@xbzbing/dsh-git-panel 0.1.0 → 0.2.0

package/lib/host/index.js

@@ -77,19 +77,22 @@ function createGitRunner(subprocess, timeoutMs, maxBytes) {
         try {
           outcome = await handle.done;
         } catch (error) {
+          const cancelled2 = opts.signal?.aborted === true && !controller.signal.aborted;
           if (controller.signal.aborted || opts.signal?.aborted === true) {
-            return { exitCode: null, stdout: "", stderr: "", timedOut: true, stdoutLossy: false };
+            return { exitCode: null, stdout: "", stderr: "", timedOut: !cancelled2, cancelled: cancelled2, stdoutLossy: false };
           }
           throw error;
         }
         const stdout = handle.collected.stdout?.readFrom(0);
         const stderr = handle.collected.stderr?.readFrom(0);
         const resolved = await resolveStdout(stdout);
+        const cancelled = opts.signal?.aborted === true && !controller.signal.aborted;
         return {
           exitCode: outcome.exitCode,
           stdout: resolved.text,
           stderr: stderr?.text ?? "",
-          timedOut: controller.signal.aborted || opts.signal?.aborted === true,
+          timedOut: controller.signal.aborted,
+          cancelled,
           stdoutLossy: resolved.lossy
         };
       } finally {
@@ -172,12 +175,13 @@ function parseGraphLog(stdout) {
     if (rec.trim() === "") continue;
     const parts = rec.split("");
     if (parts.length < 7) continue;
-    const [hash, shortHash, parentsRaw, author, dateIso, decoration, subject] = parts;
+    const [hash, shortHash, parentsRaw, author, dateIso, decoration] = parts;
+    const subject = parts.slice(6).join("");
     const parents = (parentsRaw ?? "").trim() === "" ? [] : parentsRaw.trim().split(/\s+/);
     out.push({
       hash: hash ?? "",
       shortHash: shortHash ?? "",
-      subject: subject ?? "",
+      subject,
       author: author ?? "",
       dateIso: dateIso ?? "",
       parents,
@@ -226,23 +230,38 @@ function parseBranches(stdout) {
   }
   return out;
 }
+function parseTags(stdout) {
+  const out = [];
+  for (const line of stdout.split("\n")) {
+    if (line.trim() === "") continue;
+    const [name, shortHash = ""] = line.split("\0");
+    if (name) out.push({ name, shortHash: shortHash === "" ? null : shortHash });
+  }
+  return out;
+}
 function parseNameStatus(stdout) {
   const out = [];
   const tokens = stdout.split("\0");
-  for (let i = 0; i < tokens.length; i++) {
+  let i = 0;
+  while (i < tokens.length) {
     const tok = tokens[i];
-    if (tok === void 0 || tok === "") continue;
+    if (tok === void 0 || tok === "") {
+      i += 1;
+      continue;
+    }
     const code = tok[0];
-    if (code === void 0 || !/[AMDRCTU]/.test(code)) continue;
+    if (code === void 0 || !/[AMDRCTU]/.test(code)) break;
     if (code === "R" || code === "C") {
       const newPath = tokens[i + 2];
+      if (newPath === void 0) break;
+      out.push({ path: newPath, status: statusOf(code) });
+      i += 3;
+    } else {
+      const path = tokens[i + 1];
+      if (path === void 0) break;
+      if (path !== "") out.push({ path, status: statusOf(code) });
       i += 2;
-      if (newPath) out.push({ path: newPath, status: statusOf(code) });
-      continue;
     }
-    const path = tokens[i + 1];
-    i += 1;
-    if (path) out.push({ path, status: statusOf(code) });
   }
   return out;
 }
@@ -261,6 +280,25 @@ function sumNumstat(stdout) {
   return { insertions, deletions };
 }
 
+// src/host/validate.ts
+import { isAbsolute, normalize } from "node:path";
+function isSafePath(path) {
+  if (path === "" || isAbsolute(path)) return false;
+  const norm = normalize(path);
+  if (norm === ".." || norm.startsWith("../") || norm.startsWith("..\\")) return false;
+  return true;
+}
+var REV_META = /[\x00-\x20\x7f~^:?*[\\]/;
+function isSafeRev(input) {
+  if (input === "" || input.startsWith("-")) return false;
+  if (REV_META.test(input)) return false;
+  if (input.includes("..") || input.includes("@{")) return false;
+  return true;
+}
+function isSafeBranchName(name) {
+  return isSafeRev(name) && !name.startsWith("/");
+}
+
 // src/host/core.ts
 var DEFAULT_CONFIG = {
   timeoutMs: 8e3,
@@ -271,7 +309,7 @@ var DEFAULT_CONFIG = {
 };
 function normalizeConfig(raw) {
   const c = raw ?? {};
-  const num = (v, d) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : d;
+  const num = (v, d) => typeof v === "number" && Number.isFinite(v) && v >= 1 ? Math.floor(v) : d;
   return {
     timeoutMs: num(c.timeoutMs, DEFAULT_CONFIG.timeoutMs),
     maxBytes: num(c.maxBytes, DEFAULT_CONFIG.maxBytes),
@@ -284,6 +322,7 @@ function readBool(value, fallback) {
   const raw = value !== null && typeof value === "object" && "get" in value && typeof value.get === "function" ? value.get() : value;
   return typeof raw === "boolean" ? raw : fallback;
