git-coco 0.52.0 → 0.54.0

package/dist/index.esm.mjs

@@ -61,7 +61,7 @@ import { pathToFileURL } from 'url';
 /**
  * Current build version from package.json
  */
-const BUILD_VERSION = "0.52.0";
+const BUILD_VERSION = "0.54.0";
 
 const isInteractive = (config) => {
     return config?.mode === 'interactive' || !!config?.interactive;
@@ -308,6 +308,25 @@ class LangChainNetworkError extends LangChainError {
         this.provider = provider;
     }
 }
+/**
+ * User-initiated cancellation (#881 phase 3). Thrown by streaming
+ * helpers when an `AbortSignal` they were given fires. Distinct from
+ * `LangChainNetworkError` / `LangChainTimeoutError` so callers can
+ * pattern-match: a cancelled LLM call is the user's intent, not a
+ * failure to surface in the status line as an error.
+ *
+ * Carries the accumulated text up to the cancel point (when
+ * available) so the caller can decide whether to salvage a partial
+ * result or discard it. Today the workstation discards — the
+ * preview pane was the only consumer of the accumulated text and it
+ * gets cleared on cancel anyway.
+ */
+class LangChainCancelledError extends LangChainError {
+    constructor(message, accumulated, context) {
+        super(message, { ...context, accumulated });
+        this.accumulated = accumulated;
+    }
+}
 
 /**
  * Validates that a required parameter is not null or undefined
@@ -1302,6 +1321,18 @@ const schema$1 = {
                     "description": "Default dynamic routing preference when model is set to \"dynamic\".",
                     "default": "balanced"
                 },
+                "streaming": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Master switch. When `false` (default) every LLM call uses the existing non-streaming code path, regardless of which command or surface fires it.",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Streaming output (#881). Wires `chain.stream()` instead of `chain.invoke()` into LLM-driven TUI surfaces so the user sees a live preview of the model's output as it generates, rather than staring at a spinner until the full response arrives.\n\nOutput contract is unchanged when enabled: the final draft / plan still goes through the same parser, schema validator, and retry logic as the non-streaming path. The stream is a *preview only* — it relieves the \"is this hanging?\" anxiety without touching what gets committed.\n\nOff by default while we shake the UX out across providers; some models stream poorly (one-shot blob disguised as a stream) and the preview just blinks in those cases. Off-by-default also lets users who prefer the quieter spinner-only UX skip the visual chatter.\n\nScope today: workstation compose surface's AI commit draft (the `I` keystroke). Other TUI LLM calls (split-plan, PR body) stay non-streaming pending separate validation."
+                },
                 "fastPath": {
                     "type": "object",
                     "properties": {
@@ -1756,6 +1787,18 @@ const schema$1 = {
                     "description": "Default dynamic routing preference when model is set to \"dynamic\".",
                     "default": "balanced"
                 },
+                "streaming": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Master switch. When `false` (default) every LLM call uses the existing non-streaming code path, regardless of which command or surface fires it.",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Streaming output (#881). Wires `chain.stream()` instead of `chain.invoke()` into LLM-driven TUI surfaces so the user sees a live preview of the model's output as it generates, rather than staring at a spinner until the full response arrives.\n\nOutput contract is unchanged when enabled: the final draft / plan still goes through the same parser, schema validator, and retry logic as the non-streaming path. The stream is a *preview only* — it relieves the \"is this hanging?\" anxiety without touching what gets committed.\n\nOff by default while we shake the UX out across providers; some models stream poorly (one-shot blob disguised as a stream) and the preview just blinks in those cases. Off-by-default also lets users who prefer the quieter spinner-only UX skip the visual chatter.\n\nScope today: workstation compose surface's AI commit draft (the `I` keystroke). Other TUI LLM calls (split-plan, PR body) stay non-streaming pending separate validation."
+                },
                 "fastPath": {
                     "type": "object",
                     "properties": {
@@ -1950,6 +1993,18 @@ const schema$1 = {
                     "description": "Default dynamic routing preference when model is set to \"dynamic\".",
                     "default": "balanced"
                 },
+                "streaming": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "description": "Master switch. When `false` (default) every LLM call uses the existing non-streaming code path, regardless of which command or surface fires it.",
+                            "default": false
+                        }
+                    },
+                    "additionalProperties": false,
+                    "description": "Streaming output (#881). Wires `chain.stream()` instead of `chain.invoke()` into LLM-driven TUI surfaces so the user sees a live preview of the model's output as it generates, rather than staring at a spinner until the full response arrives.\n\nOutput contract is unchanged when enabled: the final draft / plan still goes through the same parser, schema validator, and retry logic as the non-streaming path. The stream is a *preview only* — it relieves the \"is this hanging?\" anxiety without touching what gets committed.\n\nOff by default while we shake the UX out across providers; some models stream poorly (one-shot blob disguised as a stream) and the preview just blinks in those cases. Off-by-default also lets users who prefer the quieter spinner-only UX skip the visual chatter.\n\nScope today: workstation compose surface's AI commit draft (the `I` keystroke). Other TUI LLM calls (split-plan, PR body) stay non-streaming pending separate validation."
+                },
                 "fastPath": {
                     "type": "object",
                     "properties": {
@@ -7943,7 +7998,7 @@ async function enforcePromptBudget({ prompt, variables, tokenizer, maxTokens, su
 /**
  * Extracts provider and endpoint info from LLM instance if available
  */
-function extractLlmInfo(llm) {
+function extractLlmInfo$1(llm) {
     const info = {};
     // Try to extract provider from class name
     const className = llm?.constructor?.name || '';
@@ -7986,7 +8041,7 @@ const executeChain = async ({ llm, prompt, variables, parser, provider, endpoint
         });
     }
     // Extract LLM info for error reporting if not provided
-    const llmInfo = extractLlmInfo(llm);
+    const llmInfo = extractLlmInfo$1(llm);
     const effectiveProvider = provider || llmInfo.provider;
     const effectiveEndpoint = endpoint || llmInfo.endpoint;
     try {
@@ -14571,6 +14626,11 @@ const options$8 = {
         type: 'boolean',
         default: false,
     },
+    strictSplit: {
+        description: 'Fail loudly if the split planner exhausts its retry budget with an invalid plan (otherwise falls back to a single combined commit).',
+        type: 'boolean',
+        default: false,
+    },
 };
 const builder$8 = (yargs) => {
     return yargs.options(options$8).usage(getCommandUsageHeader(command$8));
@@ -15459,6 +15519,53 @@ function dropEmptyGroups(plan) {
     }
     return { ...plan, groups: surviving };
 }
+/**
+ * Construct a trivially-valid single-group plan covering every staged
+ * file. Used as the fallback when the LLM exhausts its retry budget
+ * with an invalid plan — turning a hard failure into a usable
+ * (if degraded) outcome.
+ *
+ * Properties of the returned plan:
+ *
+ *   - Exactly one group.
+ *   - Every staged file appears in that group's `files[]`. No hunks
+ *     are claimed, so any hunk inventory is irrelevant to the plan's
+ *     validity.
+ *   - By construction: no duplicates, no missing files, no mixed
+ *     mode, no phantom hunks. `getPlanValidationIssues` returns an
+ *     empty issue set.
+ *
+ * The group's `rationale` carries the reason text the caller wants
+ * to expose to the UI (typically "model exhausted N attempts; last
+ * issues were …"). The `body` carries a short note that survives
+ * into the commit message body so a user who applies without editing
+ * has the context recorded in git history.
+ *
+ * `title` defaults to a generic conventional-commits-compatible
+ * `chore: combined commit` — bland on purpose. Real commit messaging
+ * is the user's job at the compose / apply step.
+ *
+ * The plan is NOT linked to the LLM by construction. If the model
+ * can't produce a valid split, the user still gets one apply-able
+ * commit instead of a thrown error and a still-staged worktree.
+ */
+function buildSplitPlanFallback(staged, options = {}) {
+    const files = staged.map((change) => change.filePath);
+    const reasonLine = options.reason
+        ? ` Reason: ${options.reason}`
+        : '';
+    return {
+        groups: [
+            {
+                title: 'chore: combined commit',
+                body: 'Auto-generated single-commit fallback after the split planner could not produce a valid multi-group plan. Edit before applying if you want a more specific message; press `r` to re-roll the planner if a different model might do better.',
+                rationale: `Fallback plan — every staged file in one commit because the LLM could not produce a valid multi-group split.${reasonLine}`,
+                files,
+                hunks: [],
+            },
+        ],
+    };
+}
 function formatPlanValidationFeedback(issues) {
     const sections = [];
     if (issues.unknownFiles.length) {
@@ -15495,7 +15602,7 @@ const DEFAULT_MAX_PLAN_ATTEMPTS = 3;
  * into the same prompt template (`previous_attempt_feedback` slot) so the model can
  * fix its own mistakes without re-running pre-processing.
  */
-async function generateValidatedCommitSplitPlan({ llm, prompt, variables, staged, hunkInventory, logger, tokenizer, metadata = {}, maxAttempts = DEFAULT_MAX_PLAN_ATTEMPTS, }) {
+async function generateValidatedCommitSplitPlan({ llm, prompt, variables, staged, hunkInventory, logger, tokenizer, metadata = {}, maxAttempts = DEFAULT_MAX_PLAN_ATTEMPTS, strict = false, }) {
     let lastIssues = null;
     let attempt = 0;
     while (attempt < maxAttempts) {
@@ -15565,9 +15672,42 @@ async function generateValidatedCommitSplitPlan({ llm, prompt, variables, staged
             logger.verbose(`Plan attempt ${attempt}/${maxAttempts} failed validation: ${formatPlanValidationIssuesError(issues)}`, { color: 'yellow' });
         }
     }
-    throw new Error(lastIssues
-        ? `Failed to produce a valid commit-split plan after ${maxAttempts} attempts. Final validator issues: ${formatPlanValidationIssuesError(lastIssues)}`
-        : `Failed to produce a valid commit-split plan after ${maxAttempts} attempts.`);
+    const issuesSummary = lastIssues
+        ? formatPlanValidationIssuesError(lastIssues)
+        : 'no captured validator issues';
+    // Strict mode: restore the pre-#1005 behaviour. Callers that pass
+    // `strict: true` (and CLI users via `--strict-split`) want explicit
+    // failure rather than the degraded fallback.
+    if (strict) {
+        throw new Error(lastIssues
+            ? `Failed to produce a valid commit-split plan after ${maxAttempts} attempts. Final validator issues: ${issuesSummary}`
+            : `Failed to produce a valid commit-split plan after ${maxAttempts} attempts.`);
+    }
+    // Default: hand back a trivially-valid single-group fallback. The
+    // caller's apply / preview surface should treat the `fallback` flag
+    // as a signal to nudge the user (it's strictly better than a hard
+    // failure with the staged set still on disk, but it's still a
+    // degraded outcome compared to a real multi-group split).
+    const reason = `LLM exhausted ${maxAttempts} planning attempts; final validator issues: ${issuesSummary}`;
+    if (logger) {
+        logger.verbose(`Plan attempts exhausted — falling back to a single-group plan. ${reason}`, { color: 'yellow' });
+    }
+    return {
+        plan: buildSplitPlanFallback(staged, { reason: issuesSummary }),
+        attempts: maxAttempts,
+        fallback: {
+            reason,
+            lastIssues: lastIssues ?? {
+                unknownFiles: [],
+                duplicateFiles: [],
+                unknownHunks: [],
+                duplicateHunks: [],
+                mixedFiles: [],
+                partiallyCoveredFiles: [],
+                missingFiles: [],
+            },
+        },
+    };
 }
 
 /**
@@ -15612,6 +15752,7 @@ Structural rules:
 - Only use hunk IDs LITERALLY copied from the "Staged hunk inventory" section below. Do not invent or guess hunk IDs.
 - If the hunk inventory says "No hunk-level inventory available" then EVERY group's "hunks" array MUST be empty (use only "files"). Do not write hunk IDs like "path::hunk-1" when no hunk inventory exists — those are not valid.
 - Prefer 2-5 commits unless the changes are truly all one topic.
