@young1lin/dsh-ui-gitworkbench 0.1.13 → 0.1.15

package/lib/index.js

@@ -89,6 +89,7 @@ import { NETWORK_GRACE_MS, NON_INTERACTIVE_ENV, capBranches, classifyFailure, cl
 import { planFromStatus, } from './discard-ops.js';
 import { parseBlame } from './blame.js';
 import { removePathInside } from './fs-remove.js';
+import { resolveRepoRoot, rootedDir } from './repo-root.js';
 import { diffTooLarge, targetTooLarge, SIDE_BYTE_CAP, SIDE_LINE_CAP } from './side-guard.js';
 import { IMAGE_BYTE_CAP, sniffImage } from './image-sniff.js';
 import { LOG_FORMAT, parseLog } from './git-log.js';
@@ -401,10 +402,20 @@ let GitWorkbenchService = (() => {
             // the browser. The tree and the counters need only `status` and
             // `--numstat`, both of which stay around 110-140ms at that size, and the
             // pane already fetches the file it is actually showing through `fileDiff`.
-            const [statusInfo, numstat, revInfo] = await Promise.all([
+            // The fourth read resolves where the rest of this method must run: the
+            // repository ROOT. The paths this method handles are repository-relative
+            // (that is what porcelain status prints wherever it runs), so the
+            // untracked files read below must be joined against the root — a session
+            // opened at `repo/server` would otherwise look for `repo/server/server/f`.
+            // The three git reads themselves are cwd-INSENSITIVE (their output names
+            // paths from the repository root whatever directory they run in), so they
+            // stay on the session's own directory and the root resolve rides along in
+            // the same batch: the polled call pays for it in wall time not at all.
+            const [statusInfo, numstat, revInfo, root] = await Promise.all([
                 this.git(cwd, ['status', '--porcelain=v1', '--branch', '--untracked-files=all'], signal),
                 this.git(cwd, ['diff', 'HEAD', '--numstat'], signal),
                 this.git(cwd, ['rev-parse', '--abbrev-ref', 'HEAD'], signal),
+                this.rootedDirOf(worktreePath, signal),
             ]);
             if (statusInfo.exitCode !== 0) {
                 const detail = statusInfo.stderr.length > 0 ? `: ${statusInfo.stderr}` : '';
@@ -418,7 +429,7 @@ let GitWorkbenchService = (() => {
             // segments into the payload — is gone with the payload itself; `fileDiff`
             // synthesizes the one segment the reader has actually opened.
             const untracked = files.filter(file => file.status === 'untracked');
-            const measured = await mapPooled(untracked, UNTRACKED_READ_CONCURRENCY, file => measureUntracked(cwd, file.path));
+            const measured = await mapPooled(untracked, UNTRACKED_READ_CONCURRENCY, file => measureUntracked(root, file.path));
             for (const [index, file] of untracked.entries()) {
                 const measure = measured[index];
                 file.addedLines = measure.lineCount;
@@ -485,41 +496,46 @@ let GitWorkbenchService = (() => {
          * Plain-identifier params, signal last.
          */
         async fileDiff(worktreePath, path, commit, base, head, signal) {
-            const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd();
             if (typeof path !== 'string' || path.length === 0)
                 return { diff: '' };
+            // The repository root, not the session's directory: the pathspec below
+            // is repository-relative, and git resolves pathspecs against the cwd —
+            // from a subdirectory `diff HEAD -- server/f` looks for
+            // `server/server/f`, matches nothing, and reports an EMPTY diff with
+            // exit 0. (repo-root.ts holds the whole story.)
+            const root = await this.rootedDirOf(worktreePath, signal);
             if (typeof base === 'string' && base.length > 0 && typeof head === 'string' && head.length > 0) {
                 if (!isRefName(base) || !isRefName(head))
                     return { diff: '' };
-                const ranged = await this.git(cwd, ['diff', '--no-renames', `${base}...${head}`, '--', path], signal);
+                const ranged = await this.git(root, ['diff', '--no-renames', `${base}...${head}`, '--', path], signal);
                 if (ranged.exitCode === 0)
                     return { diff: ranged.stdout };
                 // Unrelated histories have no merge base for `A...B` to diff from; the
                 // two-tip diff still answers what differs, exactly as `compareRefs` does.