 }
+var NEG_CACHE_MS = 15e3;
 async function resolveWorkspace(deps, sessionId) {
   let cwd = deps.sessions.liveCwd(sessionId);
   if (cwd === void 0 || cwd === "") {
@@ -295,16 +334,26 @@ async function resolveWorkspace(deps, sessionId) {
   }
   const cached = deps.rootCache?.get(cwd);
   if (cached !== void 0) return { ok: true, root: cached };
+  const negAt = deps.rootNegCache?.get(cwd);
+  if (negAt !== void 0) {
+    if (Date.now() < negAt) return { ok: false, failure: { ok: false, error: { code: "not-a-git-repo", cwd } } };
+    deps.rootNegCache?.delete(cwd);
+  }
   const top = await runCommand(deps.run, ["git", "rev-parse", "--show-toplevel"], cwd, "toplevel", deps.signal);
   if ("failure" in top) {
     return { ok: false, failure: { ok: false, error: mapRunFailure(top.failure) } };
   }
+  if (top.run.cancelled) return { ok: false, failure: { ok: false, error: { code: "cancelled" } } };
   if (top.run.timedOut) return { ok: false, failure: { ok: false, error: { code: "timeout" } } };
   if (top.run.exitCode !== 0) {
+    deps.rootNegCache?.set(cwd, Date.now() + NEG_CACHE_MS);
     return { ok: false, failure: { ok: false, error: { code: "not-a-git-repo", cwd } } };
   }
   const raw = top.run.stdout.trim();
-  if (raw === "") return { ok: false, failure: { ok: false, error: { code: "not-a-git-repo", cwd } } };
+  if (raw === "") {
+    deps.rootNegCache?.set(cwd, Date.now() + NEG_CACHE_MS);
+    return { ok: false, failure: { ok: false, error: { code: "not-a-git-repo", cwd } } };
+  }
   let root = raw;
   try {
     root = await deps.fs.realpath(raw);
@@ -326,6 +375,11 @@ function mapRunFailure(failure) {
   const message = failure instanceof Error ? failure.message : String(failure);
   return { code: "git-unavailable", detail: message };
 }
+function mapWorkspaceFailure(failure) {
+  const error = failure.error;
+  const message = "detail" in error ? error.detail : void 0;
+  return { code: error.code, ...message !== void 0 ? { message } : {} };
+}
 async function snapshotForSession(deps, config, sessionId) {
   const workspace = await resolveWorkspace(deps, sessionId);
   if (!workspace.ok) {
@@ -336,26 +390,30 @@ async function snapshotForSession(deps, config, sessionId) {
     return failure;
   }
   const root = workspace.root;
-  const [branchRes, headRes, statusRes, aheadBehindRes, lastCommitRes] = await Promise.all([
+  const [branchRes, headRes, statusRes, aheadBehindRes, lastCommitRes, worktreeNumRes, stagedNumRes] = await Promise.all([
     runCommand(deps.run, ["git", "symbolic-ref", "--quiet", "--short", "HEAD"], root, "branch", deps.signal),
     runCommand(deps.run, ["git", "rev-parse", "--short", "HEAD"], root, "head", deps.signal),
     runCommand(deps.run, ["git", "status", "--porcelain=v1", "-z"], root, "status", deps.signal),
     runCommand(deps.run, ["git", "rev-list", "--count", "--left-right", "@{upstream}...HEAD"], root, "aheadBehind", deps.signal),
-    runCommand(deps.run, ["git", "log", "-1", "--format=%H%x1f%h%x1f%s%x1f%an%x1f%aI"], root, "lastCommit", deps.signal)
+    runCommand(deps.run, ["git", "log", "-1", "--format=%H%x1f%h%x1f%s%x1f%an%x1f%aI"], root, "lastCommit", deps.signal),
+    runCommand(deps.run, ["git", "diff", "--numstat"], root, "numstat-worktree", deps.signal),
+    runCommand(deps.run, ["git", "diff", "--numstat", "--cached"], root, "numstat-staged", deps.signal)
   ]);
   const branch = "run" in branchRes && branchRes.run.exitCode === 0 ? branchRes.run.stdout.trim() || null : null;
   const unborn = "run" in headRes && headRes.run.exitCode !== 0;
   const head = unborn ? null : "run" in headRes ? headRes.run.stdout.trim() || null : null;
   let allChanges = [];
+  let statusLossy = false;
   if ("run" in statusRes && !statusRes.run.timedOut && statusRes.run.exitCode === 0) {
     allChanges = parseStatus(statusRes.run.stdout);
+    statusLossy = statusRes.run.stdoutLossy;
   }
-  const truncated = allChanges.length > config.maxChanges;
-  const changes = truncated ? allChanges.slice(0, config.maxChanges) : allChanges;
+  const truncated = allChanges.length > config.maxChanges || statusLossy;
+  const changes = allChanges.length > config.maxChanges ? allChanges.slice(0, config.maxChanges) : allChanges;
   let staged = 0;
   let modified = 0;
   let untracked = 0;
-  for (const c of changes) {
+  for (const c of allChanges) {
     if (c.status === "untracked") untracked++;
     else if (c.staged) staged++;
     else modified++;
@@ -380,12 +438,35 @@ async function snapshotForSession(deps, config, sessionId) {
       };
     }
   }
+  const wt = "run" in worktreeNumRes && worktreeNumRes.run.exitCode === 0 ? sumNumstat(worktreeNumRes.run.stdout) : { insertions: 0, deletions: 0 };
+  const stg = "run" in stagedNumRes && stagedNumRes.run.exitCode === 0 ? sumNumstat(stagedNumRes.run.stdout) : { insertions: 0, deletions: 0 };