+- Order the groups in the sequence they would logically be built — foundational changes first, consumers after. If group B uses a symbol, function, type, or file introduced in group A, A MUST appear before B in the array. The applier commits in array order, so this order becomes the git history. Example: a "feat: add helpers" group that introduces \`formatX()\` must come before a "feat: wire helpers into renderer" group that calls \`formatX()\`, even if the staged diff is presented in the opposite order. When two groups have no dependency relationship, prefer the one closer to a "scaffold" (types, config, new files) before the one closer to a "use site" (existing files modified to consume the new code).
 
 Commit message style:
 - Write each "title" in the imperative mood ("add", not "added"), under 72 chars.
@@ -15768,7 +15909,7 @@ async function applyPatchToIndex$1(patch, git) {
         child.stdin.end();
     });
 }
-async function applyCommitSplitPlan({ plan, changes, hunkInventory, git, logger, noVerify, }) {
+async function applyCommitSplitPlan({ plan, changes, hunkInventory, git, logger, noVerify, fallback, }) {
     validatePlanForStagedFiles(plan, changes.staged, hunkInventory);
     assertNoUnstagedOverlap(plan, changes, hunkInventory);
     // Defensive: drop any group with empty files[] AND empty hunks[].
@@ -15871,11 +16012,13 @@ async function applyCommitSplitPlan({ plan, changes, hunkInventory, git, logger,
         return {
             commitHashes,
             message: `Created ${commitHashes.length} of ${applicableGroups.length} planned commit(s). Failed: ${partial}`,
+            fallback,
         };
     }
     return {
         commitHashes,
         message: `Created ${commitHashes.length} split commit(s).`,
+        fallback,
     };
 }
 /**
@@ -15973,7 +16116,7 @@ async function prepareCommitSplitPlan({ argv, config, git, logger, tokenizer, ll
     }
     const resolvedPlanLlm = planLlm ?? llm;
     const resolvedPlanModel = planService?.model ?? config.service.model;
-    const { plan } = await generateValidatedCommitSplitPlan({
+    const { plan, fallback } = await generateValidatedCommitSplitPlan({
         llm: resolvedPlanLlm,
         prompt: COMMIT_SPLIT_PROMPT,
         variables: {
@@ -15996,8 +16139,12 @@ async function prepareCommitSplitPlan({ argv, config, git, logger, tokenizer, ll
             conventional: useConventional,
         },
         maxAttempts: DEFAULT_MAX_PLAN_ATTEMPTS,
+        // Honour `--strict-split` (CLI) or `strictSplit` (config). When set,
+        // the planner reverts to the pre-#1005 behaviour of throwing on
+        // exhaustion instead of returning the single-group fallback.
+        strict: Boolean(argv.strictSplit ?? config.strictSplit),
     });
-    return { plan, context: { changes, hunkInventory } };
+    return { plan, context: { changes, hunkInventory }, fallback };
 }
 async function handleCommitSplit({ argv, config, git, logger, tokenizer, llm, planLlm, planService, }) {
     const result = await prepareCommitSplitPlan({
@@ -16013,7 +16160,7 @@ async function handleCommitSplit({ argv, config, git, logger, tokenizer, llm, pl
     if ('empty' in result) {
         return 'No staged changes found.';
     }
-    const { plan, context } = result;
+    const { plan, context, fallback } = result;
     if (argv.apply) {
         const applied = await applyCommitSplitPlan({
             plan,
@@ -16022,9 +16169,24 @@ async function handleCommitSplit({ argv, config, git, logger, tokenizer, llm, pl
             git,
             logger,
             noVerify: argv.noVerify || config.noVerify || false,
+            fallback,
         });
+        if (applied.fallback) {
+            return [
+                `Note: applied the single-commit fallback (${applied.fallback.reason}).`,
+                applied.message,
+            ].join('\n');
+        }
         return applied.message;
     }
+    if (fallback) {
+        return [
+            `Note: showing the single-commit fallback plan (${fallback.reason}).`,
+            'Re-run with a stronger model or use --strict-split to surface the planner error.',
+            '',
+            formatCommitSplitPlan(plan),
+        ].join('\n');
+    }
     return formatCommitSplitPlan(plan);
 }
 
@@ -20063,9 +20225,13 @@ function applyCommitComposeAction(state, action) {
                 editing: action.value,
             };
         case 'setLoading':
+            // Clearing loading also clears any in-flight streaming preview;
+            // the preview's whole purpose is to fill the wait window. Once
+            // the wait ends (success OR failure), the preview is stale.
             return {
                 ...state,
                 loading: action.value,
+                streamingPreview: action.value ? state.streamingPreview : undefined,
             };
         case 'setDraft':
             // No `message` here — the loader → filled fields are the confirmation
@@ -20081,6 +20247,7 @@ function applyCommitComposeAction(state, action) {
                 loading: false,
                 message: undefined,
                 details: undefined,
+                streamingPreview: undefined,
             };
         case 'setResult':
             return {
@@ -20088,6 +20255,17 @@ function applyCommitComposeAction(state, action) {
                 loading: false,
                 message: action.message,
                 details: action.details,
+                streamingPreview: undefined,
+            };
+        case 'setStreamingPreview':
+            // Per-chunk live-preview update. Fires from the streaming
+            // workflow's onChunk callback; the renderer turns it into a
+            // last-N-lines panel below the loading line. Pass `undefined`
+            // to explicitly clear (the workflow does this on completion
+            // alongside the `setDraft` / `setResult` dispatch).
+            return {
+                ...state,
+                streamingPreview: action.value,
             };
         case 'reset':
             // Drop message/details too — the post-commit "Created commit ..."
@@ -20161,6 +20339,210 @@ async function createManualCommit({ git, summary, body, noVerify = false, }) {
     }
 }
 
+/**
+ * Same provider / endpoint best-effort extraction `executeChain` uses,
+ * duplicated here rather than imported so the streaming module doesn't
+ * pull on `executeChain`'s implementation. If both helpers ever need to
+ * share more, factor this out to a shared `llmInfo.ts`.
+ */
+function extractLlmInfo(llm) {
+    const info = {};
+    const className = llm?.constructor?.name || '';
+    if (className.includes('Ollama')) {
+        info.provider = 'ollama';
+        if ('lc_kwargs' in llm && typeof llm.lc_kwargs === 'object' && llm.lc_kwargs !== null) {
+            const kwargs = llm.lc_kwargs;
+            if (typeof kwargs.baseUrl === 'string') {
+                info.endpoint = kwargs.baseUrl;
+            }
+        }
+    }
+    else if (className.includes('OpenAI')) {
+        info.provider = 'openai';
+    }
+    else if (className.includes('Anthropic')) {
+        info.provider = 'anthropic';
+    }
+    return info;
+}
+/**
+ * Coerce one streamed chunk into its text fragment. LangChain's
+ * `prompt.pipe(llm).stream(...)` yields `BaseMessageChunk` instances
+ * whose `.content` is sometimes a string and sometimes an array of
+ * content parts (multi-modal models, tool calls). We only care about
+ * the textual delta here; non-text parts are silently dropped because
+ * phase 1's surfaces (stdout + status-line copy) can't render them
+ * anyway.
+ */
+function coerceChunkText(messageChunk) {
+    if (typeof messageChunk === 'string')
+        return messageChunk;
+    if (messageChunk && typeof messageChunk === 'object' && 'content' in messageChunk) {
+        const content = messageChunk.content;
+        if (typeof content === 'string')
+            return content;
+        if (Array.isArray(content)) {
+            // Multi-part content array — concatenate the text parts only.
+            return content
+                .map((part) => {
+                if (typeof part === 'string')
+                    return part;
+                if (part && typeof part === 'object' && 'text' in part && typeof part.text === 'string') {
+                    return part.text;
+                }
+                return '';
+            })
+                .join('');
+        }
+    }
+    return '';
+}
+/**
+ * Streaming variant of `executeChain`. Pipes the prompt into the LLM,
+ * consumes the resulting async iterable, fires `onChunk` with each text
+ * fragment as it arrives, and runs the supplied parser against the
+ * fully-accumulated text on completion. Returns the parsed result.
+ *
+ * Why a separate function instead of an `onChunk?` flag on
+ * `executeChain`? Two reasons:
+ *
+ *   1. The two paths have meaningfully different failure modes — a
+ *      half-streamed result can be salvaged with a best-effort parse;
+ *      an `invoke()` failure can't. Separate functions let each handle
+ *      its own error shape cleanly.
+ *   2. Callers should make an explicit choice about whether they want
+ *      streaming. Adding it as an opt-in flag on `executeChain` makes
+ *      it tempting to plumb `onChunk` from random surfaces; a separate
+ *      helper makes the call site say "yes, this needs streaming."
+ *
+ * No automatic fallback to non-streaming `executeChain` when streaming
+ * fails — by design. Callers that want fallback should `catch` this
+ * function and call `executeChain` themselves. Keeps the helper focused
+ * on the streaming path and the fallback policy explicit at the call
+ * site (different commands may want different fallback strategies).
+ */
+async function executeChainStreaming({ llm, prompt, variables, parser, onChunk, signal, provider, endpoint, logger, tokenizer, metadata, }) {
+    validateRequired(llm, 'llm', 'executeChainStreaming');
+    validateRequired(prompt, 'prompt', 'executeChainStreaming');
+    validateRequired(variables, 'variables', 'executeChainStreaming');
+    validateRequired(parser, 'parser', 'executeChainStreaming');
+    validateRequired(onChunk, 'onChunk', 'executeChainStreaming');
+    if (typeof variables !== 'object' || Array.isArray(variables)) {
+        throw new LangChainExecutionError('executeChainStreaming: Variables must be a non-array object', { variables, type: typeof variables, isArray: Array.isArray(variables) });
+    }
+    // Pre-flight abort check (#881 phase 3). Callers that ran the cancel
+    // path before reaching here shouldn't pay for prompt rendering or
+    // request setup. Match the contract `chain.stream(..., { signal })`
+    // would have honoured — throw `LangChainCancelledError` rather than
+    // a bare `AbortError`.
+    if (signal?.aborted) {
+        throw new LangChainCancelledError('executeChainStreaming: Aborted before stream opened', '');
+    }
+    const llmInfo = extractLlmInfo(llm);
+    const effectiveProvider = provider || llmInfo.provider;
+    const effectiveEndpoint = endpoint || llmInfo.endpoint;
+    let accumulated = '';
+    try {
+        const renderedPrompt = await prompt.format(variables);
+        const promptTokens = estimatePromptTokens(tokenizer, renderedPrompt);
+        const chain = prompt.pipe(llm);
+        const startedAt = Date.now();
+        // Forward the signal into LangChain's RunnableConfig. The HTTP
+        // transport (openai / anthropic / ollama clients) honours it and
+        // tears down the connection rather than waiting for the model to
+        // finish. The async iterator throws an AbortError that we
+        // classify below.
+        const stream = await chain.stream(variables, signal ? { signal } : undefined);
+        let chunkCount = 0;
+        for await (const messageChunk of stream) {
+            const text = coerceChunkText(messageChunk);
+            if (!text)
+                continue;
+            accumulated += text;
+            chunkCount += 1;
+            try {
+                onChunk({ text, accumulated });
+            }
+            catch (callbackError) {
+                // Deliberately swallow callback errors so a bad render handler
+                // can't tank the entire LLM call. Log at verbose so users with
+                // verbose mode on can still see what happened.
+                logger?.verbose(`executeChainStreaming: onChunk handler threw: ${callbackError instanceof Error ? callbackError.message : String(callbackError)}`, { color: 'yellow' });
+            }
+        }
+        if (!accumulated) {
+            throw new LangChainExecutionError('executeChainStreaming: Stream completed with no text chunks', { variables, promptInputVariables: prompt.inputVariables });
+        }
+        const result = (await parser.invoke(accumulated));
+        const elapsedMs = Date.now() - startedAt;
+        logLlmCall(logger, {
+            task: metadata?.task || 'chain-streaming',
+            provider: effectiveProvider,
+            parserType: parser.constructor.name,
+            variableKeys: Object.keys(variables),
+            promptTokens,
+            elapsedMs,
+            // Surfaced in observability so consumers can spot the streaming
+            // path in their logs without correlating across tools. `chunks`
+            // doubles as a sanity check (a streaming call that delivered 1
+            // chunk is functionally identical to a non-streaming one).
