guito 0.6.1 → 1.0.0

package/bin/guito-server.js

@@ -2,16 +2,51 @@ import { existsSync } from 'node:fs';
 import { execFile, spawn } from 'node:child_process';
 import { readFile, rm, writeFile } from 'node:fs/promises';
 import { randomBytes } from 'node:crypto';
+import { userInfo } from 'node:os';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import fastify from 'fastify';
 import fastifyStatic from '@fastify/static';
 import fastifyCors from '@fastify/cors';
 import fastifyCompress from '@fastify/compress';
 import { simpleGit } from 'simple-git';
+import { createTwoFilesPatch } from 'diff';
 import { promisify } from 'node:util';
 import { workingTree } from './working-tree.js';
+import { avatarCache } from './avatars.js';
+import { repositoryState } from './repository-state.js';
 const execFileAsync = promisify(execFile);
-const AZURE_API_VERSION = '4.1';
+const AZURE_API_VERSION = '5.0';
+export const DEFAULT_PR_BRANCH_NAME_TEMPLATE = 'pr/${randomstring}';
+const PR_BRANCH_TEMPLATE_VARIABLES = [
+    'username',
+    'randomstring',
+    'branch',
+    'targetbranch',
+    'title',
+    'repository',
+    'date',
+    'time',
+    'timestamp',
+];
+/** Azure DevOps comment thread statuses, by their numeric REST value. */
+const AZURE_THREAD_STATUSES = {
+    unknown: 0,
+    active: 1,
+    wontFix: 3,
+    fixed: 4,
+    closed: 5,
+    byDesign: 6,
+    pending: 7,
+};
+const azureThreadStatusName = (value) => Object.entries(AZURE_THREAD_STATUSES).find(([, numeric]) => numeric === value)?.[0] ?? 'unknown';
+/** Pull request reviewer votes, by their numeric REST value. */
+const AZURE_VOTES = {
+    reset: 0,
+    approveWithSuggestions: 5,
+    approve: 10,
+    waitForAuthor: -5,
+    reject: -10,
+};
 /**
  * Extracts {projectPath, repo} from an Azure DevOps git remote URL.
  * Supports https (with optional credentials) and ssh (scp-style and ssh://)
@@ -74,11 +109,19 @@ export function buildAzureProjectPrefix(baseUrl, remoteUrl) {
         .join('/');
     try {
         const parsed = new URL(base);
-        const basePath = parsed.pathname.replace(/^\/+|\/+$/g, '');
-        if (basePath && info.projectPath.toLowerCase().startsWith(basePath.toLowerCase())) {
-            return `${parsed.origin}/${encodePath(info.projectPath)}`;
-        }
-        return `${parsed.origin}${basePath ? `/${encodePath(basePath)}` : ''}/${encodePath(info.projectPath)}`;
+        const decode = (path) => path
+            .split('/')
+            .filter(Boolean)
+            .map((segment) => decodeURIComponent(segment));
+        const baseParts = decode(parsed.pathname);
+        const remoteParts = info.projectPath.split('/').filter(Boolean);
+        let overlap = Math.min(baseParts.length, remoteParts.length);
+        while (overlap &&
+            !baseParts
+                .slice(-overlap)
+                .every((part, index) => part.toLowerCase() === remoteParts[index].toLowerCase()))
+            overlap--;
+        return `${parsed.origin}/${[...baseParts, ...remoteParts.slice(overlap)].map(encodeURIComponent).join('/')}`;
     }
     catch {
         return `${base}/${encodePath(info.projectPath)}`;
@@ -94,18 +137,18 @@ export function buildAzurePullRequestUrl(baseUrl, remoteUrl) {
     if (!info) {
         return null;
     }
-    return `${prefix}/_git/${encodeURIComponent(info.repo)}/pullrequests?api-version=${AZURE_API_VERSION}`;
+    return `${prefix}/_apis/git/repositories/${encodeURIComponent(info.repo)}/pullrequests?api-version=${AZURE_API_VERSION}`;
 }
 /**
  * Default Azure DevOps HTTP runner: shells out to the Windows built-in
- * curl.exe with NTLM + Negotiate and an empty username, which authenticates
- * with the current Windows session (SSPI single sign-on).
+ * curl.exe with Negotiate and an empty username, which authenticates with
+ * the current Windows session (SSPI single sign-on). Do not also request
+ * --ntlm: some curl builds omit that option while still supporting Negotiate.
  */
 function defaultAzureRequest(method, url, body) {
     return new Promise((resolveRequest, rejectRequest) => {
         const args = [
             '-sS',
-            '--ntlm',
             '--negotiate',
             '-u',
             ':',
@@ -116,7 +159,7 @@ function defaultAzureRequest(method, url, body) {
             '-X',
             method,
         ];
-        if (method === 'POST') {
+        if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
             args.push('-H', 'Content-Type: application/json', '--data-binary', '@-');
         }
         args.push(url);
@@ -161,6 +204,22 @@ const randomBranchSuffix = () => {
     }
     return suffix;
 };
+const safeBranchTemplateValue = (value) => value
+    .trim()
+    .replace(/[\x00-\x20\x7f~^:?*\[\\]+/g, '-')
+    .replace(/\.{2,}/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^[./-]+|[./-]+$/g, '') || 'unknown';
+/** Expands a configured automatic PR branch name and rejects unknown variables. */
+export const formatPrBranchName = (template, values) => {
+    const source = template.trim() || DEFAULT_PR_BRANCH_NAME_TEMPLATE;
+    return source.replace(/\$\{([^}]+)\}/g, (_match, variable) => {
+        if (!PR_BRANCH_TEMPLATE_VARIABLES.includes(variable)) {
+            throw new Error(`Unknown pull request branch variable \${${variable}}. Supported variables: ${PR_BRANCH_TEMPLATE_VARIABLES.map((name) => `\${${name}}`).join(', ')}.`);
+        }
+        return safeBranchTemplateValue(values[variable]);
+    });
+};
 /** Extracts Azure DevOps' human-readable error message from a REST response. */
 const azureErrorMessage = (result) => {
     try {
@@ -170,11 +229,21 @@ const azureErrorMessage = (result) => {
         return result.body;
     }
 };
-export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 8080, apiToken, azureDevOpsUrl, azureRequestImpl, }) {
+export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 8080, apiToken, azureDevOpsUrl, prBranchNameTemplate, autoReload, diffViewer, showGraph, showStashes, showTags, showRemoteBranches, issueRegex, issueUrl, fileListView, searchMode, searchCaseSensitive, azureRequestImpl, avatarFetchImpl, onLog, }) {
     // Initialize server
     const app = fastify({
         logger: false,
     });
+    if (onLog) {
+        // Report error responses to the host (e.g. the VS Code output channel).
+        app.addHook('onSend', async (request, reply, payload) => {
+            if (reply.statusCode >= 400) {
+                const body = typeof payload === 'string' ? payload.slice(0, 500) : '';
+                onLog(`${request.method} ${request.url} -> ${reply.statusCode}${body ? ` ${body}` : ''}`);
+            }
+            return payload;
+        });
+    }
     // Register cors
     await app.register(fastifyCors);
     // Compress JSON responses (commit history payloads are highly repetitive)
@@ -207,6 +276,27 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
     }
     // Initialize git lib
     const git = simpleGit(repositoryPath);
+    const avatars = avatarCache(avatarFetchImpl);
+    app.get('/api/avatar', async (req, reply) => {
+        const email = String(req.query?.email ?? '').trim();
+        if (!email || email.length > 320)
+            return reply.code(400).send({ error: 'Valid email required' });
+        const image = await avatars(email);
+        reply.header('Cache-Control', 'private, max-age=3600');
+        return image ? reply.type(image.contentType).send(image.data) : reply.code(204).send();
+    });
+    let stateRequest;
+    app.get('/api/repository-state', async (_req, reply) => {
+        try {
+            stateRequest ?? (stateRequest = repositoryState(git, repositoryPath).finally(() => {
+                stateRequest = undefined;
+            }));
+            return await stateRequest;
+        }
+        catch (err) {
+            return reply.code(400).send({ error: err.message });
+        }
+    });
     // ==================== Diff parsing ====================
     function parseUnifiedDiff(rawDiff) {
         const files = [];
@@ -322,8 +412,8 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
         await writeFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, 'utf8');
     };
     const azureRequest = azureRequestImpl ?? defaultAzureRequest;
-    const configuredAzureUrl = azureDevOpsUrl?.trim() ?? '';
     const effectiveAzureUrl = async () => {
+        const configuredAzureUrl = azureDevOpsUrl?.trim() ?? '';
         if (configuredAzureUrl) {
             return { url: configuredAzureUrl, source: 'vscode' };
         }
@@ -350,11 +440,165 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
         }
         return { prefix, remoteUrl };
     };
+    /** Human identity of the authenticated Windows/Azure user; cached per run. */
+    let cachedAzureMe = null;
+    const azureMe = async () => {
+        if (cachedAzureMe) {
+            return cachedAzureMe;
+        }
+        const { prefix } = await azureProjectContext();
+        // The prefix is "{collection-or-org}/{project}"; connectionData is
+        // collection scoped.