+  let untrackedInsertions = 0;
+  const untrackedPaths = allChanges.filter((c) => c.status === "untracked" && !c.isDirectory).map((c) => c.path);
+  const safeUntracked = untrackedPaths.filter(isSafePath).slice(0, 200);
+  if (safeUntracked.length > 0) {
+    const perFile = await Promise.all(
+      safeUntracked.map((p) => runCommand(deps.run, ["git", "diff", "--numstat", "--no-index", "--", "/dev/null", p], root, "numstat-untracked", deps.signal))
+    );
+    for (const r of perFile) if ("run" in r) untrackedInsertions += sumNumstat(r.run.stdout).insertions;
+  }
+  const lastChangeAt = await maxChangeMtime(deps, root, allChanges);
+  const distinct = new Set(allChanges.map((c) => c.path));
+  const stats = {
+    fileCount: distinct.size,
+    staged,
+    modified,
+    untracked,
+    insertions: wt.insertions + stg.insertions + untrackedInsertions,
+    deletions: wt.deletions + stg.deletions,
+    lastChangeAt,
+    headCommittedAt: lastCommit?.dateIso ?? null
+  };
   const snapshot = {
     root,
     branch,
     head,
     unborn,
-    dirty: changes.length > 0,
+    dirty: allChanges.length > 0,
     staged,
     modified,
     untracked,
@@ -393,6 +474,7 @@ async function snapshotForSession(deps, config, sessionId) {
     behind,
     lastCommit,
     changes,
+    stats,
     truncated,
     refreshIntervalMs: config.refreshIntervalMs,
     showInputPill: config.showInputPill,
@@ -417,13 +499,7 @@ async function maxChangeMtime(deps, root, changes, cap = 200) {
 }
 
 // src/host/actions.ts
-import { isAbsolute, normalize } from "node:path";
-function isSafePath(path) {
-  if (path === "" || isAbsolute(path)) return false;
-  const norm = normalize(path);
-  if (norm === ".." || norm.startsWith("../") || norm.startsWith("..\\")) return false;
-  return true;
-}
+import { join as join2, sep } from "node:path";
 function withPaths(prefixes, paths) {
   if (paths.length === 0) return { error: "invalid-path", message: "no paths given" };
   for (const path of paths) {
@@ -445,55 +521,66 @@ function planAction(action, unborn) {
       return withPaths([["git", "restore", "--"]], action.paths);
     case "commit": {
       const message = action.message.trim();
-      const amendFlag = action.amend === true ? ["--amend"] : [];
-      if (message === "" && action.amend !== true) return { error: "empty-message" };
-      const msgArgs = message === "" ? [] : ["-m", message];
+      const amend = action.amend === true;
+      if (message === "" && !amend) return { error: "empty-message" };
+      const amendFlag = amend ? ["--amend"] : [];
+      const msgArgs = message === "" ? ["--no-edit"] : ["-m", message];
       if (action.paths === void 0 || action.paths.length === 0) {
         return { argv: [["git", "commit", ...amendFlag, ...msgArgs]] };
       }
       const staged = withPaths([["git", "add", "--"]], action.paths);
       if ("error" in staged) return staged;
       const commitCmd = ["git", "commit", ...amendFlag, ...msgArgs, "--", ...action.paths];
-      for (const path of action.paths) {
-        if (!isSafePath(path)) return { error: "invalid-path", message: `unsafe path: ${path}` };
-      }
       return { argv: [...staged.argv, commitCmd] };
     }
     case "branch-checkout":
-      return { argv: [["git", "checkout", action.name]] };
+      if (!isSafeBranchName(action.name)) return { error: "invalid-name", message: `unsafe branch name: ${action.name}` };
+      return { argv: [["git", "checkout", "--end-of-options", action.name]] };
     case "fetch":
       return { argv: [["git", "fetch", "--all", "--prune"]] };
   }
 }
 async function runAction(deps, config, request) {
   const workspace = await resolveWorkspace(deps, request.sessionId);
-  if (!workspace.ok) {
-    const error = workspace.failure.error;
-    return { ok: false, error: { code: error.code, message: "detail" in error ? error.detail : void 0 } };
-  }
+  if (!workspace.ok) return { ok: false, error: mapWorkspaceFailure(workspace.failure) };
   const root = workspace.root;
   const headProbe = await runCommand(deps.run, ["git", "rev-parse", "--verify", "HEAD"], root, "head-probe", deps.signal);
   const unborn = !("run" in headProbe) || headProbe.run.exitCode !== 0;
+  if (request.action.kind === "discard") {
+    const removed = await discardUntracked(deps, config, root, request.sessionId, request.action.paths);
+    if (removed !== null) {
+      if (!removed.ok) return removed.result;
+      if (removed.remainingTracked.length === 0) {
+        const snapshot2 = await snapshotForSession(deps, config, request.sessionId);
+        if (!snapshot2.ok) return { ok: false, error: { code: "git-error", message: "snapshot after action failed" } };
+        return { ok: true, snapshot: snapshot2.value, output: "" };
+      }
