filegrc 0.13.0 → 0.13.2

package/src/git.js

@@ -1,15 +1,37 @@
 import { execFileSync, spawn } from "node:child_process";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
-import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  readSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { rm } from "node:fs/promises";
 import { devNull } from "node:os";
 import { relative, resolve, sep } from "node:path";
 import { performance } from "node:perf_hooks";
 import { isSafeGitName } from "./git-name.js";
-import { serializeWorkspaceMutation, withDeferredWorkspaceValidation } from "./mutation.js";
+import {
+  serializeWorkspaceMutation,
+  withDeferredWorkspaceValidation,
+} from "./mutation.js";
 import { isCanonicalDataPath, resolveWorkspaceRoot } from "./paths.js";
-import { measureTiming, measureTimingSync, recordTiming, timingEnabled } from "./timing.js";
+import {
+  measureTiming,
+  measureTimingSync,
+  recordTiming,
+  timingEnabled,
+} from "./timing.js";
 import { fingerprintWorkspace, validateWorkspace } from "./validate.js";
 import { loadWorkspace } from "./workspace.js";
 
@@ -23,13 +45,16 @@ const backgroundSynchronizations = new Map();
 const browserRemotePrefetches = new Map();
 const browserRemotePrefetchPromises = new Map();
 const repositorySnapshotPromises = new Map();
+const repositoryObjectFormats = new Map();
 const gitCommandCaches = new AsyncLocalStorage();
 const gitCommandDeadlines = new AsyncLocalStorage();
+const gitCommandAdapters = new AsyncLocalStorage();
 const gitCommandCacheBytes = new WeakMap();
 let gitCommandInterceptor = null;
 let gitSubprocessObserver = null;
 let historicalBatchInterceptor = null;
 let historicalRevisionReadObserver = null;
+let workspaceBlobObjectIdOverride = null;
 const BROWSER_REMOTE_PREFETCH_MAX_AGE_MS = 30_000;
 const GIT_DEFAULT_TIMEOUT_MS = 10_000;
 const GIT_REMOTE_TIMEOUT_MS = 30_000;
@@ -48,19 +73,23 @@ const GIT_COMMAND_CACHE_MAX_ENTRY_BYTES = 512 * 1024;
 export const BROWSER_VALIDATION = Symbol("filegrc.browserValidation");
 
 export function withGitCommandCache(cache, callback) {
-  if (!(cache instanceof Map)) throw new TypeError("The Git command cache must be a Map.");
+  if (!(cache instanceof Map))
+    throw new TypeError("The Git command cache must be a Map.");
   return gitCommandCaches.run(cache, callback);
 }
 
 export function withGitCommandDeadline(deadlineAt, callback) {
-  if (!Number.isFinite(deadlineAt)) throw new TypeError("The Git command deadline must be finite.");
+  if (!Number.isFinite(deadlineAt))
+    throw new TypeError("The Git command deadline must be finite.");
   return gitCommandDeadlines.run(deadlineAt, callback);
 }
 
 function gitEnvironment(overrides = {}) {
   return {
     ...Object.fromEntries(
-      Object.entries(process.env).filter(([name]) => !name.toUpperCase().startsWith("GIT_"))
+      Object.entries(process.env).filter(
+        ([name]) => !name.toUpperCase().startsWith("GIT_"),
+      ),
     ),
     ...overrides,
     GIT_NO_REPLACE_OBJECTS: "1",
@@ -85,20 +114,24 @@ function gitEnvironment(overrides = {}) {
     GIT_CONFIG_KEY_6: "protocol.ssh.allow",
     GIT_CONFIG_VALUE_6: "always",
     GIT_CONFIG_KEY_7: "protocol.file.allow",
-    GIT_CONFIG_VALUE_7: "always"
+    GIT_CONFIG_VALUE_7: "always",
   };
 }
 
 export class GitOperationError extends Error {
   constructor(kind, operation, detail, options = {}) {
-    const prefix = kind === "missing-executable"
-      ? "Git is unavailable. Install Git and open this workspace from its authoritative repository checkout."
-      : kind === "timeout"
-        ? `Git timed out while trying to ${operation}.`
-        : kind === "invalid-repository"
-          ? `Git could not ${operation} because this workspace is not in a valid Git repository.`
-          : `Git could not ${operation}.`;
-    super(detail ? `${prefix} ${sanitizeGitErrorMessage(detail)}` : prefix, options);
+    const prefix =
+      kind === "missing-executable"
+        ? "Git is unavailable. Install Git and open this workspace from its authoritative repository checkout."
+        : kind === "timeout"
+          ? `Git timed out while trying to ${operation}.`
+          : kind === "invalid-repository"
+            ? `Git could not ${operation} because this workspace is not in a valid Git repository.`
+            : `Git could not ${operation}.`;
+    super(
+      detail ? `${prefix} ${sanitizeGitErrorMessage(detail)}` : prefix,
+      options,
+    );
     this.name = "GitOperationError";
     this.kind = kind;
     this.operation = operation;
@@ -109,14 +142,27 @@ export class GitOperationError extends Error {
 export function getGitSummary(input = process.cwd()) {
   const root = resolveWorkspaceRoot(input);
   try {
-    const topLevel = measureTimingSync("git-discovery", () => git(root, ["rev-parse", "--show-toplevel"]));
+    const topLevel = measureTimingSync("git-discovery", () =>
+      git(root, ["rev-parse", "--show-toplevel"]),
+    );
     assertNoWorkspaceContentFilters(root);
     const status = git(root, ["status", "--porcelain=v1", "--", "."]);
     const commit = tryGit(root, ["rev-parse", "HEAD"]) || null;
     const branch = tryGit(root, ["symbolic-ref", "--short", "HEAD"]) || null;
-    const upstream = branch ? tryGit(root, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"]) || null : null;
+    const upstream = branch
+      ? tryGit(root, [
+          "rev-parse",
+          "--abbrev-ref",
+          "--symbolic-full-name",
+          "@{upstream}",
+        ]) || null
+      : null;
     const remotes = lines(tryGit(root, ["remote"]));
-    const last = commit ? parseLogLine(tryGit(root, ["log", "-1", "--format=%H%x1f%aI%x1f%an%x1f%s"])) : null;
+    const last = commit
+      ? parseLogLine(
+          tryGit(root, ["log", "-1", "--format=%H%x1f%aI%x1f%an%x1f%s"]),
+        )
+      : null;
     return {
       available: true,
       root: topLevel,
@@ -127,7 +173,7 @@ export function getGitSummary(input = process.cwd()) {
       remotes,
       clean: status === "",
       changes: status ? status.split("\n") : [],
-      lastCommit: last
+      lastCommit: last,
     };
   } catch (error) {
     if (error?.code === "FILEGRC_GIT_DEADLINE") throw error;
@@ -135,7 +181,8 @@ export function getGitSummary(input = process.cwd()) {
       available: false,
       clean: null,
       changes: [],
-      message: "Git history is unavailable. Commit the workspace to enable audit metadata."
+      message:
+        "Git history is unavailable. Commit the workspace to enable audit metadata.",
     };
   }
 }
@@ -143,19 +190,23 @@ export function getGitSummary(input = process.cwd()) {
 export function getFileHistory(input, relativePath, limit = 50) {
   const root = resolveWorkspaceRoot(input);
   if (!isSafeDataGitPath(relativePath)) return null;
-  const indexed = indexedPathHistory(dataRecordHistoryIndexCache.get(root), relativePath);
+  const indexed = indexedPathHistory(
+    dataRecordHistoryIndexCache.get(root),
+    relativePath,
+  );
   if (indexed) return limitedHistory(indexed, limit);
   try {
-    const countArgs = Number(limit) >= Number.MAX_SAFE_INTEGER
-      ? []
-      : [`--max-count=${Math.max(1, Math.min(Number(limit) || 50, 200))}`];
+    const countArgs =
+      Number(limit) >= Number.MAX_SAFE_INTEGER
+        ? []
+        : [`--max-count=${Math.max(1, Math.min(Number(limit) || 50, 200))}`];
     const output = git(root, [
       "log",
       "--follow",
       ...countArgs,
       "--format=%H%x1f%cI%x1f%an%x1f%s",
       "--",
-      relativePath
+      relativePath,
     ]);
     if (!output) return [];
     return output.split("\n").map(parseLogLine);
@@ -168,12 +219,16 @@ export function getFileHistory(input, relativePath, limit = 50) {
 export function getFileHistoryWithPaths(input, relativePath, limit = 50) {
   const root = resolveWorkspaceRoot(input);
   if (!isSafeDataGitPath(relativePath)) return null;
-  const indexed = indexedPathHistory(dataRecordHistoryIndexCache.get(root), relativePath);
+  const indexed = indexedPathHistory(
+    dataRecordHistoryIndexCache.get(root),
+    relativePath,
+  );
   if (indexed) return limitedHistory(indexed, limit);
   try {
-    const countArgs = Number(limit) >= Number.MAX_SAFE_INTEGER
-      ? []
-      : [`--max-count=${Math.max(1, Math.min(Number(limit) || 50, 200))}`];
+    const countArgs =
+      Number(limit) >= Number.MAX_SAFE_INTEGER
+        ? []
+        : [`--max-count=${Math.max(1, Math.min(Number(limit) || 50, 200))}`];
     const output = gitRaw(root, [
       "log",
       "--follow",
@@ -183,7 +238,7 @@ export function getFileHistoryWithPaths(input, relativePath, limit = 50) {
       "--name-status",
       "-M",
       "--",
-      relativePath
+      relativePath,
     ]);
     if (!output) return [];
     const tokens = output.split("\0");
@@ -191,22 +246,30 @@ export function getFileHistoryWithPaths(input, relativePath, limit = 50) {
     const history = [];
     let index = 0;
     while (index < tokens.length) {
-      while (index < tokens.length && !/^[a-f0-9]{40}$/i.test(tokens[index].trim())) index += 1;
+      while (
+        index < tokens.length &&
+        !/^[a-f0-9]{40}$/i.test(tokens[index].trim())
+      )
+        index += 1;
       if (index >= tokens.length) break;
       const summary = {
         commit: tokens[index++].trim(),
         timestamp: tokens[index++] || "",
         author: tokens[index++] || "",
-        subject: tokens[index++] || ""
+        subject: tokens[index++] || "",
       };
       history.push({ ...summary, path: trackedPath });
-      while (index < tokens.length && !/^[a-f0-9]{40}$/i.test(tokens[index].trim())) {
+      while (
+        index < tokens.length &&
+        !/^[a-f0-9]{40}$/i.test(tokens[index].trim())
+      ) {
         const status = tokens[index++].trim();
         if (!status) continue;
         const oldPath = tokens[index++] || "";
         if (status.startsWith("R") || status.startsWith("C")) {
           const newPath = tokens[index++] || "";
-          if (status.startsWith("R") && newPath === trackedPath) trackedPath = oldPath;
+          if (status.startsWith("R") && newPath === trackedPath)
+            trackedPath = oldPath;
         }
       }
     }
@@ -219,15 +282,24 @@ export function getFileHistoryWithPaths(input, relativePath, limit = 50) {
 
 export function getFilePathAtRevision(input, relativePath, revision) {
   const root = resolveWorkspaceRoot(input);
-  if (!isSafeDataGitPath(relativePath) || !/^[a-f0-9]{40}$/i.test(String(revision || ""))) return null;
+  if (
+    !isSafeDataGitPath(relativePath) ||
+    !/^[a-f0-9]{40}$/i.test(String(revision || ""))
+  )
+    return null;
   const index = dataRecordHistoryIndexCache.get(root);
   const indexed = indexedPathHistory(index, relativePath);
   if (indexed) {
-    return indexed.find(({ commit }) => indexedAncestor(index, commit, revision))?.path || null;
+    return (
+      indexed.find(({ commit }) => indexedAncestor(index, commit, revision))
+        ?.path || null
+    );
   }
-  const history = getFileHistoryWithPaths(root, relativePath, Number.MAX_SAFE_INTEGER) || [];
-  const summary = history.find(({ commit }) => commit === revision)
-    || history.find(({ commit }) => isDataHistoryAncestor(root, commit, revision));
+  const history =
+    getFileHistoryWithPaths(root, relativePath, Number.MAX_SAFE_INTEGER) || [];
+  const summary =
+    history.find(({ commit }) => commit === revision) ||
+    history.find(({ commit }) => isDataHistoryAncestor(root, commit, revision));
   return summary?.path || null;
 }
 
@@ -247,18 +319,37 @@ export function getChangedDataJsonFilesAtRevision(input, revision) {
   try {
     const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
     const workspacePrefix = relative(topLevel, root).split(sep).join("/");
-    if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) return [];
+    if (workspacePrefix === ".." || workspacePrefix.startsWith("../"))
+      return [];
     const dataPrefix = workspacePrefix ? `${workspacePrefix}/data` : "data";
     const output = git(root, [
-      "diff-tree", "--root", "--no-commit-id", "--name-status", "-M", "-m", "-r", revision, "--", dataPrefix
+      "diff-tree",
+      "--root",
+      "--no-commit-id",
+      "--name-status",
+      "-M",
+      "-m",
+      "-r",
+      revision,
+      "--",
+      dataPrefix,
     ]);
     const paths = [];
     for (const line of lines(output)) {
       const [status, first, second] = line.split("\t");
       if (status === "D") continue;
-      const repositoryPath = status?.startsWith("R") || status?.startsWith("C") ? second : first;
-      if (!repositoryPath?.startsWith(`${dataPrefix}/`) || !repositoryPath.endsWith(".json")) continue;
-      paths.push(workspacePrefix ? repositoryPath.slice(workspacePrefix.length + 1) : repositoryPath);
+      const repositoryPath =
+        status?.startsWith("R") || status?.startsWith("C") ? second : first;
+      if (
+        !repositoryPath?.startsWith(`${dataPrefix}/`) ||
+        !repositoryPath.endsWith(".json")
+      )
+        continue;
+      paths.push(
+        workspacePrefix
+          ? repositoryPath.slice(workspacePrefix.length + 1)
+          : repositoryPath,
+      );
     }
     return [...new Set(paths)];
   } catch (error) {
@@ -273,38 +364,51 @@ export function getRecordIdentityHistory(input, id) {
 
 export function getRecordIdentityHistories(input, ids) {
   const index = getDataRecordHistoryIndex(input);
-  return new Map([...new Set(ids)].map((id) => [id, index.historiesById.get(id) || []]));
+  return new Map(
+    [...new Set(ids)].map((id) => [id, index.historiesById.get(id) || []]),
+  );
 }
 
 export function getDataRecordHistoryIndex(input, options = {}) {
   const root = resolveWorkspaceRoot(input);
   const cached = dataRecordHistoryIndexCache.get(root);
-  const suppliedHead = /^[a-f0-9]{40}$/i.test(String(options.head)) ? String(options.head) : undefined;
+  const suppliedHead = /^[a-f0-9]{40}$/i.test(String(options.head))
+    ? String(options.head)
+    : undefined;
   if (
-    suppliedHead
-    && cached?.head === suppliedHead
-    && !cached.available
-    && cached.failureExpiresAt > performance.now()
-  ) return cached;
-  if (suppliedHead && cached?.head === suppliedHead && cached.available) return cached;
+    suppliedHead &&
+    cached?.head === suppliedHead &&
+    !cached.available &&
+    cached.failureExpiresAt > performance.now()
+  )
+    return cached;
+  if (suppliedHead && cached?.head === suppliedHead && cached.available)
+    return cached;
   const hasDeadline = options.deadline !== undefined;
-  const deadline = hasDeadline ? Number(options.deadline) : performance.now() + DATA_HISTORY_BUILD_TIMEOUT_MS;
+  const deadline = hasDeadline
+    ? Number(options.deadline)
+    : performance.now() + DATA_HISTORY_BUILD_TIMEOUT_MS;
   if (!Number.isFinite(deadline) || deadline <= performance.now()) {
-    const error = new Error("Git data history exceeded its cumulative time limit.");
+    const error = new Error(
+      "Git data history exceeded its cumulative time limit.",
+    );
     error.code = "FILEGRC_HISTORY_DEADLINE";
     throw error;
   }
   const remainingTime = () => {
     const remainingMs = Math.floor(deadline - performance.now());
     if (remainingMs <= 0) {
-      const error = new Error("Git data history exceeded its cumulative time limit.");
+      const error = new Error(
+        "Git data history exceeded its cumulative time limit.",
+      );
       error.code = "FILEGRC_HISTORY_DEADLINE";
       throw error;
     }
     return remainingMs;
   };
   const historyGit = (args) => git(root, args, { timeoutMs: remainingTime() });
-  const historyGitRaw = (args) => gitRaw(root, args, { timeoutMs: remainingTime() });
+  const historyGitRaw = (args) =>
+    gitRaw(root, args, { timeoutMs: remainingTime() });
   let head = null;
   let discoveryError = null;
   if (suppliedHead) {
@@ -335,24 +439,46 @@ export function getDataRecordHistoryIndex(input, options = {}) {
     }
   }
   let available = Boolean(head) && !shallow;
-  let error = discoveryError || (!head
-    ? new Error("Git history is unavailable because the workspace has no committed HEAD.")
-    : shallow ? new Error("Git history is shallow.") : null);
+  let error =
+    discoveryError ||
+    (!head
+      ? new Error(
+          "Git history is unavailable because the workspace has no committed HEAD.",
+        )
+      : shallow
+        ? new Error("Git history is shallow.")
+        : null);
   if (discoveryError) available = false;
   try {
     if (available) {
       const output = historyGitRaw([
-        "log", "--topo-order", "--reverse", "--diff-merges=first-parent", "-z", "--relative",
-        "--format=%H%x00%cI%x00%an%x00%s%x00", "--name-status", "-M", head, "--", "data"
+        "log",
+        "--topo-order",
+        "--reverse",
+        "--diff-merges=first-parent",
+        "-z",
+        "--relative",
+        "--format=%H%x00%cI%x00%an%x00%s%x00",
+        "--name-status",
+        "-M",
+        head,
+        "--",
+        "data",
       ]);
       const parsed = parseDataRecordHistory(output);
-      if (parsed.commitCount > DATA_HISTORY_MAX_COMMITS || parsed.changes.length > DATA_HISTORY_MAX_CHANGES) {
-        throw dataHistoryLimitError("Git data history is too large to reconcile safely.");
+      if (
+        parsed.commitCount > DATA_HISTORY_MAX_COMMITS ||
+        parsed.changes.length > DATA_HISTORY_MAX_CHANGES
+      ) {
+        throw dataHistoryLimitError(
+          "Git data history is too large to reconcile safely.",
+        );
       }
       changes.push(...parsed.recordChanges);
       sourceChanges.push(...parsed.sourceChanges);
       for (const change of parsed.changes) {
-        if (!changesByCommit.has(change.summary.commit)) changesByCommit.set(change.summary.commit, []);
+        if (!changesByCommit.has(change.summary.commit))
+          changesByCommit.set(change.summary.commit, []);
         changesByCommit.get(change.summary.commit).push(change);
       }
     }
@@ -366,13 +492,16 @@ export function getDataRecordHistoryIndex(input, options = {}) {
     try {
       sources = getFilesAtRevisions(
         root,
-        sourceChanges.map(({ summary, path }) => ({ revision: summary.commit, relativePath: path })),
+        sourceChanges.map(({ summary, path }) => ({
+          revision: summary.commit,
+          relativePath: path,
+        })),
         {
           batchSize: 512,
           maxRequests: DATA_HISTORY_MAX_SOURCE_REQUESTS,
           maxTotalBytes: DATA_HISTORY_MAX_SOURCE_BYTES,
-          deadline
-        }
+          deadline,
+        },
       );
     } catch (cause) {
       rethrowGitDeadline(cause);
@@ -395,13 +524,21 @@ export function getDataRecordHistoryIndex(input, options = {}) {
   for (const [commit, commitChanges] of changesByCommit) {
     const fileChanges = new Map();
     for (const change of commitChanges) {
-      if (change.beforePath?.match(/\.(?:json|md)$/) && change.beforePath !== change.afterPath) {
-        if (change.beforePath.endsWith(".json")) historicalRecordPaths.add(change.beforePath);
+      if (
+        change.beforePath?.match(/\.(?:json|md)$/) &&
+        change.beforePath !== change.afterPath
+      ) {
+        if (change.beforePath.endsWith(".json"))
+          historicalRecordPaths.add(change.beforePath);
         fileChanges.set(change.beforePath, null);
       }
       if (change.afterPath?.match(/\.(?:json|md)$/)) {
-        if (change.afterPath.endsWith(".json")) historicalRecordPaths.add(change.afterPath);
-        fileChanges.set(change.afterPath, sourceByCommitAndPath.get(`${commit}\0${change.afterPath}`) ?? null);
+        if (change.afterPath.endsWith(".json"))
+          historicalRecordPaths.add(change.afterPath);
+        fileChanges.set(
+          change.afterPath,
+          sourceByCommitAndPath.get(`${commit}\0${change.afterPath}`) ?? null,
+        );
       }
     }
     fileChangesByCommit.set(commit, fileChanges);
@@ -409,13 +546,25 @@ export function getDataRecordHistoryIndex(input, options = {}) {
   for (let index = 0; index < changes.length; index += 1) {
     const { summary, path } = changes[index];
     try {
-      const record = JSON.parse(sourceByCommitAndPath.get(`${summary.commit}\0${path}`));
-      if (!record || Array.isArray(record) || typeof record.id !== "string" || typeof record.type !== "string") {
-        throw new Error("Historical data records require string IDs and types.");
+      const record = JSON.parse(
+        sourceByCommitAndPath.get(`${summary.commit}\0${path}`),
+      );
+      if (
+        !record ||
+        Array.isArray(record) ||
+        typeof record.id !== "string" ||
+        typeof record.type !== "string"
+      ) {
+        throw new Error(
+          "Historical data records require string IDs and types.",
+        );
       }
-      if (!recordsByCommit.has(summary.commit)) recordsByCommit.set(summary.commit, new Map());
+      if (!recordsByCommit.has(summary.commit))
+        recordsByCommit.set(summary.commit, new Map());
       if (recordsByCommit.get(summary.commit).has(record.id)) {
-        throw new Error(`Historical data records reuse ID "${record.id}" in one commit.`);
+        throw new Error(
+          `Historical data records reuse ID "${record.id}" in one commit.`,
+        );
       }
       recordsByCommit.get(summary.commit).set(record.id, { record, path });
       if (!historiesById.has(record.id)) historiesById.set(record.id, []);
@@ -423,7 +572,10 @@ export function getDataRecordHistoryIndex(input, options = {}) {
     } catch (cause) {
       rethrowGitDeadline(cause);
       available = false;
-      error = new Error(`Git history contains an unreadable data record at ${summary.commit.slice(0, 12)}:${path}.`, { cause });
+      error = new Error(
+        `Git history contains an unreadable data record at ${summary.commit.slice(0, 12)}:${path}.`,
+        { cause },
+      );
       break;
     }
   }
@@ -432,15 +584,25 @@ export function getDataRecordHistoryIndex(input, options = {}) {
     try {
       for (const line of lines(historyGit(["rev-list", "--parents", head]))) {
         const [commit, ...parents] = line.split(" ");
-        if (!/^[a-f0-9]{40}$/i.test(commit) || parents.some((parent) => !/^[a-f0-9]{40}$/i.test(parent))) {
+        if (
+          !/^[a-f0-9]{40}$/i.test(commit) ||
+          parents.some((parent) => !/^[a-f0-9]{40}$/i.test(parent))
+        ) {
           throw new Error("Git returned invalid commit ancestry.");
         }
         parentsByCommit.set(commit, parents);
         if (parentsByCommit.size > DATA_HISTORY_MAX_ANCESTRY_COMMITS) {
-          throw dataHistoryLimitError("Git ancestry is too large to reconcile safely.");
+          throw dataHistoryLimitError(
+            "Git ancestry is too large to reconcile safely.",
+          );
         }
       }
-      if (!parentsByCommit.has(head) || [...changesByCommit.keys()].some((commit) => !parentsByCommit.has(commit))) {
+      if (
+        !parentsByCommit.has(head) ||
+        [...changesByCommit.keys()].some(
+          (commit) => !parentsByCommit.has(commit),
+        )
+      ) {
         throw new Error("Git returned incomplete commit ancestry.");
       }
     } catch (cause) {
@@ -452,12 +614,15 @@ export function getDataRecordHistoryIndex(input, options = {}) {
   for (const [id, history] of historiesById) {
     history.reverse();
     const seen = new Set();
-    historiesById.set(id, history.filter(({ commit, path }) => {
-      const key = `${commit}\u0000${path}`;
-      if (seen.has(key)) return false;
-      seen.add(key);
-      return true;
-    }));
+    historiesById.set(
+      id,
+      history.filter(({ commit, path }) => {
+        const key = `${commit}\u0000${path}`;
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      }),
+    );
   }
   const result = {
     head,
@@ -471,17 +636,32 @@ export function getDataRecordHistoryIndex(input, options = {}) {
     recordsByCommit: available ? recordsByCommit : new Map(),
     historiesById: available ? historiesById : new Map(),
     sourceBytes: available
-      ? sources.reduce((total, source) => total + (typeof source === "string" ? Buffer.byteLength(source, "utf8") : 0), 0)
+      ? sources.reduce(
+          (total, source) =>
+            total +
+            (typeof source === "string"
+              ? Buffer.byteLength(source, "utf8")
+              : 0),
+          0,
+        )
       : 0,
     ancestryCache: new Map(),
-    indexedFileCache: new Map()
+    indexedFileCache: new Map(),
   };
-  result.failureExpiresAt = available ? null : performance.now() + DATA_HISTORY_FAILURE_CACHE_MS;
+  result.failureExpiresAt = available
+    ? null
+    : performance.now() + DATA_HISTORY_FAILURE_CACHE_MS;
   result.estimatedBytes = available
-    ? result.sourceBytes * 3
-      + [...result.changesByCommit.values()].reduce((total, commitChanges) => total + commitChanges.length * 512, 0)
-      + result.parentsByCommit.size * 256
-      + [...result.historiesById.values()].reduce((total, history) => total + history.length * 128, 0)
+    ? result.sourceBytes * 3 +
+      [...result.changesByCommit.values()].reduce(
+        (total, commitChanges) => total + commitChanges.length * 512,
+        0,
+      ) +
+      result.parentsByCommit.size * 256 +
+      [...result.historiesById.values()].reduce(
+        (total, history) => total + history.length * 128,
+        0,
+      )
     : 512 + Buffer.byteLength(error?.message || "", "utf8");
   result.cacheBytes = result.estimatedBytes;
   if (result.estimatedBytes <= DATA_HISTORY_CACHE_MAX_BYTES) {
@@ -489,7 +669,10 @@ export function getDataRecordHistoryIndex(input, options = {}) {
     dataRecordHistoryIndexCacheBytes += result.cacheBytes;
   }
   if (dataRecordHistoryIndexCache.has(root)) {
-    while (dataRecordHistoryIndexCache.size > 4 || dataRecordHistoryIndexCacheBytes > DATA_HISTORY_CACHE_MAX_BYTES) {
+    while (
+      dataRecordHistoryIndexCache.size > 4 ||
+      dataRecordHistoryIndexCacheBytes > DATA_HISTORY_CACHE_MAX_BYTES
+    ) {
       const oldestRoot = dataRecordHistoryIndexCache.keys().next().value;
       const oldest = dataRecordHistoryIndexCache.get(oldestRoot);
       dataRecordHistoryIndexCache.delete(oldestRoot);
@@ -510,15 +693,27 @@ function parseDataRecordHistory(output) {
     while (fields[index] === "") index += 1;
     const commit = fields[index++];
     if (commit === undefined) break;
-    if (!/^[a-f0-9]{40}$/i.test(commit)) throw new Error("Git returned an invalid data-history commit.");
+    if (!/^[a-f0-9]{40}$/i.test(commit))
+      throw new Error("Git returned an invalid data-history commit.");
     const timestamp = fields[index++];
     const author = fields[index++];
     const subject = fields[index++];
-    if (timestamp === undefined || author === undefined || subject === undefined) {
+    if (
+      timestamp === undefined ||
+      author === undefined ||
+      subject === undefined
+    ) {
       throw new Error("Git returned an incomplete data-history header.");
     }
-    const summary = { commit, shortCommit: commit.slice(0, 8), timestamp, author, subject };
-    if (commits.has(commit)) throw new Error("Git returned duplicate data-history commit output.");
+    const summary = {
+      commit,
+      shortCommit: commit.slice(0, 8),
+      timestamp,
+      author,
+      subject,
+    };
+    if (commits.has(commit))
+      throw new Error("Git returned duplicate data-history commit output.");
     commits.add(commit);
     while (index < fields.length) {
       while (fields[index] === "") index += 1;
@@ -532,11 +727,13 @@ function parseDataRecordHistory(output) {
       const first = fields[index++];
       const renamed = status.startsWith("R") || status.startsWith("C");
       const second = renamed ? fields[index++] : null;
-      if (!first || (renamed && !second)) throw new Error("Git returned an incomplete data-history path.");
+      if (!first || (renamed && !second))
+        throw new Error("Git returned an incomplete data-history path.");
       const beforePath = status === "A" ? null : first;
       const afterPath = status === "D" ? null : renamed ? second : first;
       for (const path of [beforePath, afterPath].filter(Boolean)) {
-        if (!isSafeDataGitPath(path)) throw new Error("Git returned an unsafe data-history path.");
+        if (!isSafeDataGitPath(path))
+          throw new Error("Git returned an unsafe data-history path.");
       }
       const change = { summary, status, beforePath, afterPath };
       changes.push(change);
@@ -566,10 +763,11 @@ function limitedHistory(history, limit) {
 