+        const collection = prefix.slice(0, prefix.lastIndexOf('/'));
+        const result = await azureRequest('GET', `${collection}/_apis/connectionData?q=1&api-version=${AZURE_API_VERSION}`, '');
+        if (result.status < 200 || result.status >= 300) {
+            throw new Error(azureErrorMessage(result) ||
+                `Azure DevOps returned HTTP ${result.status} while resolving the current user.`);
+        }
+        const user = (JSON.parse(result.body) ?? {}).authenticatedUser;
+        const id = String(user?.id ?? '');
+        if (!id) {
+            throw new Error('Azure DevOps did not report an authenticated user.');
+        }
+        cachedAzureMe = {
+            id,
+            name: String(user?.providerDisplayName ?? ''),
+            email: String(user?.properties?.Mail?.$value ?? user?.properties?.Account?.$value ?? ''),
+        };
+        return cachedAzureMe;
+    };
+    /** Web UI URL of a pull request, used by the "Open in Azure DevOps" links. */
+    const azurePrWebUrl = (prefix, remoteUrl, id) => {
+        const repo = parseAzureRemoteUrl(remoteUrl)?.repo ?? '';
+        return `${prefix}/_git/${encodeURIComponent(repo)}/pullrequest/${id}`;
+    };
+    /** Maps one Azure DevOps pull request record to the shape the UI consumes. */
+    const mapAzurePullRequest = (pr, prefix, remoteUrl, me) => {
+        const reviewers = (Array.isArray(pr?.reviewers) ? pr.reviewers : []).map((entry) => ({
+            id: String(entry?.id ?? ''),
+            name: String(entry?.displayName ?? ''),
+            email: String(entry?.uniqueName ?? ''),
+            vote: Number(entry?.vote ?? 0),
+            isRequired: entry?.isRequired === true,
+        }));
+        const mine = me ? reviewers.find((reviewer) => reviewer.id === me.id) : undefined;
+        return {
+            id: Number(pr?.pullRequestId ?? 0),
+            title: String(pr?.title ?? ''),
+            isDraft: pr?.isDraft === true,
+            author: {
+                id: String(pr?.createdBy?.id ?? ''),
+                name: String(pr?.createdBy?.displayName ?? ''),
+                email: String(pr?.createdBy?.uniqueName ?? ''),
+            },
+            createdAt: String(pr?.creationDate ?? ''),
+            sourceBranch: String(pr?.sourceRefName ?? '').replace(/^refs\/heads\//, ''),
+            targetBranch: String(pr?.targetRefName ?? '').replace(/^refs\/heads\//, ''),
+            status: String(pr?.status ?? 'active'),
+            webUrl: String(pr?._links?.web?.href || '') || azurePrWebUrl(prefix, remoteUrl, Number(pr?.pullRequestId ?? 0)),
+            reviewers,
+            myVote: mine ? Number(mine.vote ?? 0) : 0,
+            requiresMe: mine?.isRequired === true,
+        };
+    };
+    /** REST base of one pull request (".../pullrequests/{id}") plus repo context. */
+    const azurePrApiBase = async (id) => {
+        if (!Number.isInteger(id) || id <= 0) {
+            throw new Error('A pull request id is required.');
+        }
+        const { prefix, remoteUrl } = await azureProjectContext();
+        const repo = parseAzureRemoteUrl(remoteUrl)?.repo;
+        if (!repo) {
+            throw new Error(`The origin remote does not point to an Azure DevOps project: ${remoteUrl}`);
+        }
+        return {
+            prefix,
+            remoteUrl,
+            repo,
+            base: `${prefix}/_apis/git/repositories/${encodeURIComponent(repo)}/pullrequests/${id}`,
+        };
+    };
+    /** Runs one Azure request and turns non-2xx replies into user-facing errors. */
+    const azureJson = async (method, url, body = '') => {
+        const result = await azureRequest(method, url, body);
+        if (result.status < 200 || result.status >= 300) {
+            throw new Error(azureErrorMessage(result) || `Azure DevOps returned HTTP ${result.status}.`);
+        }
+        return (result.body ? JSON.parse(result.body) : {});
+    };
+    /** Merges the VS Code settings with the server-side settings file. */
+    const effectiveSettings = async () => {
+        const [file, azure] = await Promise.all([readSettings(), effectiveAzureUrl()]);
+        const fileAutoReload = typeof file.autoReload === 'boolean' ? file.autoReload : undefined;
+        const fileShowGraph = typeof file.showGraph === 'boolean' ? file.showGraph : undefined;
+        const fileShowStashes = typeof file.showStashes === 'boolean' ? file.showStashes : undefined;
+        const fileShowTags = typeof file.showTags === 'boolean' ? file.showTags : undefined;
+        const fileShowRemoteBranches = typeof file.showRemoteBranches === 'boolean' ? file.showRemoteBranches : undefined;
+        const fileFileListView = file.fileListView === 'tree' || file.fileListView === 'flat' ? file.fileListView : undefined;
+        const fileSearchMode = file.searchMode === 'filter' || file.searchMode === 'navigate' ? file.searchMode : undefined;
+        const fileSearchCaseSensitive = typeof file.searchCaseSensitive === 'boolean' ? file.searchCaseSensitive : undefined;
+        const filePrBranchNameTemplate = typeof file.prBranchNameTemplate === 'string' && file.prBranchNameTemplate.trim()
+            ? file.prBranchNameTemplate.trim()
+            : undefined;
+        const localIssue = file.issueLinking;
+        let issueLinking = null;
+        if (issueRegex?.trim() && issueUrl?.trim()) {
+            issueLinking = { regex: issueRegex.trim(), url: issueUrl.trim(), useGlobally: true };
+        }
+        else if (typeof localIssue?.regex === 'string' && typeof localIssue.url === 'string') {
+            issueLinking = { regex: localIssue.regex, url: localIssue.url, useGlobally: false };
+        }
+        else {
+            const [regex, url] = await Promise.all([
+                git.raw(['config', '--global', '--get', 'guito.issueRegex']).catch(() => ''),
+                git.raw(['config', '--global', '--get', 'guito.issueUrl']).catch(() => ''),
+            ]);
+            if (regex.trim() && url.trim()) {
+                issueLinking = { regex: regex.trim(), url: url.trim(), useGlobally: true };
+            }
+        }
+        return {
+            azureDevOpsUrl: azure.url,
+            prBranchNameTemplate: prBranchNameTemplate?.trim() ||
+                filePrBranchNameTemplate ||
+                DEFAULT_PR_BRANCH_NAME_TEMPLATE,
+            source: azure.source,
+            autoReload: typeof autoReload === 'boolean' ? autoReload : (fileAutoReload ?? true),
+            diffViewer: diffViewer === 'vscode' ? 'vscode' : 'guito',
+            showGraph: typeof showGraph === 'boolean' ? showGraph : (fileShowGraph ?? true),
+            showStashes: typeof showStashes === 'boolean' ? showStashes : (fileShowStashes ?? true),
+            showTags: typeof showTags === 'boolean' ? showTags : (fileShowTags ?? true),
+            showRemoteBranches: typeof showRemoteBranches === 'boolean'
+                ? showRemoteBranches
+                : (fileShowRemoteBranches ?? true),
+            fileListView: fileListView ?? fileFileListView ?? 'flat',
+            searchMode: searchMode ?? fileSearchMode ?? 'navigate',
+            searchCaseSensitive: typeof searchCaseSensitive === 'boolean'
+                ? searchCaseSensitive
+                : (fileSearchCaseSensitive ?? false),
+            issueLinking,
+        };
+    };
+    const configuredIdentity = async () => {
+        const config = await git.listConfig();
+        return {
+            name: String(config.all['user.name'] ?? '').trim(),
+            email: String(config.all['user.email'] ?? '').trim(),
+        };
+    };
+    const authorIdentity = (name, email, identity) => ({
+        author_name: identity.name && identity.email && email.trim().toLowerCase() === identity.email.toLowerCase()
+            ? identity.name
+            : name,
+        author_email: email,
+    });
     // ==================== Repository ====================
     app.get('/api/repo', async (_req, resp) => {
         try {
             const root = (await git.revparse(['--show-toplevel'])).trim();
-            return resp.type('application/json').send({ root, name: basename(root) });
+            return resp
+                .type('application/json')
+                .send({ root, name: basename(root), identity: await configuredIdentity() });
         }
         catch (err) {
             return resp.status(400).type('application/json').send({ error: err.message });
@@ -389,12 +633,14 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
             if (Number.isFinite(skip) && skip > 0) {
                 options['--skip'] = String(skip);
             }
-            const [log, count] = await Promise.all([
+            const [log, count, identity] = await Promise.all([
                 git.log(options),
                 git.raw(['rev-list', '--count', '--all']),
+                configuredIdentity(),
             ]);
             const commits = log.all.map((commit) => ({
                 ...commit,
+                ...authorIdentity(commit.author_name, commit.author_email, identity),
                 parents: String(commit.parents ?? '')
                     .split(' ')
                     .filter(Boolean),
@@ -417,28 +663,42 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
     // matches over the loaded history.
