@xbghc/warden 0.7.0 → 0.9.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // bin/cli.ts
-import path8 from "path";
+import path9 from "path";
 import { spawn } from "child_process";
 import { existsSync as existsSync2 } from "fs";
 import { fileURLToPath } from "url";
@@ -652,7 +652,7 @@ var serve = (options, listeningListener) => {
 };
 
 // packages/server/src/app.ts
-import path7 from "path";
+import path8 from "path";
 import { randomUUID } from "crypto";
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/compose.js
@@ -812,26 +812,26 @@ var throwNestingLimitExceeded = () => {
 };
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/utils/url.js
-var splitPath = (path9) => {
-  const paths = path9.split("/");
+var splitPath = (path10) => {
+  const paths = path10.split("/");
   if (paths[0] === "") {
     paths.shift();
   }
   return paths;
 };
 var splitRoutingPath = (routePath) => {
-  const { groups, path: path9 } = extractGroupsFromPath(routePath);
-  const paths = splitPath(path9);
+  const { groups, path: path10 } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path10);
   return replaceGroupMarks(paths, groups);
 };
-var extractGroupsFromPath = (path9) => {
+var extractGroupsFromPath = (path10) => {
   const groups = [];
-  path9 = path9.replace(/\{[^}]+\}/g, (match2, index) => {
+  path10 = path10.replace(/\{[^}]+\}/g, (match2, index) => {
     const mark = `@${index}`;
     groups.push([mark, match2]);
     return mark;
   });
-  return { groups, path: path9 };
+  return { groups, path: path10 };
 };
 var replaceGroupMarks = (paths, groups) => {
   for (let i = groups.length - 1; i >= 0; i--) {
@@ -888,8 +888,8 @@ var getPath = (request) => {
       const queryIndex = url.indexOf("?", i);
       const hashIndex = url.indexOf("#", i);
       const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
-      const path9 = url.slice(start, end);
-      return tryDecodeURI(path9.includes("%25") ? path9.replace(/%25/g, "%2525") : path9);
+      const path10 = url.slice(start, end);
+      return tryDecodeURI(path10.includes("%25") ? path10.replace(/%25/g, "%2525") : path10);
     } else if (charCode === 63 || charCode === 35) {
       break;
     }
@@ -906,11 +906,11 @@ var mergePath = (base, sub, ...rest) => {
   }
   return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
 };
-var checkOptionalParameter = (path9) => {
-  if (path9.charCodeAt(path9.length - 1) !== 63 || !path9.includes(":")) {
+var checkOptionalParameter = (path10) => {
+  if (path10.charCodeAt(path10.length - 1) !== 63 || !path10.includes(":")) {
     return null;
   }
-  const segments = path9.split("/");
+  const segments = path10.split("/");
   const results = [];
   let basePath = "";
   segments.forEach((segment) => {
@@ -1052,9 +1052,9 @@ var HonoRequest = class {
    */
   path;
   bodyCache = {};
-  constructor(request, path9 = "/", matchResult = [[]]) {
+  constructor(request, path10 = "/", matchResult = [[]]) {
     this.raw = request;
-    this.path = path9;
+    this.path = path10;
     this.#matchResult = matchResult;
   }
   param(key) {
@@ -1826,8 +1826,8 @@ var Hono = class _Hono {
         return this;
       };
     });
-    this.on = (method, path9, ...handlers) => {
-      for (const p of [path9].flat()) {
+    this.on = (method, path10, ...handlers) => {
+      for (const p of [path10].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
           const methodName = m.toUpperCase();
@@ -1885,8 +1885,8 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path9, app) {
-    const subApp = this.basePath(path9);
+  route(path10, app) {
+    const subApp = this.basePath(path10);
     app.routes.map((r) => {
       let handler;
       if (app.errorHandler === errorHandler) {
@@ -1912,9 +1912,9 @@ var Hono = class _Hono {
    * const api = new Hono().basePath('/api')
    * ```
    */
-  basePath(path9) {
+  basePath(path10) {
     const subApp = this.#clone();
-    subApp._basePath = mergePath(this._basePath, path9);
+    subApp._basePath = mergePath(this._basePath, path10);
     return subApp;
   }
   /**
@@ -1988,7 +1988,7 @@ var Hono = class _Hono {
    * })
    * ```
    */
-  mount(path9, applicationHandler, options) {
+  mount(path10, applicationHandler, options) {
     let replaceRequest;
     let optionHandler;
     if (options) {
@@ -2015,7 +2015,7 @@ var Hono = class _Hono {
       return [c.env, executionContext];
     };
     replaceRequest ||= (() => {
-      const mergedPath = mergePath(this._basePath, path9);
+      const mergedPath = mergePath(this._basePath, path10);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
@@ -2030,18 +2030,18 @@ var Hono = class _Hono {
       }
       await next();
     };
-    this.#addRoute(METHOD_NAME_ALL, mergePath(path9, "*"), handler);
+    this.#addRoute(METHOD_NAME_ALL, mergePath(path10, "*"), handler);
     return this;
   }
-  #addRoute(method, path9, handler, baseRoutePath) {
-    path9 = mergePath(this._basePath, path9);
+  #addRoute(method, path10, handler, baseRoutePath) {
+    path10 = mergePath(this._basePath, path10);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