 function indexedDataFile(index, revision, relativePath) {
   if (
-    !index?.available
-    || !relativePath?.match(/\.(?:json|md)$/)
-    || !index.parentsByCommit.has(revision)
-  ) return undefined;
+    !index?.available ||
+    !relativePath?.match(/\.(?:json|md)$/) ||
+    !index.parentsByCommit.has(revision)
+  )
+    return undefined;
   const key = `${revision}\0${relativePath}`;
   if (index.indexedFileCache.has(key)) return index.indexedFileCache.get(key);
   let commit = revision;
@@ -583,7 +781,8 @@ function indexedDataFile(index, revision, relativePath) {
     commit = index.parentsByCommit.get(commit)?.[0] || null;
   }
   index.indexedFileCache.set(key, source);
-  while (index.indexedFileCache.size > 20_000) index.indexedFileCache.delete(index.indexedFileCache.keys().next().value);
+  while (index.indexedFileCache.size > 20_000)
+    index.indexedFileCache.delete(index.indexedFileCache.keys().next().value);
   return source;
 }
 
@@ -605,20 +804,29 @@ function indexedAncestor(index, ancestor, descendant) {
     pending.push(...(index.parentsByCommit.get(commit) || []));
   }
   index.ancestryCache.set(key, result);
-  while (index.ancestryCache.size > 20_000) index.ancestryCache.delete(index.ancestryCache.keys().next().value);
+  while (index.ancestryCache.size > 20_000)
+    index.ancestryCache.delete(index.ancestryCache.keys().next().value);
   return result;
 }
 
 export function isGitAncestor(input, ancestor, descendant) {
-  if (!/^[a-f0-9]{40}$/i.test(String(ancestor)) || !/^[a-f0-9]{40}$/i.test(String(descendant))) return false;
+  if (
+    !/^[a-f0-9]{40}$/i.test(String(ancestor)) ||
+    !/^[a-f0-9]{40}$/i.test(String(descendant))
+  )
+    return false;
   const root = resolveWorkspaceRoot(input);
   try {
-    observedExecFileSync("git", ["merge-base", "--is-ancestor", ancestor, descendant], {
-      cwd: root,
-      stdio: "ignore",
-      timeout: 10_000,
-      env: gitEnvironment()
-    });
+    executeGitSync(
+      root,
+      ["merge-base", "--is-ancestor", ancestor, descendant],
+      {
+        cwd: root,
+        stdio: "ignore",
+        timeout: 10_000,
+        env: gitEnvironment(),
+      },
+    );
     return true;
   } catch (error) {
     rethrowGitDeadline(error);
@@ -641,19 +849,26 @@ export function isDataHistoryAncestor(input, ancestor, descendant) {
 }
 
 export function getFileBufferAtRevision(input, revision, relativePath) {
-  if (!/^[a-f0-9]{40}$/i.test(String(revision)) || !isSafeDataGitPath(relativePath)) return null;
+  if (
+    !/^[a-f0-9]{40}$/i.test(String(revision)) ||
+    !isSafeDataGitPath(relativePath)
+  )
+    return null;
   const root = resolveWorkspaceRoot(input);
   try {
     const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
     const workspacePrefix = relative(topLevel, root).split(sep).join("/");
-    if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) return null;
-    const repositoryPath = workspacePrefix ? `${workspacePrefix}/${relativePath}` : relativePath;
-    return observedExecFileSync("git", ["show", `${revision}:${repositoryPath}`], {
+    if (workspacePrefix === ".." || workspacePrefix.startsWith("../"))
+      return null;
+    const repositoryPath = workspacePrefix
+      ? `${workspacePrefix}/${relativePath}`
+      : relativePath;
+    return executeGitSync(root, ["show", `${revision}:${repositoryPath}`], {
       cwd: root,
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 10_000,
       maxBuffer: 20_000_000,
-      env: gitEnvironment()
+      env: gitEnvironment(),
     });
   } catch (error) {
     rethrowGitDeadline(error);
@@ -662,13 +877,20 @@ export function getFileBufferAtRevision(input, revision, relativePath) {
 }
 
 export function getFileObjectIdAtRevision(input, revision, relativePath) {
-  if (!/^[a-f0-9]{40}$/i.test(String(revision)) || !isSafeDataGitPath(relativePath)) return null;
+  if (
+    !/^[a-f0-9]{40}$/i.test(String(revision)) ||
+    !isSafeDataGitPath(relativePath)
+  )
+    return null;
   const root = resolveWorkspaceRoot(input);
   try {
     const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
     const workspacePrefix = relative(topLevel, root).split(sep).join("/");
-    if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) return null;
-    const repositoryPath = workspacePrefix ? `${workspacePrefix}/${relativePath}` : relativePath;
+    if (workspacePrefix === ".." || workspacePrefix.startsWith("../"))
+      return null;
+    const repositoryPath = workspacePrefix
+      ? `${workspacePrefix}/${relativePath}`
+      : relativePath;
     const objectId = git(root, ["rev-parse", `${revision}:${repositoryPath}`]);
     return /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/i.test(objectId) ? objectId : null;
   } catch (error) {
@@ -680,16 +902,70 @@ export function getFileObjectIdAtRevision(input, revision, relativePath) {
 export function getWorkingFileObjectId(input, relativePath) {
   if (!isSafeDataGitPath(relativePath)) return null;
   const root = resolveWorkspaceRoot(input);
+  let descriptor;
   try {
-    const objectId = git(root, ["hash-object", "--no-filters", "--", relativePath]);
-    return /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/i.test(objectId) ? objectId : null;
+    const objectFormat = repositoryObjectFormat(root);
+    if (!objectFormat) return null;
+    descriptor = openSync(
+      resolve(root, relativePath),
+      constants.O_RDONLY | (constants.O_NOFOLLOW || 0),
+    );
+    const before = fstatSync(descriptor);
+    if (!before.isFile()) return null;
+    const hash = createHash(objectFormat).update(`blob ${before.size}\0`);
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let position = 0;
+    while (position < before.size) {
+      const count = readSync(
+        descriptor,
+        buffer,
+        0,
+        Math.min(buffer.length, before.size - position),
+        position,
+      );
+      if (!count) return null;
+      hash.update(buffer.subarray(0, count));
+      position += count;
+    }
+    const after = fstatSync(descriptor);
+    if (
+      after.size !== before.size ||
+      after.dev !== before.dev ||
+      after.ino !== before.ino ||
+      after.mtimeMs !== before.mtimeMs ||
+      after.ctimeMs !== before.ctimeMs
+    )
+      return null;
+    return hash.digest("hex");
   } catch (error) {
     rethrowGitDeadline(error);
     return null;
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
   }
 }
 
-export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12, options = {}) {
+function repositoryObjectFormat(root) {
+  if (repositoryObjectFormats.has(root))
+    return repositoryObjectFormats.get(root);
+  if (!tryGit(root, ["rev-parse", "--git-dir"])) return null;
+  const objectFormat =
+    tryGit(root, ["config", "--get", "extensions.objectFormat"]) || "sha1";
+  if (!["sha1", "sha256"].includes(objectFormat)) {
+    throw new Error(
+      `FileGRC does not support the repository object format "${objectFormat}".`,
+    );
+  }
+  repositoryObjectFormats.set(root, objectFormat);
+  return objectFormat;
+}
+
+export function getWorkspaceHistories(
+  input,
+  relativePaths,
+  limitPerFile = 12,
+  options = {},
+) {
   const root = resolveWorkspaceRoot(input);
   const wanted = new Set(relativePaths);
   const histories = new Map([...wanted].map((path) => [path, []]));
@@ -698,16 +974,22 @@ export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12, o
     if (options.deadlineAt === undefined) return undefined;
     const remaining = Math.ceil(options.deadlineAt - performance.now());
     if (remaining > 0) return remaining;
-    const error = new Error("The Git history deadline expired before another subprocess could start.");
+    const error = new Error(
+      "The Git history deadline expired before another subprocess could start.",
+    );
     error.code = "FILEGRC_GIT_DEADLINE";
     throw error;
   };
-  const withinDeadline = (task) => options.deadlineAt === undefined
-    ? task()
-    : withGitCommandDeadline(options.deadlineAt, task);
+  const withinDeadline = (task) =>
+    options.deadlineAt === undefined
+      ? task()
+      : withGitCommandDeadline(options.deadlineAt, task);
   let head = null;
   try {
-    head = withinDeadline(() => git(root, ["rev-parse", "HEAD"], { timeoutMs: remainingTime() })) || null;
+    head =
+      withinDeadline(() =>
+        git(root, ["rev-parse", "HEAD"], { timeoutMs: remainingTime() }),
+      ) || null;
   } catch (error) {
     if (error?.code === "FILEGRC_GIT_DEADLINE") throw error;
     head = null;
@@ -717,15 +999,29 @@ export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12, o
     if (options.strict === true && cached.available === false) {
       throw gitHistoryUnavailableError();
     }
-    for (const path of wanted) histories.set(path, cached.histories.get(path) ?? []);
+    for (const path of wanted)
+      histories.set(path, cached.histories.get(path) ?? []);
     return histories;
   }
   const allHistories = new Map();
   let available = true;
   try {
-    const output = withinDeadline(() => git(root, ["log", "--relative", "--format=%x1e%H%x1f%aI%x1f%an%x1f%s", "--name-only", "--", "data"], {
-      timeoutMs: remainingTime()
-    }));
+    const output = withinDeadline(() =>
+      git(
+        root,
+        [
+          "log",
+          "--relative",
+          "--format=%x1e%H%x1f%aI%x1f%an%x1f%s",
+          "--name-only",
+          "--",
+          "data",
+        ],
+        {
+          timeoutMs: remainingTime(),
+        },
+      ),
+    );
     for (const block of output.split("\x1e")) {
       const lines = block.trim().split("\n").filter(Boolean);
       if (lines.length < 2) continue;
@@ -744,13 +1040,22 @@ export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12, o
     }
     // Browser and workflow views tolerate an uncommitted workspace with no history yet.
   }
-  if (available) workspaceHistoryCache.set(root, { head, limitPerFile, histories: allHistories, available });
+  if (available)
+    workspaceHistoryCache.set(root, {
+      head,
+      limitPerFile,
+      histories: allHistories,
+      available,
+    });
   for (const path of wanted) histories.set(path, allHistories.get(path) ?? []);
   return histories;
 }
 
