@vantran-se/openchamber-web 1.23.0 → 1.24.3

package/server/lib/git/service.js

@@ -1,8 +1,9 @@
 import simpleGit from 'simple-git';
+import { createSerialRefresh } from './serial-refresh.js';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import { execFile } from 'child_process';
+import { execFile, spawn } from 'child_process';
 import { promisify } from 'util';
 import { createRequire } from 'module';
 
@@ -349,12 +350,22 @@ const buildGitEnv = async () => {
       env.SSH_AUTH_SOCK = resolved;
     }
   }
+  // The server has no terminal a user could answer. Without this, Git asks
+  // for a username or password on its (hidden, on Windows) console and waits
+  // forever; credential helpers and GUI prompts still run before this point.
+  if (env.GIT_TERMINAL_PROMPT === undefined) {
+    env.GIT_TERMINAL_PROMPT = '0';
+  }
   return env;
 };
 
-const createGit = async (directory, { allowUnsafeSshCommand = false, allowUnsafeCredentialHelper = false } = {}) => {
+const createGit = async (directory, { allowUnsafeSshCommand = false, allowUnsafeCredentialHelper = false, stallTimeoutMs = 0 } = {}) => {
   const env = await buildGitEnv();
   const spawnOptions = { windowsHide: true };
+  // simple-git's block timeout kills the process once it has produced no
+  // output for this long. Opt-in per caller: a background read must never hold
+  // a limiter slot forever, while a silent long push or fetch must not be cut.
+  const timeout = stallTimeoutMs > 0 ? { block: stallTimeoutMs } : undefined;
   const binary = getGitBinary();
   const hasCustomBinary = typeof binary === 'string' && binary.trim() && binary !== 'git' && binary !== 'git.exe';
   const unsafe = hasCustomBinary || allowUnsafeSshCommand || allowUnsafeCredentialHelper
@@ -379,6 +390,7 @@ const createGit = async (directory, { allowUnsafeSshCommand = false, allowUnsafe
     spawnOptions,
     binary,
     unsafe,
+    ...(timeout ? { timeout } : {}),
   });
 };
 
@@ -484,14 +496,14 @@ const resolveGitRepositoryRoot = async (directoryPath, git) => {
     : path.resolve(directoryPath, normalizedTopLevel);
 };
 
-const createRepositoryGitContext = async (directory) => {
+const createRepositoryGitContext = async (directory, gitOptions = {}) => {
   const directoryPath = normalizeDirectoryPath(directory);
   if (typeof directoryPath !== 'string' || !directoryPath.trim()) {
     throw new Error('Git directory is required');
   }
-  const directoryGit = await createGit(directoryPath);
+  const directoryGit = await createGit(directoryPath, gitOptions);
   const repoRoot = await resolveGitRepositoryRoot(directoryPath, directoryGit);
-  const git = path.resolve(directoryPath) === repoRoot ? directoryGit : await createGit(repoRoot);
+  const git = path.resolve(directoryPath) === repoRoot ? directoryGit : await createGit(repoRoot, gitOptions);
   return { directoryPath, directoryGit, repoRoot, git };
 };
 
@@ -510,12 +522,46 @@ const resolveGitInternalPath = async (repoRoot, git, gitPath) => {
   return path.resolve(repoRoot, resolved.trim());
 };
 
+const GITLINK_MODE = '160000';
+
+// Paths from `git status` can stop resolving: the file was removed after the
+// listing, or the entry is a nested repository git reports as `dir/`. Callers
+// tell these apart by `code`, and diff routes send the code to clients as is.
+const GIT_PATH_NOT_FOUND = 'path_not_found';
+const GIT_PATH_IS_NESTED_REPOSITORY = 'nested_repository';
+const GIT_PATH_IS_UNTRACKED_DIRECTORY = 'untracked_directory';
+
+const GIT_PATH_ERROR_MESSAGES = {
+  [GIT_PATH_IS_NESTED_REPOSITORY]: (filePath) => `Path is a separate Git repository: ${filePath}`,
+  [GIT_PATH_IS_UNTRACKED_DIRECTORY]: (filePath) => `Path is a directory of untracked files: ${filePath}`,
+  [GIT_PATH_NOT_FOUND]: (filePath) => `Path not found in working tree, index, or HEAD: ${filePath}`,
+};
+
+const createGitPathError = (code, filePath) => Object.assign(new Error(GIT_PATH_ERROR_MESSAGES[code](filePath)), { code });
+
+// Mode of the exact entry at `repoPath`, or null. `cat-file -e` cannot answer
+// this: a gitlink's commit lives in the submodule's object store, so git exits 1
+// without stderr, which simple-git reports as success.
+const readGitEntryMode = async (repoRoot, args, repoPath) => {
+  const result = await runGitCommand(repoRoot, args);
+  if (!result.success) return null;
+  for (const record of result.stdout.split('\0')) {
+    const tab = record.indexOf('\t');
+    if (tab !== -1 && record.slice(tab + 1) === repoPath) {
+      return record.slice(0, record.indexOf(' '));
+    }
+  }
+  return null;
+};
+
 const resolveGitFileContext = async (directoryPath, git, filePath, repoRootOverride = null) => {
   const repoRoot = repoRootOverride || await resolveGitRepositoryRoot(directoryPath, git);
   const candidates = Array.from(new Set([
     path.resolve(repoRoot, filePath),
     path.resolve(directoryPath, filePath),
   ]));
+  let nestedRepository = false;
+  let untrackedDirectory = false;
 
