dsh-remote-vs 0.9.3 → 0.11.0

package/lib/index.js

@@ -4,6 +4,7 @@ import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, re
 import { createHash, randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { StringDecoder } from "node:string_decoder";
 import { fileURLToPath } from "node:url";
 import { WebSocketServer } from "ws";
 import { execFile } from "node:child_process";
@@ -505,6 +506,40 @@ var RemotePool = class {
 				let stream;
 				let out = "";
 				let err = "";
+				/** Set by the cancel handle: closed + group-killed, reported as error. */
+				let cancelled = false;
+				const outDecoder = new StringDecoder("utf8");
+				const errDecoder = new StringDecoder("utf8");
+				/** Wrapper marker never reaches the live log (see the data handler). */
+				let pendingForward = "";
+				const forward = (kind, text) => {
+					if (text !== "" && opts.onData !== void 0) opts.onData(kind, text);
+				};
+				/**
+				* Cancel the run: close our channel and kill the remote process group.
+				*
+				* `finish` reports it as an error rather than a timeout — "the user
+				* stopped it" and "the budget ran out" are different stories, and the
+				* UI must not blame the host for the former.
+				*/
+				const cancel = () => {
+					if (settled) return;
+					cancelled = true;
+					try {
+						stream?.close();
+					} catch {}
+					if (pgid !== void 0) terminateGroup();
+					else if (!session) warnOnce();
+					finish({
+						success: false,
+						exitCode: null,
+						timedOut: false,
+						stdout: out,
+						stderr: err,
+						error: "cancelled by user"
+					});
+				};
+				opts.onCancel?.(cancel);
 				conn.exec(session ? sessionLine(command) : command, (execError, channel) => {
 					if (execError !== void 0 && execError !== null) {
 						finish({
@@ -527,6 +562,22 @@ var RemotePool = class {
 					channel.on("close", (code, signalName) => {
 						if (code !== null && code !== void 0 || signalName !== null && signalName !== void 0) exited = true;
 						if (timedOut && session && pgid === void 0) warnOnce();
+						if (pendingForward !== "") {
+							const newline = pendingForward.indexOf("\n");
+							const visible = markerPending ? pendingForward.startsWith(PGID_MARKER) ? newline < 0 ? "" : pendingForward.slice(newline + 1) : pendingForward : pendingForward;
+							pendingForward = "";
+							forward("out", visible);
+						}
+						const tailOut = outDecoder.end();
+						const tailErr = errDecoder.end();
+						if (tailOut !== "") {
+							out = appendCapped(out, tailOut);
+							forward("out", tailOut);
+						}
+						if (tailErr !== "") {
+							err = appendCapped(err, tailErr);
+							forward("err", tailErr);
+						}
 						finish({
 							success: code === 0,
 							exitCode: code,
@@ -536,18 +587,37 @@ var RemotePool = class {
 						});
 					});
 					channel.on("data", (chunk) => {
-						out = appendCapped(out, chunk.toString("utf8"));
-						if (pgid !== void 0 || !markerPending) return;
+						const text = outDecoder.write(chunk);
+						out = appendCapped(out, text);
+						if (pgid !== void 0 || !markerPending) {
+							forward("out", text);
+							return;
+						}
+						pendingForward += text;
 						const marker = takePgid(out);
 						if (marker.pgid !== void 0) {
 							pgid = marker.pgid;
 							out = marker.out;
 							markerPending = false;
 							if (timedOut) terminateGroup();
-						} else if (out.includes("\n")) markerPending = false;
