feat(web-shell): manage git remotes from the workspace branch picker - #11163

E2E test report

Environment: macOS (darwin), Node 22, local build (npm run build), git 2.50.1. UI e2e: Playwright Chromium against the mocked daemon; daemon/core layers: vitest + supertest against real temporary git repositories.

Web Shell UI e2e (Playwright)

• web-shell.git-remotes.spec.ts — 3/3 passed: sidebar git pill → Manage Remotes panel → list renders name+URL; add flow (daemon request body {name, url} asserted, row appears, success footer); two-click remove (first click arms only — zero requests — second removes, request body {name} asserted); back button restores the branch list; duplicate add → mock 409 surfaced verbatim in the footer with the list unchanged; search filters by name and by URL substring.
• web-shell.git-mode.spec.ts — 5/5 passed (regression: now shares the extracted git-workspace fixture).

Daemon routes (supertest + real temp repos) — 27/27

List with push-URL override (set-url --push); add → fresh list + on-disk git remote confirmation; duplicate add → 409 remote_already_exists; remove → fresh list; remove missing → 404 no_such_remote; non-repo → 404 not_a_git_repository; unknown workspace → 400 workspace_mismatch; escaping ?cwd= → 400 invalid_cwd; untrusted workspace → 403 (all three endpoints); closed generation → 503 workspace_runtime_unavailable (all three); name/URL validation tables → 400; absolute-path redaction asserted on every error body; classifier-collision cases (a remote named dirty-cache still classifies as remote_already_exists / no_such_remote, not dirty_working_tree). Sibling workspace-git-branches suite: 36/36 (shared classifier regression).

Core (real temp repos) — 55/55

Structured-accessor listing: sorted order, push-URL override, partial-clone promisor remote (the [blob:none] annotation shape that breaks git remote -v parsers), url-less config entry (git's name-as-URL fallback), 24-remote batched-lookup completeness (crosses the 8-wide concurrency bound). Predicate tables: add-name/add-URL/remove-name incl. the leniency divergence (a.lock add-rejected but removable) and invisible-character rejection (bidi overrides, LRM/RLM, soft hyphen, separators). Round-trips: add/remove, duplicate error, predicate-legal names (a@b, a+b, a#b, @) verified accepted by real git remote add (no 500-path divergence), hand-configured x.lock remote listed and removable.

SDK — 416/416 (2 new)

URL/method/body composition for workspaceGitRemotes / workspaceGitRemoteAdd / workspaceGitRemoteRemove, with and without cwd.

Web Shell unit — 228/228

BranchPickerPopover 66 (panel open/list, add success + daemon-failure footer, local dash guard, two-click remove with counted post-remove branch/status refreshes + onBranchChanged, filtered-to-empty vs configured-empty copy, load-failure rendering, bidi/RLM display stripping with raw-name removal and search-by-displayed-name, sticky stash-warning survival across the panel round trip, reopen reset + confirm disarm, action-query not carried into the panel filter) + WorkspaceSection + ChatEditor regressions.

Gates (on the merge-base tree, c4cf30aa2e)

npm run build exit 0 · npm run typecheck exit 0 · eslint --max-warnings 0 clean on every touched file · prettier --check clean.

Not run / boundaries

• Live-daemon curl E2E was not run in the authoring environment (its agent shell guard blocks git init/git remote add fixture writes in temp dirs). The daemon layer is covered instead by the route suite above against real temp repos — same HTTP → core → git chain, minus a live socket.
• Windows/Linux not tested locally; CI covers.
• Review process: 14-agent finder fan-out + 5 reverse-audit rounds before submission; ~25 findings (2 Critical: a partial-clone parser break and a CI lint-gate failure; the rest Suggestions) all fixed in-tree, each with a witness test, before the branch was pushed.

@qwen-code /takeover from 4

🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. This window's round counter starts at 4 (the rounds this PR spent in review before takeover), so the Critical-only brake engages after 1 more change-producing round(s) instead of a full fresh 5. Remove the autofix/takeover label (or comment @qwen-code /takeover stop) to release.

⚠️ AutoFix round 8 ended without publishing a report — view run.

🤖 AutoFix updated a stale base — the fix did not pass verification, but this PR was behind main, so it merged current main in via update-branch and will retry on the next scan. A stale base (a dependency or symbol main already changed) can fail the build without being the fix's fault; if it still fails once current, it hands off to a human.

What I found before stopping:
Autofix agent finished without required output file(s): address-summary.md, no-action.md.

See the Qwen Autofix agent step logs for model/tool output.

Run log: https://github.com/QwenLM/qwen-code/actions/runs/34192434018

🧠 Handled by Qwen Code · model/模型 kimi-k3 · CLI 0.23.0

🔀 Base updated: red check(s) [web-shell E2E Smoke (ubuntu-latest, Node 22.x)] pass on current main — merged current main via update-branch; CI will re-run.

⏸️ AutoFix paused by a review convergence signal: 3 consecutive automated review round(s) signalled machine-readable non-convergence (codes observed since the last maintainer response, or the window start if none: root-cause-triage) — the reviewer keeps finding new defects at a rate that is not falling while the loop keeps widening the diff, so another automatic round is unlikely to converge this PR. The loop resumes once a maintainer responds on this PR (a review or comment counts, and steers the next rounds), and pauses again if the signal persists for 3 more round(s). Alternatives: split the recurring cluster into its own PR, batch the remaining fixes into one push, comment @qwen-code /retry to re-arm a fresh window, or @qwen-code /takeover stop to release takeover. While paused, new feedback and base conflicts stay unhandled.

Local verification against a live daemon and a real browser

Maintainer pass at head d1e994f. The PR's own "Not validated" list names two gaps — "a live-daemon curl pass was not run in the authoring environment" and a UI verified only against the mocked daemon. Both are now closed: I rebuilt the daemon from PR source and drove the real Web Shell in real Chromium against it, with every assertion checked back against .git/config on disk with real git.

No mock daemon, no page.route, no fixtures. Chain under test: Chromium → PR web-shell → PR SDK → real HTTP → qwen serve (PR bundle) → real git → real repository.

Verdict: merge-ready. The one red check is not this PR's — see §1. 99 independent checks pass, 4 mutations confirm they discriminate, and 4 of 5 sampled still-open Critical review threads no longer reproduce at this head.