                 if (!isNoMergeBaseError(ranged.stderr))
                     return { diff: '' };
-                const tips = await this.git(cwd, ['diff', '--no-renames', base, head, '--', path], signal);
+                const tips = await this.git(root, ['diff', '--no-renames', base, head, '--', path], signal);
                 return { diff: tips.exitCode === 0 ? tips.stdout : '' };
             }
             if (typeof commit === 'string' && commit.length > 0) {
                 if (!COMMIT_HASH.test(commit))
                     return { diff: '' };
-                const key = cacheKey(cwd, commit, path);
+                const key = cacheKey(root, commit, path);
                 const cached = this.commitDiffCache.get(key);
                 if (cached !== undefined)
                     return { diff: cached };
                 // `--first-parent` for the same reason as in `commitStats`: without it a
                 // merge commit has no diff to show and the pane opens empty.
-                const shown = await this.git(cwd, ['show', commit, '--first-parent', '--format=', '--no-renames', '--', path], signal);
+                const shown = await this.git(root, ['show', commit, '--first-parent', '--format=', '--no-renames', '--', path], signal);
                 if (shown.exitCode !== 0)
                     return { diff: '' };
                 this.commitDiffCache.set(key, shown.stdout);
                 return { diff: shown.stdout };
             }
-            const tracked = await this.git(cwd, ['diff', 'HEAD', '--', path], signal);
+            const tracked = await this.git(root, ['diff', 'HEAD', '--', path], signal);
             if (tracked.stdout.trim().length > 0)
                 return { diff: tracked.stdout };
-            return { diff: await untrackedSegment(cwd, path) ?? '' };
+            return { diff: await untrackedSegment(root, path) ?? '' };
         }
         /**
          * One layer of one file for the side-by-side diff pane: the layer's
@@ -534,7 +550,8 @@ let GitWorkbenchService = (() => {
          * nothing for them and the unstaged layer falls back to the synthesized
          * new-file segment `fileDiff` already uses.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its
+         *                       repository root. Empty falls back to the host cwd.
          * @param path - repository-relative path, as the drawer lists it.
          * @param layer - `unstaged` (index→worktree) or `staged` (HEAD→index).
          * @param signal - abort signal.
@@ -546,18 +563,21 @@ let GitWorkbenchService = (() => {
             if (typeof path !== 'string' || !isSafePathArg(path)) {
                 throw new Error(`unsafe path argument: ${JSON.stringify(path)}`);
             }
-            const cwd = this.cwdOf(worktreePath);
+            // Repository root, not the session's directory: every path below is
+            // repository-relative (pathspecs resolve against the cwd, and so does
+            // the file read for the editor's target). See repo-root.ts.
+            const root = await this.rootedDirOf(worktreePath, signal);
             return layer === 'unstaged'
-                ? await this.unstagedSides(cwd, path, signal)
-                : await this.stagedSides(cwd, path, signal);
+                ? await this.unstagedSides(root, path, signal)
+                : await this.stagedSides(root, path, signal);
         }
         /** The unstaged layer: diff index→worktree, target = the working-tree file. */
-        async unstagedSides(cwd, path, signal) {
+        async unstagedSides(root, path, signal) {
             // Size guard first, off the stat rather than a read: declining a file past
             // the cap must not mean loading a pathological one whole first. Bytes are
             // all a stat knows; the line half of the guard needs the read below.
