@vantran-se/openchamber-web 1.23.1 → 1.24.4

package/server/lib/git/service.test.js

@@ -8,6 +8,7 @@ import { loadSourceSections, parseSource, sourceKey } from '../walkthrough/sourc
 import { registerGitRoutes } from './routes.js';
 
 import {
+  unsupportedRepositoryRootReason,
   checkoutBranch,
   checkoutCommit,
   cherryPick,
@@ -21,6 +22,7 @@ import {
   getCommitFiles,
   getLog,
   getStatus,
+  getTrackingBranch,
   getWorktrees,
   isGitRepository,
   observeWorktreeTopology,
@@ -37,11 +39,14 @@ import {
   unstageFiles,
   applyHunk,
   getDiff,
+  getPathDiff,
+  revertFile,
   getUntrackedDiffs,
   getFileDiff,
   validateWorktreeCreate,
   parseBranchCreationSource,
   getRangeFiles,
+  push,
 } from './service.js';
 
 // ---------------------------------------------------------------------------
@@ -127,6 +132,23 @@ async function createTempRepo() {
 // resolveBaseRefForLog
 // ---------------------------------------------------------------------------
 
+describe('unsupportedRepositoryRootReason', () => {
+  it('rejects a repository rooted at a filesystem root or the home directory', () => {
+    const home = path.join(os.tmpdir(), 'unsupported-root-home');
+    expect(unsupportedRepositoryRootReason('/', home)).toBe('filesystem-root');
+    expect(unsupportedRepositoryRootReason(path.parse(process.cwd()).root, home)).toBe('filesystem-root');
+    expect(unsupportedRepositoryRootReason(home, home)).toBe('home');
+    expect(unsupportedRepositoryRootReason(`${home}${path.sep}`, home)).toBe('home');
+  });
+
+  it('accepts an ordinary project root, including one directly under home', () => {
+    const home = path.join(os.tmpdir(), 'unsupported-root-home');
+    expect(unsupportedRepositoryRootReason(path.join(home, 'project'), home)).toBeNull();
+    expect(unsupportedRepositoryRootReason(path.join(os.tmpdir(), 'repo'), home)).toBeNull();
+    expect(unsupportedRepositoryRootReason('', home)).toBeNull();
+  });
+});
+
 describe('resolveBaseRefForLog', () => {
   it('returns the local ref unchanged when it exists, even if origin also exists', async () => {
     const checkRef = async (ref) => ref === 'main' || ref === 'refs/remotes/origin/main';
@@ -507,6 +529,131 @@ describe('symlink diffs', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Status paths that are not plain files (#3586)
+// ---------------------------------------------------------------------------
+
+describe.runIf(canRunGit())('diffs for status paths that are not plain files', () => {
+  const callDiffRoute = async (endpoint, query) => {
+    const routes = new Map();
+    registerGitRoutes({ get: (url, handler) => routes.set(url, handler), post() {}, put() {}, delete() {} });
+    let status = 200;
+    let body;
+    await routes.get(`/api/git/${endpoint}`)({ query }, {
+      status(value) { status = value; return this; },
+      json(value) { body = value; },
+    });
+    return { status, body };
+  };
+
+  const createRepositoryWithSubmodule = () => {
+    const { repository } = createRepositoryWithRemote();
+    const library = createTempDir();
+    runGit(library, ['init', '-b', 'main']);
+    runGit(library, ['config', 'user.email', 'test@example.com']);
+    runGit(library, ['config', 'user.name', 'Test']);
+    fs.writeFileSync(path.join(library, 'lib.txt'), 'lib\n');
+    runGit(library, ['add', '.']);
+    runGit(library, ['commit', '-m', 'lib']);
+    runGit(repository, ['-c', 'protocol.file.allow=always', 'submodule', 'add', library, 'sub']);
+    runGit(repository, ['commit', '-m', 'add submodule']);
+    return { repository, recorded: runGit(repository, ['rev-parse', 'HEAD:sub']).trim() };
+  };
+
+  it('answers 404 with a code when a listed file is gone before its diff is requested', async () => {
+    const { repository } = createRepositoryWithRemote();
+    for (const endpoint of ['diff', 'file-diff']) {
+      const { status, body } = await callDiffRoute(endpoint, { directory: repository, path: 'removed.txt' });
+      expect(status).toBe(404);
+      expect(body).toEqual({ code: 'path_not_found', error: 'Path not found in working tree, index, or HEAD: removed.txt' });
+    }
+  });
+
+  it('answers 422 for a nested repository that status lists as a directory', async () => {
+    const { repository } = createRepositoryWithRemote();
+    const nested = path.join(repository, 'nested');
+    fs.mkdirSync(nested);
+    runGit(nested, ['init', '-b', 'main']);
+    fs.writeFileSync(path.join(nested, 'inner.txt'), 'inner\n');
+    expect((await getStatus(repository)).files).toContainEqual(expect.objectContaining({ path: 'nested/' }));
+
+    for (const endpoint of ['diff', 'file-diff']) {
+      const { status, body } = await callDiffRoute(endpoint, { directory: repository, path: 'nested/' });
+      expect(status).toBe(422);
+      expect(body.code).toBe('nested_repository');
+    }
+    await expect(revertFile(repository, 'nested/')).rejects.toMatchObject({ code: 'nested_repository' });
+    expect(fs.existsSync(path.join(nested, 'inner.txt'))).toBe(true);
+  });
+
+  it('describes a submodule whose checked-out commit moved', async () => {
+    const { repository, recorded } = createRepositoryWithSubmodule();
+    const submodulePath = path.join(repository, 'sub');
+    runGit(submodulePath, ['config', 'user.email', 'test@example.com']);
+    runGit(submodulePath, ['config', 'user.name', 'Test']);
