@vantran-se/openchamber-web 2.1.1 → 2.2.0

package/server/lib/git/DOCUMENTATION.md

@@ -17,6 +17,7 @@ This module provides Git repository operations for the web server runtime, inclu
    - `transport-config.js`: bounded effective Git transport and checkout-hydration configuration hashing for repository authority.
    - `submodule-discovery.js`, `lfs-discovery.js`, and `discovery-endpoint.js`: bounded pure parsers for committed checkout metadata and endpoint resolution.
   - `contributor-provenance-storage.js`: strict bounded persistence for contributor-fork worktree identity and push-safety authority.
+  - `worktree-creation.js`: worktree creation with the server's authority checks, including the change-request pipeline (resolve, exact account, managed head transfer, contributor remote and provenance). `POST /api/git/worktrees` and the session service (`session.create` with `pullRequest`) both create through it; `registerGitRoutes` returns its `createWorktree` for that.
   - `credential-resolver.js` and `credential-broker.js`: resolve opaque managed credential references and provide one-operation Git authentication without returning secrets to clients.
   - `redaction.js`: bounded Git output and error redaction.
   - `helper-launch.js`: how Git reaches this module's helper scripts through `sh`, telling Electron to run as Node inside the command itself.
@@ -42,8 +43,10 @@ Author-profile application never sets or unsets `core.sshCommand` or `credential
 An identity is one repository's complete answer: signature, provider account (`account: { provider, instance, accountId }`), and transport (`account`, `ssh` with `sshCredentialId`, or `anonymous`). A client cannot write an identity without an account or with the `system` transport; records written before identities carried an account are still read (absent transport means `system`) but no repository can choose them. Connecting an account creates its identity on the spot, named after the login and qualified by provider or host when that name is already taken — one person with the same username on GitHub and GitLab gets `ada` and `ada (GitLab)`, not `ada 2`. Connecting again after disconnecting reuses the identity that already carries that person's signature on that instance rather than minting a second one (GitHub without a public address gets its own no-reply address); accounts connected earlier are backfilled once, on the first identities read after startup rather than at route registration, so a slow or locked auth store cannot delay server start. The public profile DTO contains only `id`, `name`, `userName`, `userEmail`, `account`, `transport`, `sshCredentialId`, `signCommits`, `signingKey`, `color`, and `icon`. Renderer Git summary routes expose only author name/email, and remote routes expose redacted display URLs. Raw `core.sshCommand` values and remote credentials, query parameters, and fragments remain server-internal.
 
 ### Status and Diff Operations
-- `getStatus(directory, { mode })`: Get comprehensive Git status including current branch, tracking, ahead/behind, file changes, diff stats, merge/rebase state. `mode: 'light'` skips the diff stats. One read runs per directory at a time and at most four run across directories (`serial-refresh.js`): a call made while a read is running waits for one follow-up read that starts after the call, so no caller gets a snapshot older than its request, and every caller that arrives during one read shares that single follow-up at the widest mode any of them asked for. Clients refresh after every completed agent tool call and from several surfaces at once; on a large repository (a status read is a dozen Git processes walking the working tree) this bound is what keeps identical `git status` processes from piling up side by side. A slot is held only while the read is alive: every process the read spawns is killed after two minutes without output (one minute for the untracked-directory listing, thirty seconds for the repository probe), so a Git process that hangs, which happens on Windows, fails that read instead of holding a slot until someone kills it by hand. On Windows the listing is ended with `taskkill /T`, because the spawned `git.exe` is Git for Windows' launcher and killing it alone leaves the real `git` child walking the tree as an orphan. Untracked files are listed with `-unormal` and each new directory is then expanded to its files with a bounded `ls-files` listing (`UNTRACKED_DIRECTORY_EXPANSION_LIMIT`, 1000): up to that many files the result equals `-uall`; beyond it the directory stays one `dir/` entry, because `-uall` would walk a forgotten build or dependency directory in full on every read. A nested repository stays a `dir/` entry as before.
+- `getStatus(directory, { mode })`: Get comprehensive Git status including current branch, tracking, ahead/behind, file changes, diff stats, merge/rebase state. `mode: 'light'` skips the diff stats. One read runs per directory at a time and at most four run across directories (`serial-refresh.js`): a call made while a read is running waits for one follow-up read that starts after the call, so no caller gets a snapshot older than its request, and every caller that arrives during one read shares that single follow-up at the widest mode any of them asked for. Clients refresh after every completed agent tool call and from several surfaces at once; on a large repository (a status read is a dozen Git processes walking the working tree) this bound is what keeps identical `git status` processes from piling up side by side. A slot is held only while the read is alive: every process the read spawns is killed after two minutes without output (one minute for the untracked-directory listing, thirty seconds for the repository probe), so a Git process that hangs, which happens on Windows, fails that read instead of holding a slot until someone kills it by hand. On Windows the listing is ended with `taskkill /T`, because the spawned `git.exe` is Git for Windows' launcher and killing it alone leaves the real `git` child walking the tree as an orphan. Untracked files are listed with `-unormal` and each new directory is then expanded to its files with a bounded `ls-files` listing (`UNTRACKED_DIRECTORY_EXPANSION_LIMIT`, 1000): up to that many files the result equals `-uall`; beyond it the directory stays one `dir/` entry, because `-uall` would walk a forgotten build or dependency directory in full on every read. A nested repository stays a `dir/` entry as before. A status read never writes the index (#2229): its commands run with `GIT_OPTIONAL_LOCKS=0`, and the working-tree stats come from `git diff-files -M --numstat`, because `git diff` rewrites a stale index even with that variable set. Otherwise each read holds `.git/index.lock` for as long as refreshing the index takes, and a `git commit` the user runs in a terminal at that moment fails with "index.lock: File exists". The cost is that the server never refreshes stale index timestamps itself, so after many files are touched without changes each read compares their contents until a command the user runs refreshes the index.
 - `getTrackingBranch(directory)`: Upstream of the checked-out branch as `remote/branch` (the same value as `status.tracking`, including an upstream whose remote ref is gone), or `null` when HEAD is detached or unborn or no upstream is configured. Reads refs and config only. Callers that need just the tracking name (GitHub PR status polling, PR creation) use this instead of `getStatus`.
+- `isAncestorOfHead(directory, sha)`: Check whether a commit is reachable from the checked-out `HEAD`.
+- `isPatchEquivalentOfHead(directory, sha)`: Check whether a commit has a patch-equivalent commit reachable from `HEAD`, for terminal PR history after a rebase. It runs a short bounded `git cherry` probe. Missing old objects cannot prove an association.
 - `getDiff(directory, { path, staged, contextLines })`: Get diff output for files or entire working tree with full Git blob identities. Untracked symbolic links are represented as link entries without following their targets.
 - `getPathDiff(directory, { path, staged, contextLines })`: `getDiff` for one path, returning `{ diff, submodule }`. `submodule` is `null` for ordinary paths. For a gitlink it is `{ headCommit, indexCommit, worktreeCommit, hasTrackedChanges, hasUntrackedFiles, hasConflict }`, because a submodule that only gained untracked files shows as modified in status while its patch is empty. `worktreeCommit` is `null` when the submodule is not checked out. An unmerged gitlink has no single index commit, so it reports `hasConflict: true` with `indexCommit: null`. Exposed as `GET /api/git/diff`.
 - Paths come from an earlier status listing and can stop resolving. Per-path operations reject with `error.code`: `path_not_found` when the path is absent from the working tree, index, and HEAD (for example, a file removed after the listing), `nested_repository` when the path is a directory holding its own `.git` that is not a submodule (status lists it as `dir/`), and `untracked_directory` when the path is a directory status kept as one `dir/` entry because it holds more untracked files than the expansion bound. `GET /api/git/diff` and `GET /api/git/file-diff` answer these with 404, 422 and 422 and a `{ error, code }` body instead of 500. Entry existence is read from `ls-files --stage` and `ls-tree` modes, not `cat-file -e`: a gitlink's commit is not in the parent's object store, and simple-git reports that silent exit 1 as success.
@@ -73,7 +76,7 @@ An identity is one repository's complete answer: signature, provider account (`a
 - `getRemotes(directory)`: Get list of configured remotes.
 