Environment

1. The red CI check is a pre-existing main bug, not this PR

Test (ubuntu-latest, Node 22.x) fails with ReferenceError: mockUseDaemonActivePromptBridge is not defined at packages/web-shell/client/App.test.tsx:28940 — a file this PR does not touch. The symbol was introduced by #11250, and main already fixed it in #11406, whose commit message says outright that it "failed the main-branch CI Test job at 70cf363". This branch merged main at 1f890086f, which still carried the break.

Reproduced and A/B'd locally on the two parameterized cases:

Action: update the branch onto current main; no code change needed here.

2. Core layer against real git — 47/47, every claim with a negative control

Each structural claim is paired with a control showing what plain git does, so a pass means the code closes a real gap rather than re-stating git's own behaviour.

Also covered: multi-URL push fan-out matching git remote -v exactly; names with dots (a.b beside a, x.url) parsed and removed independently; hand-configured bidi names listed and removable while the add predicate rejects creating them; ext::/7z::/fd::/-oProxyCommand= rejected while ssh://git@[::1]:22/…, scp-like, relative and space-bearing local paths are accepted by both the predicate and real git remote add.

3. Live daemon over real HTTP — 22/22 (the gap the PR listed as unvalidated)

Add wrote https://github.com/wenshao/qwen-code.git and git config --get remote.fork.url read it back; remove emptied it. Classifier collisions hold on the wire: removing remotes named dirty-cache and already exists both answer 404 no_such_remote, not the legacy keyword branches. No error body carried an absolute path. Guards: ?cwd= escaping → 400 invalid_cwd on mutations, unknown workspace → 400 workspace_mismatch, token-less mutation → 401.

Newline-injection probe (the PR's own headline risk). A hand-edited fetch value carrying a real LF makes git emit an attacker-chosen line-initial message:

fatal: invalid refspec 'bogus
error: Could not remove config section 'remote.evil''

Line 2 reads exactly like the completion signal the worktree path keys on. The route answered 409 remote_config_unparsable, the remote survived, and the list kept showing it — an honest refusal, not a false success.

4. Real browser → real daemon → real .git/config — 30/30

Live remote list (read from the real repo)	Add succeeded — verified on disk

Duplicate add: real git error, verbatim	Two-click confirm armed (zero requests yet)

• The panel's rows matched git remote exactly, before and after every mutation.
• The first remove click issued zero requests to the live daemon and left the repo untouched; the second removed it from .git/config.
• The failed duplicate add did not mutate the repo (remote.fork.url stayed single-valued).
• Race: deleting a remote in a terminal behind the open panel, then confirming its removal, surfaced git's real error: No such remote: 'racer' and the panel re-read the list instead of keeping an undeletable row.
• Tracked-remote removal: with main tracking tracked/main, removing it through the UI cleared branch.main.remote, branch.main.merge and refs/remotes/tracked/*, and the branch list's remote group was gone on return.

5. Invisible-character hardening — proven by mutation, not assertion

A hand-edited .git/config with a remote named ev\u{202E}liat and a URL carrying \u{200B}:

Shipped code	Same page, sanitizer mutated to identity
renders evliat (hidden characters)	renders evtail — the override reverses the tail and the zero-width URL looks clean

Searching the displayed name still found the row, and the remove request carried the raw configured name (65 76 202e 6c 69 61 74) — verified on the wire. With the sanitizer mutated away, three of those checks flip red, including search-by-displayed-name.

Mutations run (all discriminated): scope filter → local-only (worktree remote disappears from the listing); orphan-ref sweep deleted (removal now throws instead of certifying); worktree upstream-key sweep deleted (same); display sanitizer → identity (spoofing returns). Notably the last two are caught by the module's own verification gates — those gates are load-bearing, not decorative.

6. Still-open Critical review threads, re-tested against real git

The autofix loop is paused on a non-convergence signal, so I re-tested a sample of threads still marked open and "Still stands":

4 of 5 are stale threads describing code that has since changed. That is worth knowing before reading the backlog as a merge blocker.

7. Non-blocking observations

• N1 (confirms R3-2). When a remote name exists at both local and inherited scope, the panel shows only the local URL. Measured: panel fetchUrl=https://local.invalid/l.git, extraFetchUrls=0, while git remote -v reports the global URL as the fetch URL and two push targets. Display-only — the mutation side is safe (R1-5 above), and Add refuses to create this shape (409 remote_shadows_inherited), so it needs a pre-existing cross-scope collision made outside the panel.
• N2. A url-less section reports fetchUrl: '', but git's fallback resolves the name as the URL (git remote get-url urlless → urlless). Hand-edit-only; removal works either way.
• N3. Test-plan item 9 says "?cwd= escaping the workspace → 400". Measured: true for both mutations, but the GET route answers 200 with the workspace root's remotes (lenient resolveContainedCwd, matching the sibling branch routes). Fail-safe and correct — the sentence just needs to say "mutations". Flagged in triage stage-2 on 09-06 and still present.

8. Gates re-run locally at this head

The single git-branches failure is "types the refusal with a lock hint when the index is wedged", which came from #10390 and is already on main. It is git-version-dependent, not a PR regression: with a wedged index.lock, git 2.47.3 on this box prints error: could not write index with no "lock" substring, while the assertion requires one. CI's newer git passes it.