+      request = { ...request, action: { kind: "discard", paths: removed.remainingTracked } };
+    }
+  }
   const plan = planAction(request.action, unborn);
   if ("error" in plan) return { ok: false, error: { code: plan.error, ...plan.message ? { message: plan.message } : {} } };
   let lastOutput = "";
-  for (const argv of plan.argv) {
+  for (let step = 0; step < plan.argv.length; step += 1) {
+    const argv = plan.argv[step];
     const outcome = await runCommand(deps.run, argv, root, "action", deps.signal);
+    const where = plan.argv.length > 1 ? ` (step ${step + 1}/${plan.argv.length}: ${argv.join(" ")})` : "";
     if ("failure" in outcome) {
       const message = outcome.failure instanceof Error ? outcome.failure.message : String(outcome.failure);
-      return { ok: false, error: { code: "git-unavailable", message } };
+      return { ok: false, error: { code: "git-unavailable", message: message + where } };
     }
+    if (outcome.run.cancelled) return { ok: false, error: { code: "cancelled" } };
     if (outcome.run.timedOut) return { ok: false, error: { code: "timeout" } };
     lastOutput = outcome.run.stdout || outcome.run.stderr;
     if (outcome.run.exitCode !== 0) {
       const stderr = outcome.run.stderr;
       if (/nothing to commit|no changes added/i.test(stderr + lastOutput)) {
-        return { ok: false, error: { code: "git-error", message: stderr.trim() || "nothing to commit" } };
+        return { ok: false, error: { code: "git-error", message: (stderr.trim() || "nothing to commit") + where } };
       }
       if (/would be overwritten by checkout|local changes/i.test(stderr)) {
-        return { ok: false, error: { code: "local-changes-block", message: stderr.trim() } };
+        return { ok: false, error: { code: "local-changes-block", message: stderr.trim() + where } };
       }
-      return { ok: false, error: { code: "git-error", message: stderr.trim() || `git exited ${outcome.run.exitCode}` } };
+      return { ok: false, error: { code: "git-error", message: (stderr.trim() || `git exited ${outcome.run.exitCode}`) + where } };
     }
   }
   const snapshot = await snapshotForSession(deps, config, request.sessionId);
@@ -502,9 +589,39 @@ async function runAction(deps, config, request) {
   }
   return { ok: true, snapshot: snapshot.value, output: lastOutput.trim() };
 }
+async function discardUntracked(deps, config, root, sessionId, paths) {
+  const snap = await snapshotForSession(deps, config, sessionId);
+  if (!snap.ok) return null;
+  const untrackedSet = new Set(snap.value.changes.filter((c) => c.status === "untracked").map((c) => c.path));
+  const untracked = paths.filter((p) => untrackedSet.has(p));
+  if (untracked.length === 0) return null;
+  const tracked = paths.filter((p) => !untrackedSet.has(p));
+  let rootReal;
+  try {
+    rootReal = await deps.fs.realpath(root);
+  } catch {
+    return { ok: false, result: { ok: false, error: { code: "git-error", message: "repository root unavailable" } } };
+  }
+  for (const path of untracked) {
+    if (!isSafePath(path)) return { ok: false, result: { ok: false, error: { code: "invalid-path", message: `unsafe path: ${path}` } } };
+    const target = join2(root, path);
+    let targetReal;
+    try {
+      targetReal = await deps.fs.realpath(target);
+    } catch {
+      continue;
+    }
+    if (targetReal !== rootReal && !targetReal.startsWith(rootReal + sep)) {
+      return { ok: false, result: { ok: false, error: { code: "invalid-path", message: `path escapes repository: ${path}` } } };
+    }
+    await deps.fs.remove(target).catch(() => {
+    });
+  }
+  return { ok: true, remainingTracked: tracked };
+}
 
 // src/host/queries.ts
-import { join as join2 } from "node:path";
+import { join as join3, sep as sep2 } from "node:path";
 
 // src/host/types.ts
 var IMAGE_MIME = {
@@ -533,16 +650,7 @@ function isHexLike(text) {
 }
 async function runQuery(deps, config, request) {
   const workspace = await resolveWorkspace(deps, request.sessionId);
-  if (!workspace.ok) {
-    const error = workspace.failure.error;
-    return {
-      ok: false,
-      error: {
-        code: error.code === "not-a-git-repo" || error.code === "cwd-unavailable" || error.code === "session-not-found" || error.code === "timeout" || error.code === "git-unavailable" ? error.code : "git-error",
-        ..."detail" in error ? { message: error.detail } : {}
-      }
-    };
-  }
+  if (!workspace.ok) return { ok: false, error: mapWorkspaceFailure(workspace.failure) };
   const root = workspace.root;
   const q = request.query;
   try {
@@ -551,6 +659,8 @@ async function runQuery(deps, config, request) {
         return await queryHistory(deps, root, q);
       case "diff":
         return await queryDiff(deps, root, q);
+      case "file-lines":
+        return await queryFileLines(deps, root, q);