   for (const absolutePath of candidates) {
     if (!isInsideOrSameDirectory(repoRoot, absolutePath)) {
@@ -526,20 +572,68 @@ const resolveGitFileContext = async (directoryPath, git, filePath, repoRootOverr
     const worktreeEntry = await fsp.lstat(absolutePath).catch(() => null);
     const isSymbolicLink = worktreeEntry?.isSymbolicLink() ?? false;
     const existsInWorktree = worktreeEntry?.isFile() || isSymbolicLink;
-    const existsInIndex = await git.raw(['cat-file', '-e', `:${repoPath}`]).then(() => true).catch(() => false);
-    const existsInHead = await git.raw(['cat-file', '-e', `HEAD:${repoPath}`]).then(() => true).catch(() => false);
+    const indexMode = await readGitEntryMode(repoRoot, ['ls-files', '--stage', '-z', '--', `:(literal)${repoPath}`], repoPath);
+    const headMode = await readGitEntryMode(repoRoot, ['ls-tree', '-z', 'HEAD', '--', repoPath], repoPath);
 
-    if (existsInWorktree || existsInIndex || existsInHead) {
+    if (existsInWorktree || indexMode || headMode) {
       return {
         absolutePath,
         repoPath,
         repoRoot,
         isSymbolicLink,
+        isSubmodule: indexMode === GITLINK_MODE || headMode === GITLINK_MODE,
       };
     }
+
+    if (worktreeEntry?.isDirectory()) {
+      if (await fsp.lstat(path.join(absolutePath, '.git')).then(() => true, () => false)) {
+        nestedRepository = true;
+      } else {
+        // Status lists a directory whose untracked files were not expanded
+        // (see readStatus) as `dir/`; there is no single patch for it.
+        untrackedDirectory = true;
+      }
+    }
   }
 
-  throw new Error('Invalid file path');
+  if (nestedRepository) throw createGitPathError(GIT_PATH_IS_NESTED_REPOSITORY, filePath);
+  if (untrackedDirectory) throw createGitPathError(GIT_PATH_IS_UNTRACKED_DIRECTORY, filePath);
+  throw createGitPathError(GIT_PATH_NOT_FOUND, filePath);
+};
+
+/**
+ * What a submodule entry records, since its text patch cannot show everything:
+ * with only untracked files inside, `git status` marks it modified while
+ * `git diff` prints nothing.
+ */
+const readSubmoduleState = async (repoRoot, fileContext) => {
+  const status = await runGitCommand(repoRoot, ['status', '--porcelain=v2', '-z', '--', `:(literal)${fileContext.repoPath}`]);
+  if (!status.success) {
+    throw new Error(status.message || 'Failed to read submodule status');
+  }
+  // Changed: "1 XY S<c><m><u> mH mI mW hH hI path" ("2" adds rename fields
+  // after hI). Unmerged: "u XY S<c><m><u> m1 m2 m3 mW h1 h2 h3 path", with no
+  // stage-0 index entry. A clean submodule has no record, so HEAD and the index
+  // record the same commit.
+  const record = status.stdout.split('\0').find((entry) => /^[12u] /.test(entry))?.split(' ');
+  const hasConflict = record?.[0] === 'u';
+  const readHead = async () => (await runGitCommand(repoRoot, ['rev-parse', '--verify', '--quiet', `HEAD:${fileContext.repoPath}`])).stdout.trim();
+  const head = record && !hasConflict ? record[6] : await readHead();
+  const index = hasConflict ? '' : (record ? record[7] : head);
+  const flags = record ? record[2] : 'S...';
+  // Without its own `.git`, rev-parse would answer for the parent repository.
+  const initialized = await fsp.lstat(path.join(fileContext.absolutePath, '.git')).then(() => true, () => false);
+  const worktree = initialized ? await runGitCommand(fileContext.absolutePath, ['rev-parse', '--verify', 'HEAD']) : null;
+  const commitOrNull = (value) => (value && !/^0+$/.test(value) ? value : null);
+
+  return {
+    headCommit: commitOrNull(head),
+    indexCommit: commitOrNull(index),
+    worktreeCommit: worktree?.success ? worktree.stdout.trim() : null,
+    hasTrackedChanges: flags[2] === 'M',
+    hasUntrackedFiles: flags[3] === 'U',
+    hasConflict,
+  };
 };
 
 const cleanBranchName = (branch) => {
@@ -925,13 +1019,16 @@ const isMissingDirectoryError = (error) => {
   return /directory that does not exist|does not exist|no such file or directory/i.test(text);
 };
 
-const runGitCommand = async (cwd, args) => {
+const runGitCommand = async (cwd, args, { timeoutMs = 0 } = {}) => {
   try {
     const { stdout, stderr } = await execFileAsync(getGitBinary(), args, {
       cwd,
       env: await buildGitEnv(),
       windowsHide: true,
       maxBuffer: 20 * 1024 * 1024,
+      // Only short probes pass a timeout; commands that legitimately run long
+      // (a fetch into a temporary clone) keep the default of none.
+      ...(timeoutMs > 0 ? { timeout: timeoutMs, killSignal: 'SIGKILL' } : {}),
     });
     return {
       success: true,
@@ -2058,14 +2155,45 @@ const applyUpstreamConfiguration = async (args) => {
   );
 };
 
