@vantran-se/openchamber-web 2.1.1 → 2.2.0

package/server/lib/git/network-operation-plan.test.js

@@ -313,6 +313,29 @@ describe('Git network operation planner', () => {
     expect(JSON.stringify(plans.publicPlan)).not.toContain('credential_one');
   });
 
+  it('plans clone and checkout hydration transfers to ssh:// endpoints that name their user', async () => {
+    const endpoint = 'ssh://git@modules.example/library.git';
+    const publicEndpoint = { displayUrl: 'ssh://modules.example/library.git', fingerprint: fingerprintRemoteUrl(endpoint) };
+    const clone = await makePlanner().planNetworkOperation({
+      operation: 'clone', remoteUrl: endpoint, destinationPath: '/new/repo', transportMode: 'system', unverifiedConfirmed: true,
+    });
+    expect(clone.internalPlan.rawEndpoint).toBe(endpoint);
+    expect(clone.publicPlan.target.remote).toEqual(publicEndpoint);
+
+    const plans = await makePlanner({ inspectCheckoutHydration: async () => ({
+      headSha: SHA,
+      requirements: [{ kind: 'submodule', path: 'vendor/library', endpoint: publicEndpoint }],
+      transfers: [{ kind: 'submodule', path: 'vendor/library', endpoint: publicEndpoint, rawEndpoint: endpoint }],
+    }) }).planNetworkOperation({
+      operation: 'checkout-hydration', directory: '/repository', repositoryId: 'repo_one',
+      bindingRevision: 4, configRevision: 'config_one', remote: existingInput('fetch').remote,
+    });
+    expect(plans.internalPlan.plannedTransfers).toEqual([{
+      kind: 'submodule', path: 'vendor/library', endpoint: publicEndpoint, rawEndpoint: endpoint,
+    }]);
+    expect(JSON.stringify(plans.publicPlan)).not.toContain('git@');
+  });
+
   it('rejects stale checkout hydration source before inspection and rejects absolute discovered paths', async () => {
     const inspectCheckoutHydration = vi.fn(async () => ({ headSha: SHA, requirements: [], transfers: [] }));
     const input = {
@@ -479,7 +502,9 @@ describe('Git network operation planner', () => {
     'https://user@example.com/repo.git',
     'https://example.com/repo.git?access_token=secret',
     'https://example.com/repo.git#private',
-    'ssh://git@example.com/owner/repo.git',
+    'ssh://git:secret@example.com/owner/repo.git',
+    'ssh://:secret@example.com/owner/repo.git',
+    'ssh://-oProxyCommand=touch@example.com/owner/repo.git',
     'ssh://example.com/owner/repo.git?key=secret',
     'git@example.com:owner/repo.git?key=secret',
     'git@example.com:owner/repo.git#private',
@@ -506,6 +531,46 @@ describe('Git network operation planner', () => {
     await expect(planner.planNetworkOperation(input)).resolves.toHaveProperty('publicPlan.target.remote.endpoint.displayUrl', endpoint);
   });
 
+  it('plans every existing-remote operation for an ssh:// endpoint that names its user, keeping the user out of public data', async () => {
+    const endpoint = 'ssh://git@example.com/owner/repo.git';
+    const displayUrl = 'ssh://example.com/owner/repo.git';
+    const endpointAuthority = { ...authority, endpoint, endpointFingerprint: fingerprintRemoteUrl(endpoint) };
+    expect(endpointAuthority.endpointFingerprint).toBe(fingerprintRemoteUrl(displayUrl));
+    const remote = (name) => ({ name, endpoint: { displayUrl, fingerprint: endpointAuthority.endpointFingerprint } });
+    const deletion = existingInput('delete-remote-branch', { remote: remote('upstream') });
+    delete deletion.sourceRef;
+    const inputs = [
+      existingInput('fetch', { remote: remote('upstream') }),
+      existingInput('pull', { remote: remote('upstream') }),
+      existingInput('push', { remote: remote('upstream') }),
+      deletion,
+      syncInput({
+        fetch: { ...syncInput().fetch, remote: remote('upstream') },
+        push: { ...syncInput().push, remote: remote('origin') },
+      }),
+    ];
+    for (const input of inputs) {
+      const plans = await makePlanner({ validateGitTransportContext: async () => endpointAuthority }).planNetworkOperation(input);
+      expect(JSON.stringify(plans.publicPlan)).not.toContain('git@');
+      const rawEndpoints = input.operation === 'sync'
+        ? [plans.internalPlan.fetch.rawEndpoint, plans.internalPlan.push.rawEndpoint]
+        : [plans.internalPlan.rawEndpoint];
+      expect(rawEndpoints).toEqual(rawEndpoints.map(() => endpoint));
+    }
+  });
+
+  it('rejects a URL display endpoint that carries userinfo', async () => {
+    const endpoint = 'ssh://git@modules.example/child.git';
+    await expect(makePlanner().planNetworkOperation({
+      operation: 'clone', remoteUrl: authority.endpoint, destinationPath: '/new/repo',
+      transportMode: 'system', unverifiedConfirmed: true,
+      auxiliaryGrants: [{
+        kind: 'submodule', endpoint: { displayUrl: endpoint, fingerprint: fingerprintRemoteUrl(endpoint) },
+        transportMode: 'system', unverifiedConfirmed: true,
+      }],
+    })).rejects.toThrow('Git endpoint is invalid');
+  });
+
   it.each([
     'http://example.com/repo.git',
     'file:///tmp/repo',
@@ -514,6 +579,8 @@ describe('Git network operation planner', () => {
     'ext::command repo',
     'custom://example.com/repo',
     'https://user:secret@example.com/repo.git',
+    'https://user@example.com/repo.git',
+    'ssh://git:secret@example.com/owner/repo.git',
     'https://example.com/repo.git?token=secret',
     'git@example.com:../repo',
   ])('rejects unsafe clone endpoint %s', async (remoteUrl) => {
@@ -590,6 +657,41 @@ describe('Git network operation planner', () => {
       .rejects.toMatchObject({ code: 'GIT_NETWORK_OPERATION_AUTHORITY_CHANGED', status: 409 });
   });
 
