@xiaoming_z/dsh-git 0.0.0-stage → 0.3.0

package/test/host.test.mjs

@@ -0,0 +1,817 @@
+/**
+ * Host-half end-to-end test.
+ *
+ * Builds its own fixture repository (including a real merge conflict), mounts
+ * the plugin over a fake `ctx`, and drives the real route handler with fake
+ * `req`/`res` objects. Run: `node test/host.test.mjs`
+ */
+import { apply, splitHunks, parseNumstat, parseNameStatus } from '../index.js'
+import { execFileSync } from 'node:child_process'
+import { mkdtempSync, writeFileSync, realpathSync, statSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { createServer } from 'node:http'
+
+// ---- hermetic fixture -------------------------------------------------------
+// realpath matters: on macOS /var is a symlink into /private, and the allowlist
+// comparison canonicalizes both sides.
+const repo = realpathSync(mkdtempSync(join(tmpdir(), 'gitfix-')))
+const git = (...args) => execFileSync('git', args, { cwd: repo, encoding: 'utf8' })
+git('init', '-q', '-b', 'main')
+git('config', 'user.email', 't@e.com')
+git('config', 'user.name', 'T')
+writeFileSync(join(repo, 'a.txt'), 'base\n')
+writeFileSync(join(repo, 'b.txt'), 'bee\n')
+git('add', '-A')
+git('commit', '-qm', 'base')
+git('checkout', '-qb', 'feature')
+writeFileSync(join(repo, 'a.txt'), 'feature side\n')
+git('commit', '-qam', 'feature change')
+git('checkout', '-q', 'main')
+writeFileSync(join(repo, 'a.txt'), 'main side\n')
+git('commit', '-qam', 'main change')
+try {
+  git('merge', 'feature')
+} catch {
+  /* the conflict IS the fixture */
+}
+writeFileSync(join(repo, 'untracked.txt'), 'u\n')
+// A remote-tracking ref and its symbolic HEAD, so the branch split is exercised
+// on both shapes: `origin/HEAD` is a pointer, not a branch, and must be dropped.
+git('remote', 'add', 'origin', '/nonexistent-remote')
+git('update-ref', 'refs/remotes/origin/main', 'HEAD')
+try {
+  git('symbolic-ref', 'refs/remotes/origin/HEAD', 'refs/remotes/origin/main')
+} catch {
+  /* older git: the symbolic HEAD simply will not exist */
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+
+// ---- mount ------------------------------------------------------------------
+const routes = []
+const ctx = {
+  effect: (fn) => fn(),
+  webServer: {
+    register: (route) => {
+      routes.push(route)
+      return () => {}
+    },
+  },
+  logger: { warn: () => {}, info: () => {} },
+}
+apply(ctx, { allowedRoots: [repo] })
+
+/**
+ * Drive the mounted route handler.
+ * @param path - request URL.
+ * @param options - method, JSON body, and extra headers.
+ * @returns the decoded response.
+ */
+function call(path, { method = 'GET', body, headers = {} } = {}, routeList = routes) {
+  return new Promise((resolve, reject) => {
+    const chunks = body === undefined ? [] : [Buffer.from(JSON.stringify(body))]
+    const req = {
+      method,
+      url: path,
+      headers,
+      on(event, fn) {
+        if (event === 'data') for (const chunk of chunks) queueMicrotask(() => fn(chunk))
+        if (event === 'end') queueMicrotask(() => queueMicrotask(() => fn()))
+        return this
+      },
+      destroy() {},
+    }
+    const res = {
+      status: null,
+      writeHead(status) {
+        this.status = status
+      },
+      end(payload) {
+        try {
+          resolve({ status: this.status, body: JSON.parse(payload) })
+        } catch (error) {
+          reject(error)
+        }
+      },
+    }
+    routeList[0].handler(req, res)
+  })
+}
+
+const q = encodeURIComponent(repo)
+let failures = 0
+const check = (label, cond, extra = '') => {
+  console.log(`${cond ? 'PASS' : 'FAIL'}  ${label}${extra ? '  — ' + extra : ''}`)
+  if (!cond) failures += 1
+}
+
+console.log('routes:', routes.map((route) => `${route.kind} ${route.path}`).join(', '))
+
+let response = await call('/git-api/health')
+check('health', response.status === 200 && response.body.ok)
+
+response = await call(`/git-api/status?root=${q}`)
+const initial = response.body.data
+check(
+  'status exposes branch + conflicted file',
+  response.status === 200 && initial.branch.head === 'main' && initial.conflicted.length === 1,
+  `head=${initial.branch.head} conflicted=${initial.conflicted.map((file) => file.path)}`,
+)
+check(
+  'untracked entries carry the same field set as every other kind',
+  initial.untracked.length === 1 &&
+    initial.untracked[0].origPath === null &&
+    'index' in initial.untracked[0] &&
+    'worktree' in initial.untracked[0],
+  JSON.stringify(initial.untracked[0]),
+)
+
+response = await call('/git-api/status')
+check(