+/**
+ * A repository whose root is the user's home directory or a filesystem root
+ * (`C:\`, `/`) covers the whole disk. Every status read walks Program Files
+ * or the entire home tree, which is minutes of Git work per refresh and, on
+ * Windows, the process pile-ups users report. Such a repository is nearly
+ * always an accidental `git init` in the wrong place, so OpenChamber treats
+ * it as no repository at all. Returns the reason or null for a normal root.
+ */
+export const unsupportedRepositoryRootReason = (repoRoot, home = os.homedir()) => {
+  if (typeof repoRoot !== 'string' || !repoRoot.trim()) return null;
+  const resolved = path.resolve(repoRoot.trim());
+  if (path.resolve(path.parse(resolved).root) === resolved) return 'filesystem-root';
+  if (typeof home === 'string' && home.trim() && path.resolve(home.trim()) === resolved) return 'home';
+  return null;
+};
+
+const warnedUnsupportedRoots = new Set();
+
 export async function isGitRepository(directory) {
   const directoryPath = normalizeDirectoryPath(directory);
   if (!directoryPath || !fs.existsSync(directoryPath)) {
     return false;
   }
 
-  const result = await runGitCommand(directoryPath, ['rev-parse', '--git-dir']);
-  return result.success;
+  const result = await runGitCommand(directoryPath, ['rev-parse', '--git-dir'], { timeoutMs: GIT_PROBE_TIMEOUT_MS });
+  if (!result.success) return false;
+
+  // `--show-toplevel` has no answer inside a bare repository or a .git
+  // directory; those keep the previous answer rather than being rejected.
+  const topLevel = await runGitCommand(directoryPath, ['rev-parse', '--show-toplevel'], { timeoutMs: GIT_PROBE_TIMEOUT_MS });
+  if (!topLevel.success) return true;
+  const repoRoot = topLevel.stdout.trim();
+  const reason = unsupportedRepositoryRootReason(repoRoot);
+  if (!reason) return true;
+  if (!warnedUnsupportedRoots.has(repoRoot)) {
+    warnedUnsupportedRoots.add(repoRoot);
+    console.warn(`[git] Ignoring repository rooted at ${repoRoot} (${reason}): Git features are disabled for ${directoryPath}`);
+  }
+  return false;
 }
 
 export async function getGlobalIdentity() {
@@ -2187,13 +2315,193 @@ export async function setLocalIdentity(directory, profile) {
   }
 }
 