 ### Worktree Operations
-- `getWorktrees(directory)`: List all git worktrees for a repository. A directory outside any repository (or one that does not exist) is an authoritative empty list; any other git failure throws so callers keep their last known topology instead of clearing it. `GET /api/git/worktrees` answers such a failure with 500.
+- `getWorktrees(directory)`: List all git worktrees for a repository. A directory outside any repository (or one that does not exist) is an authoritative empty list; any other git failure throws so callers keep their last known topology instead of clearing it. `GET /api/git/worktrees` answers such a failure with 500. A bare repository has no `--show-toplevel` answer, so the listing runs from the directory itself; the bare entry git lists for the repository's own directory is not a checkout and is left out of the result.
 - `observeWorktreeTopology(directory)`: Compare the repository's registered linked-worktree set with the last one seen for it and notify `subscribeWorktreeTopologyChanges` listeners when it changed. The set is fingerprinted from the `worktrees` directory under the common Git directory (mtime plus entry names), so the check is a stat and a readdir; the common directory is resolved with `git rev-parse --git-common-dir` once per requested directory and cached. The first observation only records a baseline. Never throws.
 - `subscribeWorktreeTopologyChanges(listener)`: Listener receives `{ directories, at }`, where `directories` are every directory of that repository the server has observed, so clients can map them onto registered projects. Returns an unsubscribe function.
 - `validateWorktreeCreate(directory, input)`: Validate worktree creation parameters (mode, branchName, startRef, upstream config).
@@ -165,6 +168,15 @@ creation attempts cannot overwrite each other's rollback. If upstream fetch fail
 bootstrap, tracking is left unset rather than writing `branch.*.remote` /
 `branch.*.merge` for a ref that was never fetched. Contributor-fork creation always leaves tracking unset.
 
+The agent tool's `session.create` with `pullRequest: <number>` makes the same
+worktree without a client: `feature-routes-runtime.js` builds the change-request
+source on the server (`source-control/change-request-worktree.js`) and hands it
+to the same `worktree-creation.js` pipeline, so the remote, provenance, missing
+upstream and Publish destination chooser are the dialog's. VS Code has no
+contributor worktrees and no agent tool, so the parameter does not exist there;
+a server without the pipeline answers 501 and never falls back to a plain
+branch worktree.
+
 ### Commit and Remote Operations
 - `commit(directory, message, options)`: Create a commit from the current index. An applied identity writes the repository's own `user.name` and `user.email`, and those decide. A repository on the System identity has none on purpose — it says no override applies — so the machine's own author answers, the way Git itself resolves it, and the panel names that author before the commit. With no author anywhere the commit is refused with the two ways to set one. `options.stageFiles` may be provided with `options.files` by older callers to stage only selected unstaged rows before committing, but the shared Git panel now stages/unstages explicitly before commit.
 - `removeRemote(directory, options)`: Remove a configured remote (except `origin`).
@@ -183,7 +195,7 @@ Public snapshots contain `operationId`, `runtimeIdentity`, transport verificatio
 