+  // A sha256/base64url digest can legitimately start with '-' (~1 in 64). These
+  // are opaque values the server generated and the client echoes back, never CLI
+  // arguments, so the leading-dash injection guard must not reject them.
+  const DASH_DIGEST = '-GtzS0gxC9C70rmAQhz4wNDSF-h_ePs0Ztxk1GUtHns';
+
+  it('accepts a configRevision that begins with a dash', async () => {
+    const plans = await makePlanner().planNetworkOperation(existingInput('fetch', {
+      configRevision: DASH_DIGEST,
+    }));
+    expect(plans.publicPlan.target.configRevision).toBe(DASH_DIGEST);
+  });
+
+  it('accepts endpoint and transport digests that begin with a dash', async () => {
+    const endpoint = 'https://example.com/owner/repository.git';
+    const planner = makePlanner({
+      validateGitTransportContext: vi.fn(async () => ({
+        ...authority,
+        endpoint,
+        endpointFingerprint: DASH_DIGEST,
+        transportRevision: DASH_DIGEST,
+      })),
+    });
+    const plans = await planner.planNetworkOperation(existingInput('fetch', {
+      remote: { name: 'upstream', endpoint: { displayUrl: endpoint, fingerprint: DASH_DIGEST } },
+    }));
+    expect(plans.publicPlan.target.remote.endpoint.fingerprint).toBe(DASH_DIGEST);
+    expect(plans.internalPlan.transportRevision).toBe(DASH_DIGEST);
+  });
+
+  it('still rejects a digest carrying control characters', async () => {
+    await expect(makePlanner().planNetworkOperation(existingInput('fetch', {
+      configRevision: 'cfg\nbad',
+    }))).rejects.toMatchObject({ code: 'INVALID_GIT_NETWORK_OPERATION' });
+  });
+
   it('plans clone into a deterministic operation-owned sibling', async () => {
     const stat = vi.fn(async () => { const error = new Error('missing'); error.code = 'ENOENT'; throw error; });
     const plans = await makePlanner({ fsImpl: { stat } }).planNetworkOperation({