     app.get('/api/commits/search', async (req, resp) => {
         const query = String((req.query ?? {}).query ?? '').trim();
+        const caseSensitive = String((req.query ?? {}).caseSensitive ?? '') === '1';
         if (!query) {
-            return resp.type('application/json').send({ hashes: [] });
+            return resp.type('application/json').send({ hashes: [], indices: {} });
         }
         try {
-            const raw = await git.raw([
-                'log',
-                '--all',
-                '-i',
-                '--fixed-strings',
-                `--grep=${query}`,
-                '--format=%H',
+            const grepArgs = ['log', '--all'];
+            if (!caseSensitive)
+                grepArgs.push('-i');
+            grepArgs.push('--fixed-strings', `--grep=${query}`, '--format=%H');
+            const [raw, history] = await Promise.all([
+                git.raw(grepArgs),
+                git.raw(['log', '--all', '--format=%H']),
             ]);
+            const hashes = raw
+                .split('\n')
+                .map((hash) => hash.trim())
+                .filter(Boolean);
+            const matches = new Set(hashes);
+            // Use the same unfiltered Git log order as the paged history endpoint.
+            const indices = {};
+            history
+                .split('\n')
+                .map((hash) => hash.trim())
+                .filter(Boolean)
+                .forEach((hash, index) => {
+                if (matches.has(hash))
+                    indices[hash] = index;
+            });
             return resp.type('application/json').send({
-                hashes: raw
-                    .split('\n')
-                    .map((hash) => hash.trim())
-                    .filter(Boolean),
+                hashes,
+                indices,
             });
         }
         catch (err) {
             if (/does not have any commits yet|unknown revision|bad default revision/i.test(err.message ?? '')) {
-                return resp.type('application/json').send({ hashes: [] });
+                return resp.type('application/json').send({ hashes: [], indices: {} });
             }
             return resp.status(400).type('application/json').send({ error: err.message });
         }
@@ -617,6 +877,100 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
             return resp.status(400).type('application/json').send({ error: err.message });
         }
     });
+    // ==================== Worktrees ====================
+    app.get('/api/worktrees', async (_req, resp) => {
+        try {
+            const raw = await git.raw(['worktree', 'list', '--porcelain']);
+            // Path comparison is case-insensitive on Windows so the served worktree
+            // is detected regardless of drive-letter casing.
+            const samePath = (a, b) => process.platform === 'win32'
+                ? resolve(a).toLowerCase() === resolve(b).toLowerCase()
+                : resolve(a) === resolve(b);
+            const worktrees = raw
+                .split(/\n\s*\n/)
+                .map((block) => block.trim())
+                .filter(Boolean)
+                .map((block) => {
+                const entry = {
+                    path: '',
+                    head: '',
+                    branch: '',
+                    bare: false,
+                    detached: false,
+                    current: false,
+                };
+                for (const line of block.split('\n').map((l) => l.trim())) {
+                    if (line.startsWith('worktree '))
+                        entry.path = line.slice('worktree '.length);
+                    else if (line.startsWith('HEAD '))
+                        entry.head = line.slice('HEAD '.length);
+                    else if (line.startsWith('branch '))
+                        entry.branch = line.slice('branch '.length).replace(/^refs\/heads\//, '');
+                    else if (line === 'bare')
+                        entry.bare = true;
+                    else if (line === 'detached')
+                        entry.detached = true;
+                }
+                entry.current = !!entry.path && samePath(entry.path, repositoryPath);
+                return entry;
+            });
+            return resp.type('application/json').send(worktrees);
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    app.post('/api/worktrees', async (req, resp) => {
+        try {
+            const path = typeof req.body?.path === 'string' ? req.body.path.trim() : '';
+            const branch = typeof req.body?.branch === 'string' ? req.body.branch.trim() : '';
+            if (!path || !isAbsolute(path)) {
+                throw new Error('Choose an absolute folder path for the worktree.');
+            }
+            if (!branch) {
+                throw new Error('Choose a local branch for the worktree.');
+            }
+            // Resolve the branch as a local ref before passing it to Git. Besides a
+            // clearer error, this prevents a request from treating an option as a ref.
+            await git.raw(['show-ref', '--verify', '--quiet', `refs/heads/${branch}`]);
+            await mutate(() => git.raw(['worktree', 'add', '--', resolve(path), branch]).then(() => { }));
+            return resp.type('application/json').send({ success: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    app.post('/api/worktrees/remove', async (req, resp) => {
+        try {
+            const path = typeof req.body?.path === 'string' ? req.body.path.trim() : '';
+            if (!path || !isAbsolute(path)) {
+                throw new Error('A valid worktree path is required.');
+            }
+            const target = resolve(path);
+            const samePath = (a, b) => process.platform === 'win32'
+                ? resolve(a).toLowerCase() === resolve(b).toLowerCase()
+                : resolve(a) === resolve(b);
+            if (samePath(target, repositoryPath)) {
+                throw new Error('The worktree currently open in Guito cannot be removed.');
+            }
+            // Only registered worktrees may be removed. Do not use --force: Git must
+            // protect uncommitted or untracked files in the selected worktree.
+            const registered = (await git.raw(['worktree', 'list', '--porcelain']))
+                .split(/\n\s*\n/)
+                .some((block) => {
+                const line = block.split('\n').find((entry) => entry.startsWith('worktree '));
+                return !!line && samePath(line.slice('worktree '.length).trim(), target);
+            });
+            if (!registered) {
+                throw new Error('The selected folder is not a registered worktree.');
+            }
+            await mutate(() => git.raw(['worktree', 'remove', '--', target]).then(() => { }));
+            return resp.type('application/json').send({ success: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
     app.post('/api/checkout', async (req, resp) => {
         try {
             const { ref } = req.body;
@@ -682,8 +1036,26 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
     // ==================== Stash ====================
     app.get('/api/stash/list', async (_req, resp) => {
         try {
-            const stashList = await git.stashList();
-            return resp.type('application/json').send(stashList);
+            // Extra fields (date, author) let the commit table render stash rows;
+            // they are NUL-separated because messages cannot contain NUL.