       case "image-diff":
         return await queryImageDiff(deps, config, root, q);
       case "show":
@@ -564,7 +674,7 @@ async function runQuery(deps, config, request) {
       case "last-commit-message":
         return await queryLastCommitMessage(deps, root);
       case "worktree-stats":
-        return await queryWorktreeStats(deps, config, root, request.sessionId);
+        return await queryWorktreeStats(deps, config, request.sessionId);
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -572,18 +682,13 @@ async function runQuery(deps, config, request) {
   }
 }
 async function queryHistory(deps, root, q) {
-  const args = ["git", "log", GRAPH_FORMAT, `--max-count=${q.limit}`, `--skip=${q.skip}`];
+  const limit = Number.isFinite(q.limit) ? Math.min(500, Math.max(1, Math.trunc(q.limit))) : 100;
+  const skip = Number.isFinite(q.skip) ? Math.max(0, Math.trunc(q.skip)) : 0;
+  const args = ["git", "log", GRAPH_FORMAT, `--max-count=${limit}`, `--skip=${skip}`];
   const search = q.search?.trim() ?? "";
   const hexJump = search !== "" && isHexLike(search);
   const countArgs = ["git", "rev-list", "--count"];
   if (!hexJump) {
-    if (q.ref !== void 0 && q.ref !== "") {
-      args.push(q.ref);
-      countArgs.push(q.ref);
-    } else {
-      args.push("--all");
-      countArgs.push("--all");
-    }
     if (search !== "") {
       args.push("-i", "-E", `--grep=${search}`);
       countArgs.push("-i", "-E", `--grep=${search}`);
@@ -596,22 +701,35 @@ async function queryHistory(deps, root, q) {
       args.push(`--since=${q.since}`);
       countArgs.push(`--since=${q.since}`);
     }
+    if (q.ref !== void 0 && q.ref !== "") {
+      if (!isSafeRev(q.ref)) return { ok: false, error: { code: "invalid-name", message: `unsafe ref: ${q.ref}` } };
+      args.push("--end-of-options", q.ref);
+      countArgs.push("--end-of-options", q.ref);
+    } else {
+      args.push("--all");
+      countArgs.push("--all");
+    }
   } else {
-    args.push(search);
+    args.push("--end-of-options", search);
   }
   const [res, countRes] = await Promise.all([
     runCommand(deps.run, args, root, "history", deps.signal),
     hexJump ? Promise.resolve(null) : runCommand(deps.run, countArgs, root, "history-count", deps.signal)
   ]);
   if (!("run" in res)) return { ok: false, error: { code: "git-unavailable" } };
+  if (res.run.cancelled) return { ok: false, error: { code: "cancelled" } };
   if (res.run.timedOut) return { ok: false, error: { code: "timeout" } };
   if (res.run.exitCode !== 0) {
-    return { ok: true, value: { kind: "history", commits: [], total: 0 } };
+    const stderr = res.run.stderr.trim();
+    if (hexJump || /unknown revision|bad revision|does not have any commits|ambiguous argument/i.test(stderr)) {
+      return { ok: true, value: { kind: "history", commits: [], total: 0 } };
+    }
+    return { ok: false, error: { code: "git-error", message: stderr || `git exited ${res.run.exitCode}` } };
   }
   const commits = parseGraphLog(res.run.stdout);
   let total = -1;
   if (hexJump) {
-    total = commits.length;
+    total = -1;
   } else if (countRes !== null && "run" in countRes && countRes.run.exitCode === 0) {
     const n = Number(countRes.run.stdout.trim());
     if (Number.isFinite(n)) total = n;
@@ -626,22 +744,75 @@ async function queryDiff(deps, root, q) {
   if (q.base === "staged") {
     args = ["git", "diff", unified, "--cached", "--", q.path];
   } else if (q.base === "commit") {
-    args = ["git", "show", unified, `${q.commit}`, "--", q.path];
+    if (!isSafeRev(q.commit)) return { ok: false, error: { code: "invalid-name", message: `unsafe commit: ${q.commit}` } };
+    args = ["git", "show", unified, "--end-of-options", q.commit, "--", q.path];
   } else {
     args = ["git", "diff", unified, "--", q.path];
   }
   const res = await runCommand(deps.run, args, root, "diff", deps.signal);
   if (!("run" in res)) return { ok: false, error: { code: "git-unavailable" } };
+  if (res.run.cancelled) return { ok: false, error: { code: "cancelled" } };
   if (res.run.timedOut) return { ok: false, error: { code: "timeout" } };
   let text = res.run.stdout;
   if (q.base === "worktree" && text.trim() === "") {
-    const noIndex = await runCommand(deps.run, ["git", "diff", unified, "--no-index", "--", "/dev/null", q.path], root, "diff-untracked", deps.signal);
-    if ("run" in noIndex) text = noIndex.run.stdout;
+    const tracked = await runCommand(deps.run, ["git", "ls-files", "--error-unmatch", "--", q.path], root, "diff-tracked-probe", deps.signal);
+    const isUntracked = !("run" in tracked) || tracked.run.exitCode !== 0;
+    if (isUntracked) {
+      const noIndex = await runCommand(deps.run, ["git", "diff", unified, "--no-index", "--", "/dev/null", q.path], root, "diff-untracked", deps.signal);