             try {
-                const info = await stat(join(cwd, path));
+                const info = await stat(join(root, path));
                 if (info.isFile() && targetTooLarge(info.size, 0))
                     return { ...emptySides(), tooLarge: true };
             }
@@ -566,20 +586,20 @@ let GitWorkbenchService = (() => {
             }
             let bytes = null;
             try {
-                bytes = await readFile(join(cwd, path));
+                bytes = await readFile(join(root, path));
             }
             catch {
                 bytes = null;
             }
             if (bytes !== null && isBinaryPrefix(bytes, BINARY_SNIFF_BYTES)) {
-                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(cwd, path, signal) };
+                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(root, path, signal) };
             }
             if (bytes !== null && targetTooLarge(bytes.length, countBufferLines(bytes))) {
                 return { ...emptySides(), tooLarge: true };
             }
-            const diff = await this.layerDiffText(cwd, path, 'unstaged', signal);
+            const diff = await this.layerDiffText(root, path, 'unstaged', signal);
             if (binaryDiffOutput(diff)) {
-                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(cwd, path, signal) };
+                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(root, path, signal) };
             }
             // The diff half of the guard, AFTER the artifact exists: the target-side
             // checks above cannot see a worktree-deleted large file (no target to
@@ -591,7 +611,7 @@ let GitWorkbenchService = (() => {
                 diff,
                 diffSha: sha1Hex(diff),
                 targetText: bytes === null ? '' : bytes.toString('utf8'),
-                targetSha: bytes === null ? '' : await this.worktreeBlobSha(cwd, path, signal),
+                targetSha: bytes === null ? '' : await this.worktreeBlobSha(root, path, signal),
                 binary: false,
                 tooLarge: false,
                 // Only the unstaged layer can report this, and only it needs to: the
@@ -600,11 +620,11 @@ let GitWorkbenchService = (() => {
             };
         }
         /** The staged layer: diff HEAD→index, target = the index blob. */
-        async stagedSides(cwd, path, signal) {
+        async stagedSides(root, path, signal) {
             // `:path` resolves the stage-0 index entry: the target text when it exists,
             // and a failed resolution (no entry) is the empty target, not an error.
-            const shown = await this.git(cwd, ['show', `:${path}`], signal);
-            const sha = (await this.git(cwd, ['rev-parse', '--verify', '--quiet', `:${path}`], signal)).stdout.trim();
+            const shown = await this.git(root, ['show', `:${path}`], signal);
+            const sha = (await this.git(root, ['rev-parse', '--verify', '--quiet', `:${path}`], signal)).stdout.trim();
             const targetText = shown.exitCode === 0 ? shown.stdout : '';
             const targetBytes = Buffer.from(targetText, 'utf8');
             if (targetText.length > 0 && isBinaryPrefix(targetBytes, BINARY_SNIFF_BYTES)) {
@@ -613,7 +633,7 @@ let GitWorkbenchService = (() => {
             if (targetTooLarge(targetBytes.length, countBufferLines(targetBytes))) {
                 return { ...emptySides(), tooLarge: true, targetSha: sha };
             }
-            const diff = await this.layerDiffText(cwd, path, 'staged', signal);
+            const diff = await this.layerDiffText(root, path, 'staged', signal);
             if (binaryDiffOutput(diff)) {
                 return { ...emptySides(), binary: true, targetSha: sha };
             }
@@ -634,8 +654,8 @@ let GitWorkbenchService = (() => {
             };
         }
         /** Blob sha of the working-tree file, '' when git cannot hash it. */
-        async worktreeBlobSha(cwd, path, signal) {
-            const hashed = await this.git(cwd, ['hash-object', '--', path], signal);
+        async worktreeBlobSha(root, path, signal) {
+            const hashed = await this.git(root, ['hash-object', '--', path], signal);
             return hashed.exitCode === 0 ? hashed.stdout.trim() : '';
         }
         /**
@@ -647,19 +667,19 @@ let GitWorkbenchService = (() => {
          * its own fresh fetch, so the two ends of the stale comparison are over the
          * SAME text by construction, not by two fetch sites staying in step.
          */
-        async layerDiffText(cwd, path, layer, signal) {
+        async layerDiffText(root, path, layer, signal) {
             if (layer === 'staged') {
-                return (await this.git(cwd, ['diff', '--cached', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
+                return (await this.git(root, ['diff', '--cached', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
             }
-            const diff = (await this.git(cwd, ['diff', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
+            const diff = (await this.git(root, ['diff', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
             // Untracked files have no index entry, so `git diff` reports nothing for
             // them; the synthesized new-file segment is their unstaged diff. The
             // trailing newline is added here because every diff git prints carries
             // one: this text is what `applyBlocks` re-emits as a patch file, and a
             // patch whose last line has no LF is "corrupt patch" to `git apply` —
             // which is exactly what a real-git drive of the untracked path caught.