+  'omitted root falls back to defaultRoot (cwd) and the allowlist rejects it',
+  response.status === 400 && /outside allowedRoots/.test(response.body.error),
+)
+
+response = await call(`/git-api/status?root=${encodeURIComponent('/etc')}`)
+check('allowlist rejects /etc', response.status === 400 && /outside allowedRoots/.test(response.body.error))
+
+response = await call(`/git-api/status?root=${encodeURIComponent('/nope/nope')}`)
+check('nonexistent path rejected', response.status === 400 && /ENOENT/.test(response.body.error))
+
+response = await call(`/git-api/log?root=${q}&limit=50`)
+const commits = response.body.data.commits
+check(
+  'log parses every commit with no leading-newline damage',
+  response.status === 200 && commits.length === 2 && commits.every((commit) => /^[0-9a-f]{40}$/.test(commit.hash)),
+  `${commits.length} commits: ${commits.map((commit) => commit.subject).join(' | ')}`,
+)
+check(
+  'log keeps parents (graph needs them)',
+  commits.every((commit) => Array.isArray(commit.parents)),
+  `parents: ${commits.map((commit) => commit.parents.length).join(',')}`,
+)
+
+response = await call(`/git-api/branches?root=${q}`)
+const branchData = response.body.data ?? {}
+check(
+  'branches splits local from remote and marks HEAD',
+  response.status === 200 &&
+    branchData.head === 'main' &&
+    (branchData.local ?? []).some((branch) => branch.current && branch.name === 'main') &&
+    (branchData.local ?? []).some((branch) => branch.name === 'feature'),
+  JSON.stringify(response.body).slice(0, 200),
+)
+check(
+  'remote-tracking refs are split by remote, and the symbolic origin/HEAD is dropped',
+  (branchData.remote ?? []).length === 1 &&
+    branchData.remote[0].remote === 'origin' &&
+    branchData.remote[0].branch === 'main' &&
+    !(branchData.remote ?? []).some((branch) => branch.name.endsWith('/HEAD')),
+  JSON.stringify(branchData.remote),
+)
+
+// Walking a branch other than HEAD is what makes the branch column clickable.
+response = await call(`/git-api/log?root=${q}&ref=feature`)
+check(
+  'log accepts a ref and walks that branch',
+  response.status === 200 && response.body.data.ref === 'feature' && response.body.data.commits[0].subject === 'feature change',
+  `ref=${response.body.data?.ref} head=${response.body.data?.commits?.[0]?.subject}`,
+)
+response = await call(`/git-api/log?root=${q}&ref=--all`)
+check(
+  'a ref that looks like an option is rejected rather than reaching git',
+  response.status === 200 && response.body.data.ref === '--all' && response.body.data.commits[0].subject === 'main change',
+  'fell back to HEAD',
+)
+
+response = await call(`/git-api/diff?root=${q}&file=a.txt`)
+check(
+  'unstaged diff returns conflict markers for the conflicted file',
+  response.status === 200 && /<<<<<<<|=======/.test(response.body.data.text),
+  `${response.body.data.text.length} chars`,
+)
+
+response = await call(`/git-api/diff?root=${q}&staged=1`)
+check('staged diff accepted', response.status === 200 && response.body.data.staged === true)
+
+// ---- commit detail (the click-a-commit interaction) -------------------------
+response = await call(`/git-api/commit?root=${q}&hash=HEAD`)
+const detail = response.body.data
+check(
+  'commit detail returns the header',
+  response.status === 200 && detail.commit.subject === 'main change' && /^[0-9a-f]{40}$/.test(detail.commit.hash),
+  `subject=${detail.commit.subject}`,
+)
+check(
+  'commit detail lists changed files with status',
+  detail.files.length === 1 && detail.files[0].status === 'M' && detail.files[0].path === 'a.txt',
+  JSON.stringify(detail.files),
+)
+
+response = await call(`/git-api/commit?root=${q}&hash=HEAD~1`)
+check(
+  'commit detail parses a multi-file commit',
+  response.status === 200 && response.body.data.files.length === 2,
+  JSON.stringify(response.body.data.files.map((file) => file.status + ':' + file.path)),
+)
+
+response = await call(`/git-api/show?root=${q}&hash=HEAD`)
+check(
+  'show returns the patch for a commit',
+  response.status === 200 && /main side/.test(response.body.data.text) && /^\+main side/m.test(response.body.data.text),
+  `${response.body.data.text.length} chars`,
+)
+
+response = await call(`/git-api/show?root=${q}&hash=HEAD&file=a.txt`)
+check('show accepts a pathspec', response.status === 200 && response.body.data.text.length > 0)
+
+response = await call('/git-api/bogus')
+check('unknown GET route -> 404', response.status === 404)
+
+// ---- write protection -------------------------------------------------------