package/server/lib/git/network-operation-registry.js

@@ -1,3 +1,5 @@
+import { isPlainObject, isString } from '../shared/guards.js';
+
 const DEFAULT_MAX_ENTRIES = 256;
 const DEFAULT_TERMINAL_RETENTION_MS = 60 * 60 * 1000;
 const DEFAULT_PLANNED_RETENTION_MS = 15 * 60 * 1000;
@@ -11,11 +13,11 @@ const ERROR_CODES = new Set([
   'INVALID_REQUEST', 'NOT_FOUND', 'STALE_REPOSITORY', 'STALE_BINDING', 'STALE_CONFIG',
   'REMOTE_CHANGED', 'AUTHENTICATION_REQUIRED', 'AUTHENTICATION_FAILED', 'TRANSPORT_FAILED',
   'CONFLICT', 'CANCELLED', 'TIMEOUT', 'OUTCOME_UNKNOWN', 'RUNTIME_UNSUPPORTED', 'UNKNOWN',
-  'GIT_LFS_CLIENT_MISSING',
+  'GIT_LFS_CLIENT_MISSING', 'CHECKOUT_TOO_LARGE',
 ]);
 const FAILURE_ERROR_CODES = new Set([
   'INVALID_REQUEST', 'AUTHENTICATION_REQUIRED', 'AUTHENTICATION_FAILED', 'TRANSPORT_FAILED',
-  'RUNTIME_UNSUPPORTED', 'GIT_LFS_CLIENT_MISSING', 'UNKNOWN',
+  'RUNTIME_UNSUPPORTED', 'GIT_LFS_CLIENT_MISSING', 'CHECKOUT_TOO_LARGE', 'UNKNOWN',
 ]);
 const STATE_ERROR_CODES = Object.freeze({
   partial: FAILURE_ERROR_CODES,
@@ -74,10 +76,6 @@ const isValidHydration = (value) => isPlainObject(value)
   && value.lfs.length <= 256
   && value.lfs.every((entry) => isHydrationPart(entry, true))
   && expectedHydrationStatus([...value.submodules, ...value.lfs]) === value.status;
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 const isBoundedString = (value, max) => isString(value) && value.trim() === value
   && value.length > 0 && value.length <= max && !/[\0\r\n]/.test(value);
 const isSafeDisplayEndpoint = (value) => {

package/server/lib/git/network-operation-storage.js

@@ -1,3 +1,4 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -20,11 +21,11 @@ const ERROR_CODES = new Set([
   'INVALID_REQUEST', 'NOT_FOUND', 'STALE_REPOSITORY', 'STALE_BINDING', 'STALE_CONFIG',
   'REMOTE_CHANGED', 'AUTHENTICATION_REQUIRED', 'AUTHENTICATION_FAILED', 'TRANSPORT_FAILED',
   'CONFLICT', 'CANCELLED', 'TIMEOUT', 'OUTCOME_UNKNOWN', 'RUNTIME_UNSUPPORTED', 'UNKNOWN',
-  'GIT_LFS_CLIENT_MISSING',
+  'GIT_LFS_CLIENT_MISSING', 'CHECKOUT_TOO_LARGE',
 ]);
 const FAILURE_ERROR_CODES = new Set([
   'INVALID_REQUEST', 'AUTHENTICATION_REQUIRED', 'AUTHENTICATION_FAILED', 'TRANSPORT_FAILED',
-  'RUNTIME_UNSUPPORTED', 'GIT_LFS_CLIENT_MISSING', 'UNKNOWN',
+  'RUNTIME_UNSUPPORTED', 'GIT_LFS_CLIENT_MISSING', 'CHECKOUT_TOO_LARGE', 'UNKNOWN',
 ]);
 const STATE_ERROR_CODES = Object.freeze({
   partial: FAILURE_ERROR_CODES,
@@ -54,12 +55,9 @@ const SAFE_ERROR_MESSAGES = Object.freeze({
   RUNTIME_UNSUPPORTED: 'Git operation is unsupported by this runtime',
   UNKNOWN: 'Git operation failed; inspect repository state before retrying',
   GIT_LFS_CLIENT_MISSING: 'Git LFS is required but unavailable',
+  CHECKOUT_TOO_LARGE: 'Checkout has too many files to inspect',
 });
 
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 const exactKeys = (value, required, optional = []) => {
   const keys = Object.keys(value);
   return required.every((key) => keys.includes(key))