-      path: path9,
+      path: path10,
       method,
       handler
     };
-    this.router.add(method, path9, [handler, r]);
+    this.router.add(method, path10, [handler, r]);
     this.routes.push(r);
   }
   #handleError(err, c) {
@@ -2054,10 +2054,10 @@ var Hono = class _Hono {
     if (method === "HEAD") {
       return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
     }
-    const path9 = this.getPath(request, { env });
-    const matchResult = this.router.match(method, path9);
+    const path10 = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path10);
     const c = new Context(request, {
-      path: path9,
+      path: path10,
       matchResult,
       env,
       executionCtx,
@@ -2160,7 +2160,7 @@ var createNullObject = () => /* @__PURE__ */ Object.create(null);
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
-function match(method, path9) {
+function match(method, path10) {
   const matchers = this.buildAllMatchers();
   const match2 = ((method2, path22) => {
     const matcher = matchers[method2] || matchers[METHOD_NAME_ALL];
@@ -2176,7 +2176,7 @@ function match(method, path9) {
     return [matcher[1][index], match3];
   });
   this.match = match2;
-  return match2(method, path9);
+  return match2(method, path10);
 }
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/node.js
@@ -2293,14 +2293,14 @@ var Trie = class {
   #index = 0;
   // dynamic path -> [handler index, param assoc]; static paths are not registered
   paths = createNullObject();
-  insert(path9, isStatic) {
+  insert(path10, isStatic) {
     if (isStatic) {
-      this.#root.insert(path9.split(""), 0, [], this.#context, true);
+      this.#root.insert(path10.split(""), 0, [], this.#context, true);
       return;
     }
     const paramAssoc = [];
     const groups = [];
-    let markedPath = path9;
+    let markedPath = path10;
     for (let i = 0; ; ) {
       let replaced = false;
       markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
@@ -2325,7 +2325,7 @@ var Trie = class {
       }
     }
     this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-    this.paths[path9] = [this.#index++, paramAssoc];
+    this.paths[path10] = [this.#index++, paramAssoc];
   }
   buildRegExp() {
     let regexp = this.#root.buildRegExpStr();
@@ -2352,17 +2352,17 @@ var Trie = class {
 
 // node_modules/.pnpm/hono@4.13.7/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path9) {
-  return wildcardRegExpCache[path9] ??= new RegExp(
-    `^${path9.replace(
+function buildWildcardRegExp(path10) {
+  return wildcardRegExpCache[path10] ??= new RegExp(
+    `^${path10.replace(
       /\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,
       (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ONLY_WILDCARD_REG_EXP_STR : `/:${LABEL_REG_EXP_STR}`
     )}$`
   );
 }
-function findMiddleware(middleware, path9) {
+function findMiddleware(middleware, path10) {
   for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
-    if (buildWildcardRegExp(k).test(path9)) {
+    if (buildWildcardRegExp(k).test(path10)) {
       return [...middleware[k]];
     }
   }
@@ -2378,14 +2378,14 @@ var RegExpRouter = class {
     this.#routes = { [METHOD_NAME_ALL]: createNullObject() };
     this.#tries = { [METHOD_NAME_ALL]: new Trie() };
   }
-  #insertPath(method, path9) {
+  #insertPath(method, path10) {
     try {
-      this.#tries[method].insert(path9, !/\*|\/:/.test(path9));
+      this.#tries[method].insert(path10, !/\*|\/:/.test(path10));
     } catch (e) {
-      throw e === PATH_ERROR ? new UnsupportedPathError(path9) : e;
+      throw e === PATH_ERROR ? new UnsupportedPathError(path10) : e;
     }
   }
-  add(method, path9, handler) {
+  add(method, path10, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
     if (!middleware) {
@@ -2401,28 +2401,28 @@ var RegExpRouter = class {
         }
       }
     }
-    if (path9 === "/*") {
-      path9 = "*";
+    if (path10 === "/*") {
+      path10 = "*";
     }
     const methods = method === METHOD_NAME_ALL ? Object.keys(middleware) : [method];
-    if (/\*$/.test(path9)) {
-      const re = buildWildcardRegExp(path9);
+    if (/\*$/.test(path10)) {
+      const re = buildWildcardRegExp(path10);
       for (const m of methods) {
-        if (!middleware[m][path9]) {
-          this.#insertPath(m, path9);
-          middleware[m][path9] = findMiddleware(middleware[m], path9) || findMiddleware(middleware[METHOD_NAME_ALL], path9) || [];
+        if (!middleware[m][path10]) {
+          this.#insertPath(m, path10);
+          middleware[m][path10] = findMiddleware(middleware[m], path10) || findMiddleware(middleware[METHOD_NAME_ALL], path10) || [];
         }
       }
       for (const handlerMap of [middleware, routes]) {
         for (const m of methods) {
           for (const p in handlerMap[m]) {
-            re.test(p) && handlerMap[m][p].push([handler, path9]);
+            re.test(p) && handlerMap[m][p].push([handler, path10]);
           }
         }
       }
       return;
     }
-    const paths = checkOptionalParameter(path9) || [path9];
