@young1lin/dsh-ui-gitworkbench 0.1.14 → 0.1.16

package/lib/index.js

@@ -76,7 +76,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
  * @module @young1lin/dsh-ui-gitworkbench
  */
 import { randomBytes } from 'node:crypto';
-import { mkdir, readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, readdir, readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir, tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { defineTool } from '@deepseek-ai/dsh-tools';
@@ -86,16 +86,19 @@ import { saveJsonAtomic } from './atomic-json.js';
 import { runWriteChecked } from './write-checked.js';
 import { CommitPayloadCache, cacheKey } from './commit-cache.js';
 import { NETWORK_GRACE_MS, NON_INTERACTIVE_ENV, capBranches, classifyFailure, clipDiff, commitArgv, countBufferLines, decodesAsUtf8, fetchArgv, isBinaryPrefix, isNoMergeBaseError, isSafePathArg, parseNameStatus, parseNumstat, parseStatus, parseTracking, pullArgv, pushArgv, stageArgv, unstageArgv, } from './git-ops.js';
-import { planFromStatus, } from './discard-ops.js';
+import { isSafeRelativePath, planFromStatus, } from './discard-ops.js';
+import { shapeDirChildren } from './dir-listing.js';
 import { parseBlame } from './blame.js';
 import { removePathInside } from './fs-remove.js';
+import { resolveInside } from './path-lock.js';
+import { resolveRepoRoot, rootedDir } from './repo-root.js';
 import { diffTooLarge, targetTooLarge, SIDE_BYTE_CAP, SIDE_LINE_CAP } from './side-guard.js';
 import { IMAGE_BYTE_CAP, sniffImage } from './image-sniff.js';
 import { LOG_FORMAT, parseLog } from './git-log.js';
 import { emptyLogFilter, logFilterArgs } from './log-filter.js';
 import { parseShortlog } from './shortlog.js';
 import { isBlankEntry, loadStyle, sanitizeEntry, stylePath, } from './style-store.js';
-import { bindingsPath, findRegisteredWorktree, isRefName, loadBindings, parseWorktreeList, sanitizeName, saveBindings, worktreeDir, } from './worktree.js';
+import { bindingNotice, bindingsPath, findRegisteredWorktree, isRefName, lineageEdgeOf, loadBindings, parseWorktreeList, resolveEffectiveBinding, sanitizeName, saveBindings, worktreeDir, } from './worktree.js';
 /** Cap the bundled unified diff so a huge change cannot blow the RPC response. */
 const DIFF_CHAR_CAP = 400_000;
 /** Untracked files larger than this are listed + counted but never diffed. */
@@ -120,6 +123,11 @@ const SHORTLOG_CAP = 500;
 /** Path list cap for the picker: a monorepo can outrun any popup; past this
  *  the tree is cut and the truncation reported, never silent. */
 const TREE_PATH_CAP = 50_000;
+/** Cap on the ignored entry listing `repoTree` rides along. The listing is
+ *  proportional to the .gitignore's coverage, not the repository (git
+ *  collapses every fully-ignored directory to one line), so real repos sit in
+ *  the tens; this is a reported fuse for a pathological ignore setup. */
+const IGNORED_PATH_CAP = 5_000;
 /**
  * Most branch names sent to the browser. `worktreeStatus` is polled, so an
  * unbounded list would repeat on the wire every few seconds; the picker reports
@@ -163,6 +171,7 @@ let GitWorkbenchService = (() => {
     let _commits_decorators;
     let _authors_decorators;
     let _repoTree_decorators;
+    let _ignoredDir_decorators;
     let _compareRefs_decorators;
     let _sessionWorktree_decorators;
     let _worktreeEnter_decorators;
@@ -193,6 +202,7 @@ let GitWorkbenchService = (() => {
             _commits_decorators = [Remote('commits')];
             _authors_decorators = [Remote('authors')];
             _repoTree_decorators = [Remote('repoTree')];
+            _ignoredDir_decorators = [Remote('ignoredDir')];
             _compareRefs_decorators = [Remote('compareRefs')];
             _sessionWorktree_decorators = [Remote('sessionWorktree')];
             _worktreeEnter_decorators = [Remote('worktreeEnter')];
@@ -220,6 +230,7 @@ let GitWorkbenchService = (() => {
             __esDecorate(this, null, _commits_decorators, { kind: "method", name: "commits", static: false, private: false, access: { has: obj => "commits" in obj, get: obj => obj.commits }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _authors_decorators, { kind: "method", name: "authors", static: false, private: false, access: { has: obj => "authors" in obj, get: obj => obj.authors }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _repoTree_decorators, { kind: "method", name: "repoTree", static: false, private: false, access: { has: obj => "repoTree" in obj, get: obj => obj.repoTree }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _ignoredDir_decorators, { kind: "method", name: "ignoredDir", static: false, private: false, access: { has: obj => "ignoredDir" in obj, get: obj => obj.ignoredDir }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _compareRefs_decorators, { kind: "method", name: "compareRefs", static: false, private: false, access: { has: obj => "compareRefs" in obj, get: obj => obj.compareRefs }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _sessionWorktree_decorators, { kind: "method", name: "sessionWorktree", static: false, private: false, access: { has: obj => "sessionWorktree" in obj, get: obj => obj.sessionWorktree }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _worktreeEnter_decorators, { kind: "method", name: "worktreeEnter", static: false, private: false, access: { has: obj => "worktreeEnter" in obj, get: obj => obj.worktreeEnter }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -249,10 +260,32 @@ let GitWorkbenchService = (() => {
          * mutation updates this inside the same critical section that writes it.
          */
         bindingMirror = new Map();
+        /**
+         * Session id → parent session id, as `agent/session-start` delivered it. A
+         * subagent header names its parent, and that edge is all the lineage walk
+         * needs: a child session without a binding of its own works under its
+         * nearest bound ancestor (see {@link resolveEffectiveBinding}). The map is
+         * never pruned — it holds one short string per session this process has
+         * seen, and a stale edge can only make a lookup walk further, never lie.
+         */
+        parentOf = new Map();
         constructor(ctx) {
             super(ctx, 'gitWorkbench');
             this.registerWorktreeTools(ctx);
             this.registerWorktreePrompt(ctx);
+            // Fires for every session the process publishes — fresh subagents and
+            // sessions whose loop resumes from disk. An IDLE session's edge is absent
+            // until its loop (re)starts, so a lookup can simply find no ancestor right
+            // after a host restart — the pre-feature behavior, fail-soft. `events.on`
+            // (not the typed `ctx.on` overload) because the event is declared by
+            // @deepseek-ai/dsh-agent, which this plugin does not depend on; the
+            // listener lives on this ctx's fiber.