+            const raw = await git.raw([
+                'stash',
+                'list',
+                '--format=%H%x00%aI%x00%aN%x00%aE%x00%s',
+            ]);
+            const all = raw
+                .trim()
+                .split('\n')
+                .filter(Boolean)
+                .map((line) => {
+                const [hash, date, authorName, authorEmail, message] = line.split('\u0000');
+                return { hash, date, author_name: authorName, author_email: authorEmail, message };
+            });
+            return resp.type('application/json').send({
+                all,
+                latest: all[0] ?? null,
+                total: all.length,
+            });
         }
         catch (err) {
             return resp.status(400).type('application/json').send({ error: err.message });
@@ -754,9 +1126,21 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
         }
     });
     // ==================== Tags ====================
+    // All tags with the commit each points at (annotated tags are peeled, so the
+    // client can always look the tagged commit up by hash). Sorted by name.
     app.get('/api/tags', async (_req, resp) => {
         try {
-            const tags = await git.tags();
+            const raw = await git.raw([
+                'tag',
+                '--list',
+                '--sort=refname',
+                '--format=%(refname:short)%09%(*objectname)%09%(objectname)',
+            ]);
+            const tags = raw
+                .split('\n')
+                .map((line) => line.split('\t'))
+                .filter(([name]) => Boolean(name.trim()))
+                .map(([name, peeled, direct]) => ({ name, hash: peeled || direct }));
             return resp.type('application/json').send(tags);
         }
         catch (err) {
@@ -802,9 +1186,10 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
         }
     });
     // ==================== Remote Operations ====================
-    app.get('/api/fetch', async (_req, resp) => {
+    app.get('/api/fetch', async (req, resp) => {
         try {
-            await git.fetch();
+            const prune = ['1', 'true', 'yes'].includes(String(req.query?.prune ?? '').toLowerCase());
+            await git.fetch(prune ? { '--prune': null } : {});
             return resp.type('application/json').send({ success: true });
         }
         catch (err) {
@@ -851,13 +1236,92 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
             return resp.status(400).type('application/json').send({ error: err.message });
         }
     });
+    const listRemotes = async () => {
+        const names = (await git.raw(['remote']))
+            .split(/\r?\n/)
+            .map((name) => name.trim())
+            .filter(Boolean);
+        return Promise.all(names.map(async (name) => {
+            const fetchUrl = (await git.raw(['remote', 'get-url', name])).trim();
+            const pushUrl = (await git.raw(['remote', 'get-url', '--push', name]).catch(() => fetchUrl)).trim();
+            return { name, fetchUrl, pushUrl };
+        }));
+    };
+    app.get('/api/remotes', async (_req, resp) => {
+        try {
+            return resp.type('application/json').send(await listRemotes());
+        }
+        catch (err) {
+            return resp.status(400).send({ error: err.message });
+        }
+    });
+    app.post('/api/remotes', async (req, resp) => {
+        try {
+            const name = String(req.body?.name ?? '').trim();
+            const originalName = String(req.body?.originalName ?? '').trim();
+            const fetchUrl = String(req.body?.fetchUrl ?? '').trim();
+            const pushUrl = String(req.body?.pushUrl ?? '').trim() || fetchUrl;
+            if (!/^[A-Za-z0-9._-]+$/.test(name) || !fetchUrl) {
+                return resp.status(400).send({ error: 'A valid remote name and fetch URL are required.' });
+            }
+            if (!originalName) {
+                await git.raw(['remote', 'add', name, fetchUrl]);
+            }
+            else {
+                if (originalName !== name)
+                    await git.raw(['remote', 'rename', originalName, name]);
+                await git.raw(['remote', 'set-url', name, fetchUrl]);
+            }
+            await git.raw(['remote', 'set-url', '--push', name, pushUrl]);
+            return resp.send(await listRemotes());
+        }
+        catch (err) {
+            return resp.status(400).send({ error: err.message });
+        }
+    });
+    app.delete('/api/remotes/:name', async (req, resp) => {
+        try {
+            const name = String(req.params?.name ?? '').trim();
+            if (!/^[A-Za-z0-9._-]+$/.test(name)) {
+                return resp.status(400).send({ error: 'Invalid remote name.' });
+            }
+            await git.raw(['remote', 'remove', name]);
+            return resp.send(await listRemotes());
+        }
+        catch (err) {
+            return resp.status(400).send({ error: err.message });
+        }
+    });
+    app.post('/api/identity', async (req, resp) => {
+        try {
+            const name = String(req.body?.name ?? '').trim();
+            const email = String(req.body?.email ?? '').trim();
+            if (!name || !email) {
+                return resp.status(400).send({ error: 'User name and email are required.' });
+            }
+            await git.raw(['config', '--local', 'user.name', name]);
+            await git.raw(['config', '--local', 'user.email', email]);
+            return resp.send(await configuredIdentity());
+        }
+        catch (err) {
+            return resp.status(400).send({ error: err.message });
+        }
+    });
+    app.delete('/api/identity', async (_req, resp) => {
+        try {
+            await git.raw(['config', '--local', '--unset-all', 'user.name']).catch(() => '');
+            await git.raw(['config', '--local', '--unset-all', 'user.email']).catch(() => '');
+            return resp.send(await configuredIdentity());
+        }
+        catch (err) {
+            return resp.status(400).send({ error: err.message });
+        }
+    });
     // ==================== Settings ====================
     app.get('/api/settings', async (_req, resp) => {
         try {
-            const effective = await effectiveAzureUrl();
-            return resp
-                .type('application/json')
-                .send({ azureDevOpsUrl: effective.url, source: effective.source });
+            const settings = await effectiveSettings();
+            return resp.type('application/json').send(settings);
         }
         catch (err) {
             return resp.status(400).type('application/json').send({ error: err.message });
@@ -865,20 +1329,105 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
     });
     app.post('/api/settings', async (req, resp) => {
         try {
-            const url = String(req.body?.azureDevOpsUrl ?? '').trim();
-            if (url && !/^https?:\/\//i.test(url)) {
-                return resp
-                    .status(400)
-                    .type('application/json')
-                    .send({ error: 'The Azure DevOps URL must start with http:// or https://.' });
-            }
+            const body = req.body ?? {};
             const settings = await readSettings();
-            settings.azureDevOpsUrl = url;
+            if ('azureDevOpsUrl' in body) {
+                const url = String(body.azureDevOpsUrl ?? '').trim();
+                if (url && !/^https?:\/\//i.test(url)) {
+                    return resp
+                        .status(400)
+                        .type('application/json')
+                        .send({ error: 'The Azure DevOps URL must start with http:// or https://.' });
+                }
+                settings.azureDevOpsUrl = url;
+            }
+            if ('prBranchNameTemplate' in body) {
+                const template = String(body.prBranchNameTemplate ?? '').trim();
+                if (template.length > 200) {
+                    return resp
+                        .status(400)
+                        .send({ error: 'The pull request branch template must be 200 characters or fewer.' });
+                }
+                try {
+                    formatPrBranchName(template, {
+                        username: 'username',
+                        randomstring: 'randomstring',
+                        branch: 'branch',
+                        targetbranch: 'targetbranch',
+                        title: 'title',
+                        repository: 'repository',
+                        date: '2026-09-12',
+                        time: '120000',
+                        timestamp: '1789214400000',
+                    });
+                }
+                catch (error) {
+                    return resp.status(400).send({ error: error.message });
+                }
+                settings.prBranchNameTemplate = template || DEFAULT_PR_BRANCH_NAME_TEMPLATE;
+            }
+            if (typeof body.showGraph === 'boolean') {
+                settings.showGraph = body.showGraph;
+            }
+            if (typeof body.autoReload === 'boolean') {
+                settings.autoReload = body.autoReload;
+            }
+            if (typeof body.showStashes === 'boolean') {
+                settings.showStashes = body.showStashes;
+            }
+            if (typeof body.showTags === 'boolean') {
+                settings.showTags = body.showTags;
+            }
+            if (typeof body.showRemoteBranches === 'boolean') {
+                settings.showRemoteBranches = body.showRemoteBranches;
+            }
+            if (body.fileListView === 'tree' || body.fileListView === 'flat') {
+                settings.fileListView = body.fileListView;
+            }