中文说明

针对 live daemon 与真实浏览器的本地验证

维护者在 head d1e994f 上的验证。PR 自陈的"未验证"两项——"撰写环境未跑 live-daemon 的 curl 验证"、UI 仅对 mock daemon 验证——现已全部补齐：我用 PR 源码重新构建了 daemon，在真实 Chromium 中驱动真实 Web Shell 对其操作，每条断言都用真实 git 回读磁盘上的 .git/config 复核。

无 mock daemon、无 page.route、无夹具。受测链路：Chromium → PR web-shell → PR SDK → 真实 HTTP → qwen serve（PR 构建）→ 真实 git → 真实仓库。

**结论：可以合入。**唯一的红色检查不是本 PR 引入的，见 §1。99 项独立检查全部通过，4 次变异证明这些检查具备判别力，抽样的 5 条仍未关闭的 Critical 评审线程中有 4 条在当前 head 上已不复现。

环境

Head / base	d1e994f80 / merge-base 1f890086f
平台	Linux 6.12.63、Node 22.22.2、git 2.47.3
Daemon	node dist/cli.js serve --port 4188 --workspace <真实仓库> --no-web，由 PR 源码构建
浏览器	Playwright Chromium 1280×800，dev server 代理至 QWEN_DAEMON_URL=http://127.0.0.1:4188，token 经 ?token= 传入

---

1. 红色 CI 检查是 main 的既有 bug，与本 PR 无关

Test (ubuntu-latest, Node 22.x) 失败于 packages/web-shell/client/App.test.tsx:28940 的 ReferenceError: mockUseDaemonActivePromptBridge is not defined——这个文件本 PR 并未触及。该符号由 #11250 引入，main 已在 #11406 修复，其提交信息明确写着它*"failed the main-branch CI Test job at 70cf363"*。本分支在 1f890086f 合入 main，而该提交仍带着这个问题。

本地复现并做了两个参数化用例的 A/B：

臂	结果
PR head 原样	Tests 2 failed | 794 skipped——同样的 ReferenceError、同一行
PR head + main 的 #11406 补丁	Tests 2 passed | 794 skipped

处置：把分支更新到当前 main 即可，本 PR 无需改代码。

2. Core 层对真实 git —— 47/47，每条都带反向对照

每条结构性主张都配了一个"plain git 会怎样"的对照，因此通过意味着代码确实补上了真实缺口，而不只是复述 git 自身行为。

主张	plain git（对照）	本 PR
worktree 作用域 remote	git remote remove 失败，error: Could not remove config section，remote 存活	被列出，并在 git 写不了的作用域完成删除
无 refspec 的删除	遗留孤儿 refs/remotes/noref/main	清扫干净
worktree 作用域的分支 upstream 键	留下悬空 branch.main.remote = up	已清除
同名继承（global）remote	git remote add 成功，并静默把两个 URL 都纳入解析	预检拒绝，不写入任何内容
include.path 引入的 remote	git config --local 看不见	被列出；删除诚实拒绝，remote 确实存活
insteadOf 改写	git remote -v 显示改写后的 URL	显示配置中的 URL
Partial clone	[blob:none] 注解会破坏 -v 解析	从配置读出 promisor/partialCloneFilter

同时覆盖：多 URL 的 push 扇出与 git remote -v 完全一致；带点的名字（a.b 与 a 并存、x.url）能被正确解析并独立删除；手改配置里的 bidi 名字可列出、可删除，而 add 谓词拒绝创建这类名字；ext::/7z::/fd::/-oProxyCommand= 被拒绝，而 ssh://git@[::1]:22/…、scp 形式、相对路径、含空格的本地路径同时被谓词与真实 git remote add 接受。

3. Live daemon 真实 HTTP —— 22/22（PR 自陈未验证的那一项）

添加操作写入了 https://github.com/wenshao/qwen-code.git，git config --get remote.fork.url 回读一致；删除后该键为空。分类器碰撞在真实线上成立：删除名为 dirty-cache 和 already exists 的 remote，均返回 404 no_such_remote，而非落入遗留关键字分支。所有错误响应体都不含绝对路径。守卫：?cwd= 逃逸 → 变更类接口 400 invalid_cwd，未知 workspace → 400 workspace_mismatch，无 token 的变更 → 401。

换行注入探针（PR 自己点名的主要风险）。手改的 fetch 值携带真实 LF，可让 git 输出攻击者选定的行首消息：

fatal: invalid refspec 'bogus
error: Could not remove config section 'remote.evil''

第 2 行读起来正是 worktree 补删路径所依赖的"完成信号"。路由返回 409 remote_config_unparsable，remote 存活，列表仍然显示它——是诚实的拒绝，而非虚假的成功。

4. 真实浏览器 → 真实 daemon → 真实 .git/config —— 30/30

实时 remote 列表（读自真实仓库）	添加成功——已在磁盘核对

重复添加：git 的真实错误，原样呈现	两段式确认已待确认（此时零请求）

• 每次变更前后，面板行与 git remote 完全一致。
• 删除的第一次点击向 live daemon 发出零请求，仓库未被改动；第二次点击才真正从 .git/config 移除。
• 失败的重复添加没有改动仓库（remote.fork.url 仍为单值）。
• 竞态：面板开着时在终端删掉某个 remote，再在面板中确认删除，footer 显示 git 真实的 error: No such remote: 'racer'，且面板重新拉取列表，而不是留下一个删不掉的行。
• 删除被跟踪的 remote：main 原本跟踪 tracked/main，通过 UI 删除后，branch.main.remote、branch.main.merge 与 refs/remotes/tracked/* 全部清除，返回分支视图时该 remote 分组已消失。

5. 不可见字符加固 —— 用变异证明，而非仅凭断言

手改 .git/config，remote 名为 ev\u{202E}liat，URL 含 \u{200B}：

现有代码	同一页面，净化器变异为恒等函数
渲染为 evliat (hidden characters)	渲染为 evtail —— 覆盖符把尾部反转，零宽 URL 看起来干干净净

按显示的名字搜索仍能命中该行，删除请求携带的是配置中的原始名字（65 76 202e 6c 69 61 74）——已在线上核实。把净化器变异掉之后，其中三项检查转红，包括"按显示名搜索"。

已执行的变异（全部被判别）：作用域过滤改为仅 local（worktree remote 从列表消失）；删掉孤儿 ref 清扫（删除转为抛错而非虚假确认）；删掉 worktree upstream 键清扫（同上）；显示净化器改为恒等（欺骗重现）。值得注意的是，后两项是被模块自身的校验门拦下的——这些校验门是承重的，不是摆设。

6. 仍未关闭的 Critical 评审线程，用真实 git 复测

autofix 循环因不收敛信号暂停，因此我抽样复测了仍标记为开放且写着*"Still stands"*的线程：

线程	当前 head 上的结果
R1-5 —— 继承作用域同名 section 存活时删除仍返回 200	**不复现。**删除会拒绝（remote still configured after removal）；git-remotes.ts:462 的全作用域校验门在位
R4-4 —— 配置值携带完成短语可诱导虚假完成	**不复现。**已拒绝，remote 存活（§3）
R4-7 —— IME 组合态的 Enter 会提交添加	**不复现。**组合态 Enter 被忽略，普通 Enter 正常提交；守卫在 BranchPickerPopover.tsx:1941
R4-29 —— extraPushUrls 少报 push 扇出	不复现。extraPushUrls=1 ⇒ 2 个目标，与 git remote -v 一致
R3-2 —— 跨作用域列表准确性	复现，仅影响显示 —— 见 N1