+            ctx.events.on('agent/session-start', (payload) => {
+                const session = payload.agent?.session;
+                const parent = lineageEdgeOf(session?.header);
+                if (session !== undefined && parent !== undefined)
+                    this.parentOf.set(session.id, parent);
+            });
             // Hydrate the mirror through the same queue as the mutations, so a binding
             // written before hydration finishes is not overwritten by the stale read.
             // A failed read leaves the mirror empty: sessions then get no standing
@@ -284,17 +317,20 @@ let GitWorkbenchService = (() => {
                     name: 'worktree:binding',
                     order: 115,
                     text: (context) => {
-                        const sessionId = context.agent?.session.id;
-                        const binding = sessionId === undefined ? undefined : this.bindingMirror.get(sessionId);
-                        if (binding === undefined)
+                        const session = context.agent?.session;
+                        if (session === undefined)
                             return '';
-                        const rel = `.agents/worktrees/${binding.name}`;
-                        const branchNote = binding.branch === undefined ? '' : ` (branch ${binding.branch})`;
-                        return `This session is bound to git worktree "${binding.name}"${branchNote}.\n`
-                            + 'The session working directory is still the repository root, so the binding is a convention you must apply yourself:\n'
-                            + `- shell commands: pass workdir "${rel}"\n`
-                            + `- file tools: prefix every path with ${rel}/\n`
-                            + 'A path without that prefix acts on the MAIN worktree, not the bound one. Call worktree_exit to unbind.';
+                        // First hop straight off the live header: the prompt must not depend
+                        // on the session-start event having been seen (a plugin reload
+                        // mid-session repopulates the map only through later events).
+                        const parent = lineageEdgeOf(session.header);
+                        if (parent !== undefined && !this.parentOf.has(session.id)) {
+                            this.parentOf.set(session.id, parent);
+                        }
+                        const effective = resolveEffectiveBinding(session.id, this.parentOf, id => this.bindingMirror.get(id));
+                        if (effective === undefined)
+                            return '';
+                        return bindingNotice(effective.binding.name, effective.binding.branch, effective.inherited);
                     },
                 });
             });
@@ -331,6 +367,7 @@ let GitWorkbenchService = (() => {
                     ok: { type: 'boolean' },
                     error: { type: 'string' },
                     binding: { oneOf: [{ type: 'null' }, { type: 'object', additionalProperties: true }] },
+                    bindingInherited: { type: 'boolean' },
                     worktrees: { type: 'array', items: { type: 'object', additionalProperties: true } },
                     branches: { type: 'array', items: { type: 'string' } },
                     branchesTruncated: { type: 'boolean' },
@@ -374,7 +411,8 @@ let GitWorkbenchService = (() => {
             }));
             ctx.tools.register(defineTool({
                 name: 'worktree_status',
-                description: 'Show this session\'s bound worktree (if any) and the repository\'s existing worktrees with branches.',
+                description: 'Show this session\'s worktree (its own, or the one its parent session entered — bindingInherited says which) '
+                    + 'and the repository\'s existing worktrees with branches.',
                 parameters: {},
                 output: output(STATUS_SCHEMA),
                 execute: async (_args, exec) => {
@@ -401,10 +439,20 @@ let GitWorkbenchService = (() => {
             // the browser. The tree and the counters need only `status` and
             // `--numstat`, both of which stay around 110-140ms at that size, and the
             // pane already fetches the file it is actually showing through `fileDiff`.
-            const [statusInfo, numstat, revInfo] = await Promise.all([
+            // The fourth read resolves where the rest of this method must run: the
+            // repository ROOT. The paths this method handles are repository-relative
+            // (that is what porcelain status prints wherever it runs), so the
+            // untracked files read below must be joined against the root — a session
+            // opened at `repo/server` would otherwise look for `repo/server/server/f`.
+            // The three git reads themselves are cwd-INSENSITIVE (their output names
+            // paths from the repository root whatever directory they run in), so they
+            // stay on the session's own directory and the root resolve rides along in
+            // the same batch: the polled call pays for it in wall time not at all.
+            const [statusInfo, numstat, revInfo, root] = await Promise.all([
                 this.git(cwd, ['status', '--porcelain=v1', '--branch', '--untracked-files=all'], signal),
                 this.git(cwd, ['diff', 'HEAD', '--numstat'], signal),
                 this.git(cwd, ['rev-parse', '--abbrev-ref', 'HEAD'], signal),
+                this.rootedDirOf(worktreePath, signal),
             ]);
             if (statusInfo.exitCode !== 0) {
                 const detail = statusInfo.stderr.length > 0 ? `: ${statusInfo.stderr}` : '';
@@ -418,7 +466,7 @@ let GitWorkbenchService = (() => {
             // segments into the payload — is gone with the payload itself; `fileDiff`
             // synthesizes the one segment the reader has actually opened.
             const untracked = files.filter(file => file.status === 'untracked');
-            const measured = await mapPooled(untracked, UNTRACKED_READ_CONCURRENCY, file => measureUntracked(cwd, file.path));
+            const measured = await mapPooled(untracked, UNTRACKED_READ_CONCURRENCY, file => measureUntracked(root, file.path));
             for (const [index, file] of untracked.entries()) {
                 const measure = measured[index];
                 file.addedLines = measure.lineCount;
@@ -485,41 +533,46 @@ let GitWorkbenchService = (() => {
          * Plain-identifier params, signal last.
          */
         async fileDiff(worktreePath, path, commit, base, head, signal) {
-            const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd();
             if (typeof path !== 'string' || path.length === 0)
                 return { diff: '' };
+            // The repository root, not the session's directory: the pathspec below
+            // is repository-relative, and git resolves pathspecs against the cwd —
+            // from a subdirectory `diff HEAD -- server/f` looks for
+            // `server/server/f`, matches nothing, and reports an EMPTY diff with
+            // exit 0. (repo-root.ts holds the whole story.)
+            const root = await this.rootedDirOf(worktreePath, signal);
             if (typeof base === 'string' && base.length > 0 && typeof head === 'string' && head.length > 0) {
                 if (!isRefName(base) || !isRefName(head))
                     return { diff: '' };
-                const ranged = await this.git(cwd, ['diff', '--no-renames', `${base}...${head}`, '--', path], signal);
+                const ranged = await this.git(root, ['diff', '--no-renames', `${base}...${head}`, '--', path], signal);
                 if (ranged.exitCode === 0)
                     return { diff: ranged.stdout };
                 // Unrelated histories have no merge base for `A...B` to diff from; the
                 // two-tip diff still answers what differs, exactly as `compareRefs` does.
                 if (!isNoMergeBaseError(ranged.stderr))
                     return { diff: '' };
-                const tips = await this.git(cwd, ['diff', '--no-renames', base, head, '--', path], signal);
+                const tips = await this.git(root, ['diff', '--no-renames', base, head, '--', path], signal);
                 return { diff: tips.exitCode === 0 ? tips.stdout : '' };
             }
             if (typeof commit === 'string' && commit.length > 0) {
                 if (!COMMIT_HASH.test(commit))
                     return { diff: '' };
-                const key = cacheKey(cwd, commit, path);
+                const key = cacheKey(root, commit, path);
                 const cached = this.commitDiffCache.get(key);
                 if (cached !== undefined)
                     return { diff: cached };
                 // `--first-parent` for the same reason as in `commitStats`: without it a
                 // merge commit has no diff to show and the pane opens empty.