+							if (cancelled) terminateGroup();
+							const newline = pendingForward.indexOf("\n");
+							const visible = newline < 0 ? "" : pendingForward.slice(newline + 1);
+							pendingForward = "";
+							forward("out", visible);
+							return;
+						}
+						if (out.includes("\n") || pendingForward.length > 8192) {
+							markerPending = false;
+							const visible = pendingForward;
+							pendingForward = "";
+							forward("out", visible);
+						}
 					});
 					channel.stderr.on("data", (chunk) => {
-						err = appendCapped(err, chunk.toString("utf8"));
+						const text = errDecoder.write(chunk);
+						err = appendCapped(err, text);
+						forward("err", text);
 					});
 				});
 			});
@@ -1062,6 +1132,8 @@ const REMOTE_API = {
 	test: "/api/dsh-remote/test",
 	keygen: "/api/dsh-remote/keygen",
 	exec: "/api/dsh-remote/exec",
+	/** Streaming exec (server-sent events) for the long network verbs. */
+	execStream: "/api/dsh-remote/exec-stream",
 	files: "/api/dsh-remote/files",
 	/** Streaming binary upload: raw request body, host and path in the query. */
 	upload: "/api/dsh-remote/upload",
@@ -1551,8 +1623,14 @@ var TerminalSessionRegistry = class {
 //#region src/timeouts.ts
 /** Smallest accepted timeout: below this, local work would start failing. */
 const MIN_TIMEOUT_MS = 1e3;
-/** Largest accepted timeout — the exec route clamps to the same ceiling. */
-const MAX_TIMEOUT_MS = 6e5;
+/**
+* Largest accepted timeout — the exec route clamps to the same ceiling.
+*
+* Raised from 10 to 30 minutes when the SCM push gained a live output panel:
+* a Gerrit push on a large repo waits for server-side hooks and can outlast
+* the old ceiling with nothing wrong on either side.
+*/
+const MAX_TIMEOUT_MS = 18e5;
 /**
 * Default for one git command (status/log/branches/diff over exec).
 *
@@ -1580,7 +1658,7 @@ function clampTimeout(value, fallback) {
 	if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
 	const whole = Math.floor(value);
 	if (whole < 1e3) return MIN_TIMEOUT_MS;
-	if (whole > 6e5) return MAX_TIMEOUT_MS;
+	if (whole > 18e5) return MAX_TIMEOUT_MS;
 	return whole;
 }
 /**
@@ -1843,6 +1921,130 @@ function makeRoutes(deps) {
 					writeJson(res, 200, await pool.exec(body.alias, body.command, timeoutMs === void 0 ? {} : { timeoutMs }));
 				}
 			},
+			{
+				kind: "exact",
+				path: REMOTE_API.execStream,
+				handler: async (req, res) => {
+					if (!isLoopbackRequest(req)) {
+						writeJson(res, 403, { error: "forbidden: loopback-only" });
+						return;
+					}
+					if (req.method !== "POST") {
+						writeJson(res, 405, { error: `method not allowed: ${req.method}` });
+						return;
+					}
+					const body = await readJsonBody(req, { objectOnly: true });
+					if (body === null || typeof body.alias !== "string" || typeof body.command !== "string" || body.command === "") {
+						writeJson(res, 400, { error: "alias and a non-empty command are required" });
+						return;
+					}
+					const timeoutMs = clampExecTimeout(body.timeoutMs);
+					res.writeHead(200, {
+						"Content-Type": "text/event-stream; charset=utf-8",
+						"Cache-Control": "no-cache, no-transform",
+						Connection: "keep-alive",
+						"X-Accel-Buffering": "no"
+					});
+					/** No more events to the client (finished, or the socket broke). */
+					let outputClosed = false;
+					/** `res.end` already called. */
+					let ended = false;
+					/** The client asked to stop: kill the remote even if the read is still opening. */