5 条中有 4 条是描述已被后续改动覆盖的陈旧线程。在把这份 backlog 当作合并阻塞项来读之前，这一点值得知道。

7. 非阻塞观察

• **N1（确认 R3-2）。**当一个 remote 名同时存在于 local 与继承作用域时，面板只显示 local 的 URL。实测：面板 fetchUrl=https://local.invalid/l.git、extraFetchUrls=0，而 git remote -v 报告 global 的 URL 才是 fetch URL，并有两个 push 目标。仅影响显示——变更侧是安全的（见上面 R1-5），且 Add 会拒绝创建这种形态（409 remote_shadows_inherited），所以它需要一个在面板之外制造的既有跨作用域冲突。
• N2。无 url 的 section 报告 fetchUrl: ''，但 git 的回退会把名字本身解析为 URL（git remote get-url urlless → urlless）。仅限手改配置；无论如何删除都能工作。
• **N3。**测试计划第 9 条写着"?cwd= 逃逸 workspace → 400"。实测：两个变更类接口确实如此，但 GET 路由返回 200 并给出 workspace 根目录的 remotes（宽松的 resolveContainedCwd，与兄弟分支路由一致）。这是 fail-safe 且正确的——只是这句话应写明"变更类接口"。triage stage-2 在 09-06 已指出，目前仍在。

8. 在当前 head 本地重跑的门禁

套件	结果
core git-remotes.test.ts + git-remotes-kill.test.ts	166/166
core git-branches.test.ts	102/103 —— 见下注
cli workspace-git-remotes + workspace-git-branches	100/100
web-shell BranchPickerPopover.test.tsx	109/109
sdk-typescript DaemonClient.test.ts	418/418

git-branches 唯一的失败是*"types the refusal with a lock hint when the index is wedged"*，它来自 #10390 且已在 main 上。这是 git 版本依赖，不是本 PR 的回归：在 index.lock 被占住时，本机的 git 2.47.3 打印 error: could not write index，不含 "lock" 子串，而断言要求包含。CI 上更新的 git 能通过。

🧠 Verified with Claude Code · model claude-opus-5[1m]

Qwen Code review request accepted. Review is queued for an available runner; follow the workflow run for progress. A command-triggered review is not listed under the checks of this PR; the result is posted here as a review when it finishes.

R18 dispositions — all seven threads addressed in the batch that lands with this reply; every fix carries a discriminating witness and was mutation-checked (mutant reddens only its witness, siblings stay green). Gates at push time: core git-remotes suites 268 passed (incl. the kill suite's 29), cli remote-routes suite 37 passed / 0 skipped, web-shell suite 151 passed, prettier + eslint + typecheck green.

R18-1 (ambient guard [^.]+ spans lines) — fixed. The named-section guard now excludes the newline from the component class and stops the scan at the = (/^remote\.[^=\n]*\./m), so a host remote.pushDefault — plain, followed by any dotted key, or carrying a dot in its VALUE — no longer reads as a named [remote "<name>"] section, while a dotted section name still matches; a unit test pins all four shapes. The system-scope guard above it stays deliberately broad (/^remote\./m): an inherited remote.pushDefault in /etc/gitconfig makes the inherited-scope assertions non-hermetic too, and its message now says exactly that ("a [remote] section or pushDefault"). On this host the suite runs 37 passed / 0 skipped.

R18-2 (converge arm misses the unmask gate) — fixed, by the snapshot-scoped half rather than a full survivingUpstreamKeys mirror. The converge arm now runs sweptUpstreamResolving (re-verify: any pointed-branch or pushDefault key still resolving TO the removed name refuses) plus unmaskedPointedUpstream (the snapshot-scoped unmask half: a dangling inherited record the sweep just unshadowed on a snapshot-pointed branch, or an unmasked dangling inherited remote.pushDefault, refuses) after its sweeps and before surfacing git's 404. That closes the probe's shape exactly — witness refuses a converged retry whose sweep unshadows a dangling inherited upstream (global branch.main.remote = ghost shadowed by a local foo copy, section destroyed out of band: the removal now refuses 409 and leaves the inherited record untouched), with the doctrine pinned the other way by keeps the no-such-remote doctrine for an inherited upstream key the sweep never touched (an inherited survivor the snapshot never pointed at still answers git's 404, the answer the client's stale-row convergence keys on). A full survivingUpstreamKeys mirror would add nothing on this arm and would break that doctrine: keys whose value EQUALS the removed name are already owned here by sweptUpstreamResolving (pointed branches and pushDefault), an unshadowed key naming the removed name is necessarily snapshot-pointed (its effective value WAS the name), and a shadowed unpointed one is inert under the shadowed-survivor doctrine because its shadow survives the sweep. The certify path keeps the full gate (all-scope surviving-keys half included), which is what owns the mutated case the 404 doctrine must not swallow.