+    runGit(submodulePath, ['commit', '--allow-empty', '-m', 'moved']);
+    const moved = runGit(submodulePath, ['rev-parse', 'HEAD']).trim();
+    const submodule = { headCommit: recorded, indexCommit: recorded, worktreeCommit: moved, hasTrackedChanges: false, hasUntrackedFiles: false, hasConflict: false };
+
+    const patch = await callDiffRoute('diff', { directory: repository, path: 'sub' });
+    expect(patch.status).toBe(200);
+    expect(patch.body.diff).toContain(`+Subproject commit ${moved}`);
+    expect(patch.body.submodule).toEqual(submodule);
+
+    const split = await callDiffRoute('file-diff', { directory: repository, path: 'sub' });
+    expect(split.body).toEqual({
+      original: `Subproject commit ${recorded}\n`,
+      modified: `Subproject commit ${moved}\n`,
+      path: 'sub',
+      isBinary: false,
+      submodule,
+    });
+  });
+
+  it('reports a submodule merge conflict instead of an unchanged commit', async () => {
+    const { repository } = createRepositoryWithRemote();
+    const library = createTempDir();
+    runGit(library, ['init', '-b', 'main']);
+    runGit(library, ['config', 'user.email', 'test@example.com']);
+    runGit(library, ['config', 'user.name', 'Test']);
+    runGit(library, ['commit', '--allow-empty', '-m', 'base']);
+    runGit(library, ['checkout', '-b', 'left']);
+    runGit(library, ['commit', '--allow-empty', '-m', 'left']);
+    runGit(library, ['checkout', '-b', 'right', 'main']);
+    runGit(library, ['commit', '--allow-empty', '-m', 'right']);
+    runGit(library, ['checkout', 'main']);
+    runGit(repository, ['-c', 'protocol.file.allow=always', 'submodule', 'add', library, 'sub']);
+    runGit(repository, ['commit', '-m', 'add submodule']);
+    const submodulePath = path.join(repository, 'sub');
+    for (const [branch, commit] of [['other', 'right'], ['next', 'left']]) {
+      if (branch === 'other') runGit(repository, ['checkout', '-b', 'other']);
+      else runGit(repository, ['checkout', 'next']);
+      runGit(submodulePath, ['checkout', commit]);
+      runGit(repository, ['add', 'sub']);
+      runGit(repository, ['commit', '-m', `move to ${commit}`]);
+    }
+    expect(() => runGit(repository, ['merge', 'other'])).toThrow();
+
+    const { submodule } = await getPathDiff(repository, { path: 'sub' });
+    expect(submodule).toMatchObject({
+      headCommit: runGit(repository, ['rev-parse', 'HEAD:sub']).trim(),
+      indexCommit: null,
+      hasConflict: true,
+    });
+  });
+
+  it('reports untracked files inside a submodule even though its patch is empty', async () => {
+    const { repository, recorded } = createRepositoryWithSubmodule();
+    fs.writeFileSync(path.join(repository, 'sub', 'scratch.txt'), 'scratch\n');
+
+    const result = await getPathDiff(repository, { path: 'sub' });
+    expect(result).toEqual({
+      diff: '',
+      submodule: { headCommit: recorded, indexCommit: recorded, worktreeCommit: recorded, hasTrackedChanges: false, hasUntrackedFiles: true, hasConflict: false },
+    });
+  });
+});
+
 // ---------------------------------------------------------------------------
 // getStatus
 // ---------------------------------------------------------------------------
@@ -603,6 +750,142 @@ describe('getStatus', () => {
       process.chdir(previousCwd);
     }
   });
+
+  it('scopes diff stats by staged and working instead of combining a partially staged file', async () => {
+    if (!canRunGit()) return;
+
+    const repo = createTempDir();
+    runGit(repo, ['init', '-b', 'main']);
+    runGit(repo, ['config', 'user.email', 'test@example.com']);
+    runGit(repo, ['config', 'user.name', 'Test User']);
+    const file = 'test.txt';
+    const filePath = path.join(repo, file);
+    fs.writeFileSync(filePath, 'one\ntwo\nthree\n');
+    runGit(repo, ['add', file]);
+    runGit(repo, ['commit', '-m', 'initial']);
+
+    // Stage one new line, then keep editing without staging another.
+    fs.writeFileSync(filePath, 'one\ntwo\nthree\nstaged\n');
+    runGit(repo, ['add', file]);
+    fs.writeFileSync(filePath, 'one\ntwo\nthree\nstaged\nworking\n');
+
+    const status = await getStatus(repo);
+
+    expect(status.diffStats.staged[file]).toEqual({ insertions: 1, deletions: 0 });
+    expect(status.diffStats.working[file]).toEqual({ insertions: 1, deletions: 0 });
+  });
+
+  it('scopes untracked files to working stats and staged additions to staged stats', async () => {
+    if (!canRunGit()) return;
+
+    const repo = createTempDir();
+    runGit(repo, ['init', '-b', 'main']);
+    runGit(repo, ['config', 'user.email', 'test@example.com']);
+    runGit(repo, ['config', 'user.name', 'Test User']);
+    fs.writeFileSync(path.join(repo, 'tracked.txt'), 'tracked\n');
+    runGit(repo, ['add', 'tracked.txt']);
+    runGit(repo, ['commit', '-m', 'initial']);
+
+    fs.writeFileSync(path.join(repo, 'untracked.txt'), 'a\nb\n');
+    fs.writeFileSync(path.join(repo, 'staged.txt'), 'c\nd\ne\n');
+    runGit(repo, ['add', 'staged.txt']);
+
+    const status = await getStatus(repo);
+
+    expect(status.diffStats.working['untracked.txt']).toEqual({ insertions: 2, deletions: 0 });
+    expect(status.diffStats.staged['staged.txt']).toEqual({ insertions: 3, deletions: 0 });
+    expect(status.diffStats.working['staged.txt']).toBeUndefined();
+  });
+});
+
+describe('push', () => {