package/server/lib/git/network-operations.js

@@ -1,3 +1,4 @@
+import { isString } from '../shared/guards.js';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
@@ -41,7 +42,6 @@ const MANAGED_ENV_NAMES = new Set([
   'NO_PROXY', 'http_proxy', 'https_proxy', 'all_proxy', 'no_proxy', 'NETRC',
 ]);
 const SHA_PATTERN = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/i;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 
 const operationError = (code, message, status = 500, details = {}) => Object.assign(new Error(message), { code, status, ...details });
 const publicError = (code, message) => ({ code, message });
@@ -796,6 +796,12 @@ export function createNetworkOperations({
     if (error?.code === 'GIT_AUXILIARY_AUTHORIZATION_REQUIRED') {
       return { status: 'authorization-required', error: publicError('AUTHENTICATION_REQUIRED', 'This checkout endpoint requires an explicit credential grant') };
     }
+    // An LFS discovery bound trips on the number of tracked files. It gets its
+    // own code so the message names that; the configuration message sent
+    // people to fix settings that were fine.
+    if (error?.code === 'LFS_DISCOVERY_LIMIT_EXCEEDED') {
+      return { status: 'invalid', error: publicError('CHECKOUT_TOO_LARGE', 'Checkout has too many files to inspect') };
+    }
     if (String(error?.code || '').includes('INVALID') || String(error?.code || '').includes('LIMIT_EXCEEDED')
       || error?.code === 'UNSAFE_LFS_EXECUTABLE_CONFIG') {
       return { status: 'invalid', error: publicError('INVALID_REQUEST', 'Checkout hydration configuration is invalid') };
@@ -1979,8 +1985,9 @@ export function createNetworkOperations({
               await controls.markStepCompleted('updated-local-repository');
               if (['succeeded', 'not-needed'].includes(hydration.status)) result = { state: 'succeeded', hydration };
               else {
-                const unsupported = [...hydration.submodules, ...hydration.lfs].find((entry) => entry.error?.code === 'RUNTIME_UNSUPPORTED');
-                const failure = unsupported?.error ?? (hydration.status === 'client-missing'
+                const specific = [...hydration.submodules, ...hydration.lfs]
+                  .find((entry) => ['RUNTIME_UNSUPPORTED', 'CHECKOUT_TOO_LARGE'].includes(entry.error?.code));
+                const failure = specific?.error ?? (hydration.status === 'client-missing'
                   ? publicError('GIT_LFS_CLIENT_MISSING', 'Git LFS is required for this checkout; install git-lfs and retry')
                   : hydration.status === 'authorization-required'
                     ? publicError('AUTHENTICATION_REQUIRED', 'Checkout hydration requires an explicit endpoint grant')
@@ -2099,7 +2106,8 @@ export function createNetworkOperations({
       return { state: 'failed', error: publicError('AUTHENTICATION_REQUIRED', 'Checkout hydration requires an explicit endpoint grant'), hydration };
     }
     if (hydration.status === 'invalid') {
-      return { state: 'failed', error: publicError('INVALID_REQUEST', 'Checkout hydration configuration is invalid'), hydration };
+      const tooLarge = [...hydration.submodules, ...hydration.lfs].find((entry) => entry.error?.code === 'CHECKOUT_TOO_LARGE');
+      return { state: 'failed', error: tooLarge?.error ?? publicError('INVALID_REQUEST', 'Checkout hydration configuration is invalid'), hydration };
     }
     const unsupported = [...hydration.submodules, ...hydration.lfs].find((entry) => entry.error?.code === 'RUNTIME_UNSUPPORTED');
     return { state: 'failed', error: unsupported?.error ?? publicError('TRANSPORT_FAILED', 'Checkout hydration failed'), hydration };

package/server/lib/git/network-operations.test.js

@@ -2336,17 +2336,27 @@ process.exit(safe ? 0 : 1);
     });
   });
 
-  it('returns the stable missing git-lfs result without starting an LFS transfer', async () => {
+  // Past the old 256-record ceiling too: a repository of thousands of LFS
+  // files reaches the same client check instead of a discovery failure.
+  it.each([1, 3_000])('returns the stable missing git-lfs result for %i LFS files without starting an LFS transfer', async (count) => {
     const pointer = `version https://git-lfs.github.com/spec/v1\noid sha256:${'d'.repeat(64)}\nsize 12\n`;
+    const files = Array.from({ length: count }, (_, index) => `assets/asset-${index}.bin`);
+    const batch = (child, separator) => child.stdin.read().toString().slice(0, -1).split(separator);
     const setupValue = setup({
       spawnResponder: ({ args }) => {
         const command = args.join(' ');
         if (command.includes('config --blob HEAD:.gitmodules')) return { code: 1 };
         if (command.includes('ls-tree -rz')) return { code: 0 };
-        if (command.includes('ls-files -z')) return { code: 0, stdout: 'asset.bin\0' };
-        if (command.includes('check-attr')) return { code: 0, stdout: 'asset.bin\0filter\0lfs\0' };
-        if (command.includes('cat-file --batch-check')) return { code: 0, stdout: `${SHA} blob ${Buffer.byteLength(pointer)}\n` };
-        if (command.includes('cat-file --batch')) return { code: 0, stdout: `${SHA} blob ${Buffer.byteLength(pointer)}\n${pointer}\n` };
+        if (command.includes('ls-files -z')) return { code: 0, stdout: `${files.join('\0')}\0` };
+        if (command.includes('check-attr')) return { onSpawn: ({ child }) => {
+          child.stdout.write(batch(child, '\0').map((file) => `${file}\0filter\0lfs\0`).join(''));
+        } };
+        if (command.includes('cat-file --batch-check')) return { onSpawn: ({ child }) => {
+          child.stdout.write(batch(child, '\n').map(() => `${SHA} blob ${Buffer.byteLength(pointer)}\n`).join(''));
+        } };
+        if (command.includes('cat-file --batch')) return { onSpawn: ({ child }) => {
+          child.stdout.write(batch(child, '\n').map(() => `${SHA} blob ${Buffer.byteLength(pointer)}\n${pointer}\n`).join(''));
+        } };
         if (command.includes('HEAD:.lfsconfig') || command.includes('config --includes')) return { code: 1 };
         if (command.includes('lfs version')) return { code: 1, stderr: 'git-lfs is not installed at /private/bin' };
         return { code: 0 };
@@ -2502,7 +2512,10 @@ process.exit(safe ? 0 : 1);
     plan = await operation.service.plan({ operation: 'clone', remoteUrl: ENDPOINT, destinationPath: destination, transportMode: 'system', unverifiedConfirmed: true });
     const result = await operation.service.execute(plan.operationId);
     expect(result).toMatchObject(interruption === 'overflow'
-      ? { state: 'partial', hydration: { status: 'invalid' } }
+      ? {
+        state: 'partial', error: { code: 'CHECKOUT_TOO_LARGE' },
+        hydration: { status: 'invalid', lfs: [{ status: 'invalid', error: { code: 'CHECKOUT_TOO_LARGE' } }] },
+      }
       : { state: 'cancelled', error: { code: interruption.startsWith('CANCELLED') ? 'CANCELLED' : interruption }, hydration: { status: 'cancelled' } });
     expect(metadataBatches).toBe(2);
     expect(operation.calls.filter((call) => call.args.includes('cat-file'))).toHaveLength(4);

