byterover-cli 3.8.3 → 3.9.0

package/dist/server/infra/git/isomorphic-git-service.js

@@ -246,13 +246,13 @@ export class IsomorphicGitService {
         const result = Object.fromEntries(paths.map((p) => [p, undefined]));
         if (paths.length === 0)
             return result;
-        if (ref === 'HEAD') {
-            const headOid = await git.resolveRef({ dir, fs, ref: 'HEAD' }).catch(() => null);
-            if (!headOid)
+        if (ref !== 'STAGE') {
+            const commitOid = await this.resolveRefExpression(dir, ref.commitish).catch(() => null);
+            if (!commitOid)
                 return result;
             await Promise.all(paths.map(async (path) => {
                 try {
-                    const { blob } = await git.readBlob({ dir, filepath: path, fs, oid: headOid });
+                    const { blob } = await git.readBlob({ dir, filepath: path, fs, oid: commitOid });
                     result[path] = Buffer.from(blob).toString('utf8');
                 }
                 catch {
@@ -361,6 +361,16 @@ export class IsomorphicGitService {
         const result = await git.getConfig({ dir, fs, path: `remote.${params.remote}.url` });
         return result === undefined || result === null ? undefined : String(result);
     }
+    async getTextBlob(params) {
+        const dir = this.requireDirectory(params);
+        const { path, ref } = params;
+        const raw = await this.readRawBlob(dir, path, ref);
+        if (!raw)
+            return undefined;
+        if (raw.bytes.includes(0))
+            return { binary: true, content: '', oid: raw.oid.slice(0, 7) };
+        return { content: Buffer.from(raw.bytes).toString('utf8'), oid: raw.oid.slice(0, 7) };
+    }
     async getTrackingBranch(params) {
         const dir = this.requireDirectory(params);
         const remote = await git.getConfig({ dir, fs, path: `branch.${params.branch}.remote` });
@@ -374,6 +384,10 @@ export class IsomorphicGitService {
         const remoteBranch = mergeStr.startsWith('refs/heads/') ? mergeStr.slice('refs/heads/'.length) : mergeStr;
         return { remote: String(remote), remoteBranch };
     }
+    async hashBlob(content) {
+        const { oid } = await git.hashBlob({ object: content });
+        return oid.slice(0, 7);
+    }
     async init(params) {
         const dir = this.requireDirectory(params);
         await git.init({ defaultBranch: params.defaultBranch ?? 'main', dir, fs });
@@ -431,6 +445,15 @@ export class IsomorphicGitService {
         }
         return result;
     }
+    async listChangedFiles(params) {
+        const dir = this.requireDirectory(params);
+        const { from, to } = params;
+        // Commit-vs-commit: walk both trees, compare oids
+        if (from !== 'STAGE' && from !== 'WORKDIR' && to !== 'STAGE' && to !== 'WORKDIR') {
+            return this.listChangedBetweenCommits(dir, from.commitish, to.commitish);
+        }
+        return this.listChangedFromMatrix(dir, from, to);
+    }
     async listRemotes(params) {
         const dir = this.requireDirectory(params);
         const remotes = await git.listRemotes({ dir, fs });
@@ -737,6 +760,56 @@ export class IsomorphicGitService {
         const credentials = Buffer.from(`${userId}:${sessionKey}`).toString('base64');
         return { Authorization: `Basic ${credentials}` };
     }
+    async classifyRefVsWorkdir(dir, fromOid, refSet, matrix) {
+        // "Tracked in workdir" = present on disk (workdir != 0) AND tracked (HEAD or stage has it).
+        // This excludes untracked files (matches `git diff <commit>` which does not show untracked).
+        const trackedOnDisk = new Set();
+        for (const [filepath, head, workdir, stage] of matrix) {
+            if (workdir !== 0 && (head !== 0 || stage !== 0))
+                trackedOnDisk.add(String(filepath));
+        }
+        const candidates = new Set([...refSet, ...trackedOnDisk]);
+        const results = await Promise.all([...candidates].map(async (path) => {
+            const inRef = refSet.has(path);
+            const inWork = trackedOnDisk.has(path);
+            if (inRef && !inWork)
+                return { path, status: 'deleted' };
+            if (!inRef && inWork)
+                return { path, status: 'added' };