+  it('publishes the current branch with an upstream and leaves other local branches alone', async () => {
+    if (!canRunGit()) return;
+
+    const remote = createTempDir();
+    const repo = createTempDir();
+    runGit(remote, ['init', '--bare']);
+    runGit(repo, ['init', '-b', 'main']);
+    runGit(repo, ['config', 'user.email', 'test@example.com']);
+    runGit(repo, ['config', 'user.name', 'Test User']);
+    fs.writeFileSync(path.join(repo, 'README.md'), '# Test\n');
+    runGit(repo, ['add', 'README.md']);
+    runGit(repo, ['commit', '-m', 'Initial commit']);
+    runGit(repo, ['remote', 'add', 'fork', remote]);
+    runGit(repo, ['branch', 'unrelated']);
+    runGit(repo, ['checkout', '-b', 'feature']);
+    fs.writeFileSync(path.join(repo, 'feature.txt'), 'published\n');
+    runGit(repo, ['add', 'feature.txt']);
+    runGit(repo, ['commit', '-m', 'Add feature']);
+
+    const published = await push(repo, { remote: 'fork' });
+    expect(published.pushed).toEqual([{ local: 'refs/heads/feature', remote: 'fork' }]);
+
+    expect(runGit(repo, ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']).trim()).toBe('fork/feature');
+    expect(runGit(remote, ['rev-parse', 'refs/heads/feature']).trim()).toBe(runGit(repo, ['rev-parse', 'HEAD']).trim());
+    expect(() => runGit(remote, ['rev-parse', 'refs/heads/unrelated'])).toThrow();
+    expect(() => runGit(remote, ['rev-parse', 'refs/heads/main'])).toThrow();
+
+    expect((await push(repo)).pushed).toEqual([]);
+    fs.appendFileSync(path.join(repo, 'feature.txt'), 'next commit\n');
+    runGit(repo, ['commit', '-am', 'Update feature']);
+    expect((await push(repo)).pushed).toEqual([{ local: 'refs/heads/feature', remote: 'fork' }]);
+    expect(runGit(remote, ['rev-parse', 'feature']).trim()).toBe(runGit(repo, ['rev-parse', 'HEAD']).trim());
+
+    runGit(repo, ['reset', '--hard', 'HEAD~1']);
+    await expect(push(repo)).rejects.toThrow();
+    expect((await push(repo, { options: ['--force-with-lease'] })).pushed)
+      .toEqual([{ local: 'refs/heads/feature', remote: 'fork' }]);
+    expect(runGit(remote, ['rev-parse', 'feature']).trim()).toBe(runGit(repo, ['rev-parse', 'HEAD']).trim());
+  });
+
+  it.each(['remote.pushDefault', 'branch.next.pushRemote'])('preserves the %s destination independently of the fetch remote', async (key) => {
+    const { repository, remote: upstream } = createRepositoryWithRemote({ remoteName: 'upstream', defaultBranch: 'next' });
+    const fork = createTempDir();
+    runGit(fork, ['init', '--bare']);
+    runGit(repository, ['remote', 'add', 'fork', fork]);
+    runGit(repository, ['branch', '--set-upstream-to=upstream/next']);
+    if (key === 'branch.next.pushRemote') runGit(repository, ['config', 'remote.pushDefault', 'upstream']);
+    runGit(repository, ['config', key, 'fork']);
+    const upstreamHead = runGit(upstream, ['rev-parse', 'next']).trim();
+    fs.appendFileSync(path.join(repository, 'README.md'), 'fork change\n');
+    runGit(repository, ['commit', '-am', 'Change for fork']);
+
+    expect((await push(repository)).pushed).toEqual([{ local: 'refs/heads/next', remote: 'fork' }]);
+    expect(runGit(fork, ['rev-parse', 'next']).trim()).toBe(runGit(repository, ['rev-parse', 'HEAD']).trim());
+    expect(runGit(upstream, ['rev-parse', 'next']).trim()).toBe(upstreamHead);
+    expect(readBranchConfig(repository, 'next', 'remote')).toBe('upstream');
+    expect((await push(repository)).pushed).toEqual([]);
+  });
+
+  it.each(['remote.pushDefault', 'branch.next.pushRemote'])('uses %s for first publication without an upstream', async (key) => {
+    const { repository, remote: origin } = createRepositoryWithRemote();
+    const fork = createTempDir();
+    runGit(fork, ['init', '--bare']);
+    runGit(repository, ['remote', 'add', 'fork', fork]);
+    runGit(repository, ['config', key, 'fork']);
+    runGit(repository, ['config', 'push.autoSetupRemote', 'false']);
+
+    expect((await push(repository)).pushed).toEqual([{ local: 'refs/heads/next', remote: 'fork' }]);
+    expect(readBranchConfig(repository, 'next', 'remote')).toBe('fork');
+    expect(() => runGit(origin, ['rev-parse', 'refs/heads/next'])).toThrow();
+  });
+
+  it('lets an explicit push remote override configured destinations', async () => {
+    const { repository, remote: origin } = createRepositoryWithRemote({ defaultBranch: 'next' });
+    const fork = createTempDir();
+    runGit(fork, ['init', '--bare']);
+    runGit(repository, ['remote', 'add', 'fork', fork]);
+    runGit(repository, ['branch', '--set-upstream-to=origin/next']);
+    runGit(repository, ['config', 'branch.next.pushRemote', 'fork']);
+    fs.appendFileSync(path.join(repository, 'README.md'), 'origin change\n');
+    runGit(repository, ['commit', '-am', 'Change for origin']);
+
+    expect((await push(repository, { remote: 'origin' })).pushed)
+      .toEqual([{ local: 'refs/heads/next', remote: 'origin' }]);
+    expect(runGit(origin, ['rev-parse', 'next']).trim()).toBe(runGit(repository, ['rev-parse', 'HEAD']).trim());
+    expect(() => runGit(fork, ['rev-parse', 'next'])).toThrow();
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -2261,3 +2544,138 @@ describe.runIf(canRunGit())('getRangeFiles', () => {
     expect(copyEntry.path).toBe('copied destination.md');
   });
 });
+
+// ---------------------------------------------------------------------------