package/server/lib/git/redaction.js

@@ -1,8 +1,9 @@
+import { isString } from '../shared/guards.js';
+
 const DEFAULT_MAX_CHARS = 8_192;
 const REDACTED = '[redacted]';
 const SENSITIVE_QUERY_KEYS = /^(?:access_token|auth|authorization|credential|key|oauth_token|password|private_token|secret|token)$/i;
 const URL_PATTERN = /[a-z][a-z0-9+.-]*:\/\/[^\s<>"']+/gi;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
 
 const stringValue = (value) => {
   if (value instanceof Error) {

package/server/lib/git/repository-credential-runtime.js

@@ -1,3 +1,4 @@
+import { isString } from '../shared/guards.js';
 import crypto from 'node:crypto';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -11,8 +12,6 @@ const MAX_QUERY_BYTES = 64 * 1024;
 const NONE = Object.freeze({ mode: 'none' });
 const SYSTEM = Object.freeze({ mode: 'system' });
 
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
-
 /** The origin a redacted remote URL points at, or null when it is not HTTPS. */
 const httpsOrigin = (displayUrl) => {
   try {
@@ -122,6 +121,7 @@ export function createGitRepositoryCredentialRuntime({
   getActivePort,
   getActiveHost = () => null,
   helperPath = HELPER_PATH,
+  helperLaunch,
   randomBytes = crypto.randomBytes,
 }) {
   if (!(readBinding instanceof Function) || !credentialResolver || !isString(dataDir)
@@ -205,7 +205,9 @@ export function createGitRepositoryCredentialRuntime({
       activeSecret = randomBytes(32).toString('base64url');
       const url = `http://${callbackHost()}:${port}/api/git/repository-credential`;
       await writePrivate(endpointFilePath, `${JSON.stringify({ version: 1, url, secret: activeSecret })}\n`, 0o600);
-      const script = `#!/bin/sh\nexec ${helperShellCommand(path.resolve(helperPath), [endpointFilePath])} "$@"\n`;
+      // No `exec`: under Electron the command starts with a variable
+      // assignment, which `exec` would take for the program to run.
+      const script = `#!/bin/sh\n${helperShellCommand(path.resolve(helperPath), [endpointFilePath], helperLaunch)} "$@"\n`;
       await writePrivate(launcherPath, script, 0o700);
     },
     registerRoutes: (app) => {

package/server/lib/git/repository-credential-runtime.test.js

@@ -64,6 +64,28 @@ describe('createGitRepositoryCredentialRuntime', () => {
     expect(runtime.helperCommand()).toBe(`!'${path.join(dataDir, 'bin', 'git-credential-openchamber')}'`);
   });
 