-                const shown = await this.git(cwd, ['show', commit, '--first-parent', '--format=', '--no-renames', '--', path], signal);
+                const shown = await this.git(root, ['show', commit, '--first-parent', '--format=', '--no-renames', '--', path], signal);
                 if (shown.exitCode !== 0)
                     return { diff: '' };
                 this.commitDiffCache.set(key, shown.stdout);
                 return { diff: shown.stdout };
             }
-            const tracked = await this.git(cwd, ['diff', 'HEAD', '--', path], signal);
+            const tracked = await this.git(root, ['diff', 'HEAD', '--', path], signal);
             if (tracked.stdout.trim().length > 0)
                 return { diff: tracked.stdout };
-            return { diff: await untrackedSegment(cwd, path) ?? '' };
+            return { diff: await untrackedSegment(root, path) ?? '' };
         }
         /**
          * One layer of one file for the side-by-side diff pane: the layer's
@@ -534,7 +587,8 @@ let GitWorkbenchService = (() => {
          * nothing for them and the unstaged layer falls back to the synthesized
          * new-file segment `fileDiff` already uses.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its
+         *                       repository root. Empty falls back to the host cwd.
          * @param path - repository-relative path, as the drawer lists it.
          * @param layer - `unstaged` (index→worktree) or `staged` (HEAD→index).
          * @param signal - abort signal.
@@ -543,21 +597,28 @@ let GitWorkbenchService = (() => {
             if (layer !== 'unstaged' && layer !== 'staged') {
                 throw new Error(`unknown layer "${String(layer)}"; expected 'unstaged' or 'staged'`);
             }
-            if (typeof path !== 'string' || !isSafePathArg(path)) {
+            if (typeof path !== 'string' || !isSafeRelativePath(path)) {
                 throw new Error(`unsafe path argument: ${JSON.stringify(path)}`);
             }
-            const cwd = this.cwdOf(worktreePath);
+            // Repository root, not the session's directory: every path below is
+            // repository-relative (pathspecs resolve against the cwd, and so does
+            // the file read for the editor's target). See repo-root.ts.
+            const root = await this.rootedDirOf(worktreePath, signal);
+            // The unstaged layer READS THE FILE, so its absolute path is built by the
+            // lock rather than by a join — see path-lock.ts. Done here, once, so the
+            // one place that resolves a client path is visible in this method.
             return layer === 'unstaged'
-                ? await this.unstagedSides(cwd, path, signal)
-                : await this.stagedSides(cwd, path, signal);
+                ? await this.unstagedSides(root, path, resolveInside(root, path), signal)
+                : await this.stagedSides(root, path, signal);
         }
-        /** The unstaged layer: diff index→worktree, target = the working-tree file. */
-        async unstagedSides(cwd, path, signal) {
+        /** The unstaged layer: diff index→worktree, target = the working-tree file.
+         *  `full` is that file's absolute path, already through the lock. */
+        async unstagedSides(root, path, full, signal) {
             // Size guard first, off the stat rather than a read: declining a file past
             // the cap must not mean loading a pathological one whole first. Bytes are
             // all a stat knows; the line half of the guard needs the read below.
             try {
-                const info = await stat(join(cwd, path));
+                const info = await stat(full);
                 if (info.isFile() && targetTooLarge(info.size, 0))
                     return { ...emptySides(), tooLarge: true };
             }
@@ -566,20 +627,20 @@ let GitWorkbenchService = (() => {
             }
             let bytes = null;
             try {
-                bytes = await readFile(join(cwd, path));
+                bytes = await readFile(full);
             }
             catch {
                 bytes = null;
             }
             if (bytes !== null && isBinaryPrefix(bytes, BINARY_SNIFF_BYTES)) {
-                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(cwd, path, signal) };
+                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(root, path, signal) };
             }
             if (bytes !== null && targetTooLarge(bytes.length, countBufferLines(bytes))) {
                 return { ...emptySides(), tooLarge: true };
             }
-            const diff = await this.layerDiffText(cwd, path, 'unstaged', signal);
+            const diff = await this.layerDiffText(root, path, 'unstaged', signal);
             if (binaryDiffOutput(diff)) {
-                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(cwd, path, signal) };
+                return { ...emptySides(), binary: true, targetSha: await this.worktreeBlobSha(root, path, signal) };
             }
             // The diff half of the guard, AFTER the artifact exists: the target-side
             // checks above cannot see a worktree-deleted large file (no target to
@@ -591,7 +652,7 @@ let GitWorkbenchService = (() => {
                 diff,
                 diffSha: sha1Hex(diff),
                 targetText: bytes === null ? '' : bytes.toString('utf8'),
-                targetSha: bytes === null ? '' : await this.worktreeBlobSha(cwd, path, signal),
+                targetSha: bytes === null ? '' : await this.worktreeBlobSha(root, path, signal),
                 binary: false,
                 tooLarge: false,
                 // Only the unstaged layer can report this, and only it needs to: the
@@ -600,11 +661,11 @@ let GitWorkbenchService = (() => {
             };
         }
         /** The staged layer: diff HEAD→index, target = the index blob. */
-        async stagedSides(cwd, path, signal) {
+        async stagedSides(root, path, signal) {
             // `:path` resolves the stage-0 index entry: the target text when it exists,
             // and a failed resolution (no entry) is the empty target, not an error.
