@young1lin/dsh-ui-gitworkbench 0.1.4 → 0.1.5

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 本文件记录面向使用者的变更。格式参考 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，版本号遵循语义化版本。
 
+## [0.1.5] - 2026-08-18
+
+### 修复
+
+- **目录行的撤回直接失败（EISDIR）**。`git status` 不会走进另一个仓库，嵌套的未跟踪仓库即使带 `--untracked-files=all` 也只报一行 `?? sub/`——那是一个**目录**行，而删除步骤没带 `recursive`，于是抽屉里唯独这一种行的撤回以 `EISDIR` 告终。删除步骤现在单独成模块（`src/fs-remove.ts`），路径校验与真实文件系统行为都有测试盖着。
+- **撤回失败不再静默**。“这个文件撤回会发生什么”这一问失败时，之前与“git 说这个文件本来就没改动”返回同一个值，两者都只是静静地刷新——点下去看不出与按钮坏了有什么区别，而按钮坏了的自然反应是再点一次。现在失败把 git 自己的话抬到操作横幅上，“没什么可撤”仍然只刷新（那一行自己会消失，这既是反馈也是修复）。
+- **传输层报错不再把抽屉卡在“询问中”**。计划请求抛异常时，之前无人接手：弹窗永远不开，状态也不复位，只能关掉抽屉。
+- **认不出的后果一律弹窗**。只有 host 明确标为可逆（`irreversible: false`，即“找回被删文件”）才跳过确认；比本包新的 host 报一个未知 effect 时，缺失的标记不再被当成“可逆”而直接动手。
+
 ## [0.1.4] - 2026-08-18
 
 ### 新增

package/CHANGELOG_EN.md

@@ -2,6 +2,15 @@
 
 User-facing changes, newest first. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows SemVer.
 
+## [0.1.5] - 2026-08-18
+
+### Fixed
+
+- **Rolling back a directory row failed outright (`EISDIR`)**. `git status` will not descend into another repository: a nested untracked repo is reported as a single `?? sub/` line even under `--untracked-files=all`, and that row names a **directory**. The delete step lacked `recursive`, so it was the one row in the drawer whose roll-back died with `EISDIR`. The delete now lives in its own module (`src/fs-remove.ts`) with tests over both the path checks and the real filesystem behaviour.
+- **A failed roll-back no longer looks like a dead button**. Asking the host what rolling a file back would do used to return the same value whether it failed or whether git simply reported nothing to roll back, and both ended in a silent refresh. Failure now puts git's own words in the operation banner; "nothing to roll back" still just refreshes, since the row disappearing is both the feedback and the fix.
+- **A transport error no longer strands the drawer mid-question**. A throw from the plan request had no handler: the dialog never opened and the state never cleared, leaving no way out but closing the drawer.
+- **An unrecognised consequence now always confirms**. Only an explicit `irreversible: false` from the host (recovering a deleted file) skips the dialog; an effect newer than this bundle no longer reads a missing flag as "reversible" and act on it silently.
+
 ## [0.1.4] - 2026-08-18
 