+  it.skipIf(process.platform === 'win32')('publishes a launcher that runs the helper as Node under Electron', async () => {
+    const dataDir = await fs.mkdtemp(path.join(os.tmpdir(), 'openchamber-repo-credential-'));
+    roots.push(dataDir);
+    const executable = path.join(dataDir, 'electron');
+    await fs.writeFile(executable, '#!/bin/sh\nprintf "%s|%s" "$ELECTRON_RUN_AS_NODE" "$*"\n', { mode: 0o700 });
+    const runtime = createGitRepositoryCredentialRuntime({
+      readBinding: async () => read(null),
+      credentialResolver: { resolve: async () => null },
+      dataDir, fsPromises: fs,
+      getActivePort: () => 4399,
+      helperPath: '/opt/openchamber/repository-credential-helper.js',
+      helperLaunch: { execPath: executable, versions: { electron: '1.0.0' } },
+    });
+    await runtime.publish();
+
+    const launcher = path.join(dataDir, 'bin', 'git-credential-openchamber');
+    const output = await new Promise((resolve, reject) => {
+      execFile(launcher, ['get'], (error, stdout) => (error ? reject(error) : resolve(stdout)));
+    });
+    expect(output).toBe(`1|/opt/openchamber/repository-credential-helper.js ${path.join(dataDir, 'git-credential-endpoint.json')} get`);
+  });
+
   it('answers the bound account credential for the repository the helper runs in', async () => {
     const { runtime, dataDir, resolved } = await setup();
     await runtime.publish();

package/server/lib/git/routes.js

@@ -1,14 +1,12 @@
+import { isPlainObject, isString } from '../shared/guards.js';
 import { OpenCode } from '@opencode/client';
 import { createGitRedactor, redactGitText } from './redaction.js';
 import { runAsUserAction } from '../environment/refresh-scope.js';
 import { redactRemoteUrl } from '../source-control/url-redaction.js';
 import { parsePublicGitIdentityProfile, toPublicGitIdentityProfile } from './identity-storage.js';
+import { WorktreeCreationError, createWorktreeCreation, hasClientContributorAuthority } from './worktree-creation.js';
 
 const NETWORK_OPERATION_ID = /^[A-Za-z0-9_-]{1,200}$/;
-const isString = (value) => Object.prototype.toString.call(value) === '[object String]';
-const isPlainObject = (value) => value === Object(value)
-  && !Array.isArray(value)
-  && Object.getPrototypeOf(value) === Object.prototype;
 const toGitIdentitySummary = (identity) => identity ? {
   userName: identity.userName ?? null,
   userEmail: identity.userEmail ?? null,
@@ -180,35 +178,15 @@ export function registerGitRoutes(app, {
       return res.status(500).json({ code: 'UNKNOWN', error: errors[input.operation] });
     }
   });
-  const hasClientContributorAuthority = (body) => body?.contributorFork !== undefined
-    || body?.changeRequestTransfer !== undefined || body?.contributorTransferComplete !== undefined
-    || (body?.changeRequestSource && body?.ensureRemoteUrl !== undefined);
-  // A change request from this repository itself is fetched onto the primary
-  // remote it already has, under that remote's own URL, so the checkout adds no
-  // second remote for the same project. Only a fork gets a remote of its own.
-  // A fork's remote is named after its owner, which the provider just said; the
-  // picker cannot always know it (GitLab lists merge requests without it).
-  const forkRemoteName = (owner) => `pr-${String(owner || '').trim().toLowerCase()
-    .replace(/[^a-z0-9._-]+/g, '-').replace(/-+/g, '-').replace(/^-+|-+$/g, '') || 'head'}`;
-  const changeRequestSourceOnRepository = async (directory, source) => {
-    if (source.classification !== 'same-repository') {
-      return source.sourceProject?.owner
-        ? Object.freeze({ ...source, requestedRemoteName: forkRemoteName(source.sourceProject.owner) })
-        : source;
-    }
-    const { getRepositoryRemoteUrls } = await getGitLibraries();
-    const primary = (await getRepositoryRemoteUrls(directory)).find((remote) => remote.name === source.context.primaryRemote);
-    if (!primary?.fetchUrl) return source;
-    return Object.freeze({ ...source, requestedRemoteName: primary.name, remoteUrl: primary.fetchUrl });
-  };
-  const worktreeInputForSource = (input, source) => ({
-    ...input,
-    changeRequestSource: undefined,
-    contributorFork: source.classification === 'contributor-fork',
-    changeRequestTransfer: true,
-    ensureRemoteName: source.requestedRemoteName,
-    ensureRemoteUrl: source.remoteUrl ?? source.endpoint,
-    expectedRevision: source.headSha,
+  const worktreeCreation = createWorktreeCreation({
+    getGitLibraries,
+    networkOperations,
+    getSourceControlBinding,
+    contributorProvenance,
+    resolveChangeRequestSource,
+    createHttpsCredentialReference,
+    resolveSourceControlAccount,
+    worktreeBootstrapStore,
   });
   const rejectLegacyNetworkOperation = async (directory, res) => {
     if (contributorProvenance?.read instanceof Function) {
@@ -1290,7 +1268,6 @@ export function registerGitRoutes(app, {
     }
   });
 