-            const shown = await this.git(cwd, ['show', `:${path}`], signal);
-            const sha = (await this.git(cwd, ['rev-parse', '--verify', '--quiet', `:${path}`], signal)).stdout.trim();
+            const shown = await this.git(root, ['show', `:${path}`], signal);
+            const sha = (await this.git(root, ['rev-parse', '--verify', '--quiet', `:${path}`], signal)).stdout.trim();
             const targetText = shown.exitCode === 0 ? shown.stdout : '';
             const targetBytes = Buffer.from(targetText, 'utf8');
             if (targetText.length > 0 && isBinaryPrefix(targetBytes, BINARY_SNIFF_BYTES)) {
@@ -613,7 +674,7 @@ let GitWorkbenchService = (() => {
             if (targetTooLarge(targetBytes.length, countBufferLines(targetBytes))) {
                 return { ...emptySides(), tooLarge: true, targetSha: sha };
             }
-            const diff = await this.layerDiffText(cwd, path, 'staged', signal);
+            const diff = await this.layerDiffText(root, path, 'staged', signal);
             if (binaryDiffOutput(diff)) {
                 return { ...emptySides(), binary: true, targetSha: sha };
             }
@@ -634,8 +695,8 @@ let GitWorkbenchService = (() => {
             };
         }
         /** Blob sha of the working-tree file, '' when git cannot hash it. */
-        async worktreeBlobSha(cwd, path, signal) {
-            const hashed = await this.git(cwd, ['hash-object', '--', path], signal);
+        async worktreeBlobSha(root, path, signal) {
+            const hashed = await this.git(root, ['hash-object', '--', path], signal);
             return hashed.exitCode === 0 ? hashed.stdout.trim() : '';
         }
         /**
@@ -647,19 +708,19 @@ let GitWorkbenchService = (() => {
          * its own fresh fetch, so the two ends of the stale comparison are over the
          * SAME text by construction, not by two fetch sites staying in step.
          */
-        async layerDiffText(cwd, path, layer, signal) {
+        async layerDiffText(root, path, layer, signal) {
             if (layer === 'staged') {
-                return (await this.git(cwd, ['diff', '--cached', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
+                return (await this.git(root, ['diff', '--cached', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
             }
-            const diff = (await this.git(cwd, ['diff', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
+            const diff = (await this.git(root, ['diff', `-U${FULL_CONTEXT}`, '--', path], signal)).stdout;
             // Untracked files have no index entry, so `git diff` reports nothing for
             // them; the synthesized new-file segment is their unstaged diff. The
             // trailing newline is added here because every diff git prints carries
             // one: this text is what `applyBlocks` re-emits as a patch file, and a
             // patch whose last line has no LF is "corrupt patch" to `git apply` —
             // which is exactly what a real-git drive of the untracked path caught.
-            if (diff.length === 0 && await this.isUntracked(cwd, path, signal)) {
-                const segment = await untrackedSegment(cwd, path, SIDE_BYTE_CAP);
+            if (diff.length === 0 && await this.isUntracked(root, path, signal)) {
+                const segment = await untrackedSegment(root, path, SIDE_BYTE_CAP);
                 return segment === null ? '' : `${segment}\n`;
             }
             return diff;
@@ -677,7 +738,7 @@ let GitWorkbenchService = (() => {
          * shared with `fileSides`, and the tmpfile pair. Every failure comes back as
          * a result — the method never throws across the RPC boundary.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param layer - the layer the block was selected on; the mode decides which
          *                one that may be.
@@ -688,14 +749,16 @@ let GitWorkbenchService = (() => {
          * @param signal - abort signal.
          */
         async applyBlocks(worktreePath, path, layer, diffSha, lines, mode, signal) {
-            const cwd = this.cwdOf(worktreePath);
+            // The repository root — the patch's pathspecs are repository-relative
+            // and `git apply` resolves them against the cwd (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             const io = {
                 git: (dir, argv) => this.git(dir, argv, signal),
-                layerDiff: (file, which) => this.layerDiffText(cwd, file, which === 'staged' ? 'staged' : 'unstaged', signal),
+                layerDiff: (file, which) => this.layerDiffText(root, file, which === 'staged' ? 'staged' : 'unstaged', signal),
                 writePatch: writeTmpPatch,
                 dropPatch: dropTmpPatch,
             };
-            return runApplyBlocks(io, cwd, path, layer, String(diffSha ?? ''), lines, mode);
+            return runApplyBlocks(io, root, path, layer, String(diffSha ?? ''), lines, mode);
         }
         /**
          * Save the side-by-side editor's buffer over the working-tree file it was
@@ -716,7 +779,7 @@ let GitWorkbenchService = (() => {
          * check and this method are one thing, and no unchecked write RPC exists or
          * may be added in this plugin.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param text - the editor buffer, verbatim; written as bytes (LF as given).
          * @param expectedSha - the `targetSha` the buffer was opened with ('' when
@@ -725,7 +788,10 @@ let GitWorkbenchService = (() => {
          * @param signal - abort signal.
          */
         async writeChecked(worktreePath, path, text, expectedSha, signal) {
-            const cwd = this.cwdOf(worktreePath);
+            // The repository root — the save target joins the same base every
+            // other path here is relative to, and that base is the root, not the
+            // directory the session opened (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             const io = {
                 git: (dir, argv) => this.git(dir, argv, signal),
                 exists: async (p) => {
@@ -743,7 +809,7 @@ let GitWorkbenchService = (() => {
                 remove: async (p) => { await rm(p, { force: true }); },
                 delay: ms => new Promise(resolve => { setTimeout(resolve, ms); }),
             };
-            return runWriteChecked(io, cwd, path, typeof text === 'string' ? text : '', typeof expectedSha === 'string' ? expectedSha : '');
+            return runWriteChecked(io, root, path, typeof text === 'string' ? text : '', typeof expectedSha === 'string' ? expectedSha : '');
         }
         /**
          * One file's provenance, line by line — the side pane's blame gutter
@@ -754,7 +820,7 @@ let GitWorkbenchService = (() => {
          * rather than missing. Read-only, no index or worktree is touched, so this
          * needs none of the confirmation machinery the write paths carry.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param signal - abort signal.
          */
@@ -762,10 +828,13 @@ let GitWorkbenchService = (() => {
             if (typeof path !== 'string' || !isSafePathArg(path)) {
                 return { lines: [], truncated: false, error: `unsafe path argument: ${JSON.stringify(path)}` };
             }
-            const cwd = this.cwdOf(worktreePath);
+            // The repository root: blame's pathspec resolves against the cwd, and
+            // from a subdirectory the repository-relative path doubles up
+            // (`server/server/f`) into a fatal "no such path" (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             // `--` keeps a path that looks like a revision from being read as one, as
             // every other pathspec in this plugin does.
-            const run = await this.git(cwd, ['blame', '--line-porcelain', '--', path], signal);
+            const run = await this.git(root, ['blame', '--line-porcelain', '--', path], signal);
             if (run.exitCode !== 0) {
                 // An untracked file has no blame, and git says so; that message is the
                 // honest thing to show rather than an empty gutter.
@@ -799,15 +868,19 @@ let GitWorkbenchService = (() => {
          *
          * Read-only — nothing is spawned, nothing is written.
          *
-         * @param worktreePath - directory to run in; empty falls back to the host cwd.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param signal - abort signal.