+            streamed: true,
+            streamChunks: chunkCount,
+            ...metadata,
+        });
+        if (result === null || result === undefined) {
+            throw new LangChainExecutionError('executeChainStreaming: Parser returned null or undefined from streamed text', {
+                variables,
+                promptInputVariables: prompt.inputVariables,
+                accumulatedLength: accumulated.length,
+            });
+        }
+        return result;
+    }
+    catch (error) {
+        // Cancellation classifier (#881 phase 3). Three signals: an
+        // explicitly aborted user signal (post-throw check), the
+        // standard DOM `AbortError`, or a Node `AbortSignal` with
+        // `signal.aborted === true` while a chain-internal error
+        // propagates. Any of these means "user wanted out," not "the
+        // call failed." Wrap the raw error so callers can pattern-match
+        // on `LangChainCancelledError` and carry the partial accumulated
+        // text in case the caller wants to salvage anything.
+        const aborted = signal?.aborted ||
+            (error instanceof Error && (error.name === 'AbortError' || error.message?.includes('aborted')));
+        if (aborted) {
+            throw new LangChainCancelledError(error instanceof Error ? error.message : 'Streaming aborted by user', accumulated, {
+                provider: effectiveProvider,
+                endpoint: effectiveEndpoint,
+            });
+        }
+        if (error instanceof LangChainExecutionError ||
+            error instanceof LangChainNetworkError ||
+            error instanceof LangChainCancelledError) {
+            throw error;
+        }
+        if (error instanceof Error && isNetworkError(error)) {
+            throw new LangChainNetworkError(error.message, effectiveEndpoint, effectiveProvider, {
+                originalError: error.name,
+                originalMessage: error.message,
+                stack: error.stack,
+                promptInputVariables: prompt.inputVariables,
+                variableKeys: Object.keys(variables),
+                parserType: parser.constructor.name,
+                streamed: true,
+            });
+        }
+        handleLangChainError(error, 'executeChainStreaming: Stream execution failed', {
+            promptInputVariables: prompt.inputVariables,
+            variableKeys: Object.keys(variables),
+            parserType: parser.constructor.name,
+            provider: effectiveProvider,
+            endpoint: effectiveEndpoint,
+            streamed: true,
+        });
+    }
+}
+
 const FORMAT_INSTRUCTIONS_TEMPLATE = (schemaDescription) => (`CRITICAL: You must return ONLY a valid JSON object with no additional text, explanations, or markdown formatting.
 
 REQUIRED JSON FORMAT:
@@ -20185,7 +20567,45 @@ IMPORTANT RULES:
  * are surfaced as `validationErrors`/`warnings` rather than driving an
  * interactive retry flow — the TUI can re-invoke or let the user edit.
  */
-async function generateCommitDraft({ git, argv, logger = new Logger({ silent: true }), }) {
+/**
+ * Fallback parser shared between the non-streaming
+ * `executeChainWithSchema` call and the streaming path (#881 phase 2).
+ *
+ * Extracted from the inline `fallbackParser` option so the streaming
+ * path can use the same lossy-but-permissive recovery for accumulated
+ * text. Strips markdown code fences, attempts strict JSON parse, and
+ * falls back to "first line is title, rest is body" when JSON parsing
+ * fails entirely.
+ *
+ * Returned shape always satisfies the schema's structural requirements
+ * (`title` + `body` strings) but the *content* may be the last-ditch
+ * "Auto-generated commit" placeholder. Callers should treat this as a
+ * best-effort salvage, not a parse confirmation.
+ */
+function salvageCommitMessageFromText(text) {
+    try {
+        let cleanText = text.trim();
+        const codeBlockMatch = cleanText.match(/```(?:json)?\s*(\{[\s\S]*?\})\s*```/);
+        if (codeBlockMatch && codeBlockMatch[1]) {
+            cleanText = codeBlockMatch[1].trim();
+        }
+        const parsed = JSON.parse(cleanText);
+        if (parsed && typeof parsed === 'object' &&
+            typeof parsed.title === 'string' &&
+            typeof parsed.body === 'string' &&
+            parsed.title.length > 0) {
+            return parsed;
+        }
+    }
+    catch {
+        // fall through to line-split salvage
+    }
+    return {
+        title: text.split('\n')[0] || 'Auto-generated commit',
+        body: text.split('\n').slice(1).join('\n') || 'Generated commit message',
+    };
+}
+async function generateCommitDraft({ git, argv, logger = new Logger({ silent: true }), onStreamChunk, signal, }) {
     const config = loadConfig(argv);
     const key = getApiKeyForModel(config);
     const { provider } = getModelAndProviderFromConfig(config);
@@ -20328,42 +20748,117 @@ async function generateCommitDraft({ git, argv, logger = new Logger({ silent: tr
             tokenizer,
             maxTokens: config.service.tokenLimit || 2048,
         });
-        const commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
-            logger,
-            tokenizer,
-            metadata: {
-                task: useConventional ? 'commit-message-conventional' : 'commit-message',
-                command: 'commit-draft',
-                provider,
-                model: String(model),
-            },
-            retryOptions: {
-                maxAttempts: maxParsingAttempts,
-            },
-            fallbackParser: (text) => {
-                try {
-                    let cleanText = text.trim();
-                    const codeBlockMatch = cleanText.match(/```(?:json)?\s*(\{[\s\S]*?\})\s*```/);
-                    if (codeBlockMatch && codeBlockMatch[1]) {
-                        cleanText = codeBlockMatch[1].trim();
-                    }
-                    const parsed = JSON.parse(cleanText);
-                    if (parsed && typeof parsed === 'object' &&
-                        typeof parsed.title === 'string' &&
-                        typeof parsed.body === 'string' &&
-                        parsed.title.length > 0) {
-                        return parsed;
-                    }
-                }
-                catch {
-                    // fall through
+        // Streaming path (#881 phase 2). Active when the caller supplied
+        // an `onStreamChunk` AND the config opted in. Only the FIRST
+        // attempt streams; the commitlint-retry attempt (attempt === 2)
+        // and the existing executeChainWithSchema retry loop run
+        // non-streaming so we keep the schema-validated retry as the
+        // backstop when the streamed text can't be salvaged.
+        const streamingEnabled = Boolean(onStreamChunk && config.service.streaming?.enabled);
+        const shouldStreamThisAttempt = streamingEnabled && attempt === 1;
+        let commitMsg;
+        if (shouldStreamThisAttempt && onStreamChunk) {
+            // The streaming chain bypasses the schema parser during the
+            // stream itself (no streaming-aware JSON parser today) and
+            // delivers the raw accumulated text to a no-op `parser.invoke`.
+            // We then salvage the structured result via the same lossy
+            // recovery the non-streaming fallbackParser uses. If the
+            // salvager produces a plausible draft, we use it. Otherwise we
+            // fall through to executeChainWithSchema below for a real
+            // schema-validated retry — paying for a second LLM call only
+            // on the edge case where the streamed output is unsalvageable.
+            const streamingParser = createSchemaParser(schema, llm);
+            let salvaged;
+            try {
+                // `executeChainStreaming` runs the parser on the accumulated
+                // text at completion. StructuredOutputParser will throw when
+                // the model produced unparseable JSON — we catch that below
+                // and salvage manually. The happy-path zod-validated object
+                // becomes our commitMsg.
+                commitMsg = await executeChainStreaming({
+                    llm,
+                    prompt,
+                    variables: budgetedPrompt.variables,
+                    parser: streamingParser,
+                    onChunk: ({ text, accumulated }) => {
+                        onStreamChunk(text, accumulated);
+                    },
+                    signal,
+                    logger,
+                    tokenizer,
+                    metadata: {
+                        task: useConventional ? 'commit-message-conventional' : 'commit-message',
+                        command: 'commit-draft',
+                        provider,
+                        model: String(model),
+                    },
+                });
+            }
+            catch (streamErr) {
+                // User-initiated cancel (#881 phase 3). Bail out of the
+                // entire attempt loop and let the caller distinguish
+                // "cancelled" from "failed" in the status line. We do NOT
+                // fall through to the non-streaming retry on cancel — the
+                // user explicitly asked to stop, kicking off a fresh
+                // unstreamable LLM call would defy that intent.
+                if (streamErr instanceof LangChainCancelledError) {
+                    return {
+                        ok: false,
+                        draft: streamErr.accumulated || '',
+                        warnings,
+                        validationErrors: [],
+                        cancelled: true,
+                    };
                 }
-                return {
-                    title: text.split('\n')[0] || 'Auto-generated commit',
-                    body: text.split('\n').slice(1).join('\n') || 'Generated commit message',
-                };
-            },
-        });
+                // Streamed accumulated text didn't parse cleanly. Try the
+                // lossy salvager on whatever we have; if that produces a
+                // non-placeholder title, accept it. Otherwise fall through
+                // to the non-streaming path which can retry with a fresh
+                // LLM call.
+                logger.verbose(`Streaming attempt produced unparseable output: ${streamErr instanceof Error ? streamErr.message : String(streamErr)}. Falling back to non-streaming.`, { color: 'yellow' });
+                salvaged = undefined;
+            }
+            // Type-narrow: commitMsg is set inside try{}, but TS doesn't
+            // see that across the catch. Re-init through the salvage path
+            // if streaming threw.
+            if (salvaged) {
+                commitMsg = salvaged;
+            }
+            else if (!(commitMsg)) {
+                // Streaming threw; do the standard non-streaming flow to
+                // recover. This is the trade-off documented in the issue —
+                // streaming gives us a preview but the validated result still
+                // comes from the schema-aware retry path when streaming fails.
+                commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
+                    logger,
+                    tokenizer,
+                    metadata: {
+                        task: useConventional ? 'commit-message-conventional' : 'commit-message',
+                        command: 'commit-draft',
+                        provider,
+                        model: String(model),
+                    },
+                    retryOptions: { maxAttempts: maxParsingAttempts },
+                    fallbackParser: salvageCommitMessageFromText,
+                });
+            }
+        }
+        else {
+            commitMsg = await executeChainWithSchema(schema, llm, prompt, budgetedPrompt.variables, {
+                logger,
+                tokenizer,
+                metadata: {
+                    task: useConventional ? 'commit-message-conventional' : 'commit-message',
+                    command: 'commit-draft',
+                    provider,
+                    model: String(model),
+                },
+                retryOptions: {
+                    maxAttempts: maxParsingAttempts,
+                },
+                fallbackParser: salvageCommitMessageFromText,
+            });
+        }
         const ticketId = extractTicketIdFromBranchName(branchName);
         const fullMessage = formatCommitMessage(commitMsg, {
             append: argv.append,
@@ -20461,8 +20956,26 @@ async function runCommitDraftWorkflow(input = {}) {
     const argv = createCommitWorkflowArgv('commit');
     const logger = new Logger({ silent: true });
     try {
-        const result = await generateCommitDraft({ git, argv, logger });
+        const result = await generateCommitDraft({
+            git,
+            argv,
+            logger,
+            onStreamChunk: input.onStreamChunk,
+            signal: input.signal,
+        });
         const draft = result.draft.trim();
+        // Cancel path (#881 phase 3). Reported separately from success
+        // / failure so the runtime can render a neutral "cancelled"
+        // status line instead of an error.
+        if (result.cancelled) {
+            return {
+                ok: false,
+                message: 'AI draft cancelled.',
+                details: [],
+                draft: '',
+                cancelled: true,
+            };
+        }
         if (result.ok && draft) {
             return {
                 ok: true,
@@ -20551,6 +21064,7 @@ async function runCommitSplitPlanWorkflow(input = {}) {
             ok: true,
             plan: result.plan,
             planContext: result.context,
+            fallback: result.fallback,
         };
     }
     catch (error) {
@@ -20595,6 +21109,7 @@ async function runCommitSplitApplyWorkflow(input) {
             git,
             logger,
             noVerify: input.noVerify || false,
+            fallback: input.fallback,
         });
         return {
             ok: true,
@@ -20605,6 +21120,7 @@ async function runCommitSplitApplyWorkflow(input) {
             // I/O AND inaccurate when partial-apply landed fewer commits
             // than the plan had groups.
             commitHashes: applied.commitHashes,
+            fallback: applied.fallback,
         };
     }
     catch (error) {
@@ -21068,6 +21584,37 @@ function getLogInkWorkflowActions() {
             kind: 'normal',
             requiresConfirmation: false,
         },
+        // Per-view variants of fetch / pull / push that act on the
+        // cursored branch instead of the current one. Empty `key` keeps
+        // them palette-discoverable without registering a global hotkey —
+        // inkInput.ts dispatches them contextually when the user presses
+        // F / U / P while the branches sidebar is focused. Outside that
+        // context, the F / U / P keys still fire the global *-current-*
+        // / fetch-remotes variants above.