 ### Added

package/lib/client.js

@@ -790,6 +790,40 @@ window.__ModuleLoader__.load({
 			return [...hits.filter((hit) => hit.isFile), ...hits.filter((hit) => !hit.isFile)];
 		}
 		//#endregion
+		//#region src/client/discard-flow.ts
+		/** Fallback text for a failure that arrived with nothing to say. */
+		const UNKNOWN_DISCARD_ERROR = "discardPlan failed";
+		/**
+		* Decide what a roll-back click does with the answer it got.
+		*
+		* @param answer - the host's reply, or the failure that replaced it.
+		* @returns the single next step; never null, because every answer including a
+		*          broken one has to lead somewhere the reader can see.
+		*/
+		function nextAfterPlan(answer) {
+			if (answer.kind === "failed") {
+				const error = answer.error.trim();
+				return {
+					kind: "report",
+					error: error.length > 0 ? error : UNKNOWN_DISCARD_ERROR
+				};
+			}
+			const plan = answer.plan;
+			if (typeof plan.error === "string" && plan.error.trim().length > 0) return {
+				kind: "report",
+				error: plan.error.trim()
+			};
+			if (plan.effect === void 0) return { kind: "refresh" };
+			if (plan.irreversible === false) return {
+				kind: "run",
+				effect: plan.effect
+			};
+			return {
+				kind: "confirm",
+				plan
+			};
+		}
+		//#endregion
 		//#region src/client/file-filter.ts
 		/**
 		* Narrowing a file list by typing at it.
@@ -12214,262 +12248,262 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 			document.head.appendChild(tag);
 		}
 		var GitWorkbenchPanel_module_css_default = {
-			"syncSpacer": "SD8qLW_syncSpacer",
 			"treeDirActive": "SD8qLW_treeDirActive",
-			"commits": "SD8qLW_commits",
+			"funnelFootClear": "SD8qLW_funnelFootClear",
+			"overlayMax": "SD8qLW_overlayMax",
+			"cardBranch": "SD8qLW_cardBranch",
+			"funnelMore": "SD8qLW_funnelMore",
+			"lineHunk": "SD8qLW_lineHunk",
+			"treeDirCounts": "SD8qLW_treeDirCounts",
 			"btnAhead": "SD8qLW_btnAhead",
-			"commitTop": "SD8qLW_commitTop",
-			"commitPopSubject": "SD8qLW_commitPopSubject",
-			"segment": "SD8qLW_segment",
-			"funnelChevron": "SD8qLW_funnelChevron",
-			"resizerActive": "SD8qLW_resizerActive",
-			"segmented": "SD8qLW_segmented",
-			"commitMessage": "SD8qLW_commitMessage",
-			"signDel": "SD8qLW_signDel",
-			"themeRail": "SD8qLW_themeRail",
-			"cardAdded": "SD8qLW_cardAdded",
-			"refEmpty": "SD8qLW_refEmpty",
-			"file": "SD8qLW_file",
-			"elide": "SD8qLW_elide",
-			"sliderValue": "SD8qLW_sliderValue",
-			"fileBinary": "SD8qLW_fileBinary",
-			"wtCurrent": "SD8qLW_wtCurrent",
+			"chipLight": "SD8qLW_chipLight",
+			"commitSubject": "SD8qLW_commitSubject",
+			"calHead": "SD8qLW_calHead",
+			"funnelTabCount": "SD8qLW_funnelTabCount",
+			"funnelSearch": "SD8qLW_funnelSearch",
+			"commitPopMeta": "SD8qLW_commitPopMeta",
+			"confirmBody": "SD8qLW_confirmBody",
+			"headerView": "SD8qLW_headerView",
+			"commit": "SD8qLW_commit",
+			"lnNew": "SD8qLW_lnNew",
+			"syncUpstream": "SD8qLW_syncUpstream",
+			"bgPreview": "SD8qLW_bgPreview",
 			"funnelBoundBtnActive": "SD8qLW_funnelBoundBtnActive",
+			"card": "SD8qLW_card",
 			"wordDel": "SD8qLW_wordDel",
+			"commitRefMore": "SD8qLW_commitRefMore",
 			"themeRowSplit": "SD8qLW_themeRowSplit",
-			"funnelBounds": "SD8qLW_funnelBounds",
-			"graphCell": "SD8qLW_graphCell",
-			"treeIcon": "SD8qLW_treeIcon",
+			"cardFiles": "SD8qLW_cardFiles",
+			"confirmActions": "SD8qLW_confirmActions",
+			"cal": "SD8qLW_cal",
+			"fileStatus": "SD8qLW_fileStatus",
+			"themeNote": "SD8qLW_themeNote",
+			"btnCount": "SD8qLW_btnCount",
+			"sliderValue": "SD8qLW_sliderValue",
+			"bgEmpty": "SD8qLW_bgEmpty",
+			"cardGlyph": "SD8qLW_cardGlyph",
+			"filterChipRemove": "SD8qLW_filterChipRemove",
 			"scopeHint": "SD8qLW_scopeHint",
-			"paletteRow": "SD8qLW_paletteRow",
-			"btnBehind": "SD8qLW_btnBehind",
-			"stAdded": "SD8qLW_stAdded",
-			"line": "SD8qLW_line",
-			"gutter": "SD8qLW_gutter",
-			"funnelPreset": "SD8qLW_funnelPreset",
-			"treeFilterClear": "SD8qLW_treeFilterClear",
-			"funnelBoundKey": "SD8qLW_funnelBoundKey",
-			"commitActive": "SD8qLW_commitActive",
-			"code": "SD8qLW_code",
-			"commitFilter": "SD8qLW_commitFilter",
+			"confirmTitle": "SD8qLW_confirmTitle",
+			"commitStaged": "SD8qLW_commitStaged",
+			"fileCounts": "SD8qLW_fileCounts",
+			"file": "SD8qLW_file",
+			"btnPrimary": "SD8qLW_btnPrimary",
+			"refRowActive": "SD8qLW_refRowActive",
 			"funnelPop": "SD8qLW_funnelPop",
-			"treeRow": "SD8qLW_treeRow",
-			"funnelList": "SD8qLW_funnelList",
-			"chevronOpen": "SD8qLW_chevronOpen",
+			"tree": "SD8qLW_tree",
+			"overlay": "SD8qLW_overlay",
+			"commitRef": "SD8qLW_commitRef",
+			"headerTotalsDim": "SD8qLW_headerTotalsDim",
+			"treeWrap": "SD8qLW_treeWrap",
+			"miniBtnPrimary": "SD8qLW_miniBtnPrimary",
+			"elide": "SD8qLW_elide",
+			"funnelTab": "SD8qLW_funnelTab",
+			"checkBox": "SD8qLW_checkBox",
+			"resizer": "SD8qLW_resizer",
+			"tabActive": "SD8qLW_tabActive",
+			"pathDirGlyph": "SD8qLW_pathDirGlyph",
+			"cardWt": "SD8qLW_cardWt",
+			"themeLabel": "SD8qLW_themeLabel",
+			"headerRight": "SD8qLW_headerRight",
+			"signAdd": "SD8qLW_signAdd",
+			"scopeBtn": "SD8qLW_scopeBtn",
+			"cardBranchName": "SD8qLW_cardBranchName",
+			"wtCurrent": "SD8qLW_wtCurrent",
+			"menuPop": "SD8qLW_menuPop",
+			"miniBtn": "SD8qLW_miniBtn",
+			"segmentActive": "SD8qLW_segmentActive",
+			"stDeleted": "SD8qLW_stDeleted",
+			"refButton": "SD8qLW_refButton",
+			"calGrid": "SD8qLW_calGrid",
+			"segmented": "SD8qLW_segmented",
+			"filterChips": "SD8qLW_filterChips",
+			"pathNode": "SD8qLW_pathNode",
+			"treeActions": "SD8qLW_treeActions",
+			"diffPre": "SD8qLW_diffPre",
+			"lineContext": "SD8qLW_lineContext",
+			"funnelRow": "SD8qLW_funnelRow",
+			"commitWhen": "SD8qLW_commitWhen",
+			"funnelButton": "SD8qLW_funnelButton",
+			"btnBehind": "SD8qLW_btnBehind",
+			"gsSlide": "SD8qLW_gsSlide",
+			"stModified": "SD8qLW_stModified",
+			"btn": "SD8qLW_btn",
+			"chipSystem": "SD8qLW_chipSystem",
+			"checkMarkOn": "SD8qLW_checkMarkOn",
+			"funnel": "SD8qLW_funnel",
+			"refPop": "SD8qLW_refPop",
+			"treeIconOn": "SD8qLW_treeIconOn",
+			"scopeBtnActive": "SD8qLW_scopeBtnActive",
 			"segmentChip": "SD8qLW_segmentChip",
-			"refLabel": "SD8qLW_refLabel",
-			"calNav": "SD8qLW_calNav",
+			"paneDividerActive": "SD8qLW_paneDividerActive",
+			"commitPop": "SD8qLW_commitPop",
+			"opBanner": "SD8qLW_opBanner",
+			"funnelFootCountOn": "SD8qLW_funnelFootCountOn",
+			"cardAdded": "SD8qLW_cardAdded",
+			"drawer": "SD8qLW_drawer",
+			"headerTotalsAdd": "SD8qLW_headerTotalsAdd",
+			"refPicker": "SD8qLW_refPicker",
 			"refFoot": "SD8qLW_refFoot",
-			"miniBtn": "SD8qLW_miniBtn",
+			"treeTools": "SD8qLW_treeTools",
 			"commitAmend": "SD8qLW_commitAmend",
-			"treeDirCounts": "SD8qLW_treeDirCounts",
-			"chevron": "SD8qLW_chevron",
-			"headerPicker": "SD8qLW_headerPicker",
-			"overlay": "SD8qLW_overlay",
-			"syncBar": "SD8qLW_syncBar",
+			"pullGroup": "SD8qLW_pullGroup",
+			"headerViewRef": "SD8qLW_headerViewRef",
+			"refRow": "SD8qLW_refRow",
+			"stRenamed": "SD8qLW_stRenamed",
 			"funnelPresetActive": "SD8qLW_funnelPresetActive",
-			"refValue": "SD8qLW_refValue",
-			"refList": "SD8qLW_refList",
-			"funnelBoundRows": "SD8qLW_funnelBoundRows",
-			"funnelPresets": "SD8qLW_funnelPresets",
-			"funnelTabActive": "SD8qLW_funnelTabActive",
-			"headerPathMain": "SD8qLW_headerPathMain",
+			"commitPopBody": "SD8qLW_commitPopBody",
+			"renameLine": "SD8qLW_renameLine",
+			"signDel": "SD8qLW_signDel",
+			"funnelTabs": "SD8qLW_funnelTabs",
+			"refGroup": "SD8qLW_refGroup",
+			"commitsFoot": "SD8qLW_commitsFoot",
+			"commitsPane": "SD8qLW_commitsPane",
+			"funnelChevron": "SD8qLW_funnelChevron",
+			"cssArea": "SD8qLW_cssArea",
+			"refEmpty": "SD8qLW_refEmpty",
+			"checkMark": "SD8qLW_checkMark",
+			"themeGroup": "SD8qLW_themeGroup",
+			"paneDivider": "SD8qLW_paneDivider",
+			"elideHead": "SD8qLW_elideHead",
+			"funnelFoot": "SD8qLW_funnelFoot",
+			"fileCountDel": "SD8qLW_fileCountDel",
+			"filePath": "SD8qLW_filePath",
+			"cardDetached": "SD8qLW_cardDetached",
+			"refLabel": "SD8qLW_refLabel",
+			"stAdded": "SD8qLW_stAdded",
+			"body": "SD8qLW_body",
+			"filterChip": "SD8qLW_filterChip",
+			"calNav": "SD8qLW_calNav",
+			"calOut": "SD8qLW_calOut",
+			"syncSpacer": "SD8qLW_syncSpacer",
+			"treeDirLi": "SD8qLW_treeDirLi",
+			"paneHead": "SD8qLW_paneHead",
+			"chevronOpen": "SD8qLW_chevronOpen",
+			"headerLeft": "SD8qLW_headerLeft",
+			"scopeRow": "SD8qLW_scopeRow",
+			"pathFileGlyph": "SD8qLW_pathFileGlyph",
+			"treeEmpty": "SD8qLW_treeEmpty",
+			"commitHasBody": "SD8qLW_commitHasBody",
+			"lineDel": "SD8qLW_lineDel",