+// Beyond this many untracked files, a directory stays one `dir/` entry in
+// status. Every file would otherwise become a row, a diff request, and a stat
+// on the server, and the only directories that large are ones that belong in
+// .gitignore.
+const UNTRACKED_DIRECTORY_EXPANSION_LIMIT = 1000;
+
+// A status read holds one of MAX_CONCURRENT_STATUS_READS slots until it
+// finishes. Git never gets a terminal here, but a process can still hang on
+// Windows (a locked index, a stuck filesystem monitor, an unreachable network
+// drive), and a hung process would hold its slot forever: four of them and no
+// status read runs again until someone kills them by hand. Every process the
+// read spawns is therefore killed when it stops producing output for this long,
+// and the read fails instead of wedging the limiter. Two minutes is far above
+// what a healthy read spends silent, even on a very large tree.
+const GIT_STATUS_STALL_TIMEOUT_MS = 120_000;
+const GIT_UNTRACKED_LISTING_STALL_TIMEOUT_MS = 60_000;
+const GIT_PROBE_TIMEOUT_MS = 30_000;
+
+// Untracked files under `dirPath` (repository-relative, trailing slash), read
+// Git for Windows runs commands through a launcher: the `git.exe` we spawn is a
+// wrapper whose child is the real `git`. Killing only the wrapper leaves that
+// child alive, still walking the tree on its own (a repository rooted at a
+// drive root sends it through Program Files), and it shows up in Task Manager
+// as a stuck pair until someone ends it by hand. Windows has no process groups
+// to signal, so the tree is ended through taskkill.
+const killProcessTree = (child) => {
+  if (!child.pid) return;
+  if (process.platform === 'win32') {
+    try {
+      spawn('taskkill', ['/pid', String(child.pid), '/T', '/F'], { windowsHide: true, stdio: 'ignore' }).on('error', () => {});
+    } catch {
+      child.kill('SIGKILL');
+    }
+    return;
+  }
+  child.kill('SIGKILL');
+};
+
+// from a streamed `ls-files` that is stopped once the bound is exceeded so a
+// huge directory is never listed in full. `paths` is complete when
+// `truncated` is false.
+const listUntrackedFilesBounded = async (repoRoot, dirPath, limit) => {
+  const env = await buildGitEnv();
+  return new Promise((resolve, reject) => {
+    const child = spawn(getGitBinary(), ['ls-files', '--others', '--exclude-standard', '-z', '--', dirPath], {
+      cwd: repoRoot,
+      env,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    const paths = [];
+    let pending = '';
+    let truncated = false;
+    let settled = false;
+    let stallTimer = null;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      if (stallTimer) clearTimeout(stallTimer);
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve({ paths, truncated });
+    };
+    // A listing that goes silent is killed rather than left holding the
+    // status read (and its limiter slot) open.
+    const armStallTimer = () => {
+      if (stallTimer) clearTimeout(stallTimer);
+      stallTimer = setTimeout(() => {
+        killProcessTree(child);
+        finish(new Error(`git ls-files produced no output for ${GIT_UNTRACKED_LISTING_STALL_TIMEOUT_MS}ms in ${dirPath}`));
+      }, GIT_UNTRACKED_LISTING_STALL_TIMEOUT_MS);
+    };
+    armStallTimer();
+    child.stdout.on('data', (chunk) => {
+      armStallTimer();
+      if (truncated) return;
+      pending += chunk.toString('utf8');
+      const records = pending.split('\0');
+      pending = records.pop() ?? '';
+      for (const record of records) {
+        if (!record) continue;
+        paths.push(record);
+        if (paths.length > limit) {
+          truncated = true;
+          killProcessTree(child);
+          finish();
+          return;
+        }
+      }
+    });
+    child.on('error', (error) => finish(error));
+    child.on('close', (code) => {
+      if (truncated) {
+        finish();
+        return;
+      }
+      if (code !== 0) {
+        finish(new Error(`git ls-files exited with code ${code} for ${dirPath}`));
+        return;
+      }
+      if (pending) paths.push(pending);
+      finish();
+    });
+  });
+};
+
+// Replaces each untracked `dir/` entry from `-unormal` with one entry per file
+// inside it, the listing `-uall` would have produced, unless the directory
+// holds more than the bound; then the `dir/` entry stays. A nested repository
+// lists as itself and stays a `dir/` entry too, which is what the diff routes
+// expect. A listing failure keeps the `dir/` entry rather than dropping the
+// change from the status.
+const expandUntrackedDirectories = async (repoRoot, files) => {
+  const expanded = [];
+  for (const file of files) {
+    const isUntrackedDirectory = file.path.endsWith('/')
+      && (file.working_dir || '').trim() === '?'
+      && (file.index || '').trim() === '?';
+    if (!isUntrackedDirectory) {
+      expanded.push(file);
+      continue;
+    }
+    const listing = await listUntrackedFilesBounded(repoRoot, file.path, UNTRACKED_DIRECTORY_EXPANSION_LIMIT)
+      .catch((error) => {
+        console.warn(`[GitService] Could not expand untracked directory ${file.path}:`, error?.message || error);
+        return null;
+      });
+    if (!listing || listing.truncated || listing.paths.some((entry) => entry === file.path)) {
+      expanded.push(file);
+      continue;
+    }
+    for (const entryPath of listing.paths) {
+      expanded.push({ ...file, path: entryPath });
+    }
+  }
+  return expanded;
+};
+
+// A status read walks the working tree and runs a dozen Git processes; on a
+// large repository it takes seconds. Clients ask for it after every completed
+// agent tool call, from several surfaces, and from PR polling, so without a
+// bound one slow repository ends up with many identical `git status` processes
+// side by side. Runs are serialized per directory and capped across
+// directories; a caller that asks during a run gets a run started after it
+// asked, so results are never older than the request.
+const MAX_CONCURRENT_STATUS_READS = 4;
+const statusRefresh = createSerialRefresh({ maxConcurrent: MAX_CONCURRENT_STATUS_READS });
+
 export async function getStatus(directory, options = {}) {
-  const lightMode = options.mode === 'light';
   const normalizedDirectory = normalizeDirectoryPath(directory);
   if (typeof normalizedDirectory !== 'string' || !normalizedDirectory.trim()) {
     throw new Error('directory is required');
   }
+  const lightMode = options.mode === 'light';
+  // A full read satisfies light callers too, so one run serves whichever
+  // callers it answers, at the widest mode any of them asked for.
+  return statusRefresh.run(
+    normalizedDirectory,
+    { lightMode },
+    (requests) => readStatus(normalizedDirectory, requests.every((request) => request.lightMode)),
+  );
+}
 
+/**
+ * Upstream of the checked-out branch as `remote/branch`, or `null` when HEAD
+ * is detached, unborn, or the branch has no upstream configured. Reads refs
+ * and config only, never the working tree: callers that only need the
+ * tracking name must not pay for a status read.
+ */
+export async function getTrackingBranch(directory) {
+  const normalizedDirectory = normalizeDirectoryPath(directory);
+  if (!normalizedDirectory) {
+    return null;
+  }
+  const head = await runGitCommand(normalizedDirectory, ['symbolic-ref', '--quiet', 'HEAD']);
+  const headRef = head.success ? head.stdout.trim() : '';
+  if (!headRef.startsWith('refs/heads/')) {
+    return null;
+  }
+  const upstream = await runGitCommand(normalizedDirectory, ['for-each-ref', '--format=%(upstream:short)', headRef]);
+  const tracking = upstream.success ? upstream.stdout.trim() : '';
+  return tracking || null;
+}
+
+async function readStatus(normalizedDirectory, lightMode) {
   try {
     // Prefer an explicit non-repo check before simple-git status so a missing
     // repository never depends on process.cwd() or an opaque GitError shape.
@@ -2201,12 +2509,22 @@ export async function getStatus(directory, options = {}) {
       throw new Error('fatal: not a git repository (or any of the parent directories): .git');
     }
 
-    const { directoryPath, repoRoot, git } = await createRepositoryGitContext(normalizedDirectory);
-
-    // Use -uall to show all untracked files individually, not just directories
-    const status = await git.status(['-uall']);
+    const { directoryPath, repoRoot, git } = await createRepositoryGitContext(normalizedDirectory, {
+      stallTimeoutMs: GIT_STATUS_STALL_TIMEOUT_MS,
+    });
 