+            if (inRef && inWork) {
+                const [fromBlobOid, workOid] = await Promise.all([
+                    this.readBlobOid(dir, fromOid, path),
+                    this.hashWorkdirFile(dir, path),
+                ]);
+                if (fromBlobOid && workOid && fromBlobOid !== workOid)
+                    return { path, status: 'modified' };
+            }
+            return undefined;
+        }));
+        return results.filter((r) => r !== undefined).sort((a, b) => a.path.localeCompare(b.path));
+    }
+    classifyStagedRow(row) {
+        const [filepath, head, , stage] = row;
+        const path = String(filepath);
+        if (head === 0 && (stage === 2 || stage === 3))
+            return { path, status: 'added' };
+        if (head === 1 && stage === 0)
+            return { path, status: 'deleted' };
+        if (head === 1 && (stage === 2 || stage === 3))
+            return { path, status: 'modified' };
+        return undefined;
+    }
+    classifyUnstagedRow(row) {
+        const [filepath, head, workdir, stage] = row;
+        const path = String(filepath);
+        if (head === 0 && stage === 0)
+            return undefined; // skip untracked
+        if (workdir === 0 && (stage === 1 || stage === 2 || stage === 3))
+            return { path, status: 'deleted' };
+        if (workdir === 2 && (stage === 1 || stage === 3))
+            return { path, status: 'modified' };
+        return undefined;
+    }
     conflictsFromError(error) {
         if (!IsomorphicGitService.isConflictError(error))
             return [];
@@ -756,6 +829,13 @@ export class IsomorphicGitService {
         }))
             .sort((a, b) => a.path.localeCompare(b.path));
     }
+    describeSide(side) {
+        if (side === 'STAGE')
+            return 'STAGE';
+        if (side === 'WORKDIR')
+            return 'WORKDIR';
+        return `commitish(${side.commitish})`;
+    }
     getAuthor() {
         const token = this.authStateStore.getToken();
         if (!token)
@@ -812,6 +892,69 @@ export class IsomorphicGitService {
                 '\nPlease commit your changes or stash them before you switch branches.');
         }
     }
+    async hashWorkdirFile(dir, path) {
+        try {
+            const buf = await fs.promises.readFile(join(dir, path));
+            const { oid } = await git.hashBlob({ object: buf });
+            return oid;
+        }
+        catch {
+            return null;
+        }
+    }
+    isCommitishSide(side) {
+        return side !== 'STAGE' && side !== 'WORKDIR';
+    }
+    async listChangedBetweenCommits(dir, fromRef, toRef) {
+        const [fromOid, toOid] = await Promise.all([
+            this.resolveRefExpression(dir, fromRef),
+            this.resolveRefExpression(dir, toRef),
+        ]);
+        const changes = [];
+        await git.walk({
+            dir,
+            fs,
+            async map(filepath, [a, b]) {
+                if (filepath === '.')
+                    return;
+                const [aType, bType] = await Promise.all([a?.type(), b?.type()]);
+                if (aType === 'tree' || bType === 'tree')
+                    return;
+                if (!a && b && bType === 'blob') {
+                    changes.push({ path: filepath, status: 'added' });
+                    return;
+                }
+                if (a && !b && aType === 'blob') {
+                    changes.push({ path: filepath, status: 'deleted' });
+                    return;
+                }
+                if (a && b && aType === 'blob' && bType === 'blob') {
+                    const [aOid, bOid] = await Promise.all([a.oid(), b.oid()]);
+                    if (aOid !== bOid)
+                        changes.push({ path: filepath, status: 'modified' });
+                }
+            },
+            // eslint-disable-next-line new-cap
+            trees: [git.TREE({ ref: fromOid }), git.TREE({ ref: toOid })],
+        });
+        return changes;
+    }
+    async listChangedFromMatrix(dir, from, to) {
+        const matrix = await git.statusMatrix({ dir, fs });
+        if (from === 'STAGE' && to === 'WORKDIR') {
+            return matrix.map((row) => this.classifyUnstagedRow(row)).filter((c) => c !== undefined);
+        }
+        if (this.isCommitishSide(from) && to === 'STAGE') {