+			"fileLi": "SD8qLW_fileLi",
+			"segment": "SD8qLW_segment",
+			"syncBar": "SD8qLW_syncBar",
+			"treeLead": "SD8qLW_treeLead",
+			"lineAdd": "SD8qLW_lineAdd",
+			"line": "SD8qLW_line",
+			"cardSep": "SD8qLW_cardSep",
+			"gutter": "SD8qLW_gutter",
+			"commitBox": "SD8qLW_commitBox",
+			"calTitle": "SD8qLW_calTitle",
+			"treeRow": "SD8qLW_treeRow",
+			"paletteRowActive": "SD8qLW_paletteRowActive",
+			"header": "SD8qLW_header",
+			"commitMessage": "SD8qLW_commitMessage",
 			"treeLabel": "SD8qLW_treeLabel",
-			"bgEmpty": "SD8qLW_bgEmpty",
-			"themeNote": "SD8qLW_themeNote",
-			"treeFilter": "SD8qLW_treeFilter",
-			"treeDirCount": "SD8qLW_treeDirCount",
-			"stModified": "SD8qLW_stModified",
-			"cardFiles": "SD8qLW_cardFiles",
-			"funnelButtonActive": "SD8qLW_funnelButtonActive",
-			"calWeek": "SD8qLW_calWeek",
-			"tabs": "SD8qLW_tabs",
-			"funnelFootCount": "SD8qLW_funnelFootCount",
+			"lnOld": "SD8qLW_lnOld",
+			"funnelBoundClear": "SD8qLW_funnelBoundClear",
+			"headerPicker": "SD8qLW_headerPicker",
 			"fileActive": "SD8qLW_fileActive",
+			"chipDark": "SD8qLW_chipDark",
+			"commitPopTop": "SD8qLW_commitPopTop",
+			"treeDirCount": "SD8qLW_treeDirCount",
+			"commitLead": "SD8qLW_commitLead",
+			"paletteRow": "SD8qLW_paletteRow",
 			"gsFade": "SD8qLW_gsFade",
-			"calIn": "SD8qLW_calIn",
-			"filePath": "SD8qLW_filePath",
-			"funnelBoundVal": "SD8qLW_funnelBoundVal",
-			"refRow": "SD8qLW_refRow",
-			"commitBox": "SD8qLW_commitBox",
-			"calMark": "SD8qLW_calMark",
-			"treeFilterInput": "SD8qLW_treeFilterInput",
-			"commit": "SD8qLW_commit",
-			"btnDanger": "SD8qLW_btnDanger",
-			"commitHasBody": "SD8qLW_commitHasBody",
-			"confirmBox": "SD8qLW_confirmBox",
-			"commitsFoot": "SD8qLW_commitsFoot",
-			"settingsPop": "SD8qLW_settingsPop",
-			"checkBox": "SD8qLW_checkBox",
-			"diffPre": "SD8qLW_diffPre",
-			"headerView": "SD8qLW_headerView",
-			"commitAuthor": "SD8qLW_commitAuthor",
 			"filterClear": "SD8qLW_filterClear",
-			"treeTools": "SD8qLW_treeTools",
-			"scopeBtnActive": "SD8qLW_scopeBtnActive",
-			"chipLight": "SD8qLW_chipLight",
-			"fileCounts": "SD8qLW_fileCounts",
-			"refPop": "SD8qLW_refPop",
-			"themeGroup": "SD8qLW_themeGroup",
-			"funnelTabCount": "SD8qLW_funnelTabCount",
-			"cardBranchName": "SD8qLW_cardBranchName",
-			"card": "SD8qLW_card",
-			"commitWhen": "SD8qLW_commitWhen",
-			"cal": "SD8qLW_cal",
-			"calOut": "SD8qLW_calOut",
+			"funnelTabActive": "SD8qLW_funnelTabActive",
+			"opBannerBad": "SD8qLW_opBannerBad",
+			"headerTotalsDel": "SD8qLW_headerTotalsDel",
 			"refRowName": "SD8qLW_refRowName",
-			"diffPane": "SD8qLW_diffPane",
-			"headerDetached": "SD8qLW_headerDetached",
-			"drawer": "SD8qLW_drawer",
-			"refRowSpacer": "SD8qLW_refRowSpacer",
-			"calTitle": "SD8qLW_calTitle",
-			"wordAdd": "SD8qLW_wordAdd",
-			"cardDetached": "SD8qLW_cardDetached",
-			"funnelTabs": "SD8qLW_funnelTabs",
-			"funnelFoot": "SD8qLW_funnelFoot",
-			"cssArea": "SD8qLW_cssArea",
-			"gsSlide": "SD8qLW_gsSlide",
+			"funnelName": "SD8qLW_funnelName",
 			"elideTail": "SD8qLW_elideTail",
-			"treeCol": "SD8qLW_treeCol",
-			"fileCountAdd": "SD8qLW_fileCountAdd",
-			"stDeleted": "SD8qLW_stDeleted",
-			"commitRow": "SD8qLW_commitRow",
+			"fileBinary": "SD8qLW_fileBinary",
+			"treeIconDown": "SD8qLW_treeIconDown",
 			"stUntracked": "SD8qLW_stUntracked",
-			"treeSub": "SD8qLW_treeSub",
-			"stRenamed": "SD8qLW_stRenamed",
-			"syncLevel": "SD8qLW_syncLevel",
-			"elideHead": "SD8qLW_elideHead",
-			"compareArrow": "SD8qLW_compareArrow",
-			"chipDark": "SD8qLW_chipDark",
-			"cardWt": "SD8qLW_cardWt",
-			"funnelBoundClear": "SD8qLW_funnelBoundClear",
-			"headerTotalsDim": "SD8qLW_headerTotalsDim",
 			"confirmScrim": "SD8qLW_confirmScrim",
-			"funnelPane": "SD8qLW_funnelPane",
-			"tree": "SD8qLW_tree",
-			"treeIconGlyph": "SD8qLW_treeIconGlyph",
-			"btnCount": "SD8qLW_btnCount",
+			"headerPathMain": "SD8qLW_headerPathMain",
+			"theme": "SD8qLW_theme",
+			"funnelBoundVal": "SD8qLW_funnelBoundVal",
+			"sliderRow": "SD8qLW_sliderRow",
+			"treeFilter": "SD8qLW_treeFilter",
+			"commitFilter": "SD8qLW_commitFilter",
+			"funnelBoundKey": "SD8qLW_funnelBoundKey",
+			"graphCell": "SD8qLW_graphCell",
+			"code": "SD8qLW_code",
+			"opBannerOk": "SD8qLW_opBannerOk",
+			"compareArrow": "SD8qLW_compareArrow",
+			"treeSub": "SD8qLW_treeSub",
+			"pathChildren": "SD8qLW_pathChildren",
 			"commitHash": "SD8qLW_commitHash",
-			"headerViewRef": "SD8qLW_headerViewRef",
-			"funnelBoundValSet": "SD8qLW_funnelBoundValSet",
-			"confirmBody": "SD8qLW_confirmBody",
+			"confirmBox": "SD8qLW_confirmBox",
+			"treeFilterInput": "SD8qLW_treeFilterInput",
+			"treeIcon": "SD8qLW_treeIcon",
+			"calIn": "SD8qLW_calIn",
+			"commitLine": "SD8qLW_commitLine",
+			"chevron": "SD8qLW_chevron",
+			"themeDirty": "SD8qLW_themeDirty",
+			"refValue": "SD8qLW_refValue",
+			"commits": "SD8qLW_commits",
+			"funnelBounds": "SD8qLW_funnelBounds",
+			"treeDir": "SD8qLW_treeDir",
+			"headerBranch": "SD8qLW_headerBranch",
+			"treeFilterClear": "SD8qLW_treeFilterClear",
+			"commitTop": "SD8qLW_commitTop",
 			"empty": "SD8qLW_empty",
-			"btnPrimary": "SD8qLW_btnPrimary",
-			"fileDiscard": "SD8qLW_fileDiscard",
-			"pathChildren": "SD8qLW_pathChildren",
-			"opBannerOk": "SD8qLW_opBannerOk",
-			"confirmTitle": "SD8qLW_confirmTitle",
-			"funnelCount": "SD8qLW_funnelCount",
-			"cardBranch": "SD8qLW_cardBranch",
-			"segmentActive": "SD8qLW_segmentActive",
-			"lineContext": "SD8qLW_lineContext",
+			"swatch": "SD8qLW_swatch",
+			"calMark": "SD8qLW_calMark",
+			"commitPopSubject": "SD8qLW_commitPopSubject",
+			"tab": "SD8qLW_tab",
 			"treeDirName": "SD8qLW_treeDirName",
-			"commitPop": "SD8qLW_commitPop",
+			"diffPane": "SD8qLW_diffPane",
+			"commitActive": "SD8qLW_commitActive",
+			"commitSubjectRow": "SD8qLW_commitSubjectRow",
+			"refRowSpacer": "SD8qLW_refRowSpacer",
+			"fileDiscard": "SD8qLW_fileDiscard",
+			"checkMarkPartial": "SD8qLW_checkMarkPartial",
+			"calToday": "SD8qLW_calToday",
+			"btnClose": "SD8qLW_btnClose",
 			"filterChipLabel": "SD8qLW_filterChipLabel",
-			"commitPopBody": "SD8qLW_commitPopBody",
-			"refRowActive": "SD8qLW_refRowActive",
-			"headerLeft": "SD8qLW_headerLeft",
 			"headerTotals": "SD8qLW_headerTotals",
-			"resizer": "SD8qLW_resizer",
-			"funnel": "SD8qLW_funnel",
-			"funnelBoundRow": "SD8qLW_funnelBoundRow",
-			"refGroup": "SD8qLW_refGroup",
-			"opBanner": "SD8qLW_opBanner",
-			"miniBtnPrimary": "SD8qLW_miniBtnPrimary",
-			"btnIcon": "SD8qLW_btnIcon",
-			"funnelButton": "SD8qLW_funnelButton",
-			"funnelSearch": "SD8qLW_funnelSearch",
-			"refSearch": "SD8qLW_refSearch",
-			"commitsPane": "SD8qLW_commitsPane",
-			"lnOld": "SD8qLW_lnOld",
-			"treeIconOn": "SD8qLW_treeIconOn",
-			"headerBranch": "SD8qLW_headerBranch",
-			"swatch": "SD8qLW_swatch",
-			"funnelTab": "SD8qLW_funnelTab",
-			"syncUpstream": "SD8qLW_syncUpstream",
-			"commitLead": "SD8qLW_commitLead",
-			"pullGroup": "SD8qLW_pullGroup",
-			"lineAdd": "SD8qLW_lineAdd",
-			"treeIconDown": "SD8qLW_treeIconDown",
-			"checkMark": "SD8qLW_checkMark",
-			"commitStaged": "SD8qLW_commitStaged",
-			"lineHunk": "SD8qLW_lineHunk",
-			"treeWrap": "SD8qLW_treeWrap",
-			"overlayMax": "SD8qLW_overlayMax",
-			"menuPop": "SD8qLW_menuPop",
-			"tabActive": "SD8qLW_tabActive",
-			"btn": "SD8qLW_btn",
-			"headerTotalsDel": "SD8qLW_headerTotalsDel",
-			"lnNew": "SD8qLW_lnNew",
-			"paneTitle": "SD8qLW_paneTitle",
-			"refCaret": "SD8qLW_refCaret",
-			"renameLine": "SD8qLW_renameLine",
-			"scopeRow": "SD8qLW_scopeRow",
-			"paneDivider": "SD8qLW_paneDivider",
-			"refButton": "SD8qLW_refButton",
+			"themeRail": "SD8qLW_themeRail",
+			"treeCol": "SD8qLW_treeCol",
 			"cardDeleted": "SD8qLW_cardDeleted",
-			"headerRight": "SD8qLW_headerRight",
-			"paletteRowActive": "SD8qLW_paletteRowActive",
-			"checkMarkPartial": "SD8qLW_checkMarkPartial",
-			"scopeBtn": "SD8qLW_scopeBtn",
-			"lineDel": "SD8qLW_lineDel",
-			"themeDirty": "SD8qLW_themeDirty",
-			"confirmActions": "SD8qLW_confirmActions",
-			"opBannerBad": "SD8qLW_opBannerBad",
+			"treeIconGlyph": "SD8qLW_treeIconGlyph",
+			"paneTitle": "SD8qLW_paneTitle",
+			"settingsPop": "SD8qLW_settingsPop",
 			"commitCopy": "SD8qLW_commitCopy",
-			"sliderRow": "SD8qLW_sliderRow",
-			"fileLi": "SD8qLW_fileLi",
-			"funnelCaption": "SD8qLW_funnelCaption",
-			"body": "SD8qLW_body",
-			"commitPopMeta": "SD8qLW_commitPopMeta",
-			"commitPopTop": "SD8qLW_commitPopTop",
-			"tab": "SD8qLW_tab",
-			"commitSubject": "SD8qLW_commitSubject",
 			"commitsSentinel": "SD8qLW_commitsSentinel",
-			"cardGlyph": "SD8qLW_cardGlyph",