          */
         async fileImage(worktreePath, path, signal) {
-            if (typeof path !== 'string' || !isSafePathArg(path)) {
+            if (typeof path !== 'string' || !isSafeRelativePath(path)) {
                 throw new Error(`unsafe path argument: ${JSON.stringify(path)}`);
             }
-            const full = join(this.cwdOf(worktreePath), path);
+            // The repository root — the image is read from disk at the same base
+            // every other path in this plugin is relative to (repo-root.ts) — and
+            // through the lock, because this is a raw read with no git in the way
+            // to refuse a path that leaves the repository (path-lock.ts).
+            const full = resolveInside(await this.rootedDirOf(worktreePath, signal), path);
             let size = 0;
             try {
                 const info = await stat(full);
@@ -848,11 +921,11 @@ let GitWorkbenchService = (() => {
          * Those are the files whose diff has to be synthesized rather than asked of
          * `git diff`, which reports nothing for them.
          */
-        async isUntracked(cwd, path, signal) {
-            const listed = await this.git(cwd, ['ls-files', '--', path], signal);
+        async isUntracked(root, path, signal) {
+            const listed = await this.git(root, ['ls-files', '--', path], signal);
             if (listed.exitCode !== 0 || listed.stdout.trim().length > 0)
                 return false;
-            const head = await this.git(cwd, ['rev-parse', '--verify', '--quiet', `HEAD:${path}`], signal);
+            const head = await this.git(root, ['rev-parse', '--verify', '--quiet', `HEAD:${path}`], signal);
             return head.exitCode !== 0;
         }
         /**
@@ -885,11 +958,17 @@ let GitWorkbenchService = (() => {
             // empty pane. Against the first parent the answer is well defined and is the
             // useful one: what this merge brought into the branch it landed on. On a
             // single-parent commit the flag is a no-op, byte for byte.
+            // The repository root: no pathspec here today, but the cache key below
+            // must describe the same repository to a later caller, and running from
+            // the root is the one rule every read in this plugin follows
+            // (repo-root.ts). Resolved after the cache probe so a hit spawns
+            // nothing.
+            const root = await this.rootedDirOf(worktreePath, signal);
             const [meta, numstat, nameStatus, patch] = await Promise.all([
-                this.git(cwd, ['show', hash, '--no-patch', `--format=${LOG_FORMAT}`], signal),
-                this.git(cwd, ['show', hash, '--first-parent', '--numstat', '--format=', '--no-renames'], signal),
-                this.git(cwd, ['show', hash, '--first-parent', '--name-status', '--format=', '--no-renames'], signal),
-                this.git(cwd, ['show', hash, '--first-parent', '--format=', '--no-renames'], signal),
+                this.git(root, ['show', hash, '--no-patch', `--format=${LOG_FORMAT}`], signal),
+                this.git(root, ['show', hash, '--first-parent', '--numstat', '--format=', '--no-renames'], signal),
+                this.git(root, ['show', hash, '--first-parent', '--name-status', '--format=', '--no-renames'], signal),
+                this.git(root, ['show', hash, '--first-parent', '--format=', '--no-renames'], signal),
             ]);
             if (meta.exitCode !== 0) {
                 const detail = meta.stderr.length > 0 ? `: ${meta.stderr}` : '';
@@ -954,6 +1033,10 @@ let GitWorkbenchService = (() => {
             const from = Number.isInteger(skip) && skip >= 0 ? skip : 0;
             const size = Number.isInteger(limit) && limit > 0 && limit <= HISTORY_PAGE_MAX ? limit : HISTORY_PAGE;
             const effective = filter ?? emptyLogFilter();
+            // The repository root: a filter's pathspec is repository-relative, and
+            // git resolves pathspecs against the cwd — from a subdirectory a
+            // filtered history silently comes back EMPTY with exit 0 (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             // Reading one row beyond the page answers "is there more" without a second
             // traversal of the log.
             //
@@ -966,7 +1049,7 @@ let GitWorkbenchService = (() => {
             //
             // Filter args go LAST: their segment ends with `--` + pathspecs, and
             // nothing after that separator may be parsed as a flag.
-            const log = await this.git(cwd, ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`, ...logFilterArgs(effective)], signal);
+            const log = await this.git(root, ['log', target, '--topo-order', `--skip=${from}`, `-${size + 1}`, `--pretty=format:${LOG_FORMAT}`, ...logFilterArgs(effective)], signal);
             // A bad filter (unparsable regex, invalid date) dies here, and an empty
             // page is indistinguishable from "no match" unless the failure speaks —
             // §6.13: the exit code + stderr tail is the only honest answer.
@@ -1001,20 +1084,112 @@ let GitWorkbenchService = (() => {
         }
         /**
          * Every file path on HEAD — the filter popup's path picker, aggregated into
-         * a directory tree client-side.
+         * a directory tree client-side — plus the ignored-but-present entries the
+         * Files tab browses.
+         *
+         * The ignored listing is `ls-files --others --ignored --exclude-standard
+         * --directory`: every ignored FILE is listed verbatim (`application-local.yml`
+         * is exactly the file a browser must find and `ls-tree HEAD` cannot), while
+         * every directory a rule ignores as a whole collapses to ONE line with a
+         * trailing slash — `node_modules/` costs one entry, not the ~40k files
+         * inside it. The list therefore scales with the .gitignore's coverage, not
+         * the repository: measured 54 entries / 48ms on this checkout with
+         * node_modules present.
          *
-         * `-z` is load-bearing: NUL-separated output is UNQUOTED, while the default
-         * would render non-ASCII names as quoted octal escapes under
-         * `core.quotepath` and hand the picker garbage.
+         * `-z` is load-bearing on both spawns: NUL-separated output is UNQUOTED,
+         * while the default would render non-ASCII names as quoted octal escapes
+         * under `core.quotepath` and hand the picker garbage.
          * @param worktreePath - worktree whose HEAD is listed; empty falls back to the host cwd.
          * @param signal - abort signal.
          */
         async repoTree(worktreePath, signal) {
-            const cwd = typeof worktreePath === 'string' && worktreePath.length > 0 ? worktreePath : process.cwd();
-            const res = await this.git(cwd, ['ls-tree', '-r', '-z', '--name-only', 'HEAD'], signal);
+            // The repository root: unlike status and numstat, `ls-tree` prints
+            // cwd-RELATIVE paths — from a subdirectory every entry would lose the
+            // `server/` prefix and the picker would feed the log filter pathspecs
+            // that match nothing (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
+            const [res, ignoredRes] = await Promise.all([
+                this.git(root, ['ls-tree', '-r', '-z', '--name-only', 'HEAD'], signal),
+                this.git(root, ['ls-files', '--others', '--ignored', '--exclude-standard', '--directory', '-z'], signal),
+            ]);
             const all = res.stdout.split('\0').filter(path => path.length > 0);
             const truncated = all.length > TREE_PATH_CAP;
-            return { paths: truncated ? all.slice(0, TREE_PATH_CAP) : all, truncated };
+            const ignoredAll = ignoredRes.stdout.split('\0').filter(path => path.length > 0);
+            const ignoredTruncated = ignoredAll.length > IGNORED_PATH_CAP;
+            // `ls-tree`'s exit code is deliberately NOT checked: a repository with no
+            // HEAD yet fails it, and "this repository has no files" is the honest
+            // answer there. The ignored listing has no such legitimate failure, so a
+            // non-zero exit is reported rather than served as an empty list — the one
+            // shape that is indistinguishable from a repository ignoring nothing.