+					let cancelRequested = false;
+					/** The cancel handle was invoked (only once). */
+					let cancelSent = false;
+					let cancel;
+					/** Server-side forward cap: the client shows a scrolling tail anyway. */
+					let sent = 0;
+					const FORWARD_CAP = 4 * 1024 * 1024;
+					/**
+					* Stop the remote process group exactly once.
+					*
+					* The disconnect may happen while `pool.exec` is still acquiring the
+					* channel (slot queue, setsid probe, connect) — the handle does not exist
+					* yet then, so the request is latched and fired the moment `onCancel`
+					* arrives; otherwise a push would finish unseen and uncancellable.
+					*/
+					const abortRemote = () => {
+						cancelRequested = true;
+						if (cancel === void 0 || cancelSent) return;
+						cancelSent = true;
+						cancel();
+					};
+					const send = (event) => {
+						if (outputClosed) return;
+						try {
+							res.write(`data: ${JSON.stringify(event)}\n\n`);
+						} catch {
+							outputClosed = true;
+							abortRemote();
+						}
+					};
+					const heartbeat = setInterval(() => {
+						if (outputClosed) return;
+						try {
+							res.write(": ping\n\n");
+						} catch {
+							outputClosed = true;
+							abortRemote();
+						}
+					}, 15e3);
+					heartbeat.unref?.();
+					const stop = () => {
+						if (ended) return;
+						ended = true;
+						outputClosed = true;
+						clearInterval(heartbeat);
+						try {
+							res.end();
+						} catch {}
+					};
+					res.on("close", () => {
+						abortRemote();
+						stop();
+					});
+					try {
+						const result = await pool.exec(body.alias, body.command, {
+							...timeoutMs === void 0 ? {} : { timeoutMs },
+							onData: (stream, text) => {
+								if (outputClosed || sent >= FORWARD_CAP) return;
+								sent += Buffer.byteLength(text, "utf8");
+								send({
+									t: stream,
+									d: text
+								});
+							},
+							onCancel: (handle) => {
+								cancel = handle;
+								if (cancelRequested && !cancelSent) {
+									cancelSent = true;
+									handle();
+								}
+							}
+						});
+						if (outputClosed) return;
+						send({
+							t: "exit",
+							success: result.success,
+							exitCode: result.exitCode,
+							timedOut: result.timedOut,
+							durationMs: result.durationMs,
+							...result.error === void 0 ? {} : { error: result.error }
+						});
+					} catch (error) {
+						send({
+							t: "exit",
+							success: false,
+							exitCode: null,
+							timedOut: false,
+							durationMs: 0,
+							error: error instanceof Error ? error.message : String(error)
+						});
+					} finally {
+						stop();
+					}
+				}
+			},
 			{
 				kind: "exact",
 				path: REMOTE_API.files,
@@ -4006,7 +4208,7 @@ const Config = z.object({
 		"off",
 		"shadow",
 		"enforce"
-	]).default("off").volatile(),
+	]).default("enforce").volatile(),
 	gitTimeoutMs: z.number().step(1).min(MIN_TIMEOUT_MS).max(MAX_TIMEOUT_MS).default(DEFAULT_GIT_TIMEOUT_MS).volatile(),
 	readTimeoutMs: z.number().step(1).min(MIN_TIMEOUT_MS).max(MAX_TIMEOUT_MS).default(DEFAULT_READ_TIMEOUT_MS).volatile()
 });
@@ -4063,7 +4265,7 @@ function apply(ctx, config) {
 	const worlds = new RemoteWorlds(ctx, {
 		store,
 		pool,
-		mode: () => readField(config?.routingMode, "off")
+		mode: () => readField(config?.routingMode, "enforce")
 	});
 	ctx.provide("remoteWorlds", worlds);
 	ctx.effect(() => () => {