+            if (body.searchMode === 'filter' || body.searchMode === 'navigate') {
+                settings.searchMode = body.searchMode;
+            }
+            if (typeof body.searchCaseSensitive === 'boolean') {
+                settings.searchCaseSensitive = body.searchCaseSensitive;
+            }
+            if ('issueLinking' in body) {
+                if (body.issueLinking === null) {
+                    if (body.issueLinkingGlobal) {
+                        await git.raw(['config', '--global', '--unset-all', 'guito.issueRegex']).catch(() => '');
+                        await git.raw(['config', '--global', '--unset-all', 'guito.issueUrl']).catch(() => '');
+                    }
+                    else {
+                        delete settings.issueLinking;
+                    }
+                }
+                else {
+                    const regex = String(body.issueLinking?.regex ?? '').trim();
+                    const url = String(body.issueLinking?.url ?? '').trim();
+                    if (!regex || !url) {
+                        return resp.status(400).send({ error: 'Issue regex and URL are required.' });
+                    }
+                    try {
+                        new RegExp(regex);
+                    }
+                    catch {
+                        return resp.status(400).send({ error: 'Issue regex is not a valid regular expression.' });
+                    }
+                    if (!/^https?:\/\//i.test(url)) {
+                        return resp.status(400).send({ error: 'Issue URL must start with http:// or https://.' });
+                    }
+                    if (body.issueLinking.useGlobally) {
+                        await git.raw(['config', '--global', 'guito.issueRegex', regex]);
+                        await git.raw(['config', '--global', 'guito.issueUrl', url]);
+                        delete settings.issueLinking;
+                    }
+                    else {
+                        settings.issueLinking = { regex, url };
+                    }
+                }
+            }
             await writeSettings(settings);
-            const effective = await effectiveAzureUrl();
-            return resp
-                .type('application/json')
-                .send({ azureDevOpsUrl: effective.url, source: effective.source });
+            const effective = await effectiveSettings();
+            return resp.type('application/json').send(effective);
         }
         catch (err) {
             return resp.status(400).type('application/json').send({ error: err.message });
@@ -899,12 +1448,49 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
                     .type('application/json')
                     .send({ error: 'Unable to build the Azure DevOps pull request URL.' });
             }
-            const prUrl = `${prefix}/_git/${encodeURIComponent(info.repo)}/pullrequests?api-version=${AZURE_API_VERSION}`;
+            const prUrl = `${prefix}/_apis/git/repositories/${encodeURIComponent(info.repo)}/pullrequests?api-version=${AZURE_API_VERSION}`;
             let source = String(sourceBranch ?? '').trim();
             if (newBranch) {
                 // Create a remote-only branch from the current HEAD; the local
                 // repository and the checked-out branch stay untouched.
-                const name = `pr/${randomBranchSuffix()}`;
+                const now = new Date();
+                const currentSettings = await effectiveSettings();
+                let computerUsername = process.env.USERNAME || process.env.USER || '';
+                try {
+                    computerUsername = userInfo().username || computerUsername;
+                }
+                catch {
+                    // Environment variables are a sufficient fallback in restricted hosts.
+                }
+                const name = formatPrBranchName(currentSettings.prBranchNameTemplate, {
+                    username: computerUsername,
+                    randomstring: randomBranchSuffix(),
+                    branch: (await git.revparse(['--abbrev-ref', 'HEAD'])).trim(),
+                    targetbranch: String(targetBranch)
+                        .replace(/^refs\/heads\//, '')
+                        .replace(/^origin\//, ''),
+                    title: String(title ?? '').trim() || 'pull-request',
+                    repository: basename(await repoRoot()),
+                    date: now.toISOString().slice(0, 10),
+                    time: now.toISOString().slice(11, 19).replace(/:/g, ''),
+                    timestamp: String(now.getTime()),
+                });
+                try {
+                    await git.raw(['check-ref-format', '--branch', name]);
+                }
+                catch {
+                    return resp.status(400).send({
+                        error: `The pull request branch template produced an invalid Git branch name: ${name}`,
+                    });
+                }
+                const existingBranch = await git
+                    .raw(['ls-remote', '--heads', 'origin', `refs/heads/${name}`])
+                    .catch(() => '');
+                if (existingBranch.trim()) {
+                    return resp.status(400).send({
+                        error: `The pull request branch already exists on origin: ${name}`,
+                    });
+                }
                 await git.push(['origin', `HEAD:refs/heads/${name}`]);
                 source = name;
             }
@@ -936,8 +1522,11 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
                 }
             }
             const payload = {
+                isDraft: req.body?.isDraft === true,
                 sourceRefName: `refs/heads/${source}`,
-                targetRefName: `refs/heads/${targetBranch}`,
+                targetRefName: `refs/heads/${String(targetBranch)
+                    .replace(/^refs\/heads\//, '')
+                    .replace(/^origin\//, '')}`,
             };
             const trimmedTitle = String(title ?? '').trim();
             const trimmedDescription = String(description ?? '').trim();
@@ -959,7 +1548,7 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
                 .map((id) => Number(id))
                 .filter((id) => Number.isInteger(id) && id > 0);
             if (payloadWorkItems.length) {
-                payload.workItems = payloadWorkItems.map((id) => ({ id }));
+                payload.workItemRefs = payloadWorkItems.map((id) => ({ id: String(id) }));
             }
             const result = await azureRequest('POST', prUrl, JSON.stringify(payload));
             if (result.status < 200 || result.status >= 300) {
@@ -978,7 +1567,7 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
             const warnings = [];
             if (labelNames.length && created.pullRequestId) {
                 // Built from the prefix: prUrl already carries the api-version query.
-                const labelsUrl = `${prefix}/_git/${encodeURIComponent(info.repo)}` +
+                const labelsUrl = `${prefix}/_apis/git/repositories/${encodeURIComponent(info.repo)}` +
                     `/pullrequests/${created.pullRequestId}/labels?api-version=${AZURE_API_VERSION}`;
                 for (const name of labelNames) {
                     try {
@@ -1004,8 +1593,7 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
         }
     });
     // ==================== Azure DevOps PR metadata ====================
-    // Identity search for the reviewer pickers (the endpoint the Azure DevOps
-    // web UI itself uses; undocumented but stable across TFS 2018+).
+    // Collection-scoped identity IDs can be passed directly as PR reviewers.
     app.get('/api/azure-devops/reviewers', async (req, resp) => {
         try {
             const query = String((req.query ?? {}).query ?? '').trim();
@@ -1013,9 +1601,10 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
                 return resp.type('application/json').send({ reviewers: [] });
             }
             const { prefix } = await azureProjectContext();
-            const url = `${prefix}/_apis/identitypicker/identities?api-version=${AZURE_API_VERSION}` +
-                '&identityTypes=msa-uuid,umd&queryType=nameAndEmail&searchFilter=' +
-                `&showImage=False&filterValue=${encodeURIComponent(query)}`;
+            const collection = prefix.slice(0, prefix.lastIndexOf('/'));
+            const identityBase = collection.replace('https://dev.azure.com/', 'https://vssps.dev.azure.com/');
+            const url = `${identityBase}/_apis/identities?api-version=5.0` +
+                `&searchFilter=General&filterValue=${encodeURIComponent(query)}&queryMembership=None`;
             const result = await azureRequest('GET', url, '');
             if (result.status < 200 || result.status >= 300) {
                 return resp
@@ -1026,12 +1615,20 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
                 });
             }
             const data = JSON.parse(result.body);
-            const list = Array.isArray(data) ? data : (data.results ?? data.identities ?? []);
+            const list = Array.isArray(data) ? data : (data.value ?? data.identities ?? []);
             const reviewers = list
                 .map((entry) => ({
                 id: String(entry?.id ?? entry?.identity?.id ?? ''),
-                label: String(entry?.label ?? entry?.displayName ?? entry?.name ?? ''),
-                description: entry?.description ? String(entry.description) : undefined,
+                label: String(entry?.customDisplayName ||
+                    entry?.providerDisplayName ||
+                    entry?.label ||
+                    entry?.displayName ||
+                    entry?.name ||
+                    ''),
+                description: entry?.properties?.Mail?.$value ??