+        {
+            id: 'fetch-selected-branch',
+            key: '',
+            label: 'Fetch selected branch',
+            description: 'Run `git fetch <remote> <branch>` for the cursored branch in the branches view / sidebar.',
+            kind: 'normal',
+            requiresConfirmation: false,
+        },
+        {
+            id: 'pull-selected-branch',
+            key: '',
+            label: 'Pull selected branch',
+            description: 'Pull the cursored branch in the branches view / sidebar. Falls back to a fast-forward-only refspec fetch when the branch is not currently checked out; refuses non-FF.',
+            kind: 'normal',
+            requiresConfirmation: false,
+        },
+        {
+            id: 'push-selected-branch',
+            key: '',
+            label: 'Push selected branch',
+            description: 'Run `git push <remote> <branch>` for the cursored branch in the branches view / sidebar.',
+            kind: 'normal',
+            requiresConfirmation: false,
+        },
         {
             // Per-view-only — the inkInput handler scopes this to the tags
             // surface so we don't expose `R` as a remote-delete from elsewhere.
@@ -22008,8 +22555,22 @@ function getLogInkFooterHints(options) {
         // "enter open" hint that drills into the dedicated view.
         const itemsPresent = (options.sidebarItemCount ?? 0) > 0;
         if (itemsPresent && options.sidebarTab === 'branches') {
+            // P / U / F fire the global pull-current-branch, push-current-branch,
+            // fetch-remotes workflows — already implemented, just not visible in
+            // the footer before. Surfacing them here matters because the user's
+            // attention is on a branch when the branches sidebar is focused;
+            // pull / push / fetch are the next obvious actions.
+            //
+            // Note: `U` and `P` currently operate on the CURRENT branch, not the
+            // cursored one. Task #5 will extend them to act on the cursored row;
+            // until then the labels read as "current-branch ops" by virtue of
+            // matching the workflow descriptions.
             return {
-                contextual: ['↑/↓ branches', '←/→ tab', 'enter checkout', 'D delete', 'R rename', 'u upstream'],
+                contextual: [
+                    '↑/↓ branches', '←/→ tab', 'enter checkout',
+                    'F fetch', 'U pull', 'P push',
+                    'D delete', 'R rename', 'u upstream',
+                ],
                 global: NORMAL_GLOBAL_HINTS,
             };
         }
@@ -22704,10 +23265,17 @@ function withPoppedView(state) {
  * in a clean slate — the mental equivalent of a fresh `coco ui`
  * launched against the submodule's working dir.
  *
- * Carry-over preferences (sidebar tab, branch / tag sort, palette
- * recents, inspector tab, diff view mode) are intentionally left
- * untouched. They're user-level choices that should persist across
- * frames, the same way they persist across view pushes today.
+ * Sidebar tab + branch / tag sort are also captured into the return
+ * snapshot (#995) so popping back restores the parent's choices
+ * instead of letting the submodule's tab/sort bleed across the
+ * boundary. The values on the *new* frame are left as-is (carried
+ * over from the parent) — the load effect in app.ts re-reads
+ * persistence keyed on the submodule's workdir and dispatches a
+ * restore if the user has a submodule-specific saved preference.
+ *
+ * Other preferences (palette recents, inspector tab, diff view mode)
+ * stay global by design — the user's preference shouldn't reset when
+ * they cross a submodule boundary.
  *
  * Live runtime objects (`SimpleGit`, loaded `LogInkContext`) live
  * outside the reducer in `app.ts`'s parallel ref structure — this
@@ -22724,6 +23292,10 @@ function withPushedRepoFrame(state, payload) {
             selectedFileIndex: state.selectedFileIndex,
             selectedSubmoduleIndex: state.selectedSubmoduleIndex,
             filter: state.filter,
+            sidebarTab: state.sidebarTab,
+            userSidebarTab: state.userSidebarTab,
+            branchSort: state.branchSort,
+            tagSort: state.tagSort,
         },
     };
     return {
@@ -22776,6 +23348,15 @@ function withPoppedRepoFrame(state) {
         filter: ret.filter,
         filterMode: false,
         pendingCommitFocused: false,
+        // #995 — restore sidebar tab + sort preferences from the captured
+        // parentReturn. Without this, the submodule's tab / sort choice
+        // bleeds back into the parent after pop: the user picks 'tags' in
+        // a vendored submodule, pops back to the parent, and finds the
+        // parent's previously-selected 'branches' tab quietly replaced.
+        sidebarTab: ret.sidebarTab,
+        userSidebarTab: ret.userSidebarTab,
+        branchSort: ret.branchSort,
+        tagSort: ret.tagSort,
         pendingKey: undefined,
         pendingConfirmationId: undefined,
         pendingConfirmationPayload: undefined,
@@ -23551,6 +24132,17 @@ function applyLogInkAction(state, action) {
                 statusLoading: !action.value ? undefined : (action.loading ? true : undefined),
                 pendingKey: undefined,
             };
+        case 'setPendingPullRequestBodyDraft':
+            // PR-body draft tracker (#881 phase 4). Set true while
+            // `startCreatePullRequest` is awaiting the changelog-based
+            // body generation; gates the Esc cancel binding in the input
+            // handler so pressing Esc during the wait skips opening the
+            // follow-up prompt instead of falling through to global Esc.
+            return {
+                ...state,
+                pendingPullRequestBodyDraft: action.value || undefined,
+                pendingKey: undefined,
+            };
         case 'setWorkflowAction':
             return {
                 ...state,
@@ -23794,6 +24386,7 @@ function applyLogInkAction(state, action) {
                     plan: action.plan,
                     planContext: action.planContext,
                     scrollOffset: 0,
+                    fallback: action.fallback,
                 },
                 pendingKey: undefined,
             };
@@ -24570,6 +25163,36 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         }
         return [];
     }
+    // Cancel in-flight AI commit draft (#881 phase 3). When the compose
+    // surface is mid-stream (loading === true), Esc aborts the LLM call
+    // and the runtime handler cleans up (clear loading, clear preview,
+    // status line shows "AI draft cancelled."). Sits above the editing
+    // / view handlers so the cancel keystroke can't fall through to
+    // "leave compose" or anything else.
+    //
+    // Loading and editing are mutually exclusive in practice (the user
+    // can't type while the AI is generating), but the order here makes
+    // the precedence explicit if that ever changes.
+    if (state.activeView === 'compose' && state.commitCompose.loading && key.escape) {
+        return [{ type: 'cancelAiCommitDraft' }];
+    }
+    // Cancel in-flight PR body draft (#881 phase 4). The `C` keystroke
+    // kicks off a changelog-based draft that runs for 5-15 seconds
+    // before the input prompt opens. While the draft is pending, Esc
+    // tells the runtime to skip the prompt and surface a "cancelled"
+    // status. Unlike the compose cancel above, this is a *soft* cancel
+    // — the background LLM call still completes, but its result is
+    // discarded. Acceptable trade-off for now; deeper signal threading
+    // through `changelogHandler` lands in a follow-up if real cancel
+    // becomes a request.
+    //
+    // Sits unconditionally on the global Esc check (no `activeView`
+    // gate) because the draft can be initiated from any view via the
+    // palette `C` binding; Esc must work wherever the user is when
+    // they decide to bail.
+    if (state.pendingPullRequestBodyDraft && key.escape) {
+        return [{ type: 'cancelPullRequestBodyDraft' }];
+    }
     if (state.commitCompose.editing) {
         if (key.escape) {
             return [action({ type: 'commitCompose', action: { type: 'setEditing', value: false } })];
@@ -26438,6 +27061,27 @@ function getLogInkInputEvents(state, inputValue, key = {}, context = {}) {
         events.push({ type: 'createManualCommit' });
         return events;
     }
+    // Context-sensitive per-branch variants of F / U / P. When the
+    // user has the branches sidebar / view focused with at least one
+    // branch, F / U / P should act on the cursored row, not on the
+    // current branch. This intercept fires BEFORE the generic
+    // workflow-by-key lookup below so the global *-current-branch
+    // variants don't shadow the contextual ones.
+    //
+    // Outside the branches context, the generic lookup runs and the
+    // F / U / P keys hit the global `fetch-remotes` / `pull-current-branch`
+    // / `push-current-branch` workflows as before.
+    if (isBranchActionTarget(state) && context.branchCount) {
+        if (inputValue === 'F') {
+            return [{ type: 'runWorkflowAction', id: 'fetch-selected-branch' }];
+        }
+        if (inputValue === 'U') {
+            return [{ type: 'runWorkflowAction', id: 'pull-selected-branch' }];
+        }
+        if (inputValue === 'P') {
+            return [{ type: 'runWorkflowAction', id: 'push-selected-branch' }];
+        }
+    }
     const workflowAction = getLogInkWorkflowActionByKey(inputValue);
     if (workflowAction?.requiresConfirmation) {
         return [action({ type: 'setPendingConfirmation', value: workflowAction.id })];
@@ -26565,17 +27209,24 @@ function formatRemainingWorktreeHint(unstaged, untracked) {
  *
  * When the worktree is clean post-apply:
  *   "Created N commits — press gh to view them in history. Worktree is clean."
+ *
+ * When `fallback` is set, the planner exhausted its retry budget and
+ * the apply landed the single-group fallback plan instead of a real
+ * multi-group split. Prefix the message so the user knows the result
+ * isn't a true LLM split — they may want to re-roll with a different
+ * model, or accept the combined commit as-is.
  */
-function formatSplitApplySuccess(commitCount, unstaged, untracked) {
+function formatSplitApplySuccess(commitCount, unstaged, untracked, fallback) {
     const created = commitCount === 1
         ? 'Created 1 commit'
         : `Created ${commitCount} commits`;
     const navCue = `${created} — press gh to view them in history.`;
     const remainingHint = formatRemainingWorktreeHint(unstaged, untracked);
-    if (!remainingHint) {
-        return `${navCue} Worktree is clean.`;
+    const tail = remainingHint ? ` ${remainingHint}` : ' Worktree is clean.';
+    if (fallback) {
+        return `Split planner fallback applied (combined commit) — ${fallback.reason}. ${navCue}${tail}`;
     }
-    return `${navCue} ${remainingHint}`;
+    return `${navCue}${tail}`;
 }
 
 /**
@@ -27540,6 +28191,106 @@ function pushCurrentBranch(git) {
 function setUpstream(git, localBranch, upstreamBranch) {
     return runAction$5(() => git.raw(['branch', '--set-upstream-to', upstreamBranch, localBranch]), `Set ${localBranch} upstream to ${upstreamBranch}`);
 }
+/**
+ * Push an arbitrary local branch (need not be the current branch) to
+ * its remote. Refuses when the branch has no upstream and no remote
+ * defaulting is configured — that branch needs a `git push -u …` from
+ * the shell first.
+ *
+ * Pairs with `pushCurrentBranch` (no-arg variant); the workstation
+ * dispatcher picks one or the other based on where the cursor is.
+ */
+function pushBranch(git, branch) {
+    if (branch.type !== 'local') {
+        return Promise.resolve({
+            ok: false,
+            message: 'Only local branches can be pushed.',
+        });
+    }
+    if (!branch.upstream || !branch.remote) {
+        return Promise.resolve({
+            ok: false,
+            message: `${branch.shortName} has no upstream — checkout the branch and run \`git push -u <remote> ${branch.shortName}\` first.`,
+        });
+    }
+    return runAction$5(() => git.raw(['push', branch.remote, branch.shortName]), `Pushed ${branch.shortName} to ${branch.upstream}`);
+}
+/**
+ * Fetch the cursored branch's upstream from its remote. Side-effect
+ * free on the working tree — just updates the remote-tracking ref.