 function gitHistoryUnavailableError(cause) {
-  const error = new Error("Git history is unavailable for the requested workspace files.", { cause });
+  const error = new Error(
+    "Git history is unavailable for the requested workspace files.",
+    { cause },
+  );
   error.code = "FILEGRC_GIT_HISTORY_UNAVAILABLE";
   return error;
 }
@@ -758,7 +1063,11 @@ function gitHistoryUnavailableError(cause) {
 export function getFileAtRevision(input, revision, relativePath) {
   const root = resolveWorkspaceRoot(input);
   historicalRevisionReadObserver?.({ root, revision, relativePath });
-  const indexed = indexedDataFile(dataRecordHistoryIndexCache.get(root), revision, relativePath);
+  const indexed = indexedDataFile(
+    dataRecordHistoryIndexCache.get(root),
+    revision,
+    relativePath,
+  );
   return indexed === undefined
     ? getFilesAtRevisions(root, [{ revision, relativePath }])[0]
     : indexed;
@@ -767,30 +1076,47 @@ export function getFileAtRevision(input, revision, relativePath) {
 export function getFilesAtRevisions(input, requests, options = {}) {
   const root = resolveWorkspaceRoot(input);
   const hasDeadline = options.deadline !== undefined;
-  const deadline = hasDeadline ? Number(options.deadline) : performance.now() + DATA_HISTORY_BUILD_TIMEOUT_MS;
+  const deadline = hasDeadline
+    ? Number(options.deadline)
+    : performance.now() + DATA_HISTORY_BUILD_TIMEOUT_MS;
   if (!Number.isFinite(deadline) || deadline <= performance.now()) {
-    const error = new Error("Git historical file export exceeded its cumulative deadline.");
+    const error = new Error(
+      "Git historical file export exceeded its cumulative deadline.",
+    );
     error.code = "FILEGRC_HISTORY_DEADLINE";
     throw error;
   }
   const remainingTime = () => {
     const remainingMs = Math.floor(deadline - performance.now());
     if (remainingMs <= 0) {
-      const error = new Error("Git historical file export exceeded its cumulative deadline.");
+      const error = new Error(
+        "Git historical file export exceeded its cumulative deadline.",
+      );
       error.code = "FILEGRC_HISTORY_DEADLINE";
       throw error;
     }
     return remainingMs;
   };
-  const invalid = Array.isArray(requests) && requests.find(({ revision, relativePath } = {}) => (
-    !/^[a-f0-9]{40}$/i.test(String(revision)) || !isSafeDataGitPath(relativePath)
-  ));
+  const invalid =
+    Array.isArray(requests) &&
+    requests.find(
+      ({ revision, relativePath } = {}) =>
+        !/^[a-f0-9]{40}$/i.test(String(revision)) ||
+        !isSafeDataGitPath(relativePath),
+    );
   if (!Array.isArray(requests) || invalid) {
-    throw new Error("Historical file exports require a Git commit and a data/ path.");
+    throw new Error(
+      "Historical file exports require a Git commit and a data/ path.",
+    );
   }
-  const maxRequests = Number(options.maxRequests) > 0 ? Math.floor(Number(options.maxRequests)) : null;
+  const maxRequests =
+    Number(options.maxRequests) > 0
+      ? Math.floor(Number(options.maxRequests))
+      : null;
   if (maxRequests && requests.length > maxRequests) {
-    const error = new Error(`Git historical file exports exceed the ${maxRequests}-request safety limit.`);
+    const error = new Error(
+      `Git historical file exports exceed the ${maxRequests}-request safety limit.`,
+    );
     error.code = "FILEGRC_HISTORY_EXPORT_LIMIT";
     throw error;
   }
@@ -807,54 +1133,84 @@ export function getFilesAtRevisions(input, requests, options = {}) {
       missing.push({ ...request, index, key });
     }
   });
-  const maxTotalBytes = Number(options.maxTotalBytes) > 0 ? Number(options.maxTotalBytes) : null;
+  const maxTotalBytes =
+    Number(options.maxTotalBytes) > 0 ? Number(options.maxTotalBytes) : null;
   const cachedBytes = maxTotalBytes
-    ? results.reduce((total, value) => total + (typeof value === "string" ? Buffer.byteLength(value, "utf8") : 0), 0)
+    ? results.reduce(
+        (total, value) =>
+          total +
+          (typeof value === "string" ? Buffer.byteLength(value, "utf8") : 0),
+        0,
+      )
     : 0;
-  if (maxTotalBytes && cachedBytes > maxTotalBytes) throw historicalExportLimitError(maxTotalBytes);
+  if (maxTotalBytes && cachedBytes > maxTotalBytes)
+    throw historicalExportLimitError(maxTotalBytes);
   if (!missing.length) return results;
   try {
-    const topLevel = git(root, ["rev-parse", "--show-toplevel"], { timeoutMs: remainingTime() });
+    const topLevel = git(root, ["rev-parse", "--show-toplevel"], {
+      timeoutMs: remainingTime(),
+    });
     const workspacePrefix = relative(topLevel, root).split(sep).join("/");
-    if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) return requests.map(() => null);
+    if (workspacePrefix === ".." || workspacePrefix.startsWith("../"))
+      return requests.map(() => null);
     const missingSpecifications = missing.map(({ revision, relativePath }) => {
-      const repositoryPath = workspacePrefix ? `${workspacePrefix}/${relativePath}` : relativePath;
+      const repositoryPath = workspacePrefix
+        ? `${workspacePrefix}/${relativePath}`
+        : relativePath;
       return `${revision}:${repositoryPath}`;
     });
     if (maxTotalBytes) {
-      assertHistoricalExportSize(root, missingSpecifications, maxTotalBytes - cachedBytes, maxTotalBytes, remainingTime());
+      assertHistoricalExportSize(
+        root,
+        missingSpecifications,
+        maxTotalBytes - cachedBytes,
+        maxTotalBytes,
+        remainingTime(),
+      );
     }
-    const batchSize = Math.max(1, Math.min(Number(options.batchSize) || 4, 512));
+    const batchSize = Math.max(
+      1,
+      Math.min(Number(options.batchSize) || 4, 512),
+    );
     for (let offset = 0; offset < missing.length; offset += batchSize) {
       const batch = missing.slice(offset, offset + batchSize);
-      const specifications = missingSpecifications.slice(offset, offset + batchSize);
+      const specifications = missingSpecifications.slice(
+        offset,
+        offset + batchSize,
+      );
       let values;
       try {
         const run = () => {
           const remainingMs = remainingTime();
-          return observedExecFileSync("git", ["cat-file", "--batch"], {
+          return executeGitSync(root, ["cat-file", "--batch"], {
             cwd: root,
             input: `${specifications.join("\n")}\n`,
             stdio: ["pipe", "pipe", "ignore"],
             timeout: remainingMs,
             maxBuffer: 80_000_000,
-            env: gitEnvironment()
+            env: gitEnvironment(),
           });
         };
-        const output = measureTimingSync("git-history-export", () => (
-          historicalBatchInterceptor ? historicalBatchInterceptor({ root, specifications, run }) : run()
-        ));
+        const output = measureTimingSync("git-history-export", () =>
+          historicalBatchInterceptor
+            ? historicalBatchInterceptor({ root, specifications, run })
+            : run(),
+        );
         values = parseBatchObjects(output, batch.length);
       } catch (cause) {
         rethrowGitDeadline(cause);
-        const error = new Error("Git could not read the historical file batch safely.", { cause });
+        const error = new Error(
+          "Git could not read the historical file batch safely.",
+          { cause },
+        );
         error.code = "FILEGRC_HISTORY_BATCH_FAILED";
         throw error;
       }
       batch.forEach(({ index, key }, batchIndex) => {
         const value = values[batchIndex];
         results[index] = value;
-        if (value !== null && Buffer.byteLength(value, "utf8") <= 65_536) historicalFileCache.set(key, value);
+        if (value !== null && Buffer.byteLength(value, "utf8") <= 65_536)
+          historicalFileCache.set(key, value);
       });
       while (historicalFileCache.size > 2_048) {
         historicalFileCache.delete(historicalFileCache.keys().next().value);
@@ -862,7 +1218,15 @@ export function getFilesAtRevisions(input, requests, options = {}) {
     }
     return results;
   } catch (error) {
-    if (["FILEGRC_HISTORY_EXPORT_LIMIT", "FILEGRC_HISTORY_BATCH_FAILED", "FILEGRC_HISTORY_DEADLINE", "FILEGRC_GIT_DEADLINE"].includes(error?.code)) throw error;
+    if (
+      [
+        "FILEGRC_HISTORY_EXPORT_LIMIT",
+        "FILEGRC_HISTORY_BATCH_FAILED",
+        "FILEGRC_HISTORY_DEADLINE",
+        "FILEGRC_GIT_DEADLINE",
+      ].includes(error?.code)
+    )
+      throw error;
     return results.map((value) => value ?? null);
   }
 }
@@ -875,35 +1239,49 @@ export function setHistoricalBatchInterceptorForTests(interceptor) {
   };
 }
 
-function assertHistoricalExportSize(root, specifications, remainingBytes, maxTotalBytes, timeoutMs = GIT_DEFAULT_TIMEOUT_MS) {
-  const output = measureTimingSync("git-history-size", () => observedExecFileSync("git", [
-    "cat-file",
-    "--batch-check=%(objectname) %(objecttype) %(objectsize)"
-  ], {
-    cwd: root,
-    input: `${specifications.join("\n")}\n`,
-    encoding: "utf8",
-    stdio: ["pipe", "pipe", "ignore"],
-    timeout: timeoutMs,
-    maxBuffer: 20_000_000,
-    env: gitEnvironment()
-  }));
+function assertHistoricalExportSize(
+  root,
+  specifications,
+  remainingBytes,
+  maxTotalBytes,
+  timeoutMs = GIT_DEFAULT_TIMEOUT_MS,
+) {
+  const output = measureTimingSync("git-history-size", () =>
+    executeGitSync(
+      root,
+      ["cat-file", "--batch-check=%(objectname) %(objecttype) %(objectsize)"],
+      {
+        cwd: root,
+        input: `${specifications.join("\n")}\n`,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "ignore"],
+        timeout: timeoutMs,
+        maxBuffer: 20_000_000,
+        env: gitEnvironment(),
+      },
+    ),
+  );
   let total = 0;
   for (const line of output.trim().split("\n")) {
     if (!line || line.endsWith(" missing")) continue;
     const match = line.match(/^[a-f0-9]+ blob (\d+)$/i);
-    if (!match) throw new Error("Git returned invalid historical object metadata.");
+    if (!match)
+      throw new Error("Git returned invalid historical object metadata.");
     total += Number(match[1]);
-    if (!Number.isSafeInteger(total) || total > remainingBytes) throw historicalExportLimitError(maxTotalBytes);
+    if (!Number.isSafeInteger(total) || total > remainingBytes)
+      throw historicalExportLimitError(maxTotalBytes);
   }
 }
 
 function historicalExportLimitError(maxTotalBytes) {
   const megabytes = maxTotalBytes / (1024 * 1024);
-  const limit = Number.isInteger(megabytes) && megabytes >= 1
-    ? `${megabytes} MB`
-    : `${maxTotalBytes} byte`;
-  const error = new Error(`Git historical file exports exceed the ${limit} safety limit.`);
+  const limit =
+    Number.isInteger(megabytes) && megabytes >= 1
+      ? `${megabytes} MB`
+      : `${maxTotalBytes} byte`;
+  const error = new Error(
+    `Git historical file exports exceed the ${limit} safety limit.`,
+  );
   error.code = "FILEGRC_HISTORY_EXPORT_LIMIT";
   return error;
 }
@@ -927,7 +1305,9 @@ export function getDataFilesAtRevision(input, revision) {
     }
     const files = new Set();
     for (let position = lineage.length - 1; position >= 0; position -= 1) {
-      for (const [path, source] of index.fileChangesByCommit.get(lineage[position]) || []) {
+      for (const [path, source] of index.fileChangesByCommit.get(
+        lineage[position],
+      ) || []) {
         if (source === null) files.delete(path);
         else files.add(path);
       }
@@ -937,11 +1317,18 @@ export function getDataFilesAtRevision(input, revision) {
   try {
     const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
     const workspacePrefix = relative(topLevel, root).split(sep).join("/");
-    if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) return [];
+    if (workspacePrefix === ".." || workspacePrefix.startsWith("../"))
+      return [];
     const dataPrefix = workspacePrefix ? `${workspacePrefix}/data` : "data";
-    return lines(git(root, ["ls-tree", "-r", "--name-only", revision, "--", dataPrefix]))
-      .filter((path) => path.startsWith(`${dataPrefix}/`) && path.endsWith(".json"))
-      .map((path) => workspacePrefix ? path.slice(workspacePrefix.length + 1) : path);
+    return lines(
+      git(root, ["ls-tree", "-r", "--name-only", revision, "--", dataPrefix]),
+    )
+      .filter(
+        (path) => path.startsWith(`${dataPrefix}/`) && path.endsWith(".json"),
+      )
+      .map((path) =>
+        workspacePrefix ? path.slice(workspacePrefix.length + 1) : path,
+      );
   } catch (error) {
     rethrowGitDeadline(error);
     return [];
@@ -950,14 +1337,16 @@ export function getDataFilesAtRevision(input, revision) {
 
 function readHistoricalFile(root, specification) {
   try {
-    return measureTimingSync("git-history-export", () => observedExecFileSync("git", ["show", specification], {
-      cwd: root,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 10_000,
-      maxBuffer: 20_000_000,
-      env: gitEnvironment()
-    }));
+    return measureTimingSync("git-history-export", () =>
+      executeGitSync(root, ["show", specification], {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 10_000,
+        maxBuffer: 20_000_000,
+        env: gitEnvironment(),
+      }),
+    );
   } catch (error) {
     rethrowGitDeadline(error);
     return null;
@@ -969,7 +1358,8 @@ function parseBatchObjects(output, expected) {
   let offset = 0;
   for (let index = 0; index < expected; index += 1) {
     const headerEnd = output.indexOf(10, offset);
-    if (headerEnd < 0) throw new Error("Git returned an incomplete historical object header.");
+    if (headerEnd < 0)
+      throw new Error("Git returned an incomplete historical object header.");
     const header = output.subarray(offset, headerEnd).toString("utf8");
     offset = headerEnd + 1;
     if (header.endsWith(" missing")) {
@@ -977,31 +1367,57 @@ function parseBatchObjects(output, expected) {
       continue;
     }
     const size = Number(header.split(" ").at(-1));
-    if (!Number.isSafeInteger(size) || size < 0 || offset + size >= output.length) {
+    if (
+      !Number.isSafeInteger(size) ||
+      size < 0 ||
+      offset + size >= output.length
+    ) {
       throw new Error("Git returned an invalid historical object size.");
     }
     results.push(output.subarray(offset, offset + size).toString("utf8"));
     offset += size;
-    if (output[offset++] !== 10) throw new Error("Git returned an incomplete historical object.");
+    if (output[offset++] !== 10)
+      throw new Error("Git returned an incomplete historical object.");
   }
   return results;
 }
 
 function isSafeDataGitPath(value) {
-  return isCanonicalDataPath(value)
-    && !/[\r\n]/.test(value)
-    && value.startsWith("data/")
-    && value !== "data/";
+  return (
+    isCanonicalDataPath(value) &&
+    !/[\r\n]/.test(value) &&
+    value.startsWith("data/") &&
+    value !== "data/"
+  );
 }
 
 export function getChangedDataPathsSinceRevision(input, revision) {
   if (!/^[a-f0-9]{40}$/i.test(String(revision))) return null;
   const root = resolveWorkspaceRoot(input);
   try {
-    return [...new Set([
-      ...lines(git(root, ["diff", "--name-only", "--relative", revision, "--", "data"])),
-      ...lines(git(root, ["ls-files", "--others", "--exclude-standard", "--", "data"]))
-    ])].filter((path) => path.startsWith("data/"));
+    return [
+      ...new Set([
+        ...lines(
+          git(root, [
+            "diff",
+            "--name-only",
+            "--relative",
+            revision,
+            "--",
+            "data",
+          ]),
+        ),
+        ...lines(
+          git(root, [
+            "ls-files",
+            "--others",
+            "--exclude-standard",
+            "--",
+            "data",
+          ]),
+        ),
+      ]),
+    ].filter((path) => path.startsWith("data/"));
   } catch (error) {
     rethrowGitDeadline(error);
     return null;
@@ -1023,11 +1439,15 @@ export function hasGitRevision(input, revision) {
 }
 
 export async function commitWorkspace(input, message) {
-  return serializeWorkspaceMutation(input, (root) => commitWorkspaceUnlocked(root, message));
+  return serializeWorkspaceMutation(input, (root) =>
+    commitWorkspaceUnlocked(root, message),
+  );
 }
 
 export async function commitAndPushWorkspace(input, message) {
-  return serializeWorkspaceMutation(input, (root) => commitAndPushWorkspaceUnlocked(root, message));
+  return serializeWorkspaceMutation(input, (root) =>
+    commitAndPushWorkspaceUnlocked(root, message),
+  );
 }
 
 export async function pullWorkspace(input = process.cwd()) {
@@ -1045,13 +1465,17 @@ export function getRepositorySnapshot(input = process.cwd(), options = {}) {
     return repositorySnapshotPromises.get(root);
   }
   const snapshot = buildRepositorySnapshot(root).finally(() => {
-    if (repositorySnapshotPromises.get(root) === snapshot) repositorySnapshotPromises.delete(root);
+    if (repositorySnapshotPromises.get(root) === snapshot)
+      repositorySnapshotPromises.delete(root);
   });
   repositorySnapshotPromises.set(root, snapshot);
   return snapshot;
 }
 
-export async function getRepositoryStateSignature(input = process.cwd(), options = {}) {
+export async function getRepositoryStateSignature(
+  input = process.cwd(),
+  options = {},
+) {
   const root = resolveWorkspaceRoot(input);
   const timeout = { timeoutMs: options.timeoutMs };
   let status;
@@ -1060,25 +1484,26 @@ export async function getRepositoryStateSignature(input = process.cwd(), options
   let remotes;
   try {
     [status, gitDirectory, refs, remotes] = await Promise.all([
-      runGitCommand(root, [
-        "status",
-        "--porcelain=v2",
-        "--branch",
-        "-z",
-        "--untracked-files=all"
-      ], { ...timeout, operation: "verify repository state" }),
+      runGitCommand(
+        root,
+        ["status", "--porcelain=v2", "--branch", "-z", "--untracked-files=all"],
+        { ...timeout, operation: "verify repository state" },
+      ),
       runGitCommand(root, ["rev-parse", "--absolute-git-dir"], {
         ...timeout,
-        operation: "locate repository state"
+        operation: "locate repository state",
       }),
       runGitCommand(root, ["rev-parse", "--verify", "@{upstream}"], {
         ...timeout,
-        operation: "verify the upstream repository revision"
+        operation: "verify the upstream repository revision",
       }).catch((error) => {
         if (error?.code === "FILEGRC_GIT_DEADLINE") throw error;
         return "";
       }),
-      runGitCommand(root, ["remote", "-v"], { ...timeout, operation: "verify repository remotes" })
+      runGitCommand(root, ["remote", "-v"], {
+        ...timeout,
+        operation: "verify repository remotes",
+      }),
     ]);
   } catch (error) {
     if (error?.code === "FILEGRC_GIT_DEADLINE") throw error;
@@ -1088,14 +1513,16 @@ export async function getRepositoryStateSignature(input = process.cwd(), options
     remotes = "";
   }
   const background = backgroundSynchronizations.get(root);
-  const backgroundState = background ? {
-    status: background.status,
-    commit: background.commit,
-    startedAt: background.startedAt ?? null,
-    finishedAt: background.finishedAt ?? null,
-    remotePushed: background.remotePushed === true,
-    error: background.error ?? null
-  } : null;
+  const backgroundState = background
+    ? {
+        status: background.status,
+        commit: background.commit,
+        startedAt: background.startedAt ?? null,
+        finishedAt: background.finishedAt ?? null,
+        remotePushed: background.remotePushed === true,
+        error: background.error ?? null,
+      }
+    : null;
   return createHash("sha256")
     .update(status)
     .update("\0")
@@ -1115,15 +1542,21 @@ export async function getWorkspaceRevisionSnapshot(input = process.cwd()) {
   const root = resolveWorkspaceRoot(input);
   try {
     assertNoWorkspaceContentFilters(root);
-    const source = await measureTiming("repository-revision", () => runGitCommand(root, [
-      "status",
-      "--porcelain=v2",
-      "--branch",
-      "-z",
-      "--untracked-files=all",
-      "--",
-      "data"
-    ], { operation: "resolve the workspace revision" }));
+    const source = await measureTiming("repository-revision", () =>
+      runGitCommand(
+        root,
+        [
+          "status",
+          "--porcelain=v2",
+          "--branch",
+          "-z",
+          "--untracked-files=all",
+          "--",
+          "data",
+        ],
+        { operation: "resolve the workspace revision" },
+      ),
+    );
     const parsed = parseWorkspaceRevision(source);
     return {
       available: true,
@@ -1132,7 +1565,7 @@ export async function getWorkspaceRevisionSnapshot(input = process.cwd()) {
       branch: parsed.branch,
       clean: parsed.changePaths.length === 0,
       changes: parsed.changePaths,
-      workspaceChangePaths: parsed.changePaths
+      workspaceChangePaths: parsed.changePaths,
     };
   } catch (error) {
     if (error?.code === "FILEGRC_GIT_DEADLINE") throw error;
@@ -1143,11 +1576,13 @@ export async function getWorkspaceRevisionSnapshot(input = process.cwd()) {
 async function buildRepositorySnapshot(root) {
   let repositoryPaths;
   try {
-    repositoryPaths = await measureTiming("git-discovery", () => runGitCommand(
-      root,
-      ["rev-parse", "--show-toplevel", "--absolute-git-dir"],
-      { operation: "locate the repository" }
-    ));
+    repositoryPaths = await measureTiming("git-discovery", () =>
+      runGitCommand(
+        root,
+        ["rev-parse", "--show-toplevel", "--absolute-git-dir"],
+        { operation: "locate the repository" },
+      ),
+    );
   } catch (error) {
     if (error?.code === "FILEGRC_GIT_DEADLINE") throw error;
     return unavailableSnapshot(error);
@@ -1156,42 +1591,61 @@ async function buildRepositorySnapshot(root) {
   try {
     assertNoWorkspaceContentFilters(root);
     const [status, remotes] = await Promise.all([
-      runGitCommand(topLevel, ["status", "--porcelain=v2", "--branch", "-z", "--untracked-files=all"], {
-        operation: "inspect repository status"
-      }),
-      runGitCommand(root, ["remote"], { operation: "list repository remotes" })
+      runGitCommand(
+        topLevel,
+        ["status", "--porcelain=v2", "--branch", "-z", "--untracked-files=all"],
+        {
+          operation: "inspect repository status",
+        },
+      ),
+      runGitCommand(root, ["remote"], { operation: "list repository remotes" }),
     ]);
     const parsed = parsePorcelainV2(status, topLevel, root);
     const last = parsed.commit
-      ? parseLogLine(await runGitCommand(root, ["log", "-1", "--format=%H%x1f%aI%x1f%an%x1f%s"], {
-          operation: "read the latest commit"
-        }))
+      ? parseLogLine(
+          await runGitCommand(
+            root,
+            ["log", "-1", "--format=%H%x1f%aI%x1f%an%x1f%s"],
+            {
+              operation: "read the latest commit",
+            },
+          ),
+        )
       : null;
     let upstreamCommit = null;
     let pendingCommits = [];
     let pendingCommitsFilegrcOnly = parsed.ahead === 0 ? true : null;
     if (parsed.upstream) {
-      upstreamCommit = (await runGitCommand(root, ["rev-parse", parsed.upstream], {
-        operation: `resolve upstream ${parsed.upstream}`
-      })).trim() || null;
+      upstreamCommit =
+        (
+          await runGitCommand(root, ["rev-parse", parsed.upstream], {
+            operation: `resolve upstream ${parsed.upstream}`,
+          })
+        ).trim() || null;
     }
     if (parsed.ahead > 0 && parsed.upstream) {
-      const pending = await runGitCommand(root, [
-        "log",
-        "--format=%x1e%H%x1f%s",
-        "--name-only",
-        `${parsed.upstream}..HEAD`
-      ], { operation: `inspect commits ahead of ${parsed.upstream}` });
+      const pending = await runGitCommand(
+        root,
+        [
+          "log",
+          "--format=%x1e%H%x1f%s",
+          "--name-only",
+          `${parsed.upstream}..HEAD`,
+        ],
+        { operation: `inspect commits ahead of ${parsed.upstream}` },
+      );
       const prefix = relative(topLevel, root).split(sep).join("/");
       const commits = parsePendingCommitPaths(pending);
       pendingCommits = commits.map(({ commit, subject }) => ({
         commit,
         shortCommit: commit.slice(0, 8),
-        subject
+        subject,
       }));
-      pendingCommitsFilegrcOnly = commits.every(({ paths }) => (
-        paths.length > 0 && paths.every((path) => pathInsideWorkspace(path, prefix))
-      ));
+      pendingCommitsFilegrcOnly = commits.every(
+        ({ paths }) =>
+          paths.length > 0 &&
+          paths.every((path) => pathInsideWorkspace(path, prefix)),
+      );
     }
     return {
       available: true,
@@ -1212,7 +1666,11 @@ async function buildRepositorySnapshot(root) {
       pendingCommits,
       pendingCommitsFilegrcOnly,
       lastCommit: last,
-      invocationCount: 3 + (parsed.commit ? 1 : 0) + (parsed.upstream ? 1 : 0) + (parsed.ahead > 0 ? 1 : 0)
+      invocationCount:
+        3 +
+        (parsed.commit ? 1 : 0) +
+        (parsed.upstream ? 1 : 0) +
+        (parsed.ahead > 0 ? 1 : 0),
     };
   } catch (error) {
     if (error?.code === "FILEGRC_GIT_DEADLINE") throw error;
@@ -1226,17 +1684,23 @@ function unavailableSnapshot(error, extra = {}) {
     clean: null,
     changes: [],
     error,
-    message: error instanceof GitOperationError
-      ? error.message
-      : "Git history is unavailable. Commit the workspace to enable audit metadata.",
-    ...extra
+    message:
+      error instanceof GitOperationError
+        ? error.message
+        : "Git history is unavailable. Commit the workspace to enable audit metadata.",
+    ...extra,
   };
 }
 
