerGitParityTool(server) {
                     const err = jsonRespond(errPayload);
                     if (args.format === "json") {
                         results.push({
-                            workspace_root: workspaceRoot,
+                            workspaceRoot: workspaceRoot,
                             status: "MISMATCH",
                             pairs: [{ label: "—", leftPath: "", rightPath: "", match: false, error: err }],
                         });
@@ -114,7 +114,7 @@ export function registerGitParityTool(server) {
                     }
                 }
                 results.push({
-                    workspace_root: top,
+                    workspaceRoot: top,
                     ...spreadDefined("presetSchemaVersion", parityPresetSchemaVersion),
                     status: allOk ? "OK" : "MISMATCH",
                     pairs: pairResults,