+ * Works for any branch with an upstream regardless of checkout state.
+ *
+ * Falls back to a clean error when the branch has no upstream
+ * configured (`git fetch <remote> <name>` would assume an unrelated
+ * default refspec and surprise the user).
+ */
+function fetchBranch(git, branch) {
+    if (branch.type !== 'local') {
+        return Promise.resolve({
+            ok: false,
+            message: 'Only local branches can be fetched per-branch — use F to fetch all remotes.',
+        });
+    }
+    if (!branch.upstream || !branch.remote) {
+        return Promise.resolve({
+            ok: false,
+            message: `${branch.shortName} has no upstream — nothing to fetch.`,
+        });
+    }
+    // `branch.upstream` is the short form (e.g. `origin/main`); the
+    // ref name after the remote prefix is what fetch wants as the
+    // refspec source. For a remote `origin` and upstream `origin/main`
+    // we run `git fetch origin main`.
+    const upstreamRef = branch.upstream.startsWith(`${branch.remote}/`)
+        ? branch.upstream.slice(branch.remote.length + 1)
+        : branch.upstream;
+    return runAction$5(() => git.raw(['fetch', branch.remote, upstreamRef]), `Fetched ${branch.upstream}`);
+}
+/**
+ * Pull the cursored branch. Branches into two paths based on whether
+ * the branch is currently checked out:
+ *
+ *   - **Current branch**: defer to `pullCurrentBranch` (standard
+ *     `git pull --ff-only`).
+ *   - **Non-current branch**: use the refspec form
+ *     `git fetch <remote> <branch>:<branch>` which advances the local
+ *     ref to match the remote ref ONLY if the update is fast-forward.
+ *     Returns non-zero on non-FF without touching the working tree.
+ *     Diverged branches need a checkout + `pull --rebase` from the
+ *     user; we refuse rather than try to do that for them.
+ *
+ * `currentBranchName` lets the dispatcher compare without re-querying
+ * git — it already has the value in `context.branches.currentBranch`.
+ */
+function pullBranch(git, branch, currentBranchName) {
+    if (branch.type !== 'local') {
+        return Promise.resolve({
+            ok: false,
+            message: 'Only local branches can be pulled.',
+        });
+    }
+    if (!branch.upstream || !branch.remote) {
+        return Promise.resolve({
+            ok: false,
+            message: `${branch.shortName} has no upstream — nothing to pull.`,
+        });
+    }
+    // Current branch — defer to the in-place workflow.
+    if (branch.shortName === currentBranchName) {
+        return pullCurrentBranch(git);
+    }
+    // Non-current branch — refspec-based fast-forward refusing non-FF.
+    // `branch.upstream` is `<remote>/<ref>`; strip the remote prefix to
+    // get the upstream ref name to fetch.
+    const upstreamRef = branch.upstream.startsWith(`${branch.remote}/`)
+        ? branch.upstream.slice(branch.remote.length + 1)
+        : branch.upstream;
+    return runAction$5(() => git.raw([
+        'fetch',
+        branch.remote,
+        `${upstreamRef}:${branch.shortName}`,
+    ]), `Fast-forwarded ${branch.shortName} to ${branch.upstream}`);
+}
 
 async function runAction$4(action, successMessage) {
     try {
@@ -29063,29 +29814,81 @@ function formatBranchDivergence(branch, options = {}) {
         parts.push(`↓${branch.behind}`);
     return `${parts.join(' ')} ${branch.upstream}`;
 }
-/**
- * Single-cell marker shown to the left of a branch name in lists.
- *
- * - `*` — current branch (regardless of remote state)
- * - `◌` — no upstream
- * - `≡` — has upstream + synced (ahead === 0 && behind === 0)
- * - `↕` — has upstream + diverged (any non-zero ahead/behind)
- * - ` ` — fallback / no info
- *
- * ASCII fallbacks (legible without box-drawing/arrow glyphs):
- * - `?` for "no upstream", `=` for synced, `~` for diverged.
- */
+function formatUpstreamAheadBanner(branch, options = {}) {
+    if (!branch?.upstream || branch.behind <= 0) {
+        return undefined;
+    }
+    const sep = options.ascii ? '.' : '·';
+    if (branch.ahead > 0) {
+        // Diverged — local has work too, fast-forward pull is impossible.
+        // Suggest pull --rebase as the cleaner-history default; users who
+        // prefer merge can do that themselves.
+        const symbols = options.ascii
+            ? `+${branch.ahead} -${branch.behind}`
+            : `↑${branch.ahead} ↓${branch.behind}`;
+        return `${symbols} diverged from ${branch.upstream} ${sep} F fetch ${sep} U pull --rebase`;
+    }
+    // Behind-only — fast-forward pull works.
+    const arrow = options.ascii ? 'v' : '↓';
+    const noun = branch.behind === 1 ? 'commit' : 'commits';
+    return `${arrow} ${branch.behind} ${noun} behind ${branch.upstream} ${sep} F fetch ${sep} U pull`;
+}
 function branchRowMarker(branch, options = {}) {
-    if (branch.current)
-        return '*';
-    if (!branch.upstream)
-        return options.ascii ? '?' : '◌';
+    if (branch.current) {
+        return { glyph: '*', kind: 'head' };
+    }
+    if (!branch.upstream) {
+        return { glyph: options.ascii ? '?' : '◌', kind: 'no-upstream' };
+    }
     const ahead = branch.ahead ?? 0;
     const behind = branch.behind ?? 0;
     if (ahead === 0 && behind === 0) {
-        return options.ascii ? '=' : '≡';
+        return { glyph: options.ascii ? '=' : '≡', kind: 'synced' };
+    }
+    if (ahead > 0 && behind > 0) {
+        return { glyph: options.ascii ? '~' : '⇅', kind: 'diverged' };
+    }
+    if (behind > 0) {
+        return { glyph: options.ascii ? 'v' : '↓', kind: 'behind' };
+    }
+    // ahead > 0 (the only remaining case after the guards above)
+    return { glyph: options.ascii ? '^' : '↑', kind: 'ahead' };
+}
+/**
+ * Theme-aware colour picker for a `BranchRowMarker.kind`.
+ *
+ * Reuses the existing chip / banner colour semantic so the workstation
+ * speaks one visual language across history (chips, "behind upstream"
+ * banner) and the branches list:
+ *
+ *   - `head`        → success green (matches HEAD chip)
+ *   - `behind`      → warning yellow (matches "behind upstream" banner)
+ *   - `diverged`    → warning yellow (same: action needed inbound)
+ *   - `ahead`       → info blue (you have work to push)
+ *   - `synced`      → undefined (neutral; inherit row's existing dim)
+ *   - `no-upstream` → undefined (neutral; same)
+ *
+ * Returns `undefined` under `noColor` / `ascii` for the muted cases so
+ * the row renderer skips the colour wrap entirely; the glyph alone
+ * carries the meaning.
+ */
+function getBranchRowMarkerColor(kind, theme) {
+    if (theme.noColor)
+        return undefined;
+    switch (kind) {
+        case 'head':
+            return theme.colors.success;
+        case 'behind':
+        case 'diverged':
+            return theme.colors.warning;
+        case 'ahead':
+            return theme.colors.info;
+        case 'synced':
+        case 'no-upstream':
+            return undefined;
+        default:
+            return undefined;
     }
-    return options.ascii ? '~' : '↕';
 }
 /**
  * Compact, human-friendly relative timestamp for the branch row.
@@ -29693,7 +30496,7 @@ function renderActiveSidebarContent(h, Text, tab, state, context, contextStatus,
         ];
         return [
             ...headerRows,
-            ...renderSelectableSidebarRows(h, Text, sortedBranches, state.selectedBranchIndex, focused, width, theme, (branch) => `${branchRowMarker(branch, { ascii: theme.ascii })} ${branch.shortName}`, 'tab-branches', visibleListCount),
+            ...renderSelectableSidebarRows(h, Text, sortedBranches, state.selectedBranchIndex, focused, width, theme, (branch) => `${branchRowMarker(branch, { ascii: theme.ascii }).glyph} ${branch.shortName}`, 'tab-branches', visibleListCount),
         ];
     }
     if (tab === 'tags') {
@@ -30156,21 +30959,22 @@ function renderBranchesSurface(h, components, state, context, contextStatus, bod
                 const isSelected = index === selected;
                 const cursor = isSelected ? '>' : ' ';
                 const marker = branchRowMarker(branch, { ascii: theme.ascii });
+                const markerColor = getBranchRowMarkerColor(marker.kind, theme);
                 const divergence = formatBranchDivergence(branch, { ascii: theme.ascii });
                 const lastTouched = formatBranchLastTouched(branch.date, new Date());
                 // Split the row into spans so the timestamp stays dim even on the
-                // currently-selected (bold) row. The leading marker + name keep
-                // their per-window-derived column widths; the timestamp is
-                // right-padded so the divergence column stays aligned across rows.
+                // currently-selected (bold) row, and the sync-state marker keeps
+                // its own colour even when the surrounding row text is dimmed.
                 const namePadded = truncateCells(branch.shortName, nameColWidth).padEnd(nameColWidth);
                 const timestampPadded = lastTouched.padEnd(8);
                 const lineDim = !isSelected && !branch.current;
-                const head = `${cursor} ${marker} ${namePadded} `;
+                const cursorAndPad = `${cursor} `;
+                const trailingName = ` ${namePadded} `;
                 const trailingDivergence = divergence ? ` ${divergence}` : '';
                 // Truncate the assembled line to the actual panel width so a
                 // narrow inspector / sidebar focus doesn't push branch rows
                 // onto a second visual line (#830).
-                const fullText = `${head}${timestampPadded}${trailingDivergence}`;
+                const fullText = `${cursorAndPad}${marker.glyph}${trailingName}${timestampPadded}${trailingDivergence}`;
                 const truncated = truncateCells(fullText, Math.max(20, width - 4));
                 // If truncation chopped into the timestamp/divergence portion,
                 // fall back to a single Text to keep the visible width honest.
@@ -30185,7 +30989,15 @@ function renderBranchesSurface(h, components, state, context, contextStatus, bod
                     key: `branch-${index}`,
                     bold: isSelected,
                     dimColor: lineDim,
-                }, head, h(Text, { dimColor: true }, timestampPadded), trailingDivergence);
+                }, cursorAndPad, 
+                // The marker carries the sync-state colour; an explicit
+                // `dimColor: false` on this span keeps the colour bright even
+                // when the surrounding row is dim (other branches in the list
+                // dim out under the existing `lineDim` rule). The synced /
+                // no-upstream kinds return undefined from
+                // `getBranchRowMarkerColor`, so those markers inherit the
+                // row's dim and read as quiet chrome.
+                h(Text, { color: markerColor, dimColor: markerColor ? false : undefined }, marker.glyph), trailingName, h(Text, { dimColor: true }, timestampPadded), trailingDivergence);
             });
     return h(Box, {
         borderColor: focusBorderColor(theme, focused),
@@ -30312,6 +31124,97 @@ function renderChangelogSurface(h, components, state, _context, _contextStatus,
     }, h(Box, { justifyContent: 'space-between' }, h(Text, { bold: true }, panelTitle(headerLeft, focused)), h(Text, { dimColor: true }, headerRight)), ...lines);
 }
 
+/**
+ * Streaming-preview helper (#881 phase 2). Turns the raw accumulated
+ * text from an in-flight LLM stream into the last N visual lines that
+ * fit a given panel width, plus a flag telling the renderer whether
+ * earlier content was elided.
+ *
+ * Why a chrome helper instead of inlining the math in the compose
+ * surface: the same shape is going to be reused by PR-body and review
+ * streaming once those surfaces opt in. The visual line math (wrap to
+ * width, count from the bottom, mark truncation) doesn't belong on the
+ * surface itself.
+ *
+ * No JSX / no Ink here — chrome modules stay framework-agnostic and
+ * return data the surface can hand to its own `h(Text, ...)` calls.