-			"paneDividerActive": "SD8qLW_paneDividerActive",
-			"funnelRow": "SD8qLW_funnelRow",
-			"commitRefMore": "SD8qLW_commitRefMore",
-			"themeLabel": "SD8qLW_themeLabel",
-			"commitBtn": "SD8qLW_commitBtn",
-			"refPicker": "SD8qLW_refPicker",
-			"treeLead": "SD8qLW_treeLead",
-			"funnelBoundBtn": "SD8qLW_funnelBoundBtn",
-			"treeDirLi": "SD8qLW_treeDirLi",
-			"fileStatus": "SD8qLW_fileStatus",
-			"btnClose": "SD8qLW_btnClose",
-			"funnelFootCountOn": "SD8qLW_funnelFootCountOn",
-			"paneHead": "SD8qLW_paneHead",
-			"funnelMore": "SD8qLW_funnelMore",
-			"headerTotalsAdd": "SD8qLW_headerTotalsAdd",
-			"fileCountDel": "SD8qLW_fileCountDel",
-			"bgPreview": "SD8qLW_bgPreview",
+			"commitAuthor": "SD8qLW_commitAuthor",
+			"wordAdd": "SD8qLW_wordAdd",
+			"cardAhead": "SD8qLW_cardAhead",
+			"funnelBoundRows": "SD8qLW_funnelBoundRows",
+			"refSearch": "SD8qLW_refSearch",
+			"headerDetached": "SD8qLW_headerDetached",
+			"btnIcon": "SD8qLW_btnIcon",
+			"funnelPane": "SD8qLW_funnelPane",
+			"refList": "SD8qLW_refList",
+			"funnelFootCount": "SD8qLW_funnelFootCount",
+			"funnelCount": "SD8qLW_funnelCount",
 			"cardBehind": "SD8qLW_cardBehind",
-			"header": "SD8qLW_header",
+			"calWeek": "SD8qLW_calWeek",
+			"funnelBoundBtn": "SD8qLW_funnelBoundBtn",
+			"funnelCaption": "SD8qLW_funnelCaption",
+			"funnelList": "SD8qLW_funnelList",
+			"btnDanger": "SD8qLW_btnDanger",
+			"fileCountAdd": "SD8qLW_fileCountAdd",
 			"compareBar": "SD8qLW_compareBar",
-			"theme": "SD8qLW_theme",
-			"filterChips": "SD8qLW_filterChips",
-			"cardAhead": "SD8qLW_cardAhead",
-			"filterChip": "SD8qLW_filterChip",
-			"commitSubjectRow": "SD8qLW_commitSubjectRow",
-			"pathDirGlyph": "SD8qLW_pathDirGlyph",
-			"treeDir": "SD8qLW_treeDir",
-			"commitRef": "SD8qLW_commitRef",
-			"commitLine": "SD8qLW_commitLine",
-			"treeActions": "SD8qLW_treeActions",
-			"cardSep": "SD8qLW_cardSep",
-			"funnelFootClear": "SD8qLW_funnelFootClear",
-			"funnelName": "SD8qLW_funnelName",
-			"chipSystem": "SD8qLW_chipSystem",
-			"treeEmpty": "SD8qLW_treeEmpty",
-			"pathNode": "SD8qLW_pathNode",
-			"checkMarkOn": "SD8qLW_checkMarkOn",
-			"pathFileGlyph": "SD8qLW_pathFileGlyph",
-			"calToday": "SD8qLW_calToday",
-			"signAdd": "SD8qLW_signAdd",
-			"filterChipRemove": "SD8qLW_filterChipRemove",
-			"calHead": "SD8qLW_calHead",
-			"calGrid": "SD8qLW_calGrid"
+			"syncLevel": "SD8qLW_syncLevel",
+			"tabs": "SD8qLW_tabs",
+			"resizerActive": "SD8qLW_resizerActive",
+			"commitBtn": "SD8qLW_commitBtn",
+			"funnelPresets": "SD8qLW_funnelPresets",
+			"commitRow": "SD8qLW_commitRow",
+			"funnelButtonActive": "SD8qLW_funnelButtonActive",
+			"funnelPreset": "SD8qLW_funnelPreset",
+			"funnelBoundValSet": "SD8qLW_funnelBoundValSet",
+			"refCaret": "SD8qLW_refCaret",
+			"funnelBoundRow": "SD8qLW_funnelBoundRow"
 		};
 		//#endregion
 		//#region src/client/GitWorkbenchPanel.tsx
@@ -13229,6 +13263,25 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 					refresh();
 				}
 			};
+			/**
+			* Put a failure the drawer produced itself into the same banner git failures
+			* use.
+			*
+			* Roll-back is the caller: it asks the host what a file's roll-back would do
+			* before it does anything, and that question can fail on its own, with no
+			* `runOp` behind it to report through. Everything else the drawer does is
+			* either a git call or has a visible result of its own.
+			*/
+			const reportOpError = (op, error) => {
+				setOpResult({
+					op,
+					result: {
+						ok: false,
+						failure: "unknown",
+						error
+					}
+				});
+			};
 			/** Wait for the git lock, so a queued tick batch waits out a heavy
 			*  operation instead of being refused by it. */
 			const waitNotBusy = async () => {
@@ -13483,6 +13536,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 				opResult,
 				runOp,
 				fetchDiscardPlan,
+				onOpError: reportOpError,
 				pendingTicks,
 				onTick: queueTicks,
 				fetchFileDiff: fetchDiffForView,
@@ -13605,7 +13659,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 				]
 			});
 		}
-		function Drawer({ stats, shown, tab, onSwitchTab, commits, commitHash, onSelectCommit, hasMoreCommits, loadingMore, onLoadMoreCommits, historyRef, onHistoryRef, historyQuery, onHistoryQuery, historyError, fetchAuthors, fetchRepoTree, branches, worktreeBranches, branchesTruncated, baseRef, headRef, onBaseRef, onHeadRef, comparable, t, binding, worktrees, sessionPath, statsPath, onSwitchSource, segments, selected, onSelect, maximized, onToggleMaximized, theme, mode, family, onMode, onFamily, style, background, onStyle, width, onWidth, panes, onPane, onClose, onRefresh, commitDraft, onCommitDraft, commitAmend, onCommitAmend, sync, treeLoading, historyLoading, busy, opResult, runOp, fetchDiscardPlan, pendingTicks, onTick, fetchFileDiff, viewKey, gen, collapsed, onCollapsedChange }) {
+		function Drawer({ stats, shown, tab, onSwitchTab, commits, commitHash, onSelectCommit, hasMoreCommits, loadingMore, onLoadMoreCommits, historyRef, onHistoryRef, historyQuery, onHistoryQuery, historyError, fetchAuthors, fetchRepoTree, branches, worktreeBranches, branchesTruncated, baseRef, headRef, onBaseRef, onHeadRef, comparable, t, binding, worktrees, sessionPath, statsPath, onSwitchSource, segments, selected, onSelect, maximized, onToggleMaximized, theme, mode, family, onMode, onFamily, style, background, onStyle, width, onWidth, panes, onPane, onClose, onRefresh, commitDraft, onCommitDraft, commitAmend, onCommitAmend, sync, treeLoading, historyLoading, busy, opResult, runOp, fetchDiscardPlan, onOpError, pendingTicks, onTick, fetchFileDiff, viewKey, gen, collapsed, onCollapsedChange }) {
 			const body = shown ?? EMPTY_STATS;
 			/** The file list with ticks still awaiting git laid over them. The tree and
 			*  the commit box read this, so a click moves its box and the "N ticked"
@@ -13670,6 +13724,10 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 			* `recover` — a deleted file coming back — shows no dialog at all. It loses
 			* nothing, and a confirmation in front of a pure gain is how people learn to
 			* dismiss confirmations without reading them.
+			*
+			* Every other answer is `nextAfterPlan`'s to classify, and the one it exists
+			* for is failure: a plan that never arrives reports, where it used to leave
+			* the reader looking at a button that did nothing.
 			*/
 			const askDiscard = (file) => {
 				setDiscardPending({
@@ -13677,24 +13735,21 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 					plan: null
 				});
 				(async () => {
-					const preview = await fetchDiscardPlan(statsPath, file.path, new AbortController().signal);
-					if (preview === null || preview.effect === void 0) {
-						setDiscardPending(null);
-						onRefresh();
-						return;
-					}
-					if (preview.irreversible !== true) {
-						setDiscardPending(null);
-						runOp("discardFile", {
-							path: file.path,
-							expectedEffect: preview.effect
+					const next = nextAfterPlan(await fetchDiscardPlan(statsPath, file.path, new AbortController().signal));
+					if (next.kind === "confirm") {
+						setDiscardPending({
+							file,
+							plan: next.plan
 						});
 						return;
 					}
-					setDiscardPending({
-						file,
-						plan: preview
+					setDiscardPending(null);
+					if (next.kind === "run") runOp("discardFile", {
+						path: file.path,
+						expectedEffect: next.effect
 					});
+					else if (next.kind === "refresh") onRefresh();
+					else onOpError("discardFile", next.error);
 				})();
 			};
 			const confirmDiscard = () => {
@@ -17129,11 +17184,25 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 						return result.ok ? result.value : null;
 					},
 					fetchDiscardPlan: async (worktreePath, path, signal) => {
-						const result = await connection.rpc.call("/api", "gitWorkbench/discardPlan", { args: {
-							worktreePath: worktreePath ?? "",
-							path
-						} }, signal);
-						return result.ok ? result.value : null;
+						try {
+							const result = await connection.rpc.call("/api", "gitWorkbench/discardPlan", { args: {
+								worktreePath: worktreePath ?? "",
+								path
+							} }, signal);
+							if (result.ok && result.value !== void 0) return {
+								kind: "plan",
+								plan: result.value
+							};
+							return {
+								kind: "failed",
+								error: result.error?.message ?? ""
+							};
+						} catch (error) {
+							return {
+								kind: "failed",
+								error: error instanceof Error ? error.message : String(error)
+							};
+						}
 					},
 					runGitOp: async (op, worktreePath, payload, signal) => {
 						const result = await connection.rpc.call("/api", `gitWorkbench/${op}`, { args: {