-            if (diff.length === 0 && await this.isUntracked(cwd, path, signal)) {
-                const segment = await untrackedSegment(cwd, path, SIDE_BYTE_CAP);
+            if (diff.length === 0 && await this.isUntracked(root, path, signal)) {
+                const segment = await untrackedSegment(root, path, SIDE_BYTE_CAP);
                 return segment === null ? '' : `${segment}\n`;
             }
             return diff;
@@ -677,7 +697,7 @@ let GitWorkbenchService = (() => {
          * shared with `fileSides`, and the tmpfile pair. Every failure comes back as
          * a result — the method never throws across the RPC boundary.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param layer - the layer the block was selected on; the mode decides which
          *                one that may be.
@@ -688,14 +708,16 @@ let GitWorkbenchService = (() => {
          * @param signal - abort signal.
          */
         async applyBlocks(worktreePath, path, layer, diffSha, lines, mode, signal) {
-            const cwd = this.cwdOf(worktreePath);
+            // The repository root — the patch's pathspecs are repository-relative
+            // and `git apply` resolves them against the cwd (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             const io = {
                 git: (dir, argv) => this.git(dir, argv, signal),
-                layerDiff: (file, which) => this.layerDiffText(cwd, file, which === 'staged' ? 'staged' : 'unstaged', signal),
+                layerDiff: (file, which) => this.layerDiffText(root, file, which === 'staged' ? 'staged' : 'unstaged', signal),
                 writePatch: writeTmpPatch,
                 dropPatch: dropTmpPatch,
             };
-            return runApplyBlocks(io, cwd, path, layer, String(diffSha ?? ''), lines, mode);
+            return runApplyBlocks(io, root, path, layer, String(diffSha ?? ''), lines, mode);
         }
         /**
          * Save the side-by-side editor's buffer over the working-tree file it was
@@ -716,7 +738,7 @@ let GitWorkbenchService = (() => {
          * check and this method are one thing, and no unchecked write RPC exists or
          * may be added in this plugin.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param text - the editor buffer, verbatim; written as bytes (LF as given).
          * @param expectedSha - the `targetSha` the buffer was opened with ('' when
@@ -725,7 +747,10 @@ let GitWorkbenchService = (() => {
          * @param signal - abort signal.
          */
         async writeChecked(worktreePath, path, text, expectedSha, signal) {
-            const cwd = this.cwdOf(worktreePath);
+            // The repository root — the save target joins the same base every
+            // other path here is relative to, and that base is the root, not the
+            // directory the session opened (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             const io = {
                 git: (dir, argv) => this.git(dir, argv, signal),
                 exists: async (p) => {
@@ -743,7 +768,7 @@ let GitWorkbenchService = (() => {
                 remove: async (p) => { await rm(p, { force: true }); },
                 delay: ms => new Promise(resolve => { setTimeout(resolve, ms); }),
             };
-            return runWriteChecked(io, cwd, path, typeof text === 'string' ? text : '', typeof expectedSha === 'string' ? expectedSha : '');
+            return runWriteChecked(io, root, path, typeof text === 'string' ? text : '', typeof expectedSha === 'string' ? expectedSha : '');
         }
         /**
          * One file's provenance, line by line — the side pane's blame gutter
@@ -754,7 +779,7 @@ let GitWorkbenchService = (() => {
          * rather than missing. Read-only, no index or worktree is touched, so this
          * needs none of the confirmation machinery the write paths carry.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param signal - abort signal.
          */
@@ -762,10 +787,13 @@ let GitWorkbenchService = (() => {
             if (typeof path !== 'string' || !isSafePathArg(path)) {
                 return { lines: [], truncated: false, error: `unsafe path argument: ${JSON.stringify(path)}` };
             }
-            const cwd = this.cwdOf(worktreePath);
+            // The repository root: blame's pathspec resolves against the cwd, and
+            // from a subdirectory the repository-relative path doubles up
+            // (`server/server/f`) into a fatal "no such path" (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             // `--` keeps a path that looks like a revision from being read as one, as
             // every other pathspec in this plugin does.
-            const run = await this.git(cwd, ['blame', '--line-porcelain', '--', path], signal);
+            const run = await this.git(root, ['blame', '--line-porcelain', '--', path], signal);
             if (run.exitCode !== 0) {
                 // An untracked file has no blame, and git says so; that message is the
                 // honest thing to show rather than an empty gutter.