R18-3 (include-held residue blocks the collateral-damage restore) — fixed. A present value equal to the removed name is discounted from the restore's presence reads (branch remote, pushRemote, pushDefault) by a single shared gate: the remote.<name> section is gone from every scope AND the name no longer resolves at all — the resolver probe (legacy $GIT_DIR/remotes/<name> file, insteadOf alias) plus the local-path probe (a same-named directory repo or bundle file, which git's transport answers with no config record while --get-url never consults the filesystem); a sectionless name short-circuits before the path probe, which would otherwise put a scp-like spelling on the network, and a probe that cannot answer yields no-discount inside the gate (the safe direction) rather than aborting the rollback ahead of the merge arm — the certification gates downstream still fail closed on the same read. The destroyed local survivor copy is then written back (the recreated section lands at EOF, past the include directive); on the exit-0 split-section path the restore runs a second, idempotent time after the worktree-half completion, or the gate would see a half the completion removes. Witnesses: restores a local upstream copy an include-held record naming the removed remote shadowed (the write-back), the two ref-lock witnesses and the legacy no-re-point pair (no re-point while the section stands or a legacy file keeps the name resolving), the directory-repo and bundle no-re-point pairs (no re-point over a live local-path upstream), writes back a destroyed pushDefault over an include-held residue once the name stops resolving and the pushRemote write-back (the push arms), restores the destroyed merge key when the discount gate probe cannot answer (the probe-failure carve-out), the split-section completion write-back, and the kill-suite pin that a scp-like removed name never spawns the path probe. Mutation matrix on the gate: pd-never-discount reddens only the pd write-back witness; pd-always-discount only the pd legacy witness; branch-always-discount the legacy + ref-lock no-re-point witnesses; branch-never-discount only the write-back witness; dropping the local-path leg only the directory-repo + bundle pair; dropping the probe-failure carve-out only the merge-restore witness; dropping the sectionless skip only the kill-suite pin. The merge-pairing condition reads the UNDISCOUNTED presence (remoteNowRaw.length > 0): the merge question is "does a remote record stand?", not "is the residue discountable".

R18-4 (colon-bearing local path fails the unmask gate open) — fixed. isSectionlessUpstream now applies git's own transport rule: scp-like only when the colon precedes the first slash, so /srv/mirrors/app:1 and ../old:sibling fall through to the resolver + path probes and a dangling one refuses; ., URLs, true scp-like spellings and the win32 UNC carve keep skipping the probes. Witness refuses an unmasked dangling colon-after-slash upstream value beside the Windows-spelled one; the local-path and scp-like pushDefault certifications stay green.

R18-5 (invisible char splits the skeleton collision group) — fixed. The collision-group key, the member flags and the render lookup all fold the SANITIZED display name (remoteNameSkeleton(sanitizeRemoteDisplay(r.name)).toLowerCase()), so main and rn\u200bain land in one group and both rows mark; the polarity arm keeps folding the RAW name (it compares skeleton to raw name). Witness: the three-row sanitized collision case (clean twin stays marked via the invisible-char member flags; aria-label Remove origin (lookalike name)). Mutant: keying the group on the raw fold reddens it while the plain main/rnain case stays green. The class-level suggestion (one exported remoteInkKey helper shared by group key, render lookup and search) is deferred to a follow-up: the three consumers deliberately differ in post-normalization (the search arm adds NFKC + whitespace fold + case forms so a ligature row is findable by the text it inks as), and unifying them would change search behavior beyond this PR's scope.

R18-6 (settle yanks focus the user re-lent mid-flight) — fixed. The mutation records the element that held focus at mutation start in a separate ref; the settle effect skips the restore when the in-content focus at settle time is a different element (neither the recorded start element nor the content root itself, which mirrors Radix's FocusScope container focus). The start-time cases keep working: remote-add-url → remote-add-name still restores when the URL input still holds focus at settle, and the back-button restore still fires when the row unmounted (active element body). Witnesses: re-lent-focus skip on both the remove and add paths (search focused mid-flight stays focused), plus the inert-chrome restore case (dialog container focus does not cancel the settle restore).

R18-7 (fold not invariant under canonical equivalence) — fixed at the entrance. The fold canonicalizes its input to NFC before the table walk — NFC is a canonical function, so canonically equivalent spellings enter the same representative and cannot split (Ȧ+handakuten and its NFD spelling now fold identically); a longest-decomposed-prefix table lookup covers code points the entrance NFC fused out of a table base plus a mark, and the generator mirrors both rules so the emitted table stays closed under the runtime fold. The remaining known limitation (a confusable spelling augmented by marks of EQUAL combining class can still split, since canonical ordering cannot reorder them) is documented in the module header and deferred as a follow-up; it needs a mark-order-aware fold, not a normalization change.

Local-audit addendum (rounds 11-14). Further defects found by the local audit pair and fixed in this batch: isSectionlessUpstream's drive-letter carve is now a faithful mirror of git's url_is_local_not_ssh — has_dos_drive_prefix (any non-NUL ASCII character, or one whole non-ASCII code point, plus a colon), the is_valid_win32_path conjunct (NTFS-forbidden characters, reserved device-name segments, segments ending in space or period, and the whole-path trailing-dot magic), and forward-slash UNC — because a drive-letter url whose tail NTFS rejects is routed by git to ssh (host = the drive letter), and probing it would spawn ssh from a config string; on win32 an NTFS-valid drive-letter path is a local transport and reaches the probes, while on POSIX every drive-letter shape is scp-like ssh and the colon rule answers it. The predicate is exported and unit-tested under a stubbed platform (original descriptor restored), since the win32 legs are not executable off-win32; four mutants (trailing-dot magic, segment rules, drive-prefix class, forward-slash UNC) each redden only their unit test. Both design docs enumerate the win32 classification correctly, and the accepted-residuals list is numbered one to four in both languages. Three round-12/13 undirected findings were verified false against the current tree (the sentences they called missing are present in both languages; the line references they cited do not exist) and rejected; their real nits were applied (residual paragraph placement and numbering, comment reflows, inventory completeness).

Deferred follow-ups recorded (not dropped): the remoteInkKey helper unification (R18-5 class), the equal-combining-class skeleton limitation (R18-7), a wire-visible distinct error code for the pre-flight refusals so the client can name them without message matching, and the residuals the local audit recorded rather than fixed under this PR's late-round Critical-only discipline — numbered one to four in both design docs: (1) merge-key re-sweep by the post-certification cleanup on refusals landing after it; (2) the discount gate's section read covering only the invoking worktree's scope chain (sibling config.worktree blind spot); (3) the swallowed granted discount when git's rm leaves the local [branch <b>] section standing with an [include] directive after it; (4) the race-only pre-existing TOCTOU between the union gate and the tail surviving-keys gate — plus the ambient guard's [remote "a=b"] miss, recorded in the cli test comment; the per-pass gate memo (latency-only guard: it can change spawn count but never an outcome, and discriminating it would need a ≥2-pointed-branch spawn-counting harness for zero behavioral gain — recorded in the code comment); and core.protectNTFS = false on win32 (an explicit opt-out under which git reads reserved-name drive tails as local while the predicate calls them sectionless — fail-safe direction, same family as the UNC over-approximation); and the 1024 of 6564 emitted confusables keys that are not NFC fixed points and therefore unreachable under the entrance NFC (dead weight in the client table, behavior-preserving to drop — recorded in the generator). Round 17's last Suggestion is closed by a new kill-suite witness: the discount gate's scope leg sits outside its try so a killed scope read aborts the removal before any destructive cleanup, while a killed probe leg answers no-discount inside the gate; the mutant that moves the scope leg into the try reddens only that witness. The regenerated confusables table's six formerly-unified ink classes (e.g. ņ/n̦) are likewise recorded in the skeleton test comment and both design docs as the accepted side of the canonical-equivalence trade (21 of the 4853 key+mark combinations whose NFC and NFD spellings differ split under the old fold, zero under the new).