package/lib/fs-remove.js

@@ -0,0 +1,73 @@
+/**
+ * The one filesystem delete in this plugin, and the checks it carries.
+ *
+ * `discard-ops.ts` plans a delete when git has no copy of a file to restore
+ * from — untracked, or added-but-never-committed. git will not carry that out:
+ * `git clean` refuses paths it cannot index, which on Windows includes every
+ * reserved device name (`nul`, `con`, `aux`, `com1`, and the same names with
+ * any extension). So the removal goes through the filesystem, where git's own
+ * refusal to leave the repository does not apply — hence the checks here
+ * rather than a bare `rm`.
+ *
+ * Lives outside `index.ts` so vitest can load it: the class there needs the
+ * dsh runtime, and the property worth testing is "what does this delete, and
+ * what does it refuse" — a question about paths and the disk, not about RPC.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/fs-remove
+ */
+import { rm } from 'node:fs/promises';
+import { resolve, sep } from 'node:path';
+import { isSafeRelativePath } from './discard-ops.js';
+/**
+ * Resolve a repo-relative path against the worktree root, refusing to leave it.
+ *
+ * The second lock rather than the only one: {@link isSafeRelativePath} already
+ * rejected traversal spellings when the plan was made. This re-checks the
+ * RESOLVED path, which is the form the filesystem acts on, so a path that
+ * survives the first check by being spelled unusually still has to land inside
+ * the root to be acted on.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from a plan step.
+ * @returns the absolute path to act on.
+ * @throws if the path is not a safe relative path, resolves outside the root,
+ *         or IS the root.
+ */
+export function resolveInside(root, relative) {
+    if (!isSafeRelativePath(relative)) {
+        throw new Error(`unsafe path to delete: ${JSON.stringify(relative)}`);
+    }
+    const base = resolve(root);
+    const target = resolve(base, relative);
+    if (target === base)
+        throw new Error('refusing to delete the worktree root');
+    if (!target.startsWith(base + sep)) {
+        throw new Error(`refusing to delete outside the worktree: ${JSON.stringify(relative)}`);
+    }
+    return target;
+}
+/**
+ * Remove one entry from the worktree, having proven it is inside it.
+ *
+ * `recursive` is not a widening of the blast radius: `resolveInside` has
+ * already pinned the target to one path git named, and git names a DIRECTORY
+ * whenever it will not look inside one — an untracked nested repository is
+ * reported as `sub/`, with no per-file lines even under
+ * `--untracked-files=all`. Without `recursive` that row is the only one in the
+ * drawer whose roll-back fails, and it fails as `EISDIR`, which says nothing
+ * to the person who clicked it.
+ *
+ * `force` makes an absent entry a success: the reader asked for it to be gone,
+ * and it is.
+ *
+ * A symlinked directory inside the worktree could still point outward; that is
+ * a repository someone already has write access to, and resolving link targets
+ * per segment on every delete would cost a stat per segment for a case git
+ * itself does not defend against.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from a plan step.
+ */
+export async function removePathInside(root, relative) {
+    await rm(resolveInside(root, relative), { recursive: true, force: true });
+}