-
   app.put('/api/git/branches/rename', async (req, res) => {
     const { renameBranch } = await getGitLibraries();
     try {
@@ -1310,6 +1287,9 @@ export function registerGitRoutes(app, {
       const result = await renameBranch(directory, oldName, newName);
       res.json(result);
     } catch (error) {
+      if (error.statusCode === 409) {
+        return res.status(409).json({ error: error.message });
+      }
       console.error('Failed to rename branch:', error);
       res.status(500).json({ error: error.message || 'Failed to rename branch' });
     }
@@ -1442,8 +1422,9 @@ export function registerGitRoutes(app, {
           }
         }
       }
-      // A repository always lists at least its primary worktree; an empty
-      // list means "not a repository" and has no topology to track.
+      // An empty list means "not a repository", or a bare repository with no
+      // linked worktree yet; neither has topology to track. A worktree created
+      // from the terminal in such a repository shows up on the next list call.
       if (worktrees.length > 0) {
         void observeWorktreeTopology(directory);
       }
@@ -1475,123 +1456,33 @@ export function registerGitRoutes(app, {
       if (hasClientContributorAuthority(req.body)) {
         return res.status(400).json({ error: 'Invalid contributor worktree request', code: 'INVALID_CONTRIBUTOR_WORKTREE' });
       }
-      let input = req.body || {};
-      if (input.changeRequestSource) {
-        if (!(resolveChangeRequestSource instanceof Function)) return res.status(501).json({ error: 'Contributor worktrees are unavailable', code: 'RUNTIME_UNSUPPORTED' });
-        const source = await changeRequestSourceOnRepository(directory, await resolveChangeRequestSource(input.changeRequestSource));
-        input = worktreeInputForSource(input, source);
-      }
+      const input = await worktreeCreation.validationInput(directory, req.body || {});
       const result = await validateWorktreeCreate(directory, input);
       res.json(result);
     } catch (error) {
+      if (error instanceof WorktreeCreationError) {
+        return res.status(error.status).json({ error: error.message, code: error.code });
+      }
       console.error('Failed to validate worktree creation:', error);
       res.status(500).json({ error: error.message || 'Failed to validate worktree creation' });
     }
   });
 