+            return matrix.map((row) => this.classifyStagedRow(row)).filter((c) => c !== undefined);
+        }
+        if (this.isCommitishSide(from) && to === 'WORKDIR') {
+            const fromOid = await this.resolveRefExpression(dir, from.commitish);
+            const tracked = await git.listFiles({ dir, fs, ref: fromOid });
+            const trackedSet = new Set(tracked);
+            return this.classifyRefVsWorkdir(dir, fromOid, trackedSet, matrix);
+        }
+        throw new GitError(`unsupported diff side combination: from=${this.describeSide(from)} to=${this.describeSide(to)}`);
+    }
     /**
      * Manual merge for unrelated histories (no common ancestor).
      * isomorphic-git throws MergeNotSupportedError because it can't handle
@@ -940,6 +1083,46 @@ export class IsomorphicGitService {
             return null;
         }
     }
+    /**
+     * Reads the raw blob bytes + full oid at the given ref in a single pass.
+     * Returns `undefined` when the blob is absent (path missing, ref unresolved, etc.).
+     * Used by {@link getTextBlob}; callers downstream decide binary vs text.
+     */
+    async readRawBlob(dir, path, ref) {
+        if (ref === 'STAGE') {
+            let found;
+            await git
+                .walk({
+                dir,
+                fs,
+                async map(filepath, [entry]) {
+                    if (filepath !== path || !entry)
+                        return;
+                    if ((await entry.type()) !== 'blob')
+                        return;
+                    const oid = await entry.oid();
+                    const { blob } = await git.readBlob({ dir, fs, oid });
+                    found = { bytes: blob, oid };
+                },
+                // eslint-disable-next-line new-cap
+                trees: [git.STAGE()],
+            })
+                .catch(() => {
+                // leave found undefined
+            });
+            return found;
+        }
+        const commitOid = await this.resolveRefExpression(dir, ref.commitish).catch(() => null);
+        if (!commitOid)
+            return undefined;
+        try {
+            const { blob, oid } = await git.readBlob({ dir, filepath: path, fs, oid: commitOid });
+            return { bytes: blob, oid };
+        }
+        catch {
+            return undefined;
+        }
+    }
     requireDirectory(params) {
         // Guard against empty string — undefined/null are caught by TypeScript at compile time
         if (!params.directory)
@@ -1006,14 +1189,14 @@ export class IsomorphicGitService {
     async resolveRefExpression(dir, ref) {
         const tildeMatch = /^(.+)~(\d+)$/.exec(ref);
         if (!tildeMatch) {
-            return git.resolveRef({ dir, fs, ref });
+            return this.resolveSingleRef(dir, ref);
         }
         const baseRef = tildeMatch[1];
         const count = Number.parseInt(tildeMatch[2], 10);
         if (count === 0) {
-            return git.resolveRef({ dir, fs, ref: baseRef });
+            return this.resolveSingleRef(dir, baseRef);
         }
-        let oid = await git.resolveRef({ dir, fs, ref: baseRef });
+        let oid = await this.resolveSingleRef(dir, baseRef);
         for (let i = 0; i < count; i++) {
             // eslint-disable-next-line no-await-in-loop
             const commit = await git.readCommit({ dir, fs, oid });
@@ -1024,6 +1207,23 @@ export class IsomorphicGitService {
         }
         return oid;
     }
+    /**
+     * Resolve a single ref (branch name, tag, full SHA, or short SHA).
+     * Falls back to `git.expandOid` for short SHAs since `git.resolveRef`
+     * only accepts full OIDs and symbolic refs.
+     */
+    async resolveSingleRef(dir, ref) {
+        try {
+            return await git.resolveRef({ dir, fs, ref });
+        }
+        catch (error) {
+            // Short SHA: 4-39 hex chars. Try expandOid which disambiguates against the object DB.
+            if (/^[\da-f]{4,39}$/i.test(ref)) {
+                return git.expandOid({ dir, fs, oid: ref });
+            }
+            throw error;
+        }
+    }
     /**
      * Fixes conflict markers written by isomorphic-git to match native git:
      * 1. Replaces `<<<<<<< <branchName>` with `<<<<<<< HEAD`