package/lib/types/client/api.d.ts

@@ -100,6 +100,18 @@ export declare const api: {
         }>;
     };
     exec: (alias: string, command: string, timeoutMs?: number) => Promise<RemoteExecResult>;
+    /**
+     * Streaming exec: the network verbs' live log.
+     *
+     * The route answers as SSE frames; `onData` receives decoded text while the
+     * command runs, and the promise settles on the `exit` frame. An aborted
+     * `signal` cancels the remote process group on the host side (the route acts
+     * on the closed response), so a cancel button can actually stop a push.
+     */
+    execStream: (alias: string, command: string, timeoutMs: number, handlers: {
+        onData?: (stream: "out" | "err", text: string) => void;
+        signal?: AbortSignal;
+    }) => Promise<RemoteExecResult>;
     getWorkspaces: () => Promise<{
         workspaces: RemoteWorkspaceBinding[];
     } & RemoteRoutingStatus & RemotePluginMeta>;

package/lib/types/client/composer.d.ts

@@ -95,7 +95,11 @@ interface InputSnapshot {
     draft: string;
     draftRev?: number;
     occurrences?: readonly OccurrenceLike[];
-    phase?: 'plain' | 'adjudicating' | 'claimed' | 'submitting';
+    /**
+     * Host submission plane. `sending` exists since DSH 0.2.2-alpha.2: an ordinary
+     * message the host has not accepted yet — the editor is read-only there too.
+     */
+    phase?: 'plain' | 'adjudicating' | 'claimed' | 'submitting' | 'sending';
     claim?: {
         readonly token: string;
     };

package/lib/types/client/exec-output.d.ts

@@ -0,0 +1,58 @@
+/** What a streamed push should do: remembered refspec ('' = plain) + remote. */
+export interface PushTarget {
+    refspec: string;
+    remote: string;
+}
+/**
+ * The commands one network verb runs, in order.
+ *
+ * Pure so the gate can pin the sequence: sync is pull-then-push (the historical
+ * order), and a push with a refspec must not fall back to the bare form.
+ */
+export declare function networkCommands(root: string, kind: 'fetch' | 'pull' | 'push' | 'sync', push: PushTarget): string[];
+/** Live-log cap: keep the TAIL, because the head of a long push is never the point. */
+export declare const EXEC_OUTPUT_CAP = 200000;
+/**
+ * Fold carriage-return progress rewrites for DISPLAY.
+ *
+ * git's progress lines are written as `Counting: 1%\rCounting: 2%\r…` and a
+ * `<pre>` would render every rewrite as its own line (hundreds of them for one
+ * push). Only the content after the last `\r` of a line survives.
+ *
+ * Fold at RENDER time, over the complete accumulated text — not inside
+ * `appendExecOutput`. A chunk can end mid-rewrite (git writes bare `\r`s at
+ * arbitrary boundaries), and folding a fragment loses the state that the next
+ * fragment continues: measured against real `git push --progress` stderr, the
+ * per-chunk fold glued `Counting: 1%Counting: 2%…` into one long line.
+ */
+export declare function foldExecOutput(text: string): string;
+/**
+ * Append one decoded chunk, keeping the TAIL.
+ *
+ * The raw `\r` bytes are preserved on purpose: the view folds them once, over
+ * the whole accumulated log, so a rewrite split across two chunks still folds
+ * correctly (`foldExecOutput`).
+ */
+export declare function appendExecOutput(previous: string, chunk: string, cap?: number): string;
+/**
+ * Split an SSE buffer into complete frames and the incomplete tail.
+ *
+ * A chunk can end in the middle of `data: {...}` or between the two newlines
+ * that terminate a frame, so the caller must carry `rest` into the next read.
+ */
+export declare function takeSseFrames(buffer: string): {
+    frames: string[];
+    rest: string;
+};
+/**
+ * One SSE frame's JSON payload; `undefined` for comments (heartbeats), empty
+ * frames and malformed JSON — a broken heartbeat must not kill the stream.
+ */
+export declare function parseSseFrame(frame: string): unknown | undefined;
+/** `m:ss` (or `h:mm:ss`) for the running timer. */
+export declare function formatElapsed(ms: number): string;
+/**
+ * The network verbs' budget: at least 20 minutes, or twice the configured git
+ * budget when that is larger, never past the host's 30-minute ceiling.
+ */
+export declare function networkBudgetMs(gitTimeoutMs: number): number;