+            const ignoredError = ignoredRes.exitCode === 0
+                ? undefined
+                : (ignoredRes.stderr.trim() || `git ls-files failed (exit ${ignoredRes.exitCode})`).slice(-500);
+            return {
+                paths: truncated ? all.slice(0, TREE_PATH_CAP) : all,
+                truncated,
+                ignored: ignoredTruncated ? ignoredAll.slice(0, IGNORED_PATH_CAP) : ignoredAll,
+                ignoredTruncated,
+                ...(ignoredError !== undefined ? { ignoredError } : {}),
+            };
+        }
+        /**
+         * One level of one ignored directory, read from the filesystem — the step
+         * behind clicking `node_modules/` open in the Files tab.
+         *
+         * Deliberately NOT a git listing: with `--directory`, a pathspec under an
+         * ignored directory still collapses to that one directory line (probed:
+         * `ls-files --others --ignored --exclude-standard --directory -- 'node_modules/*'`
+         * answers `node_modules/` and nothing else), and dropping `--directory`
+         * would enumerate every file inside at once — the very flood the collapsed
+         * listing exists to avoid. `readdir` is one level by construction and costs
+         * milliseconds. What the entries ARE is inherited anyway: everything below
+         * an ignored directory is ignored by descent, so the browser owes the
+         * reader the directory's contents, not git's opinion of them.
+         *
+         * A directory that vanished between the listing and the click answers
+         * empty: nothing to browse is the honest answer, and the next refresh
+         * drops the row.
+         *
+         * The name says what it is FOR, not what it permits: nothing here checks
+         * that `dir` is ignored, so this lists any directory inside the worktree.
+         * That is the same reach the reader already has through `fileSides` and
+         * `fileImage`, and adding an ignore check would only make the browser ask
+         * git a second question to learn what it already knows from the listing it
+         * was handed. What it does NOT permit is leaving the worktree, which is
+         * what the path lock below is for.
+         * @param worktreePath - worktree the directory lives in; empty falls back to the host cwd.
+         * @param dir - repo-relative directory path, as the collapsed listing named it.
+         * @param signal - abort signal.
+         */
+        async ignoredDir(worktreePath, dir, signal) {
+            // The same lock every filesystem read in this plugin passes: the browser
+            // is a less trusted source of paths than git's own output, and `readdir`
+            // obeys no repository boundary (path-lock.ts).
+            const target = resolveInside(await this.rootedDirOf(worktreePath, signal), dir);
+            let dirents;
+            try {
+                dirents = await readdir(target, { withFileTypes: true });
+            }
+            catch {
+                return { entries: [], truncated: false };
+            }
+            const plain = dirents
+                .filter(entry => !entry.isSymbolicLink())
+                .map(entry => ({ name: entry.name, dir: entry.isDirectory() }));
+            // A pnpm-style layout makes every package row a symlink into the store;
+            // `withFileTypes` reports the LINK, so a follow-up stat decides whether
+            // the row expands. A broken link reads as a file and simply fails to
+            // open, like any other dangling name.
+            const links = dirents.filter(entry => entry.isSymbolicLink());
+            const resolved = await Promise.all(links.map(async (entry) => {
+                try {
+                    return { name: entry.name, dir: (await stat(join(target, entry.name))).isDirectory() };
+                }
+                catch {
+                    return { name: entry.name, dir: false };
+                }
+            }));
+            return shapeDirChildren([...plain, ...resolved]);
         }
         /**
          * Compare two refs, in the same {@link WorkbenchStats} shape as every other view.
@@ -1087,13 +1262,20 @@ let GitWorkbenchService = (() => {
                 files, diff, commits: parseLog(log.stdout),
             };
         }
-        /** The session's worktree binding, or nulls when unbound (plain-identifier params; signal last). */
+        /**
+         * The session's EFFECTIVE worktree binding — its own, else the nearest bound
+         * ancestor's — or nulls when neither exists. This is what the chip follows,
+         * so a subagent session shows the worktree its conversation works in without
+         * ever holding a binding of its own (plain-identifier params; signal last).
+         */
         async sessionWorktree(sessionId, signal) {
             if (typeof sessionId !== 'string' || sessionId.length === 0)
-                return { worktreePath: null, name: null };
+                return { worktreePath: null, name: null, inherited: false };
             const file = await this.bindingsIo().load();
-            const binding = file.bindings[sessionId];
-            return binding === undefined ? { worktreePath: null, name: null } : { worktreePath: binding.worktreePath, name: binding.name };
+            const effective = resolveEffectiveBinding(sessionId, this.parentOf, id => file.bindings[id]);
+            return effective === undefined
+                ? { worktreePath: null, name: null, inherited: false }
+                : { worktreePath: effective.binding.worktreePath, name: effective.binding.name, inherited: effective.inherited };
         }
         /** Create (or reuse) a git worktree under `<repoRoot>/.agents/worktrees/` and bind the session to it. */
         async worktreeEnter(sessionId, repoPath, name, signal) {
@@ -1185,8 +1367,15 @@ let GitWorkbenchService = (() => {
             return this.withBindings(async (io) => {
                 const file = await io.load();
                 const binding = file.bindings[sessionId];
-                if (binding === undefined)
-                    return { ok: false, error: 'no worktree binding for this session' };
+                if (binding === undefined) {
+                    // A subagent CAN see a worktree in its status while holding no binding
+                    // of its own (it works under its parent's). Naming that here keeps the
+                    // model from retrying an exit that cannot succeed.
+                    const inherited = resolveEffectiveBinding(sessionId, this.parentOf, id => file.bindings[id]);
+                    return inherited === undefined
+                        ? { ok: false, error: 'no worktree binding for this session' }
+                        : { ok: false, error: 'this session has no binding of its own; its worktree is entered by a parent session — ask the parent session to call worktree_exit' };
+                }
                 if (remove === true) {
                     const status = await this.git(binding.worktreePath, ['status', '--porcelain'], signal);
                     if (status.exitCode !== 0) {
@@ -1217,21 +1406,26 @@ let GitWorkbenchService = (() => {
          * Branches come back most-recently-committed first. With hundreds of them the
          * order is what makes the list usable — the handful anyone is working on sit
          * at the top, so the picker is useful before a single character is typed.
-         * @param sessionId - session whose binding is looked up.
+         * @param sessionId - session whose effective binding is looked up.