+                    entry?.properties?.Account?.$value ??
+                    entry?.description ??
+                    undefined,
             }))
                 .filter((entry) => entry.id && entry.label);
             return resp.type('application/json').send({ reviewers });
@@ -1044,19 +1641,21 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
     // then fetches title/state for the first matches.
     app.get('/api/azure-devops/workitems', async (req, resp) => {
         try {
-            const query = String((req.query ?? {}).query ?? '').trim();
+            const query = String((req.query ?? {}).query ?? '')
+                .trim()
+                .replace(/^#(?=\d+$)/, '');
             if (!query) {
                 return resp.type('application/json').send({ workItems: [] });
             }
             const { prefix } = await azureProjectContext();
             const clauses = [`[System.Title] CONTAINS '${query.replace(/'/g, "''")}'`];
             if (/^\d+$/.test(query)) {
-                clauses.push(`[System.Id] = '${query}'`);
+                clauses.push(`[System.Id] = ${Number(query)}`);
             }
             const wiql = 'SELECT [System.Id], [System.Title], [System.State] FROM WorkItems ' +
-                `WHERE ${clauses.map((clause) => `(${clause})`).join(' OR ')} ` +
+                `WHERE [System.TeamProject] = @project AND (${clauses.map((clause) => `(${clause})`).join(' OR ')}) ` +
                 'ORDER BY [System.ChangedDate] DESC';
-            const wiqlResult = await azureRequest('POST', `${prefix}/_apis/wit/wiql?api-version=${AZURE_API_VERSION}`, JSON.stringify({ query: wiql }));
+            const wiqlResult = await azureRequest('POST', `${prefix}/_apis/wit/wiql?$top=20&api-version=${AZURE_API_VERSION}`, JSON.stringify({ query: wiql }));
             if (wiqlResult.status < 200 || wiqlResult.status >= 300) {
                 return resp
                     .status(400)
@@ -1093,23 +1692,481 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
             return resp.status(400).type('application/json').send({ error: err.message });
         }
     });
-    // Work item tag names for the tag autocomplete.
+    // Existing pull request labels for the tag autocomplete.
     app.get('/api/azure-devops/tags', async (_req, resp) => {
         try {
-            const { prefix } = await azureProjectContext();
-            const result = await azureRequest('GET', `${prefix}/_apis/wit/tags?api-version=${AZURE_API_VERSION}`, '');
-            if (result.status < 200 || result.status >= 300) {
+            const { prefix, remoteUrl } = await azureProjectContext();
+            const repo = parseAzureRemoteUrl(remoteUrl).repo;
+            // PR labels are distinct from Azure Boards work item tags.
+            const names = new Set();
+            for (let skip = 0;; skip += 100) {
+                const result = await azureRequest('GET', `${prefix}/_apis/git/repositories/${encodeURIComponent(repo)}/pullrequests` +
+                    `?searchCriteria.status=all&$top=100&$skip=${skip}&api-version=${AZURE_API_VERSION}`, '');
+                if (result.status < 200 || result.status >= 300) {
+                    throw new Error(azureErrorMessage(result) || `Azure DevOps returned HTTP ${result.status}.`);
+                }
+                const data = JSON.parse(result.body);
+                const requests = Array.isArray(data) ? data : (data.value ?? []);
+                // Some Server releases omit labels from the PR list response.
+                // Read those resources explicitly, with at most five requests in flight.
+                for (let offset = 0; offset < requests.length; offset += 5) {
+                    const labels = await Promise.all(requests.slice(offset, offset + 5).map(async (request) => {
+                        if (Array.isArray(request.labels))
+                            return request.labels;
+                        if (!Number.isInteger(request.pullRequestId))
+                            return [];
+                        const result = await azureRequest('GET', `${prefix}/_apis/git/repositories/${encodeURIComponent(repo)}` +
+                            `/pullrequests/${request.pullRequestId}/labels?api-version=${AZURE_API_VERSION}`, '');
+                        if (result.status < 200 || result.status >= 300) {
+                            throw new Error(azureErrorMessage(result) || `Azure DevOps returned HTTP ${result.status}.`);
+                        }
+                        const data = JSON.parse(result.body);
+                        return Array.isArray(data) ? data : (data.value ?? []);
+                    }));
+                    for (const label of labels.flat()) {
+                        if (typeof label.name === 'string' && label.name.trim())
+                            names.add(label.name.trim());
+                    }
+                }
+                if (requests.length < 100)
+                    break;
+            }
+            const tags = [...names].sort((a, b) => a.localeCompare(b));
+            return resp.type('application/json').send({ tags });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // ==================== Azure DevOps pull request review ====================
+    // Everything the PR sidebar list and the PR detail dialog need: identity,
+    // listing, editing, votes, reviewers, auto-complete, completion, comment
+    // threads, and per-file diffs.
+    app.get('/api/azure-devops/me', async (_req, resp) => {
+        try {
+            return resp.type('application/json').send(await azureMe());
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Pull requests the current user created or reviews ("mine"), merged and
+    // de-duplicated. Status defaults to active.
+    app.get('/api/azure-devops/pullrequests', async (req, resp) => {
+        try {
+            const status = String(req.query?.status ?? 'active').trim() || 'active';
+            const { prefix, remoteUrl } = await azureProjectContext();
+            const repo = parseAzureRemoteUrl(remoteUrl).repo;
+            const me = await azureMe();
+            const collect = async (criteria) => {
+                const found = new Map();
+                for (let skip = 0;; skip += 100) {
+                    const url = `${prefix}/_apis/git/repositories/${encodeURIComponent(repo)}/pullrequests` +
+                        `?searchCriteria.status=${encodeURIComponent(status)}&searchCriteria.${criteria}` +
+                        `&$top=100&$skip=${skip}&api-version=${AZURE_API_VERSION}`;
+                    const data = await azureJson('GET', url);
+                    const requests = Array.isArray(data?.value) ? data.value : [];
+                    for (const request of requests) {
+                        const id = Number(request?.pullRequestId);
+                        if (Number.isInteger(id) && id > 0 && !found.has(id)) {
+                            found.set(id, request);
+                        }
+                    }
+                    if (requests.length < 100)
+                        break;
+                }
+                return found;
+            };
+            const [created, assigned] = await Promise.all([
+                collect(`creatorId=${encodeURIComponent(me.id)}`),
+                collect(`reviewerId=${encodeURIComponent(me.id)}`),
+            ]);
+            const merged = new Map([...created, ...assigned]);
+            const pullRequests = [...merged.values()]
+                .map((request) => mapAzurePullRequest(request, prefix, remoteUrl, me))
+                .sort((a, b) => String(b.createdAt).localeCompare(String(a.createdAt)));
+            return resp.type('application/json').send({ pullRequests });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    app.get('/api/azure-devops/pullrequests/:id', async (req, resp) => {
+        try {
+            const { base, prefix, remoteUrl } = await azurePrApiBase(Number(req.params?.id));
+            const [pr, me] = await Promise.all([
+                azureJson('GET', `${base}?api-version=${AZURE_API_VERSION}`),
+                azureMe(),
+            ]);
+            const summary = mapAzurePullRequest(pr, prefix, remoteUrl, me);
+            return resp.type('application/json').send({
+                ...summary,
+                description: String(pr?.description ?? ''),
+                autoCompleteSetBy: pr?.autoCompleteSetBy
+                    ? {
+                        id: String(pr.autoCompleteSetBy.id ?? ''),
+                        name: String(pr.autoCompleteSetBy.displayName ?? ''),
+                    }
+                    : null,
+                completionOptions: pr?.completionOptions ?? null,
+                lastMergeSourceCommit: String(pr?.lastMergeSourceCommit?.commitId ?? ''),
+                lastMergeTargetCommit: String(pr?.lastMergeTargetCommit?.commitId ?? ''),
+                labels: (Array.isArray(pr?.labels) ? pr.labels : [])
+                    .map((label) => String(label?.name ?? ''))
+                    .filter(Boolean),
+            });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Edits title/description or flips the draft flag ("publish"/"convert to draft").