+// getTrackingBranch
+// ---------------------------------------------------------------------------
+
+describe('getTrackingBranch', () => {
+  const createCommittedRepo = () => {
+    const repo = createTempDir();
+    runGit(repo, ['init', '-b', 'main']);
+    runGit(repo, ['config', 'user.email', 'test@example.com']);
+    runGit(repo, ['config', 'user.name', 'Test User']);
+    runGit(repo, ['commit', '--allow-empty', '-m', 'Initial commit']);
+    return repo;
+  };
+
+  it('reports the same upstream name as status, including a gone upstream', async () => {
+    if (!canRunGit()) return;
+
+    const repo = createCommittedRepo();
+    await expect(getTrackingBranch(repo)).resolves.toBeNull();
+
+    runGit(repo, ['remote', 'add', 'origin', 'https://example.invalid/repo.git']);
+    runGit(repo, ['config', 'branch.main.remote', 'origin']);
+    runGit(repo, ['config', 'branch.main.merge', 'refs/heads/main']);
+    await expect(getTrackingBranch(repo)).resolves.toBe('origin/main');
+    expect((await getStatus(repo)).tracking).toBe('origin/main');
+
+    runGit(repo, ['update-ref', 'refs/remotes/origin/main', 'HEAD']);
+    await expect(getTrackingBranch(repo)).resolves.toBe('origin/main');
+  });
+
+  it('is null for a detached HEAD and outside a repository', async () => {
+    if (!canRunGit()) return;
+
+    const repo = createCommittedRepo();
+    runGit(repo, ['checkout', '--detach']);
+    await expect(getTrackingBranch(repo)).resolves.toBeNull();
+    await expect(getTrackingBranch(createTempDir())).resolves.toBeNull();
+  });
+});
+
+describe('getStatus concurrency', () => {
+  it('answers overlapping reads of one repository and reflects changes made while a read ran', async () => {
+    if (!canRunGit()) return;
+
+    const repo = createTempDir();
+    runGit(repo, ['init', '-b', 'main']);
+    runGit(repo, ['config', 'user.email', 'test@example.com']);
+    runGit(repo, ['config', 'user.name', 'Test User']);
+    runGit(repo, ['commit', '--allow-empty', '-m', 'Initial commit']);
+
+    const first = getStatus(repo);
+    fs.writeFileSync(path.join(repo, 'late.txt'), 'added after the first read was admitted\n');
+    const second = getStatus(repo, { mode: 'light' });
+    const third = getStatus(repo);
+
+    const [firstStatus, secondStatus, thirdStatus] = await Promise.all([first, second, third]);
+    expect(firstStatus.current).toBe('main');
+    expect(secondStatus.files.map((file) => file.path)).toContain('late.txt');
+    expect(thirdStatus.files.map((file) => file.path)).toContain('late.txt');
+    // The follow-up run served both later callers at the widest requested mode.
+    expect(secondStatus.diffStats).toBeDefined();
+    expect(thirdStatus.diffStats).toBeDefined();
+  });
+});
+
+describe('getStatus untracked directories', () => {
+  const callDiffRoute = async (endpoint, query) => {
+    const routes = new Map();
+    registerGitRoutes({ get: (url, handler) => routes.set(url, handler), post() {}, put() {}, delete() {} });
+    let status = 200;
+    let body;
+    await routes.get(`/api/git/${endpoint}`)({ query }, {
+      status(value) { status = value; return this; },
+      json(value) { body = value; },
+    });
+    return { status, body };
+  };
+
+  const createCommittedRepo = () => {
+    const repo = createTempDir();
+    runGit(repo, ['init', '-b', 'main']);
+    runGit(repo, ['config', 'user.email', 'test@example.com']);
+    runGit(repo, ['config', 'user.name', 'Test User']);
+    fs.writeFileSync(path.join(repo, 'README.md'), '# Test\n');
+    runGit(repo, ['add', 'README.md']);
+    runGit(repo, ['commit', '-m', 'Initial commit']);
+    return repo;
+  };
+
+  const writeFiles = (root, count) => {
+    fs.mkdirSync(root, { recursive: true });
+    for (let index = 0; index < count; index += 1) {
+      fs.writeFileSync(path.join(root, `file-${String(index).padStart(5, '0')}.txt`), `${index}\n`);
+    }
+  };
+
+  it('lists the files of an ordinary new directory one by one', async () => {
+    if (!canRunGit()) return;
+
+    const repo = createCommittedRepo();
+    writeFiles(path.join(repo, 'feature', 'deep'), 3);
+    fs.writeFileSync(path.join(repo, 'loose.txt'), 'loose\n');
+
+    const paths = (await getStatus(repo)).files.map((file) => file.path);
+    expect(paths).toEqual([
+      'feature/deep/file-00000.txt',
+      'feature/deep/file-00001.txt',
+      'feature/deep/file-00002.txt',
+      'loose.txt',
+    ]);
+  });
+
+  it('keeps a directory with more than a thousand new files as one entry the diff routes explain', async () => {
+    if (!canRunGit()) return;
+
+    const repo = createCommittedRepo();
+    writeFiles(path.join(repo, 'node_modules', 'pkg'), 1001);
+    writeFiles(path.join(repo, 'small'), 2);
+
+    const status = await getStatus(repo);
+    expect(status.files.map((file) => file.path)).toEqual([
+      'node_modules/',
+      'small/file-00000.txt',
+      'small/file-00001.txt',
+    ]);
+    expect(status.files[0]).toMatchObject({ index: '?', working_dir: '?' });
+
+    for (const endpoint of ['diff', 'file-diff']) {
+      const { status: httpStatus, body } = await callDiffRoute(endpoint, { directory: repo, path: 'node_modules/' });
+      expect(httpStatus).toBe(422);
+      expect(body).toEqual({ code: 'untracked_directory', error: 'Path is a directory of untracked files: node_modules/' });
+    }
+  });
+});