   app.post('/api/git/worktrees', userAction(async (req, res) => {
-    const { createWorktree, validateWorktreeCreate } = await getGitLibraries();
-    if (typeof createWorktree !== 'function' || typeof validateWorktreeCreate !== 'function') {
-      return res.status(501).json({ error: 'Worktree creation is not available' });
-    }
     try {
       const directory = req.query.directory;
       if (!directory || typeof directory !== 'string') {
         return res.status(400).json({ error: 'directory parameter is required' });
       }
-
-      if (hasClientContributorAuthority(req.body)) {
-        return res.status(400).json({ error: 'Invalid contributor worktree request', code: 'INVALID_CONTRIBUTOR_WORKTREE' });
-      }
-      if (!(networkOperations?.hydrateBoundCheckout instanceof Function)
-        || !(worktreeBootstrapStore?.read instanceof Function)
-        || !(worktreeBootstrapStore?.write instanceof Function)) {
-        return res.status(501).json({ error: 'Worktree checkout bootstrap is not available' });
-      }
-      let input = req.body || {};
-      let source = null;
-      if (input.changeRequestSource) {
-        if (!(resolveChangeRequestSource instanceof Function)
-          || !(createHttpsCredentialReference instanceof Function)
-          || !(resolveSourceControlAccount instanceof Function)
-          || !(networkOperations?.transferContributorHead instanceof Function)) {
-          return res.status(501).json({ error: 'Contributor worktrees are unavailable', code: 'RUNTIME_UNSUPPORTED' });
-        }
-        source = await changeRequestSourceOnRepository(directory, await resolveChangeRequestSource(input.changeRequestSource));
-        const headBranch = source.headRef.slice('refs/heads/'.length);
-        const destinationRef = `refs/remotes/${source.requestedRemoteName}/${headBranch}`;
-        input = {
-          ...worktreeInputForSource(input, source),
-          existingBranch: destinationRef.slice('refs/'.length),
-          setUpstream: false,
-        };
-        const validation = await validateWorktreeCreate(directory, input);
-        if (!validation.ok && !validation.errors.every((entry) => entry.code === 'contributor_transfer_unavailable')) {
-          // The same error shape as every other refusal here, so the reason reaches the user.
-          const collision = validation.errors.find((entry) => entry.code === 'remote_name_collision');
-          return res.status(409).json(collision
-            ? { error: collision.message, code: 'CONTRIBUTOR_REMOTE_COLLISION', remoteName: input.ensureRemoteName }
-            : {
-              error: validation.errors.map((entry) => entry.message).filter(Boolean).join('\n') || 'Failed to validate worktree creation',
-              code: 'INVALID_REQUEST',
-            });
-        }
-        const account = await resolveSourceControlAccount(source.context);
-        if (account?.credentialId !== source.context.accountId || account?.status !== 'valid'
-          || !Number.isSafeInteger(account?.credentialRevision) || account.credentialRevision < 1
-          || Object.prototype.toString.call(account?.providerUserId) !== '[object String]' || !account.providerUserId) {
-          throw Object.assign(new Error('Contributor credential is unavailable'), { code: 'AUTHENTICATION_REQUIRED', status: 409 });
-        }
-        const credentialId = createHttpsCredentialReference({
-          provider: source.context.provider,
-          instance: source.context.instance,
-          credentialId: account.credentialId,
-          credentialRevision: account.credentialRevision,
-          providerUserId: account.providerUserId,
-        });
-        const transfer = await networkOperations.transferContributorHead({
-          directory,
-          sourceRequest: req.body.changeRequestSource,
-          source,
-          destinationRef,
-          credentialId,
-        });
-        if (transfer.state !== 'succeeded') {
-          const status = transfer.error?.code === 'AUTHENTICATION_REQUIRED' ? 401 : 409;
-          return res.status(status).json({ error: transfer.error?.message || 'Contributor head transfer failed', code: transfer.error?.code || 'UNKNOWN' });
-        }
-        input.contributorTransferComplete = true;
-      }
-      const bindingRead = getSourceControlBinding instanceof Function
-        ? await getSourceControlBinding(directory)
-        : null;
-      const repositoryAuthority = bindingRead?.binding ? {
-        repositoryId: bindingRead.repository.repositoryId,
-        bindingRevision: bindingRead.revision,
-        configRevision: bindingRead.repository.configRevision,
-      } : null;
-      const hydrateCheckout = ({ directory: checkoutDirectory, parentRemoteName }) => networkOperations.hydrateBoundCheckout({
-        directory: checkoutDirectory,
-        parentRemoteName,
-        parentEndpoint: source?.endpoint,
-        repositoryAuthority,
-      });
-      const created = await createWorktree(directory, input, {
-        contributorProvenance,
-        contributorSource: source,
-        hydrateCheckout,
-        bootstrapStore: worktreeBootstrapStore,
-      });
-      res.json(created);
+      res.json(await worktreeCreation.create(directory, req.body || {}));
     } catch (error) {
-      console.error('Failed to create worktree:', error);
-      if (error?.code === 'CONTRIBUTOR_REMOTE_COLLISION') {
-        return res.status(409).json({
-          error: 'Contributor remote name is already used by a different endpoint',
-          code: 'CONTRIBUTOR_REMOTE_COLLISION',
-          remoteName: error.remoteName,
-        });
+      // A refusal carries the same error shape as every other one here, so the reason reaches the user.
+      if (error instanceof WorktreeCreationError) {
+        const body = { error: error.message, code: error.code };
+        if (error.remoteName !== undefined) body.remoteName = error.remoteName;
+        return res.status(error.status).json(body);
       }
+      console.error('Failed to create worktree:', error);
       res.status(Number.isInteger(error?.status) ? error.status : 500).json({
         error: error.message || 'Failed to create worktree',
         code: error?.code,
@@ -1835,4 +1726,7 @@ export function registerGitRoutes(app, {
     }
   });
 
+  // The session service creates worktrees from change requests through the
+  // same checks the route uses.
+  return { createWorktree: worktreeCreation.create };
 }

package/server/lib/git/routes.test.js

@@ -527,7 +527,7 @@ describe('contributor worktree authority', () => {
     expect(hydrateBoundCheckout).toHaveBeenCalledWith(expect.objectContaining({ parentRemoteName: '' }));
   });
 
-  it('inspects an unbound local checkout and passes the durable store', async () => {
+  it('hydrates an unbound checkout under the unbound revision and passes the durable store', async () => {
     const hydrateBoundCheckout = vi.fn(async () => ({ status: 'not-needed', submodules: [], lfs: [] }));
     const worktreeBootstrapStore = { read: vi.fn(), write: vi.fn(), remove: vi.fn() };
     gitLibraries.createWorktree.mockImplementationOnce(async (_directory, _input, options) => {
@@ -556,7 +556,7 @@ describe('contributor worktree authority', () => {
       directory: '/repo-local',
       parentRemoteName: '',
       parentEndpoint: undefined,
-      repositoryAuthority: null,
+      repositoryAuthority: { repositoryId: 'repo_one', bindingRevision: 0, configRevision: 'config_one' },
     });
   });