+ */
+/**
+ * Default last-N visible visual lines. Tuned for compose where the
+ * panel already shows summary + body + loading line, so the preview
+ * can't take more vertical space without pushing the state-line off
+ * the bottom of short terminals. 6 lines is roughly two short
+ * commit-body paragraphs — enough to feel like content is flowing,
+ * not so much that the user loses sight of the surrounding chrome.
+ */
+const DEFAULT_STREAMING_PREVIEW_LINES = 6;
+/**
+ * Marker prefixed to the first visible line when earlier content was
+ * elided. Chrome theme picks ASCII vs Unicode at render time; this
+ * module returns both so surfaces don't need to import the theme.
+ */
+const STREAMING_PREVIEW_TRUNCATE_GLYPH = '…';
+const STREAMING_PREVIEW_TRUNCATE_ASCII = '...';
+/**
+ * Compute the visible preview window for a streaming buffer.
+ *
+ * The buffer is split on newlines (preserving blank lines so paragraph
+ * spacing stays visible), each source line is hard-wrapped to `width`,
+ * and the trailing `maxLines` wrapped lines are returned. When the
+ * total wrapped line count exceeds `maxLines`, `truncated` is true so
+ * the renderer can prefix the first line with an ellipsis marker.
+ *
+ * Whitespace-only / empty input returns `{ lines: [], truncated: false }`
+ * so renderers can branch on `lines.length === 0` to skip rendering
+ * entirely during the brief window between dispatching `setLoading`
+ * and the first chunk arriving.
+ *
+ * Width math mirrors the compose surface's body wrap (`width - 6` for
+ * border + paddingX + 2-space indent budget); callers pass the width
+ * they intend to use and this helper assumes it's the wrap budget,
+ * not the panel width.
+ */
+function formatStreamingPreview(accumulated, width, maxLines = DEFAULT_STREAMING_PREVIEW_LINES) {
+    if (!accumulated) {
+        return { lines: [], truncated: false };
+    }
+    const trimmed = accumulated.replace(/\s+$/u, '');
+    if (!trimmed) {
+        return { lines: [], truncated: false };
+    }
+    // Wrap each source line. Empty source lines must survive the wrap so
+    // a stream like "A\n\nB" reads as two paragraphs separated by a blank
+    // row rather than collapsing into "A B".
+    const wrapWidth = Math.max(8, width);
+    const wrapped = [];
+    for (const line of trimmed.split('\n')) {
+        if (line === '') {
+            wrapped.push('');
+            continue;
+        }
+        for (const segment of wrapCells(line, wrapWidth)) {
+            wrapped.push(segment);
+        }
+    }
+    const budget = Math.max(1, maxLines);
+    if (wrapped.length <= budget) {
+        return { lines: wrapped, truncated: false };
+    }
+    return {
+        lines: wrapped.slice(wrapped.length - budget),
+        truncated: true,
+    };
+}
+/**
+ * Resolve the truncation marker for the current theme. Pure helper so
+ * the surface can render a single-character glyph in colour terminals
+ * and the ASCII fallback when `theme.ascii` is on. Centralised here so
+ * future surfaces opting into streaming use the same glyph.
+ */
+function streamingPreviewTruncateMarker(ascii) {
+    return ascii ? STREAMING_PREVIEW_TRUNCATE_ASCII : STREAMING_PREVIEW_TRUNCATE_GLYPH;
+}
+
 /**
  * Compose surface — the in-TUI commit-message composer. Combines a
  * summary line, a body field, and a state-line footer; an inline
@@ -30321,6 +31224,33 @@ function renderChangelogSurface(h, components, state, _context, _contextStatus,
  * Extracted from `src/commands/log/inkRuntime.ts` as part of phase 5a.2
  * of #890. No behavior change.
  */
+/**
+ * Render the streaming-preview block — the trailing lines of the
+ * in-flight LLM stream that sit below the loading spinner. Pure
+ * formatting; the wrap math + truncation flag live in the
+ * `streamingPreview` chrome helper so other surfaces (PR body,
+ * review) can reuse them later.
+ *
+ * Returns an empty array when no preview text is present (the loader
+ * just shows the spinner) so the caller's spread doesn't insert blank
+ * rows that would shift the state-line.
+ */
+function renderStreamingPreviewLines(h, components, preview, width, theme) {
+    const { Text } = components;
+    const view = formatStreamingPreview(preview, width);
+    if (view.lines.length === 0)
+        return [];
+    const marker = view.truncated ? streamingPreviewTruncateMarker(theme.ascii) : '';
+    return view.lines.map((line, index) => {
+        // Prefix the first line with the truncation marker when earlier
+        // content was elided. Subsequent lines render unprefixed.
+        const prefix = index === 0 && marker ? `${marker} ` : '  ';
+        return h(Text, {
+            key: `compose-stream-${index}`,
+            dimColor: true,
+        }, `${prefix}${line}`);
+    });
+}
 function renderComposeSurface(h, components, state, context, contextStatus, bodyRows, width, theme, spinnerFrame = 0) {
     const { Box, Text } = components;
     const compose = state.commitCompose;
@@ -30344,9 +31274,16 @@ function renderComposeSurface(h, components, state, context, contextStatus, body
         : ['<empty>'];
     const summaryVisualLines = wrapCells(`${compose.summary || '<empty>'}${summaryCursor}`, Math.max(8, width - 11) // "Summary  " (9) + 2 chrome = 11
     );
+    // State-line cycles through three modes (#881 phase 3 added the
+    // loading variant): editing copy when the user is typing, cancel
+    // hint when an AI draft is generating, default guidance otherwise.
+    // The cancel hint also covers the streaming preview window — same
+    // keystroke (Esc) aborts whether or not the preview is visible.
     const stateLine = compose.editing
         ? 'Editing — Enter switches summary↔body, Esc exits edit mode.'
-        : 'Press e to edit, c to commit, I for AI draft, esc to leave.';
+        : compose.loading
+            ? 'Generating AI draft — press Esc to cancel.'
+            : 'Press e to edit, c to commit, I for AI draft, esc to leave.';
     const hasStagedFiles = (worktree?.files || [])
         .some((file) => file.indexStatus !== ' ' && file.indexStatus !== '?');
     // Staged file list is rendered in the right Worktree panel
@@ -30393,6 +31330,13 @@ function renderComposeSurface(h, components, state, context, contextStatus, body
             }, theme.ascii
                 ? `[${pickSpinnerFrame(spinnerFrame).replace(/[^a-zA-Z0-9 ]/g, '.')}] Generating AI commit draft (this can take a moment)`
                 : `${pickSpinnerFrame(spinnerFrame)}  Generating AI commit draft… (this can take a moment)`),
+            // Streaming preview (#881 phase 2). Renders the trailing visual
+            // lines of the in-flight LLM stream below the loader so the user
+            // sees content building up instead of an opaque spinner. Empty
+            // before the first chunk arrives; the preview helper returns an
+            // empty `lines` array in that window so we skip the block
+            // entirely.
+            ...renderStreamingPreviewLines(h, components, compose.streamingPreview, bodyTextWidth, theme),
         ]
         : []), ...(compose.message ? [h(Text, undefined, ''), h(Text, { key: 'compose-msg' }, truncateCells(compose.message, 140))] : []), ...(compose.details || []).map((line, index) => h(Text, {
         key: `compose-detail-${index}`,
@@ -32197,6 +33141,25 @@ function renderHistoryPanel(h, components, state, context, bodyRows, width, them
         paddingX: 1,
         width,
     }, h(Box, { justifyContent: 'space-between' }, h(Text, { bold: true }, panelTitle('Commits', focused)), h(Text, { dimColor: true }, `${title} | ${graphMode} | ${loadState}`)), 
+    // Upstream-ahead banner. Surfaces "the remote has work you don't"
+    // for the current branch — distinct from the chip work in 0.52.0
+    // which colours remote refs IN the row set. On a behind branch the
+    // upstream commits aren't reachable from local HEAD, so the chips
+    // alone can't signal "fetch / pull needed." This single line does.
+    //
+    // Two wording variants (behind-only vs diverged) live in the
+    // helper; render is identical aside from the formatted string.
+    // Warning yellow = same semantic as the remote-tracking chip kind.
+    ...((() => {
+        const currentBranchRef = context.branches?.localBranches.find((branch) => branch.current);
+        const banner = formatUpstreamAheadBanner(currentBranchRef, { ascii: theme.ascii });
+        if (!banner)
+            return [];
+        return [h(Text, {
+                key: 'upstream-ahead-banner',
+                color: theme.noColor ? undefined : theme.colors.warning,
+            }, banner)];
+    })()), 
     // Server-side filter indicator (#776). Only rendered when the user
     // has an active path:/author: prefix; clears when they Ctrl+U.
     ...(state.historyFetchArgs
@@ -35247,9 +36210,18 @@ function LogInkApp(deps) {
     // Wrappers that delegate to the active frame's runtime entry so the
     // existing call sites stay byte-identical. Support both function-
     // updater and value-updater forms (the codebase uses both).
-    const setContext = React.useCallback((arg) => {
+    //
+    // `targetDepth` (#994) routes the write to a specific frame instead
+    // of the currently-active one. Loaders that capture the depth at
+    // issue-time and pass it here are robust against frame-stack
+    // mutations (push / pop) that happen while the load is in flight —
+    // the write lands on the frame that issued it, or silently drops
+    // if that frame has been popped (`updateRepoFrameRuntime` no-ops on
+    // out-of-range indices). Without the tag, an in-flight refresh on
+    // the parent would clobber a freshly-pushed submodule frame.
+    const setContext = React.useCallback((arg, targetDepth) => {
         setRuntimes((prev) => {
-            const depth = prev.length - 1;
+            const depth = targetDepth ?? prev.length - 1;
             if (depth < 0)
                 return prev;
             return updateRepoFrameRuntime(prev, depth, (frame) => ({
@@ -35260,9 +36232,9 @@ function LogInkApp(deps) {
             }));
         });
     }, []);
-    const setContextStatus = React.useCallback((arg) => {
+    const setContextStatus = React.useCallback((arg, targetDepth) => {
         setRuntimes((prev) => {
-            const depth = prev.length - 1;
+            const depth = targetDepth ?? prev.length - 1;
             if (depth < 0)
                 return prev;
             return updateRepoFrameRuntime(prev, depth, (frame) => ({
@@ -35588,28 +36560,39 @@ function LogInkApp(deps) {
         // (stale-while-revalidate) and quietly swap it in once the new fetch
         // resolves — avoids the every-second flicker the watcher would
         // otherwise produce on busy repos.
+        //
+        // #994 — capture the depth this refresh was issued from BEFORE
+        // the await. The callback closure also captured `git` from the
+        // same render, so they're consistent: when the user drills into
+        // a submodule mid-await, the resolved data still lands on the
+        // parent frame (the one whose `git` was used for the fetch),
+        // not on the freshly-pushed submodule frame.
+        const issuedAtDepth = runtimes.length - 1;
         if (!options.silent) {
             dispatch({ type: 'setStatus', value: 'refreshing repository context' });
-            setContextStatus(createLogInkContextStatus('loading'));
+            setContextStatus(createLogInkContextStatus('loading'), issuedAtDepth);
         }
         const next = await loadLogInkContext(git);
-        setContext(next);
-        setContextStatus(createLogInkContextStatus('ready'));
+        setContext(next, issuedAtDepth);
+        setContextStatus(createLogInkContextStatus('ready'), issuedAtDepth);
         if (!options.silent) {
             dispatch({ type: 'setStatus', value: 'repository context refreshed' });
         }
-    }, [dispatch, git]);
+    }, [dispatch, git, runtimes.length, setContext, setContextStatus]);
     const refreshWorktreeContext = React.useCallback(async (options = {}) => {
+        // #994 — same frame-tagging as refreshContext above. Worktree
+        // loads are usually fast but still race-prone on slow disks.