+response = await call('/git-api/stage', { method: 'POST', body: { root: repo, files: ['a.txt'] } })
+check(
+  'a write without the custom header is refused (cross-site protection)',
+  response.status === 400 && /cross-site/.test(response.body.error),
+  response.body.error,
+)
+
+response = await call('/git-api/stage', { method: 'GET' })
+check('GET on a write route -> 404 (no such read route)', response.status === 404)
+
+response = await call('/git-api/health', { method: 'DELETE' })
+check('unsupported method -> 405', response.status === 405)
+
+const write = { headers: { 'x-dsh-git': '1' } }
+
+response = await call('/git-api/stage', {
+  method: 'POST',
+  ...write,
+  body: { root: repo, files: ['untracked.txt'] },
+})
+check('stage accepts a write with the header', response.status === 200 && response.body.ok === true, response.body.error)
+
+response = await call(`/git-api/status?root=${q}`)
+check(
+  'the write invalidated the cache immediately (no watcher wait)',
+  response.body.data.staged.some((file) => file.path === 'untracked.txt'),
+  `staged: ${response.body.data.staged.map((file) => file.path).join(',')}`,
+)
+
+response = await call('/git-api/unstage', {
+  method: 'POST',
+  ...write,
+  body: { root: repo, files: ['untracked.txt'] },
+})
+check('unstage accepts a write with the header', response.status === 200, response.body.error)
+
+response = await call(`/git-api/status?root=${q}`)
+check(
+  'unstage put the new file back to untracked',
+  response.body.data.untracked.some((file) => file.path === 'untracked.txt') &&
+    !response.body.data.staged.some((file) => file.path === 'untracked.txt'),
+)
+
+response = await call('/git-api/stage', { method: 'POST', ...write, body: { root: repo, files: [] } })
+check('an empty file list is refused', response.status === 400 && /non-empty/.test(response.body.error))
+
+response = await call('/git-api/commit', { method: 'POST', ...write, body: { root: repo, message: '   ' } })
+check('an empty commit message is refused', response.status === 400 && /must not be empty/.test(response.body.error))
+
+// resolve the conflict and commit through the API
+response = await call('/git-api/stage', { method: 'POST', ...write, body: { root: repo, files: ['a.txt'] } })
+check('stage resolves the conflicted path', response.status === 200, response.body.error)
+
+response = await call('/git-api/commit', {
+  method: 'POST',
+  ...write,
+  body: { root: repo, message: 'resolve the merge' },
+})
+check(
+  'commit through the API returns the new short hash',
+  response.status === 200 && /^[0-9a-f]{7,}$/.test(response.body.data.hash ?? ''),
+  `hash=${response.body.data?.hash} ${response.body.error ?? ''}`,
+)
+
+response = await call(`/git-api/log?root=${q}&limit=5`)
+check(
+  'the new commit is visible immediately',
+  response.body.data.commits[0].subject === 'resolve the merge',
+  `head=${response.body.data.commits[0].subject}`,
+)
+
+response = await call(`/git-api/commit?root=${q}&hash=HEAD`)
+check(
+  'a merge commit lists the conflicting file',
+  response.status === 200 && response.body.data.files.some((file) => file.path === 'a.txt'),
+  JSON.stringify(response.body.data.files),
+)
+
+response = await call('/git-api/commit', { method: 'POST', ...write, body: { root: repo, message: 'nothing staged' } })
+check(
+  'committing with nothing staged surfaces the git diagnostic',
+  // git prints this one on stdout, not stderr — the reason the error path
+  // checks both streams.
+  response.status === 400 && /nothing (?:added to |to )?commit|no changes/i.test(response.body.error),
+  response.body.error,
+)
+
+// ---- untracked files --------------------------------------------------------
+response = await call(`/git-api/diff?root=${q}&untracked=1&file=untracked.txt`)
+check(
+  'an untracked file gets a synthesised all-added diff',
+  response.status === 200 && /^\+u$/m.test(response.body.data.text) && response.body.data.untracked === true,
+  response.body.error ?? `${response.body.data?.text?.length} chars`,
+)
+response = await call(`/git-api/diff?root=${q}&untracked=1&file=nope.txt`)
+check('an untracked diff for a missing path is refused', response.status === 400 && /does not exist/.test(response.body.error), response.body.error)
+response = await call(`/git-api/diff?root=${q}&untracked=1&file=../../etc/hosts`)
+check('an untracked diff cannot escape the repository', response.status === 400 && /outside the repository/.test(response.body.error), response.body.error)
+
+// A CJK filename must come back readable, not as git's default octal escapes.