-export async function getBrowserRepositoryState(input = process.cwd(), options = {}) {
-  const root = input?.entries && input?.root ? input.root : resolveWorkspaceRoot(input);
+export async function getBrowserRepositoryState(
+  input = process.cwd(),
+  options = {},
+) {
+  const root =
+    input?.entries && input?.root ? input.root : resolveWorkspaceRoot(input);
   const config = await getRepositoryConfig(input);
-  const gitSummary = options.repositorySnapshot ?? await getRepositorySnapshot(root);
+  const gitSummary =
+    options.repositorySnapshot ?? (await getRepositorySnapshot(root));
   if (config.mode !== "trunk") {
     return {
       mode: "manual",
@@ -1252,8 +1716,10 @@ export async function getBrowserRepositoryState(input = process.cwd(), options =
       behind: null,
       pendingCommits: [],
       pendingCommitsFilegrcOnly: null,
-      lastSuccessfulSynchronization: lastSuccessfulSynchronizations.get(root) ?? null,
-      message: "Browser writes stay local until a user commits and synchronizes them."
+      lastSuccessfulSynchronization:
+        lastSuccessfulSynchronizations.get(root) ?? null,
+      message:
+        "Browser writes stay local until a user commits and synchronizes them.",
     };
   }
 
@@ -1266,27 +1732,34 @@ export async function getBrowserRepositoryState(input = process.cwd(), options =
       writesAllowed: !options.readOnly,
       status: "not-synced",
       label: "Not synced",
-      message: "Development override is active. Browser writes stay local and FileGRC will not commit or push them."
+      message:
+        "Development override is active. Browser writes stay local and FileGRC will not commit or push them.",
     };
   }
   return {
     ...details,
     developmentOverride: false,
-    writesAllowed: !options.readOnly && details.writesAllowed
+    writesAllowed: !options.readOnly && details.writesAllowed,
   };
 }
 
 export async function runBrowserMutation(input, options, task) {
   return serializeWorkspaceMutation(input, async (root) => {
     const config = await getRepositoryConfig(root);
-    if (config.mode !== "trunk" || options?.allowNonAuthoritativeWrites === true) {
+    if (
+      config.mode !== "trunk" ||
+      options?.allowNonAuthoritativeWrites === true
+    ) {
       return task(root);
     }
     return runTrunkMutationUnlocked(root, config, options, task);
   });
 }
 
-export async function prefetchBrowserRemote(input = process.cwd(), options = {}) {
+export async function prefetchBrowserRemote(
+  input = process.cwd(),
+  options = {},
+) {
   const root = resolveWorkspaceRoot(input);
   const key = `${root}\0${options.allowNonAuthoritativeWrites === true}`;
   if (browserRemotePrefetchPromises.has(key)) {
@@ -1294,7 +1767,8 @@ export async function prefetchBrowserRemote(input = process.cwd(), options = {})
     return browserRemotePrefetchPromises.get(key);
   }
   const prefetch = prefetchBrowserRemoteCoalesced(root, options).finally(() => {
-    if (browserRemotePrefetchPromises.get(key) === prefetch) browserRemotePrefetchPromises.delete(key);
+    if (browserRemotePrefetchPromises.get(key) === prefetch)
+      browserRemotePrefetchPromises.delete(key);
   });
   browserRemotePrefetchPromises.set(key, prefetch);
   return prefetch;
@@ -1303,11 +1777,20 @@ export async function prefetchBrowserRemote(input = process.cwd(), options = {})
 async function prefetchBrowserRemoteCoalesced(root, options) {
   const prepared = await serializeWorkspaceMutation(root, async () => {
     const config = await getRepositoryConfig(root);
-    if (config.mode !== "trunk" || options.allowNonAuthoritativeWrites === true) return { config, repository: null };
-    const repository = await measureTiming("git-preconditions", () => requireTrunkPreconditionsAsync(root, config));
+    if (config.mode !== "trunk" || options.allowNonAuthoritativeWrites === true)
+      return { config, repository: null };
+    const repository = await measureTiming("git-preconditions", () =>
+      requireTrunkPreconditionsAsync(root, config),
+    );
     return { config, repository };
   });
-  if (!prepared.repository) return { status: "not-needed", token: null, fetchedAt: null, expiresAt: null };
+  if (!prepared.repository)
+    return {
+      status: "not-needed",
+      token: null,
+      fetchedAt: null,
+      expiresAt: null,
+    };
 
   // Fetch updates only remote-tracking refs, so it does not occupy the source mutation queue.
   await fetchConfiguredRemote(root, prepared.config);
@@ -1315,7 +1798,9 @@ async function prefetchBrowserRemoteCoalesced(root, options) {
     const summary = await getRepositorySnapshot(root, { fresh: true });
     if (!summary.available) throw summary.error;
     if (summary.commit !== prepared.repository.currentCommit) {
-      throw new Error("The authoritative branch changed while FileGRC checked its remote. Reload and try again.");
+      throw new Error(
+        "The authoritative branch changed while FileGRC checked its remote. Reload and try again.",
+      );
     }
     const repository = inspectTrunkRepository(root, prepared.config, summary);
     const fetchedAt = new Date().toISOString();
@@ -1325,13 +1810,15 @@ async function prefetchBrowserRemoteCoalesced(root, options) {
       remote: prepared.config.remote,
       currentCommit: summary.commit,
       upstreamCommit: repository.upstreamCommit,
-      fetchedAt: Date.parse(fetchedAt)
+      fetchedAt: Date.parse(fetchedAt),
     });
     return {
       status: "checked",
       token,
       fetchedAt,
-      expiresAt: new Date(Date.parse(fetchedAt) + BROWSER_REMOTE_PREFETCH_MAX_AGE_MS).toISOString()
+      expiresAt: new Date(
+        Date.parse(fetchedAt) + BROWSER_REMOTE_PREFETCH_MAX_AGE_MS,
+      ).toISOString(),
     };
   });
 }
@@ -1339,37 +1826,72 @@ async function prefetchBrowserRemoteCoalesced(root, options) {
 export async function retryBrowserSync(input = process.cwd(), options = {}) {
   return serializeWorkspaceMutation(input, async (root) => {
     const config = await getRepositoryConfig(root);
-    if (config.mode !== "trunk") throw new Error("Retry sync is available only in trunk repository mode.");
+    if (config.mode !== "trunk")
+      throw new Error("Retry sync is available only in trunk repository mode.");
     if (backgroundSynchronizations.get(root)?.status === "syncing") {
-      throw new Error("A FileGRC background push is already in progress. Wait for it to finish before retrying sync.");
+      throw new Error(
+        "A FileGRC background push is already in progress. Wait for it to finish before retrying sync.",
+      );
     }
     if (options.allowNonAuthoritativeWrites === true) {
-      throw new Error("Retry sync is disabled while the development write override is active.");
+      throw new Error(
+        "Retry sync is disabled while the development write override is active.",
+      );
     }
-    const before = await requireTrunkPreconditionsAsync(root, config, { allowAhead: true });
+    const before = await requireTrunkPreconditionsAsync(root, config, {
+      allowAhead: true,
+    });
     await fetchConfiguredRemote(root, config);
-    const synchronized = inspectTrunkRepository(root, config, await getRepositorySnapshot(root, { fresh: true }));
+    const synchronized = inspectTrunkRepository(
+      root,
+      config,
+      await getRepositorySnapshot(root, { fresh: true }),
+    );
     if (synchronized.behind > 0 && synchronized.ahead > 0) {
-      throw new Error("The authoritative branch has diverged from its upstream. FileGRC will not merge or rebase it. Reconcile the repository with Git, then reload.");
+      throw new Error(
+        "The authoritative branch has diverged from its upstream. FileGRC will not merge or rebase it. Reconcile the repository with Git, then reload.",
+      );
     }
     if (synchronized.behind > 0) {
-      throw new Error("The authoritative branch is behind its upstream. Fast-forward it with Git, then reload before retrying sync.");
+      throw new Error(
+        "The authoritative branch is behind its upstream. Fast-forward it with Git, then reload before retrying sync.",
+      );
     }
-    const ready = inspectTrunkRepository(root, config, await getRepositorySnapshot(root, { fresh: true }));
+    const ready = inspectTrunkRepository(
+      root,
+      config,
+      await getRepositorySnapshot(root, { fresh: true }),
+    );
     if (ready.ahead > 0 && !ready.pendingCommitsFilegrcOnly) {
-      throw new Error("At least one commit ahead of upstream changes files outside this FileGRC workspace. FileGRC will not push it. Reconcile the repository with Git.");
+      throw new Error(
+        "At least one commit ahead of upstream changes files outside this FileGRC workspace. FileGRC will not push it. Reconcile the repository with Git.",
+      );
     }
     if (ready.ahead > 0) {
-      const pushed = await pushConfiguredBranch(root, config, ready.currentCommit, ready.upstreamCommit);
+      const pushed = await pushConfiguredBranch(
+        root,
+        config,
+        ready.currentCommit,
+        ready.upstreamCommit,
+      );
       if (pushed.trackingError) {
-        const committed = { commit: ready.currentCommit, shortCommit: ready.currentCommit.slice(0, 8) };
+        const committed = {
+          commit: ready.currentCommit,
+          shortCommit: ready.currentCommit.slice(0, 8),
+        };
         recordBackgroundTrackingFailure(root, committed, pushed.trackingError);
         throw new Error(pushed.trackingError);
       }
     }
-    const after = inspectTrunkRepository(root, config, await getRepositorySnapshot(root, { fresh: true }));
+    const after = inspectTrunkRepository(
+      root,
+      config,
+      await getRepositorySnapshot(root, { fresh: true }),
+    );
     if (after.ahead !== 0 || after.behind !== 0) {
-      throw new Error("The authoritative branch is still not synchronized. Reload the repository state before trying again.");
+      throw new Error(
+        "The authoritative branch is still not synchronized. Reload the repository state before trying again.",
+      );
     }
     const synchronizedAt = new Date().toISOString();
     lastSuccessfulSynchronizations.set(root, synchronizedAt);
@@ -1380,29 +1902,50 @@ export async function retryBrowserSync(input = process.cwd(), options = {}) {
       branch: config.authoritativeBranch,
       upstream: after.upstream,
       synchronizedAt,
-      retriedCommits: before.ahead ?? 0
+      retriedCommits: before.ahead ?? 0,
     };
   });
 }
 
 async function runTrunkMutationUnlocked(root, config, options, task) {
-  const beforeFetch = await measureTiming("git-preconditions", () => requireTrunkPreconditionsAsync(root, config));
+  const beforeFetch = await measureTiming("git-preconditions", () =>
+    requireTrunkPreconditionsAsync(root, config),
+  );
   let synchronized = beforeFetch;
-  if (!consumeFreshBrowserRemotePrefetch(root, config, options?.prefetchToken, beforeFetch)) {
+  if (
+    !consumeFreshBrowserRemotePrefetch(
+      root,
+      config,
+      options?.prefetchToken,
+      beforeFetch,
+    )
+  ) {
     await fetchConfiguredRemote(root, config);
-    synchronized = inspectTrunkRepository(root, config, await getRepositorySnapshot(root, { fresh: true }));
+    synchronized = inspectTrunkRepository(
+      root,
+      config,
+      await getRepositorySnapshot(root, { fresh: true }),
+    );
   }
   if (synchronized.ahead > 0 && synchronized.behind > 0) {
-    throw new Error("The authoritative branch has diverged from its upstream. FileGRC will not merge or rebase it. Reconcile the repository with Git, then reload.");
+    throw new Error(
+      "The authoritative branch has diverged from its upstream. FileGRC will not merge or rebase it. Reconcile the repository with Git, then reload.",
+    );
   }
   if (synchronized.ahead > 0) {
-    throw new Error("The authoritative branch has local commits waiting to be pushed. Use Retry sync before making another browser change.");
+    throw new Error(
+      "The authoritative branch has local commits waiting to be pushed. Use Retry sync before making another browser change.",
+    );
   }
   if (synchronized.behind > 0) {
-    throw new Error("The authoritative branch is behind its upstream. Fast-forward it with Git, then reload before making a browser change.");
+    throw new Error(
+      "The authoritative branch is behind its upstream. Fast-forward it with Git, then reload before making a browser change.",
+    );
   }
   if (synchronized.ahead !== 0 || synchronized.behind !== 0) {
-    throw new Error("The authoritative branch is not synchronized with its upstream. Reload after reconciling the repository with Git.");
+    throw new Error(
+      "The authoritative branch is not synchronized with its upstream. Reload after reconciling the repository with Git.",
+    );
   }
 
   let result;
@@ -1410,93 +1953,162 @@ async function runTrunkMutationUnlocked(root, config, options, task) {
   let validationProof;
   let validatedManifest;
   try {
-    result = await measureTiming("write", () => withDeferredWorkspaceValidation(() => task(root, {
-      repositorySnapshot: synchronized
-    })));
-    subject = generatedCommitMessage(typeof options?.message === "function" ? options.message(result) : options?.message);
+    result = await measureTiming("write", () =>
+      withDeferredWorkspaceValidation(() =>
+        task(root, {
+          repositorySnapshot: synchronized,
+        }),
+      ),
+    );
+    subject = generatedCommitMessage(
+      typeof options?.message === "function"
+        ? options.message(result)
+        : options?.message,
+    );
     assertNoIgnoredAuthoritativeFiles(root);
-    const beforeValidation = workspaceByteManifest(root);
-    const validation = await validateWorkspace(root);
+    const beforeValidation = measureTimingSync("workspace-manifest", () =>
+      workspaceByteManifest(root),
+    );
+    const validation = await withGitCommandCache(new Map(), () =>
+      validateWorkspace(root),
+    );
     if (!validation.ok) {
-      throw new Error(`The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}.`);
+      throw new Error(
+        `The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}.`,
+      );
     }
-    validationProof = options?.includeValidationProof === false
-      ? null
-      : {
-          validation,
-          fingerprint: (await measureTiming("fingerprint", () => fingerprintWorkspace(validation.loaded))).fingerprint
-    };
-    validatedManifest = workspaceByteManifest(root);
+    validationProof =
+      options?.includeValidationProof === false
+        ? null
+        : {
+            validation,
+            fingerprint: (
+              await measureTiming("fingerprint", () =>
+                fingerprintWorkspace(validation.loaded),
+              )
+            ).fingerprint,
+          };
+    validatedManifest = measureTimingSync("workspace-manifest", () =>
+      workspaceByteManifest(root),
+    );
     assertWorkspaceManifestEqual(beforeValidation, validatedManifest);
-    await assertNoOutsideWorktreeChangesAsync(root);
+    await measureTiming("outside-worktree-check", () =>
+      assertNoOutsideWorktreeChangesAsync(root),
+    );
   } catch (error) {
-    throw new Error(`${error.message} FileGRC preserved every current file instead of guessing which edits it owns. Review the Git diff; later browser mutations are blocked until the worktree is reconciled.`);
+    let changed = false;
+    try {
+      changed =
+        Boolean(
+          await runGitCommand(
+            root,
+            ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
+            {
+              operation: "check the worktree after a failed browser mutation",
+            },
+          ),
+        ) || ignoredAuthoritativeFiles(root).length > 0;
+    } catch {
+      // Keep the mutation error when Git cannot prove that the failed action left changes.
+    }
+    if (!changed) throw error;
+    throw new Error(
+      `${error.message} FileGRC preserved every current file instead of guessing which edits it owns. Review the Git diff; later browser mutations are blocked until the worktree is reconciled.`,
+    );
   }
 
-  const changed = Boolean(await runGitCommand(root, ["status", "--porcelain=v1", "--", "."], {
-    operation: "check the FileGRC workspace change"
-  }));
+  const changed = Boolean(
+    await runGitCommand(root, ["status", "--porcelain=v1", "--", "."], {
+      operation: "check the FileGRC workspace change",
+    }),
+  );
   if (!changed && options?.allowNoChanges === true) {
-    return withValidationProof({
-      ...result,
-      synchronization: {
-        status: "unchanged",
-        commit: synchronized.currentCommit,
-        shortCommit: synchronized.currentCommit?.slice(0, 8) ?? null,
-        upstream: synchronized.upstream,
-        synchronizedAt: lastSuccessfulSynchronizations.get(root) ?? null,
-        pushError: null
-      }
-    }, validationProof);
+    return withValidationProof(
+      {
+        ...result,
+        synchronization: {
+          status: "unchanged",
+          commit: synchronized.currentCommit,
+          shortCommit: synchronized.currentCommit?.slice(0, 8) ?? null,
+          upstream: synchronized.upstream,
+          synchronizedAt: lastSuccessfulSynchronizations.get(root) ?? null,
+          pushError: null,
+        },
+      },
+      validationProof,
+    );
   }
   if (!changed) {
-    throw new Error("The browser action did not change any FileGRC workspace files.");
+    throw new Error(
+      "The browser action did not change any FileGRC workspace files.",
+    );
   }
   assertValidGitIdentity(root);
   assertNoWorkspaceContentFilters(root);
-  await assertNoOutsideWorktreeChangesAsync(root);
+  await measureTiming("outside-worktree-check", () =>
+    assertNoOutsideWorktreeChangesAsync(root),
+  );
   let commit;
   let indexReconciled;
   try {
     const expectedRef = `refs/heads/${config.authoritativeBranch}`;
     assertExpectedCheckout(root, expectedRef, synchronized.currentCommit);
-    validatedManifest = writeWorkspaceManifestObjects(root, validatedManifest);
-    ({ commit, indexReconciled } = await measureTiming("commit", () => commitValidatedIndexAsync(root, subject, validatedManifest, {
-      expectedParent: synchronized.currentCommit,
-      expectedRef
-    })));
+    validatedManifest = measureTimingSync("workspace-manifest-objects", () =>
+      writeWorkspaceManifestObjects(root, validatedManifest),
+    );
+    ({ commit, indexReconciled } = await measureTiming("commit", () =>
+      commitValidatedIndexAsync(root, subject, validatedManifest, {
+        expectedParent: synchronized.currentCommit,
+        expectedRef,
+      }),
+    ));
   } catch (error) {
-    throw new Error(`${error.message} The saved files remain in the Git worktree and later browser changes are blocked.`);
+    throw new Error(
+      `${error.message} The saved files remain in the Git worktree and later browser changes are blocked.`,
+    );
   }
 
-  const committed = { commit, shortCommit: commit.slice(0, 8), upstreamCommit: synchronized.upstreamCommit };
+  const committed = {
+    commit,
+    shortCommit: commit.slice(0, 8),
+    upstreamCommit: synchronized.upstreamCommit,
+  };
   if (!indexReconciled) {
-    const error = new Error("FileGRC created the commit, but the shared Git index changed or could not be reconciled afterward. Review and reconcile the Git index before syncing.");
+    const error = new Error(
+      "FileGRC created the commit, but the shared Git index changed or could not be reconciled afterward. Review and reconcile the Git index before syncing.",
+    );
     recordBackgroundPushFailure(root, committed, error);
-    return withValidationProof({
+    return withValidationProof(
+      {
+        ...result,
+        synchronization: {
+          status: "not-synced",
+          commit: committed.commit,
+          shortCommit: committed.shortCommit,
+          upstream: synchronized.upstream,
+          synchronizedAt: null,
+          pushError:
+            backgroundSynchronizations.get(root)?.error ?? error.message,
+        },
+      },
+      validationProof,
+    );
+  }
+  queueBackgroundPush(root, config, committed, options?.backgroundPushDelayMs);
+  return withValidationProof(
+    {
       ...result,
       synchronization: {
-        status: "not-synced",
+        status: "syncing",
         commit: committed.commit,
         shortCommit: committed.shortCommit,
         upstream: synchronized.upstream,
         synchronizedAt: null,
-        pushError: backgroundSynchronizations.get(root)?.error ?? error.message
-      }
-    }, validationProof);
-  }
-  queueBackgroundPush(root, config, committed, options?.backgroundPushDelayMs);
-  return withValidationProof({
-    ...result,
-    synchronization: {
-      status: "syncing",
-      commit: committed.commit,
-      shortCommit: committed.shortCommit,
-      upstream: synchronized.upstream,
-      synchronizedAt: null,
-      pushError: null
-    }
-  }, validationProof);
+        pushError: null,
+      },
+    },
+    validationProof,
+  );
 }
 