+        const issuedAtDepth = runtimes.length - 1;
         if (!options.silent) {
-            setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'loading'));
+            setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'loading'), issuedAtDepth);
         }
         const worktree = await safe(getWorktreeOverview(git));
         setContext((current) => ({
             ...current,
             worktree,
-        }));
-        setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'ready'));
-    }, [git]);
+        }), issuedAtDepth);
+        setContextStatus((current) => updateLogInkContextStatus(current, 'worktree', 'ready'), issuedAtDepth);
+    }, [git, runtimes.length, setContext, setContextStatus]);
     // Live refresh: watch .git metadata + the working tree root and reload
     // context when something changes outside the TUI (editor save, external
     // git commands, branch switch in another terminal). Best-effort — the
@@ -35834,6 +36817,11 @@ function LogInkApp(deps) {
     const contextStatusRef = React.useRef(contextStatus);
     contextStatusRef.current = contextStatus;
     React.useEffect(() => {
+        // #994 — capture the depth this boot load is being issued for.
+        // The git instance in the closure is bound to this frame; tagged
+        // writes ensure resolved values land on the correct runtime entry
+        // even if a subsequent push/pop changes the active frame mid-load.
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
         loadLogInkContextEntries(git).forEach(({ key, load }) => {
             if (contextStatusRef.current[key] === 'ready')
@@ -35845,14 +36833,14 @@ function LogInkApp(deps) {
                 setContext((current) => ({
                     ...current,
                     [key]: value,
-                }));
-                setContextStatus((current) => updateLogInkContextStatus(current, key, 'ready'));
+                }), issuedAtDepth);
+                setContextStatus((current) => updateLogInkContextStatus(current, key, 'ready'), issuedAtDepth);
             });
         });
         return () => {
             active = false;
         };
-    }, [git]);
+    }, [git, runtimes.length, setContext, setContextStatus]);
     // Lazy-load the full pullRequest overview (#808). Only fires when
     // the user actually navigates to the PR view, and only when we
     // don't already have data (so a workflow-triggered refresh that
@@ -35866,21 +36854,22 @@ function LogInkApp(deps) {
             return;
         if (context.pullRequest)
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
-        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'loading'));
+        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'loading'), issuedAtDepth);
         void safe(getPullRequestOverview(git)).then((value) => {
             if (!active)
                 return;
             setContext((current) => ({
                 ...current,
                 pullRequest: value,
-            }));
-            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'ready'));
+            }), issuedAtDepth);
+            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequest', 'ready'), issuedAtDepth);
         });
         return () => {
             active = false;
         };
-    }, [git, state.activeView, context.pullRequest]);
+    }, [git, runtimes.length, state.activeView, context.pullRequest, setContext, setContextStatus]);
     // Lazy-load the issue triage list (#882 phase 3, filter-aware
     // since phase 6). Fires on entry to the view AND on filter
     // preset changes (`f` cycles the preset; the dep on
@@ -35892,8 +36881,9 @@ function LogInkApp(deps) {
             return;
         if (context.issueList)
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
-        setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'loading'));
+        setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'loading'), issuedAtDepth);
         const filter = issueFilterForPreset(state.selectedIssueFilter);
         void safe(getIssueList(git, filter)).then((value) => {
             if (!active)
@@ -35901,13 +36891,21 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 issueList: value,
-            }));
-            setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'ready'));
+            }), issuedAtDepth);
+            setContextStatus((current) => updateLogInkContextStatus(current, 'issueList', 'ready'), issuedAtDepth);
         });
         return () => {
             active = false;
         };
-    }, [git, state.activeView, context.issueList, state.selectedIssueFilter]);
+    }, [
+        git,
+        runtimes.length,
+        state.activeView,
+        context.issueList,
+        state.selectedIssueFilter,
+        setContext,
+        setContextStatus,
+    ]);
     // Filter cycling: when the preset changes, drop the cached list
     // so the effect above re-fires with the new filter. Done as a
     // separate effect (rather than folded into the cycle reducer)
@@ -35931,8 +36929,9 @@ function LogInkApp(deps) {
             return;
         if (context.pullRequestList)
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
-        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'loading'));
+        setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'loading'), issuedAtDepth);
         const filter = pullRequestFilterForPreset(state.selectedPullRequestFilter);
         void safe(getPullRequestList(git, filter)).then((value) => {
             if (!active)
@@ -35940,13 +36939,21 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 pullRequestList: value,
-            }));
-            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'ready'));
+            }), issuedAtDepth);
+            setContextStatus((current) => updateLogInkContextStatus(current, 'pullRequestList', 'ready'), issuedAtDepth);
         });
         return () => {
             active = false;
         };
-    }, [git, state.activeView, context.pullRequestList, state.selectedPullRequestFilter]);
+    }, [
+        git,
+        runtimes.length,
+        state.activeView,
+        context.pullRequestList,
+        state.selectedPullRequestFilter,
+        setContext,
+        setContextStatus,
+    ]);
     React.useEffect(() => {
         if (state.activeView !== 'pull-request-triage')
             return;
@@ -35976,6 +36983,7 @@ function LogInkApp(deps) {
             return;
         if (context.issueDetailByNumber?.has(cursored.number))
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
         const timer = setTimeout(async () => {
             const result = await getIssueDetail(cursored.number);
@@ -35984,17 +36992,19 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 issueDetailByNumber: new Map(current.issueDetailByNumber || []).set(result.detail.number, result.detail),
-            }));
+            }), issuedAtDepth);
         }, DETAIL_HYDRATION_DELAY_MS);
         return () => {
             active = false;
             clearTimeout(timer);
         };
     }, [
+        runtimes.length,
         state.activeView,
         state.selectedIssueIndex,
         filteredIssueList,
         context.issueDetailByNumber,
+        setContext,
     ]);
     React.useEffect(() => {
         if (state.activeView !== 'pull-request-triage')
@@ -36004,6 +37014,7 @@ function LogInkApp(deps) {
             return;
         if (context.pullRequestDetailByNumber?.has(cursored.number))
             return;
+        const issuedAtDepth = runtimes.length - 1;
         let active = true;
         const timer = setTimeout(async () => {
             const result = await getPullRequestDetail(cursored.number);
@@ -36012,17 +37023,19 @@ function LogInkApp(deps) {
             setContext((current) => ({
                 ...current,
                 pullRequestDetailByNumber: new Map(current.pullRequestDetailByNumber || []).set(result.detail.number, result.detail),
-            }));
+            }), issuedAtDepth);
         }, DETAIL_HYDRATION_DELAY_MS);
         return () => {
             active = false;
             clearTimeout(timer);
         };
     }, [
+        runtimes.length,
         state.activeView,
         state.selectedPullRequestTriageIndex,
         filteredPullRequestTriageList,
         context.pullRequestDetailByNumber,
+        setContext,
     ]);
     React.useEffect(() => {
         let active = true;
@@ -36283,21 +37296,96 @@ function LogInkApp(deps) {
         state.commitCompose.body,
         state.commitCompose.summary,
     ]);
+    // AbortController for the in-flight AI draft (#881 phase 3). Kept in
+    // a ref rather than state because cancel is a side-effect: the input
+    // handler reads `controllerRef.current?.abort()` synchronously when
+    // Esc fires during a loading draft. Storing it in state would force
+    // a re-render on every set, and React doesn't need to know — only
+    // the imperative cancel path does. Cleared after each call settles
+    // so a stale controller can't cancel a future draft.
+    const aiDraftAbortRef = React.useRef(null);
     const runAiCommitDraft = React.useCallback(async () => {
+        // Tear down any controller from a previous draft (defensive — a
+        // settled call should have cleared it in the finally block, but
+        // double-running would otherwise leave the first orphaned).
+        aiDraftAbortRef.current?.abort();
+        const controller = new AbortController();
+        aiDraftAbortRef.current = controller;
         dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: true } });
         dispatch({ type: 'setStatus', value: 'generating AI commit draft', loading: true });
-        const result = await runCommitDraftWorkflow();
-        if (result.ok && result.draft) {
-            dispatch({ type: 'commitCompose', action: { type: 'setDraft', value: result.draft } });
-            dispatch({ type: 'setStatus', value: 'AI draft ready for editing' });
-            return;
+        // Streaming preview (#881 phase 2). The workflow forwards this to
+        // `generateCommitDraft`, which only actually streams when the
+        // user opted in via `service.streaming.enabled`. The callback
+        // updates `commitCompose.streamingPreview` so the compose surface
+        // renders a live last-N-lines preview below the loader. The
+        // reducer clears `streamingPreview` whenever loading flips off
+        // (success or failure), so we don't need an explicit teardown
+        // dispatch here.
+        try {
+            const result = await runCommitDraftWorkflow({
+                git,
+                signal: controller.signal,
+                onStreamChunk: (_text, accumulated) => {
+                    // Dispatch the full accumulated text — the preview chrome
+                    // helper does the last-N-lines slicing at render time, so
+                    // re-doing the slice here would be wasted work. Per-chunk
+                    // dispatches are cheap; React batches them and Ink redraws
+                    // at its own frame cadence.
+                    dispatch({
+                        type: 'commitCompose',
+                        action: { type: 'setStreamingPreview', value: accumulated },
+                    });
+                },
+            });
+            // Cancel path (#881 phase 3). User pressed Esc during the
+            // stream; reducer drops loading + preview, status line shows
+            // a neutral "cancelled" message. Skip the result / failure
+            // dispatches because the user already knows what happened.
+            if (result.cancelled) {
+                dispatch({ type: 'commitCompose', action: { type: 'setLoading', value: false } });
+                dispatch({ type: 'setStatus', value: 'AI draft cancelled.' });
+                return;
+            }
+            if (result.ok && result.draft) {
+                dispatch({ type: 'commitCompose', action: { type: 'setDraft', value: result.draft } });
+                dispatch({ type: 'setStatus', value: 'AI draft ready for editing' });
+                return;
+            }
+            dispatch({
+                type: 'commitCompose',
+                action: { type: 'setResult', message: result.message, details: result.details },
+            });
+            dispatch({ type: 'setStatus', value: result.message });
         }
-        dispatch({
-            type: 'commitCompose',
-            action: { type: 'setResult', message: result.message, details: result.details },
-        });
-        dispatch({ type: 'setStatus', value: result.message });
-    }, [dispatch]);
+        finally {
+            // Clear the ref only if it still points at OUR controller — a
+            // rapid second invocation could have already replaced it, in
+            // which case the new controller is the one that owns cancel
+            // duty now.
+            if (aiDraftAbortRef.current === controller) {
+                aiDraftAbortRef.current = null;
+            }
+        }
+    }, [dispatch, git]);
+    /**
+     * Cancel an in-flight AI draft (#881 phase 3). Called by the input
+     * handler when the user presses Esc while `commitCompose.loading`
+     * is true. Idempotent — calling without an active controller is a
+     * no-op rather than an error so the keystroke handler can fire
+     * unconditionally during the loading window.
+     *
+     * `controller.abort()` propagates through
+     * `executeChainStreaming`, which throws `LangChainCancelledError`,
+     * which becomes `cancelled: true` on the workflow result. The
+     * runAiCommitDraft promise's finally block clears the ref. The
+     * resulting cleanup dispatches (clearing loading + status) happen
+     * back in `runAiCommitDraft`, not here, so this function stays
+     * pure-imperative and the React state updates flow through a
+     * single code path.
+     */
+    const cancelAiCommitDraft = React.useCallback(() => {
+        aiDraftAbortRef.current?.abort();
+    }, []);
     // `C` keystroke handler — start the create-pull-request flow. Resolves
     // the head + base branches from the live context, runs
     // `coco changelog --branch <base>` (via `runPullRequestBodyWorkflow`)
@@ -36311,6 +37399,19 @@ function LogInkApp(deps) {
     // missing) we surface the failure on the status line and skip the
     // prompt entirely — better than opening a prompt the user can't
     // actually submit successfully.
+    // Soft-cancel handle for the PR body draft (#881 phase 4). A mutable
+    // ref rather than state because the cancel decision needs to be
+    // visible synchronously inside the async workflow without forcing
+    // re-renders. Owned by the in-flight invocation: the cancel callback
+    // mutates `.cancelled` on the live ref; the workflow checks it after
+    // `await` resolves and decides whether to open the follow-up prompt.