+writeFileSync(join(repo, '中文 文件名.txt'), '内容\n')
+response = await call(`/git-api/diff?root=${q}&untracked=1&file=${encodeURIComponent('中文 文件名.txt')}`)
+check(
+  'a non-ASCII path is not octal-escaped in the diff header',
+  response.status === 200 && response.body.data.text.includes('中文 文件名.txt') && !/\\3[0-7][0-7]/.test(response.body.data.text),
+  response.body.data?.text?.split('\n')[0]?.slice(0, 90),
+)
+
+// ---- hunk-level staging -----------------------------------------------------
+const hunkLines = Array.from({ length: 40 }, (_, i) => `line ${i}`)
+writeFileSync(join(repo, 'hunks.txt'), hunkLines.join('\n') + '\n')
+git('add', 'hunks.txt')
+git('commit', '-qm', 'add hunks file')
+hunkLines[2] = 'line 2 CHANGED'
+hunkLines[30] = 'line 30 CHANGED'
+writeFileSync(join(repo, 'hunks.txt'), hunkLines.join('\n') + '\n')
+
+response = await call(`/git-api/diff?root=${q}&file=hunks.txt`)
+const split = splitHunks(response.body.data.text)
+check('two separated edits produce two hunks', split.hunks.length === 2, `${split.hunks.length} hunks`)
+
+response = await call('/git-api/hunks', {
+  method: 'POST',
+  ...write,
+  body: { root: repo, file: 'hunks.txt', hunks: [0] },
+})
+check('staging a single hunk succeeds', response.status === 200, response.body.error)
+
+const stagedHunks = (await call(`/git-api/diff?root=${q}&file=hunks.txt&staged=1`)).body.data.text
+check(
+  'only the selected hunk reached the index',
+  /line 2 CHANGED/.test(stagedHunks) && !/line 30 CHANGED/.test(stagedHunks),
+  stagedHunks.split('\n').filter((l) => l.startsWith('+')).join(' | '),
+)
+const leftOver = (await call(`/git-api/diff?root=${q}&file=hunks.txt`)).body.data.text
+check(
+  'the unselected hunk is still only in the worktree',
+  /line 30 CHANGED/.test(leftOver) && !/line 2 CHANGED/.test(leftOver),
+  leftOver.split('\n').filter((l) => l.startsWith('+')).join(' | '),
+)
+
+response = await call('/git-api/hunks', {
+  method: 'POST',
+  ...write,
+  body: { root: repo, file: 'hunks.txt', hunks: [0], staged: true },
+})
+check('unstaging that hunk succeeds', response.status === 200, response.body.error)
+check(
+  'the index is clean again for that file',
+  (await call(`/git-api/diff?root=${q}&file=hunks.txt&staged=1`)).body.data.text.trim() === '',
+)
+
+response = await call('/git-api/hunks', {
+  method: 'POST',
+  ...write,
+  body: { root: repo, file: 'hunks.txt', hunks: [7] },
+})
+check('an out-of-range hunk index is refused', response.status === 400 && /out of range/.test(response.body.error), response.body.error)
+
+response = await call('/git-api/hunks', { method: 'POST', ...write, body: { root: repo, file: 'hunks.txt', hunks: [] } })
+check('selecting no hunks is refused', response.status === 400 && /no hunks selected/.test(response.body.error), response.body.error)
+
+writeFileSync(join(repo, 'hunks.txt'), hunkLines.map((l) => l.replace(' CHANGED', '')).join('\n') + '\n')
+
+// ---- checkout and branch creation -------------------------------------------
+response = await call('/git-api/checkout', { method: 'POST', ...write, body: { root: repo, ref: 'feature' } })
+check('checkout switches to an existing branch', response.status === 200, response.body.error)
+response = await call(`/git-api/status?root=${q}`)
+check('the status reflects the new branch', response.body.data.branch.head === 'feature', response.body.data.branch.head)
+
+response = await call('/git-api/checkout', {
+  method: 'POST',
+  ...write,
+  body: { root: repo, ref: 'HEAD', create: 'topic/one' },
+})
+check('a new branch can be created from a start point', response.status === 200, response.body.error)
+response = await call(`/git-api/branches?root=${q}`)
+check(
+  'the new branch exists and is the current one',
+  response.body.data.head === 'topic/one' &&
+    response.body.data.local.some((branch) => branch.name === 'topic/one' && branch.current),
+  `head=${response.body.data.head}`,
+)
+
+response = await call('/git-api/checkout', { method: 'POST', ...write, body: { root: repo, ref: 'HEAD', create: '-x' } })
+check('a branch name that looks like an option is refused', response.status === 400 && /must not start with/.test(response.body.error), response.body.error)
+
+response = await call('/git-api/checkout', { method: 'POST', ...write, body: { root: repo, ref: 'HEAD', create: 'bad..name' } })
+check('git itself rejects an invalid branch name', response.status === 400 && /not a valid branch name/.test(response.body.error), response.body.error)
+
+response = await call('/git-api/checkout', { method: 'POST', ...write, body: { root: repo, ref: '--force' } })
+check('a ref that looks like an option is refused', response.status === 400 && /must not start with/.test(response.body.error), response.body.error)
+
+response = await call('/git-api/checkout', { method: 'POST', ...write, body: { root: repo, ref: '' } })
+check('an empty ref is refused', response.status === 400 && /must not be empty/.test(response.body.error), response.body.error)
+
+response = await call('/git-api/checkout', { method: 'POST', body: { root: repo, ref: 'main' } })
+check('checkout is a write and needs the header', response.status === 400 && /cross-site/.test(response.body.error), response.body.error)
+
+// Back to main so the fixture's later assertions still hold.