package/dist/server/infra/transport/handlers/config-handler.js

@@ -13,6 +13,7 @@ export class ConfigHandler {
         this.transport.onRequest(ConfigEvents.GET_ENVIRONMENT, () => {
             const config = getCurrentConfig();
             return {
+                gitRemoteBaseUrl: config.gitRemoteBaseUrl,
                 iamBaseUrl: config.iamBaseUrl,
                 isDevelopment: isDevelopment(),
                 webAppUrl: config.webAppUrl,

package/dist/server/infra/transport/handlers/locations-handler.d.ts

@@ -24,4 +24,5 @@ export declare class LocationsHandler {
     constructor(deps: LocationsHandlerDeps);
     setup(): void;
     private buildLocations;
+    private handleReveal;
 }

package/dist/server/infra/transport/handlers/locations-handler.js

@@ -1,6 +1,8 @@
+import { spawn } from 'node:child_process';
 import { join } from 'node:path';
-import { LocationsEvents } from '../../../../shared/transport/events/locations-events.js';
+import { LocationsEvents, } from '../../../../shared/transport/events/locations-events.js';
 import { BRV_DIR, CONTEXT_TREE_DIR } from '../../../constants.js';
+import { resolveRevealCommand } from './reveal-command.js';
 /**
  * Handles locations:get event.
  * Returns all registered project locations with context tree status.
@@ -31,6 +33,7 @@ export class LocationsHandler {
                 return { locations: [] };
             }
         });
+        this.transport.onRequest(LocationsEvents.REVEAL, async (data) => this.handleReveal(data));
     }
     async buildLocations(currentProjectPath) {
         const all = this.projectRegistry.getAll();
@@ -75,4 +78,25 @@ export class LocationsHandler {
             return (all.get(b.projectPath)?.registeredAt ?? 0) - (all.get(a.projectPath)?.registeredAt ?? 0);
         });
     }
+    async handleReveal(data) {
+        const { projectPath } = data;
+        if (!projectPath)
+            throw new Error('projectPath is required');
+        // Only allow revealing paths that are registered projects — the client
+        // controls this argument, so we must not trust it blindly.
+        const registered = this.projectRegistry.getAll();
+        if (!registered.has(projectPath)) {
+            throw new Error('Project is not registered.');
+        }
+        const exists = await this.pathExists(projectPath).catch(() => false);
+        if (!exists)
+            throw new Error('Project folder no longer exists.');
+        const { args, command } = resolveRevealCommand(process.platform, projectPath);
+        const child = spawn(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        child.on('error', () => {
+            /* best-effort — nothing to report back once the ack resolved */
+        });
+        child.unref();
+        return { projectPath };
+    }
 }

package/dist/server/infra/transport/handlers/reveal-command.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Resolves the OS-native command for revealing a path in the system file manager.
+ * Extracted so the branching can be unit-tested without spawning real processes.
+ */
+export type RevealCommand = {
+    args: string[];
+    command: string;
+};
+export declare function resolveRevealCommand(platformName: NodeJS.Platform, targetPath: string): RevealCommand;

package/dist/server/infra/transport/handlers/reveal-command.js

@@ -0,0 +1,7 @@
+export function resolveRevealCommand(platformName, targetPath) {
+    if (platformName === 'darwin')
+        return { args: [targetPath], command: 'open' };
+    if (platformName === 'win32')
+        return { args: [targetPath], command: 'explorer' };
+    return { args: [targetPath], command: 'xdg-open' };
+}

package/dist/server/infra/transport/handlers/vc-handler.d.ts

@@ -40,6 +40,11 @@ export declare class VcHandler {
     constructor(deps: IVcHandlerDeps);
     setup(): void;
     private buildAuthorHint;
+    /**
+     * Builds a single diff entry for a changed file, or `undefined` when either required side
+     * is absent/binary (the caller filters these out to keep binaries out of diff output).
+     */
+    private buildDiffFile;
     private buildNoRemoteMessage;
     private computeDiff;
     /**
@@ -77,6 +82,12 @@ export declare class VcHandler {
     private handleRemote;
     private handleReset;
     private handleStatus;
+    /**
+     * Reads a diff side's content + short oid in a single pass. Returns `undefined`
+     * only when the blob is absent on disk / at the ref. Binary content (NUL byte)
+     * is marked via `binary: true` so the caller can emit `Binary files ... differ`.
+     */
+    private readSideEntry;
     /**
      * Resolve clone request data into a clean cogit URL + team/space info.
      * Accepts either a URL or explicit teamName/spaceName.