 function withValidationProof(result, proof) {
@@ -1510,16 +2122,17 @@ function consumeFreshBrowserRemotePrefetch(root, config, token, repository) {
   const prefetch = browserRemotePrefetches.get(root);
   browserRemotePrefetches.delete(root);
   if (
-    !token
-    || !prefetch
-    || prefetch.token !== token
-    || prefetch.remote !== config.remote
-    || Date.now() - prefetch.fetchedAt > BROWSER_REMOTE_PREFETCH_MAX_AGE_MS
+    !token ||
+    !prefetch ||
+    prefetch.token !== token ||
+    prefetch.remote !== config.remote ||
+    Date.now() - prefetch.fetchedAt > BROWSER_REMOTE_PREFETCH_MAX_AGE_MS
   ) {
     return false;
   }
-  const reusable = repository.currentCommit === prefetch.currentCommit
-    && repository.upstreamCommit === prefetch.upstreamCommit;
+  const reusable =
+    repository.currentCommit === prefetch.currentCommit &&
+    repository.upstreamCommit === prefetch.upstreamCommit;
   if (reusable) recordTiming("fetch-reused", 0);
   return reusable;
 }
@@ -1530,22 +2143,28 @@ function queueBackgroundPush(root, config, committed, delayMs = 0) {
     commit: committed.commit,
     shortCommit: committed.shortCommit,
     startedAt: new Date().toISOString(),
-    error: null
+    error: null,
   });
   const start = async () => {
     try {
       const ready = await requireTrunkPreconditionsAsync(root, config, {
         allowAhead: true,
-        backgroundCommit: committed.commit
+        backgroundCommit: committed.commit,
       });
       if (ready.currentCommit !== committed.commit) {
-        throw new Error("The authoritative branch changed after FileGRC created its browser commit. FileGRC did not push it.");
+        throw new Error(
+          "The authoritative branch changed after FileGRC created its browser commit. FileGRC did not push it.",
+        );
       }
       if (ready.behind > 0) {
-        throw new Error("The authoritative branch changed upstream after FileGRC created its browser commit. FileGRC did not push it.");
+        throw new Error(
+          "The authoritative branch changed upstream after FileGRC created its browser commit. FileGRC did not push it.",
+        );
       }
       if (ready.ahead < 1 || !ready.pendingCommitsFilegrcOnly) {
-        throw new Error("The pending commits are no longer limited to this FileGRC workspace. FileGRC did not push them.");
+        throw new Error(
+          "The pending commits are no longer limited to this FileGRC workspace. FileGRC did not push them.",
+        );
       }
       await finishBackgroundPush(root, config, committed);
     } catch (error) {
@@ -1562,45 +2181,65 @@ async function finishBackgroundPush(root, config, committed) {
   let outcome = "failed";
   let remotePushed = false;
   try {
-    const pushed = await pushConfiguredBranch(root, config, committed.commit, committed.upstreamCommit);
+    const pushed = await pushConfiguredBranch(
+      root,
+      config,
+      committed.commit,
+      committed.upstreamCommit,
+    );
     remotePushed = pushed.remotePushed;
     if (pushed.trackingError) {
       recordBackgroundTrackingFailure(root, committed, pushed.trackingError);
       outcome = "pushed-tracking-stale";
       return;
     }
-    const after = inspectTrunkRepository(root, config, await getRepositorySnapshot(root, { fresh: true }), { ignoreBackground: true });
+    const after = inspectTrunkRepository(
+      root,
+      config,
+      await getRepositorySnapshot(root, { fresh: true }),
+      { ignoreBackground: true },
+    );
     if (after.ahead !== 0 || after.behind !== 0) {
-      throw new Error("The authoritative branch is still not synchronized after the background push.");
+      throw new Error(
+        "The authoritative branch is still not synchronized after the background push.",
+      );
     }
     const synchronizedAt = new Date().toISOString();
     lastSuccessfulSynchronizations.set(root, synchronizedAt);
     deleteBackgroundSynchronizationIfCurrent(root, committed.commit);
     outcome = "synced";
   } catch (error) {
-    if (remotePushed) recordBackgroundRemoteSuccessFailure(root, committed, error.message);
+    if (remotePushed)
+      recordBackgroundRemoteSuccessFailure(root, committed, error.message);
     else recordBackgroundPushFailure(root, committed, error);
   } finally {
     if (timingEnabled()) {
-      console.error(`[filegrc timing] ${JSON.stringify({
-        operation: "background-sync",
-        push: { count: 1, durationMs: performance.now() - started },
-        outcome
-      })}`);
+      console.error(
+        `[filegrc timing] ${JSON.stringify({
+          operation: "background-sync",
+          push: { count: 1, durationMs: performance.now() - started },
+          outcome,
+        })}`,
+      );
     }
   }
 }
 
 function recordBackgroundPushFailure(root, committed, error) {
-  setBackgroundSynchronizationIfCurrent(root, committed, {
-    status: "failed",
-    commit: committed.commit,
-    shortCommit: committed.shortCommit,
-    startedAt: backgroundSynchronizations.get(root)?.startedAt ?? null,
-    finishedAt: new Date().toISOString(),
-    remotePushed: false,
-    error: `${error.message} The local FileGRC commit was retained. Use Retry sync after the remote is available.`
-  }, { allowMissing: true });
+  setBackgroundSynchronizationIfCurrent(
+    root,
+    committed,
+    {
+      status: "failed",
+      commit: committed.commit,
+      shortCommit: committed.shortCommit,
+      startedAt: backgroundSynchronizations.get(root)?.startedAt ?? null,
+      finishedAt: new Date().toISOString(),
+      remotePushed: false,
+      error: `${error.message} The local FileGRC commit was retained. Use Retry sync after the remote is available.`,
+    },
+    { allowMissing: true },
+  );
 }
 
 function recordBackgroundTrackingFailure(root, committed, error) {
@@ -1608,24 +2247,34 @@ function recordBackgroundTrackingFailure(root, committed, error) {
 }
 
 function recordBackgroundRemoteSuccessFailure(root, committed, error) {
-  setBackgroundSynchronizationIfCurrent(root, committed, {
-    status: "failed",
-    commit: committed.commit,
-    shortCommit: committed.shortCommit,
-    startedAt: backgroundSynchronizations.get(root)?.startedAt ?? null,
-    finishedAt: new Date().toISOString(),
-    remotePushed: true,
-    error: `${error} The remote accepted the exact FileGRC commit. Fetch with Git to reconcile local state; do not retry the push.`
-  }, { allowMissing: true });
-}
-
-function setBackgroundSynchronizationIfCurrent(root, committed, next, options = {}) {
+  setBackgroundSynchronizationIfCurrent(
+    root,
+    committed,
+    {
+      status: "failed",
+      commit: committed.commit,
+      shortCommit: committed.shortCommit,
+      startedAt: backgroundSynchronizations.get(root)?.startedAt ?? null,
+      finishedAt: new Date().toISOString(),
+      remotePushed: true,
+      error: `${error} The remote accepted the exact FileGRC commit. Fetch with Git to reconcile local state; do not retry the push.`,
+    },
+    { allowMissing: true },
+  );
+}
+
+function setBackgroundSynchronizationIfCurrent(
+  root,
+  committed,
+  next,
+  options = {},
+) {
   const current = backgroundSynchronizations.get(root);
   if (current && current.commit !== committed.commit) return false;
   if (!current && options.allowMissing !== true) return false;
   backgroundSynchronizations.set(root, {
     ...next,
-    remotePushed: current?.remotePushed === true || next.remotePushed === true
+    remotePushed: current?.remotePushed === true || next.remotePushed === true,
   });
   return true;
 }
@@ -1637,61 +2286,86 @@ function deleteBackgroundSynchronizationIfCurrent(root, commit) {
 
 async function commitWorkspaceUnlocked(root, message) {
   const subject = String(message ?? "").trim();
-  if (!subject || subject.length > 200 || /[\u0000-\u001f\u007f]/.test(subject)) {
-    throw new Error("Commit messages must be one line from 1 through 200 characters.");
+  if (
+    !subject ||
+    subject.length > 200 ||
+    /[\u0000-\u001f\u007f]/.test(subject)
+  ) {
+    throw new Error(
+      "Commit messages must be one line from 1 through 200 characters.",
+    );
   }
   assertNoWorkspaceContentFilters(root);
   const before = getGitSummary(root);
-  if (!before.available) throw new Error("Git history is unavailable for this workspace.");
-  if (!before.branch) throw new Error("Check out a branch before creating a browser commit.");
+  if (!before.available)
+    throw new Error("Git history is unavailable for this workspace.");
+  if (!before.branch)
+    throw new Error("Check out a branch before creating a browser commit.");
   assertNoGitOperationInProgress(root);
   if (before.clean) throw new Error("The workspace has no changes to commit.");
-  if (!tryGit(root, ["config", "user.name"]) || !tryGit(root, ["config", "user.email"])) {
-    throw new Error("Configure git user.name and user.email before committing.");
+  if (
+    !tryGit(root, ["config", "user.name"]) ||
+    !tryGit(root, ["config", "user.email"])
+  ) {
+    throw new Error(
+      "Configure git user.name and user.email before committing.",
+    );
   }
   assertValidGitIdentity(root);
   assertNoIgnoredAuthoritativeFiles(root);
   const beforeValidation = workspaceByteManifest(root);
   const validation = await validateWorkspace(root);
   if (!validation.ok) {
-    throw new Error(`The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}. Fix them before committing.`);
+    throw new Error(
+      `The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}. Fix them before committing.`,
+    );
   }
   let validatedManifest = workspaceByteManifest(root);
   assertWorkspaceManifestEqual(beforeValidation, validatedManifest);
   const commitOptions = {
     expectedParent: before.commit,
-    expectedRef: `refs/heads/${before.branch}`
+    expectedRef: `refs/heads/${before.branch}`,
   };
-  assertExpectedCheckout(root, commitOptions.expectedRef, commitOptions.expectedParent);
+  assertExpectedCheckout(
+    root,
+    commitOptions.expectedRef,
+    commitOptions.expectedParent,
+  );
   validatedManifest = writeWorkspaceManifestObjects(root, validatedManifest);
-  const committed = await commitValidatedIndexAsync(root, subject, validatedManifest, commitOptions);
+  const committed = await commitValidatedIndexAsync(
+    root,
+    subject,
+    validatedManifest,
+    commitOptions,
+  );
   const after = getGitSummary(root);
   return {
     commit: committed.commit,
     shortCommit: committed.commit.slice(0, 8),
     indexReconciled: committed.indexReconciled,
-    subject: after.lastCommit?.subject || subject
+    subject: after.lastCommit?.subject || subject,
   };
 }
 
 async function commitAndPushWorkspaceUnlocked(root, message) {
   const before = getGitSummary(root);
-  const target = before.upstream || before.remotes?.length
-    ? captureManualPushTarget(root, before)
-    : null;
+  const target =
+    before.upstream || before.remotes?.length
+      ? captureManualPushTarget(root, before)
+      : null;
   const committed = await commitWorkspaceUnlocked(root, message);
   if (!target) {
     return {
       ...committed,
       pushed: false,
-      pushSkipped: true
+      pushSkipped: true,
     };
   }
   try {
     const pushed = await pushCapturedWorkspaceCommit(root, {
       before,
       target,
-      commit: committed.commit
+      commit: committed.commit,
     });
     return {
       ...committed,
@@ -1699,14 +2373,14 @@ async function commitAndPushWorkspaceUnlocked(root, message) {
       pushSkipped: false,
       upstream: pushed.upstream,
       trackingConfigured: pushed.trackingConfigured,
-      trackingError: pushed.trackingError
+      trackingError: pushed.trackingError,
     };
   } catch (error) {
     return {
       ...committed,
       pushed: false,
       pushSkipped: false,
-      pushError: error.message
+      pushError: error.message,
     };
   }
 }
@@ -1715,21 +2389,35 @@ async function pullWorkspaceUnlocked(root) {
   const before = syncReadySummary(root, "pull");
   assertNoGitOperationInProgress(root);
   if (!before.upstream) {
-    throw new Error("This branch has no upstream branch. Push it first or configure an upstream with Git.");
+    throw new Error(
+      "This branch has no upstream branch. Push it first or configure an upstream with Git.",
+    );
   }
   const remote = before.upstream.split("/")[0];
   const branch = before.upstream.slice(remote.length + 1);
   const url = assertSafeAutomaticTransport(root, remote);
-  gitForWrite(root, exactFetchArgs({ remote, branch, url }), `fetch ${remote} before checking incoming commits`);
-  const target = git(root, ["rev-parse", "--verify", `${before.upstream}^{commit}`]);
-  const incomingCommits = lines(git(root, ["rev-list", "--reverse", `${before.commit}..${target}`]));
+  gitForWrite(
+    root,
+    exactFetchArgs({ remote, branch, url }),
+    `fetch ${remote} before checking incoming commits`,
+  );
+  const target = git(root, [
+    "rev-parse",
+    "--verify",
+    `${before.upstream}^{commit}`,
+  ]);
+  const incomingCommits = lines(
+    git(root, ["rev-list", "--reverse", `${before.commit}..${target}`]),
+  );
   assertCommitsInsideWorkspace(root, incomingCommits);
   for (const commit of incomingCommits) {
     assertNoCommitWorkspaceContentFilters(root, commit);
   }
   assertExpectedCheckout(root, `refs/heads/${before.branch}`, before.commit);
   if (incomingCommits.length) {
-    throw new Error("FileGRC fetched incoming commits but did not integrate them. Reconcile the branch with Git, then reload FileGRC.");
+    throw new Error(
+      "FileGRC fetched incoming commits but did not integrate them. Reconcile the branch with Git, then reload FileGRC.",
+    );
   }
   const after = getGitSummary(root);
   return {
@@ -1737,7 +2425,7 @@ async function pullWorkspaceUnlocked(root) {
     commit: after.commit,
     shortCommit: after.shortCommit,
     branch: after.branch,
-    upstream: after.upstream
+    upstream: after.upstream,
   };
 }
 
@@ -1747,9 +2435,15 @@ async function pushWorkspaceUnlocked(root) {
   const target = captureManualPushTarget(root, before);
   const validation = await validateWorkspace(root);
   if (!validation.ok) {
-    throw new Error(`The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}. Fix them before pushing.`);
+    throw new Error(
+      `The workspace has ${validation.counts.errors} validation ${validation.counts.errors === 1 ? "error" : "errors"}. Fix them before pushing.`,
+    );
   }
-  return pushCapturedWorkspaceCommit(root, { before, target, commit: before.commit });
+  return pushCapturedWorkspaceCommit(root, {
+    before,
+    target,
+    commit: before.commit,
+  });
 }
 
 async function pushCapturedWorkspaceCommit(root, { before, target, commit }) {
@@ -1757,14 +2451,23 @@ async function pushCapturedWorkspaceCommit(root, { before, target, commit }) {
   await gitForWriteAsync(root, exactPushArgs(target, commit), "push", {
     expectedCheckout: {
       expectedRef: `refs/heads/${before.branch}`,
-      expectedCommit: commit
-    }
+      expectedCommit: commit,
+    },
   });
   let trackingError = reconcileRemoteTracking(root, target, commit);
   if (!before.upstream && !trackingError) {
     try {
       assertExpectedCheckout(root, `refs/heads/${before.branch}`, commit);
-      gitForWrite(root, ["branch", "--set-upstream-to", `${target.remote}/${before.branch}`, before.branch], "configure the pushed branch upstream");
+      gitForWrite(
+        root,
+        [
+          "branch",
+          "--set-upstream-to",
+          `${target.remote}/${before.branch}`,
+          before.branch,
+        ],
+        "configure the pushed branch upstream",
+      );
     } catch (error) {
       trackingError = error.message;
     }
@@ -1773,9 +2476,11 @@ async function pushCapturedWorkspaceCommit(root, { before, target, commit }) {
     commit,
     shortCommit: commit.slice(0, 8),
     branch: before.branch,
-    upstream: before.upstream || (trackingError ? null : `${target.remote}/${before.branch}`),
+    upstream:
+      before.upstream ||
+      (trackingError ? null : `${target.remote}/${before.branch}`),
     trackingConfigured: Boolean(before.upstream) || !trackingError,
-    trackingError
+    trackingError,
   };
 }
 
@@ -1783,13 +2488,27 @@ function captureManualPushTarget(root, before) {
   let remote;
   let destination;
   if (before.upstream) {
-    remote = tryGit(root, ["config", "--get", `branch.${before.branch}.remote`]);
-    destination = tryGit(root, ["config", "--get", `branch.${before.branch}.merge`]);
+    remote = tryGit(root, [
+      "config",
+      "--get",
+      `branch.${before.branch}.remote`,
+    ]);
+    destination = tryGit(root, [
+      "config",
+      "--get",
+      `branch.${before.branch}.merge`,
+    ]);
     const destinationBranch = destination?.startsWith("refs/heads/")
       ? destination.slice("refs/heads/".length)
       : "";
-    if (!isSafeGitName(remote) || !isSafeGitName(destinationBranch) || before.upstream !== `${remote}/${destinationBranch}`) {
-      throw new Error("The current branch has an unsafe or unsupported upstream configuration. Configure a normal remote branch with Git before pushing.");
+    if (
+      !isSafeGitName(remote) ||
+      !isSafeGitName(destinationBranch) ||
+      before.upstream !== `${remote}/${destinationBranch}`
+    ) {
+      throw new Error(
+        "The current branch has an unsafe or unsupported upstream configuration. Configure a normal remote branch with Git before pushing.",
+      );
     }
   } else {
     remote = before.remotes.includes("origin")
@@ -1798,9 +2517,11 @@ function captureManualPushTarget(root, before) {
         ? before.remotes[0]
         : null;
     if (!remote) {
-      throw new Error(before.remotes.length
-        ? "This branch has no upstream and the repository has multiple remotes. Configure an upstream with Git."
-        : "This repository has no Git remote. Add one before pushing.");
+      throw new Error(
+        before.remotes.length
+          ? "This branch has no upstream and the repository has multiple remotes. Configure an upstream with Git."
+          : "This repository has no Git remote. Add one before pushing.",
+      );
     }
     destination = `refs/heads/${before.branch}`;
   }
@@ -1810,19 +2531,28 @@ function captureManualPushTarget(root, before) {
     destination,
     destinationBranch,
     trackingRef: `refs/remotes/${remote}/${destinationBranch}`,
-    expectedTrackingCommit: before.upstream ? tryGit(root, ["rev-parse", "--verify", before.upstream]) : null,
-    url: assertSafeAutomaticTransport(root, remote, { push: true })
+    expectedTrackingCommit: before.upstream
+      ? tryGit(root, ["rev-parse", "--verify", before.upstream])
+      : null,
+    url: assertSafeAutomaticTransport(root, remote, { push: true }),
   };
 }
 
 function reconcileRemoteTracking(root, target, commit) {
   try {
-    gitForWrite(root, [
-      "update-ref", "-m", "FileGRC exact push",
-      target.trackingRef,
-      commit,
-      target.expectedTrackingCommit || "0000000000000000000000000000000000000000"
-    ], "reconcile the remote-tracking branch after a successful push");
+    gitForWrite(
+      root,
+      [
+        "update-ref",
+        "-m",
+        "FileGRC exact push",
+        target.trackingRef,
+        commit,
+        target.expectedTrackingCommit ||
+          "0000000000000000000000000000000000000000",
+      ],
+      "reconcile the remote-tracking branch after a successful push",
+    );
     return null;
   } catch (error) {
     return `${error.message} The exact commit was pushed, but the local remote-tracking branch needs reconciliation with Git.`;
@@ -1832,24 +2562,43 @@ function reconcileRemoteTracking(root, target, commit) {
 function exactPushArgs(target, commit) {
   const expected = target.expectedTrackingCommit || "";
   return [
-    "-c", "push.pushOption=",
-    "push", "--porcelain", "--no-follow-tags", "--recurse-submodules=no", "--no-signed", "--no-push-option",
+    "-c",
+    "push.pushOption=",
+    "push",
+    "--porcelain",
+    "--no-follow-tags",
+    "--recurse-submodules=no",
+    "--no-signed",
+    "--no-push-option",
     `--force-with-lease=${target.destination}:${expected}`,
-    "--", target.url, `${commit}:${target.destination}`
+    "--",
+    target.url,
+    `${commit}:${target.destination}`,
   ];
 }
 
 function syncReadySummary(root, action) {
   const summary = getGitSummary(root);
-  if (!summary.available) throw new Error(`Git history is unavailable for this workspace, so filegrc cannot ${action}.`);
-  if (!summary.branch) throw new Error(`Check out a branch before trying to ${action}.`);
-  if (!summary.clean) throw new Error(`Commit or discard workspace changes before trying to ${action}.`);
+  if (!summary.available)
+    throw new Error(
+      `Git history is unavailable for this workspace, so filegrc cannot ${action}.`,
+    );
+  if (!summary.branch)
+    throw new Error(`Check out a branch before trying to ${action}.`);
+  if (!summary.clean)
+    throw new Error(
+      `Commit or discard workspace changes before trying to ${action}.`,
+    );
   return summary;
 }
 
 async function getRepositoryConfig(input) {
-  const loaded = input?.entries && input?.root ? input : await loadWorkspace(input);
-  const renderer = loaded.resources.find(({ type, id }) => type === "renderer-settings" && id === "renderer-settings");
+  const loaded =
+    input?.entries && input?.root ? input : await loadWorkspace(input);
+  const renderer = loaded.resources.find(
+    ({ type, id }) =>
+      type === "renderer-settings" && id === "renderer-settings",
+  );
   const mode = renderer?.repositoryMode;
   const authoritativeBranch = cleanGitName(renderer?.authoritativeBranch);
   const remote = cleanGitName(renderer?.repositoryRemote);
@@ -1860,15 +2609,17 @@ async function getRepositoryConfig(input) {
     configurationError: !["trunk", "manual"].includes(mode)
       ? "Repository mode is missing or invalid. Run the model migration or update renderer settings."
       : !isSafeGitName(authoritativeBranch)
-      ? "The configured authoritative branch is not a safe Git branch name. Update renderer settings before using browser writes."
-      : !isSafeGitName(remote)
-        ? "The configured repository remote is not a safe Git remote name. Update renderer settings before using browser writes."
-        : null
+        ? "The configured authoritative branch is not a safe Git branch name. Update renderer settings before using browser writes."
+        : !isSafeGitName(remote)
+          ? "The configured repository remote is not a safe Git remote name. Update renderer settings before using browser writes."
+          : null,
   };
 }
 