package/lib/types/client/i18n.d.ts

@@ -11,7 +11,7 @@
  * them here keeps the check meaningful in both directions: every entry must
  * exist in both dictionaries, and nothing else may be unreferenced.
  */
-export declare const DYNAMIC_KEYS: readonly ["common.loading", "editor.saving", "editor.unsaved", "editor.saved", "scm.hunkStaged", "scm.hunkUnstaged", "scm.hunkReverted"];
+export declare const DYNAMIC_KEYS: readonly ["common.loading", "editor.saving", "editor.unsaved", "editor.saved", "scm.hunkStaged", "scm.hunkUnstaged", "scm.hunkReverted", "history.details", "history.content", "history.diff"];
 export type Lang = 'zh' | 'en';
 export declare function detectLang(): Lang;
 export declare function makeT(lang: Lang): (key: string) => string;

package/lib/types/client/scm/CommitPane.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The history panel's commit pane: the selected commit in the three views the
+ * DSH-better-sidebar changes pane exposes — `提交详情` (the card), `内容` (the
+ * files the commit touched) and `差异` (its patch).
+ *
+ * Deliberately better than the reference pane in the places a narrow sidebar
+ * hurts most:
+ *  - a sticky patch toolbar (previous/next file, current file, wrap toggle,
+ *    copy) so a long diff never loses the reader's position or the controls;
+ *  - sticky file headers per block, because "which file am I looking at" was
+ *    the reference's biggest scroll cost;
+ *  - `内容` groups files by directory with collapsible folders and a path
+ *    filter, instead of a flat wall of paths;
+ *  - right-click opens a real menu on every changed file (open in the editor,
+ *    show in the diff, copy the path / the file patch) — the editor's own
+ *    gesture, not a second mental model;
+ *  - expand/restore the pane to full height, and copy the commit message,
+ *    without leaving the panel.
+ *
+ * Frameless by design: the split, the frame and the pane height belong to the
+ * history panel, so this fills whatever box it is handed and scrolls itself.
+ * Read-only: a commit's patch is history, so the only mutations are "check this
+ * commit out" (confirmed) and copying — staging/reverting lives on worktree
+ * diffs.
+ *
+ * The patch is loaded lazily: a reader of 提交详情 must not pay a `git show
+ * --patch` round trip per clicked commit, and the pane asks for it only while
+ * the 差异 tab is on screen.
+ */
+import { type ReactNode } from 'react';
+import type { GitCommit, GitCommitFile } from '../../protocol.ts';
+import type { Lang } from '../i18n.ts';
+import { type HistoryTab } from './commit-model.ts';
+/** Translator shape shared by every view (`makeT` returns the same). */
+type Translate = (key: string) => string;
+export interface CommitPaneProps {
+    commit: GitCommit;
+    tab: HistoryTab;
+    onTab: (next: HistoryTab) => void;
+    onClose: () => void;
+    /** True while the pane covers the whole panel instead of its usual split. */
+    expanded: boolean;
+    onToggleExpand: () => void;
+    /** Message text below the subject line ('' = none, or the read failed). */
+    body: string;
+    /** `git show --name-status` rows; undefined while the read is in flight. */
+    files: GitCommitFile[] | undefined;
+    /** Set when the file-list read failed (the 内容 tab shows it). */
+    filesError: string | undefined;
+    /** Raw `git show --patch` text; undefined until the 差异 tab asks for it. */
+    patch: string | undefined;
+    /** The remote read hit its byte cap: the parsed prefix is NOT the whole diff. */
+    patchTruncated: boolean;
+    patchLoading: boolean;
+    patchError: string | undefined;
+    /** A file selected in 内容 (or a patch header), highlighted in 差异. */
+    focusPath: string | undefined;
+    onFocusPath: (path: string) => void;
+    /** `origPath` is a rename source: the editor drill-down must diff BOTH paths. */
+    onOpenFile: (path: string, origPath?: string) => void;
+    /** Reveal a changed file's containing directory in the explorer. */
+    onRevealFile: (path: string) => void;
+    /** Open a terminal tab already `cd`d into the file's directory. */
+    onOpenTerminal: (path: string) => void;
+    /** Remote ABSOLUTE path of a repo-relative commit path (copy-absolute). */
+    absPathOf: (path: string) => string;
+    onCheckout: () => void;
+    onReload: () => void;
+    t: Translate;
+    lang: Lang;
+}
+export declare function CommitPane(props: CommitPaneProps): ReactNode;
+export {};