 ### Exact-ref transport authority
 
-Push, fetch, pull, remote-branch deletion, and sync accept only full refs. Sources are `refs/heads/*` or `refs/tags/*`; push destinations are heads or tags, deletion destinations are heads, fetch destinations are remote refs, heads, or tags, and pull destinations are heads. Sync narrows its fetch destination to `refs/remotes/*`, names its checked-out pull destination, and requires that destination to equal the exact push source. Planning accepts authoritative HTTPS, `ssh://`, and strict SCP endpoints only. URL endpoints with userinfo, query, or fragment data fail before plan registration or Git argv construction. Planning validates the repository ID, binding and config revisions, remote, redacted endpoint fingerprint and display URL, transport mode, and opaque credential reference against source-control authority before resolving refs. Execution repeats authority validation before any subprocess or credential resolution and again immediately before each transfer Git process starts. It also compares a server-internal transport revision derived from effective system, global, local, worktree, and included Git configuration. The revision covers credential helpers and URL-scoped credential settings, SSH commands, URL rewrites, HTTP settings, and remote proxies. Values and origin paths never enter public plans or errors.
+Push, fetch, pull, remote-branch deletion, and sync accept only full refs. Sources are `refs/heads/*` or `refs/tags/*`; push destinations are heads or tags, deletion destinations are heads, fetch destinations are remote refs, heads, or tags, and pull destinations are heads. Sync narrows its fetch destination to `refs/remotes/*`, names its checked-out pull destination, and requires that destination to equal the exact push source. Planning accepts authoritative HTTPS, `ssh://`, and strict SCP endpoints only, under the same endpoint rule as Clone. An `ssh://` endpoint may name its login user; HTTPS userinfo, any password, and query or fragment data fail before plan registration or Git argv construction. The SSH user stays in the internal raw endpoint: display URLs and fingerprints drop it, and URL display endpoints with userinfo fail. Planning validates the repository ID, binding and config revisions, remote, redacted endpoint fingerprint and display URL, transport mode, and opaque credential reference against source-control authority before resolving refs. Execution repeats authority validation before any subprocess or credential resolution and again immediately before each transfer Git process starts. It also compares a server-internal transport revision derived from effective system, global, local, worktree, and included Git configuration. The revision covers credential helpers and URL-scoped credential settings, SSH commands, URL rewrites, HTTP settings, and remote proxies. Values and origin paths never enter public plans or errors.
 
 Push resolves and stores the source commit SHA while planning, rechecks it during both execution authority passes, and sends exactly `<pinned-sha>:<destination-ref>`. New-branch publication can request local upstream configuration; only after push success does the executor write the exact branch remote and merge ref, and a local configuration failure returns `partial`. An optional force lease is exactly `--force-with-lease=<destination-ref>:<expected-remote-sha>`. Remote deletion sends exactly `:<destination-ref>` and has the same uncertain-outcome rules as push. Fetch sends exactly `<source-ref>:<destination-ref>` with `--no-tags`. Pull pins the checked-out full HEAD ref and its commit SHA during planning, rechecks both before authentication, before fetch, and before merge, fetches to `refs/openchamber/network/<operationId>`, merges the fetched SHA with `--no-edit --no-verify`, then deletes the temporary ref. Remote names select authority; Git receives only the server-resolved raw endpoint.
 
@@ -247,9 +259,9 @@ The operation executor reads `.gitmodules` from the selected commit with `git co
 
 Each submodule endpoint needs an exact auxiliary grant, including same-host paths. Cross-host children never receive the parent credential. The executor resolves every credential by the child endpoint's own opaque ID, checks the discovered endpoint against the grant before credential resolution and again before spawn, and redacts raw endpoints, paths, credentials, and process errors. One child failure does not erase completed siblings. Cancellation between children prevents later children from starting. Every existing component of a submodule checkout path must be a real directory; symbolic links fail before auxiliary authorization or transfer. After authorization, the executor checks the path components again and creates missing parent directories one level at a time before it creates the child checkout. Repair accepts an already-present child only when its HEAD exactly equals the committed gitlink, then inspects it recursively without another clone. A child directory created by the current failed transfer is quarantined and removed only when its filesystem identity still matches the operation's record.
 