+    app.patch('/api/azure-devops/pullrequests/:id', async (req, resp) => {
+        try {
+            const { title, description, isDraft } = req.body ?? {};
+            const payload = {};
+            if (title !== undefined)
+                payload.title = String(title);
+            if (description !== undefined)
+                payload.description = String(description);
+            if (isDraft !== undefined)
+                payload.isDraft = isDraft === true;
+            if (!Object.keys(payload).length) {
+                return resp.status(400).type('application/json').send({ error: 'Nothing to update.' });
+            }
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            await azureJson('PATCH', `${base}?api-version=${AZURE_API_VERSION}`, JSON.stringify(payload));
+            return resp.type('application/json').send({ ok: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Records the current user's vote on the pull request.
+    app.post('/api/azure-devops/pullrequests/:id/vote', async (req, resp) => {
+        try {
+            const vote = String(req.body?.vote ?? '');
+            if (!(vote in AZURE_VOTES)) {
                 return resp
                     .status(400)
                     .type('application/json')
-                    .send({
-                    error: azureErrorMessage(result) || `Azure DevOps returned HTTP ${result.status}.`,
+                    .send({ error: `Unknown vote "${vote}".` });
+            }
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            const me = await azureMe();
+            await azureJson('PUT', `${base}/reviewers/${encodeURIComponent(me.id)}?api-version=${AZURE_API_VERSION}`, JSON.stringify({ vote: AZURE_VOTES[vote] }));
+            return resp.type('application/json').send({ ok: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Adds or updates a reviewer (optionally required), or removes one.
+    app.post('/api/azure-devops/pullrequests/:id/reviewers', async (req, resp) => {
+        try {
+            const id = String(req.body?.id ?? '');
+            if (!id) {
+                return resp.status(400).type('application/json').send({ error: 'Reviewer id required.' });
+            }
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            const reviewerUrl = `${base}/reviewers/${encodeURIComponent(id)}?api-version=${AZURE_API_VERSION}`;
+            if (req.body?.remove === true) {
+                await azureJson('DELETE', reviewerUrl);
+                return resp.type('application/json').send({ ok: true });
+            }
+            // The PUT replaces the reviewer record, so an existing vote is passed
+            // through to survive an isRequired toggle.
+            const payload = { isRequired: req.body?.required === true };
+            if (req.body?.vote !== undefined && Number.isFinite(Number(req.body.vote))) {
+                payload.vote = Number(req.body.vote);
+            }
+            await azureJson('PUT', reviewerUrl, JSON.stringify(payload));
+            return resp.type('application/json').send({ ok: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    /** Maps dialog completion options onto the Azure DevOps payload shape. */
+    const completionOptionsOf = (body) => {
+        const strategies = ['noFastForward', 'squash', 'rebase', 'rebaseMerge'];
+        const mergeStrategy = String(body?.mergeStrategy ?? '');
+        const options = {};
+        if (strategies.includes(mergeStrategy))
+            options.mergeStrategy = mergeStrategy;
+        if (body?.deleteSourceBranch !== undefined) {
+            options.deleteSourceBranch = body.deleteSourceBranch === true;
+        }
+        const completeWorkItems = body?.completeWorkItems === true;
+        if (completeWorkItems) {
+            options.completeWorkItems = true;
+            // Transitioning requires completion of linked work items.
+            if (body?.transitionWorkItems === true)
+                options.transitionWorkItems = true;
+        }
+        return Object.keys(options).length ? options : null;
+    };
+    // Sets or clears auto-complete with optional completion options.
+    app.post('/api/azure-devops/pullrequests/:id/autocomplete', async (req, resp) => {
+        try {
+            const enabled = req.body?.enabled === true;
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            const buildPayload = (identity) => {
+                const payload = { autoCompleteSetBy: identity };
+                if (enabled) {
+                    const options = completionOptionsOf(req.body);
+                    if (options)
+                        payload.completionOptions = options;
+                }
+                return JSON.stringify(payload);
+            };
+            const url = `${base}?api-version=${AZURE_API_VERSION}`;
+            const me = enabled ? await azureMe() : null;
+            // Azure DevOps clears auto-complete for an empty identity; some Server
+            // releases only accept an explicit null, so retry that shape on failure.
+            try {
+                await azureJson('PATCH', url, buildPayload(enabled && me ? { id: me.id } : { id: '' }));
+            }
+            catch (firstError) {
+                if (enabled)
+                    throw firstError;
+                await azureJson('PATCH', url, buildPayload(null));
+            }
+            return resp.type('application/json').send({ ok: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Completes the pull request (merge). Requires the merge source commit for
+    // optimistic concurrency, exactly like the Azure DevOps web dialog.
+    app.post('/api/azure-devops/pullrequests/:id/complete', async (req, resp) => {
+        try {
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            const pr = await azureJson('GET', `${base}?api-version=${AZURE_API_VERSION}`);
+            const commitId = String(pr?.lastMergeSourceCommit?.commitId ?? '');
+            if (!commitId) {
+                throw new Error('The pull request has no merge commit to complete yet.');
+            }
+            const payload = {
+                status: 'completed',
+                lastMergeSourceCommit: { commitId },
+            };
+            const options = completionOptionsOf(req.body);
+            if (options)
+                payload.completionOptions = options;
+            await azureJson('PATCH', `${base}?api-version=${AZURE_API_VERSION}`, JSON.stringify(payload));
+            return resp.type('application/json').send({ ok: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    app.get('/api/azure-devops/pullrequests/:id/threads', async (req, resp) => {
+        try {
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            const data = await azureJson('GET', `${base}/threads?api-version=${AZURE_API_VERSION}`);
+            const threads = (Array.isArray(data?.value) ? data.value : [])
+                .filter((thread) => thread?.isDeleted !== true)
+                .map((thread) => {
+                const context = thread?.threadContext ?? {};
+                const line = context.rightFileStart?.line ?? context.leftFileStart?.line ?? null;
+                return {
+                    id: Number(thread?.id ?? 0),
+                    status: azureThreadStatusName(Number(thread?.status ?? 0)),
+                    isDeleted: false,
+                    filePath: typeof context.filePath === 'string' ? context.filePath.replace(/^\//, '') : null,
+                    line: Number.isInteger(line) ? line : null,
+                    side: context.rightFileStart ? 'right' : context.leftFileStart ? 'left' : null,
+                    comments: (Array.isArray(thread?.comments) ? thread.comments : [])
+                        .filter((comment) => comment?.isDeleted !== true)
+                        .map((comment) => ({
+                        id: Number(comment?.id ?? 0),
+                        author: {
+                            name: String(comment?.author?.displayName ?? ''),
+                            email: String(comment?.author?.uniqueName ?? ''),
+                        },
+                        content: String(comment?.content ?? ''),
+                        createdAt: String(comment?.publishedDate ?? ''),
+                        isDeleted: false,
+                    })),
+                };
+            });
+            return resp.type('application/json').send({ threads });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Adds a comment: a reply to a thread, a general PR comment, or an inline
+    // comment anchored to a file line (thread context).
+    app.post('/api/azure-devops/pullrequests/:id/threads', async (req, resp) => {
+        try {
+            const content = String(req.body?.content ?? '').trim();
+            if (!content) {
+                return resp.status(400).type('application/json').send({ error: 'Comment text required.' });
+            }
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            const threadId = Number(req.body?.threadId ?? 0);
+            if (Number.isInteger(threadId) && threadId > 0) {
+                await azureJson('POST', `${base}/threads/${threadId}/comments?api-version=${AZURE_API_VERSION}`, JSON.stringify({ content }));
+                return resp.type('application/json').send({ ok: true });
+            }
+            const payload = {
+                status: AZURE_THREAD_STATUSES.active,
+                comments: [{ content, parentCommentId: 0 }],
+            };
+            const filePath = String(req.body?.filePath ?? '').trim();
+            const line = Number(req.body?.line ?? 0);
+            const left = req.body?.side === 'left';
+            if (filePath && Number.isInteger(line) && line > 0) {
+                // Azure anchors a whole-line comment from offset 1 to "end of line".