-    // Light mode: skip numstat + new-file line counting for faster response
+    // `-unormal` lists a directory with no tracked files as one `dir/` entry
+    // and stops walking it at its first file. `-uall` would walk every file
+    // in it: on a forgotten build or dependency directory that is a scan of
+    // tens of thousands of files and hundreds of megabytes per status read.
+    // Directories are expanded to their files afterwards, up to a bound.
+    const status = await git.status(['-unormal']);
+    status.files = await expandUntrackedDirectories(repoRoot, status.files);
+
+    // Light mode: skip numstat + new-file line counting for faster response.
+    // Staged (`--cached`: HEAD -> index) and working (`--numstat`: index -> worktree)
+    // stay in separate maps. A partially staged file has an entry in both, and the
+    // UI shows each row's own scope instead of a combined total.
     const [stagedStatsRaw, workingStatsRaw] = lightMode
       ? ['', '']
       : await Promise.all([
@@ -2214,9 +2532,10 @@ export async function getStatus(directory, options = {}) {
           git.raw(['diff', '--numstat']).catch(() => ''),
         ]);
 
-    const diffStatsMap = new Map();
+    const stagedDiffStats = {};
+    const workingDiffStats = {};
 
-    const accumulateStats = (raw) => {
+    const accumulateStats = (raw, target) => {
       if (!raw) return;
       raw
         .split('\n')
@@ -2235,18 +2554,18 @@ export async function getStatus(directory, options = {}) {
           const insertions = insertionsRaw === '-' ? 0 : parseInt(insertionsRaw, 10) || 0;
           const deletions = deletionsRaw === '-' ? 0 : parseInt(deletionsRaw, 10) || 0;
 
-          const existing = diffStatsMap.get(path) || { insertions: 0, deletions: 0 };
-          diffStatsMap.set(path, {
+          const existing = target[path] || { insertions: 0, deletions: 0 };
+          target[path] = {
             insertions: existing.insertions + insertions,
             deletions: existing.deletions + deletions,
-          });
+          };
         });
     };
 
-    accumulateStats(stagedStatsRaw);
-    accumulateStats(workingStatsRaw);
+    accumulateStats(stagedStatsRaw, stagedDiffStats);
+    accumulateStats(workingStatsRaw, workingDiffStats);
 
-    const diffStats = Object.fromEntries(diffStatsMap.entries());
+    const diffStats = { staged: stagedDiffStats, working: workingDiffStats };
 
     const MAX_NEW_FILE_STATS = 200;
     const MAX_NEW_FILE_STAT_SIZE = 1024 * 1024;
@@ -2266,7 +2585,10 @@ export async function getStatus(directory, options = {}) {
           continue;
         }
 
-        const existing = diffStats[file.path];
+        // Untracked and working-tree-added files belong to the working scope;
+        // a file whose 'A' code is on the index belongs to the staged scope.
+        const target = working === '?' || working === 'A' ? workingDiffStats : stagedDiffStats;
+        const existing = target[file.path];
         if (existing && existing.insertions > 0) {
           continue;
         }
@@ -2282,6 +2604,7 @@ export async function getStatus(directory, options = {}) {
           const buffer = await fsp.readFile(absolutePath);
           if (buffer.indexOf(0) !== -1) {
             newFileStats.push({
+              target,
               path: file.path,
               insertions: existing?.insertions ?? 0,
               deletions: existing?.deletions ?? 0,
@@ -2292,6 +2615,7 @@ export async function getStatus(directory, options = {}) {
           const normalized = buffer.toString('utf8').replace(/\r\n/g, '\n');
           if (!normalized.length) {
             newFileStats.push({
+              target,
               path: file.path,
               insertions: 0,
               deletions: 0,
@@ -2306,6 +2630,7 @@ export async function getStatus(directory, options = {}) {
 
           const lineCount = segments.length;
           newFileStats.push({
+            target,
             path: file.path,
             insertions: lineCount,
             deletions: 0,
@@ -2319,7 +2644,7 @@ export async function getStatus(directory, options = {}) {
     }
 
     for (const entry of newFileStats) {
-      diffStats[entry.path] = {
+      entry.target[entry.path] = {
         insertions: entry.insertions,
         deletions: entry.deletions,
       };
@@ -2481,11 +2806,29 @@ const getNoIndexDiff = async (repoRoot, repoPath, contextLines) => {
 };
 
 export async function getDiff(directory, { path: filePath, staged = false, contextLines = 3 } = {}) {
-  const { directoryPath, directoryGit, repoRoot, git } = await createRepositoryGitContext(directory);
+  const context = await createRepositoryGitContext(directory);
+  const fileContext = filePath
+    ? await resolveGitFileContext(context.directoryPath, context.directoryGit, filePath, context.repoRoot)
+    : null;
+  return readDiff(context, fileContext, { staged, contextLines });
+}
 