 function inspectTrunkRepository(root, config, summary, options = {}) {
-  const background = options.ignoreBackground ? null : backgroundSynchronizations.get(root);
+  const background = options.ignoreBackground
+    ? null
+    : backgroundSynchronizations.get(root);
   const base = {
     mode: "trunk",
     authoritativeBranch: config.authoritativeBranch,
@@ -1880,34 +2631,44 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
     behind: null,
     pendingCommits: [],
     pendingCommitsFilegrcOnly: null,
-    lastSuccessfulSynchronization: lastSuccessfulSynchronizations.get(root) ?? null,
+    lastSuccessfulSynchronization:
+      lastSuccessfulSynchronizations.get(root) ?? null,
     wholeWorktreeClean: summary.available ? summary.wholeWorktreeClean : null,
     operationInProgress: summary.available ? summary.operationInProgress : null,
-    backgroundSynchronization: background ? {
-      status: background.status,
-      commit: background.commit,
-      shortCommit: background.shortCommit,
-      startedAt: background.startedAt,
-      finishedAt: background.finishedAt ?? null,
-      remotePushed: background.remotePushed === true,
-      error: background.error
-    } : null,
-    writesAllowed: false
+    backgroundSynchronization: background
+      ? {
+          status: background.status,
+          commit: background.commit,
+          shortCommit: background.shortCommit,
+          startedAt: background.startedAt,
+          finishedAt: background.finishedAt ?? null,
+          remotePushed: background.remotePushed === true,
+          error: background.error,
+        }
+      : null,
+    writesAllowed: false,
   };
   if (config.configurationError) {
     return {
       ...base,
       status: "git-setup-required",
       label: "Git setup required",
-      message: config.configurationError
+      message: config.configurationError,
     };
   }
   if (!summary.available) {
     return {
       ...base,
-      status: summary.error?.kind === "missing-executable" ? "git-setup-required" : "git-error",
-      label: summary.error?.kind === "missing-executable" ? "Git setup required" : "Git error",
-      message: summary.message || "Git history is unavailable for this workspace."
+      status:
+        summary.error?.kind === "missing-executable"
+          ? "git-setup-required"
+          : "git-error",
+      label:
+        summary.error?.kind === "missing-executable"
+          ? "Git setup required"
+          : "Git error",
+      message:
+        summary.message || "Git history is unavailable for this workspace.",
     };
   }
   if (summary.branch !== config.authoritativeBranch) {
@@ -1915,7 +2676,8 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
       ...base,
       status: "read-only-checkout",
       label: "Read-only checkout",
-      message: "This checkout is not the authoritative FileGRC branch. You can review the program here, but browser changes are disabled. Run FileGRC from the main checkout or use the explicit development override."
+      message:
+        "This checkout is not the authoritative FileGRC branch. You can review the program here, but browser changes are disabled. Run FileGRC from the main checkout or use the explicit development override.",
     };
   }
   if (!summary.remotes.includes(config.remote)) {
@@ -1923,7 +2685,7 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
       ...base,
       status: "git-setup-required",
       label: "Git setup required",
-      message: `The configured Git remote "${config.remote}" does not exist. Add it and configure the authoritative branch upstream before using browser writes.`
+      message: `The configured Git remote "${config.remote}" does not exist. Add it and configure the authoritative branch upstream before using browser writes.`,
     };
   }
   const expectedUpstream = `${config.remote}/${config.authoritativeBranch}`;
@@ -1932,7 +2694,7 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
       ...base,
       status: "git-setup-required",
       label: "Git setup required",
-      message: `The authoritative branch must track ${expectedUpstream}. Configure that upstream with Git before using browser writes.`
+      message: `The authoritative branch must track ${expectedUpstream}. Configure that upstream with Git before using browser writes.`,
     };
   }
   const upstreamCommit = summary.upstreamCommit;
@@ -1945,14 +2707,14 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
     ahead: counts.ahead,
     behind: counts.behind,
     pendingCommits,
-    pendingCommitsFilegrcOnly
+    pendingCommitsFilegrcOnly,
   };
   if (base.operationInProgress) {
     return {
       ...details,
       status: "not-synced",
       label: "Not synced",
-      message: `A Git ${base.operationInProgress} is in progress. Finish or abort it with Git before using browser writes.`
+      message: `A Git ${base.operationInProgress} is in progress. Finish or abort it with Git before using browser writes.`,
     };
   }
   if (!base.wholeWorktreeClean) {
@@ -1960,17 +2722,21 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
       ...details,
       status: "not-synced",
       label: "Not synced",
-      message: "The Git worktree has uncommitted changes. Commit, discard, or move them with Git before using browser writes."
+      message:
+        "The Git worktree has uncommitted changes. Commit, discard, or move them with Git before using browser writes.",
     };
   }
-  if (background?.status === "syncing" && background.commit === summary.commit) {
+  if (
+    background?.status === "syncing" &&
+    background.commit === summary.commit
+  ) {
     return {
       ...details,
       status: "syncing",
       label: "Syncing",
       message: `The FileGRC commit ${background.shortCommit} is saved locally and is being pushed to ${expectedUpstream}.`,
       writesAllowed: false,
-      retrySafe: false
+      retrySafe: false,
     };
   }
   if (counts.ahead === null || counts.behind === null) {
@@ -1978,34 +2744,38 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
       ...details,
       status: "git-setup-required",
       label: "Git setup required",
-      message: `The upstream ${expectedUpstream} is unavailable locally. Fetch ${config.remote} with Git, then reload.`
+      message: `The upstream ${expectedUpstream} is unavailable locally. Fetch ${config.remote} with Git, then reload.`,
     };
   }
   if (counts.ahead > 0 || counts.behind > 0) {
     const external = counts.ahead > 0 && !pendingCommitsFilegrcOnly;
-    const backgroundFailure = background?.status === "failed"
-      && background.commit === summary.commit
-      && (background.remotePushed === true || (
-        counts.ahead > 0
-        && counts.behind === 0
-        && pendingCommitsFilegrcOnly
-      ))
-      ? background.error
-      : null;
+    const backgroundFailure =
+      background?.status === "failed" &&
+      background.commit === summary.commit &&
+      (background.remotePushed === true ||
+        (counts.ahead > 0 && counts.behind === 0 && pendingCommitsFilegrcOnly))
+        ? background.error
+        : null;
     return {
       ...details,
       status: "not-synced",
       label: "Not synced",
-      message: backgroundFailure || (external
-        ? "A commit ahead of upstream changes files outside this FileGRC workspace. Reconcile it with Git. FileGRC will not push it."
-        : counts.ahead > 0 && counts.behind > 0
-          ? "The authoritative branch has diverged from upstream. Reconcile it with Git. FileGRC will not merge or rebase it."
-          : counts.ahead > 0
-            ? "FileGRC-only commits are waiting to be pushed. Use Retry sync."
-            : "The authoritative branch is behind upstream. Fast-forward it with Git, then reload FileGRC."),
+      message:
+        backgroundFailure ||
+        (external
+          ? "A commit ahead of upstream changes files outside this FileGRC workspace. Reconcile it with Git. FileGRC will not push it."
+          : counts.ahead > 0 && counts.behind > 0
+            ? "The authoritative branch has diverged from upstream. Reconcile it with Git. FileGRC will not merge or rebase it."
+            : counts.ahead > 0
+              ? "FileGRC-only commits are waiting to be pushed. Use Retry sync."
+              : "The authoritative branch is behind upstream. Fast-forward it with Git, then reload FileGRC."),
       writesAllowed: false,
-      retrySafe: counts.ahead > 0 && counts.behind === 0 && pendingCommitsFilegrcOnly && background?.remotePushed !== true,
-      backgroundSyncError: backgroundFailure
+      retrySafe:
+        counts.ahead > 0 &&
+        counts.behind === 0 &&
+        pendingCommitsFilegrcOnly &&
+        background?.remotePushed !== true,
+      backgroundSyncError: backgroundFailure,
     };
   }
   return {
@@ -2014,7 +2784,7 @@ function inspectTrunkRepository(root, config, summary, options = {}) {
     label: "Synced",
     message: `The authoritative branch is synchronized with ${expectedUpstream}.`,
     writesAllowed: true,
-    retrySafe: false
+    retrySafe: false,
   };
 }
 
@@ -2023,58 +2793,99 @@ async function requireTrunkPreconditionsAsync(root, config, options = {}) {
   const state = inspectTrunkRepository(root, config, summary);
   if (config.configurationError) throw new Error(state.message);
   if (!summary.available) throw summary.error || new Error(state.message);
-  if (summary.branch !== config.authoritativeBranch) throw new Error(state.message);
+  if (summary.branch !== config.authoritativeBranch)
+    throw new Error(state.message);
   if (!summary.remotes.includes(config.remote)) throw new Error(state.message);
-  if (summary.upstream !== `${config.remote}/${config.authoritativeBranch}`) throw new Error(state.message);
+  if (summary.upstream !== `${config.remote}/${config.authoritativeBranch}`)
+    throw new Error(state.message);
   if (
-    state.backgroundSynchronization?.status === "syncing"
-    && state.backgroundSynchronization.commit !== options.backgroundCommit
+    state.backgroundSynchronization?.status === "syncing" &&
+    state.backgroundSynchronization.commit !== options.backgroundCommit
   ) {
-    throw new Error("A FileGRC background push is still finalizing. Wait for it to finish before making another browser change.");
+    throw new Error(
+      "A FileGRC background push is still finalizing. Wait for it to finish before making another browser change.",
+    );
   }
   if (state.operationInProgress) throw new Error(state.message);
   if (!state.wholeWorktreeClean) throw new Error(state.message);
+  assertNoIgnoredAuthoritativeFiles(root);
   if (!options.allowAhead && state.ahead > 0) {
-    throw new Error("The authoritative branch has local commits waiting to be pushed. Use Retry sync before making another browser change.");
+    throw new Error(
+      "The authoritative branch has local commits waiting to be pushed. Use Retry sync before making another browser change.",
+    );
   }
   return state;
 }
 
 async function fetchConfiguredRemote(root, config) {
   const url = assertSafeAutomaticTransport(root, config.remote);
-  return measureTiming("fetch", () => gitForWriteAsync(
-    root,
-    exactFetchArgs({ remote: config.remote, branch: config.authoritativeBranch, url }),
-    `fetch ${config.remote}`
-  ));
+  return measureTiming("fetch", () =>
+    gitForWriteAsync(
+      root,
+      exactFetchArgs({
+        remote: config.remote,
+        branch: config.authoritativeBranch,
+        url,
+      }),
+      `fetch ${config.remote}`,
+    ),
+  );
 }
 
 function exactFetchArgs({ remote, branch, url }) {
   return [
-    "fetch", "--prune", "--no-prune-tags", "--no-tags", "--recurse-submodules=no",
-    "--", url, `+refs/heads/${branch}:refs/remotes/${remote}/${branch}`
+    "fetch",
+    "--prune",
+    "--no-prune-tags",
+    "--no-tags",
+    "--recurse-submodules=no",
+    "--",
+    url,
+    `+refs/heads/${branch}:refs/remotes/${remote}/${branch}`,
   ];
 }
 
 function assertCommitsInsideWorkspace(root, commits) {
   const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
   const prefix = relative(topLevel, root).split(sep).join("/");
-  if (prefix === ".." || prefix.startsWith("../")) throw new Error("The FileGRC workspace is outside its Git repository.");
+  if (prefix === ".." || prefix.startsWith("../"))
+    throw new Error("The FileGRC workspace is outside its Git repository.");
   if (!prefix) return;
   for (const commit of commits) {
-    const changed = nulFields(gitRaw(topLevel, [
-      "diff-tree", "--root", "--no-commit-id", "--name-only", "-z", "-m", "-r", commit, "--"
-    ]));
-    const outside = changed.filter((path) => !pathInsideWorkspace(path, prefix));
+    const changed = nulFields(
+      gitRaw(topLevel, [
+        "diff-tree",
+        "--root",
+        "--no-commit-id",
+        "--name-only",
+        "-z",
+        "-m",
+        "-r",
+        commit,
+        "--",
+      ]),
+    );
+    const outside = changed.filter(
+      (path) => !pathInsideWorkspace(path, prefix),
+    );
     if (outside.length) {
-      throw new Error(`FileGRC will not rebase commit ${commit.slice(0, 12)} because it changes files outside this nested workspace: ${outside.slice(0, 5).join(", ")}${outside.length > 5 ? "…" : ""}. Reconcile the whole repository with Git.`);
+      throw new Error(
+        `FileGRC will not rebase commit ${commit.slice(0, 12)} because it changes files outside this nested workspace: ${outside.slice(0, 5).join(", ")}${outside.length > 5 ? "…" : ""}. Reconcile the whole repository with Git.`,
+      );
     }
   }
 }
 
-async function pushConfiguredBranch(root, config, source, expectedTrackingCommit) {
+async function pushConfiguredBranch(
+  root,
+  config,
+  source,
+  expectedTrackingCommit,
+) {
   if (!/^[a-f0-9]{40}$/i.test(source)) {
-    throw new Error("FileGRC requires an exact commit ID before pushing the authoritative branch.");
+    throw new Error(
+      "FileGRC requires an exact commit ID before pushing the authoritative branch.",
+    );
   }
   const url = assertSafeAutomaticTransport(root, config.remote, { push: true });
   const target = {
@@ -2082,31 +2893,44 @@ async function pushConfiguredBranch(root, config, source, expectedTrackingCommit
     url,
     destination: `refs/heads/${config.authoritativeBranch}`,
     trackingRef: `refs/remotes/${config.remote}/${config.authoritativeBranch}`,
-    expectedTrackingCommit
+    expectedTrackingCommit,
   };
-  await measureTiming("push", () => gitForWriteAsync(
+  await measureTiming("push", () =>
+    gitForWriteAsync(
+      root,
+      exactPushArgs(target, source),
+      `push ${config.authoritativeBranch} to ${config.remote}`,
+      {
+        expectedCheckout: {
+          expectedRef: `refs/heads/${config.authoritativeBranch}`,
+          expectedCommit: source,
+        },
+      },
+    ),
+  );
+  const trackingError = await reconcileRemoteTrackingAsync(
     root,
-    exactPushArgs(target, source),
-    `push ${config.authoritativeBranch} to ${config.remote}`,
-    {
-      expectedCheckout: {
-        expectedRef: `refs/heads/${config.authoritativeBranch}`,
-        expectedCommit: source
-      }
-    }
-  ));
-  const trackingError = await reconcileRemoteTrackingAsync(root, target, source);
+    target,
+    source,
+  );
   return { remotePushed: true, trackingError };
 }
 
 async function reconcileRemoteTrackingAsync(root, target, commit) {
   try {
-    await gitForWriteAsync(root, [
-      "update-ref", "-m", "FileGRC exact push",
-      target.trackingRef,
-      commit,
-      target.expectedTrackingCommit || "0000000000000000000000000000000000000000"
-    ], "reconcile the remote-tracking branch after a successful push");
+    await gitForWriteAsync(
+      root,
+      [
+        "update-ref",
+        "-m",
+        "FileGRC exact push",
+        target.trackingRef,
+        commit,
+        target.expectedTrackingCommit ||
+          "0000000000000000000000000000000000000000",
+      ],
+      "reconcile the remote-tracking branch after a successful push",
+    );
     return null;
   } catch (error) {
     return `${error.message} The exact commit was pushed, but the local remote-tracking branch needs reconciliation with Git.`;
@@ -2115,32 +2939,52 @@ async function reconcileRemoteTrackingAsync(root, target, commit) {
 
 function assertSafeAutomaticTransport(root, remote, options = {}) {
   assertNoRepositoryExecutableGitConfig(root);
-  const url = tryGit(root, ["remote", "get-url", ...(options.push ? ["--push"] : []), "--", remote]);
-  const safe = url
-    && !/[\0\r\n]/.test(url)
-    && (
-      /^(?:https?|ssh|file):\/\//i.test(url)
-      || /^(?:\.\.?[\\/]|[\\/]|[A-Za-z]:[\\/])/.test(url)
-      || /^[^\s/@:]+@[^\s/:]+:.+$/.test(url)
-    );
+  const url = tryGit(root, [
+    "remote",
+    "get-url",
+    ...(options.push ? ["--push"] : []),
+    "--",
+    remote,
+  ]);
+  const safe =
+    url &&
+    !/[\0\r\n]/.test(url) &&
+    (/^(?:https?|ssh|file):\/\//i.test(url) ||
+      /^(?:\.\.?[\\/]|[\\/]|[A-Za-z]:[\\/])/.test(url) ||
+      /^[^\s/@:]+@[^\s/:]+:.+$/.test(url));
   if (!safe) {
-    throw new Error(`FileGRC will not use the configured remote "${remote}" because its URL scheme is not allowed for automatic fetch or push.`);
+    throw new Error(
+      `FileGRC will not use the configured remote "${remote}" because its URL scheme is not allowed for automatic fetch or push.`,
+    );
   }
   return url;
 }
 
 function assertNoRepositoryExecutableGitConfig(root) {
   assertWorkspaceInsideGitWorktree(root);
-  const pattern = "^(core\\.(sshcommand|gitproxy|askpass|alternaterefscommand|worktree|sparsecheckout.*)|credential\\.(helper|.*\\.helper)|fetch\\.bundleuri|filter\\..*\\.(clean|smudge|process)|merge\\..*\\.driver|http\\..*|remote\\..*\\.(proxy|uploadpack|receivepack)|url\\..*\\.(insteadof|pushinsteadof)|protocol\\..*\\.allow)$";
+  const pattern =
+    "^(core\\.(sshcommand|gitproxy|askpass|alternaterefscommand|worktree|sparsecheckout.*)|credential\\.(helper|.*\\.helper)|fetch\\.bundleuri|filter\\..*\\.(clean|smudge|process)|merge\\..*\\.driver|http\\..*|remote\\..*\\.(proxy|uploadpack|receivepack)|url\\..*\\.(insteadof|pushinsteadof)|protocol\\..*\\.allow)$";
   const scopes = ["--local"];
-  if (gitOptionalMatch(root, ["config", "--local", "--type=bool", "--get", "extensions.worktreeConfig"]) === "true") {
+  if (
+    gitOptionalMatch(root, [
+      "config",
+      "--local",
+      "--type=bool",
+      "--get",
+      "extensions.worktreeConfig",
+    ]) === "true"
+  ) {
     scopes.push("--worktree");
   }
   const executableConfiguration = scopes
-    .map((scope) => gitOptionalMatch(root, ["config", scope, "--get-regexp", pattern]))
+    .map((scope) =>
+      gitOptionalMatch(root, ["config", scope, "--get-regexp", pattern]),
+    )
     .find(Boolean);
   if (executableConfiguration) {
-    throw new Error("FileGRC will not run managed Git synchronization while repository-local executable transport, filter, merge, HTTP, credential, URL rewrite, or protocol configuration is present. Move trusted user and transport settings to normal user-level Git configuration and remove the local override.");
+    throw new Error(
+      "FileGRC will not run managed Git synchronization while repository-local executable transport, filter, merge, HTTP, credential, URL rewrite, or protocol configuration is present. Move trusted user and transport settings to normal user-level Git configuration and remove the local override.",
+    );
   }
   assertNoHiddenIndexEntries(root);
 }
@@ -2149,19 +2993,25 @@ function assertWorkspaceInsideGitWorktree(root) {
   const workspace = realpathSync(root);
   const topLevel = realpathSync(git(root, ["rev-parse", "--show-toplevel"]));
   if (workspace !== topLevel && !workspace.startsWith(`${topLevel}${sep}`)) {
-    throw new Error("FileGRC will not run managed Git writes because repository configuration redirects the Git worktree outside this workspace. Remove core.worktree and reopen the authoritative checkout.");
+    throw new Error(
+      "FileGRC will not run managed Git writes because repository configuration redirects the Git worktree outside this workspace. Remove core.worktree and reopen the authoritative checkout.",
+    );
   }
 }
 
 function assertExpectedCheckout(root, expectedRef, expectedCommit) {
   if (!checkoutMatches(root, expectedRef, expectedCommit)) {
-    throw new Error("The checked-out Git branch or commit changed while FileGRC prepared the operation. Review the worktree and return to the expected branch before trying again.");
+    throw new Error(
+      "The checked-out Git branch or commit changed while FileGRC prepared the operation. Review the worktree and return to the expected branch before trying again.",
+    );
   }
 }
 
 function checkoutMatches(root, expectedRef, expectedCommit) {
-  return tryGit(root, ["symbolic-ref", "--quiet", "HEAD"]) === expectedRef
-    && tryGit(root, ["rev-parse", "HEAD"]) === expectedCommit;
+  return (
+    tryGit(root, ["symbolic-ref", "--quiet", "HEAD"]) === expectedRef &&
+    tryGit(root, ["rev-parse", "HEAD"]) === expectedCommit
+  );
 }
 
 function assertValidGitIdentity(root) {
@@ -2169,38 +3019,74 @@ function assertValidGitIdentity(root) {
     git(root, ["var", "GIT_AUTHOR_IDENT"]);
     git(root, ["var", "GIT_COMMITTER_IDENT"]);
   } catch {
-    throw new Error("Configure valid git user.name and git user.email values before FileGRC creates commits. The saved files remain uncommitted and later browser changes are blocked.");
+    throw new Error(
+      "Configure valid git user.name and git user.email values before FileGRC creates commits. The saved files remain uncommitted and later browser changes are blocked.",
+    );
   }
 }
 
 async function assertNoOutsideWorktreeChangesAsync(root) {
-  const topLevel = (await runGitCommand(root, ["rev-parse", "--show-toplevel"], {
-    operation: "locate the repository before checking worktree changes"
-  })).trim();
+  const topLevel = (
+    await runGitCommand(root, ["rev-parse", "--show-toplevel"], {
+      operation: "locate the repository before checking worktree changes",
+    })
+  ).trim();
   const prefix = relative(topLevel, root).split(sep).join("/");
-  const output = await runGitCommand(topLevel, ["status", "--porcelain=v1", "-z", "--untracked-files=all"], {
-    operation: "inspect worktree changes"
-  });
+  const output = await runGitCommand(
+    topLevel,
+    ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
+    {
+      operation: "inspect worktree changes",
+    },
+  );
   const paths = statusPathsFromRaw(output);
   if (paths.some((path) => !pathInsideWorkspace(path, prefix))) {
-    throw new Error("Files outside this FileGRC workspace changed while the browser action was running. FileGRC preserved the current worktree; reconcile the Git diff before another browser mutation.");
+    throw new Error(
+      "Files outside this FileGRC workspace changed while the browser action was running. FileGRC preserved the current worktree; reconcile the Git diff before another browser mutation.",
+    );
   }
 }
 