-LFS discovery combines effective attributes, bounded object batches, committed `.lfsconfig`, effective `lfs.url` and remote LFS URLs (Git configuration wins over `.lfsconfig`, and `lfs.url` over `remote.<name>.lfsurl`, as in Git LFS), and executable filter and transfer configuration. It queries attributes and object metadata in batches of at most 128 paths, then reads only pointer-sized blobs through `cat-file --batch`. A complete ordinary repository is not rejected merely for exceeding 256 or 1,024 files. Listing, query-output, pointer-byte, and public-result limits remain enforced. Incomplete or malformed discovery fails closed, never as `not-needed`. Custom transfer agents and non-canonical executable LFS filters fail before LFS execution. The effective HTTPS LFS endpoint gets its own exact auxiliary grant, including for an SSH Git checkout. Hydration runs explicit `git lfs fetch <selected-parent-remote> HEAD` and `git lfs checkout` under registry process ownership. A required missing client returns `GIT_LFS_CLIENT_MISSING` with `client-missing` instead of a generic clone failure.
+LFS discovery combines effective attributes, bounded object batches, committed `.lfsconfig`, effective `lfs.url` and remote LFS URLs (Git configuration wins over `.lfsconfig`, and `lfs.url` over `remote.<name>.lfsurl`, as in Git LFS), and executable filter and transfer configuration. It queries attributes and object metadata in batches of at most 1,024 paths, then reads only pointer-sized blobs through `cat-file --batch`. A complete ordinary repository is not rejected merely for exceeding 256 or 1,024 files, LFS files included: every pointer-sized blob is validated, but the scan keeps at most 256 attribute records and 256 pointer samples as evidence, so memory does not grow with the number of LFS files. `discoverLfs` therefore returns `attributePaths` and `pointers` as bounded samples; hydration reads only whether LFS is needed. Listing, query-output, and pointer-byte limits remain enforced. A checkout that exceeds one of them, such as a tracked-file listing over 16 MiB, fails hydration with `CHECKOUT_TOO_LARGE` under the `invalid` status, never as a configuration error. Submodule discovery limits keep `INVALID_REQUEST`. Incomplete or malformed discovery fails closed, never as `not-needed`. Custom transfer agents and non-canonical executable LFS filters fail before LFS execution. The effective HTTPS LFS endpoint gets its own exact auxiliary grant, including for an SSH Git checkout. Hydration runs explicit `git lfs fetch <selected-parent-remote> HEAD` and `git lfs checkout` under registry process ownership. A required missing client returns `GIT_LFS_CLIENT_MISSING` with `client-missing` instead of a generic clone failure.
 
-Local worktree hydration first inspects local content. Git-route and OpenChamber-session creation both use the server's one durable bootstrap store and always invoke this inspection, including for repositories without a source-control binding. A checkout needing neither submodule nor LFS transfer requires no parent remote; required hydration without an exact source persists path-specific authorization data rather than choosing `origin` or reporting setup ready. Its operation-private durable marker carries no fabricated repository or remote authority and cannot complete a retained-checkout repair blocker. Managed pull and sync integration use a credential-free local execution context with network protocols, lazy fetching, hooks, content filters, fsmonitor, autostash, and recursive submodule operations disabled. Required post-integration hydration uses explicit grants; failure preserves the completed local update and skips sync publication.
+Local worktree hydration first inspects local content. Git-route and OpenChamber-session creation both use the server's one durable bootstrap store and always invoke this inspection, including for repositories without a source-control binding. Both pass the repository authority from the binding read, so an unbound repository resolves its checkout remote and submodule endpoints as System grants against the store's tombstone revision, the same way it pushes and fetches. A checkout needing neither submodule nor LFS transfer requires no parent remote; required hydration without an exact source persists path-specific authorization data rather than choosing `origin` or reporting setup ready. Its operation-private durable marker carries no fabricated repository or remote authority and cannot complete a retained-checkout repair blocker. Managed pull and sync integration use a credential-free local execution context with network protocols, lazy fetching, hooks, content filters, fsmonitor, autostash, and recursive submodule operations disabled. Required post-integration hydration uses explicit grants; failure preserves the completed local update and skips sync publication.
 
 ### Managed LFS publication
 

package/server/lib/git/contributor-provenance-storage.js

@@ -1,3 +1,4 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -6,10 +7,6 @@ import { withSourceControlFileLock } from '../source-control/file-lock.js';
 
 const VERSION = 1;
 const DEFAULT_MAX_RECORDS = 512;
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 const isIdentifier = (value) => isString(value) && value.length > 0 && value.length <= 512
   && value.trim() === value && !/[\0\r\n]/.test(value);
 const exactKeys = (value, keys) => {
@@ -163,10 +160,16 @@ export function createContributorProvenanceStore({
     return enqueue(async () => {
       const [state, identities] = await Promise.all([
         readState(),
-        Promise.all(directories.map(resolveIdentity)),
+        // A listing entry whose git directory no longer resolves (a worktree
+        // deleted outside git, a bare repository root, a broken .git link)
+        // has no identity to look up. It reads as no provenance rather than
+        // failing the whole listing; action-time reads stay strict.
+        Promise.all(directories.map((directory) => resolveIdentity(directory).catch(() => null))),
       ]);
       const recordsByWorktree = new Map(state.records.map((record) => [record.worktreeId, record]));
-      return identities.map((identity) => recordForIdentity(recordsByWorktree.get(identity.worktreeId), identity));
+      return identities.map((identity) => (identity
+        ? recordForIdentity(recordsByWorktree.get(identity.worktreeId), identity)
+        : { revision: 0, provenance: null }));
     });
   };
   const compareAndSwap = (directory, expectedRevision, provenance) => {

package/server/lib/git/contributor-provenance-storage.test.js

@@ -130,4 +130,33 @@ describe('contributor provenance storage', () => {
     expect(records.every((record) => record.provenance === null)).toBe(true);
     expect(storeReads).toBe(1);
   });
+
+  it('reads an unresolvable listed worktree as no provenance instead of failing the batch', async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), 'openchamber-contributor-batch-'));
+    roots.push(root);
+    const gitDirectory = path.join(root, 'one');
+    await fs.mkdir(gitDirectory);
+    const store = createContributorProvenanceStore({
+      filePath: path.join(root, 'provenance.json'),
+      resolveRepositoryIdentity: async (directory) => (directory === '/gone'
+        ? { supported: false }
+        : { supported: true, repositoryId: 'repo_one' }),
+      resolveGitPaths: async (directory) => (directory === '/gone'
+        ? { supported: false, reason: 'not-a-git-repository' }
+        : { supported: true, bare: false, gitDirectory }),
+    });
+
+    // A worktree deleted outside git (or a bare repository root) has no
+    // identity to look up; the rest of the listing still answers.
+    const records = await store.readMany(['/one', '/gone']);
+    expect(records).toHaveLength(2);
+    expect(records[0].provenance).toBe(null);
+    expect(records[1]).toEqual({ revision: 0, provenance: null });
+
+    // Store corruption stays a hard failure.
+    await fs.writeFile(path.join(root, 'provenance.json'), '{"version":1,"records":"bad"}', { mode: 0o600 });
+    await expect(store.readMany(['/one', '/gone'])).rejects.toMatchObject({
+      code: 'CONTRIBUTOR_PROVENANCE_STORE_INVALID',
+    });
+  });
 });