@@ -799,7 +827,7 @@ let GitWorkbenchService = (() => {
          *
          * Read-only — nothing is spawned, nothing is written.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param signal - abort signal.
          */
@@ -807,7 +835,9 @@ let GitWorkbenchService = (() => {
             if (typeof path !== 'string' || !isSafePathArg(path)) {
                 throw new Error(`unsafe path argument: ${JSON.stringify(path)}`);
             }
-            const full = join(this.cwdOf(worktreePath), path);
+            // The repository root — the image is read from disk at the same base
+            // every other path in this plugin is relative to (repo-root.ts).
+            const full = join(await this.rootedDirOf(worktreePath, signal), path);
             let size = 0;
             try {
                 const info = await stat(full);
@@ -848,11 +878,11 @@ let GitWorkbenchService = (() => {
          * Those are the files whose diff has to be synthesized rather than asked of
          * `git diff`, which reports nothing for them.
          */
-        async isUntracked(cwd, path, signal) {
-            const listed = await this.git(cwd, ['ls-files', '--', path], signal);
+        async isUntracked(root, path, signal) {
+            const listed = await this.git(root, ['ls-files', '--', path], signal);
             if (listed.exitCode !== 0 || listed.stdout.trim().length > 0)
                 return false;
-            const head = await this.git(cwd, ['rev-parse', '--verify', '--quiet', `HEAD:${path}`], signal);
+            const head = await this.git(root, ['rev-parse', '--verify', '--quiet', `HEAD:${path}`], signal);
             return head.exitCode !== 0;
         }
         /**
@@ -885,11 +915,17 @@ let GitWorkbenchService = (() => {
             // empty pane. Against the first parent the answer is well defined and is the
             // useful one: what this merge brought into the branch it landed on. On a
             // single-parent commit the flag is a no-op, byte for byte.
+            // The repository root: no pathspec here today, but the cache key below
+            // must describe the same repository to a later caller, and running from
+            // the root is the one rule every read in this plugin follows
+            // (repo-root.ts). Resolved after the cache probe so a hit spawns
+            // nothing.
+            const root = await this.rootedDirOf(worktreePath, signal);
             const [meta, numstat, nameStatus, patch] = await Promise.all([
-                this.git(cwd, ['show', hash, '--no-patch', `--format=${LOG_FORMAT}`], signal),
-                this.git(cwd, ['show', hash, '--first-parent', '--numstat', '--format=', '--no-renames'], signal),
-                this.git(cwd, ['show', hash, '--first-parent', '--name-status', '--format=', '--no-renames'], signal),
-                this.git(cwd, ['show', hash, '--first-parent', '--format=', '--no-renames'], signal),
+                this.git(root, ['show', hash, '--no-patch', `--format=${LOG_FORMAT}`], signal),
+                this.git(root, ['show', hash, '--first-parent', '--numstat', '--format=', '--no-renames'], signal),
+                this.git(root, ['show', hash, '--first-parent', '--name-status', '--format=', '--no-renames'], signal),
+                this.git(root, ['show', hash, '--first-parent', '--format=', '--no-renames'], signal),
             ]);
             if (meta.exitCode !== 0) {
                 const detail = meta.stderr.length > 0 ? `: ${meta.stderr}` : '';
@@ -954,6 +990,10 @@ let GitWorkbenchService = (() => {
             const from = Number.isInteger(skip) && skip >= 0 ? skip : 0;
             const size = Number.isInteger(limit) && limit > 0 && limit <= HISTORY_PAGE_MAX ? limit : HISTORY_PAGE;
             const effective = filter ?? emptyLogFilter();
+            // The repository root: a filter's pathspec is repository-relative, and
+            // git resolves pathspecs against the cwd — from a subdirectory a
+            // filtered history silently comes back EMPTY with exit 0 (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             // Reading one row beyond the page answers "is there more" without a second
             // traversal of the log.
             //
@@ -966,7 +1006,7 @@ let GitWorkbenchService = (() => {
             //
             // Filter args go LAST: their segment ends with `--` + pathspecs, and
             // nothing after that separator may be parsed as a flag.