package/server/lib/github/pr-status.js

@@ -1,5 +1,5 @@
 import { stat } from 'node:fs/promises';
-import { getRemotes, getStatus } from '../git/index.js';
+import { getRemotes, getTrackingBranch } from '../git/index.js';
 import { resolveGitHubRepoFromDirectory } from './repo/index.js';
 import { noteIfGitHubRateLimit } from './rate-limit.js';
 
@@ -644,13 +644,13 @@ export async function resolveGitHubPrStatus({ octokit, directory, branch, remote
   const normalizedBranch = normalizeText(branch);
   const normalizedRemoteName = normalizeText(remoteName) || 'origin';
 
-  const [status, remotes] = await Promise.all([
-    getStatus(directory).catch(() => null),
+  const [tracking, remotes] = await Promise.all([
+    getTrackingBranch(directory).catch(() => null),
     getRemotes(directory).catch(() => []),
   ]);
 
-  const trackingRemoteName = parseTrackingRemoteName(status?.tracking);
-  const trackingBranchName = parseTrackingBranchName(status?.tracking);
+  const trackingRemoteName = parseTrackingRemoteName(tracking);
+  const trackingBranchName = parseTrackingBranchName(tracking);
   const branchCandidates = [];
   pushUnique(branchCandidates, normalizedBranch);
   pushUnique(branchCandidates, trackingBranchName);

package/server/lib/github/pr-status.test.js

@@ -4,7 +4,7 @@ const listMock = mock(async () => ({ data: [] }));
 
 mock.module('../git/index.js', () => ({
   getRemotes: async () => [],
-  getStatus: async () => null,
+  getTrackingBranch: async () => null,
 }));
 
 mock.module('./repo/index.js', () => ({

package/server/lib/github/routes.js

@@ -781,14 +781,14 @@ export function registerGitHubRoutes(app) {
       // Determine the source remote for the head branch
       // Priority: 1) explicit headRemote, 2) tracking branch remote, 3) 'origin' if targeting non-origin
       let sourceRemote = headRemote;
-      const { getStatus, getRemotes } = await import('../git/index.js');
+      const { getTrackingBranch, getRemotes } = await import('../git/index.js');
       
       // If no explicit headRemote, check the branch's tracking info
       if (!sourceRemote) {
-        const status = await getStatus(directory).catch(() => null);
-        if (status?.tracking) {
+        const tracking = await getTrackingBranch(directory).catch(() => null);
+        if (tracking) {
           // tracking is like "gsxdsm/fix/multi-remote-branch-creation" or "origin/main"
-          const trackingRemote = status.tracking.split('/')[0];
+          const trackingRemote = tracking.split('/')[0];
           if (trackingRemote) {
             sourceRemote = trackingRemote;
           }