package/server/lib/git/credential-broker.js

@@ -1,3 +1,4 @@
+import { isString } from '../shared/guards.js';
 import crypto from 'node:crypto';
 import http from 'node:http';
 import path from 'node:path';
@@ -11,7 +12,6 @@ const MAX_BODY_BYTES = 64 * 1024;
 const HELPER_PATH = fileURLToPath(new URL('./credential-helper.js', import.meta.url));
 /** Where the helper finds its lease nonce; set on the Git process, inherited by the helper. */
 export const GIT_CREDENTIAL_NONCE_ENV = 'OPENCHAMBER_GIT_CREDENTIAL_NONCE';
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 
 /**
  * Git's credential wire format: `key=value` lines, one per attribute. Exported

package/server/lib/git/credential-resolver.js

@@ -1,3 +1,4 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
@@ -10,10 +11,6 @@ const VERSIONED_REFERENCE_PREFIX = 'ocgit:v2';
 const DEFAULT_PORTS = Object.freeze({ http: 80, https: 443, ssh: 22 });
 const MAX_SSH_PRIVATE_KEY_BYTES = 128 * 1024;
 const SSH_PRIVATE_KEY_MARKER = /-----BEGIN (?:OPENSSH |RSA |DSA |EC |ENCRYPTED )?PRIVATE KEY-----/;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
 
 const requiredString = (value, name) => {
   if (!isString(value) || !value || value.trim() !== value || /[\0\r\n]/.test(value)) {

package/server/lib/git/credentials.js

@@ -307,3 +307,4 @@ export function createManagedSshInventory({
     },
   });
 }
+

package/server/lib/git/discovery-endpoint.js

@@ -1,8 +1,8 @@
+import { isString } from '../shared/guards.js';
 import path from 'node:path';
 
 const CONTROL_PATTERN = /[\0-\x20\x7f]/;
 const SCP_PATTERN = /^(?:([^@/:\s]+)@)?([A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?):([^\\]+)$/;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 
 const discoveryError = (message) => Object.assign(new Error(message), {
   code: 'INVALID_GIT_DISCOVERY_ENDPOINT',

package/server/lib/git/identity-provisioning.js

@@ -1,4 +1,5 @@
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
+import { isString } from '../shared/guards.js';
+
 const text = (value) => (isString(value) ? value.trim() : '');
 
 const sameAccount = (left, right) => Boolean(left) && Boolean(right)

package/server/lib/git/identity-storage.js

@@ -1,3 +1,4 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
@@ -6,10 +7,6 @@ import { withSourceControlFileLockSync } from '../source-control/file-lock.js';
 
 const FILE_NAME = 'git-identities.json';
 const legacyDataDir = () => path.join(os.homedir(), '.config', 'openchamber');
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 const invalidStore = (cause) => Object.assign(new Error('Git identity profile store is invalid', { cause }), {
   code: 'GIT_IDENTITY_STORE_INVALID',
 });
@@ -270,4 +267,6 @@ export const getProfiles = () => defaultStore().getProfiles();
 export const getProfile = (id) => defaultStore().getProfile(id);
 export const createProfile = (profileData) => defaultStore().createProfile(profileData);
 export const updateProfile = (id, updates) => defaultStore().updateProfile(id, updates);
+
+/** @public Read by Git routes through the lazy-loaded Git library. */
 export const deleteProfile = (id) => defaultStore().deleteProfile(id);

package/server/lib/git/lfs-discovery.js

@@ -1,3 +1,4 @@
+import { isString } from '../shared/guards.js';
 import { normalizeDiscoveryEndpoint, resolveGitRelativeEndpoint } from './discovery-endpoint.js';
 
 export const LFS_DISCOVERY_LIMITS = Object.freeze({
@@ -25,7 +26,6 @@ const SAFE_FILTERS = Object.freeze({
   'filter.lfs.smudge': 'git-lfs smudge -- %f',
   'filter.lfs.process': 'git-lfs filter-process',
 });
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 
 const lfsError = (message, code = 'INVALID_LFS_DISCOVERY_INPUT') => Object.assign(new Error(message), { code });
 
@@ -80,9 +80,6 @@ const parseAttributes = (value, limits) => {
     if (fields[index + 2] === 'lfs' && !seen.has(filePath)) {
       seen.add(filePath);
       paths.push(filePath);
-      if (paths.length > limits.maxPublicRecords) {
-        throw lfsError('LFS attribute records exceed their public record limit', 'LFS_DISCOVERY_LIMIT_EXCEEDED');
-      }
     }
   }
   return paths;
@@ -144,6 +141,14 @@ export function parseTreeObjects(treeOutput) {
   return entries;
 }
 