+/**
+ * `getDiff` for one path, plus what a submodule records. A submodule patch is
+ * empty when only untracked files changed inside it, so callers need the state
+ * to show anything truthful.
+ */
+export async function getPathDiff(directory, { path: filePath, staged = false, contextLines = 3 } = {}) {
+  const context = await createRepositoryGitContext(directory);
+  const fileContext = await resolveGitFileContext(context.directoryPath, context.directoryGit, filePath, context.repoRoot);
+  const diff = await readDiff(context, fileContext, { staged, contextLines });
+  if (!fileContext.isSubmodule) return { diff, submodule: null };
+  return { diff, submodule: await readSubmoduleState(context.repoRoot, fileContext) };
+}
+
+async function readDiff({ repoRoot, git }, fileContext, { staged, contextLines }) {
   try {
     const args = ['diff', '--no-color', '--full-index'];
-    const fileContext = filePath ? await resolveGitFileContext(directoryPath, directoryGit, filePath, repoRoot) : null;
 
     if (typeof contextLines === 'number' && !Number.isNaN(contextLines)) {
       args.push(`-U${Math.max(0, contextLines)}`);
@@ -2682,7 +3025,7 @@ export async function getRangeDiff(directory, { base, head, path: filePath, cont
       const fileContext = await resolveGitFileContext(directoryPath, directoryGit, filePath, repoRoot);
       paths.push(fileContext.repoPath);
     } catch (error) {
-      if (error.message !== 'Invalid file path') throw error;
+      if (error.code !== GIT_PATH_NOT_FOUND) throw error;
       // A committed deletion is absent from HEAD, the index, and the working
       // tree. It is still a valid range path when it exists at the merge base.
       const mergeBase = (await git.raw(['merge-base', baseRef, headRef])).trim();
@@ -2907,7 +3250,22 @@ export async function getFileDiff(directory, { path: filePath, staged = false }
   const { directoryPath, directoryGit, repoRoot, git } = await createRepositoryGitContext(directory);
   const isImage = isImageFile(filePath);
   const mimeType = isImage ? getImageMimeType(filePath) : null;
-  const { absolutePath, repoPath, isSymbolicLink } = await resolveGitFileContext(directoryPath, directoryGit, filePath, repoRoot);
+  const fileContext = await resolveGitFileContext(directoryPath, directoryGit, filePath, repoRoot);
+  const { absolutePath, repoPath, isSymbolicLink } = fileContext;
+
+  if (fileContext.isSubmodule) {
+    // Git's own text form of a gitlink, so a plain two-pane view still shows
+    // the recorded commits; `submodule` carries what the text cannot.
+    const submodule = await readSubmoduleState(repoRoot, fileContext);
+    const describeCommit = (commit) => (commit ? `Subproject commit ${commit}\n` : '');
+    return {
+      original: describeCommit(submodule.headCommit),
+      modified: describeCommit(staged ? submodule.indexCommit : submodule.worktreeCommit),
+      path: filePath,
+      isBinary: false,
+      submodule,
+    };
+  }
 
   if (!isImage && !isSymbolicLink) {
     const isBinaryBySniff = await looksBinaryBySniff(absolutePath);
@@ -3346,26 +3704,45 @@ export async function push(directory, options = {}) {
     );
   };
 
-  const normalizePushResult = (result) => {
+  const remote = String(options.remote || '').trim();
+  const status = await git.status();
+  const config = await git.listConfig();
+  const remotes = await git.getRemotes(true);
+  const remoteName = remote
+    || config.all[`branch.${status.current}.pushremote`]
+    || config.all['remote.pushdefault']
+    || config.all[`branch.${status.current}.remote`]
+    || (remotes.length === 1 ? remotes[0].name : 'origin');
+
+  const pushTo = async (target, branch, pushOptions) => {
+    // simple-git drops forced updates and puts no-ops in `pushed`. Read Git's
+    // porcelain status flags so feedback reflects actual remote ref changes.
+    let output = '';
+    git.outputHandler((_command, stdout) => {
+      stdout.on('data', (chunk) => { output += chunk.toString(); });
+    });
+    const result = await git.push(target, branch, pushOptions);
+    const pushed = [];
+    for (const line of output.split(/\r?\n/)) {
+      const match = /^([ *+\-])\t([^:]*):([^\t]+)\t/.exec(line);
+      if (match) {
+        pushed.push({ local: match[2], remote: remoteName });
+      }
+    }
     return {
       success: true,
-      pushed: result.pushed,
-      repo: result.repo,
-      ref: result.ref,
+      pushed,
+      repo: result.repo || directory,
+      ref: result.ref || null,
     };
   };
 
-  const remote = String(options.remote || '').trim();
-
   if (!remote && !options.branch) {
     try {
-      await git.push();
-      return {
-        success: true,
-        pushed: [],
-        repo: directory,
-        ref: null,
-      };
+      const pushOptions = status.current && !status.tracking
+        ? buildUpstreamOptions(options.options)
+        : options.options || {};
+      return await pushTo(undefined, undefined, pushOptions);
     } catch (error) {
       if (!looksLikeMissingUpstream(error)) {
         const message = describePushError(error);
@@ -3374,17 +3751,13 @@ export async function push(directory, options = {}) {
       }
 
       try {
-        const status = await git.status();
         const branch = status.current;
-        const remotes = await git.getRemotes(true);
-        const fallbackRemote = remotes.find((entry) => entry.name === 'origin')?.name || remotes[0]?.name;
-        if (!branch || !fallbackRemote) {
+        if (!branch || !remoteName) {
           const message = describePushError(error);
           throw new Error(message);
         }
 