+      if ("run" in noIndex) text = noIndex.run.stdout;
+    }
   }
   return { ok: true, value: { kind: "diff", path: q.path, text } };
 }
+async function queryFileLines(deps, root, q) {
+  if (!isSafePath(q.path)) return { ok: false, error: { code: "invalid-path", message: q.path } };
+  const start = Number.isFinite(q.start) ? Math.max(1, Math.floor(q.start)) : 1;
+  const end = Number.isFinite(q.end) ? Math.max(start, Math.floor(q.end)) : start;
+  let args;
+  if (q.base === "commit") {
+    if (!isSafeRev(q.commit)) return { ok: false, error: { code: "invalid-name", message: `unsafe commit: ${q.commit}` } };
+    args = ["git", "show", "--end-of-options", `${q.commit}:${q.path}`];
+  } else {
+    args = ["git", "show", `--end-of-options`, `:${q.path}`];
+    if (q.base === "worktree") args = ["git", "cat-file", "-p", `:${q.path}`];
+  }
+  const res = await runCommand(deps.run, args, root, "file-lines", deps.signal);
+  if (!("run" in res)) return { ok: false, error: { code: "git-unavailable" } };
+  if (res.run.cancelled) return { ok: false, error: { code: "cancelled" } };
+  if (res.run.timedOut) return { ok: false, error: { code: "timeout" } };
+  if (res.run.exitCode !== 0) {
+    if (q.base === "worktree") {
+      const wt = await readWorktreeText(deps, root, q.path);
+      if (wt !== null) return sliceLines(q.path, wt, start, end);
+    }
+    return { ok: false, error: { code: "git-error", message: res.run.stderr.trim() || "no such blob" } };
+  }
+  return sliceLines(q.path, res.run.stdout, start, end);
+}
+async function readWorktreeText(deps, root, path) {
+  try {
+    const file = join3(root, path);
+    const real = await deps.fs.realpath(file);
+    const rootReal = await deps.fs.realpath(root);
+    if (real !== rootReal && !real.startsWith(rootReal + sep2)) return null;
+    const buf = await deps.fs.readFile(file);
+    return buf.toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function sliceLines(path, content, start, end) {
+  const all = content.split("\n");
+  if (all.length > 0 && all[all.length - 1] === "") all.pop();
+  const from = Math.min(start, all.length + 1);
+  const to = Math.min(end, all.length);
+  const lines = from <= to ? all.slice(from - 1, to) : [];
+  const eof = to >= all.length;
+  return { ok: true, value: { kind: "file-lines", path, start: from, lines, eof } };
+}
 async function queryImageDiff(deps, config, root, q) {
   if (!isSafePath(q.path)) return { ok: false, error: { code: "invalid-path", message: q.path } };
+  if (q.base === "commit" && !isSafeRev(q.commit)) return { ok: false, error: { code: "invalid-name", message: `unsafe commit: ${q.commit}` } };
   const mime = imageMimeFor(q.path);
   if (mime === null) return { ok: true, value: { kind: "image-diff", path: q.path, mime } };
   const oldSpec = q.base === "staged" ? `HEAD:${q.path}` : q.base === "commit" ? `${q.commit}^1:${q.path}` : `:${q.path}`;
@@ -694,7 +865,7 @@ async function blobSide(deps, gitDir, oid, cap) {
   if (!("run" in nameRes) || nameRes.run.exitCode !== 0) return void 0;
   const name = nameRes.run.stdout.trim();
   if (!/^[A-Za-z0-9._-]+$/.test(name)) return void 0;
-  const file = join2(gitDir, name);
+  const file = join3(gitDir, name);
   try {
     const buf = await deps.fs.readFile(file);
     if (buf.length > cap) return { tooLarge: true };
@@ -708,7 +879,10 @@ async function blobSide(deps, gitDir, oid, cap) {
 }
 async function worktreeSide(deps, root, path, cap) {
   try {
-    const file = join2(root, path);
+    const file = join3(root, path);
+    const real = await deps.fs.realpath(file);
+    const rootReal = await deps.fs.realpath(root);
+    if (real !== rootReal && !real.startsWith(rootReal + sep2)) return void 0;
     const info = await deps.fs.stat(file);
     if (info.size > cap) return { tooLarge: true };
     const buf = await deps.fs.readFile(file);
@@ -719,12 +893,14 @@ async function worktreeSide(deps, root, path, cap) {
   }
 }
 async function queryShow(deps, root, ref) {
+  if (!isSafeRev(ref)) return { ok: false, error: { code: "invalid-name", message: `unsafe ref: ${ref}` } };
   const metaFormat = "--format=%H%x1f%h%x1f%s%x1f%an%x1f%aI%x1f%b";
   const [metaRes, statRes] = await Promise.all([
-    runCommand(deps.run, ["git", "show", "-s", metaFormat, ref], root, "show-meta", deps.signal),
-    runCommand(deps.run, ["git", "show", "--name-status", "-z", "--format=", ref], root, "show-stat", deps.signal)
+    runCommand(deps.run, ["git", "show", "-s", metaFormat, "--end-of-options", ref], root, "show-meta", deps.signal),
+    runCommand(deps.run, ["git", "show", "--name-status", "-z", "--format=", "--end-of-options", ref], root, "show-stat", deps.signal)
   ]);
   if (!("run" in metaRes)) return { ok: false, error: { code: "git-unavailable" } };
+  if (metaRes.run.cancelled) return { ok: false, error: { code: "cancelled" } };