package/lib/index.js

@@ -76,15 +76,16 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
  * @module @young1lin/dsh-ui-gitworkbench
  */
 import { randomBytes } from 'node:crypto';
-import { mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, realpath, rename, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join, resolve, sep } from 'node:path';
+import { join } from 'node:path';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { saveJsonAtomic } from './atomic-json.js';
 import { CommitPayloadCache, cacheKey } from './commit-cache.js';
 import { NETWORK_GRACE_MS, NON_INTERACTIVE_ENV, capBranches, classifyFailure, clipDiff, commitArgv, countBufferLines, fetchArgv, isBinaryPrefix, isNoMergeBaseError, isSafePathArg, parseNameStatus, parseNumstat, parseStatus, parseTracking, pullArgv, pushArgv, stageArgv, unstageArgv, } from './git-ops.js';
 import { planFromStatus, } from './discard-ops.js';
+import { removePathInside } from './fs-remove.js';
 import { LOG_FORMAT, parseLog } from './git-log.js';
 import { emptyLogFilter, logFilterArgs } from './log-filter.js';
 import { parseShortlog } from './shortlog.js';
@@ -1034,7 +1035,7 @@ let GitWorkbenchService = (() => {
                     continue;
                 }
                 try {
-                    await this.removeInside(cwd, step.path);
+                    await removePathInside(cwd, step.path);
                 }
                 catch (error) {
                     return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) };
@@ -1061,29 +1062,6 @@ let GitWorkbenchService = (() => {
             }
             return planFromStatus(status.stdout, path);
         }
-        /**
-         * Delete one file, having proven it is inside the worktree.
-         *
-         * `isSafeRelativePath` already rejected traversal in the plan, so this is the
-         * second lock rather than the only one: it re-checks the RESOLVED path,
-         * which is the form the filesystem actually acts on. `force` makes an absent
-         * file a success — the reader asked for it to be gone, and it is.
-         *
-         * A symlinked directory inside the worktree could still point outward; that
-         * is a repository someone already has write access to, and resolving link
-         * targets on every delete would cost a stat per segment for a case git
-         * itself does not defend against.
-         */
-        async removeInside(cwd, relative) {
-            const root = resolve(cwd);
-            const target = resolve(root, relative);
-            if (target !== root && !target.startsWith(root + sep)) {
-                throw new Error(`refusing to delete outside the worktree: ${JSON.stringify(relative)}`);
-            }
-            if (target === root)
-                throw new Error('refusing to delete the worktree root');
-            await rm(target, { force: true });
-        }
         /**
          * Commit what is in the index.
          * @param worktreePath - directory to run in.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@young1lin/dsh-ui-gitworkbench",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Out-of-tree dsh web UI plugin: a session-header git workbench chip opening a drawer with the file tree, per-file diff, history, compare, staging, commit, and sync (fetch/pull/push).",
   "type": "module",
   "main": "lib/index.js",

package/src/client/GitWorkbenchPanel.tsx

@@ -60,6 +60,7 @@ import { layoutGraph, type GraphRow } from './commit-graph.ts'
 import { formatCommitDate } from './commit-filter.ts'
 import { chipsFromFilter, emptyQueryFilter, parseLogQuery, removeChip, serializeLogQuery } from './log-filter-query.ts'
 import { buildDirTree, searchPaths, type DirEntry } from './dir-tree.ts'
+import { nextAfterPlan, type DiscardAnswer, type DiscardPreview } from './discard-flow.ts'
 import { filterFiles } from './file-filter.ts'
 import { addPath, buildIndex, checkedState, isCovered, removePath } from './path-select.ts'
 import { inCalRange, localTodayIso, monthGrid, weekdayLabels } from './calendar.ts'
@@ -216,14 +217,7 @@ export interface GitOpPayload {
   readonly expectedEffect?: string
 }
 
-/** What the host says rolling one file back would do. */
-export interface DiscardPreview {
-  /** Absent when git reports nothing to roll back for that path. */
-  readonly effect?: 'restore' | 'delete' | 'recover' | 'unrename'
-  readonly irreversible?: boolean
-  readonly previousPath?: string
-  readonly error?: string
-}
+export type { DiscardAnswer, DiscardNext, DiscardPreview } from './discard-flow.ts'
 
 /** Translate a key of this plugin's namespace, with optional `{name}` params. */
 type Translate = (key: string, params?: Record<string, string | number>) => string
@@ -249,7 +243,7 @@ type Props = PropsRuntime<'conversation.session.header.actions'> & {
   readonly runGitOp: (op: GitOpName, worktreePath: string | undefined, payload: GitOpPayload, signal: AbortSignal) => Promise<GitOpResult>
   /** What rolling this file back WOULD do, read fresh so the confirmation
    *  states the real consequence rather than one derived from a polled row. */
-  readonly fetchDiscardPlan: (worktreePath: string | undefined, path: string, signal: AbortSignal) => Promise<DiscardPreview | null>
+  readonly fetchDiscardPlan: (worktreePath: string | undefined, path: string, signal: AbortSignal) => Promise<DiscardAnswer>
 }
 
 /**
@@ -1032,6 +1026,19 @@ export function GitWorkbenchPanel({ sessionId, useSessions, t, fetchStats, fetch
     }
   }
 
+  /**
+   * Put a failure the drawer produced itself into the same banner git failures
+   * use.
+   *
+   * Roll-back is the caller: it asks the host what a file's roll-back would do
+   * before it does anything, and that question can fail on its own, with no
+   * `runOp` behind it to report through. Everything else the drawer does is
+   * either a git call or has a visible result of its own.
+   */
+  const reportOpError = (op: GitOpName, error: string): void => {
+    setOpResult({ op, result: { ok: false, failure: 'unknown', error } })
+  }
+
   /** Wait for the git lock, so a queued tick batch waits out a heavy
    *  operation instead of being refused by it. */
   const waitNotBusy = async (): Promise<void> => {
@@ -1304,6 +1311,7 @@ export function GitWorkbenchPanel({ sessionId, useSessions, t, fetchStats, fetch
           opResult={opResult}
           runOp={runOp}
           fetchDiscardPlan={fetchDiscardPlan}
+          onOpError={reportOpError}
           pendingTicks={pendingTicks}
           onTick={queueTicks}
           fetchFileDiff={fetchDiffForView}
@@ -1495,7 +1503,9 @@ interface DrawerProps {
   /** The last write operation's outcome, or null once a new one starts. */
   opResult: { op: GitOpName; result: GitOpResult } | null
   runOp: (op: GitOpName, payload?: GitOpPayload) => Promise<GitOpResult>
-  fetchDiscardPlan: (worktreePath: string | undefined, path: string, signal: AbortSignal) => Promise<DiscardPreview | null>
+  fetchDiscardPlan: (worktreePath: string | undefined, path: string, signal: AbortSignal) => Promise<DiscardAnswer>
+  /** Say why an operation the drawer started did nothing. */
+  onOpError: (op: GitOpName, error: string) => void
   /** Ticks awaiting their git call, keyed by path — overlaid over the file
    *  list so the click is on screen before git confirms it. */
   pendingTicks: ReadonlyMap<string, TickAction>
@@ -1509,7 +1519,7 @@ interface DrawerProps {
   onCollapsedChange: (next: Set<string>) => void
 }
 