-        const result = await git.push(fallbackRemote, branch, buildUpstreamOptions(options.options));
-        return normalizePushResult(result);
+        return await pushTo(remoteName, branch, buildUpstreamOptions(options.options));
       } catch (fallbackError) {
         const message = describePushError(fallbackError);
         console.error('Failed to push (including upstream fallback):', fallbackError);
@@ -3393,26 +3766,14 @@ export async function push(directory, options = {}) {
     }
   }
 
-  const remoteName = remote || 'origin';
-
   // If caller didn't specify a branch, this is the common "Push"/"Commit & Push" path.
   // When there's no upstream yet (typical for freshly-created worktree branches), publish it on first push.
-  if (!options.branch) {
-    try {
-      const status = await git.status();
-      if (status.current && !status.tracking) {
-        const result = await git.push(remoteName, status.current, buildUpstreamOptions(options.options));
-        return normalizePushResult(result);
-      }
-    } catch (error) {
-      // If we can't read status, fall back to the regular push path below.
-      console.warn('Failed to read git status before push:', error);
-    }
+  if (!options.branch && status.current && !status.tracking) {
+    return pushTo(remoteName, status.current, buildUpstreamOptions(options.options));
   }
 
   try {
-    const result = await git.push(remoteName, options.branch, options.options || {});
-    return normalizePushResult(result);
+    return await pushTo(remoteName, options.branch, options.options || {});
   } catch (error) {
     // Last-resort fallback: retry with upstream if the error suggests it's missing.
     if (!looksLikeMissingUpstream(error)) {
@@ -3422,15 +3783,13 @@ export async function push(directory, options = {}) {
     }
 
     try {
-      const status = await git.status();
       const branch = options.branch || status.current;
       if (!branch) {
         console.error('Failed to push: missing branch name for upstream setup:', error);
         throw error;
       }
 
-      const result = await git.push(remoteName, branch, buildUpstreamOptions(options.options));
-      return normalizePushResult(result);
+      return await pushTo(remoteName, branch, buildUpstreamOptions(options.options));
     } catch (fallbackError) {
       const message = describePushError(fallbackError);
       console.error('Failed to push (including upstream fallback):', fallbackError);
@@ -4064,14 +4423,167 @@ export async function getWorktrees(directory) {
     // OpenCode's working directory or an unconfigured project path), git
     // exits with "fatal: not a git repository ...". Treat that as an
     // authoritative empty result so the route handler can still respond
-    // 200 [] and the desktop main.log stays free of noise.
-    if (!isNotGitRepositoryError(error)) {
-      console.warn('Failed to list worktrees, returning empty list:', error?.message || error);
+    // 200 [] and the desktop main.log stays free of noise. Any other failure
+    // is a failure: callers keep their last known topology instead of
+    // treating "git could not answer" as "there are no worktrees".
+    if (isNotGitRepositoryError(error)) return [];
+    throw error;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Worktree topology change tracking
+//
+// Linked worktrees are registered under the repository's common Git directory
+// (`<common>/worktrees/<name>`). Instead of watching the filesystem, the server
+// fingerprints that directory while handling requests clients already make
+// (status, worktree listing) and after its own worktree create/remove, and
+// tells connected clients when the set of worktrees changed. Cost scales with
+// user activity, never with the number of registered projects.
+// ---------------------------------------------------------------------------
+
+const MAX_TRACKED_WORKTREE_DIRECTORIES = 500;
+const MAX_TRACKED_WORKTREE_REPOSITORIES = 200;
+const MAX_DIRECTORIES_PER_WORKTREE_REPOSITORY = 100;
+const worktreeTopologyListeners = new Set();
+const worktreeRepositoryKeyByDirectory = new Map();
+const worktreeTopologyByRepository = new Map();
+
+export function subscribeWorktreeTopologyChanges(listener) {
+  worktreeTopologyListeners.add(listener);
+  return () => {
+    worktreeTopologyListeners.delete(listener);
+  };
+}
+
+const rememberWorktreeRepositoryKey = (directoryPath, key) => {
+  worktreeRepositoryKeyByDirectory.delete(directoryPath);
+  worktreeRepositoryKeyByDirectory.set(directoryPath, key);
+  while (worktreeRepositoryKeyByDirectory.size > MAX_TRACKED_WORKTREE_DIRECTORIES) {
+    const oldest = worktreeRepositoryKeyByDirectory.keys().next().value;
+    if (oldest === undefined) break;
+    worktreeRepositoryKeyByDirectory.delete(oldest);
+  }
+};
+
+/**
+ * Canonical common Git directory for `directoryPath`, resolved with git once per
+ * directory and cached. Returns null when git cannot answer (not a repository,
+ * missing directory).
+ */
+const resolveWorktreeRepositoryKey = async (directoryPath) => {
+  const cached = worktreeRepositoryKeyByDirectory.get(directoryPath);
+  if (cached) {
+    rememberWorktreeRepositoryKey(directoryPath, cached);
+    return cached;
+  }
+  const result = await runGitCommand(directoryPath, ['rev-parse', '--git-common-dir']);
+  const rawCommonDir = String(result.stdout || '').trim();
+  if (!result.success || !rawCommonDir) {
+    return null;
+  }
+  const commonDir = path.resolve(directoryPath, rawCommonDir);
+  let key = commonDir;
+  try {
+    key = fs.realpathSync(commonDir);
+  } catch {
+    // Keep the resolved path; a missing common dir cannot register worktrees.
+  }
+  rememberWorktreeRepositoryKey(directoryPath, key);
+  return key;
+};
+
+/**
+ * Cheap identity of the registered linked-worktree set: the `worktrees`
+ * directory's mtime plus its entry names. Adding, removing, or pruning a
+ * worktree changes at least one of them; `git worktree move` rewrites files
+ * inside an entry and is not detected.
+ */
+const readWorktreeTopologyFingerprint = (repositoryKey) => {
+  const worktreesDir = path.join(repositoryKey, 'worktrees');
+  try {
+    const stat = fs.statSync(worktreesDir);
+    const names = fs.readdirSync(worktreesDir).sort();
+    return `${stat.mtimeMs}:${names.join('\0')}`;
+  } catch {
+    return 'none';
+  }
+};
+
+const trackWorktreeTopologyDirectory = (repositoryKey, directoryPath) => {
+  let entry = worktreeTopologyByRepository.get(repositoryKey);
+  if (!entry) {
+    entry = { directories: new Set(), fingerprint: null };
+  }
+  // Re-insert so the map stays ordered by last use; the least recently used
+  // repository is dropped first once the bound is reached.
+  worktreeTopologyByRepository.delete(repositoryKey);
+  worktreeTopologyByRepository.set(repositoryKey, entry);
+  while (worktreeTopologyByRepository.size > MAX_TRACKED_WORKTREE_REPOSITORIES) {
+    const oldest = worktreeTopologyByRepository.keys().next().value;
+    if (oldest === undefined) break;
+    worktreeTopologyByRepository.delete(oldest);
+  }
+  if (entry.directories.size < MAX_DIRECTORIES_PER_WORKTREE_REPOSITORY) {
+    entry.directories.add(directoryPath);
+  }
+  return entry;
+};
+
+const notifyWorktreeTopologyChanged = (entry) => {
+  const event = { directories: [...entry.directories], at: Date.now() };
+  for (const listener of worktreeTopologyListeners) {
+    try {
+      listener(event);
+    } catch (error) {
+      console.warn('Worktree topology listener failed:', error?.message || error);
     }
-    return [];
+  }
+};
+
+/**
+ * Compare the repository's worktree set with the last one seen for it and
+ * notify listeners when it changed. The first observation only records a
+ * baseline. Called from request handlers that already touch the repository;
+ * never throws.
+ */
+export async function observeWorktreeTopology(directory) {
+  const directoryPath = normalizeDirectoryPath(directory);
+  if (!directoryPath) return;
+  try {
+    const repositoryKey = await resolveWorktreeRepositoryKey(directoryPath);
+    if (!repositoryKey) return;
+    const entry = trackWorktreeTopologyDirectory(repositoryKey, directoryPath);
+    const fingerprint = readWorktreeTopologyFingerprint(repositoryKey);
+    if (entry.fingerprint === fingerprint) return;
+    const hadBaseline = entry.fingerprint !== null;
+    entry.fingerprint = fingerprint;
+    if (hadBaseline) notifyWorktreeTopologyChanged(entry);
+  } catch (error) {
+    console.warn('Failed to observe worktree topology:', error?.message || error);
   }
 }
 