-            const log = await this.git(cwd, ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`, ...logFilterArgs(effective)], signal);
+            const log = await this.git(root, ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`, ...logFilterArgs(effective)], signal);
             // A bad filter (unparsable regex, invalid date) dies here, and an empty
             // page is indistinguishable from "no match" unless the failure speaks —
             // §6.13: the exit code + stderr tail is the only honest answer.
@@ -1010,8 +1050,12 @@ let GitWorkbenchService = (() => {
          * @param signal - abort signal.
          */
         async repoTree(worktreePath, signal) {
-            const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd();
-            const res = await this.git(cwd, ['ls-tree', '-r', '-z', '--name-only', 'HEAD'], signal);
+            // The repository root: unlike status and numstat, `ls-tree` prints
+            // cwd-RELATIVE paths — from a subdirectory every entry would lose the
+            // `server/` prefix and the picker would feed the log filter pathspecs
+            // that match nothing (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
+            const res = await this.git(root, ['ls-tree', '-r', '-z', '--name-only', 'HEAD'], signal);
             const all = res.stdout.split('\0').filter(path => path.length > 0);
             const truncated = all.length > TREE_PATH_CAP;
             return { paths: truncated ? all.slice(0, TREE_PATH_CAP) : all, truncated };
@@ -1318,22 +1362,28 @@ let GitWorkbenchService = (() => {
         }
         /**
          * Add paths to the index.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param paths - repository-relative paths; an empty list is refused rather
          *                than turned into a whole-tree `git add`.
          * @param signal - abort signal.
          */
         async stage(worktreePath, paths, signal) {
-            return this.writeOp(worktreePath, () => stageArgv(asPathList(paths)), signal);
+            // The repository root: `git add` resolves its pathspecs against the cwd,
+            // and from a subdirectory a repository-relative path dies with
+            // "pathspec did not match any files" (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
+            return this.writeOp(root, () => stageArgv(asPathList(paths)), signal);
         }
         /**
          * Remove paths from the index, leaving the working tree untouched.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param paths - repository-relative paths.
          * @param signal - abort signal.
          */
         async unstage(worktreePath, paths, signal) {
-            return this.writeOp(worktreePath, () => unstageArgv(asPathList(paths)), signal);
+            // Same rule as `stage` — the pathspecs are repository-relative.
+            const root = await this.rootedDirOf(worktreePath, signal);
+            return this.writeOp(root, () => unstageArgv(asPathList(paths)), signal);
         }
         /**
          * What discarding this file WOULD do, without doing it.
@@ -1344,16 +1394,19 @@ let GitWorkbenchService = (() => {
          * cannot come back" is exactly the difference the reader is being asked
          * about. So the dialog is built from this, read fresh, rather than from the
          * row that was clicked.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param signal - abort signal.
          * @returns the effect and whether it is irreversible; `effect` is absent when
          *          git reports nothing to discard for that path.
          */
         async discardPlan(worktreePath, path, signal) {
+            // The repository root — the plan's argv and delete paths are
+            // repository-relative (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             let plan;
             try {
-                plan = await this.planDiscard(worktreePath, path, signal);
+                plan = await this.planDiscard(root, path, signal);
             }
             catch (error) {
                 return { error: error instanceof Error ? error.message : String(error) };
@@ -1378,7 +1431,7 @@ let GitWorkbenchService = (() => {
          * it. `expectedEffect` is what the reader was shown and agreed to: if the
          * file changed underneath the dialog — staged, edited, reverted by someone
          * else — the freshly derived effect no longer matches and nothing is done.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param expectedEffect - the effect the confirmation stated; blank skips
          *                         the agreement check, which only the reversible
@@ -1387,9 +1440,13 @@ let GitWorkbenchService = (() => {
          * @returns the operation result, with the effect actually carried out.