-function Drawer({ stats, shown, tab, onSwitchTab, commits, commitHash, onSelectCommit, hasMoreCommits, loadingMore, onLoadMoreCommits, historyRef, onHistoryRef, historyQuery, onHistoryQuery, historyError, fetchAuthors, fetchRepoTree, branches, worktreeBranches, branchesTruncated, baseRef, headRef, onBaseRef, onHeadRef, comparable, t, binding, worktrees, sessionPath, statsPath, onSwitchSource, segments, selected, onSelect, maximized, onToggleMaximized, theme, mode, family, onMode, onFamily, style, background, onStyle, width, onWidth, panes, onPane, onClose, onRefresh, commitDraft, onCommitDraft, commitAmend, onCommitAmend, sync, treeLoading, historyLoading, busy, opResult, runOp, fetchDiscardPlan, pendingTicks, onTick, fetchFileDiff, viewKey, gen, collapsed, onCollapsedChange }: DrawerProps): ReactNode {
+function Drawer({ stats, shown, tab, onSwitchTab, commits, commitHash, onSelectCommit, hasMoreCommits, loadingMore, onLoadMoreCommits, historyRef, onHistoryRef, historyQuery, onHistoryQuery, historyError, fetchAuthors, fetchRepoTree, branches, worktreeBranches, branchesTruncated, baseRef, headRef, onBaseRef, onHeadRef, comparable, t, binding, worktrees, sessionPath, statsPath, onSwitchSource, segments, selected, onSelect, maximized, onToggleMaximized, theme, mode, family, onMode, onFamily, style, background, onStyle, width, onWidth, panes, onPane, onClose, onRefresh, commitDraft, onCommitDraft, commitAmend, onCommitAmend, sync, treeLoading, historyLoading, busy, opResult, runOp, fetchDiscardPlan, onOpError, pendingTicks, onTick, fetchFileDiff, viewKey, gen, collapsed, onCollapsedChange }: DrawerProps): ReactNode {
   // Empty stand-in while a commit's change set loads, so every hook below keeps a
   // stable shape and the panes simply render nothing.
   const body = shown ?? EMPTY_STATS
@@ -1581,27 +1591,23 @@ function Drawer({ stats, shown, tab, onSwitchTab, commits, commitHash, onSelectC
    * `recover` — a deleted file coming back — shows no dialog at all. It loses
    * nothing, and a confirmation in front of a pure gain is how people learn to
    * dismiss confirmations without reading them.
+   *
+   * Every other answer is `nextAfterPlan`'s to classify, and the one it exists
+   * for is failure: a plan that never arrives reports, where it used to leave
+   * the reader looking at a button that did nothing.
    */
   const askDiscard = (file: GitFile): void => {
     setDiscardPending({ file, plan: null })
     void (async () => {
-      const preview = await fetchDiscardPlan(statsPath, file.path, new AbortController().signal)
-      // Nothing to roll back means the row was stale — the tree lists only
-      // changed files, so a file with no change is one git has since seen
-      // settled. Refreshing is the honest answer: the row goes away, which is
-      // both the feedback and the fix. A banner saying "nothing happened"
-      // would leave the row that caused it sitting right there.
-      if (preview === null || preview.effect === undefined) {
-        setDiscardPending(null)
-        onRefresh()
-        return
-      }
-      if (preview.irreversible !== true) {
-        setDiscardPending(null)
-        void runOp('discardFile', { path: file.path, expectedEffect: preview.effect })
+      const next = nextAfterPlan(await fetchDiscardPlan(statsPath, file.path, new AbortController().signal))
+      if (next.kind === 'confirm') {
+        setDiscardPending({ file, plan: next.plan })
         return
       }
-      setDiscardPending({ file, plan: preview })
+      setDiscardPending(null)
+      if (next.kind === 'run') void runOp('discardFile', { path: file.path, expectedEffect: next.effect })
+      else if (next.kind === 'refresh') onRefresh()
+      else onOpError('discardFile', next.error)
     })()
   }
 

package/src/client/discard-flow.ts

@@ -0,0 +1,82 @@
+/**
+ * What a roll-back click does with the host's answer.
+ *
+ * The click never acts on its own: it asks the host what rolling this file
+ * back WOULD do, and this decides what the answer means. Four answers are
+ * possible and three of them used to collapse into one — the reader who
+ * clicked saw the same nothing whether the file was already clean, the host
+ * threw, or the request never arrived. "Nothing visibly happened" is the one
+ * outcome a destructive control must never produce ambiguously: it is
+ * indistinguishable from a dead button, and the natural response to a dead
+ * button is to click it again.
+ *
+ * So a failure REPORTS and a stale row REFRESHES, and those are different
+ * things. Refreshing is the honest answer to "git says this file has no
+ * changes": the row disappears, which is both the feedback and the fix, and a
+ * banner reading "nothing happened" would leave the row that caused it sitting
+ * right there. A failure has no such self-explaining fix, so it has to be said.
+ *
+ * Pure so vitest can load it — the panel it serves pulls React and a CSS
+ * module. The panel imports {@link DiscardPreview} from here for the same
+ * reason: a decision about the shape cannot be tested where the shape lives.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/client/discard-flow
+ */
+
+/** What the host says rolling one file back would do. */
+export interface DiscardPreview {
+  /** Absent when git reports nothing to roll back for that path. */
+  readonly effect?: 'restore' | 'delete' | 'recover' | 'unrename'
+  readonly irreversible?: boolean
+  readonly previousPath?: string
+  readonly error?: string
+}
+
+/** The host's reply to `discardPlan`, failure included. */
+export type DiscardAnswer =
+  /** The call returned; the plan may still be empty. */
+  | { readonly kind: 'plan'; readonly plan: DiscardPreview }
+  /** The call did not return a plan — it errored, threw, or was refused. */
+  | { readonly kind: 'failed'; readonly error: string }
+
+/** What the drawer does next. */
+export type DiscardNext =
+  /** Open the confirmation naming this plan's consequence. */
+  | { readonly kind: 'confirm'; readonly plan: DiscardPreview }
+  /** Carry it out with no dialog — nothing is lost. */
+  | { readonly kind: 'run'; readonly effect: string }
+  /** The row was stale; reload the tree and let it go away. */
+  | { readonly kind: 'refresh' }
+  /** Say why nothing was done. */
+  | { readonly kind: 'report'; readonly error: string }
+
+/** Fallback text for a failure that arrived with nothing to say. */
+export const UNKNOWN_DISCARD_ERROR = 'discardPlan failed'
+
+/**
+ * Decide what a roll-back click does with the answer it got.
+ *
+ * @param answer - the host's reply, or the failure that replaced it.
+ * @returns the single next step; never null, because every answer including a
+ *          broken one has to lead somewhere the reader can see.
+ */
+export function nextAfterPlan(answer: DiscardAnswer): DiscardNext {
+  if (answer.kind === 'failed') {
+    const error = answer.error.trim()
+    return { kind: 'report', error: error.length > 0 ? error : UNKNOWN_DISCARD_ERROR }
+  }
+  const plan = answer.plan
+  // The host reports a refusal in-band too, so a plan carrying an error is a
+  // failure that happened to arrive over a successful call.
+  if (typeof plan.error === 'string' && plan.error.trim().length > 0) {
+    return { kind: 'report', error: plan.error.trim() }
+  }
+  if (plan.effect === undefined) return { kind: 'refresh' }
+  // `recover` — a deleted file coming back — loses nothing, and a confirmation
+  // in front of a pure gain is how people learn to dismiss confirmations
+  // without reading them. Only an EXPLICIT `false` skips the dialog: a host
+  // newer than this bundle can name an effect this client has no copy for, and
+  // a missing flag read as "reversible" would act on it silently.
+  if (plan.irreversible === false) return { kind: 'run', effect: plan.effect }
+  return { kind: 'confirm', plan }
+}