+/**
+ * Record that this server changed the repository's worktree set itself and
+ * notify listeners right away. `directory` is any directory inside the
+ * repository; never throws so a notification problem cannot fail the
+ * operation that triggered it.
+ */
+const publishWorktreeTopologyChange = async (directory) => {
+  const directoryPath = normalizeDirectoryPath(directory);
+  if (!directoryPath) return;
+  try {
+    const repositoryKey = await resolveWorktreeRepositoryKey(directoryPath);
+    if (!repositoryKey) return;
+    const entry = trackWorktreeTopologyDirectory(repositoryKey, directoryPath);
+    entry.fingerprint = readWorktreeTopologyFingerprint(repositoryKey);
+    notifyWorktreeTopologyChanged(entry);
+  } catch (error) {
+    console.warn('Failed to publish worktree topology change:', error?.message || error);
+  }
+};
+
 export async function validateWorktreeCreate(directory, input = {}) {
   const mode = input?.mode === 'existing' ? 'existing' : 'new';
   const errors = [];
@@ -4329,6 +4841,7 @@ async function attachGitWorktreeToCandidate(context, candidate, input = {}) {
   }
 
   await runGitCommandOrThrow(context.primaryWorktree, worktreeAddArgs, 'Failed to create git worktree');
+  await publishWorktreeTopologyChange(context.primaryWorktree);
 
   const upstreamRemote = shouldSetUpstream
     ? String(input?.upstreamRemote || inferredUpstream?.remote || '').trim()
@@ -4551,6 +5064,7 @@ export async function removeWorktree(directory, input = {}) {
     ['worktree', 'remove', '--force', matchedEntry.worktree],
     'Failed to remove git worktree'
   );
+  await publishWorktreeTopologyChange(context.primaryWorktree);
 
   if (deleteLocalBranch) {
     const branchName = cleanBranchName(String(matchedEntry.branchRef || matchedEntry.branch || '').trim());
@@ -4902,7 +5416,7 @@ export async function canonicalizeWorktreeState(directory) {
 
   // Detect attention reasons from getStatus side-effects
   try {
-    const status = await git.status(['-uall']);
+    const status = await git.status(['-unormal']);
     if (status.current && (await git.raw(['rev-parse', '--verify', 'MERGE_HEAD']).then(() => true).catch(() => false))) {
       attentionReason = 'merge';
     } else {