+/**
+ * Every tracked file is checked, and every pointer-sized blob that claims to be
+ * an LFS pointer is validated. The result keeps only bounded evidence: up to
+ * `maxPublicRecords` attribute records and `maxPointerSamples` pointer samples.
+ * Hydration needs to know whether LFS is in use, not an inventory, so a
+ * repository with thousands of LFS files is scanned in the same memory as one
+ * with a handful.
+ */
 export async function scanLfsFiles(filesOutput, query, gitlinkPaths = [], treeObjects = null) {
   const limits = LFS_DISCOVERY_LIMITS;
   const text = boundedText(filesOutput, limits.maxFilesBytes, 'Tracked files output');
@@ -176,15 +181,11 @@ export async function scanLfsFiles(filesOutput, query, gitlinkPaths = [], treeOb
     }
     for (const file of selected) {
       const record = `${file}\0filter\0lfs\0`;
-      attributesBytes += Buffer.byteLength(record);
-      if (attributesBytes > limits.maxAttributesBytes) {
-        throw lfsError('LFS attribute records exceed their byte limit', 'LFS_DISCOVERY_LIMIT_EXCEEDED');
-      }
+      const recordBytes = Buffer.byteLength(record);
+      if (attributes.length >= limits.maxPublicRecords || attributesBytes + recordBytes > limits.maxAttributesBytes) break;
+      attributesBytes += recordBytes;
       attributes.push(record);
     }
-    if (attributes.length > limits.maxPublicRecords) {
-      throw lfsError('LFS attribute records exceed their public record limit', 'LFS_DISCOVERY_LIMIT_EXCEEDED');
-    }
 
     // Query sizes without reading blobs. Only pointer-sized blobs enter the
     // bounded content query; Git LFS pointers fit within 1 KiB.
@@ -219,9 +220,8 @@ export async function scanLfsFiles(filesOutput, query, gitlinkPaths = [], treeOb
     for (const { candidate, content } of await readSmallBlobs(query, candidates, limits, 'Git object')) {
       if (content.subarray(0, prefix.length).equals(prefix)) {
         parseLfsPointer(content);
-        pointerSamples.push({ path: candidate.path, content: Buffer.from(content) });
-        if (pointerSamples.length > limits.maxPointerSamples) {
-          throw lfsError('LFS pointers exceed their record limit', 'LFS_DISCOVERY_LIMIT_EXCEEDED');
+        if (pointerSamples.length < limits.maxPointerSamples) {
+          pointerSamples.push({ path: candidate.path, content: Buffer.from(content) });
         }
       }
     }

package/server/lib/git/lfs-discovery.test.js

@@ -190,12 +190,22 @@ describe('incremental LFS file discovery', () => {
     await expect(fixture.run()).rejects.toThrow();
   });
 
-  it('keeps pointer and attribute public limits across batches', async () => {
-    for (const attributes of [false, true]) {
-      const fixture = scanFixture(Array.from({ length: 257 }, (_, index) => ({ path: `file-${index}`, content: attributes ? 'ordinary' : pointer() })),
-        { attribute: () => attributes ? 'lfs' : 'unspecified' });
-      await expect(fixture.run()).rejects.toMatchObject({ code: 'LFS_DISCOVERY_LIMIT_EXCEEDED' });
-    }
+  it.each([257, 3_000])('accepts %i LFS files with long paths and keeps bounded evidence', async (count) => {
+    const directory = `assets/${'deeply-nested-directory/'.repeat(8)}`;
+    const files = Array.from({ length: count }, (_, index) => ({ path: `${directory}file-${index}.bin`, content: pointer() }));
+    const fixture = scanFixture(files, { attribute: () => 'lfs' });
+    const scan = await fixture.run();
+    expect(scan.pointerSamples).toHaveLength(LFS_DISCOVERY_LIMITS.maxPointerSamples);
+    expect(Buffer.byteLength(scan.attributesOutput)).toBeLessThanOrEqual(LFS_DISCOVERY_LIMITS.maxAttributesBytes);
+    const result = discoverLfs(input(scan));
+    expect(result.needed).toBe(true);
+    expect(result.attributePaths).toHaveLength(LFS_DISCOVERY_LIMITS.maxPublicRecords);
+  });
+
+  it('validates every pointer, including those past the kept samples', async () => {
+    const files = Array.from({ length: 1_500 }, (_, index) => ({ path: `file-${index}`, content: pointer() }));
+    files.push({ path: 'late-broken', content: pointer().replace('size 42', 'size forty-two') });
+    await expect(scanFixture(files).run()).rejects.toMatchObject({ code: 'INVALID_LFS_DISCOVERY_INPUT' });
   });
 
   it('does not query unsafe or incomplete paths and enforces the listing byte bound', async () => {