   if (metaRes.run.timedOut) return { ok: false, error: { code: "timeout" } };
   if (metaRes.run.exitCode !== 0) {
     return { ok: false, error: { code: "git-error", message: metaRes.run.stderr.trim() || "unknown ref" } };
@@ -740,7 +916,7 @@ async function queryShow(deps, root, ref) {
       author: parts[3] ?? "",
       dateIso: parts[4] ?? ""
     };
-    body = (parts[5] ?? "").trim();
+    body = parts.slice(5).join("").trim();
   }
   const stats = "run" in statRes && statRes.run.exitCode === 0 ? parseNameStatus(statRes.run.stdout) : [];
   return { ok: true, value: { kind: "show", ref, commit, body, stats } };
@@ -765,11 +941,7 @@ async function queryBranches(deps, root) {
 }
 async function queryTags(deps, root) {
   const res = await runCommand(deps.run, ["git", "for-each-ref", "--sort=-creatordate", "--format=%(refname:short)%00%(objectname:short)", "refs/tags"], root, "tags", deps.signal);
-  const tags = "run" in res && res.run.exitCode === 0 ? res.run.stdout.split("\n").flatMap((line) => {
-    if (line.trim() === "") return [];
-    const [name, shortHash = ""] = line.split("\0");
-    return name ? [{ name, shortHash: shortHash === "" ? null : shortHash }] : [];
-  }) : [];
+  const tags = "run" in res && res.run.exitCode === 0 ? parseTags(res.run.stdout) : [];
   return { ok: true, value: { kind: "tags", tags } };
 }
 async function queryAuthors(deps, root) {
@@ -782,48 +954,18 @@ async function queryLastCommitMessage(deps, root) {
   const message = "run" in res && res.run.exitCode === 0 ? res.run.stdout.replace(/\n+$/, "") : "";
   return { ok: true, value: { kind: "last-commit-message", message } };
 }
-async function queryWorktreeStats(deps, config, root, sessionId) {
+async function queryWorktreeStats(deps, config, sessionId) {
   const snapshot = await snapshotForSession(deps, config, sessionId);
   if (!snapshot.ok) return { ok: false, error: { code: "git-error", message: "snapshot failed" } };
-  const snap = snapshot.value;
-  const distinct = new Set(snap.changes.map((c) => c.path));
-  const [worktreeNum, stagedNum, headTime] = await Promise.all([
-    runCommand(deps.run, ["git", "diff", "--numstat"], root, "numstat-worktree", deps.signal),
-    runCommand(deps.run, ["git", "diff", "--numstat", "--cached"], root, "numstat-staged", deps.signal),
-    runCommand(deps.run, ["git", "log", "-1", "--format=%aI"], root, "head-time", deps.signal)
-  ]);
-  const a = "run" in worktreeNum && worktreeNum.run.exitCode === 0 ? sumNumstat(worktreeNum.run.stdout) : { insertions: 0, deletions: 0 };
-  const b = "run" in stagedNum && stagedNum.run.exitCode === 0 ? sumNumstat(stagedNum.run.stdout) : { insertions: 0, deletions: 0 };
-  let untrackedInsertions = 0;
-  const untrackedPaths = snap.changes.filter((c) => c.status === "untracked" && !c.isDirectory).map((c) => c.path);
-  if (untrackedPaths.length > 0) {
-    const safe = untrackedPaths.filter(isSafePath).slice(0, 200);
-    if (safe.length > 0) {
-      const noIndex = await runCommand(deps.run, ["git", "diff", "--numstat", "--no-index", "--", "/dev/null", ...safe], root, "numstat-untracked", deps.signal);
-      if ("run" in noIndex) untrackedInsertions = sumNumstat(noIndex.run.stdout).insertions;
-    }
-  }
-  const lastChangeAt = await maxChangeMtime(deps, root, snap.changes);
-  const headCommittedAt = "run" in headTime && headTime.run.exitCode === 0 ? headTime.run.stdout.trim() || null : null;
-  const stats = {
-    fileCount: distinct.size,
-    staged: snap.staged,
-    modified: snap.modified,
-    untracked: snap.untracked,
-    insertions: a.insertions + b.insertions + untrackedInsertions,
-    deletions: a.deletions + b.deletions,
-    lastChangeAt,
-    headCommittedAt
-  };
-  return { ok: true, value: { kind: "worktree-stats", stats } };
+  return { ok: true, value: { kind: "worktree-stats", stats: snapshot.value.stats } };
 }
 
 // src/host/version.ts
 import { readFile as readFile2 } from "node:fs/promises";
-import { dirname, join as join3 } from "node:path";
+import { dirname, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
 function manifestPath() {
-  return join3(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+  return join4(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
 }
 function stringField(value) {
   return typeof value === "string" && value !== "" ? value : void 0;
@@ -841,9 +983,10 @@ function compareVersions(a, b) {
   const split = (value) => {
     const trimmed = value.trim().replace(/^v/i, "");
     const [core, ...rest] = trimmed.split("-");
+    const preRaw = rest.join("-");
     return {
       core: core.split(".").map((part) => Number.parseInt(part, 10)).filter((part) => Number.isFinite(part)),
-      prerelease: rest.length > 0 && rest.join("-") !== ""
+      pre: preRaw === "" ? [] : preRaw.split(".")