Round 3 · Live-daemon + real-browser verification of the R17/R18 batch

Maintainer pass at head b38a9843b. Rounds 1 (d1e994f, Linux / git 2.47) and 2 (08f5009a, macOS / git 2.55) covered the feature end to end, so this round is a delta pass: everything below targets the two fix commits landed since — R17 ad3de520f and R18 b38a9843b — plus the one observation round 2 left open.

Chain under test: Chromium → PR web-shell → PR SDK → real HTTP → qwen serve (built from PR source) → real git 2.47.3 → real repositories. No mock daemon, no page.route, no fixtures; the UI is the daemon's own packages/web-shell/dist (production path), and every assertion is read back from disk with real git.

Verdict: merge-ready once main is merged in. The single red check is a base-freshness gate, not code (§1). 56 live checks pass, 4 mutants each redden only their own witness, round 2's open observation N4 is closed, and the PR's own R18-7 numbers reproduce exactly from an independently built corpus.

Environment

1. The red check is a base-freshness gate, not this PR's code

Lint & Static fails in 23 s, before any lint runs, at check-lint-gate-freshness.mjs:

The lint gate changed on 'main' after this branch last incorporated it:
  - .github/workflows/ci.yml: ac505acbfc1d feat(omni): integrate multimodal media pipeline into main (#12019) (2026-09-16)

The lane checks out the branch head alone, so its green only proves the branch passes the gate as the branch defines it. Action: merge current main; no code change. Every other lane at this head is green (Test (ubuntu-latest), web-shell E2E Smoke, Serve A/B, Real daemon E2E, Capture web-shell visuals, the Java matrix, OpenTUI no-flicker, TUI parity), with review-pr still running.

2. R18-3 — the headline: no config-chosen string leaves the box

The discount gate's local-path leg probes ls-remote -- <name>. A scp-like name is a network transport, so the gate must answer it on the string test alone. I measured that with a GIT_SSH_COMMAND recorder rather than a spawn-count assertion — a remote configured as [email protected]:secret.git, an include-held residue naming it, and a real removal driven through the shipped code and through a mutant with the short-circuit deleted:

The mutant does not merely spend a spawn — it connects out (git-upload-pack 'secret.git' to a host taken from .git/config) and then certifies the removal 200 on the answer that probe produced. The shipped code records an empty recorder and refuses. This is the sharpest thing I found in the batch, and it lands on the right side.

3. R18-4 — isSectionlessUpstream mirrors git's own transport routing — 20/20

Ground truth is real git, not the spec: for each value I ran git ls-remote -- <value> under the same recorder and classified the transport it actually chose (ssh spawn / another network attempt / the local filesystem).

The colon-before-first-slash rule is exactly git's, including the two shapes R18-4 named. The win32 legs (not executable off-win32) were exercised under a stubbed process.platform, descriptor restored: an NTFS-valid drive path is local and reaches the probes, while a reserved device name (C:\con\x), an NTFS-forbidden character, a segment ending in a space, and UNC in all three separator spellings (\\, //, \/) stay sectionless — 9/9.

4. R18-2 / R18-3 against real git, with a diagonal mutation matrix

Each claim is paired with what plain git does to the same repository.

Mutants, each rebuilt and re-driven over the same fixtures:

Diagonal: every gate is load-bearing and no witness is redundant.

One thing worth stating because it shaped my own harness: gitEnv strips GIT_CONFIG_GLOBAL/GIT_CONFIG_SYSTEM/GIT_CONFIG_NOSYSTEM and the rest of the repository-shifting family, so an inherited scope can only be planted through HOME. That hardening is doing its job.

5. R18-1 — the ambient guard, A/B'd on a host that reproduces the miss

Same fixture HOME, same 37 cases: the pre-R18 spelling /^remote\.[^.]+\./m throws and skips all 37, this head runs 37 passed / 0 skipped. Both polarities hold on the same runner — a genuinely dotted section name ([remote "a.b"]) still fires the guard, and a pushDefault whose value carries a dot does not.

6. R18-7 — fold invariance under canonical equivalence, independently reproduced

Corpus built from the committed table itself: every key × every combining mark U+0300–U+036F, offered as NFC and as NFD. 4853 combinations whose two spellings differ, 21 splits under the pre-R18 fold, 0 at this head, and exactly 6 table keys whose own skeleton changed (ņ ѝ أ ئ ṃ ῶ) — the numbers the PR records, derived without reference to its tests.

7. R18-5 in the live UI — and round 2's N4 is closed

The live panel, reading a real .git/config	Searching the DISPLAYED name

• N4 (round 2) is closed. 0rigin beside origin: round 2 measured neither row marked, because the group key folded case-sensitively. At this head both read (lookalike name).
• R18-5 holds. main beside rn+U+200B+ain: the invisible character no longer splits the group — the clean twin still marks (lookalike name) while the carrier reads (hidden characters). Searching the displayed rnain returns both rows; git remote | grep rnain finds nothing.
• A purely canonical NFC/NFD pair (café vs cafe+U+0301) keeps the single-row polarity the module documents — confirmed as designed, not a gap.
• Every row's tooltip and aria-label spell the raw configured name as code-point escapes (rn\u{200b}ain, \u{30}rigin, cafe\u{301}), and the raw code point never reaches the inked text.

8. R18-6 — the settle no longer yanks focus the user re-lent mid-flight

Driven against the real daemon behind a transparent proxy that only delays the remove response (+1800 ms), so the in-flight window is wide enough for a human-like re-lend; focus at settle is outlined in the capture.