package/server/lib/guests/DOCUMENTATION.md

@@ -0,0 +1,68 @@
+# Guest panels
+
+## Purpose
+
+OpenChamber-owned install and static serve for iframe guests. This is not the OpenCode plugin manager (`plugin-routes.js` / Settings → Plugins).
+
+## Routes
+
+- `POST /api/guests/:id/storage` accepts the SDK's `GuestStorageRequest` and returns `GuestStorageResult`. It requires an installed, enabled, fully approved guest with either a panel or background entry, but no additional capability. The UI host supplies the frame's own identity. Guest-scoped asset tokens cannot call this route. Data lives beside `extensions.json` in `guest-storage/<id>.json`. Each key is 1 to 128 characters, each JSON value at most 64 KiB UTF-8, the whole namespace at most 2 MiB and 2,000 keys. `storage.js` owns serialized authorization/read/write/removal; writes are atomic and failures preserve prior bytes. `uninstallGuest` removes storage for every install source. Missing keys return `found: false`, including after removal; stored JSON null returns `found: true`.
+- `GET /api/guests` also exposes `pageEntry` and optional `pageTitle` for `contributes.page`. Full-screen page HTML and its built scripts pass the same install checks as attach HTML. No new serving/auth path is required.
+
+- `GET /api/guests` returns installed guests. `attach` is `"panel"` or `"dialog"` when declared, and `attachEntry` is the dialog's separate HTML. `version` is the package semver. `integration` is the public slice: name, description, `auth`, and settings; OAuth URLs and tokens stay on the server. `service` includes `runtime`, optional `permissions`, optional `socketBindings`, and `granted`. `capabilities` carries `{ requested, granted }`, derived through the SDK's `requestedGuestCapabilities`. `actions`, `commands`, `tools`, and `filesystem` retain their parsed declarations; UI owns menu placement, command collisions, and tool precedence. `entry` is the optional visible panel and `backgroundEntry` is independent on-demand execution HTML. Background-only extensions get no rail surface; tools-only extensions with neither entry mount no frame. A guest without every requested grant is inactive until approval. `enabled: false` pauses it. A failed listing is 500, never an empty list.
+- `GET /api/guests/:id/oauth/status` — `{ connected, account, hasClient, settings, redirectUri }`. No secrets. Host Linear merges first-party Linear status. `redirectUri` is empty unless `auth` is `oauth`.
+- `PUT /api/guests/:id/oauth/client` — client id and optional secret from the Integrations form. OAuth guests only.
+- `PUT /api/guests/:id/token` — pasted API token. Token guests only. The host probes the declared account path. The token never goes to the iframe.
+- `PUT /api/guests/:id/settings` — declared keys only. The Integrations card calls it when a declared field loses focus with a changed value; there is no Save button. Connect saves the token (and username for `basic`) or the OAuth client id and then the declared fields.
+- `POST /api/guests/:id/oauth/start` — PKCE S256 for OAuth guests. Host Linear starts the first-party Linear authorize URL. Token guests get `NO_INTEGRATION`.
+- `GET /api/guests/:id/oauth/callback` — public HTML page. The provider redirects here with no UI bearer. State and verifier stay on the server. A callback without a matching `state` is refused; nothing is inferred from a pending exchange. Host Linear uses the first-party Linear callback, not this URL.
+- `DELETE /api/guests/:id/oauth` — drops tokens for that guest. Client and settings stay. Host Linear disconnects the first-party Linear workspace.
+- `POST /api/guests/:id/request` — authenticated UI session. Attaches Authorization. Path must stay on that guest's `apiOrigin`. Token guests send the pasted token as is, `Bearer <token>` when the manifest sets `token.scheme: "bearer"`, or `Basic <pair>` for `"basic"`, where `PUT /api/guests/:id/token` took `{ token, username }` and stored `base64(username:token)` as the access token (`USERNAME_MISSING` without a username). Host Linear sends the Linear bearer to `https://api.linear.app` only. Linear issue file URLs stay on `GET /api/linear/issues/get`. The guest proxy does not add Linear headers. A paused extension (`enabled: false`) is 400 `DISABLED`; tokens stay. A guest without the `network` capability granted is 400 `NOT_GRANTED`.
+- `POST /api/guests/:id/service/request` — authenticated UI session. Proxies to that guest's host-spawned service on `127.0.0.1`. Spawns on first use after the grant; every service needs one. Missing grant, missing service, or bad path is 400 with `NO_SERVICE` / `BAD_PATH`. Paused extension is 400 `DISABLED` (service stopped). Ready failure is 502 `SERVICE_FAILED`.
+- `POST /api/guests/:id/files` — authenticated UI session. `{ op: 'read' | 'write' | 'list' | 'stat', path, content? }` (`content` required for `write`, at most `GUEST_FILE_CONTENT_MAX` characters; `path` at most `GUEST_FILE_PATH_MAX`). The open project comes from `resolveOptionalProjectDirectory(req)` (`x-opencode-directory` header or `directory` query). `files.js` resolves the path: relative → joined to the project's realpath, and the deepest existing ancestor is realpath'd so a symlink out of the project is `BAD_PATH`; a relative path with no project is `NO_DIRECTORY`. `/…` or `~/…` → home expanded, normalized, canonicalized the same way, then matched against the package's `contributes.filesystem` globs whose literal prefixes were canonicalized too (`/tmp` → `/private/tmp` on macOS); no match is `BAD_PATH`. Any `..` segment, NUL, or backslash is `BAD_PATH`. Then the grant: project scope needs `files`, outside needs `filesystem`, else `NOT_GRANTED`. Then the operation: read is UTF-8 and refuses a file over the cap with `FILE_TOO_LARGE`; write makes parent directories and lands through a temp file plus rename (a reader never sees a truncated file); list returns `{ name, kind }` sorted by name and capped at `GUEST_FILE_LIST_MAX`, with symlinks as `other`; stat answers `kind: 'missing'` for nothing there. Answers are `{ ok: true, result }`, or `{ error: code, message }` with 400 (404 for `NOT_FOUND`). Paused extension is 400 `DISABLED`. `ENOENT` is `NOT_FOUND`, `EACCES` / `EPERM` is `DENIED`, `EISDIR` / `ENOTDIR` is `BAD_PATH`. Neither the path nor the content is ever logged.
+- `POST /api/guests/:id/generate` — authenticated UI session. `{ prompt, system?, maxOutputTokens? }` (prompt at most `GUEST_GENERATE_PROMPT_MAX`, system `GUEST_GENERATE_SYSTEM_MAX`, tokens `GUEST_GENERATE_OUTPUT_TOKENS_MAX`). Paused extension is 400 `DISABLED`; missing `model` grant is 400 `NOT_GRANTED`. The call goes to `generateSmallModelText` in `lib/small-model`, which resolves and authenticates the Small Model the same way session titles and notes do (settings override → OpenCode config → signed-in provider); the optional `x-opencode-directory` header only picks which OpenCode config is read. No model (404) or Claude Code as the only candidate (422) is 400 `NO_MODEL`; a provider failure is 502 `MODEL_FAILED`. Answer is `{ ok: true, result: { text } }` capped at `GUEST_GENERATE_TEXT_MAX`. Prompt and answer are never logged.
+- `GET /api/guests/:id/service/status` — `{ status }` for that guest's service runtime (`stopped` / `starting` / `ready` / `failed`).
+- `PUT /api/guests/:id/capabilities` — `{ granted: GuestCapability[] }`. The list must equal the package's requested list, or be empty to withdraw approval (which also stops a running service). Anything else is 400 `invalid-request`. `service.granted` mirrors whether `service` is in the granted list. Approval also records the grant's scope (`grant-scope.js` `guestGrantScope`: the sorted `filesystem` patterns, the integration's `apiOrigin` and OAuth `authorizeUrl` / `tokenUrl`, the service's exec names and socket ids) as `capabilityScopes[id]`. When the recorded origin or OAuth endpoints differ from the new ones (`sameCredentialTarget`) the guest's stored tokens are dropped: a token pasted for one API, or a refresh token and client secret minted for one token endpoint, must not follow the integration to another.