+    const paths = checkOptionalParameter(path10) || [path10];
     for (const path22 of paths) {
       for (const m of methods) {
         if (!routes[m][path22]) {
@@ -2451,11 +2451,11 @@ var RegExpRouter = class {
     const handlerData = [];
     const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
     for (const r of [middleware, routes]) {
-      for (const path9 in r) {
-        const handlers = r[path9];
-        const pathData = trie.paths[path9];
+      for (const path10 in r) {
+        const handlers = r[path10];
+        const pathData = trie.paths[path10];
         if (!pathData) {
-          staticMap[path9] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+          staticMap[path10] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
           continue;
         }
         handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [
@@ -2479,13 +2479,13 @@ var SmartRouter = class {
   constructor(init) {
     this.#routers = init.routers;
   }
-  add(method, path9, handler) {
+  add(method, path10, handler) {
     if (!this.#routes) {
       throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     }
-    this.#routes.push([method, path9, handler]);
+    this.#routes.push([method, path10, handler]);
   }
-  match(method, path9) {
+  match(method, path10) {
     if (!this.#routes) {
       throw new Error("Fatal error");
     }
@@ -2500,7 +2500,7 @@ var SmartRouter = class {
         for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) {
           router.add(...routes[i2]);
         }
-        res = router.match(method, path9);
+        res = router.match(method, path10);
       } catch (e) {
         if (e instanceof UnsupportedPathError) {
           continue;
@@ -2535,9 +2535,9 @@ var Node2 = class _Node2 {
   #patterns = [];
   #pattern;
   #params = emptyParams;
-  insert(method, path9, handler) {
+  insert(method, path10, handler) {
     let curNode = this;
-    const parts = splitRoutingPath(path9);
+    const parts = splitRoutingPath(path10);
     const possibleKeys = /* @__PURE__ */ new Set();
     let i = 0;
     for (const p of parts) {
@@ -2577,12 +2577,12 @@ var Node2 = class _Node2 {
       }
     }
   }
-  search(method, path9) {
+  search(method, path10) {
     const handlerSets = [];
     this.#params = emptyParams;
     const curNode = this;
     let curNodes = [curNode];
-    const parts = splitPath(path9);
+    const parts = splitPath(path10);
     const curNodesQueue = [];
     const len = parts.length;
     let partOffsets = null;
@@ -2624,13 +2624,13 @@ var Node2 = class _Node2 {
           if (matcher !== true) {
             if (!partOffsets) {
               partOffsets = [];
-              let offset = path9[0] === "/" ? 1 : 0;
+              let offset = path10[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path9.slice(partOffsets[i]);
+            const restPathString = path10.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               params[name] = m[0];
@@ -2690,13 +2690,13 @@ var Node2 = class _Node2 {
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node2();
-  add(method, path9, handler) {
-    for (const result of checkOptionalParameter(path9) || [path9]) {
+  add(method, path10, handler) {
+    for (const result of checkOptionalParameter(path10) || [path10]) {
       this.#node.insert(method, result, handler);
     }
   }
-  match(method, path9) {
-    return this.#node.search(method, path9);
+  match(method, path10) {
+    return this.#node.search(method, path10);
   }
 };
 
@@ -2918,7 +2918,7 @@ function parseTargetKey(key) {
   if (key.startsWith("worktree:")) {
     const rest = key.slice("worktree:".length);
     const m = /^(.+):(working|staged|all|commit:.+|range:.+|base:.+)$/.exec(rest);
-    if (!m || !m[1] || !m[2]) throw new TargetKeyError(`invalid worktree target key: ${key}`);
+    if (!m?.[1] || !m[2]) throw new TargetKeyError(`invalid worktree target key: ${key}`);
     const worktree = m[1];
     if (!worktree.startsWith("/")) throw new TargetKeyError(`worktree path must be absolute: ${worktree}`);
     return { ...parseSuffix(m[2]), worktree };
@@ -2968,11 +2968,7 @@ function stageModeFor(t) {
 function localViewKeys(key) {
   const t = tryParseTargetKey(key);
   const wt = t?.worktree ? { worktree: t.worktree } : {};
-  return [
-    formatTargetKey({ kind: "working", ...wt }),
-    formatTargetKey({ kind: "staged", ...wt }),
-    formatTargetKey({ kind: "all", ...wt })
-  ];
+  return [formatTargetKey({ kind: "working", ...wt }), formatTargetKey({ kind: "staged", ...wt }), formatTargetKey({ kind: "all", ...wt })];
 }
 
 // packages/shared/src/order.ts
@@ -3049,7 +3045,19 @@ function parseCommitLog(stdout) {
 // packages/server/src/git.ts
 import { execFile } from "child_process";
 import { existsSync } from "fs";
-var ALLOWED_SUBCOMMANDS = /* @__PURE__ */ new Set(["rev-parse", "diff", "show", "log", "worktree", "ls-files", "status", "merge-base", "rev-list"]);
+var ALLOWED_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "rev-parse",
+  "diff",
+  "show",
+  "log",
+  "worktree",
+  "ls-files",
+  "status",
+  "merge-base",
+  "rev-list",