Mutant M4 (the settle restores unconditionally, i.e. the pre-R18 behaviour) yanks focus to the back button on the same run; the shipped build leaves it in the search box. The removal itself lands in both arms.

9. The flow against the live daemon — 7/7, plus 17/17 wire probes

Add — verified with git config --get	Two-click confirm armed (zero requests so far)	A remote deleted behind the panel

Panel rows matched git remote exactly before and after every mutation; the first remove click issued zero HTTP requests and left the repository untouched; a duplicate add surfaced git's own remote fork already exists. with remote.fork.url still single-valued; the race (a terminal git remote remove stale behind the open panel) surfaced git's real No such remote and the panel re-read the list.

On the wire at this head: classifier collisions hold for remotes named dirty-cache, already exists, not a git repository and Could not remove config section (all 404 no_such_remote, never a legacy keyword branch); ?cwd= escaping → 400 invalid_cwd on both mutations; token-less mutation → 401; unregistered workspace → 400; ext::sh -c id, -oProxyCommand=id, fd::17/foo → 400 invalid_remote_url while ssh://git@[::1]:22/x.git, the scp-like spelling and a relative path with a space are accepted; the newline-injection shape (a fetch value forging error: Could not remove config section … on its second line) answers 409 remote_config_unparsable with the section surviving. 0 of 12 error bodies carried an absolute path.

10. Gates re-run locally at this head

The one git-branches failure is types the refusal with a lock hint when the index is wedged — byte-identical at the merge base, not in this PR's diff, and git-version-dependent: with a wedged index.lock, git 2.47.3 on this box prints error: could not write index, which carries no lock substring. It passed on git 2.55 in round 2.

11. What is gating the merge

• 185 review threads, 0 unresolved (GraphQL, fully paginated).
• Required lanes green at head; the only red is §1's freshness gate, cleared by merging main.
• So the remaining gate is a merge of main plus human approval, not code.

12. Carried non-blocking observations

• N1 (carried from round 1 N3 / round 2 N1, unchanged). Test-plan item 9 still reads "?cwd= escaping the workspace → 400". Re-measured here: true for both mutations; the GET route is deliberately lenient and answered 200 with the workspace root's remotes. Wording only — add "mutations".
• N2 (carried from round 2 N3, still reproducible). resets the remotes view and restores no focus after a workspace switch is byte-unchanged at this head and still samples activeBefore without flushing past the popover's 50 ms open-autofocus timer. Inserting one 80 ms act between the sample and the settle reproduces the Windows lane's message here verbatim: AssertionError: expected <input …(3)></input> to be <body><div>…(2)</div></body>. One line of test-side flush before the sample would stop the lane carrying a red that looks PR-owned. Not a product defect.

中文说明

第 3 轮 · 针对 R17/R18 批次的 live daemon 与真实浏览器验证

维护者在 head b38a9843b 上的验证。第 1 轮（d1e994f，Linux / git 2.47）与第 2 轮（08f5009a，macOS / git 2.55）已端到端覆盖了整个特性，因此本轮是增量验证：以下全部针对此后合入的两个修复提交——R17 ad3de520f 与 R18 b38a9843b——以及第 2 轮遗留的那一条观察。

受测链路：**Chromium → PR 的 web-shell → PR 的 SDK → 真实 HTTP → qwen serve（由 PR 源码构建）→ 真实 git 2.47.3 → 真实仓库。**无 mock daemon、无 page.route、无夹具；UI 使用 daemon 自带的 packages/web-shell/dist（生产路径），每条断言都用真实 git 回读磁盘。

**结论：合入当前 main 后即可合并。**唯一的红色检查是 base 新鲜度门禁，与代码无关（§1）。56 项实测检查通过，4 个变异体各自只让对应见证变红，第 2 轮遗留的 N4 已关闭，且 PR 自己记录的 R18-7 数字在我独立构建的语料上逐一复现。

环境

Head / merge-base	b38a9843b9 / d313505fdb
平台	Linux 6.12.63、Node 22.22.2、git 2.47.3
Daemon	node dist/cli.js serve --port 4193 --token … --require-auth --workspace ×3，由 PR 树 node esbuild.config.js 产出
UI	daemon 自带的 packages/web-shell/dist，Chromium 1280×900 @2x，token 经 ?token= 传入
变异臂	对构建产物 git-remotes.js 与 BranchPickerPopover.tsx 每次只改一个守卫、重新构建、重新驱动；结束后恢复并复核工作树干净

---

1. 红色检查是 base 新鲜度门禁，不是本 PR 的代码

Lint & Static 在 23 秒内失败，发生在任何 lint 执行之前的 check-lint-gate-freshness.mjs：

The lint gate changed on 'main' after this branch last incorporated it:
  - .github/workflows/ci.yml: ac505acbfc1d feat(omni): integrate multimodal media pipeline into main (#12019) (2026-09-16)

该通道只检出分支 head，因此它的绿色只能证明分支通过了分支自己定义的那份门禁。**处置：合入当前 main，无需改代码。**此 head 上其余通道全绿（Test (ubuntu-latest)、web-shell E2E Smoke、Serve A/B、Real daemon E2E、Capture web-shell visuals、Java 矩阵、OpenTUI no-flicker、TUI parity），review-pr 仍在运行。

2. R18-3 —— 最关键的一条：不让配置里的字符串出网

discount gate 的本地路径探针会执行 ls-remote -- <name>。而 scp 形式的名字是网络传输，所以这个门必须只靠字符串判断就作答。我没有用 spawn 计数断言，而是用 GIT_SSH_COMMAND 记录器实测：仓库里配置一个名为 [email protected]:secret.git 的 remote、一条 include 持有的同名残留，然后分别用出厂代码和删掉短路的变异体驱动真实删除：

变异体不只是多花了一次 spawn——它真的向外连接了（对着取自 .git/config 的主机执行 git-upload-pack 'secret.git'），随后还依据这次探测的结果把删除判为成功 200。出厂代码的记录器为空，并给出拒绝。这是本批次里我发现的最尖锐的一点，而它落在正确的一侧。