          */
         async discardFile(worktreePath, path, expectedEffect, signal) {
+            // The repository root, resolved ONCE for the plan and the steps alike:
+            // every step's argv and delete path came out of a whole-tree porcelain
+            // status, so they are repository-relative (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             let plan;
             try {
-                plan = await this.planDiscard(worktreePath, path, signal);
+                plan = await this.planDiscard(root, path, signal);
             }
             catch (error) {
                 return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) };
@@ -1405,10 +1462,9 @@ let GitWorkbenchService = (() => {
                     error: `this file changed since you were asked (now: ${plan.effect}); nothing was done`,
                 };
             }
-            const cwd = this.cwdOf(worktreePath);
             for (const step of plan.steps) {
                 if (step.kind === 'git') {
-                    const result = await this.git(cwd, step.argv, signal);
+                    const result = await this.git(root, step.argv, signal);
                     const failure = classifyFailure(result.exitCode, result.stderr, result.stdout);
                     if (failure !== null) {
                         return { ok: false, failure, error: (result.stderr || result.stdout).trim().slice(-1000) };
@@ -1416,7 +1472,7 @@ let GitWorkbenchService = (() => {
                     continue;
                 }
                 try {
-                    await removePathInside(cwd, step.path);
+                    await removePathInside(root, step.path);
                 }
                 catch (error) {
                     return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) };
@@ -1432,12 +1488,14 @@ let GitWorkbenchService = (() => {
          * reports `D` plus `??` instead — which plans as "restore one, DELETE the
          * other" where the truth is "undo the rename".
          */
-        async planDiscard(worktreePath, path, signal) {
+        async planDiscard(root, path, signal) {
             if (typeof path !== 'string' || !isSafePathArg(path)) {
                 throw new Error(`unsafe path argument: ${JSON.stringify(path)}`);
             }
-            const cwd = this.cwdOf(worktreePath);
-            const status = await this.git(cwd, ['status', '--porcelain=v1', '--untracked-files=all'], signal);
+            // Runs at the repository root the caller resolved: the plan's paths
+            // must agree with the directory its steps execute in, and with the
+            // client's `path`, which the drawer lists repository-relative.
+            const status = await this.git(root, ['status', '--porcelain=v1', '--untracked-files=all'], signal);
             if (status.exitCode !== 0) {
                 throw new Error((status.stderr || status.stdout).trim().slice(-1000) || 'git status failed');
             }
@@ -1451,7 +1509,8 @@ let GitWorkbenchService = (() => {
          * @param signal - abort signal.
          */
         async commit(worktreePath, message, amend, signal) {
-            return this.writeOp(worktreePath, () => commitArgv(String(message ?? ''), amend === true), signal);
+            // No pathspec in this argv — the session's own directory suffices.
+            return this.writeOp(this.cwdOf(worktreePath), () => commitArgv(String(message ?? ''), amend === true), signal);
         }
         /**
          * Update remote-tracking refs without touching the working tree.
@@ -1460,7 +1519,7 @@ let GitWorkbenchService = (() => {
          * @returns the operation result, plus the divergence the fetch revealed.
          */
         async fetch(worktreePath, signal) {
-            const result = await this.writeOp(worktreePath, () => fetchArgv(), signal, NETWORK_GRACE_MS);
+            const result = await this.writeOp(this.cwdOf(worktreePath), () => fetchArgv(), signal, NETWORK_GRACE_MS);
             if (!result.ok)
                 return result;
             // The point of fetching is the count it produces, so report it in the same
@@ -1477,7 +1536,7 @@ let GitWorkbenchService = (() => {
          */
         async pull(worktreePath, mode, signal) {
             const chosen = mode === 'rebase' || mode === 'merge' ? mode : 'ff-only';
-            return this.writeOp(worktreePath, () => pullArgv(chosen), signal, NETWORK_GRACE_MS);
+            return this.writeOp(this.cwdOf(worktreePath), () => pullArgv(chosen), signal, NETWORK_GRACE_MS);
         }
         /**
          * Publish the current branch.
@@ -1496,10 +1555,16 @@ let GitWorkbenchService = (() => {
                 return { ok: false, failure: 'unknown', error: 'HEAD is detached; nothing to push' };
             if (tracking.branch.length === 0)
                 return { ok: false, failure: 'unknown', error: 'no branch to push' };
-            return this.writeOp(worktreePath, () => pushArgv(tracking.branch, tracking.upstream !== null), signal, NETWORK_GRACE_MS);
+            return this.writeOp(this.cwdOf(worktreePath), () => pushArgv(tracking.branch, tracking.upstream !== null), signal, NETWORK_GRACE_MS);
         }
-        /** Shared shape for every write op: run it, classify what went wrong. */
-        async writeOp(worktreePath, build, signal, graceMs) {
+        /** Shared shape for every write op: run it, classify what went wrong.