+  "for-each-ref",
+  "check-ref-format"
+]);
 var FORBIDDEN_OPTION_PREFIXES = ["--output", "--ext-diff", "--textconv", "-c", "--config-env", "--exec-path", "--git-dir", "--work-tree"];
 var DEFAULT_GIT_TIMEOUT_MS = 3e4;
 var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
@@ -3190,6 +3198,45 @@ async function applyOnce(cwd, patch, opts) {
     child.stdin?.end(patch);
   });
 }
+async function runGitWrite(args, opts) {
+  for (const arg of args) if (arg.includes("\0")) throw new GitError("NUL byte in git argument", null, "", 400, "git_bad_argument");
+  return new Promise((resolve, reject) => {
+    execFile(
+      "git",
+      [...args],
+      {
+        cwd: opts.cwd,
+        timeout: opts.timeoutMs ?? DEFAULT_GIT_TIMEOUT_MS,
+        maxBuffer: 16 * 1024 * 1024,
+        encoding: "utf8",
+        env: { ...process.env, LC_ALL: "C", GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" },
+        windowsHide: true
+      },
+      (error, stdout, stderr) => {
+        const err = error;
+        if (!err) {
+          resolve({ stdout, stderr, code: 0 });
+          return;
+        }
+        if (err.killed || err.signal === "SIGTERM") {
+          reject(new GitError(`git ${args[0]} timed out`, null, stderr, 504, "git_timeout"));
+          return;
+        }
+        if (err.code === "ENOENT") {
+          if (!existsSync(opts.cwd)) {
+            reject(new GitError(`working directory no longer exists: ${opts.cwd}`, null, "", 400, "unknown_worktree"));
+            return;
+          }
+          reject(new GitError("git executable not found in PATH", null, "", 500, "git_missing"));
+          return;
+        }
+        const code = typeof err.code === "number" ? err.code : -1;
+        const first = stderr.split("\n").find((l) => l.trim()) ?? err.message;
+        reject(new GitError(first.trim().replace(/^(fatal|error): /, ""), code, stderr, 500, "git_failed"));
+      }
+    );
+  });
+}
 async function refExists(cwd, ref) {
   try {
     await runGit(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], { cwd });
@@ -3230,7 +3277,7 @@ async function resolveRepo(dir) {
   try {
     const r = await runGit(["rev-parse", "--show-toplevel"], { cwd: dir });
     top = r.stdout.trim();
-  } catch (e) {
+  } catch {
     throw new HttpError(400, `${dir} is not inside a git repository`, "not_a_repo");
   }
   if (!top) throw new HttpError(400, `${dir} is not inside a git worktree (bare repository?)`, "not_a_repo");
@@ -3240,19 +3287,20 @@ async function resolveRepo(dir) {
   const commonRoot = path.basename(commonDir) === ".git" ? path.dirname(commonDir) : root;
   return { root, commonRoot };
 }
-async function listWorktrees(ctx) {
+async function listWorktreesAll(ctx) {
   const r = await runGit(["worktree", "list", "--porcelain"], { cwd: ctx.root });
   const out = [];
   let cur = null;
   const flush = () => {
-    if (cur && cur.path && !cur.prunable) {
+    if (cur?.path) {
       out.push({
         path: cur.path,
         head: cur.head ?? "",
         branch: cur.branch,
         isMain: false,
         detached: cur.detached ?? false,
-        bare: cur.bare ?? false
+        bare: cur.bare ?? false,
+        prunable: cur.prunable ?? false
       });
     }
     cur = null;
@@ -3266,7 +3314,6 @@ async function listWorktrees(ctx) {
       flush();
       cur = { path: line.slice("worktree ".length) };
     } else if (!cur) {
-      continue;
     } else if (line.startsWith("HEAD ")) cur.head = line.slice(5);
     else if (line.startsWith("branch ")) cur.branch = line.slice(7).replace(/^refs\/heads\//, "");
     else if (line === "detached") cur.detached = true;
@@ -3280,6 +3327,9 @@ async function listWorktrees(ctx) {
   }
   return out;
 }
+async function listWorktrees(ctx) {
+  return (await listWorktreesAll(ctx)).filter((w) => !w.prunable).map(({ prunable: _prunable, ...w }) => w);
+}
 async function currentBranch(cwd) {
   const res = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd }).catch(() => ({ stdout: "" }));
   const name = res.stdout.trim();
@@ -3323,7 +3373,9 @@ function lineHash(content) {
   return sha1(content.trimEnd());
 }
 function hunkHash(lineContents) {
-  return sha1(lineContents.map((l) => l.trimEnd()).join("\n").trim());
+  return sha1(
+    lineContents.map((l) => l.trimEnd()).join("\n").trim()
+  );
 }
 
 // packages/server/src/diffparse.ts
@@ -3364,7 +3416,7 @@ function stripPrefix(p, prefix) {
 function splitGitHeader(rest) {
   if (rest.startsWith('"')) {
     const m = /^("(?:[^"\\]|\\.)*")\s+("(?:[^"\\]|\\.)*")$/.exec(rest);
-    if (m && m[1] && m[2]) return { a: stripPrefix(m[1], "a/"), b: stripPrefix(m[2], "b/") };
+    if (m?.[1] && m[2]) return { a: stripPrefix(m[1], "a/"), b: stripPrefix(m[2], "b/") };
   }
   for (let i = 0; i < rest.length; i++) {
     if (rest[i] !== " ") continue;
@@ -3521,7 +3573,6 @@ function parseUnifiedDiff(text) {
     if (line.startsWith("Binary files ") || line === "GIT binary patch") {
       c.binary = true;
       c.raw.push(line);
-      continue;
     }
   }
   flush();
@@ -3845,12 +3896,13 @@ function pickedLines(diff, selection) {