package/server/lib/git/network-operation-plan.js

@@ -1,3 +1,4 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -8,10 +9,6 @@ import { createHttpsCredentialReference, normalizeGitRemoteEndpoint } from './cr
 const OPERATIONS = ['push', 'fetch', 'pull', 'delete-remote-branch', 'sync', 'clone', 'checkout-hydration'];
 const SHA_PATTERN = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i;
 const REF_COMPONENT_PATTERN = /^(?!\.)(?!.*(?:\.\.|\/\.|\.lock(?:\/|$)))(?!.*[~^:?*[\\\s])(?!.*\/$)(?!.*\/\/)[^\0-\x20\x7f]+$/;
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 const isBoolean = (value) => Object.prototype.toString.call(value) === '[object Boolean]'
   && (value === true || value === false);
 const hasExactKeys = (value, required, optional = []) => {
@@ -39,13 +36,24 @@ const requiredString = (value, name) => {
   if (result.startsWith('-') || /[\0\r\n]/.test(result)) throw planError(`${name} is invalid`);
   return result;
 };
+// A server-generated digest the client echoes back (configRevision, endpoint
+// fingerprint, transportRevision): an opaque sha256/base64url value, never a CLI
+// argument. Base64url may legitimately start with '-', so the leading-dash
+// injection guard in `requiredString` must not apply; only real control
+// characters are rejected.
+const parseDigest = (value, name) => {
+  if (!isString(value) || !value.trim()) throw planError(`${name} is required`);
+  const result = value.trim();
+  if (/[\0\r\n]/.test(result)) throw planError(`${name} is invalid`);
+  return result;
+};
 const parseSha = (value, name) => {
   const sha = requiredString(value, name);
   if (!SHA_PATTERN.test(sha)) throw planError(`${name} is invalid`);
   return sha.toLowerCase();
 };
 const parseFingerprint = (value, name) => {
-  const fingerprint = requiredString(value, name);
+  const fingerprint = parseDigest(value, name);
   if (!/^[A-Za-z0-9_-]{43}$/.test(fingerprint)) throw planError(`${name} is invalid`);
   return fingerprint;
 };
@@ -60,7 +68,7 @@ const parseRemote = (value) => {
     name: requiredString(value.name, 'remote name'),
     endpoint: {
       displayUrl: requiredString(value.endpoint.displayUrl, 'remote displayUrl'),
-      fingerprint: requiredString(value.endpoint.fingerprint, 'remote fingerprint'),
+      fingerprint: parseDigest(value.endpoint.fingerprint, 'remote fingerprint'),
     },
   };
 };
@@ -79,7 +87,7 @@ const parseHydrationRequirements = (value) => {
       || !hasExactKeys(entry.endpoint, ['displayUrl', 'fingerprint'])) {
       throw planError('checkout hydration requirement is invalid');
     }
-    assertSafeExistingEndpoint(entry.endpoint.displayUrl);
+    assertSafeDisplayEndpoint(entry.endpoint.displayUrl);
     return {
       kind: entry.kind,
       path: parseCheckoutPath(entry.path),
@@ -158,7 +166,7 @@ const parseAuxiliaryGrants = (value) => {
       throw planError('auxiliary grant is invalid');
     }
     const transportMode = parseTransportMode(grant.transportMode);
-    assertSafeExistingEndpoint(grant.endpoint.displayUrl);
+    assertSafeDisplayEndpoint(grant.endpoint.displayUrl);
     const parsed = {
       kind: grant.kind,
       endpoint: {
@@ -184,33 +192,41 @@ const parseAuxiliaryGrants = (value) => {
   if (new Set(keys).size !== keys.length) throw planError('auxiliary grants must be unique');
   return grants;
 };
-const assertSafeExistingEndpoint = (endpoint) => {
-  const value = requiredString(endpoint, 'Git endpoint');
-  if (value.length > 4096) throw planError('Git endpoint is invalid');
+/**
+ * Whether Git may receive this endpoint: HTTPS, `ssh://`, or strict SCP.
+ * An SSH URL may name its login user, as SCP does; HTTPS userinfo and any
+ * password are credentials and never pass. Clone and every existing-remote
+ * transfer share this rule.
+ */
+const isSafeTransferEndpoint = (value) => {
+  if (value.length > 4096) return false;
   if (!value.includes('://')) {
     const match = value.match(/^(?:[A-Za-z0-9._-]+@)?[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?:([^\s:\\]+)$/);
-    if (!match || /[?#]/.test(value) || match[1].startsWith('-')
-      || match[1].split('/').some((part) => !part || part === '.' || part === '..')) {
-      throw planError('Git endpoint is invalid');
-    }
-    return;
+    return Boolean(match) && !/[?#]/.test(value) && !match[1].startsWith('-')
+      && match[1].split('/').every((part) => part && part !== '.' && part !== '..');
   }
   let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    throw planError('Git endpoint is invalid');
-  }
   let pathname;
   try {
+    parsed = new URL(value);
     pathname = decodeURIComponent(parsed.pathname);
   } catch {
-    throw planError('Git endpoint is invalid');
+    return false;
   }
-  if (!['https:', 'ssh:'].includes(parsed.protocol) || parsed.username || parsed.password
-    || parsed.search || parsed.hash || !parsed.hostname || !parsed.pathname || parsed.pathname === '/'
-    || /[\0-\x20\x7f\\]/.test(pathname)
-    || pathname.split('/').slice(1).some((part) => !part || part === '.' || part === '..')) {
+  return ['https:', 'ssh:'].includes(parsed.protocol)
+    && (!parsed.username || (parsed.protocol === 'ssh:' && /^[A-Za-z0-9._][A-Za-z0-9._-]*$/.test(parsed.username)))
+    && !parsed.password && !parsed.search && !parsed.hash
+    && Boolean(parsed.hostname) && Boolean(parsed.pathname) && parsed.pathname !== '/'
+    && !/[\0-\x20\x7f\\]/.test(pathname)
+    && pathname.split('/').slice(1).every((part) => part && part !== '.' && part !== '..');
+};
+const assertSafeExistingEndpoint = (endpoint) => {
+  if (!isSafeTransferEndpoint(requiredString(endpoint, 'Git endpoint'))) throw planError('Git endpoint is invalid');