package/dist/server/infra/transport/handlers/vc-handler.js

@@ -32,6 +32,29 @@ const FIELD_MAP = {
     'user.email': 'email',
     'user.name': 'name',
 };
+function inferStatus(oldExists, newExists) {
+    if (!oldExists && newExists)
+        return 'added';
+    if (oldExists && !newExists)
+        return 'deleted';
+    return 'modified';
+}
+function resolveDiffSides(mode) {
+    switch (mode.kind) {
+        case 'range': {
+            return { from: { commitish: mode.from }, to: { commitish: mode.to } };
+        }
+        case 'ref-vs-worktree': {
+            return { from: { commitish: mode.ref }, to: 'WORKDIR' };
+        }
+        case 'staged': {
+            return { from: { commitish: 'HEAD' }, to: 'STAGE' };
+        }
+        case 'unstaged': {
+            return { from: 'STAGE', to: 'WORKDIR' };
+        }
+    }
+}
 /**
  * Handles vc:* events (Version Control commands).
  */
@@ -96,6 +119,35 @@ export class VcHandler {
         }
         return 'Run: brv vc config user.name <value> and brv vc config user.email <value>.';
     }
+    /**
+     * Builds a single diff entry for a changed file, or `undefined` when either required side
+     * is absent/binary (the caller filters these out to keep binaries out of diff output).
+     */
+    async buildDiffFile(params) {
+        const { directory, from, path, status, to } = params;
+        const [oldSide, newSide] = await Promise.all([
+            status === 'added' ? undefined : this.readSideEntry(directory, from, path),
+            status === 'deleted' ? undefined : this.readSideEntry(directory, to, path),
+        ]);
+        if (status !== 'added' && !oldSide)
+            return undefined;
+        if (status !== 'deleted' && !newSide)
+            return undefined;
+        const binary = (oldSide?.binary ?? false) || (newSide?.binary ?? false);
+        const result = {
+            newContent: binary ? '' : (newSide?.content ?? ''),
+            oldContent: binary ? '' : (oldSide?.content ?? ''),
+            path,
+            status,
+        };
+        if (oldSide)
+            result.oldOid = oldSide.oid;
+        if (newSide)
+            result.newOid = newSide.oid;
+        if (binary)
+            result.binary = true;
+        return result;
+    }
     buildNoRemoteMessage(nextStep) {
         return (`No remote configured.\n\nTo connect to cloud:\n` +
             `  1. Go to ${this.webAppUrl} → create or open a Space\n` +
@@ -106,7 +158,7 @@ export class VcHandler {
     async computeDiff(directory, path, side) {
         if (side === 'staged') {
             const [head, stage] = await Promise.all([
-                this.gitService.getBlobContent({ directory, path, ref: 'HEAD' }),
+                this.gitService.getBlobContent({ directory, path, ref: { commitish: 'HEAD' } }),
                 this.gitService.getBlobContent({ directory, path, ref: 'STAGE' }),
             ]);
             return { newContent: stage ?? '', oldContent: head ?? '', path };
@@ -480,19 +532,63 @@ export class VcHandler {
         if (!gitInitialized) {
             throw new VcError('ByteRover version control not initialized.', VcErrorCode.GIT_NOT_INITIALIZED);
         }
+        // Mode-based call (CLI/TUI): auto-discover changed files + return full IVcDiffFile entries.
+        // Binary or unreadable files are dropped by buildDiffFile (returns undefined).
+        if ('mode' in data) {
+            const { from, to } = resolveDiffSides(data.mode);
+            try {
+                const changed = await this.gitService.listChangedFiles({ directory, from, to });
+                const entries = await Promise.all(changed.map((change) => this.buildDiffFile({ directory, from, path: change.path, status: change.status, to })));
+                const diffs = entries.filter((d) => d !== undefined);
+                return { diffs, mode: data.mode };
+            }
+            catch (error) {
+                const classified = classifyIsomorphicGitError(error, VcErrorCode.INVALID_REF);
+                if (classified)
+                    throw classified;
+                throw error;
+            }
+        }
+        // WebUI call: caller-supplied paths + side. Status is derived from blob presence,
+        // so an empty-blob edit is correctly reported as `modified`, not `added`.
         const { paths, side } = data;
         if (side === 'staged') {
             const [head, stage] = await Promise.all([
-                this.gitService.getBlobContents({ directory, paths, ref: 'HEAD' }),
+                this.gitService.getBlobContents({ directory, paths, ref: { commitish: 'HEAD' } }),
                 this.gitService.getBlobContents({ directory, paths, ref: 'STAGE' }),
             ]);
-            const diffs = paths.map((path) => ({ newContent: stage[path] ?? '', oldContent: head[path] ?? '', path }));
+            const diffs = paths.map((path) => {
+                const oldBlob = head[path];
+                const newBlob = stage[path];
+                return {
+                    newContent: newBlob ?? '',
+                    oldContent: oldBlob ?? '',
+                    path,