   const picked = /* @__PURE__ */ new Map();
   const changed = (h) => h.lines.map((l, i) => l.type === "context" ? -1 : i).filter((i) => i >= 0);
   if (selection === void 0) {
-    diff.hunks.forEach((h, i) => picked.set(i, new Set(changed(h))));
+    for (const [i, h] of diff.hunks.entries()) picked.set(i, new Set(changed(h)));
     return picked;
   }
   if (!Array.isArray(selection)) throw badRequest("hunks must be an array", "bad_selection");
   for (const sel of selection) {
-    if (!sel || !Number.isInteger(sel.index) || sel.index < 0 || sel.index >= diff.hunks.length) throw badRequest(`no such hunk: ${sel?.index}`, "bad_selection");
+    if (!sel || !Number.isInteger(sel.index) || sel.index < 0 || sel.index >= diff.hunks.length)
+      throw badRequest(`no such hunk: ${sel?.index}`, "bad_selection");
     const hunk = diff.hunks[sel.index];
     const set = picked.get(sel.index) ?? /* @__PURE__ */ new Set();
     picked.set(sel.index, set);
@@ -3927,23 +3979,138 @@ function buildStagePatch(diff, mode, selection) {
   return { patch: [...header, ...hunks].join("\n") + "\n", lines };
 }
 
+// packages/server/src/worktrees.ts
+import path3 from "path";
+import { readdir, realpath as realpath2, stat } from "fs/promises";
+function worktreePathPrefix(ctx) {
+  return path3.join(path3.dirname(ctx.commonRoot), `${path3.basename(ctx.commonRoot)}-`);
+}
+async function dirtyCount(cwd) {
+  try {
+    const r = await runGit(["status", "--porcelain", "--untracked-files=all"], { cwd });
+    return r.stdout.split("\n").filter((l) => l.trim()).length;
+  } catch {
+    return 0;
+  }
+}
+async function listWorktreesDetailed(ctx) {
+  const all = await listWorktreesAll(ctx);
+  return Promise.all(all.map(async (w) => ({ ...w, dirty: w.prunable || w.bare ? 0 : await dirtyCount(w.path) })));
+}
+async function listBranches(ctx, worktrees) {
+  const r = await runGit(["for-each-ref", "--format=%(refname:short)%09%(objectname:short)", "refs/heads"], { cwd: ctx.commonRoot });
+  const at = /* @__PURE__ */ new Map();
+  for (const w of worktrees) if (w.branch) at.set(w.branch, w.path);
+  return r.stdout.split("\n").filter(Boolean).map((line) => {
+    const [name = "", sha = ""] = line.split("	");
+    const worktree = at.get(name);
+    return { name, sha, ...worktree ? { worktree } : {} };
+  });
+}
+async function assertBranchName(ctx, name) {
+  if (!isValidRef(name) || name.includes("@{") || name.startsWith("refs/")) throw badRequest(`invalid branch name: ${name}`, "invalid_branch");
+  try {
+    await runGit(["check-ref-format", "--branch", name], { cwd: ctx.commonRoot });
+  } catch {
+    throw badRequest(`invalid branch name: ${name}`, "invalid_branch");
+  }
+}
+async function assertNewWorktreePath(ctx, worktrees, p) {
+  if (!p || !path3.isAbsolute(p)) throw badRequest("worktree path must be absolute", "invalid_path");
+  const target = path3.resolve(p);
+  const parent = path3.dirname(ctx.commonRoot);
+  if (target === parent || !target.startsWith(parent + path3.sep)) throw badRequest(`worktree path must be under ${parent}`, "invalid_path");
+  for (const w of worktrees) {
+    if (target === w.path || target.startsWith(w.path + path3.sep)) throw badRequest(`${target} is inside the worktree at ${w.path}`, "invalid_path");
+  }
+  const st = await stat(target).catch((e) => {
+    if (e.code === "ENOENT") return void 0;
+    throw e;
+  });
+  if (!st) return target;
+  if (!st.isDirectory() || (await readdir(target)).length > 0) throw badRequest(`${target} already exists`, "path_exists");
+  return target;
+}
+async function addWorktree(ctx, req) {
+  const branch = req.branch.trim();
+  const base = req.base?.trim();
+  await assertBranchName(ctx, branch);
+  const existing = await listWorktreesAll(ctx);
+  const target = await assertNewWorktreePath(ctx, existing, req.path.trim());
+  const cwd = ctx.commonRoot;
+  const branchExists = await refExists(cwd, `refs/heads/${branch}`);
+  let args;
+  if (base) {
+    if (!isValidRef(base)) throw badRequest(`invalid base ref: ${base}`, "invalid_ref");
+    if (!await refExists(cwd, base)) throw badRequest(`unknown ref: ${base}`, "unknown_ref");
+    if (branchExists) throw new HttpError(409, `branch ${branch} already exists`, "branch_exists");
+    args = ["worktree", "add", "-b", branch, target, base];
+  } else {
+    if (!branchExists) throw badRequest(`unknown branch: ${branch}`, "unknown_ref");
+    const holder = existing.find((w) => w.branch === branch);
+    if (holder) throw new HttpError(409, `${branch} is already checked out at ${holder.path}`, "branch_in_use");
+    args = ["worktree", "add", target, branch];
+  }
+  try {
+    await runGitWrite(args, { cwd });
+  } catch (e) {
+    if (e instanceof GitError && /already (checked out|used by worktree)/.test(e.stderr)) throw new HttpError(409, e.message, "branch_in_use");
+    throw e;
+  }
+  const real = await realpath2(target).catch(() => target);
+  const made = (await listWorktrees(ctx)).find((w) => w.path === real);
+  if (!made) throw new HttpError(500, `git created ${target} but does not list it`, "git_failed");