+         *
+         * Takes the DIRECTORY to run in, already resolved: callers carrying
+         * repository-relative pathspecs pass the rooted directory
+         * ({@link GitWorkbenchService.rootedDirOf}); pathspec-free operations may
+         * pass the session's own directory.
+         */
+        async writeOp(dir, build, signal, graceMs) {
             let argv;
             try {
                 argv = build();
@@ -1509,7 +1574,7 @@ let GitWorkbenchService = (() => {
                 // list or a blank commit message takes.
                 return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) };
             }
-            const result = await this.git(this.cwdOf(worktreePath), argv, signal, graceMs);
+            const result = await this.git(dir, argv, signal, graceMs);
             const failure = classifyFailure(result.exitCode, result.stderr, result.stdout);
             if (failure === null)
                 return { ok: true, output: result.stdout.trim().slice(-1000) };
@@ -1567,11 +1632,24 @@ let GitWorkbenchService = (() => {
             return run;
         }
         /** Resolve the repo root for a directory (null when not a git repo). Always forward slashes. */
-        async repoRootOf(cwd, signal) {
-            const out = await this.git(cwd, ['rev-parse', '--show-toplevel'], signal);
-            if (out.exitCode !== 0)
-                return null;
-            return out.stdout.trim().replace(/\\/g, '/') || null;
+        repoRootOf(cwd, signal) {
+            return resolveRepoRoot((dir, argv) => this.git(dir, argv, signal), cwd);
+        }
+        /**
+         * The directory to run git in and join paths against for a session's
+         * `worktreePath`: the repository ROOT, falling back to the directory
+         * itself outside a repository (the caller's own git run then fails the
+         * way it always did, and that error is the honest one to show).
+         *
+         * The drawer's paths are repository-relative — porcelain status and
+         * `--numstat` print them that way wherever they run — while pathspecs,
+         * `:path` revisions, `hash-object` arguments and `join(dir, path)` all
+         * resolve against the directory a command runs in. Those two halves only
+         * agree at the root, so every method that carries a path runs there.
+         * `repo-root.ts` tells the whole story, with the probes that caught it.
+         */
+        rootedDirOf(worktreePath, signal) {
+            return rootedDir((dir, argv) => this.git(dir, argv, signal), this.cwdOf(worktreePath));
         }
         /**
          * Spawn `git <args>` in cwd with piped stdio; drains both streams and returns
@@ -1640,14 +1718,14 @@ async function mapPooled(items, limit, task) {
  * count newlines is the expensive half of this pass, and most untracked files
  * never reach the bundled diff. Never throws; an unreadable file reports zero
  * lines and nothing to diff.
- * @param cwd - worktree the path is relative to.
+ * @param root - repository root the path is relative to.
  * @param path - repository-relative file path.
  * @returns the file's line count, binary flag, and whether a diff may be built.
  */
-async function measureUntracked(cwd, path) {
+async function measureUntracked(root, path) {
     let bytes;
     try {
-        bytes = await readFile(join(cwd, path));
+        bytes = await readFile(join(root, path));
     }
     catch {
         return { lineCount: 0, binary: false, diffable: false };
@@ -1665,16 +1743,16 @@ async function measureUntracked(cwd, path) {
  *
  * `git diff --no-index /dev/null <f>` is NOT used: on Windows git resolves
  * `/dev/null` as a repo-relative path. Never throws.
- * @param cwd - worktree the path is relative to.
+ * @param root - repository root the path is relative to.
  * @param path - repository-relative file path.
  * @param byteCap - refuse files larger than this; defaults to the stats
  *                  payload's budget, which `fileSides` raises to its own.
  * @returns the segment, or null when the file is missing, binary, or oversized.
  */
-async function untrackedSegment(cwd, path, byteCap = UNTRACKED_FILE_BYTE_CAP) {
+async function untrackedSegment(root, path, byteCap = UNTRACKED_FILE_BYTE_CAP) {
     let bytes;
     try {
-        bytes = await readFile(join(cwd, path));
+        bytes = await readFile(join(root, path));
     }
     catch {
         return null;