+response = await call('/git-api/checkout', { method: 'POST', ...write, body: { root: repo, ref: 'main' } })
+check('checkout back to main', response.status === 200 && response.body.ok, response.body.error)
+
+// ---- pull ------------------------------------------------------------------
+// A local clone of a local repository: `git pull` runs offline against a real
+// remote, so the fetch/merge path is exercised without a network.
+const originRepo = realpathSync(mkdtempSync(join(tmpdir(), 'gitorigin-')))
+const gitOrigin = (...args) => execFileSync('git', args, { cwd: originRepo, encoding: 'utf8' })
+gitOrigin('init', '-q', '-b', 'main')
+gitOrigin('config', 'user.email', 't@e.com')
+gitOrigin('config', 'user.name', 'T')
+writeFileSync(join(originRepo, 'f.txt'), 'one\n')
+gitOrigin('add', '-A')
+gitOrigin('commit', '-qm', 'origin first')
+// A non-bare origin refuses a push to its checked-out branch; the fixture only
+// needs the ref to move.
+gitOrigin('config', 'receive.denyCurrentBranch', 'ignore')
+
+const cloneRepo = realpathSync(mkdtempSync(join(tmpdir(), 'gitclone-')))
+execFileSync('git', ['clone', '-q', originRepo, cloneRepo], { encoding: 'utf8' })
+const gitClone = (...args) => execFileSync('git', args, { cwd: cloneRepo, encoding: 'utf8' })
+const cloneBefore = gitClone('rev-parse', 'HEAD').trim()
+
+const pullRoutes = (() => {
+  const localRoutes = []
+  apply(
+    {
+      effect: (fn) => fn(),
+      webServer: { register: (route) => { localRoutes.push(route); return () => {} } },
+      logger: { warn: () => {}, info: () => {} },
+      get: () => undefined,
+    },
+    { allowedRoots: [cloneRepo] },
+  )
+  return localRoutes
+})()
+
+response = await call('/git-api/pull', { method: 'POST', body: { root: cloneRepo } }, pullRoutes)
+check('pull is a write and needs the header', response.status === 400 && /cross-site/.test(response.body.error), response.body.error)
+
+response = await call('/git-api/pull', { method: 'POST', ...write, body: { root: cloneRepo } }, pullRoutes)
+check(
+  'pulling with nothing new reports no change',
+  response.status === 200 && response.body.data.changed === false,
+  JSON.stringify(response.body.data ?? response.body.error),
+)
+
+// Advance the origin, then pull it into the clone.
+writeFileSync(join(originRepo, 'f.txt'), 'one\ntwo\n')
+gitOrigin('commit', '-qam', 'origin second')
+
+response = await call('/git-api/pull', { method: 'POST', ...write, body: { root: cloneRepo } }, pullRoutes)
+check(
+  'pulling new commits advances HEAD and reports the move',
+  response.status === 200 &&
+    response.body.data.changed === true &&
+    response.body.data.before === cloneBefore.slice(0, 7) &&
+    response.body.data.after === gitClone('rev-parse', 'HEAD').trim().slice(0, 7),
+  `${response.body.data?.before} -> ${response.body.data?.after}`,
+)
+
+response = await call(`/git-api/status?root=${encodeURIComponent(cloneRepo)}`, {}, pullRoutes)
+check('the worktree really received the change', response.body.data.branch.head === 'main')
+
+response = await call(
+  '/git-api/pull',
+  { method: 'POST', ...write, body: { root: cloneRepo, strategy: '--force' } },
+  pullRoutes,
+)
+check(
+  'an unknown strategy is refused rather than reaching git',
+  response.status === 400 && /unknown pull strategy/.test(response.body.error),
+  response.body.error,
+)
+
+response = await call(
+  '/git-api/pull',
+  { method: 'POST', ...write, body: { root: cloneRepo, strategy: 'rebase' } },
+  pullRoutes,
+)
+check('an enumerated strategy is accepted', response.status === 200 && response.body.data.strategy === 'rebase', response.body.error)
+
+// A remote that demands credentials must fail immediately. Without
+// GIT_TERMINAL_PROMPT=0 git would wait for input it can never receive, and the
+// only thing that would end the request is the 180s network timeout.