+  return made;
+}
+async function removeWorktree(ctx, req) {
+  const p = req.path.trim();
+  const wt = (await listWorktreesAll(ctx)).find((w) => w.path === p || p && w.path === path3.resolve(p));
+  if (!wt) throw badRequest(`unknown worktree: ${p}`, "unknown_worktree");
+  if (wt.isMain) throw badRequest("the main worktree cannot be removed", "main_worktree");
+  const cwd = ctx.commonRoot;
+  const args = ["worktree", "remove"];
+  if (req.force) args.push("--force");
+  args.push(wt.path);
+  try {
+    await runGitWrite(args, { cwd });
+  } catch (e) {
+    if (e instanceof GitError && /contains modified or untracked files/.test(e.stderr)) {
+      throw new HttpError(409, `${wt.path} has uncommitted changes`, "worktree_dirty");
+    }
+    if (e instanceof GitError && !req.force && /use --force|validation failed/.test(e.stderr)) {
+      throw new HttpError(409, e.message, "needs_force");
+    }
+    throw e;
+  }
+  const res = { ok: true, branchDeleted: false };
+  if (req.deleteBranch && wt.branch) {
+    try {
+      await runGitWrite(["branch", "-d", wt.branch], { cwd });
+      res.branchDeleted = true;
+    } catch (e) {
+      res.branchError = e instanceof Error ? e.message : String(e);
+    }
+  }
+  return res;
+}
+
 // packages/server/src/state.ts
 import os from "os";
-import path3 from "path";
-import { mkdir, open, readFile as readFile2, rename, stat, unlink, writeFile } from "fs/promises";
+import path4 from "path";
+import { mkdir, open, readFile as readFile2, rename, stat as stat2, unlink, writeFile } from "fs/promises";
 function dataDir() {
   const xdg = process.env.XDG_DATA_HOME;
-  const base = xdg && xdg.trim() ? xdg : path3.join(os.homedir(), ".local", "share");
-  return path3.join(base, "warden");
+  const base = xdg?.trim() ? xdg : path4.join(os.homedir(), ".local", "share");
+  return path4.join(base, "warden");
 }
 function repoHash(repoRoot) {
   return sha1(repoRoot).slice(0, 12);
 }
 function stateFilePath(repoRoot, baseDir = dataDir()) {
-  return path3.join(baseDir, repoHash(repoRoot), "state.json");
+  return path4.join(baseDir, repoHash(repoRoot), "state.json");
 }
 function defaultPrefs() {
-  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true };
+  return { viewMode: "unified", nvimSocketByRoot: {}, autoRefresh: true, railOpen: false };
 }
 function defaultState(repoRoot) {
   return { schemaVersion: 1, repoRoot, targets: {}, issues: [], todos: [], prefs: defaultPrefs() };
@@ -3983,7 +4150,8 @@ function normalise(raw2, repoRoot) {
       ...defaultPrefs(),
       ...r.prefs ?? {},
       nvimSocketByRoot: r.prefs?.nvimSocketByRoot ?? {},
-      autoRefresh: typeof r.prefs?.autoRefresh === "boolean" ? r.prefs.autoRefresh : true
+      autoRefresh: typeof r.prefs?.autoRefresh === "boolean" ? r.prefs.autoRefresh : true,
+      railOpen: typeof r.prefs?.railOpen === "boolean" ? r.prefs.railOpen : false
     }
   };
 }
@@ -4035,7 +4203,7 @@ var StateStore = class {
   /** Apply a mutation under lock. The callback receives the freshest on-disk state. */
   update(fn) {
     const run2 = async () => {
-      await mkdir(path3.dirname(this.file), { recursive: true });
+      await mkdir(path4.dirname(this.file), { recursive: true });
       const release = await this.acquireLock();
       try {
         const state = await this.load();
@@ -4073,7 +4241,7 @@ var StateStore = class {
         const err = e;
         if (err.code !== "EEXIST") throw e;
         try {
-          const st = await stat(lock);
+          const st = await stat2(lock);
           if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
             await unlink(lock).catch(() => void 0);
             continue;
@@ -4134,7 +4302,7 @@ var LANG_BY_EXT = {
 };
 function langForPath(filePath) {
   const m = /\.([A-Za-z0-9]+)$/.exec(filePath);
-  if (!m || !m[1]) return "";
+  if (!m?.[1]) return "";
   return LANG_BY_EXT[m[1].toLowerCase()] ?? m[1].toLowerCase();
 }
 function formatCommentSection(c) {
@@ -4155,13 +4323,7 @@ function formatCommentsExport({ repoRoot, comments }) {
 }
 function formatIssueExport({ repoRoot, issue, comments }) {
   const targets = [...new Set(comments.map((c) => c.targetKey))];
-  const head = [
-    `# Issue: ${issue.title}`,
-    `Status: ${issue.status}`,
-    `Target: ${targets.join(", ") || "-"}`,
-    `Repo: ${repoRoot}`,
-    `Count: ${comments.length}`
-  ];
+  const head = [`# Issue: ${issue.title}`, `Status: ${issue.status}`, `Target: ${targets.join(", ") || "-"}`, `Repo: ${repoRoot}`, `Count: ${comments.length}`];
   const parts = [head.join("\n")];
   if (issue.body.trim()) parts.push(issue.body.trim());
   parts.push(...comments.map(formatCommentSection));
@@ -4170,9 +4332,9 @@ function formatIssueExport({ repoRoot, issue, comments }) {
 
 // packages/server/src/nvim.ts
 import os2 from "os";
-import path4 from "path";
+import path5 from "path";
 import { execFile as execFile2 } from "child_process";
-import { readdir, stat as stat2 } from "fs/promises";
+import { readdir as readdir2, stat as stat3 } from "fs/promises";
 var QUERY_TIMEOUT_MS = 500;
 var CACHE_TTL_MS = 1e4;