+                    status: inferStatus(oldBlob !== undefined, newBlob !== undefined),
+                };
+            });
             return { diffs };
         }
         // unstaged: compare index (old) against working tree (new)
         const stage = await this.gitService.getBlobContents({ directory, paths, ref: 'STAGE' });
-        const workingTree = await Promise.all(paths.map((path) => fs.promises.readFile(join(directory, path), 'utf8').catch(() => '')));
-        const diffs = paths.map((path, i) => ({ newContent: workingTree[i], oldContent: stage[path] ?? '', path }));
+        const workingTree = await Promise.all(paths.map(async (path) => {
+            try {
+                return await fs.promises.readFile(join(directory, path), 'utf8');
+            }
+            catch {
+                return undefined;
+            }
+        }));
+        const diffs = paths.map((path, i) => {
+            const oldBlob = stage[path];
+            const newFile = workingTree[i];
+            return {
+                newContent: newFile ?? '',
+                oldContent: oldBlob ?? '',
+                path,
+                status: inferStatus(oldBlob !== undefined, newFile !== undefined),
+            };
+        });
         return { diffs };
     }
     async handleDiscard(data, clientId) {
@@ -506,15 +602,13 @@ export class VcHandler {
         // Prefer index blob (preserves staged changes); fall back to HEAD; else delete (untracked).
         const [stage, head] = await Promise.all([
             this.gitService.getBlobContents({ directory, paths: filePaths, ref: 'STAGE' }),
-            this.gitService.getBlobContents({ directory, paths: filePaths, ref: 'HEAD' }),
+            this.gitService.getBlobContents({ directory, paths: filePaths, ref: { commitish: 'HEAD' } }),
         ]);
         const results = await Promise.all(filePaths.map(async (path) => {
             const target = stage[path] ?? head[path];
             const absolutePath = join(directory, path);
             try {
-                await (target === undefined
-                    ? fs.promises.unlink(absolutePath)
-                    : fs.promises.writeFile(absolutePath, target));
+                await (target === undefined ? fs.promises.unlink(absolutePath) : fs.promises.writeFile(absolutePath, target));
                 return true;
             }
             catch {
@@ -820,6 +914,25 @@ export class VcHandler {
             const url = await this.gitService.getRemoteUrl({ directory, remote: 'origin' });
             return { action: 'show', url: url ? maskCredentialsInUrl(url) : undefined };
         }
+        if (data.subcommand === 'remove') {
+            const existingUrl = await this.gitService.getRemoteUrl({ directory, remote: 'origin' });
+            if (!existingUrl) {
+                throw new VcError("No remote 'origin' to remove.", VcErrorCode.NO_REMOTE);
+            }
+            // Clear config before removing the remote so a mid-way failure leaves a retry-friendly state:
+            // if removeRemote throws, config is already cleared and remote is still present, so
+            // re-running `remove` will retry removeRemote and succeed. The reverse order leaves the
+            // remote gone but config stale, and the next `remove` fails with NO_REMOTE — unrecoverable.
+            const existingConfig = await this.projectConfigStore.read(projectPath);
+            if (existingConfig) {
+                await this.projectConfigStore.write(existingConfig.withoutSpace(), projectPath);
+            }
+            await this.gitService.removeRemote({ directory, remote: 'origin' });
+            return { action: 'remove' };
+        }
+        if (data.subcommand !== 'add' && data.subcommand !== 'set-url') {
+            throw new VcError('Unknown remote subcommand.', VcErrorCode.INVALID_ACTION);
+        }
         if (!data.url) {
             throw new VcError('URL is required.', VcErrorCode.INVALID_REMOTE_URL);
         }
@@ -981,6 +1094,27 @@ export class VcHandler {
             untracked: gitStatus.files.filter((f) => f.status === 'untracked').map((f) => f.path),
         };
     }
+    /**
+     * Reads a diff side's content + short oid in a single pass. Returns `undefined`
+     * only when the blob is absent on disk / at the ref. Binary content (NUL byte)
+     * is marked via `binary: true` so the caller can emit `Binary files ... differ`.
+     */
+    async readSideEntry(directory, side, path) {
+        if (side === 'WORKDIR') {
+            let buf;
+            try {
+                buf = await fs.promises.readFile(join(directory, path));
+            }
+            catch {
+                return undefined;
+            }
+            const oid = await this.gitService.hashBlob(buf);
+            if (buf.includes(0))
+                return { binary: true, content: '', oid };
+            return { content: buf.toString('utf8'), oid };
+        }
+        return this.gitService.getTextBlob({ directory, path, ref: side });
+    }
     /**
      * Resolve clone request data into a clean cogit URL + team/space info.
      * Accepts either a URL or explicit teamName/spaceName.