+    //
+    // The LLM call itself keeps running (no AbortSignal threaded through
+    // `changelogHandler` today). The user-visible outcome — "PR draft
+    // cancelled, no prompt opens" — is identical to a hard cancel, at
+    // the cost of paying for the in-flight tokens. Deeper threading
+    // lands in a follow-up if hard cancel becomes a request.
+    const pullRequestBodyCancelRef = React.useRef(null);
     const startCreatePullRequest = React.useCallback(async () => {
         const head = context.branches?.currentBranch || context.provider?.currentBranch;
         if (!head) {
@@ -36339,32 +37440,61 @@ function LogInkApp(deps) {
             });
             return;
         }
+        // Set up the cancel handle BEFORE flipping the pending flag so a
+        // race between the flag-set and a synchronous Esc keystroke can't
+        // leave the input handler dispatching cancel without a ref to
+        // mutate. The cancel callback no-ops cleanly when the ref is null
+        // (call already settled).
+        const cancelHandle = { cancelled: false };
+        pullRequestBodyCancelRef.current = cancelHandle;
+        dispatch({ type: 'setPendingPullRequestBodyDraft', value: true });
         dispatch({
             type: 'setStatus',
-            value: `generating PR body from changelog (vs ${defaultBranch})…`,
+            value: `generating PR body from changelog (vs ${defaultBranch}) — Esc to cancel`,
             loading: true,
         });
-        const body = await runPullRequestBodyWorkflow({ baseBranch: defaultBranch });
-        // Fallback shape when the changelog generation fails — open the
-        // prompt with empty title + body rather than aborting, so the user
-        // can still author the PR manually. The status line surfaces why
-        // we couldn't pre-fill.
-        const initialTitle = body.title || head.replace(/^(feat|fix|chore|docs|refactor|test)\//, '').replace(/[-_]/g, ' ');
-        const initialBody = body.body || '';
-        const initial = initialBody ? `${initialTitle}\n\n${initialBody}` : initialTitle;
-        if (!body.ok) {
-            dispatch({ type: 'setStatus', value: `PR body generation failed: ${body.message}. Edit manually.` });
+        try {
+            const body = await runPullRequestBodyWorkflow({ baseBranch: defaultBranch });
+            // Soft-cancel check (#881 phase 4). If the user pressed Esc
+            // while the workflow was awaiting, skip opening the prompt and
+            // surface a neutral status. The underlying LLM call has
+            // already settled — its result is discarded. Hard cancel
+            // (aborting the HTTP request mid-flight) is a follow-up.
+            if (cancelHandle.cancelled) {
+                dispatch({ type: 'setStatus', value: 'PR draft cancelled.' });
+                return;
+            }
+            // Fallback shape when the changelog generation fails — open the
+            // prompt with empty title + body rather than aborting, so the user
+            // can still author the PR manually. The status line surfaces why
+            // we couldn't pre-fill.
+            const initialTitle = body.title || head.replace(/^(feat|fix|chore|docs|refactor|test)\//, '').replace(/[-_]/g, ' ');
+            const initialBody = body.body || '';
+            const initial = initialBody ? `${initialTitle}\n\n${initialBody}` : initialTitle;
+            if (!body.ok) {
+                dispatch({ type: 'setStatus', value: `PR body generation failed: ${body.message}. Edit manually.` });
+            }
+            else {
+                dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.' });
+            }
+            dispatch({
+                type: 'openInputPrompt',
+                kind: 'create-pr',
+                label: `Create PR: ${head} → ${defaultBranch}  (line 1 title · rest body · Enter newline · Ctrl+D submit)`,
+                initial,
+                multiline: true,
+            });
         }
-        else {
-            dispatch({ type: 'setStatus', value: 'PR body drafted — review and Ctrl+D to submit.' });
+        finally {
+            // Clear the flag + the ref so a subsequent draft starts clean.
+            // Only clear the ref if we still own it — a second invocation
+            // would have already taken ownership in which case the cancel
+            // duty has rolled over.
+            dispatch({ type: 'setPendingPullRequestBodyDraft', value: false });
+            if (pullRequestBodyCancelRef.current === cancelHandle) {
+                pullRequestBodyCancelRef.current = null;
+            }
         }
-        dispatch({
-            type: 'openInputPrompt',
-            kind: 'create-pr',
-            label: `Create PR: ${head} → ${defaultBranch}  (line 1 title · rest body · Enter newline · Ctrl+D submit)`,
-            initial,
-            multiline: true,
-        });
     }, [
         context.branches?.currentBranch,
         context.provider?.currentBranch,
@@ -36373,6 +37503,24 @@ function LogInkApp(deps) {
         context.pullRequest?.currentPullRequest,
         dispatch,
     ]);
+    /**
+     * Soft-cancel the in-flight PR body draft (#881 phase 4). The
+     * cancel ref's `.cancelled` flag is checked after the workflow's
+     * await resolves; setting it true causes the workflow to skip the
+     * prompt-open and surface a neutral "cancelled" status. The LLM
+     * call itself isn't aborted (no signal threaded through the
+     * `changelogHandler` chain) so the user still pays for the in-flight
+     * tokens. Acceptable for a 5-15s draft; hard cancel lands in a
+     * follow-up if it becomes a real ask.
+     *
+     * Idempotent — calling without an active draft is a no-op.
+     */
+    const cancelPullRequestBodyDraft = React.useCallback(() => {
+        const handle = pullRequestBodyCancelRef.current;
+        if (!handle)
+            return;
+        handle.cancelled = true;
+    }, []);
     // Copy an arbitrary string to the system clipboard. Distinct from
     // `yankFromActiveView` which derives the value from the current view
     // — this one takes the value as an explicit event payload, used by
@@ -36798,11 +37946,18 @@ function LogInkApp(deps) {
             type: 'setSplitPlanReady',
             plan: result.plan,
             planContext: result.planContext,
+            fallback: result.fallback,
         });
+        const readyMessage = result.fallback
+            ? `Split planner exhausted retries — showing single-commit fallback. y/Enter to apply as one commit, r to re-roll, Esc to cancel.`
+            : `Split plan ready: ${result.plan.groups.length} commit(s). y/Enter to apply, Esc to cancel.`;
+        // Use 'info' kind for the fallback path (still actionable, just
+        // not a clean win). The reducer's "warning" is the absence of
+        // `success` framing — the message text itself carries the cue.
         dispatch({
             type: 'setStatus',
-            value: `Split plan ready: ${result.plan.groups.length} commit(s). y/Enter to apply, Esc to cancel.`,
-            kind: 'success',
+            value: readyMessage,
+            kind: result.fallback ? 'info' : 'success',
         });
     }, [context.operation, context.worktree?.stagedCount, dispatch, git]);
     // `y`/Enter inside the overlay — apply the previewed plan. Uses the
@@ -36844,6 +37999,7 @@ function LogInkApp(deps) {
             plan: splitPlan.plan,
             planContext: splitPlan.planContext,
             git,
+            fallback: splitPlan.fallback,
         });
         dump.push(`workflow returned: ok=${result.ok} message="${result.message}" commitHashes=[${(result.commitHashes || []).join(', ')}]`);
         try {
@@ -36877,16 +38033,20 @@ function LogInkApp(deps) {
             return;
         }
         // Success — close the overlay, reset compose (the staged set is
-        // now empty since the plan committed everything), and pop the
-        // compose view so the user lands on whatever was beneath (usually
-        // status, sometimes history).
+        // now empty since the plan committed everything), and route the
+        // user to the history view so they see the just-landed commits
+        // with the recent-commit marker firing on each row that was
+        // created. Previous behavior popped compose to whatever was
+        // beneath (often status — which now reads "clean worktree" and
+        // gives the user no signal that anything just happened);
+        // history is the natural follow-on surface.
+        //
+        // navigateHome nukes the rest of the stack so `<` after apply
+        // doesn't walk back into the now-empty compose / status state
+        // the user just left behind.
         dispatch({ type: 'clearSplitPlan' });
         dispatch({ type: 'commitCompose', action: { type: 'reset' } });
-        // Only pop if compose is on top — the apply could have been
-        // invoked from a deeper stack and we don't want to over-pop.
-        if (state.activeView === 'compose' && state.viewStack.length > 1) {
-            dispatch({ type: 'popView' });
-        }
+        dispatch({ type: 'navigateHome' });
         // Refresh BEFORE setting the final status so we can peek at the
         // post-apply worktree state and craft a directive next-step hint
         // ("X unstaged + Y untracked remaining — press gs to stage / I
@@ -36934,9 +38094,16 @@ function LogInkApp(deps) {
             });
             return;
         }
-        const successMessage = formatSplitApplySuccess(commitHashes.length, unstaged, untracked);
-        dispatch({ type: 'setStatus', value: successMessage, kind: 'success' });
-    }, [dispatch, git, refreshContext, refreshHistoryRows, refreshWorktreeContext, state.activeView, state.splitPlan, state.viewStack.length]);
+        const successMessage = formatSplitApplySuccess(commitHashes.length, unstaged, untracked, result.fallback ? { reason: result.fallback.reason } : undefined);
+        // Fallback path uses 'info' kind — apply technically succeeded
+        // but the user should know it landed as a single combined commit
+        // rather than a real LLM-driven multi-group split.
+        dispatch({
+            type: 'setStatus',
+            value: successMessage,
+            kind: result.fallback ? 'info' : 'success',
+        });
+    }, [dispatch, git, refreshContext, refreshHistoryRows, refreshWorktreeContext, state.splitPlan]);
     // Esc inside the overlay — close without applying. Status line gets
     // a confirmation so the user knows the operation was abandoned.
     const cancelCommitSplit = React.useCallback(() => {
@@ -37443,6 +38610,41 @@ function LogInkApp(deps) {
             'fetch-remotes': async () => fetchRemotes(git),
             'pull-current-branch': async () => pullCurrentBranch(git),
             'push-current-branch': async () => pushCurrentBranch(git),
+            // Per-branch fetch / pull / push that operate on the cursored
+            // row in the branches sidebar. inkInput.ts dispatches these
+            // when F / U / P fire from the sidebar; the *-current-branch
+            // / fetch-remotes variants above still handle the same keys
+            // from any other context.
+            'fetch-selected-branch': async () => {
+                const all = sortBranches(context.branches?.localBranches || [], state.branchSort);
+                const visible = state.filter
+                    ? all.filter((b) => matchesPromotedFilter([b.shortName, b.upstream || ''], state.filter))
+                    : all;
+                const branch = visible[Math.min(state.selectedBranchIndex, visible.length - 1)];
+                if (!branch)
+                    return { ok: false, message: 'No branch selected' };
+                return fetchBranch(git, branch);
+            },
+            'pull-selected-branch': async () => {
+                const all = sortBranches(context.branches?.localBranches || [], state.branchSort);
+                const visible = state.filter
+                    ? all.filter((b) => matchesPromotedFilter([b.shortName, b.upstream || ''], state.filter))
+                    : all;
+                const branch = visible[Math.min(state.selectedBranchIndex, visible.length - 1)];
+                if (!branch)
+                    return { ok: false, message: 'No branch selected' };
+                return pullBranch(git, branch, context.branches?.currentBranch);
+            },
+            'push-selected-branch': async () => {
+                const all = sortBranches(context.branches?.localBranches || [], state.branchSort);
+                const visible = state.filter
+                    ? all.filter((b) => matchesPromotedFilter([b.shortName, b.upstream || ''], state.filter))
+                    : all;
+                const branch = visible[Math.min(state.selectedBranchIndex, visible.length - 1)];
+                if (!branch)
+                    return { ok: false, message: 'No branch selected' };
+                return pushBranch(git, branch);
+            },
             'rename-branch': async () => {
                 const newName = payload?.trim();
                 if (!newName)
@@ -38360,9 +39562,15 @@ function LogInkApp(deps) {
             else if (event.type === 'runAiCommitDraft') {
                 void runAiCommitDraft();
             }
+            else if (event.type === 'cancelAiCommitDraft') {
+                cancelAiCommitDraft();
+            }
             else if (event.type === 'startCreatePullRequest') {
                 void startCreatePullRequest();
             }
+            else if (event.type === 'cancelPullRequestBodyDraft') {
+                cancelPullRequestBodyDraft();
+            }
             else if (event.type === 'startChangelogView') {
                 void startChangelogView();
             }