 function execNvim(args, timeoutMs) {
@@ -4201,14 +4363,14 @@ function socketDirs(env = process.env) {
     }
   }
   const tmp = env.TMPDIR || "/tmp";
-  if (user) dirs.push(path4.join(tmp, `nvim.${user}`));
-  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path4.dirname(env.NVIM_LISTEN_ADDRESS));
+  if (user) dirs.push(path5.join(tmp, `nvim.${user}`));
+  if (env.NVIM_LISTEN_ADDRESS) dirs.push(path5.dirname(env.NVIM_LISTEN_ADDRESS));
   return [...new Set(dirs)];
 }
 var SOCKET_NAME = /^nvim\.(\d+)\.\d+$/;
 async function isSocket(p) {
   try {
-    return (await stat2(p)).isSocket();
+    return (await stat3(p)).isSocket();
   } catch {
     return false;
   }
@@ -4218,12 +4380,12 @@ async function findSockets(dirs = socketDirs()) {
   const visit = async (dir, depth) => {
     let entries;
     try {
-      entries = await readdir(dir, { withFileTypes: true });
+      entries = await readdir2(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of entries) {
-      const full = path4.join(dir, ent.name);
+      const full = path5.join(dir, ent.name);
       const m = SOCKET_NAME.exec(ent.name);
       if (m && (ent.isSocket() || await isSocket(full))) {
         found.set(full, Number(m[1]));
@@ -4288,8 +4450,8 @@ var NvimService = class {
 };
 
 // packages/server/src/watcher.ts
-import path5 from "path";
-import { stat as stat3 } from "fs/promises";
+import path6 from "path";
+import { stat as stat4 } from "fs/promises";
 var DEFAULT_POLL_INTERVAL_MS = 1500;
 function statusPaths(out) {
   const parts = out.split("\0");
@@ -4385,7 +4547,7 @@ var RepoWatcher = class {
     const stats = await Promise.all(
       statusPaths(statusRes.stdout).map(async (rel) => {
         try {
-          const st = await stat3(path5.join(this.root, rel));
+          const st = await stat4(path6.join(this.root, rel));
           return `${rel}	${st.mtimeMs}	${st.size}`;
         } catch {
           return `${rel}	-`;
@@ -4397,8 +4559,8 @@ var RepoWatcher = class {
 };
 
 // packages/server/src/static.ts
-import path6 from "path";
-import { readFile as readFile3, stat as stat4 } from "fs/promises";
+import path7 from "path";
+import { readFile as readFile3, stat as stat5 } from "fs/promises";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -4415,20 +4577,20 @@ var MIME = {
   ".txt": "text/plain; charset=utf-8"
 };
 async function serveStaticFile(c, webDir) {
-  const root = path6.resolve(webDir);
+  const root = path7.resolve(webDir);
   let rel;
   try {
     rel = decodeURIComponent(c.req.path);
   } catch {
     return c.text("Bad Request", 400);
   }
-  let target = path6.resolve(root, "." + rel);
-  if (target !== root && !target.startsWith(root + path6.sep)) return c.text("Forbidden", 403);
+  let target = path7.resolve(root, "." + rel);
+  if (target !== root && !target.startsWith(root + path7.sep)) return c.text("Forbidden", 403);
   try {
-    const st = await stat4(target);
-    if (st.isDirectory()) target = path6.join(target, "index.html");
+    const st = await stat5(target);
+    if (st.isDirectory()) target = path7.join(target, "index.html");
   } catch {
-    target = path6.join(root, "index.html");
+    target = path7.join(root, "index.html");
   }
   let body;
   try {
@@ -4436,7 +4598,7 @@ async function serveStaticFile(c, webDir) {
   } catch {
     return c.text("Not Found", 404);
   }
-  const ext = path6.extname(target).toLowerCase();
+  const ext = path7.extname(target).toLowerCase();
   const isAsset = rel.startsWith("/assets/");
   return new Response(new Uint8Array(body), {
     status: 200,
@@ -4507,6 +4669,12 @@ function createApp(opts) {
     return c.json({ error: err instanceof Error ? err.message : String(err), code: "internal" }, 500);
   });
   const api = new Hono2();
+  api.use("*", async (c, next) => {
+    if (c.req.method !== "GET" && c.req.method !== "HEAD" && c.req.header("sec-fetch-site") === "cross-site") {
+      throw new HttpError(403, "cross-site requests are refused", "cross_site");
+    }
+    await next();
+  });
   api.get("/ping", (c) => c.text(opts.instanceToken ?? ""));
   api.get("/repo", async (c) => {
     const state = await store.load();
@@ -4516,7 +4684,11 @@ function createApp(opts) {
     const target = last ? tryParseTargetKey(last) : void 0;
     const usable2 = !!target && (!target.worktree || info.worktrees.some((w) => w.path === target.worktree));
     if (last && usable2) info.defaultTarget = last;
-    else if (last) await store.update((s) => void (s.prefs.lastTarget = "working"));
+    else if (last) {
+      await store.update((s) => {
+        s.prefs.lastTarget = "working";
+      });
+    }
     return c.json(info);
   });
   api.get("/state", async (c) => c.json(await store.load()));
@@ -4526,6 +4698,7 @@ function createApp(opts) {
       if (body.viewMode === "unified" || body.viewMode === "split") s.prefs.viewMode = body.viewMode;
       if (typeof body.lastTarget === "string") s.prefs.lastTarget = body.lastTarget;
       if (typeof body.autoRefresh === "boolean") s.prefs.autoRefresh = body.autoRefresh;
+      if (typeof body.railOpen === "boolean") s.prefs.railOpen = body.railOpen;