+- `PUT /api/guests/:id/service/sockets` — `{ id, path }` for a declared socket binding. Empty or null `path` clears the override. Stops a running service for that guest. Catalog `service.socketBindings` shows `resolved` and `override` for this host.
+- `PUT /api/guests/:id/enabled` — `{ enabled }`. False is a full pause: catalog `enabled: false`, rail/attach/Integrations hide the guest, open panels close, cloud `request` and `service/request` return `DISABLED`, and a running service stops. Tokens and grants stay until Remove.
+- `POST /api/guests` accepts exactly one of `{ path }` or `{ url }`, optional `replace`, and optional `gitIdentityId` for Git installs. `path` is an absolute folder or local ZIP. `url` is HTTPS Git/ZIP, `ssh://` Git, or scp-style SSH. Folder installs persist their realpath; Git and ZIP installs copy into `{openchamberDataDir}/extensions/{id}`. Success is 201, or 200 after replacement. Invalid input is `invalid-path`/`invalid-url`; clone and extraction failures are `clone-failed`/`extract-failed`. A missing selected identity fails cloning rather than falling back to global auth. Missing built scripts are `missing-build`, invalid package/version is `invalid-manifest`, and a newer required host is `host-too-old`. Duplicate installs are 409 `id-taken`/`already-installed`. Other install failures are 400. Clone uses the host's resolved Git binary; orphaned copy folders from interrupted installs can be replaced on retry. Each OpenChamber data directory owns its own catalog.
+- `POST /api/guests/upload` — the archive itself as the body, `Content-Type: application/octet-stream`, for a browser or a remote instance that cannot name a path on the host. Query `replace=true` mirrors the JSON route's `replace`; `name` (the original filename) is accepted and unused, never logged. A wrong content type is 415 `unsupported-media-type`. A `Content-Length` over the cap is refused with 413 `too-large` before the body is read, and a body that grows past the cap without a declared length stops with the same answer. The cap is `OPENCHAMBER_GUEST_UPLOAD_MAX_BYTES`, default 50 MB (`upload.js` `guestUploadMaxBytes`). The bytes go to `installGuestFromZipBuffer`, the same function a local `.zip` path and an https `.zip` URL end in, so results and errors are those of `POST /api/guests` with a zip: 201 / 200 after replace with `{ guest }` (`source: "zip"`), 409 `already-installed` / `id-taken` with `id`, 400 `invalid-manifest`, `missing-build`, `host-too-old`, `extract-failed`. Registered before the `:id` routes because `upload` is a valid panel id shape. Archive contents are never logged.
+- `POST /api/guests/updates/check` — `{ force?: boolean }` → `{ updates: Record<guestId, { version }> }` for every git install whose origin now carries a newer `package.json` `version`. The check runs `git fetch --depth 1 origin <ref|HEAD>` inside the installed clone and reads `FETCH_HEAD:package.json` through the SDK manifest parser; the only signal is semver (`updates.js` `compareSemver`, prerelease below release), no commit hashes. Results sit in a memory cache per store file and guest id for `UPDATE_CHECK_TTL_MS` (one hour); `force` asks the network again. That cache is separate from the catalog cache, so a store write does not drop it. One guest's failed fetch never hides another's update. Folder and zip installs are never checked.
+- `POST /api/guests/:id/update` — replace the installed git copy with a fresh clone of its stored origin. Answers `{ guest }` (the refreshed catalog row) or 400 `{ error }` with `not-git` (folder, zip, or no stored origin), `clone-failed`, `invalid-manifest` (also when the clone declares a different panel id), `missing-build`, `host-too-old` (body may include `required`), or `swap-failed`. Unknown id is 404. Grants, tokens, settings, and the paused flag are keyed by guest id and stay as they were; a version that asks for more capabilities shows up as needs-approval in the catalog and goes through the usual review dialog.
+- `DELETE /api/guests/:id` — drops the store row, any service grant, and socket overrides; stops a running service. Path-install does not delete the user's folder. Zip and git copies under `{openchamberDataDir}/extensions/` are deleted. Unknown id is 404.
+- `GET /api/guests/:id/{*filePath}` serves package-local files. Unknown IDs, escapes, missing files, and unknown types return 404. HTML and JS require either `entry` or `backgroundEntry`, expressed by `resolveGuestServedFile`'s `hasRuntime` option. Tools-only extensions still serve their SVG icons but no executable content. Guest HTML propagates the scoped `oc_url_token` onto relative script/link/image URLs. The token is minted for `guest:<id>` and works only under that guest's asset route, never `/api/fs/raw` or event streams. Every response carries `Content-Security-Policy: sandbox allow-scripts`, including direct document navigation. The host serves built files from disk and never compiles guest sources.
+
+## Install
+
+`contributes.background.entry` is optional package-local `.html`, separate from `panel.entry`. Install validates its HTML and every referenced built script using the same path confinement as visible panels. `backgroundEntry` is exposed on the catalog independently of `entry`; adding it does not create a rail icon or a visible page. Capabilities, services, integrations, and storage work with either execution entry. The SDK refuses visible contributions without `panel.entry` and all runtime contributions when neither entry exists. See `packages/sdk/DOCUMENTATION.md` for on-demand invocation ownership.
+
+`html-styles.js` appends the SDK's shared scrollbar stylesheet to served HTML, including requests without an asset token. This applies to existing panel, page, and attach bundles in direct and relay mode; the relay loader retains the inline style in `srcDoc`. Appending preserves the doctype and avoids rewriting tag-like text inside scripts or comments. Authored CSP stays intact and can block inline styling. Package files on disk and non-HTML responses are unchanged. Scrollbar colors follow the SDK theme variables inside the frame.
+
+Built-ins ship with the app; user extensions are installed separately. Add a folder, local ZIP, HTTPS Git/ZIP URL, or SSH Git address from Settings → Extensions. The ZIP picker and drop zone upload the archive on web and remote desktop instances. A guest with a page must ship built classic-IIFE JavaScript, for example from `bunx openchamber-guest-bundle panel/main.ts panel/main.js`; the sandbox does not support ESM imports. `package.json` needs a semver version. A missing panel SVG or invalid manifest fails installation; page-less tools-only packages skip HTML/script checks. Optional `engines.openchamber` is checked against this host. Provider accounts are connected separately in Settings → Integrations.
+
+Folder installs store their realpath with `source: "path"`. ZIP and Git copies live in `{openchamberDataDir}/extensions/{id}`. Git URLs may end in `#branch-or-tag`; clones use `--branch <ref> --depth 1`. `gitOrigins` stores `{ url, ref?, gitIdentityId? }` per install path and is removed on uninstall. Legacy origins without an identity retain global authentication. Malformed origins are dropped individually. The public catalog exposes the origin URL/ref, never the key path. Named profiles are re-resolved on each clone or update fetch so key rotation applies; missing profiles fail closed. Global auth preserves the server's SSH agent and Git/SSH configuration. ZIP limits remain 20MB for path/URL installs, 500 files and 40MB expanded, store/deflate only, no encryption, zip64 or parent-path escapes. Uninstall deletes copies and leaves folder-install sources intact.
+