     };
   };
   const left = split(a);
@@ -855,17 +998,39 @@ function compareVersions(a, b) {
     if (l > r) return 1;
     if (l < r) return -1;
   }
-  if (left.prerelease === right.prerelease) return 0;
-  return left.prerelease ? -1 : 1;
+  if (left.pre.length === 0 && right.pre.length === 0) return 0;
+  if (left.pre.length === 0) return 1;
+  if (right.pre.length === 0) return -1;
+  const preLen = Math.max(left.pre.length, right.pre.length);
+  for (let i = 0; i < preLen; i += 1) {
+    const lp = left.pre[i];
+    const rp = right.pre[i];
+    if (lp === void 0) return -1;
+    if (rp === void 0) return 1;
+    const ln = Number.parseInt(lp, 10);
+    const rn = Number.parseInt(rp, 10);
+    const lNum = Number.isFinite(ln) && String(ln) === lp;
+    const rNum = Number.isFinite(rn) && String(rn) === rp;
+    if (lNum && rNum) {
+      if (ln !== rn) return ln > rn ? 1 : -1;
+    } else if (lp !== rp) return lp > rp ? 1 : -1;
+  }
+  return 0;
 }
+var manifestCache;
 async function readManifest(path) {
   const raw = await readFile2(path, "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed !== "object" || parsed === null) throw new Error("package.json is not an object");
   return parsed;
 }
+async function loadManifest(path) {
+  if (path !== void 0) return readManifest(path);
+  if (manifestCache === void 0) manifestCache = await readManifest(manifestPath());
+  return manifestCache;
+}
 async function readVersionInfo(options = {}) {
-  const manifest = await readManifest(options.manifestPath ?? manifestPath());
+  const manifest = await loadManifest(options.manifestPath);
   const current = stringField(manifest.version) ?? "0.0.0";
   const repo = parseRepository(manifest.repository);
   const repositoryUrl = repo === void 0 ? void 0 : `https://github.com/${repo.owner}/${repo.repo}`;
@@ -876,16 +1041,26 @@ async function readVersionInfo(options = {}) {
     checkedRemote: false
   };
 }
+function safeReleaseUrl(url) {
+  if (url === void 0) return void 0;
+  return /^https:\/\/github\.com\//i.test(url) ? url : void 0;
+}
+var REMOTE_CACHE_MS = 10 * 60 * 1e3;
+var remoteCache;
 async function checkLatestVersion(options = {}) {
+  if (options.manifestPath === void 0 && options.fetchFn === void 0 && remoteCache !== void 0 && Date.now() - remoteCache.at < REMOTE_CACHE_MS) {
+    return remoteCache.info;
+  }
   const base = await readVersionInfo({ manifestPath: options.manifestPath });
-  const repo = parseRepository((await readManifest(options.manifestPath ?? manifestPath())).repository);
+  const repo = parseRepository((await loadManifest(options.manifestPath)).repository);
   if (repo === void 0) {
     return { ...base, checkedRemote: false, error: "repository is not configured" };
   }
   const fetchFn = options.fetchFn ?? fetch;
   try {
     const response = await fetchFn(`https://api.github.com/repos/${repo.owner}/${repo.repo}/releases/latest`, {
-      headers: { accept: "application/vnd.github+json", "user-agent": "dsh-git-panel" }
+      headers: { accept: "application/vnd.github+json", "user-agent": "dsh-git-panel" },
+      signal: AbortSignal.timeout(5e3)
     });
     if (!response.ok) {
       return { ...base, checkedRemote: true, error: `GitHub responded with ${response.status}` };
@@ -897,13 +1072,15 @@ async function checkLatestVersion(options = {}) {
       return { ...base, checkedRemote: true, error: "GitHub response did not include a release tag" };
     }
     const latest = tag.replace(/^v/i, "");
-    return {
+    const info = {
       ...base,
       checkedRemote: true,
       latest,
       updateAvailable: compareVersions(latest, base.current) > 0,
-      releaseUrl: htmlUrl ?? `${base.repositoryUrl ?? ""}/releases/latest`
+      releaseUrl: safeReleaseUrl(htmlUrl) ?? (base.repositoryUrl !== void 0 ? `${base.repositoryUrl}/releases/latest` : void 0)
     };
+    if (options.manifestPath === void 0 && options.fetchFn === void 0) remoteCache = { at: Date.now(), info };
+    return info;
   } catch (error) {
     return { ...base, checkedRemote: true, error: error instanceof Error ? error.message : "Unable to reach GitHub" };
   }
@@ -924,27 +1101,25 @@ var GitPanelService = class extends (_a = TypertRemoteService, _snapshot_dec = [
   }
   buildDeps(ctx, config) {
     const rootCache = /* @__PURE__ */ new Map();
+    const rootNegCache = /* @__PURE__ */ new Map();
     const get = (key) => ctx.get(key);
+    const fs = {
+      realpath,
+      stat: async (p) => stat(p),
+      readFile: readFile3,
+      remove: async (p) => {
+        await rm(p, { force: true });
+      }
+    };
     const subprocess = get("subprocess");
-    if (subprocess === void 0) {
-      return {
-        run: { run: async () => {
-          throw new Error("subprocess service unavailable");
-        } },
-        fs: { realpath, stat: async (p) => stat(p), readFile: readFile3, remove: async (p) => {
-          await rm(p, { force: true });
-        } },
-        sessions: { liveCwd: () => void 0, persistedMeta: async () => void 0 },
-        rootCache
-      };
-    }
+    const run = subprocess === void 0 ? { run: async () => {
+      throw new Error("subprocess service unavailable");
+    } } : createGitRunner(subprocess, config.timeoutMs, config.maxBytes);
     const sessions = get("sessions");
     const persistence = get("sessionPersistence");
     return {
-      run: createGitRunner(subprocess, config.timeoutMs, config.maxBytes),
-      fs: { realpath, stat: async (p) => stat(p), readFile: readFile3, remove: async (p) => {
-        await rm(p, { force: true });
-      } },
+      run,
+      fs,
       sessions: {
         liveCwd: (id) => sessions?.get(id)?.header?.cwd,
         persistedMeta: async (id) => {
@@ -957,7 +1132,8 @@ var GitPanelService = class extends (_a = TypertRemoteService, _snapshot_dec = [
           }
         }
       },
-      rootCache
+      rootCache,
+      rootNegCache
     };
   }
   async snapshot(request, signal) {
@@ -970,7 +1146,11 @@ var GitPanelService = class extends (_a = TypertRemoteService, _snapshot_dec = [
     return runQuery(this.withSignal(signal), this.liveConfig(), request);
   }
   async version(request) {
-    return request.check === true ? checkLatestVersion() : readVersionInfo();
+    try {
+      return request.check === true ? await checkLatestVersion() : await readVersionInfo();
+    } catch (error) {
+      return { current: "0.0.0", updateAvailable: false, checkedRemote: false, error: error instanceof Error ? error.message : "version unavailable" };
+    }
   }
   /** Re-read config so a live-edited volatile field (showInputPill) is current. */
   liveConfig() {