+};
+// Display URLs are redacted, so a URL-form display never carries userinfo.
+const assertSafeDisplayEndpoint = (endpoint) => {
+  const value = requiredString(endpoint, 'Git endpoint');
+  if (!isSafeTransferEndpoint(value) || (value.includes('://') && new URL(value).username)) {
     throw planError('Git endpoint is invalid');
   }
 };
@@ -235,35 +251,7 @@ const parseRemoteFetchMapping = (remoteName, output) => {
 };
 const parseCloneEndpoint = (value) => {
   const endpoint = requiredString(value, 'remoteUrl');
-  if (!endpoint.includes('://')
-    && /^(?:[A-Za-z0-9._-]+@)?[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?:[^\s:\\]+$/.test(endpoint)) {
-    const separator = endpoint.indexOf(':');
-    const repositoryPath = endpoint.slice(separator + 1);
-    if (/[?#]/.test(endpoint) || repositoryPath.startsWith('-')
-      || repositoryPath.split('/').some((part) => !part || part === '.' || part === '..')) {
-      throw planError('remoteUrl is invalid');
-    }
-    return endpoint;
-  }
-  let parsed;
-  try {
-    parsed = new URL(endpoint);
-  } catch {
-    throw planError('remoteUrl is invalid');
-  }
-  let pathname;
-  try {
-    pathname = decodeURIComponent(parsed.pathname);
-  } catch {
-    throw planError('remoteUrl is invalid');
-  }
-  if (!['https:', 'ssh:'].includes(parsed.protocol) || parsed.password || parsed.search || parsed.hash
-    || !parsed.hostname || !parsed.pathname || parsed.pathname === '/'
-    || (parsed.protocol === 'https:' && parsed.username)
-    || /[\0-\x20\x7f\\]/.test(pathname)
-    || pathname.split('/').slice(1).some((part) => !part || part === '.' || part === '..')) {
-    throw planError('remoteUrl is invalid');
-  }
+  if (!isSafeTransferEndpoint(endpoint)) throw planError('remoteUrl is invalid');
   return endpoint;
 };
 /**
@@ -376,7 +364,7 @@ export function createNetworkOperationPlanner({
       throw contributorError('DESTINATION_SELECTION_REQUIRED', 'Contributor push destination selection is required');
     }
     const repositoryId = requiredString(input.repositoryId, 'repositoryId');
-    const configRevision = requiredString(input.configRevision, 'configRevision');
+    const configRevision = parseDigest(input.configRevision, 'configRevision');
     if (!Number.isSafeInteger(input.bindingRevision) || input.bindingRevision < 0) {
       throw planError('bindingRevision is required');
     }
@@ -425,7 +413,7 @@ export function createNetworkOperationPlanner({
     const fetchAuthority = await validateGitTransportContext(authorityInput(fetchRemote, 'fetch'));
     const pushAuthority = await validateGitTransportContext(authorityInput(pushRemote, 'push'));
     const validateAuthority = (authority, remote, transportMode) => {
-      const transportRevision = requiredString(authority.transportRevision, 'transportRevision');
+      const transportRevision = parseDigest(authority.transportRevision, 'transportRevision');
       assertSafeExistingEndpoint(authority.endpoint);
       if (transportMode === 'anonymous' && (authority.credentialId !== undefined
         || normalizeGitRemoteEndpoint(authority.endpoint).protocol !== 'https')) {
@@ -531,7 +519,7 @@ export function createNetworkOperationPlanner({
     const directory = requiredString(input.directory, 'directory');
     const contributor = await readContributor(directory);
     const repositoryId = requiredString(input.repositoryId, 'repositoryId');
-    const configRevision = requiredString(input.configRevision, 'configRevision');
+    const configRevision = parseDigest(input.configRevision, 'configRevision');
     const remote = parseRemote(input.remote);
     const sourceNamespaces = ['refs/heads/', 'refs/tags/'];
     const destinationNamespaces = operation === 'fetch'
@@ -580,7 +568,7 @@ export function createNetworkOperationPlanner({
       remote: remote.name,
       endpointKind,
     });
-    const transportRevision = requiredString(authority.transportRevision, 'transportRevision');
+    const transportRevision = parseDigest(authority.transportRevision, 'transportRevision');
     assertSafeExistingEndpoint(authority.endpoint);
     if (transportMode === 'anonymous' && (authority.credentialId !== undefined
       || normalizeGitRemoteEndpoint(authority.endpoint).protocol !== 'https')) {
@@ -783,7 +771,7 @@ export function createNetworkOperationPlanner({
     }
     const directory = requiredString(input.directory, 'directory');
     const repositoryId = requiredString(input.repositoryId, 'repositoryId');
-    const configRevision = requiredString(input.configRevision, 'configRevision');
+    const configRevision = parseDigest(input.configRevision, 'configRevision');
     if (!Number.isSafeInteger(input.bindingRevision) || input.bindingRevision < 0) {
       throw planError('bindingRevision is required');
     }
@@ -831,7 +819,7 @@ export function createNetworkOperationPlanner({
       directory,
       endpointKind: 'fetch',
       transportMode: authority.transportMode,
-      transportRevision: requiredString(authority.transportRevision, 'transportRevision'),
+      transportRevision: parseDigest(authority.transportRevision, 'transportRevision'),
       expectedHeadSha,
       plannedRequirements: requirements,
       plannedTransfers,
@@ -889,7 +877,7 @@ export function createNetworkOperationPlanner({
       directory,
       repositoryId: requiredString(input.repositoryId, 'repositoryId'),
       bindingRevision: input.bindingRevision,
-      configRevision: requiredString(input.configRevision, 'configRevision'),
+      configRevision: parseDigest(input.configRevision, 'configRevision'),
       remote: remote.name,
       endpointKind: 'push',
     });