package/dist/server/infra/webui/webui-middleware.js

@@ -19,7 +19,12 @@ export function createWebUiMiddleware({ getConfig, webuiDistDir }) {
             "connect-src 'self' ws: wss:",
             "font-src 'self' data: https://fonts.gstatic.com",
             "frame-ancestors 'none'",
-            "img-src 'self' data:",
+            // `img-src https:` is deliberately broad: user avatars come from an
+            // open-ended set of OAuth provider CDNs (Google, GitHub, Gravatar,
+            // self-hosted identity providers, …) that can't be enumerated ahead
+            // of time. Images can't execute code, so the attack surface is just
+            // pixel exfiltration / tracking, which we accept for this use case.
+            "img-src 'self' data: https:",
             "object-src 'none'",
             "script-src 'self'",
             "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",

package/dist/shared/transport/events/config-events.d.ts

@@ -5,6 +5,7 @@ export declare const ConfigEvents: {
     readonly PROJECT_CHANGED: "config:projectChanged";
 };
 export interface ConfigGetEnvironmentResponse {
+    gitRemoteBaseUrl: string;
     iamBaseUrl: string;
     isDevelopment: boolean;
     webAppUrl: string;

package/dist/shared/transport/events/index.d.ts

@@ -130,6 +130,7 @@ export declare const AllEventGroups: readonly [{
     readonly SWITCHED: "session:switched";
 }, {
     readonly GET: "locations:get";
+    readonly REVEAL: "locations:reveal";
 }, {
     readonly ADD: "source:add";
     readonly LIST: "source:list";

package/dist/shared/transport/events/locations-events.d.ts

@@ -1,7 +1,14 @@
 import type { ProjectLocationDTO } from '../types/dto.js';
 export declare const LocationsEvents: {
     readonly GET: "locations:get";
+    readonly REVEAL: "locations:reveal";
 };
 export interface LocationsGetResponse {
     locations: ProjectLocationDTO[];
 }
+export interface LocationsRevealRequest {
+    projectPath: string;
+}
+export interface LocationsRevealResponse {
+    projectPath: string;
+}

package/dist/shared/transport/events/locations-events.js

@@ -1,3 +1,4 @@
 export const LocationsEvents = {
     GET: 'locations:get',
+    REVEAL: 'locations:reveal',
 };