          * @param repoPath - caller's directory, used when the session is unbound.
          * @param signal - abort signal.
-         * @returns the binding, the repository's worktrees, and its local branches.
+         * @returns the effective binding (with whether an ancestor lent it), the
+         * repository's worktrees, and its local branches.
          */
         async worktreeStatus(sessionId, repoPath, signal) {
             const file = await this.bindingsIo().load();
-            const binding = typeof sessionId === 'string' && sessionId.length > 0 ? file.bindings[sessionId] ?? null : null;
+            const effective = typeof sessionId === 'string' && sessionId.length > 0
+                ? resolveEffectiveBinding(sessionId, this.parentOf, id => file.bindings[id])
+                : undefined;
+            const binding = effective?.binding ?? null;
+            const bindingInherited = effective?.inherited ?? false;
             // Unbound: list the CALLER's repo. Falling back to the host's launch directory
             // would answer about whatever directory dsh was started in, not this session's.
             const caller = typeof repoPath === 'string' && repoPath.length > 0 ? repoPath.replace(/\\/g, '/') : process.cwd();
             const cwd = binding?.repoRoot ?? caller;
             const root = await this.repoRootOf(cwd, signal);
             if (root === null)
-                return { binding, worktrees: [], branches: [], branchesTruncated: false };
+                return { binding, bindingInherited, worktrees: [], branches: [], branchesTruncated: false };
             const [listed, named] = await Promise.all([
                 this.git(root, ['worktree', 'list', '--porcelain'], signal),
                 this.git(root, ['branch', '--sort=-committerdate', '--format=%(refname:short)'], signal),
@@ -1240,6 +1434,7 @@ let GitWorkbenchService = (() => {
             const { branches, branchesTruncated } = capBranches(all, BRANCH_LIST_CAP);
             return {
                 binding,
+                bindingInherited,
                 worktrees: parseWorktreeList(listed.stdout),
                 branches,
                 branchesTruncated,
@@ -1318,22 +1513,28 @@ let GitWorkbenchService = (() => {
         }
         /**
          * Add paths to the index.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param paths - repository-relative paths; an empty list is refused rather
          *                than turned into a whole-tree `git add`.
          * @param signal - abort signal.
          */
         async stage(worktreePath, paths, signal) {
-            return this.writeOp(worktreePath, () => stageArgv(asPathList(paths)), signal);
+            // The repository root: `git add` resolves its pathspecs against the cwd,
+            // and from a subdirectory a repository-relative path dies with
+            // "pathspec did not match any files" (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
+            return this.writeOp(root, () => stageArgv(asPathList(paths)), signal);
         }
         /**
          * Remove paths from the index, leaving the working tree untouched.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param paths - repository-relative paths.
          * @param signal - abort signal.
          */
         async unstage(worktreePath, paths, signal) {
-            return this.writeOp(worktreePath, () => unstageArgv(asPathList(paths)), signal);
+            // Same rule as `stage` — the pathspecs are repository-relative.
+            const root = await this.rootedDirOf(worktreePath, signal);
+            return this.writeOp(root, () => unstageArgv(asPathList(paths)), signal);
         }
         /**
          * What discarding this file WOULD do, without doing it.
@@ -1344,16 +1545,19 @@ let GitWorkbenchService = (() => {
          * cannot come back" is exactly the difference the reader is being asked
          * about. So the dialog is built from this, read fresh, rather than from the
          * row that was clicked.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param signal - abort signal.
          * @returns the effect and whether it is irreversible; `effect` is absent when
          *          git reports nothing to discard for that path.
          */
         async discardPlan(worktreePath, path, signal) {
+            // The repository root — the plan's argv and delete paths are
+            // repository-relative (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             let plan;
             try {
-                plan = await this.planDiscard(worktreePath, path, signal);
+                plan = await this.planDiscard(root, path, signal);
             }
             catch (error) {
                 return { error: error instanceof Error ? error.message : String(error) };
@@ -1378,7 +1582,7 @@ let GitWorkbenchService = (() => {
          * it. `expectedEffect` is what the reader was shown and agreed to: if the
          * file changed underneath the dialog — staged, edited, reverted by someone
          * else — the freshly derived effect no longer matches and nothing is done.
-         * @param worktreePath - directory to run in.
+         * @param worktreePath - directory the session opened; git runs at its repository root.
          * @param path - repository-relative path, as the drawer lists it.
          * @param expectedEffect - the effect the confirmation stated; blank skips
          *                         the agreement check, which only the reversible
@@ -1387,9 +1591,13 @@ let GitWorkbenchService = (() => {
          * @returns the operation result, with the effect actually carried out.
          */
         async discardFile(worktreePath, path, expectedEffect, signal) {
+            // The repository root, resolved ONCE for the plan and the steps alike:
+            // every step's argv and delete path came out of a whole-tree porcelain
+            // status, so they are repository-relative (repo-root.ts).
+            const root = await this.rootedDirOf(worktreePath, signal);
             let plan;
             try {
-                plan = await this.planDiscard(worktreePath, path, signal);
+                plan = await this.planDiscard(root, path, signal);
             }
             catch (error) {
                 return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) };
@@ -1405,10 +1613,9 @@ let GitWorkbenchService = (() => {
                     error: `this file changed since you were asked (now: ${plan.effect}); nothing was done`,
                 };
             }
-            const cwd = this.cwdOf(worktreePath);
             for (const step of plan.steps) {
                 if (step.kind === 'git') {
-                    const result = await this.git(cwd, step.argv, signal);
+                    const result = await this.git(root, step.argv, signal);
                     const failure = classifyFailure(result.exitCode, result.stderr, result.stdout);
                     if (failure !== null) {
                         return { ok: false, failure, error: (result.stderr || result.stdout).trim().slice(-1000) };
@@ -1416,7 +1623,7 @@ let GitWorkbenchService = (() => {
                     continue;
                 }
                 try {
-                    await removePathInside(cwd, step.path);
+                    await removePathInside(root, step.path);
                 }
                 catch (error) {
                     return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) };
@@ -1432,12 +1639,14 @@ let GitWorkbenchService = (() => {
          * reports `D` plus `??` instead — which plans as "restore one, DELETE the
          * other" where the truth is "undo the rename".
          */
-        async planDiscard(worktreePath, path, signal) {
+        async planDiscard(root, path, signal) {
             if (typeof path !== 'string' || !isSafePathArg(path)) {
                 throw new Error(`unsafe path argument: ${JSON.stringify(path)}`);
             }
-            const cwd = this.cwdOf(worktreePath);
-            const status = await this.git(cwd, ['status', '--porcelain=v1', '--untracked-files=all'], signal);
+            // Runs at the repository root the caller resolved: the plan's paths
+            // must agree with the directory its steps execute in, and with the
+            // client's `path`, which the drawer lists repository-relative.