package/lib/types/client/scm/ExecPanel.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Live output panel for the long network verbs (fetch / pull / push / sync).
+ *
+ * The unary exec route can only answer after the fact, so a 20-minute Gerrit
+ * push used to look like a frozen button. This panel is fed by the streaming
+ * exec route: it shows the git/remote output while it runs, a running clock,
+ * a stop button that really kills the remote process group, and keeps the full
+ * (tail-capped) log for copying after the fact.
+ *
+ * Rendered through a PORTAL on `document.body`: the SCM panel lives inside the
+ * sidebar's keep-alive slot, which the host hides with `display:none` when
+ * another rail view is picked — and a `position: fixed` descendant of a hidden
+ * ancestor disappears with it, taking the only cancel affordance of a running
+ * push along. The portal keeps the panel (and its stop button) reachable.
+ */
+import { type ReactNode } from 'react';
+export type ExecPanelStatus = 'running' | 'done' | 'error' | 'cancelled';
+export interface ExecPanelState {
+    title: string;
+    output: string;
+    status: ExecPanelStatus;
+    /** Wall-clock start, so the timer survives re-renders. */
+    startedAt: number;
+    elapsedMs: number;
+    /** One-line footer: exit code / duration / error. */
+    exitText?: string;
+}
+export interface ExecPanelProps {
+    state: ExecPanelState;
+    onCancel: () => void;
+    onClose: () => void;
+    t: (key: string) => string;
+}
+export declare function ExecPanel(props: ExecPanelProps): ReactNode;

package/lib/types/client/scm/HistoryPanel.d.ts

@@ -1,17 +1,25 @@
 /**
  * History view: the commit graph with branch lanes and merge curves (lane
- * layout ported from the previous Git view), plus click-to-expand changed
- * files and a per-file diff of that commit.
+ * layout ported from the previous Git view), plus a COMMIT PANE below it —
+ * the selected commit's 提交详情 / 内容 / 差异 tabs (see `./CommitPane.tsx`).
+ *
+ * The pane replaced the old per-row inline expansion: a commit is a subject
+ * with three answers, not a disclosure widget, and the pane keeps the graph
+ * readable while one commit is open. Clicking a row selects (the pane opens on
+ * 提交详情), clicking a changed file shows its patch in 差异, and a commit's
+ * per-file two-sided diff still opens in the editor through `openCommitFile`.
  *
  * Loading is a SINGLE capped call (`api.git.log(..., GIT_LOG_MAX)`); a deep
  * repository shows the newest GIT_LOG_MAX commits and is filtered client-side.
- * The docstring here used to promise scroll-triggered paging that does not
- * exist, which is worse than no comment: a reader trusts it.
  *
  * Each repository's last answer is kept in memory (`./panel-cache.ts`), so a
  * switch back to a workspace repaints its commit list at once and the log is
  * re-read behind it — the tab used to blank on every switch, and worse, kept the
  * PREVIOUS repository's rows until the new log arrived.
+ *
+ * Per-commit reads are cached separately (message + files, and the lazy patch),
+ * keyed by repository AND hash, so switching repositories can never show one
+ * host's commit body under another host's graph.
  */
 import { type ReactNode } from 'react';
 export declare function HistoryPanel(): ReactNode;