+                payload.threadContext = {
+                    filePath: `/${filePath.replace(/^\//, '')}`,
+                    [left ? 'leftFileStart' : 'rightFileStart']: { line, offset: 1 },
+                    [left ? 'leftFileEnd' : 'rightFileEnd']: { line, offset: 2147483647 },
+                };
+            }
+            await azureJson('POST', `${base}/threads?api-version=${AZURE_API_VERSION}`, JSON.stringify(payload));
+            return resp.type('application/json').send({ ok: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Resolves, reactivates or closes a comment thread.
+    app.post('/api/azure-devops/pullrequests/:id/threads/:threadId/status', async (req, resp) => {
+        try {
+            const status = String(req.body?.status ?? '');
+            if (!(status in AZURE_THREAD_STATUSES) || status === 'unknown') {
+                return resp
+                    .status(400)
+                    .type('application/json')
+                    .send({ error: `Unknown thread status "${status}".` });
+            }
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            await azureJson('PATCH', `${base}/threads/${Number(req.params?.threadId)}?api-version=${AZURE_API_VERSION}`, JSON.stringify({ status: AZURE_THREAD_STATUSES[status] }));
+            return resp.type('application/json').send({ ok: true });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Changed files of the latest PR iteration (names and change types only;
+    // content is fetched per file on demand by /file-diff).
+    app.get('/api/azure-devops/pullrequests/:id/changes', async (req, resp) => {
+        try {
+            const { base } = await azurePrApiBase(Number(req.params?.id));
+            const iterations = await azureJson('GET', `${base}/iterations?api-version=${AZURE_API_VERSION}`);
+            const list = Array.isArray(iterations?.value) ? iterations.value : [];
+            const latest = list.length
+                ? list.reduce((newest, entry) => String(entry?.createdDate ?? '') > String(newest?.createdDate ?? '') ? entry : newest)
+                : null;
+            if (!latest) {
+                return resp.type('application/json').send({ files: [] });
+            }
+            const data = await azureJson('GET', `${base}/iterations/${latest.id}/changes?api-version=${AZURE_API_VERSION}`);
+            const changeStatus = {
+                add: 'added',
+                edit: 'modified',
+                rename: 'renamed',
+                delete: 'deleted',
+                undelete: 'added',
+            };
+            const files = (Array.isArray(data?.value) ? data.value : []).map((entry) => {
+                const path = String(entry?.item?.path ?? '').replace(/^\//, '');
+                const changeType = changeStatus[String(entry?.changeType ?? '')] ?? 'modified';
+                const oldPath = changeType === 'renamed'
+                    ? String(entry?.sourceServerItem ?? '').replace(/^\//, '')
+                    : '';
+                return { path, oldPath, changeType };
+            });
+            return resp.type('application/json').send({ files });
+        }
+        catch (err) {
+            return resp.status(400).type('application/json').send({ error: err.message });
+        }
+    });
+    // Unified diff of one PR file, computed from the Azure item contents at the
+    // PR merge commits. source/target are optional overrides; default comes from
+    // the pull request detail.
+    app.get('/api/azure-devops/pullrequests/:id/file-diff', async (req, resp) => {
+        try {
+            const path = String(req.query?.path ?? '').replace(/^\//, '');
+            if (!path) {
+                return resp.status(400).type('application/json').send({ error: 'path required' });
+            }
+            const oldPath = String(req.query?.oldPath ?? '').replace(/^\//, '');
+            const { base, prefix, repo } = await azurePrApiBase(Number(req.params?.id));
+            let source = String(req.query?.source ?? '');
+            let target = String(req.query?.target ?? '');
+            if (!source || !target) {
+                const pr = await azureJson('GET', `${base}?api-version=${AZURE_API_VERSION}`);
+                source = source || String(pr?.lastMergeSourceCommit?.commitId ?? '');
+                target = target || String(pr?.lastMergeTargetCommit?.commitId ?? '');
+            }
+            if (!source || !target) {
+                throw new Error('The pull request does not have merge commits to diff yet.');
+            }
+            const fetchContent = async (itemPath, commit) => {
+                if (!itemPath)
+                    return { content: '', binary: false };
+                const url = `${prefix}/_apis/git/repositories/${encodeURIComponent(repo)}/items` +
+                    `?path=${encodeURIComponent(`/${itemPath}`)}` +
+                    `&versionDescriptor.version=${encodeURIComponent(commit)}` +
+                    `&versionDescriptor.versionType=commit&includeContent=true` +
+                    `&api-version=${AZURE_API_VERSION}`;
+                const result = await azureRequest('GET', url, '');
+                // 404/203: the file does not exist at that commit (added/deleted file).
+                if (result.status === 404 || result.status === 203) {
+                    return { content: '', binary: false };
+                }
+                if (result.status < 200 || result.status >= 300) {
+                    throw new Error(azureErrorMessage(result) || `Azure DevOps returned HTTP ${result.status}.`);
+                }
+                const data = JSON.parse(result.body);
+                return {
+                    content: typeof data?.content === 'string' ? data.content : '',
+                    binary: data?.isBinary === true,
+                };
+            };
+            const [oldFile, newFile] = await Promise.all([
+                fetchContent(oldPath || path, target),
+                fetchContent(path, source),
+            ]);
+            if (oldFile.binary || newFile.binary) {
+                return resp.type('application/json').send({
+                    path,
+                    oldPath,
+                    status: 'binary',
+                    binary: true,
+                    additions: 0,
+                    deletions: 0,
+                    lines: [],
                 });
             }
-            const tags = (JSON.parse(result.body).value ?? [])
-                .map((tag) => String(tag?.name ?? '').trim())
-                .filter(Boolean);
-            return resp.type('application/json').send({ tags });
+            const status = String(req.query?.changeType ?? '') ||
+                (!oldFile.content ? 'added' : !newFile.content ? 'deleted' : 'modified');
+            // jsdiff omits the "diff --git" header parseUnifiedDiff expects, and
+            // prefixing it lets the same parser serve both local and PR diffs.
+            const patch = createTwoFilesPatch(`a/${oldPath || path}`, `b/${path}`, oldFile.content, newFile.content);
+            const raw = `diff --git a/${oldPath || path} b/${path}\n${patch.replace(/^=+\n/, '')}`;
+            // The patch's trailing newline would surface as a phantom context row.
+            const [file] = parseUnifiedDiff(raw.replace(/\n+$/, ''));
+            const maxLines = 10000;
+            const lines = (file?.lines ?? []).slice(0, maxLines);
+            if ((file?.lines ?? []).length > maxLines) {
+                lines.push({ type: 'hunk', text: 'Diff truncated (file too large).' });
+            }
+            return resp.type('application/json').send({
+                path,
+                oldPath,
+                status,
+                binary: false,
+                additions: file?.additions ?? 0,
+                deletions: file?.deletions ?? 0,
+                lines,
+            });
         }
         catch (err) {
             return resp.status(400).type('application/json').send({ error: err.message });
@@ -1139,8 +2196,7 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
                 message,
                 refs: '',
                 body: body ?? '',
-                author_name: authorName,
-                author_email: authorEmail,
+                ...authorIdentity(authorName, authorEmail, await configuredIdentity()),
                 parents: String(parents ?? '')
                     .split(' ')
                     .filter(Boolean),
@@ -1288,5 +2344,20 @@ export async function startGuitoServer({ repositoryPath, uiRoot, host, port = 80
     return {
         address,
         close: () => app.close(),
+        updateSettings: (settings) => {
+            azureDevOpsUrl = settings.azureDevOpsUrl;
+            prBranchNameTemplate = settings.prBranchNameTemplate;
+            autoReload = settings.autoReload;
+            diffViewer = settings.diffViewer;
+            showGraph = settings.showGraph;
+            showStashes = settings.showStashes;
+            fileListView = settings.fileListView;
+            searchMode = settings.searchMode;
+            searchCaseSensitive = settings.searchCaseSensitive;
+            showTags = settings.showTags;
+            showRemoteBranches = settings.showRemoteBranches;
+            issueRegex = settings.issueRegex;
+            issueUrl = settings.issueUrl;
+        },
     };
 }