+const authServer = createServer((request, response) => {
+  response.writeHead(401, { 'www-authenticate': 'Basic realm="test"' })
+  response.end('auth required')
+})
+await new Promise((resolve) => authServer.listen(0, '127.0.0.1', resolve))
+const authPort = authServer.address().port
+try {
+  gitClone('remote', 'add', 'auth', `http://127.0.0.1:${authPort}/repo.git`)
+  gitClone('config', 'branch.main.remote', 'auth')
+  gitClone('config', 'branch.main.merge', 'refs/heads/main')
+  const startedAt = Date.now()
+  response = await call('/git-api/pull', { method: 'POST', ...write, body: { root: cloneRepo } }, pullRoutes)
+  const elapsedMs = Date.now() - startedAt
+  check(
+    'a credential prompt fails fast instead of hanging until the timeout',
+    response.status === 400 && elapsedMs < 20_000 && /prompts disabled|Authentication failed|could not read/i.test(response.body.error),
+    `${elapsedMs}ms — ${(response.body.error ?? '').split('\n')[0]}`,
+  )
+} finally {
+  authServer.close()
+  gitClone('config', 'branch.main.remote', 'origin')
+  gitClone('config', 'branch.main.merge', 'refs/heads/main')
+}
+
+// ---- push -------------------------------------------------------------------
+response = await call('/git-api/push', { method: 'POST', body: { root: cloneRepo } }, pullRoutes)
+check('push is a write and needs the header', response.status === 400 && /cross-site/.test(response.body.error), response.body.error)
+
+writeFileSync(join(cloneRepo, 'f.txt'), 'one\ntwo\nlocal\n')
+gitClone('commit', '-qam', 'local commit')
+response = await call('/git-api/push', { method: 'POST', ...write, body: { root: cloneRepo } }, pullRoutes)
+check(
+  'pushing a local commit moves the upstream and reports the change',
+  response.status === 200 && response.body.data.changed === true,
+  JSON.stringify(response.body.data ?? response.body.error),
+)
+check('the remote really received it', gitOrigin('log', '-1', '--format=%s').trim() === 'local commit')
+
+response = await call('/git-api/push', { method: 'POST', ...write, body: { root: cloneRepo } }, pullRoutes)
+check(
+  'pushing with nothing new reports no change',
+  response.status === 200 && response.body.data.changed === false,
+  `changed=${response.body.data?.changed} output=${JSON.stringify(response.body.data?.output?.trim())}`,
+)
+
+// A branch with no upstream cannot be pushed until it is published.
+gitClone('checkout', '-q', '-b', 'topic/push')
+writeFileSync(join(cloneRepo, 'g.txt'), 'g\n')
+gitClone('add', '-A')
+gitClone('commit', '-qm', 'topic commit')
+response = await call('/git-api/push', { method: 'POST', ...write, body: { root: cloneRepo } }, pullRoutes)
+check(
+  'a branch without an upstream fails with git\'s own guidance',
+  response.status === 400 && /no upstream branch|set-upstream/i.test(response.body.error),
+  (response.body.error ?? '').split('\n')[0],
+)
+
+response = await call(
+  '/git-api/push',
+  { method: 'POST', ...write, body: { root: cloneRepo, setUpstream: true } },
+  pullRoutes,
+)
+check(
+  'publishing a branch sets its upstream',
+  response.status === 200 && response.body.data.published === true && response.body.data.changed === true,
+  JSON.stringify(response.body.data ?? response.body.error),
+)
+check(
+  'the branch now tracks the remote',
+  gitClone('rev-parse', '--abbrev-ref', '@{upstream}').trim() === 'origin/topic/push',
+  gitClone('rev-parse', '--abbrev-ref', '@{upstream}').trim(),
+)
+check('the remote received the new branch', gitOrigin('branch', '--format=%(refname:short)').includes('topic/push'))
+
+// A detached HEAD has no branch to push.
+gitClone('checkout', '-q', '--detach')
+response = await call('/git-api/push', { method: 'POST', ...write, body: { root: cloneRepo } }, pullRoutes)
+check('a detached HEAD is refused', response.status === 400 && /detached/.test(response.body.error), response.body.error)
+gitClone('checkout', '-q', 'main')
+
+// ---- review since a marker --------------------------------------------------
+// Two commits plus an uncommitted edit, so the review has to cover both.