package/src/client/index.ts

@@ -19,7 +19,7 @@ import type {} from '@deepseek-ai/dsh-client-runtime' // informational inject ed
 import type {} from '@deepseek-ai/dsh-client-ui-slots' // SlotMap is reused, not extended
 import {
   GitWorkbenchPanel,
-  type DiscardPreview, type GitCommit, type GitOpName, type GitOpPayload, type GitOpResult,
+  type DiscardAnswer, type DiscardPreview, type GitCommit, type GitOpName, type GitOpPayload, type GitOpResult,
   type WorkbenchStats, type SyncStatus, type WorktreeStatus,
 } from './GitWorkbenchPanel.tsx'
 import type { StyleEntry, StyleScope, StyleSettings } from './themes.ts'
@@ -211,14 +211,22 @@ export function apply(ctx: ClientContext): void {
         // is the difference between "goes back to its committed content" and
         // "leaves the disk and cannot come back" — which is the entire question
         // the dialog exists to ask.
-        fetchDiscardPlan: async (worktreePath: string | undefined, path: string, signal: AbortSignal): Promise<DiscardPreview | null> => {
-          const result = await connection.rpc.call(
-            '/api',
-            'gitWorkbench/discardPlan',
-            { args: { worktreePath: worktreePath ?? '', path } },
-            signal,
-          ) as { ok: true; value: DiscardPreview } | { ok: false; error: { message?: string } }
-          return result.ok ? result.value : null
+        fetchDiscardPlan: async (worktreePath: string | undefined, path: string, signal: AbortSignal): Promise<DiscardAnswer> => {
+          // A throw here used to be nobody's: the click had already put the
+          // drawer into "asking the host", and an unhandled rejection left it
+          // there with no dialog and no way back except closing the drawer.
+          try {
+            const result = await connection.rpc.call(
+              '/api',
+              'gitWorkbench/discardPlan',
+              { args: { worktreePath: worktreePath ?? '', path } },
+              signal,
+            ) as { ok: boolean; value?: DiscardPreview; error?: { message?: string } }
+            if (result.ok && result.value !== undefined) return { kind: 'plan', plan: result.value }
+            return { kind: 'failed', error: result.error?.message ?? '' }
+          } catch (error) {
+            return { kind: 'failed', error: error instanceof Error ? error.message : String(error) }
+          }
         },
         runGitOp: async (op: GitOpName, worktreePath: string | undefined, payload: GitOpPayload, signal: AbortSignal): Promise<GitOpResult> => {
           const result = await connection.rpc.call(

package/src/fs-remove.ts

@@ -0,0 +1,76 @@
+/**
+ * The one filesystem delete in this plugin, and the checks it carries.
+ *
+ * `discard-ops.ts` plans a delete when git has no copy of a file to restore
+ * from — untracked, or added-but-never-committed. git will not carry that out:
+ * `git clean` refuses paths it cannot index, which on Windows includes every
+ * reserved device name (`nul`, `con`, `aux`, `com1`, and the same names with
+ * any extension). So the removal goes through the filesystem, where git's own
+ * refusal to leave the repository does not apply — hence the checks here
+ * rather than a bare `rm`.
+ *
+ * Lives outside `index.ts` so vitest can load it: the class there needs the
+ * dsh runtime, and the property worth testing is "what does this delete, and
+ * what does it refuse" — a question about paths and the disk, not about RPC.
+ *
+ * @module @young1lin/dsh-ui-gitworkbench/fs-remove
+ */
+
+import { rm } from 'node:fs/promises'
+import { resolve, sep } from 'node:path'
+
+import { isSafeRelativePath } from './discard-ops.js'
+
+/**
+ * Resolve a repo-relative path against the worktree root, refusing to leave it.
+ *
+ * The second lock rather than the only one: {@link isSafeRelativePath} already
+ * rejected traversal spellings when the plan was made. This re-checks the
+ * RESOLVED path, which is the form the filesystem acts on, so a path that
+ * survives the first check by being spelled unusually still has to land inside
+ * the root to be acted on.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from a plan step.
+ * @returns the absolute path to act on.
+ * @throws if the path is not a safe relative path, resolves outside the root,
+ *         or IS the root.
+ */
+export function resolveInside(root: string, relative: string): string {
+  if (!isSafeRelativePath(relative)) {
+    throw new Error(`unsafe path to delete: ${JSON.stringify(relative)}`)
+  }
+  const base = resolve(root)
+  const target = resolve(base, relative)
+  if (target === base) throw new Error('refusing to delete the worktree root')
+  if (!target.startsWith(base + sep)) {
+    throw new Error(`refusing to delete outside the worktree: ${JSON.stringify(relative)}`)
+  }
+  return target
+}
+
+/**
+ * Remove one entry from the worktree, having proven it is inside it.
+ *
+ * `recursive` is not a widening of the blast radius: `resolveInside` has
+ * already pinned the target to one path git named, and git names a DIRECTORY
+ * whenever it will not look inside one — an untracked nested repository is
+ * reported as `sub/`, with no per-file lines even under
+ * `--untracked-files=all`. Without `recursive` that row is the only one in the
+ * drawer whose roll-back fails, and it fails as `EISDIR`, which says nothing
+ * to the person who clicked it.
+ *
+ * `force` makes an absent entry a success: the reader asked for it to be gone,
+ * and it is.
+ *
+ * A symlinked directory inside the worktree could still point outward; that is
+ * a repository someone already has write access to, and resolving link targets
+ * per segment on every delete would cost a stat per segment for a case git
+ * itself does not defend against.
+ *
+ * @param root - the worktree directory, absolute.
+ * @param relative - repo-relative path from a plan step.
+ */
+export async function removePathInside(root: string, relative: string): Promise<void> {
+  await rm(resolveInside(root, relative), { recursive: true, force: true })
+}

package/src/index.ts

@@ -42,9 +42,9 @@
  * @module @young1lin/dsh-ui-gitworkbench
  */
 import { randomBytes } from 'node:crypto'
-import { mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises'
+import { mkdir, readFile, realpath, rename, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
-import { join, resolve, sep } from 'node:path'
+import { join } from 'node:path'
 import type { Readable } from 'node:stream'
 import type { Context } from '@deepseek-ai/cordis'
 import { defineTool, type ToolRunContext } from '@deepseek-ai/dsh-tools'
@@ -63,6 +63,7 @@ import {
   planFromStatus,
   type DiscardEffect, type DiscardPlan,
 } from './discard-ops.js'
+import { removePathInside } from './fs-remove.js'
 import { LOG_FORMAT, parseLog, type GitCommit } from './git-log.js'
 import { emptyLogFilter, logFilterArgs, type LogFilter } from './log-filter.js'
 import { parseShortlog, type AuthorEntry } from './shortlog.js'
@@ -1040,7 +1041,7 @@ export class GitWorkbenchService extends TypertRemoteService {
         continue
       }
       try {
-        await this.removeInside(cwd, step.path)
+        await removePathInside(cwd, step.path)
       } catch (error) {
         return { ok: false, failure: 'unknown', error: error instanceof Error ? error.message : String(error) }
       }
@@ -1068,29 +1069,6 @@ export class GitWorkbenchService extends TypertRemoteService {
     return planFromStatus(status.stdout, path)
   }
 
-  /**
-   * Delete one file, having proven it is inside the worktree.
-   *
-   * `isSafeRelativePath` already rejected traversal in the plan, so this is the
-   * second lock rather than the only one: it re-checks the RESOLVED path,
-   * which is the form the filesystem actually acts on. `force` makes an absent
-   * file a success — the reader asked for it to be gone, and it is.
-   *
-   * A symlinked directory inside the worktree could still point outward; that
-   * is a repository someone already has write access to, and resolving link
-   * targets on every delete would cost a stat per segment for a case git
-   * itself does not defend against.
-   */
-  private async removeInside(cwd: string, relative: string): Promise<void> {
-    const root = resolve(cwd)
-    const target = resolve(root, relative)
-    if (target !== root && !target.startsWith(root + sep)) {
-      throw new Error(`refusing to delete outside the worktree: ${JSON.stringify(relative)}`)
-    }
-    if (target === root) throw new Error('refusing to delete the worktree root')
-    await rm(target, { force: true })
-  }
-
   /**
    * Commit what is in the index.
    * @param worktreePath - directory to run in.