+OAuth and pasted tokens live in `{openchamberDataDir}/guest-auth.json`, each entry with the `target` it was minted for (`apiOrigin`, and for OAuth `authorizeUrl` and `tokenUrl`). `takeUsableGuestAuth` runs before every use (proxy, refresh, the status card): tokens whose target differs from what the package declares now, or that carry no target, are dropped on the spot, whatever the grants say. A pending authorization carries the same target; the callback refuses the exchange (`TARGET_CHANGED`) when the package changed its endpoints in between, and the exchange itself goes to the pending target's `tokenUrl`, never to the current manifest's. The client id and secret carry their own `clientTarget`, written by `PUT /api/guests/:id/oauth/client` (`saveGuestOAuthClient`: an empty secret field keeps the stored secret only for the same client id and the same endpoints, decided under the store lock; a new id or moved endpoints drop it); `usableClientCredentials` treats a client entered for other endpoints as absent (`CLIENT_MISSING` on Connect, `hasClient: false` on the card), so a moved package gets no old secret and the user enters new credentials. Every token write that follows a network round trip (the code exchange, a refresh) goes through `patchGuestAuth` with an `expect` predicate checked under the store lock: the entry must still hold the tokens and target the round trip started from, else the answer is dropped and the entry left as it is. The proxy's cleanup after a 401 is scoped the same way: `dropGuestTokens` with an `expect` on the access token the request was refused with, so a refresh that came back empty because the user reconnected meanwhile never erases the new connection. Host Linear tokens stay in `linear-auth.json`. Writes are atomic and `0o600`. The file is per OpenChamber instance, same as `extensions.json`. Web and desktop share it. VS Code and mobile set the guest catalog to `unsupported`. That is not an empty ready list. Those cards stay hidden.
+
+A missing folder is omitted from the list. Other guests stay. A corrupt `extensions.json` is 500, not an empty catalog. A missing or blank `guest-auth.json` is an empty store. Corrupt JSON there is 500, not a disconnected card. This is not Settings → Plugins.
+
+## Invariants
+
+- Built-in packages come from the app-owned registry bound by `registerBuiltInGuests` at server startup. Source/build/packaging rules are in `packages/extensions/DOCUMENTATION.md`. They receive only their declared grants automatically; ordinary runtime and enabled checks still apply. `openchamber-builtin-` IDs are reserved from user installs, including replacement. DELETE, Git update and grant-edit routes refuse built-ins. Disable preserves account/storage data and stops their services.
+
+- Grants are narrowed on read, never trusted as stored. `listInstalledGuestsUncached` passes each guest's stored list through `effectiveGrants(granted, storedScope, currentScope)`: `filesystem`, `network`, and `service` only count while the scope recorded at approval equals what the package declares now, and never count without a recorded scope. A newer version that widens its patterns, moves its API origin, or asks for more exec names or sockets shows up as needs-approval and is refused by every proxy meanwhile. Routes and `proxyGuestServiceRequest` take the grant list from the catalog row (`guest.capabilityGrants`), not from the store.
+- Store changes are read-modify-write under one lock per file (`updateExtensionStore`): Allow, Pause, a socket override, an install, and an uninstall landing at the same time all keep each other's result. `guest-auth.json` has the same lock (`withAuthStoreLock`) and every temp file name is unique.
+- ZIP downloads validate and pin each HTTPS hop, at most five. Git clones and update fetches share `prepareGuestGitNetwork`. HTTPS retains `http.followRedirects=false` and `http.curloptResolve` pinning. SSH validates the username/host/path, rejects password-bearing URLs and private DNS answers, pins `Hostname` to a resolved public address, and retains the original host for host-key checks through `HostKeyAlias`. Default SSH options use batch mode and `StrictHostKeyChecking=accept-new`, with ProxyCommand/ProxyJump disabled. Identity key paths are shell-quoted; keys and SSH agent sockets stay on the server. Public Git hosts are supported, not local SSH aliases or private-network targets. Existing user-configured Git/SSH commands remain trusted server configuration.
+- The catalog cache is version-guarded: `invalidateGuestCatalog` bumps a per-path version, the store notifies before and after each write, and a listing only caches its result when the version did not move while it read. A read that straddled a withdrawal therefore never serves the old grants for the TTL.
+- Stopping a service also cancels a request in flight: `stopGuestService` (Pause, Remove, withdrawn approval, socket change, host quit) bumps a per-guest epoch. `proxyGuestServiceRequest` reads the epoch before its first store read, hands it to the start, and checks it again after the service is up; `startGuestService` checks it after every await, right before `spawn`, and while polling readiness. Pause anywhere between the request's enabled check and the proxied call ends with no process and `NO_SERVICE`. Internal cleanup of a dead or failed runtime before a restart is `discardRuntime`, which does not bump the epoch: a crash is not a Pause, so the request that triggers the restart goes through.
+
+- Paths stay inside the package root (`realpath`). `..`, absolute paths, and URLs do not serve.
+- Only an allowlisted content type is served.
+- Host and guest speak `@openchamber/sdk`. Do not copy those types into `packages/ui`.
+- `contributes.actions`, `contributes.commands`, and `contributes.tools` are validated by the SDK parse at install (`invalid-actions` / `invalid-commands` / `invalid-tools` surface as `invalid-manifest`) and copied to the catalog row unchanged. Tool presentations are applied in the UI only (`packages/ui/src/lib/guests/tool-presentation.ts`); no server route reads them. No server route runs an action or a command: the message or session item is built in the UI from the same records Export as Markdown uses, and a slash command is answered by the guest frame over `postMessage`. The rail badge is UI memory only.
+- `contributes.attach` is copied as `"panel"` or `"dialog"`. The composer + menu and New Worktree read that field. Omitted guests stay off those menus. The object form's `entry` (dialog only) is checked at install like `panel.entry`: missing HTML is `invalid-manifest`, an unbuilt script it loads is `missing-build`; the catalog exposes it as `attachEntry` and the attach window loads that page instead of `panel.entry`. The optional attach `data` payload lives only in the UI's chip, queued context part, and session metadata snapshot; no server route parses it.
+- `request` never leaves the declared `apiOrigin`. A 401 refreshes once. If that fails, tokens for that guest are dropped. Host Linear does not drop Linear auth on a failed GraphQL query. A paused guest never proxies `request` or `serviceRequest`.
+- `serviceRequest` never leaves that guest's loopback port. Auth to the service is `Authorization: Bearer` with a host-minted token. The service env is an allowlist (PATH, HOME, temp, locale, Windows system variables) plus `OPENCHAMBER_SERVICE_*`; host secrets are not inherited. There is no sandbox: an allowed service has the user's full access, and the grant card says so. Ready is `GET /health` → 200. Parallel first requests share one spawn; they must not kill each other mid-start. Host quit stops every service. Disabling a guest stops its service without clearing OAuth or grants.
+- File access is decided in `files.js` on canonical paths, never on the string the guest sent. `matchesFilesystemPattern`, `expandHome`, and `globToRegExp` are pure; `resolveGuestFilePath` and `runGuestFileOperation` take `fsPromises` / `nodePath` so tests can stub the OS. The project directory is whatever `resolveOptionalProjectDirectory` validated for this request, so a guest cannot name a project the UI did not open.
+- Update swap (`updates.js` `updateGuest`): the new clone lands in `{dataDir}/extensions/.tmp-<id>-<random>` and is inspected exactly like an install before anything else moves. Only then: stop the guest's service, rename current → `.old-<id>`, rename temp → final, delete `.old-<id>`. Any failure before the swap deletes the temp dir and leaves the install untouched; a failed second rename moves `.old-<id>` back. The store row is not rewritten (same path, same id), the catalog cache and that guest's update cache entry are dropped.
+- The OAuth callback skips UI auth. Everything else under `/api/guests` stays behind the usual session.