+git('checkout', '-q', 'main')
+const reviewMarker = git('rev-parse', 'HEAD').trim()
+writeFileSync(join(repo, 'a.txt'), 'review one\n')
+git('add', 'a.txt')
+git('commit', '-qm', 'reviewed commit one')
+writeFileSync(join(repo, 'rev.txt'), 'r\n')
+git('add', 'rev.txt')
+git('commit', '-qm', 'reviewed commit two')
+writeFileSync(join(repo, 'a.txt'), 'review one\nUNCOMMITTED\n')
+
+response = await call(`/git-api/review?root=${q}&since=${reviewMarker}`)
+const review = response.body.data
+check('review resolves against a marker', response.status === 200, response.body.error)
+check('review reports the commits since the marker', review.commits.length === 2, `${review.commits.length} commits`)
+check(
+  'review counts committed and uncommitted files together',
+  review.files.length === 2 && review.files.some((file) => file.path === 'rev.txt') && review.files.some((file) => file.path === 'a.txt'),
+  JSON.stringify(review.files.map((file) => `${file.status}:${file.path}`)),
+)
+check(
+  'review totals add up',
+  review.totals.files === 2 && review.totals.added >= 2,
+  JSON.stringify(review.totals),
+)
+check('review echoes the head it observed', /^[0-9a-f]{7,}$/.test(review.head), review.head)
+
+response = await call(`/git-api/diff?root=${q}&file=a.txt&since=${reviewMarker}`)
+check(
+  'a single file can be diffed against the marker',
+  response.status === 200 && response.body.data.text.includes('UNCOMMITTED'),
+  `${response.body.data?.text?.length} chars`,
+)
+
+response = await call(`/git-api/review?root=${q}`)
+check('review without a marker is refused', response.status === 400 && /since marker/.test(response.body.error), response.body.error)
+response = await call(`/git-api/review?root=${q}&since=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef`)
+check(
+  'a marker that no longer resolves is reported rather than looking empty',
+  response.status === 400 && /unknown revision|bad object|Not a valid object|Needed a single revision/i.test(response.body.error),
+  (response.body.error ?? '').split('\n')[0],
+)
+
+// The parsers are the fiddly part; pin their shapes directly.
+check(
+  'numstat parses an ordinary record',
+  JSON.stringify(parseNumstat('3\t1\tsrc/a.js\0')) === JSON.stringify([{ path: 'src/a.js', origPath: null, added: 3, deleted: 1, binary: false }]),
+)
+check(
+  'numstat parses a rename (empty path field, then both paths)',
+  JSON.stringify(parseNumstat('1\t1\t\0old.js\0new.js\0')) ===
+    JSON.stringify([{ path: 'new.js', origPath: 'old.js', added: 1, deleted: 1, binary: false }]),
+)
+check(
+  'numstat marks a binary file',
+  JSON.stringify(parseNumstat('-\t-\tlogo.png\0')) ===
+    JSON.stringify([{ path: 'logo.png', origPath: null, added: null, deleted: null, binary: true }]),
+)
+check(
+  'numstat keeps a path that itself contains a tab',
+  parseNumstat('1\t0\tweird\tname.txt\0')[0].path === 'weird\tname.txt',
+  parseNumstat('1\t0\tweird\tname.txt\0')[0].path,
+)
+check(
+  'name-status parses a rename',
+  parseNameStatus('R100\0old.js\0new.js\0').get('new.js').origPath === 'old.js',
+)
+check('name-status parses a plain change', parseNameStatus('M\0a.js\0').get('a.js').status === 'M')
+
+// Leave a clean worktree: later assertions measure unstaged changes.
+git('checkout', '--', 'a.txt')
+
+// ---- registered workspaces extend the allowlist ------------------------------
+// The panel follows the session's repository, which is usually outside
+// `allowedRoots`. Rather than widening that to every path, the host also trusts
+// directories the harness itself has registered as workspaces.