 function assertNoWorkspaceContentFilters(root) {
-  const paths = [...new Set(nulFields(gitRaw(root, [
-    "ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", "."
-  ])))];
+  const paths = [
+    ...new Set(
+      nulFields(
+        gitRaw(root, [
+          "ls-files",
+          "-z",
+          "--cached",
+          "--others",
+          "--exclude-standard",
+          "--",
+          ".",
+        ]),
+      ),
+    ),
+  ];
   for (let offset = 0; offset < paths.length; offset += 256) {
     const batch = paths.slice(offset, offset + 256);
-    const attributes = nulFields(gitRaw(root, ["check-attr", "-z", "filter", "merge", "--", ...batch]));
+    const attributes = nulFields(
+      gitRaw(root, ["check-attr", "-z", "filter", "merge", "--", ...batch]),
+    );
     for (let index = 0; index < attributes.length; index += 3) {
       const [path, attribute, value] = attributes.slice(index, index + 3);
-      if (attribute === "filter" && value && !["unspecified", "unset"].includes(value)) {
-        throw new Error(`FileGRC will not commit "${path}" because Git content filter "${value}" could change or execute while staging authoritative files. Remove the filter attribute and review the resulting diff.`);
+      if (
+        attribute === "filter" &&
+        value &&
+        !["unspecified", "unset"].includes(value)
+      ) {
+        throw new Error(
+          `FileGRC will not commit "${path}" because Git content filter "${value}" could change or execute while staging authoritative files. Remove the filter attribute and review the resulting diff.`,
+        );
       }
-      if (attribute === "merge" && value && !["unspecified", "unset", "set"].includes(value)) {
-        throw new Error(`FileGRC will not manage "${path}" because Git merge driver "${value}" could execute while synchronizing authoritative files. Remove the named merge attribute and review the resulting diff.`);
+      if (
+        attribute === "merge" &&
+        value &&
+        !["unspecified", "unset", "set"].includes(value)
+      ) {
+        throw new Error(
+          `FileGRC will not manage "${path}" because Git merge driver "${value}" could execute while synchronizing authoritative files. Remove the named merge attribute and review the resulting diff.`,
+        );
       }
     }
   }
@@ -2213,34 +3099,72 @@ function assertNoCommitWorkspaceContentFilters(root, commit) {
   if (prefix === ".." || prefix.startsWith("../")) {
     throw new Error("The FileGRC workspace is outside its Git repository.");
   }
-  const exactCommit = git(root, ["rev-parse", "--verify", `${commit}^{commit}`]);
-  const paths = nulFields(gitRaw(topLevel, [
-    "ls-tree", "-r", "-z", exactCommit, "--", prefix || "."
-  ])).map((entry) => {
+  const exactCommit = git(root, [
+    "rev-parse",
+    "--verify",
+    `${commit}^{commit}`,
+  ]);
+  const paths = nulFields(
+    gitRaw(topLevel, ["ls-tree", "-r", "-z", exactCommit, "--", prefix || "."]),
+  ).map((entry) => {
     const separator = entry.indexOf("\t");
-    const metadata = separator === -1 ? [] : entry.slice(0, separator).split(" ");
+    const metadata =
+      separator === -1 ? [] : entry.slice(0, separator).split(" ");
     const path = separator === -1 ? "" : entry.slice(separator + 1);
     const [mode, type, objectId] = metadata;
-    if (!/^(?:100644|100755)$/.test(mode || "") || type !== "blob" || !/^[a-f0-9]+$/i.test(objectId || "") || !path) {
-      throw new Error(`FileGRC will not check out incoming commit ${exactCommit.slice(0, 12)} because its workspace tree contains a non-regular entry. Replace symlinks and submodules with regular, reviewable files before synchronizing.`);
+    if (
+      !/^(?:100644|100755)$/.test(mode || "") ||
+      type !== "blob" ||
+      !/^[a-f0-9]+$/i.test(objectId || "") ||
+      !path
+    ) {
+      throw new Error(
+        `FileGRC will not check out incoming commit ${exactCommit.slice(0, 12)} because its workspace tree contains a non-regular entry. Replace symlinks and submodules with regular, reviewable files before synchronizing.`,
+      );
     }
     return path;
   });
-  const indexFile = resolve(gitDirectory, `filegrc-inspection-index-${randomUUID()}`);
+  const indexFile = resolve(
+    gitDirectory,
+    `filegrc-inspection-index-${randomUUID()}`,
+  );
   try {
-    gitForWrite(topLevel, ["read-tree", exactCommit], "inspect the incoming Git tree", { gitIndexFile: indexFile });
+    gitForWrite(
+      topLevel,
+      ["read-tree", exactCommit],
+      "inspect the incoming Git tree",
+      { gitIndexFile: indexFile },
+    );
     for (let offset = 0; offset < paths.length; offset += 256) {
       const batch = paths.slice(offset, offset + 256);
-      const attributes = nulFields(gitRaw(topLevel, ["check-attr", "-z", "--cached", "filter", "merge", "--", ...batch], {
-        gitIndexFile: indexFile
-      }));
+      const attributes = nulFields(
+        gitRaw(
+          topLevel,
+          ["check-attr", "-z", "--cached", "filter", "merge", "--", ...batch],
+          {
+            gitIndexFile: indexFile,
+          },
+        ),
+      );
       for (let index = 0; index < attributes.length; index += 3) {
         const [path, attribute, value] = attributes.slice(index, index + 3);
-        if (attribute === "filter" && value && !["unspecified", "unset"].includes(value)) {
-          throw new Error(`FileGRC will not check out incoming commit ${exactCommit.slice(0, 12)} because "${path}" uses Git content filter "${value}". Remove the filter attribute in a reviewed Git change before synchronizing.`);
+        if (
+          attribute === "filter" &&
+          value &&
+          !["unspecified", "unset"].includes(value)
+        ) {
+          throw new Error(
+            `FileGRC will not check out incoming commit ${exactCommit.slice(0, 12)} because "${path}" uses Git content filter "${value}". Remove the filter attribute in a reviewed Git change before synchronizing.`,
+          );
         }
-        if (attribute === "merge" && value && !["unspecified", "unset", "set"].includes(value)) {
-          throw new Error(`FileGRC will not check out incoming commit ${exactCommit.slice(0, 12)} because "${path}" uses Git merge driver "${value}". Remove the named merge attribute in a reviewed Git change before synchronizing.`);
+        if (
+          attribute === "merge" &&
+          value &&
+          !["unspecified", "unset", "set"].includes(value)
+        ) {
+          throw new Error(
+            `FileGRC will not check out incoming commit ${exactCommit.slice(0, 12)} because "${path}" uses Git merge driver "${value}". Remove the named merge attribute in a reviewed Git change before synchronizing.`,
+          );
         }
       }
     }
@@ -2251,103 +3175,239 @@ function assertNoCommitWorkspaceContentFilters(root, commit) {
 }
 
 function assertNoIgnoredAuthoritativeFiles(root) {
-  const ignored = nulFields(gitRaw(root, [
-    "ls-files", "-z", "--others", "--ignored", "--exclude-standard", "--", "data"
-  ]));
+  const ignored = ignoredAuthoritativeFiles(root);
   if (ignored.length) {
-    throw new Error(`FileGRC will not commit while authoritative data files are ignored by Git: ${ignored.slice(0, 5).join(", ")}${ignored.length > 5 ? "…" : ""}. Remove the ignore rule and review the complete staged diff.`);
+    throw new Error(
+      `FileGRC will not commit while authoritative data files are ignored by Git: ${ignored.slice(0, 5).join(", ")}${ignored.length > 5 ? "…" : ""}. Remove the ignore rule and review the complete staged diff.`,
+    );
   }
 }
 
+function ignoredAuthoritativeFiles(root) {
+  return nulFields(
+    gitRaw(root, [
+      "ls-files",
+      "-z",
+      "--others",
+      "--ignored",
+      "--exclude-standard",
+      "--",
+      "data",
+    ]),
+  );
+}
+
 function workspaceByteManifest(root) {
   assertNoHiddenIndexEntries(root);
-  const paths = [...new Set(nulFields(gitRaw(root, [
-    "ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", "."
-  ])))].sort();
+  const objectFormat = repositoryObjectFormat(root);
+  if (!objectFormat)
+    throw new Error(
+      "FileGRC could not determine the Git repository object format.",
+    );
+  const paths = [
+    ...new Set(
+      nulFields(
+        gitRaw(root, [
+          "ls-files",
+          "-z",
+          "--cached",
+          "--others",
+          "--exclude-standard",
+          "--",
+          ".",
+        ]),
+      ),
+    ),
+  ].sort();
   const workspace = realpathSync(root);
-  return new Map(paths.map((path) => {
-    if (!path || path.startsWith("/") || path.split("/").includes("..") || /[\0\r\n]/.test(path)) {
-      throw new Error("Git reported an unsafe workspace path. Reconcile the worktree before committing.");
-    }
-    const absolute = resolve(root, path);
-    let stat;
-    try {
-      stat = lstatSync(absolute);
-    } catch (error) {
-      if (error?.code === "ENOENT") return [path, { objectId: null, mode: null }];
-      throw error;
-    }
-    if (stat.isSymbolicLink()) {
-      throw new Error(`FileGRC will not commit symbolic link "${path}". Store authoritative content as a regular file and review its target explicitly.`);
-    }
-    if (!stat.isFile()) {
-      throw new Error(`FileGRC will not commit non-file workspace entry "${path}".`);
-    }
-    const descriptor = openSync(absolute, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
-    try {
-      const opened = fstatSync(descriptor);
-      const resolved = realpathSync(absolute);
-      const current = lstatSync(absolute);
+  return new Map(
+    paths.map((path) => {
       if (
-        !opened.isFile()
-        || (resolved !== workspace && !resolved.startsWith(`${workspace}${sep}`))
-        || current.isSymbolicLink()
-        || !current.isFile()
-        || opened.dev !== current.dev
-        || opened.ino !== current.ino
+        !path ||
+        path.startsWith("/") ||
+        path.split("/").includes("..") ||
+        /[\0\r\n]/.test(path)
       ) {
-        throw new Error(`FileGRC will not commit workspace entry "${path}" because it changed while its bytes were being inspected.`);
+        throw new Error(
+          "Git reported an unsafe workspace path. Reconcile the worktree before committing.",
+        );
       }
-      const bytes = readFileSync(descriptor);
-      const objectId = hashWorkspaceBytes(root, bytes);
-      return [path, { objectId, mode: opened.mode & 0o111 ? "100755" : "100644", bytes }];
-    } finally {
-      closeSync(descriptor);
-    }
-  }));
+      const absolute = resolve(root, path);
+      let stat;
+      try {
+        stat = lstatSync(absolute);
+      } catch (error) {
+        if (error?.code === "ENOENT")
+          return [path, { objectId: null, mode: null }];
+        throw error;
+      }
+      if (stat.isSymbolicLink()) {
+        throw new Error(
+          `FileGRC will not commit symbolic link "${path}". Store authoritative content as a regular file and review its target explicitly.`,
+        );
+      }
+      if (!stat.isFile()) {
+        throw new Error(
+          `FileGRC will not commit non-file workspace entry "${path}".`,
+        );
+      }
+      const descriptor = openSync(
+        absolute,
+        constants.O_RDONLY | (constants.O_NOFOLLOW || 0),
+      );
+      try {
+        const opened = fstatSync(descriptor);
+        const resolved = realpathSync(absolute);
+        const current = lstatSync(absolute);
+        if (
+          !opened.isFile() ||
+          (resolved !== workspace &&
+            !resolved.startsWith(`${workspace}${sep}`)) ||
+          current.isSymbolicLink() ||
+          !current.isFile() ||
+          opened.dev !== current.dev ||
+          opened.ino !== current.ino
+        ) {
+          throw new Error(
+            `FileGRC will not commit workspace entry "${path}" because it changed while its bytes were being inspected.`,
+          );
+        }
+        const objectHash = createHash(objectFormat).update(
+          `blob ${opened.size}\0`,
+        );
+        const byteHash = createHash("sha256");
+        const buffer = Buffer.allocUnsafe(64 * 1024);
+        let position = 0;
+        while (position < opened.size) {
+          const count = readSync(
+            descriptor,
+            buffer,
+            0,
+            Math.min(buffer.length, opened.size - position),
+            position,
+          );
+          if (!count)
+            throw new Error(
+              `FileGRC could not read complete workspace entry "${path}".`,
+            );
+          const chunk = buffer.subarray(0, count);
+          objectHash.update(chunk);
+          byteHash.update(chunk);
+          position += count;
+        }
+        const after = fstatSync(descriptor);
+        if (
+          after.size !== opened.size ||
+          after.dev !== opened.dev ||
+          after.ino !== opened.ino ||
+          after.mtimeMs !== opened.mtimeMs ||
+          after.ctimeMs !== opened.ctimeMs
+        ) {
+          throw new Error(
+            `FileGRC will not commit workspace entry "${path}" because it changed while its bytes were being inspected.`,
+          );
+        }
+        const calculatedObjectId = objectHash.digest("hex");
+        const objectId =
+          workspaceBlobObjectIdOverride?.(null, objectFormat, path) ??
+          calculatedObjectId;
+        return [
+          path,
+          {
+            objectId,
+            byteDigest: byteHash.digest("hex"),
+            size: opened.size,
+            mode: opened.mode & 0o111 ? "100755" : "100644",
+          },
+        ];
+      } finally {
+        closeSync(descriptor);
+      }
+    }),
+  );
 }
 
 function assertNoHiddenIndexEntries(root) {
-  const hidden = nulFields(gitRaw(root, ["ls-files", "-v", "-z", "--cached", "--", "."]))
-    .filter((entry) => entry[0] === "S" || entry[0] === entry[0]?.toLowerCase());
+  const hidden = nulFields(
+    gitRaw(root, ["ls-files", "-v", "-z", "--cached", "--", "."]),
+  ).filter((entry) => entry[0] === "S" || entry[0] === entry[0]?.toLowerCase());
   if (hidden.length) {
     const paths = hidden.slice(0, 5).map((entry) => entry.slice(2));
-    throw new Error(`FileGRC will not run managed Git operations while index entries use skip-worktree or assume-unchanged: ${paths.join(", ")}${hidden.length > 5 ? "…" : ""}. Clear those Git index flags and review the complete workspace diff.`);
+    throw new Error(
+      `FileGRC will not run managed Git operations while index entries use skip-worktree or assume-unchanged: ${paths.join(", ")}${hidden.length > 5 ? "…" : ""}. Clear those Git index flags and review the complete workspace diff.`,
+    );
   }
 }
 
-function hashWorkspaceBytes(root, bytes, write = false) {
-  return observedExecFileSync("git", ["hash-object", ...(write ? ["-w"] : []), "--stdin"], {
+function writeWorkspaceManifestObjects(root, manifest) {
+  const valuesByObjectId = new Map();
+  for (const value of manifest.values()) {
+    if (!value.objectId) continue;
+    const prior = valuesByObjectId.get(value.objectId);
+    if (
+      prior &&
+      (prior.size !== value.size || prior.byteDigest !== value.byteDigest)
+    ) {
+      throw new Error(
+        `Git object ${value.objectId} identifies different validated workspace bytes.`,
+      );
+    }
+    valuesByObjectId.set(value.objectId, value);
+  }
+  if (!valuesByObjectId.size) return manifest;
+  const entries = [...manifest].filter(([, value]) => value.objectId);
+  const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
+  const workspacePrefix = relative(topLevel, root).split(sep).join("/");
+  if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) {
+    throw new Error("The FileGRC workspace is outside its Git repository.");
+  }
+  const written = executeGitSync(root, ["hash-object", "-w", "--stdin-paths"], {
     cwd: root,
-    input: bytes,
+    input: `${entries.map(([path]) => (workspacePrefix ? `${workspacePrefix}/${path}` : path)).join("\n")}\n`,
     encoding: "utf8",
     stdio: ["pipe", "pipe", "ignore"],
     timeout: 30_000,
     maxBuffer: 20_000_000,
-    env: gitEnvironment()
-  }).trim();
-}
-
-function writeWorkspaceManifestObjects(root, manifest) {
-  return new Map([...manifest].map(([path, value]) => (
-    value.objectId
-      ? [path, { ...value, objectId: hashWorkspaceBytes(root, value.bytes, true) }]
-      : [path, value]
-  )));
+    env: gitEnvironment(),
+  })
+    .trim()
+    .split("\n");
+  if (written.length !== entries.length) {
+    throw new Error("Git returned an unexpected number of workspace objects.");
+  }
+  for (let index = 0; index < entries.length; index += 1) {
+    if (written[index] !== entries[index][1].objectId) {
+      throw new Error(
+        `Git wrote an unexpected object while preparing validated workspace bytes for commit.`,
+      );
+    }
+  }
+  assertWorkspaceManifestEqual(manifest, workspaceByteManifest(root));
+  return manifest;
 }
 
 function assertWorkspaceManifestEqual(expected, current) {
   if (!workspaceManifestsEqual(expected, current)) {
-    throw new Error("Workspace files changed while FileGRC was validating them. Review the concurrent edit and try the action again.");
+    throw new Error(
+      "Workspace files changed while FileGRC was validating them. Review the concurrent edit and try the action again.",
+    );
   }
 }
 
 function workspaceManifestsEqual(expected, current) {
-  return expected.size === current.size
-    && [...expected].every(([path, value]) => {
+  return (
+    expected.size === current.size &&
+    [...expected].every(([path, value]) => {
       const other = current.get(path);
-      return other && value.objectId === other.objectId && value.mode === other.mode;
-    });
+      return (
+        other &&
+        value.objectId === other.objectId &&
+        value.mode === other.mode &&
+        value.size === other.size &&
+        value.byteDigest === other.byteDigest
+      );
+    })
+  );
 }
 
 async function commitValidatedIndexAsync(root, subject, manifest, options) {
@@ -2356,39 +3416,72 @@ async function commitValidatedIndexAsync(root, subject, manifest, options) {
   const parent = options.expectedParent;
   const ref = options.expectedRef;
   assertExpectedCheckout(root, ref, parent);
-  const gitDirectory = await runGitCommand(root, ["rev-parse", "--absolute-git-dir"], { operation: "locate the repository index" });
-  const sharedIndex = resolve(root, await runGitCommand(root, ["rev-parse", "--git-path", "index"], { operation: "locate the shared repository index" }));
+  const gitDirectory = await runGitCommand(
+    root,
+    ["rev-parse", "--absolute-git-dir"],
+    { operation: "locate the repository index" },
+  );
+  const sharedIndex = resolve(
+    root,
+    await runGitCommand(root, ["rev-parse", "--git-path", "index"], {
+      operation: "locate the shared repository index",
+    }),
+  );
   const expectedSharedIndex = readFileSync(sharedIndex);
   const indexFile = resolve(gitDirectory, `filegrc-index-${randomUUID()}`);
-  const sharedUpdateIndex = resolve(gitDirectory, `filegrc-shared-index-${randomUUID()}`);
+  const sharedUpdateIndex = resolve(
+    gitDirectory,
+    `filegrc-shared-index-${randomUUID()}`,
+  );
   let indexReconciled = false;
   try {
     writeFileSync(sharedUpdateIndex, expectedSharedIndex);
     await applyManifestToIndexAsync(root, manifest, sharedUpdateIndex);
-    await runGitCommand(root, ["read-tree", parent], { operation: "initialize the private FileGRC index", gitIndexFile: indexFile });
+    await runGitCommand(root, ["read-tree", parent], {
+      operation: "initialize the private FileGRC index",
+      gitIndexFile: indexFile,
+    });
     await applyManifestToIndexAsync(root, manifest, indexFile);
-    const tree = await runGitCommand(root, ["write-tree"], { operation: "capture the validated FileGRC tree", gitIndexFile: indexFile });
-    const commit = await runGitCommand(root, ["commit-tree", tree, "-p", parent, "-m", subject], {
-      operation: "create the validated FileGRC browser commit",
-      timeoutMs: GIT_REMOTE_TIMEOUT_MS
+    const tree = await runGitCommand(root, ["write-tree"], {
+      operation: "capture the validated FileGRC tree",
+      gitIndexFile: indexFile,
     });
+    const commit = await runGitCommand(
+      root,
+      ["commit-tree", tree, "-p", parent, "-m", subject],
+      {
+        operation: "create the validated FileGRC browser commit",
+        timeoutMs: GIT_REMOTE_TIMEOUT_MS,
+      },
+    );
     assertNoGitOperationInProgress(root);
-    await runGitCommand(root, ["update-ref", "-m", subject, ref, commit, parent], {
-      operation: "advance the authoritative branch to the validated FileGRC commit",
-      expectedCheckout: { expectedRef: ref, expectedCommit: parent },
-      expectedNoOperation: true
-    });
+    await runGitCommand(
+      root,
+      ["update-ref", "-m", subject, ref, commit, parent],
+      {
+        operation:
+          "advance the authoritative branch to the validated FileGRC commit",
+        expectedCheckout: { expectedRef: ref, expectedCommit: parent },
+        expectedNoOperation: true,
+      },
+    );
     if (!gitOperationInProgress(root) && checkoutMatches(root, ref, commit)) {
-      indexReconciled = replaceSharedIndexIfUnchanged(sharedIndex, sharedUpdateIndex, expectedSharedIndex);
+      indexReconciled = replaceSharedIndexIfUnchanged(
+        sharedIndex,
+        sharedUpdateIndex,
+        expectedSharedIndex,
+      );
     }
     return { commit, indexReconciled: indexReconciled ?? false };
   } finally {
-    await Promise.all([
-      rm(indexFile, { force: true }),
-      rm(`${indexFile}.lock`, { force: true }),
-      rm(sharedUpdateIndex, { force: true }),
-      rm(`${sharedUpdateIndex}.lock`, { force: true })
-    ].map((cleanup) => cleanup.catch(() => undefined)));
+    await Promise.all(
+      [
+        rm(indexFile, { force: true }),
+        rm(`${indexFile}.lock`, { force: true }),
+        rm(sharedUpdateIndex, { force: true }),
+        rm(`${sharedUpdateIndex}.lock`, { force: true }),
+      ].map((cleanup) => cleanup.catch(() => undefined)),
+    );
   }
 }
 