+            const status = await this.git(root, ['status', '--porcelain=v1', '--untracked-files=all'], signal);
             if (status.exitCode !== 0) {
                 throw new Error((status.stderr || status.stdout).trim().slice(-1000) || 'git status failed');
             }
@@ -1451,7 +1660,8 @@ let GitWorkbenchService = (() => {
          * @param signal - abort signal.
          */
         async commit(worktreePath, message, amend, signal) {
-            return this.writeOp(worktreePath, () => commitArgv(String(message ?? ''), amend === true), signal);
+            // No pathspec in this argv — the session's own directory suffices.
+            return this.writeOp(this.cwdOf(worktreePath), () => commitArgv(String(message ?? ''), amend === true), signal);
         }
         /**
          * Update remote-tracking refs without touching the working tree.
@@ -1460,7 +1670,7 @@ let GitWorkbenchService = (() => {
          * @returns the operation result, plus the divergence the fetch revealed.
          */
         async fetch(worktreePath, signal) {
-            const result = await this.writeOp(worktreePath, () => fetchArgv(), signal, NETWORK_GRACE_MS);
+            const result = await this.writeOp(this.cwdOf(worktreePath), () => fetchArgv(), signal, NETWORK_GRACE_MS);
             if (!result.ok)
                 return result;
             // The point of fetching is the count it produces, so report it in the same
@@ -1477,7 +1687,7 @@ let GitWorkbenchService = (() => {
          */
         async pull(worktreePath, mode, signal) {
             const chosen = mode === 'rebase' || mode === 'merge' ? mode : 'ff-only';
-            return this.writeOp(worktreePath, () => pullArgv(chosen), signal, NETWORK_GRACE_MS);
+            return this.writeOp(this.cwdOf(worktreePath), () => pullArgv(chosen), signal, NETWORK_GRACE_MS);
         }
         /**
          * Publish the current branch.
@@ -1496,10 +1706,16 @@ let GitWorkbenchService = (() => {
                 return { ok: false, failure: 'unknown', error: 'HEAD is detached; nothing to push' };
             if (tracking.branch.length === 0)
                 return { ok: false, failure: 'unknown', error: 'no branch to push' };
-            return this.writeOp(worktreePath, () => pushArgv(tracking.branch, tracking.upstream !== null), signal, NETWORK_GRACE_MS);
+            return this.writeOp(this.cwdOf(worktreePath), () => pushArgv(tracking.branch, tracking.upstream !== null), signal, NETWORK_GRACE_MS);
         }
-        /** Shared shape for every write op: run it, classify what went wrong. */
-        async writeOp(worktreePath, build, signal, graceMs) {
+        /** Shared shape for every write op: run it, classify what went wrong.
+         *
+         * Takes the DIRECTORY to run in, already resolved: callers carrying
+         * repository-relative pathspecs pass the rooted directory
+         * ({@link GitWorkbenchService.rootedDirOf}); pathspec-free operations may
+         * pass the session's own directory.
+         */
+        async writeOp(dir, build, signal, graceMs) {
             let argv;
             try {
                 argv = build();
@@ -1509,7 +1725,7 @@ let GitWorkbenchService = (() => {
                 // list or a blank commit message takes.
                 return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) };
             }
-            const result = await this.git(this.cwdOf(worktreePath), argv, signal, graceMs);
+            const result = await this.git(dir, argv, signal, graceMs);
             const failure = classifyFailure(result.exitCode, result.stderr, result.stdout);
             if (failure === null)
                 return { ok: true, output: result.stdout.trim().slice(-1000) };
@@ -1567,11 +1783,24 @@ let GitWorkbenchService = (() => {
             return run;
         }
         /** Resolve the repo root for a directory (null when not a git repo). Always forward slashes. */
-        async repoRootOf(cwd, signal) {
-            const out = await this.git(cwd, ['rev-parse', '--show-toplevel'], signal);
-            if (out.exitCode !== 0)
-                return null;
-            return out.stdout.trim().replace(/\\/g, '/') || null;
+        repoRootOf(cwd, signal) {
+            return resolveRepoRoot((dir, argv) => this.git(dir, argv, signal), cwd);
+        }
+        /**
+         * The directory to run git in and join paths against for a session's
+         * `worktreePath`: the repository ROOT, falling back to the directory
+         * itself outside a repository (the caller's own git run then fails the
+         * way it always did, and that error is the honest one to show).
+         *
+         * The drawer's paths are repository-relative — porcelain status and
+         * `--numstat` print them that way wherever they run — while pathspecs,
+         * `:path` revisions, `hash-object` arguments and `join(dir, path)` all
+         * resolve against the directory a command runs in. Those two halves only
+         * agree at the root, so every method that carries a path runs there.
+         * `repo-root.ts` tells the whole story, with the probes that caught it.
+         */
+        rootedDirOf(worktreePath, signal) {
+            return rootedDir((dir, argv) => this.git(dir, argv, signal), this.cwdOf(worktreePath));
         }
         /**
          * Spawn `git <args>` in cwd with piped stdio; drains both streams and returns
@@ -1640,14 +1869,14 @@ async function mapPooled(items, limit, task) {
  * count newlines is the expensive half of this pass, and most untracked files
  * never reach the bundled diff. Never throws; an unreadable file reports zero
  * lines and nothing to diff.
- * @param cwd - worktree the path is relative to.
+ * @param root - repository root the path is relative to.
  * @param path - repository-relative file path.
  * @returns the file's line count, binary flag, and whether a diff may be built.
  */
-async function measureUntracked(cwd, path) {
+async function measureUntracked(root, path) {
     let bytes;
     try {
-        bytes = await readFile(join(cwd, path));
+        bytes = await readFile(resolveInside(root, path));
     }
     catch {
         return { lineCount: 0, binary: false, diffable: false };
@@ -1665,16 +1894,16 @@ async function measureUntracked(cwd, path) {
  *
  * `git diff --no-index /dev/null <f>` is NOT used: on Windows git resolves
  * `/dev/null` as a repo-relative path. Never throws.
- * @param cwd - worktree the path is relative to.
+ * @param root - repository root the path is relative to.
  * @param path - repository-relative file path.
  * @param byteCap - refuse files larger than this; defaults to the stats
  *                  payload's budget, which `fileSides` raises to its own.
  * @returns the segment, or null when the file is missing, binary, or oversized.
  */
-async function untrackedSegment(cwd, path, byteCap = UNTRACKED_FILE_BYTE_CAP) {
+async function untrackedSegment(root, path, byteCap = UNTRACKED_FILE_BYTE_CAP) {
     let bytes;
     try {
-        bytes = await readFile(join(cwd, path));
+        bytes = await readFile(resolveInside(root, path));
     }
     catch {
         return null;