+const otherRepo = realpathSync(mkdtempSync(join(tmpdir(), 'gitws-')))
+const gitOther = (...args) => execFileSync('git', args, { cwd: otherRepo, encoding: 'utf8' })
+gitOther('init', '-q', '-b', 'main')
+gitOther('config', 'user.email', 't@e.com')
+gitOther('config', 'user.name', 'T')
+writeFileSync(join(otherRepo, 'x.txt'), 'x\n')
+gitOther('add', '-A')
+gitOther('commit', '-qm', 'base')
+
+response = await call(`/git-api/status?root=${encodeURIComponent(otherRepo)}`)
+check(
+  'a repository outside allowedRoots is still refused without a workspace entry',
+  response.status === 400 && /not a known workspace/.test(response.body.error),
+  response.body.error,
+)
+
+/** Mount a second instance with its own route table and a workspace registry. */
+function mountWith(registry) {
+  const localRoutes = []
+  const localCtx = {
+    effect: (fn) => fn(),
+    webServer: {
+      register: (route) => {
+        localRoutes.push(route)
+        return () => {}
+      },
+    },
+    logger: { warn: () => {}, info: () => {} },
+    get: (name) => (name === 'workspaceRegistry' ? registry : undefined),
+  }
+  apply(localCtx, { allowedRoots: ['/definitely-not-a-repo'] })
+  return localRoutes
+}
+
+const withRegistry = mountWith({ list: () => [{ path: otherRepo }] })
+response = await call(`/git-api/status?root=${encodeURIComponent(otherRepo)}`, {}, withRegistry)
+check(
+  'a registered workspace is trusted even when allowedRoots excludes it',
+  response.status === 200 && response.body.data.branch.head === 'main',
+  response.body.error ?? `head=${response.body.data?.branch?.head}`,
+)
+
+const wrongNameRegistry = (() => {
+  const localRoutes = []
+  apply(
+    {
+      effect: (fn) => fn(),
+      webServer: { register: (route) => { localRoutes.push(route); return () => {} } },
+      logger: { warn: () => {}, info: () => {} },
+      get: (name) => (name === 'workspace' ? { list: () => [{ path: otherRepo }] } : undefined),
+    },
+    { allowedRoots: ['/definitely-not-a-repo'] },
+  )
+  return localRoutes
+})()
+response = await call(`/git-api/status?root=${encodeURIComponent(otherRepo)}`, {}, wrongNameRegistry)
+check(
+  'the registry is looked up under its real service name',
+  response.status === 400,
+  'a registry exposed only under a guessed name must not be consulted',
+)
+
+const withoutRegistry = mountWith(undefined)
+response = await call(`/git-api/status?root=${encodeURIComponent(otherRepo)}`, {}, withoutRegistry)
+check(
+  'no registry means the workspace entry is simply absent',
+  response.status === 400,
+  response.body.error,
+)
+
+const throwingRegistry = mountWith({ list: () => { throw new Error('registry unavailable') } })
+response = await call(`/git-api/status?root=${encodeURIComponent(otherRepo)}`, {}, throwingRegistry)
+check(
+  'a throwing workspace registry does not take the route down',
+  response.status === 400 && /not a known workspace/.test(response.body.error),
+  response.body.error,
+)
+
+// ---- watcher-driven invalidation (out-of-band writes) -----------------------
+const before = (await call(`/git-api/status?root=${q}`)).body.data
+writeFileSync(join(repo, 'a.txt'), 'changed outside the panel\n')
+await sleep(400)
+const after = (await call(`/git-api/status?root=${q}`)).body.data
+check(
+  'watcher drops the cached status after an out-of-band worktree write',
+  before.unstaged.length === 0 && after.unstaged.length === 1,
+  `unstaged ${before.unstaged.length}->${after.unstaged.length}`,
+)
+
+// ---- a linked worktree keeps its git directory in a FILE --------------------
+// `<worktree>/.git` is a one-line pointer to `<repo>/.git/worktrees/<name>`, and
+// it never changes. Watching THAT file means a checkout in the worktree goes
+// unnoticed and the cache keeps serving the old branch forever — which is
+// exactly what the composer chip reads.
+const linkedRoot = realpathSync(mkdtempSync(join(tmpdir(), 'gitwt-')))
+const linked = join(linkedRoot, 'wt')
+execFileSync('git', ['worktree', 'add', '-q', linked, '-b', 'linked-work'], { cwd: repo })
+check(
+  'the fixture really is a linked worktree',
+  statSync(join(linked, '.git')).isFile(),
+  'a linked worktree keeps .git as a file',
+)
+const linkedRoutes = []
+apply(
+  {
+    effect: (fn) => fn(),
+    webServer: { register: (route) => { linkedRoutes.push(route); return () => {} } },
+    logger: { warn: () => {}, info: () => {} },
+  },
+  { allowedRoots: [linkedRoot] },
+)
+const linkedRoute = linkedRoutes.find((route) => route.path === '/git-api')
+const callLinked = (path) =>
+  new Promise((resolve) => {
+    const req = {
+      method: 'GET',
+      url: path,
+      headers: {},
+      on(event, fn) {
+        if (event === 'end') queueMicrotask(() => fn())
+        return this
+      },
+    }
+    const res = { writeHead() {}, end(body) { resolve({ status: 200, body: JSON.parse(body) }) } }
+    linkedRoute.handler(req, res)
+  })
+const linkedQ = encodeURIComponent(linked)
+const linkedBefore = (await callLinked(`/git-api/branches?root=${linkedQ}`)).body.data
+execFileSync('git', ['checkout', '-q', '-b', 'linked-other'], { cwd: linked })
+await sleep(400)
+const linkedAfter = (await callLinked(`/git-api/branches?root=${linkedQ}`)).body.data
+check(
+  'a linked worktree reports its branch before the switch',
+  linkedBefore.head === 'linked-work',
+  String(linkedBefore.head),
+)
+check(
+  'a checkout inside a linked worktree drops the cache',
+  linkedAfter.head === 'linked-other',
+  String(linkedAfter.head),
+)
+
+console.log(failures === 0 ? '\nALL PASS' : `\n${failures} FAILURE(S)`)
+process.exit(failures === 0 ? 0 : 1)