package/lib/types/client/scm/actions.d.ts

@@ -8,7 +8,8 @@
  * messages a user can act on (missing identity, no upstream, conflicts, ...).
  */
 import { REMOTE_API } from '../../protocol.ts';
-import type { GitBranch, GitCommitFile, GitRemote, GitStash, GitStatusDetail, RemoteRead } from '../../protocol.ts';
+import type { GitBranch, GitCommitFile, GitRemote, GitStash, GitStatusDetail, RemoteExecResult, RemoteRead } from '../../protocol.ts';
+import { type PushTarget } from '../exec-output.ts';
 /** Error carrying a message already fit for the UI. */
 export declare class GitOpError extends Error {
 }
@@ -90,8 +91,34 @@ export interface DiffPayload {
 export declare function loadDiff(alias: string, root: string, path: string, staged: boolean, untracked?: boolean): Promise<DiffPayload>;
 /** Files touched by one commit. */
 export declare function loadCommitFiles(alias: string, root: string, hash: string): Promise<GitCommitFile[]>;
-/** Diff of one path inside a commit (used by the history file drill-down). */
-export declare function loadCommitFileDiff(alias: string, root: string, hash: string, path: string): Promise<DiffPayload>;
+/**
+ * Diff of one path inside a commit (the editor drill-down).
+ *
+ * `origPath` is the rename source: `git show -M -- <old> <new>` needs BOTH
+ * paths or git cannot pair them and a 100% rename renders as a fully-added
+ * file. A root commit has no `^` revision — `git show <hash>` already diffs
+ * against the empty tree, and the failed old-side read degrades to ''.
+ */
+export declare function loadCommitFileDiff(alias: string, root: string, hash: string, path: string, origPath?: string): Promise<DiffPayload>;
+/** Raw message of one commit, split into its subject line and the body. */
+export declare function loadCommitMessage(alias: string, root: string, hash: string): Promise<{
+    subject: string;
+    body: string;
+}>;
+/**
+ * Whole patch of one commit (the commit header is stripped: starts at
+ * `diff --git`).
+ *
+ * `truncated` answers whether the read hit `commitPatchCommand`'s BYTE cap.
+ * The cap is applied with `head -c` (bytes) while the string length counts
+ * UTF-16 code units, so the comparison must measure BYTES too — a CJK-heavy
+ * patch capped at 2,000,000 bytes is only ~667k characters, and a char-length
+ * check silently reported "complete" for a cut patch.
+ */
+export declare function loadCommitPatch(alias: string, root: string, hash: string): Promise<{
+    text: string;
+    truncated: boolean;
+}>;
 /** Local + remote-tracking branches. */
 export declare function loadBranches(alias: string, root: string, current: string): Promise<GitBranch[]>;
 /** Configured remotes. */
@@ -120,6 +147,26 @@ export declare function commitAll(alias: string, root: string, message: string,
 export declare function lastCommitMessage(alias: string, root: string): Promise<string>;
 /** fetch / pull / push / sync. */
 export declare function syncRepo(alias: string, root: string, kind: 'fetch' | 'pull' | 'push' | 'sync'): Promise<string>;
+/**
+ * Push to an explicit remote with an explicit refspec (Gerrit review flow:
+ * `HEAD:refs/for/<branch>`). Same timeout budget as the other network verbs.
+ */
+export declare function pushWithRefspec(alias: string, root: string, remote: string, refspec: string): Promise<string>;
+export interface NetworkStreamHandlers {
+    onData?: (stream: 'out' | 'err', text: string) => void;
+    signal?: AbortSignal;
+}
+/**
+ * Run one network verb over the STREAMING exec route and accumulate its log.
+ *
+ * Stops at the first failing step (a sync whose pull failed must not push a
+ * half-merged tree). The caller owns the live panel; this returns only once the
+ * whole verb has settled, with `output` capped to its tail.
+ */
+export declare function streamNetworkVerb(alias: string, root: string, kind: 'fetch' | 'pull' | 'push' | 'sync', push: PushTarget, handlers?: NetworkStreamHandlers): Promise<{
+    result: RemoteExecResult;
+    output: string;
+}>;
 /** Branch verbs. */
 export declare function branchOp(alias: string, root: string, op: {
     kind: 'checkout';