@@ -2398,7 +3491,11 @@ function replaceSharedIndexIfUnchanged(sharedIndex, privateIndex, expected) {
   let installed = false;
   let ownsLock = false;
   try {
-    descriptor = openSync(lock, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o666);
+    descriptor = openSync(
+      lock,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
+      0o666,
+    );
     ownsLock = true;
     if (!readFileSync(sharedIndex).equals(expected)) return false;
     writeFileSync(descriptor, readFileSync(privateIndex));
@@ -2412,36 +3509,61 @@ function replaceSharedIndexIfUnchanged(sharedIndex, privateIndex, expected) {
     return false;
   } finally {
     if (descriptor !== undefined) {
-      try { closeSync(descriptor); } catch { /* Best-effort cleanup after reconciliation. */ }
+      try {
+        closeSync(descriptor);
+      } catch {
+        /* Best-effort cleanup after reconciliation. */
+      }
     }
     if (ownsLock && !installed) {
-      try { rmSync(lock, { force: true }); } catch { /* Best-effort cleanup after reconciliation. */ }
+      try {
+        rmSync(lock, { force: true });
+      } catch {
+        /* Best-effort cleanup after reconciliation. */
+      }
     }
   }
 }
 
 async function applyManifestToIndexAsync(root, manifest, indexFile) {
-  const options = { operation: "write the validated FileGRC index", ...(indexFile ? { gitIndexFile: indexFile } : {}) };
-  for (const args of manifestIndexCommands(root, manifest)) await runGitCommand(root, args, options);
+  const options = {
+    operation: "write the validated FileGRC index",
+    ...(indexFile ? { gitIndexFile: indexFile } : {}),
+  };
+  for (const args of manifestIndexCommands(root, manifest))
+    await runGitCommand(root, args, options);
 }
 
 function manifestIndexCommands(root, manifest) {
   const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
   const prefix = relative(topLevel, root).split(sep).join("/");
-  if (prefix === ".." || prefix.startsWith("../")) throw new Error("The FileGRC workspace is outside its Git repository.");
+  if (prefix === ".." || prefix.startsWith("../"))
+    throw new Error("The FileGRC workspace is outside its Git repository.");
   const additions = [];
   const deletions = [];
   for (const [path, value] of manifest) {
     const repositoryPath = prefix ? `${prefix}/${path}` : path;
-    if (value.objectId) additions.push(`${value.mode},${value.objectId},${repositoryPath}`);
+    if (value.objectId)
+      additions.push(`${value.mode},${value.objectId},${repositoryPath}`);
     else deletions.push(repositoryPath);
   }
   const commands = [];
   for (let offset = 0; offset < additions.length; offset += 128) {
-    commands.push(["update-index", "--add", ...additions.slice(offset, offset + 128).flatMap((entry) => ["--cacheinfo", entry])]);
+    commands.push([
+      "update-index",
+      "--add",
+      ...additions
+        .slice(offset, offset + 128)
+        .flatMap((entry) => ["--cacheinfo", entry]),
+    ]);
   }
   for (let offset = 0; offset < deletions.length; offset += 256) {
-    commands.push(["update-index", "--force-remove", "--", ...deletions.slice(offset, offset + 256)]);
+    commands.push([
+      "update-index",
+      "--force-remove",
+      "--",
+      ...deletions.slice(offset, offset + 256),
+    ]);
   }
   return commands;
 }
@@ -2458,7 +3580,8 @@ function statusPathsFromRaw(output) {
     }
     const status = field.slice(0, 2);
     paths.push(field.slice(3));
-    if (/[RC]/.test(status) && fields[index + 1] !== undefined) paths.push(fields[++index]);
+    if (/[RC]/.test(status) && fields[index + 1] !== undefined)
+      paths.push(fields[++index]);
   }
   return paths;
 }
@@ -2483,7 +3606,13 @@ function cleanGitName(value, fallback) {
 function parseLogLine(line) {
   if (!line) return null;
   const [commit, timestamp, author, subject] = line.split("\x1f");
-  return { commit, shortCommit: commit?.slice(0, 8), timestamp, author, subject };
+  return {
+    commit,
+    shortCommit: commit?.slice(0, 8),
+    timestamp,
+    author,
+    subject,
+  };
 }
 
 function lines(source) {
@@ -2502,8 +3631,10 @@ function parsePorcelainV2(source, topLevel, root) {
   const workspaceChanges = [];
   for (let index = 0; index < fields.length; index += 1) {
     const field = fields[index];
-    if (field.startsWith("# branch.oid ")) commit = field.slice(13) === "(initial)" ? null : field.slice(13);
-    else if (field.startsWith("# branch.head ")) branch = field.slice(14) === "(detached)" ? null : field.slice(14);
+    if (field.startsWith("# branch.oid "))
+      commit = field.slice(13) === "(initial)" ? null : field.slice(13);
+    else if (field.startsWith("# branch.head "))
+      branch = field.slice(14) === "(detached)" ? null : field.slice(14);
     else if (field.startsWith("# branch.upstream ")) upstream = field.slice(18);
     else if (field.startsWith("# branch.ab ")) {
       const match = /\+(\d+) -(\d+)/.exec(field);
@@ -2512,13 +3643,24 @@ function parsePorcelainV2(source, topLevel, root) {
       const path = porcelainV2Path(field);
       allChanges.push(field);
       const originalPath = field.startsWith("2 ") ? fields[index + 1] : null;
-      if (pathInsideWorkspace(path, prefix) || originalPath && pathInsideWorkspace(originalPath, prefix)) {
+      if (
+        pathInsideWorkspace(path, prefix) ||
+        (originalPath && pathInsideWorkspace(originalPath, prefix))
+      ) {
         workspaceChanges.push(field);
       }
       if (originalPath) index += 1;
     }
   }
-  return { commit, branch, upstream, ahead, behind, allChanges, workspaceChanges };
+  return {
+    commit,
+    branch,
+    upstream,
+    ahead,
+    behind,
+    allChanges,
+    workspaceChanges,
+  };
 }
 
 function parseWorkspaceRevision(source) {
@@ -2542,13 +3684,17 @@ function parseWorkspaceRevision(source) {
   return {
     commit,
     branch,
-    changePaths: [...new Set(changePaths.filter(Boolean))].sort()
+    changePaths: [...new Set(changePaths.filter(Boolean))].sort(),
   };
 }
 
 function porcelainV2Path(field) {
   if (field.startsWith("? ") || field.startsWith("! ")) return field.slice(2);
-  const requiredSpaces = field.startsWith("2 ") ? 9 : field.startsWith("u ") ? 10 : 8;
+  const requiredSpaces = field.startsWith("2 ")
+    ? 9
+    : field.startsWith("u ")
+      ? 10
+      : 8;
   let offset = 0;
   for (let count = 0; count < requiredSpaces; count += 1) {
     offset = field.indexOf(" ", offset) + 1;
@@ -2575,7 +3721,7 @@ function repositoryOperationFromDirectory(gitDirectory) {
     ["cherry-pick", "CHERRY_PICK_HEAD"],
     ["sequencer", "sequencer"],
     ["revert", "REVERT_HEAD"],
-    ["bisect", "BISECT_START"]
+    ["bisect", "BISECT_START"],
   ]) {
     if (existsSync(resolve(gitDirectory, path))) return name;
   }
@@ -2585,7 +3731,9 @@ function repositoryOperationFromDirectory(gitDirectory) {
 function assertNoGitOperationInProgress(root) {
   const operation = gitOperationInProgress(root);
   if (operation) {
-    throw new Error(`A Git ${operation} is already in progress. Finish or abort it with Git before using FileGRC synchronization.`);
+    throw new Error(
+      `A Git ${operation} is already in progress. Finish or abort it with Git before using FileGRC synchronization.`,
+    );
   }
 }
 
@@ -2596,39 +3744,81 @@ function gitOperationInProgress(root) {
 
 export function setGitCommandInterceptorForTests(interceptor) {
   if (interceptor !== null && typeof interceptor !== "function") {
-    throw new TypeError("The Git command interceptor must be a function or null.");
+    throw new TypeError(
+      "The Git command interceptor must be a function or null.",
+    );
   }
   const previous = gitCommandInterceptor;
   gitCommandInterceptor = interceptor;
-  return () => { gitCommandInterceptor = previous; };
+  return () => {
+    gitCommandInterceptor = previous;
+  };
+}
+
+export function withGitCommandAdapterForTests(adapter, callback) {
+  if (
+    !adapter ||
+    typeof adapter.run !== "function" ||
+    typeof adapter.runSync !== "function"
+  ) {
+    throw new TypeError(
+      "The Git command adapter requires run and runSync functions.",
+    );
+  }
+  if (typeof callback !== "function")
+    throw new TypeError("The Git command adapter callback must be a function.");
+  return gitCommandAdapters.run(adapter, callback);
 }
 
 export function setGitSubprocessObserverForTests(observer) {
   if (observer !== null && typeof observer !== "function") {
-    throw new TypeError("The Git subprocess observer must be a function or null.");
+    throw new TypeError(
+      "The Git subprocess observer must be a function or null.",
+    );
   }
   const previous = gitSubprocessObserver;
   gitSubprocessObserver = observer;
-  return () => { gitSubprocessObserver = previous; };
+  return () => {
+    gitSubprocessObserver = previous;
+  };
 }
 
 export function setHistoricalRevisionReadObserverForTests(observer) {
   if (observer !== null && typeof observer !== "function") {
-    throw new TypeError("The historical revision-read observer must be a function or null.");
+    throw new TypeError(
+      "The historical revision-read observer must be a function or null.",
+    );
   }
   const previous = historicalRevisionReadObserver;
   historicalRevisionReadObserver = observer;
-  return () => { historicalRevisionReadObserver = previous; };
+  return () => {
+    historicalRevisionReadObserver = previous;
+  };
+}
+
+export function setWorkspaceBlobObjectIdOverrideForTests(override) {
+  if (override !== null && typeof override !== "function") {
+    throw new TypeError(
+      "The workspace blob object ID override must be a function or null.",
+    );
+  }
+  const previous = workspaceBlobObjectIdOverride;
+  workspaceBlobObjectIdOverride = override;
+  return () => {
+    workspaceBlobObjectIdOverride = previous;
+  };
 }
 
 export function runGitCommand(cwd, args, options = {}) {
   if (gitCommandInterceptor) {
-    return Promise.resolve().then(() => gitCommandInterceptor({
-      cwd,
-      args: [...args],
-      options: { ...options },
-      run: () => runGitCommandNative(cwd, args, options)
-    }));
+    return Promise.resolve().then(() =>
+      gitCommandInterceptor({
+        cwd,
+        args: [...args],
+        options: { ...options },
+        run: () => runGitCommandNative(cwd, args, options),
+      }),
+    );
   }
   return runGitCommandNative(cwd, args, options);
 }
@@ -2642,27 +3832,46 @@ function runGitCommandNative(cwd, args, options = {}) {
     assertExpectedCheckout(
       cwd,
       options.expectedCheckout.expectedRef,
-      options.expectedCheckout.expectedCommit
+      options.expectedCheckout.expectedCommit,
     );
   }
   if (options.expectedNoOperation) assertNoGitOperationInProgress(cwd);
+  const adapter = gitCommandAdapters.getStore();
+  if (adapter) {
+    return Promise.resolve(
+      adapter.run({ cwd, args: [...args], options: { ...options } }),
+    ).then((output) => String(output ?? "").trim());
+  }
   const operation = options.operation || "run a Git command";
   const configuredTimeout = options.timeoutMs ?? GIT_DEFAULT_TIMEOUT_MS;
-  const { timeoutMs, deadlineLimited } = gitTimeoutPlan(configuredTimeout, GIT_DEFAULT_TIMEOUT_MS);
-  const maxOutputBytes = Math.max(1, Number(options.maxOutputBytes) || GIT_MAX_OUTPUT_BYTES);
-  gitSubprocessObserver?.({ kind: "async", cwd, args: [...args], options: { ...options } });
+  const { timeoutMs, deadlineLimited } = gitTimeoutPlan(
+    configuredTimeout,
+    GIT_DEFAULT_TIMEOUT_MS,
+  );
+  const maxOutputBytes = Math.max(
+    1,
+    Number(options.maxOutputBytes) || GIT_MAX_OUTPUT_BYTES,
+  );
+  gitSubprocessObserver?.({
+    kind: "async",
+    cwd,
+    args: [...args],
+    options: { ...options },
+  });
   return new Promise((resolveCommand, rejectCommand) => {
     const child = spawn("git", args, {
       cwd,
       stdio: ["ignore", "pipe", "pipe"],
       detached: process.platform !== "win32",
       env: gitEnvironment({
-        ...(options.gitIndexFile ? { GIT_INDEX_FILE: options.gitIndexFile } : {}),
+        ...(options.gitIndexFile
+          ? { GIT_INDEX_FILE: options.gitIndexFile }
+          : {}),
         GIT_TERMINAL_PROMPT: "0",
         GIT_ASKPASS: "",
         SSH_ASKPASS: "",
-        GIT_MERGE_AUTOEDIT: "no"
-      })
+        GIT_MERGE_AUTOEDIT: "no",
+      }),
     });
     const stdout = [];
     const stderr = [];
@@ -2673,10 +3882,15 @@ function runGitCommandNative(cwd, args, options = {}) {
     let forceKillTimer;
     const terminate = (signal) => {
       try {
-        if (process.platform !== "win32" && child.pid) process.kill(-child.pid, signal);
+        if (process.platform !== "win32" && child.pid)
+          process.kill(-child.pid, signal);
         else child.kill(signal);
       } catch {
-        try { child.kill(signal); } catch { /* The child already exited. */ }
+        try {
+          child.kill(signal);
+        } catch {
+          /* The child already exited. */
+        }
       }
     };
     const stop = () => {
@@ -2704,12 +3918,14 @@ function runGitCommandNative(cwd, args, options = {}) {
       settled = true;
       clearTimeout(timer);
       clearTimeout(forceKillTimer);
-      rejectCommand(new GitOperationError(
-        error.code === "ENOENT" ? "missing-executable" : "command-failure",
-        operation,
-        error.code === "ENOENT" ? "" : error.message,
-        { cause: error, code: error.code }
-      ));
+      rejectCommand(
+        new GitOperationError(
+          error.code === "ENOENT" ? "missing-executable" : "command-failure",
+          operation,
+          error.code === "ENOENT" ? "" : error.message,
+          { cause: error, code: error.code },
+        ),
+      );
     });
     child.once("close", (code, signal) => {
       if (settled) return;
@@ -2718,20 +3934,25 @@ function runGitCommandNative(cwd, args, options = {}) {
       clearTimeout(forceKillTimer);
       const output = Buffer.concat(stdout).toString("utf8");
       const errorOutput = Buffer.concat(stderr).toString("utf8").trim();
-      if (code === 0 && !timedOut && !outputExceeded) return resolveCommand(output.trim());
+      if (code === 0 && !timedOut && !outputExceeded)
+        return resolveCommand(output.trim());
       const detail = outputExceeded
         ? `Git output exceeded ${maxOutputBytes} bytes.`
         : timedOut
           ? `The operation exceeded ${timeoutMs} ms and the process group was terminated.`
-          : errorOutput || `Git exited with status ${code ?? signal ?? "unknown"}.`;
+          : errorOutput ||
+            `Git exited with status ${code ?? signal ?? "unknown"}.`;
       const kind = timedOut
         ? "timeout"
         : /not a git repository|outside repository/i.test(errorOutput)
           ? "invalid-repository"
           : "command-failure";
-      rejectCommand(new GitOperationError(kind, operation, detail, {
-        code: timedOut && deadlineLimited ? "FILEGRC_GIT_DEADLINE" : undefined
-      }));
+      rejectCommand(
+        new GitOperationError(kind, operation, detail, {
+          code:
+            timedOut && deadlineLimited ? "FILEGRC_GIT_DEADLINE" : undefined,
+        }),
+      );
     });
   });
 }
@@ -2746,14 +3967,19 @@ async function tryGitAsync(cwd, args, operation) {
 
 function git(cwd, args, options = {}) {
   return cachedGitCommand("text", cwd, args, options, () => {
-    return measureTimingSync("git-command-sync", () => observedExecFileSync("git", args, {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: Math.max(1, Number(options.timeoutMs) || GIT_DEFAULT_TIMEOUT_MS),
-      maxBuffer: 20_000_000,
-      env: gitEnvironment()
-    }).trim());
+    return measureTimingSync("git-command-sync", () =>
+      executeGitSync(cwd, args, {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: Math.max(
+          1,
+          Number(options.timeoutMs) || GIT_DEFAULT_TIMEOUT_MS,
+        ),
+        maxBuffer: 20_000_000,
+        env: gitEnvironment(),
+      }).trim(),
+    );
   });
 }
 
@@ -2786,13 +4012,15 @@ function tryGitRaw(cwd, args) {
 
 function gitRaw(cwd, args, options = {}) {
   return cachedGitCommand("raw", cwd, args, options, () => {
-    return observedExecFileSync("git", args, {
+    return executeGitSync(cwd, args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: Math.max(1, Number(options.timeoutMs) || GIT_DEFAULT_TIMEOUT_MS),
       maxBuffer: 20_000_000,
-      env: gitEnvironment(options.gitIndexFile ? { GIT_INDEX_FILE: options.gitIndexFile } : {})
+      env: gitEnvironment(
+        options.gitIndexFile ? { GIT_INDEX_FILE: options.gitIndexFile } : {},
+      ),
     });
   });
 }
@@ -2804,7 +4032,7 @@ function cachedGitCommand(outputKind, cwd, args, options, run) {
     outputKind,
     resolve(cwd),
     args,
-    options.gitIndexFile || null
+    options.gitIndexFile || null,
   ]);
   const cached = cache.get(key);
   if (cached) {
@@ -2816,7 +4044,10 @@ function cachedGitCommand(outputKind, cwd, args, options, run) {
   const size = Buffer.byteLength(value);
   if (size <= GIT_COMMAND_CACHE_MAX_ENTRY_BYTES) {
     let totalBytes = gitCommandCacheBytes.get(cache) || 0;
-    while (cache.size >= GIT_COMMAND_CACHE_MAX_ENTRIES || totalBytes + size > GIT_COMMAND_CACHE_MAX_BYTES) {
+    while (
+      cache.size >= GIT_COMMAND_CACHE_MAX_ENTRIES ||
+      totalBytes + size > GIT_COMMAND_CACHE_MAX_BYTES
+    ) {
       const oldestKey = cache.keys().next().value;
       if (oldestKey === undefined) break;
       totalBytes -= cache.get(oldestKey)?.size || 0;
@@ -2829,9 +4060,10 @@ function cachedGitCommand(outputKind, cwd, args, options, run) {
 }
 
 function observedExecFileSync(executable, args, options = {}) {
-  const timeoutPlan = executable === "git"
-    ? gitTimeoutPlan(options.timeout, GIT_DEFAULT_TIMEOUT_MS)
-    : null;
+  const timeoutPlan =
+    executable === "git"
+      ? gitTimeoutPlan(options.timeout, GIT_DEFAULT_TIMEOUT_MS)
+      : null;
   const boundedOptions = timeoutPlan
     ? { ...options, timeout: timeoutPlan.timeoutMs }
     : options;
@@ -2841,13 +4073,22 @@ function observedExecFileSync(executable, args, options = {}) {
         kind: "sync",
         cwd: boundedOptions.cwd,
         args: [...args],
-        options: { ...boundedOptions, input: boundedOptions.input === undefined ? undefined : "[redacted]" }
+        options: {
+          ...boundedOptions,
+          input: boundedOptions.input === undefined ? undefined : "[redacted]",
+        },
       });
     }
     return execFileSync(executable, args, boundedOptions);
   } catch (error) {
-    if (timeoutPlan?.deadlineLimited && (error?.code === "ETIMEDOUT" || error?.signal)) {
-      const deadlineError = new Error("The Git command exceeded the shared request deadline.", { cause: error });
+    if (
+      timeoutPlan?.deadlineLimited &&
+      (error?.code === "ETIMEDOUT" || error?.signal)
+    ) {
+      const deadlineError = new Error(
+        "The Git command exceeded the shared request deadline.",
+        { cause: error },
+      );
       deadlineError.code = "FILEGRC_GIT_DEADLINE";
       throw deadlineError;
     }
@@ -2862,16 +4103,19 @@ function boundedGitTimeout(configured, fallback) {
 function gitTimeoutPlan(configured, fallback) {
   const requested = Math.max(1, Number(configured) || fallback);
   const deadlineAt = gitCommandDeadlines.getStore();
-  if (deadlineAt === undefined) return { timeoutMs: requested, deadlineLimited: false };
+  if (deadlineAt === undefined)
+    return { timeoutMs: requested, deadlineLimited: false };
   const remaining = Math.ceil(deadlineAt - performance.now());
   if (remaining <= 0) {
-    const error = new Error("The Git command deadline expired before another subprocess could start.");
+    const error = new Error(
+      "The Git command deadline expired before another subprocess could start.",
+    );
     error.code = "FILEGRC_GIT_DEADLINE";
     throw error;
   }
   return {
     timeoutMs: Math.min(requested, remaining),
-    deadlineLimited: remaining <= requested
+    deadlineLimited: remaining <= requested,
   };
 }
 
@@ -2886,30 +4130,59 @@ function nulFields(source) {
 function gitForWrite(cwd, args, action = "create the commit", options = {}) {
   try {
     assertWorkspaceInsideGitWorktree(cwd);
-    return observedExecFileSync("git", args, {
+    return executeGitSync(cwd, args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: 30_000,
       maxBuffer: 20_000_000,
       env: gitEnvironment({
-        ...(options.gitIndexFile ? { GIT_INDEX_FILE: options.gitIndexFile } : {}),
+        ...(options.gitIndexFile
+          ? { GIT_INDEX_FILE: options.gitIndexFile }
+          : {}),
         GIT_TERMINAL_PROMPT: "0",
-        GIT_MERGE_AUTOEDIT: "no"
-      })
+        GIT_MERGE_AUTOEDIT: "no",
+      }),
     }).trim();
   } catch (error) {
-    const message = sanitizeGitErrorMessage(error.stderr?.trim() || error.stdout?.trim() || error.message);
+    const message = sanitizeGitErrorMessage(
+      error.stderr?.trim() || error.stdout?.trim() || error.message,
+    );
     throw new Error(`Git could not ${action}. ${message}`);
   }
 }
 
-async function gitForWriteAsync(cwd, args, action = "update the repository", options = {}) {
+function executeGitSync(cwd, args, options = {}) {
+  const adapter = gitCommandAdapters.getStore();
+  if (adapter) {
+    const outputKind = options.encoding ? "text" : "buffer";
+    const output = adapter.runSync({
+      cwd,
+      args: [...args],
+      options: { ...options },
+      output: outputKind,
+    });
+    if (outputKind === "buffer") {
+      return Buffer.isBuffer(output)
+        ? output
+        : Buffer.from(String(output ?? ""));
+    }
+    return String(output ?? "");
+  }
+  return observedExecFileSync("git", args, options);
+}
+
+async function gitForWriteAsync(
+  cwd,
+  args,
+  action = "update the repository",
+  options = {},
+) {
   assertWorkspaceInsideGitWorktree(cwd);
   return runGitCommand(cwd, args, {
     operation: action,
     timeoutMs: GIT_REMOTE_TIMEOUT_MS,
-    ...options
+    ...options,
   });
 }