       if (body.nvimSocketByRoot && typeof body.nvimSocketByRoot === "object") {
         s.prefs.nvimSocketByRoot = { ...s.prefs.nvimSocketByRoot, ...body.nvimSocketByRoot };
       }
@@ -4615,7 +4788,8 @@ function createApp(opts) {
     if (body.hunks !== void 0 && !Array.isArray(body.hunks)) throw badRequest("hunks must be an array", "bad_selection");
     const diff = await fileDiffWithHints(ctx, body.path);
     if (!diff) throw badRequest(`file ${body.path} is not part of ${key}`, "no_diff");
-    if (diff.contentHash !== body.contentHash) throw new HttpError(409, "the diff changed since it was loaded; refresh and pick the lines again", "diff_changed");
+    if (diff.contentHash !== body.contentHash)
+      throw new HttpError(409, "the diff changed since it was loaded; refresh and pick the lines again", "diff_changed");
     const { patch, lines } = buildStagePatch(diff, mode, body.hunks);
     await applyToIndex(ctx.cwd, patch, { reverse: mode === "unstage" });
     void watchers.get(ctx.cwd)?.poll();
@@ -4838,7 +5012,7 @@ function createApp(opts) {
   });
   api.post("/issues", async (c) => {
     const body = await c.req.json();
-    if (!body.title || !body.title.trim()) throw badRequest("title is required");
+    if (!body.title?.trim()) throw badRequest("title is required");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const issue = {
       id: randomUUID(),
@@ -4931,7 +5105,7 @@ function createApp(opts) {
   });
   api.post("/todos", async (c) => {
     const body = await c.req.json();
-    if (!body.title || !body.title.trim()) throw badRequest("title is required");
+    if (!body.title?.trim()) throw badRequest("title is required");
     const branch = body.branch?.trim() || await currentBranch(await knownRoot(body.root));
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const todo = {
@@ -5043,6 +5217,26 @@ function createApp(opts) {
     const res = { base, sha, ahead: Number(counts[1] ?? 0), behind: Number(counts[0] ?? 0) };
     return c.json(res);
   });
+  api.get("/worktrees", async (c) => {
+    const list = await listWorktreesDetailed(repo);
+    const res = { worktrees: list, branches: await listBranches(repo, list), pathPrefix: worktreePathPrefix(repo) };
+    return c.json(res);
+  });
+  api.post("/worktrees", async (c) => {
+    const body = await c.req.json();
+    if (typeof body.path !== "string" || typeof body.branch !== "string") throw badRequest("path and branch are required");
+    if (body.base !== void 0 && typeof body.base !== "string") throw badRequest("base must be a ref");
+    const made = await addWorktree(repo, body);
+    worktreeCache = null;
+    return c.json(made, 201);
+  });
+  api.post("/worktrees/remove", async (c) => {
+    const body = await c.req.json();
+    if (typeof body.path !== "string") throw badRequest("path is required");
+    const res = await removeWorktree(repo, body);
+    worktreeCache = null;
+    return c.json(res);
+  });
   api.get("/events", async (c) => {
     const root = c.req.query("root") || repo.root;
     const known = root === repo.root || root === repo.commonRoot || (await worktrees()).some((w) => w.path === root);
@@ -5094,7 +5288,7 @@ function createApp(opts) {
   api.post("/nvim/open", async (c) => {
     const body = await c.req.json();
     if (!body.socket || !body.absPath) throw badRequest("socket and absPath are required");
-    if (!path7.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
+    if (!path8.isAbsolute(body.absPath)) throw badRequest("absPath must be absolute");
     const scan = await nvim.scan();
     if (!scan.instances.some((i) => i.socket === body.socket)) {
       const fresh = await nvim.scan(true);
@@ -5220,7 +5414,7 @@ async function startServer(opts) {
 }
 
 // bin/cli.ts
-var VERSION = true ? "0.7.0" : "dev";
+var VERSION = true ? "0.9.0" : "dev";
 function parseArgs(argv) {
   const args = { repoPath: process.cwd(), open: true, help: false, version: false };
   for (let i = 0; i < argv.length; i++) {
@@ -5238,7 +5432,7 @@ function parseArgs(argv) {
     } else if (a === "--help" || a === "-h") args.help = true;
     else if (a === "--version" || a === "-v") args.version = true;
     else if (a.startsWith("-")) throw new Error(`unknown option: ${a}`);
-    else args.repoPath = path8.resolve(a);
+    else args.repoPath = path9.resolve(a);
   }
   return args;
 }
@@ -5281,16 +5475,16 @@ async function openBrowser(url) {
   return false;
 }
 function resolveWebDir() {
-  const here = path8.dirname(fileURLToPath(import.meta.url));
+  const here = path9.dirname(fileURLToPath(import.meta.url));
   const candidates = [
     process.env.WARDEN_WEB_DIR,
-    path8.join(here, "web"),
+    path9.join(here, "web"),
     // dist/cli.js -> dist/web
-    path8.join(here, "..", "dist", "web")
+    path9.join(here, "..", "dist", "web")
     // bin/cli.ts (tsx dev) -> dist/web
   ].filter((p) => !!p);
   for (const dir of candidates) {
-    if (existsSync2(path8.join(dir, "index.html"))) return dir;
+    if (existsSync2(path9.join(dir, "index.html"))) return dir;
   }
   return void 0;
 }