3. R18-4 —— isSectionlessUpstream 与 git 自身的传输路由一致 —— 20/20

地面真值取自真实 git 而非文档：每个取值都在同一记录器下执行 git ls-remote -- <value>，据此判定 git 实际选择的传输（spawn ssh / 其他网络尝试 / 本地文件系统）。

取值	git 的选择	谓词
/srv/mirrors/app:1	本地（文件系统）	进入探针	✅
../old:sibling	本地（文件系统）	进入探针	✅
mirror、/a/b	本地（文件系统）	进入探针	✅
[email protected]:path.git	网络（ssh）	sectionless，不探测	✅
host.invalid:1234/x.git	网络（ssh）	sectionless，不探测	✅
ssh://…、https://…	网络	sectionless，不探测	✅
POSIX 上的 C:\repo	网络（ssh，主机名 C）	sectionless，不探测	✅

「冒号在第一个斜杠之前」的规则与 git 完全一致，包括 R18-4 点名的两种形态。win32 分支（在非 win32 上不可执行）通过桩化 process.platform 验证并恢复描述符：NTFS 合法的盘符路径是本地传输、会进入探针，而保留设备名（C:\con\x）、NTFS 禁用字符、以空格结尾的段，以及三种分隔符拼法的 UNC（\\、//、\/）都保持 sectionless —— 9/9。

4. R18-2 / R18-3 对真实 git，并配对角线变异矩阵

每条主张都配了一个「plain git 对同一仓库会怎样」的对照。

#	主张	plain git（对照）	本 head
B2	include 持有的同名记录不得阻塞回滚	本地副本被摧毁、merge 键被摧毁，分支被留在悬空的 gone 残留上	本地副本 survivor 与 merge 键被写回；有效 upstream 为 survivor
B3a	收敛重试的清扫解除了对一条悬空继承 upstream 的遮蔽	error: No such remote，分支留在悬空态	409 remote still configured after removal，继承记录未被触碰
B3b	快照从未指向过的继承 upstream 键	error: No such remote	保留 git 的 404 —— 客户端过期行收敛所依赖的答案

变异体，均重新构建并在同一夹具上重新驱动：

变异体	B1（出网）	B2（回滚）	B3a（收敛）	B3b（404）
出厂	✅	✅	✅	✅
M1 —— 删除 sectionless 短路	❌	✅	✅	✅
M2 —— 门永不放行 discount	✅	❌	✅	✅
M3 —— 收敛臂失去 unmask 门	✅	✅	❌	✅

对角线成立：每个守卫都确实起作用，没有冗余见证。

有一点值得说明，因为它直接影响了我自己的 harness：gitEnv 会剥掉 GIT_CONFIG_GLOBAL/GIT_CONFIG_SYSTEM/GIT_CONFIG_NOSYSTEM 及其余可改变仓库指向的变量，所以继承作用域只能通过 HOME 植入。这条加固确实在起作用。

5. R18-1 —— 在能复现该缺陷的宿主上做守卫 A/B

同一份夹具 HOME、同样 37 个用例：pre-R18 的写法 /^remote\.[^.]+\./m 抛错并跳过全部 37 个，而本 head 是 37 passed / 0 skipped。两个方向的极性在同一 runner 上都成立——真正带点的 section 名（[remote "a.b"]）仍会触发守卫，而值里带点的 pushDefault 不会。

6. R18-7 —— 规范等价下的折叠不变性，独立复现

语料直接由提交的表构造：每个 key × 每个组合记号 U+0300–U+036F，分别以 NFC 与 NFD 形式喂给折叠。两种拼写不同的组合共 4853 个，pre-R18 折叠下分裂 21 个，本 head 0 个；自身 skeleton 发生变化的表 key 恰为 6 个（ņ ѝ أ ئ ṃ ῶ）——正是 PR 记录的那组数字，且推导过程未参考其测试。

7. R18-5 在真实 UI 中成立 —— 第 2 轮的 N4 已关闭

实时面板，读自真实 .git/config	按显示的名字搜索

• N4（第 2 轮）已关闭。0rigin 与 origin 并存：第 2 轮实测两行都没有标记，原因是分组键大小写敏感；本 head 上两行都显示 (lookalike name)。
• R18-5 成立。main 与 rn+U+200B+ain：不可见字符不再把分组拆开——干净的那一行仍标记 (lookalike name)，携带者显示 (hidden characters)。按显示的 rnain 搜索会同时命中两行，而 git remote | grep rnain 什么也搜不到。
• 纯规范变体的一对（café 与 cafe+U+0301）保持模块中写明的单行极性——确认为设计如此，不是缺口。
• 每行的 tooltip 与 aria 标签都以码点转义写出原始配置名（rn\u{200b}ain、\u{30}rigin、cafe\u{301}），原始码点从不进入可见文本。

8. R18-6 —— settle 不再夺走用户中途交出的焦点

在真实 daemon 前加了一个只延迟删除响应（+1800 ms）的透明代理，使得「操作进行中」的窗口足以完成一次拟人的焦点转移；截图中 settle 时刻的焦点用轮廓标出。

变异体 M4（settle 无条件恢复，即 pre-R18 行为）在同一次运行中把焦点夺到返回按钮上；出厂构建则把焦点留在搜索框。两臂的删除本身都正常落地。

9. 对 live daemon 的完整流程 —— 7/7，外加 17/17 线上探针

添加 —— 用 git config --get 核对	两段式确认已待确认（此时零请求）	面板背后被删掉的 remote

每次变更前后，面板行与 git remote 完全一致；第一次点击删除发出零个 HTTP 请求且仓库未被改动；重复添加原样呈现 git 自己的 remote fork already exists.，remote.fork.url 仍是单值；竞态（面板开着时在终端执行 git remote remove stale）呈现 git 真实的 No such remote，面板随即重新拉取列表。

此 head 上的线级结果：分类器碰撞成立——名为 dirty-cache、already exists、not a git repository、Could not remove config section 的 remote 删除均返回 404 no_such_remote，从不落入遗留关键字分支；?cwd= 逃逸 → 两个变更接口均 400 invalid_cwd；无 token 的变更 → 401；未注册 workspace → 400；ext::sh -c id、-oProxyCommand=id、fd::17/foo → 400 invalid_remote_url，而 ssh://git@[::1]:22/x.git、scp 形式和含空格的相对路径被接受；换行注入形态（fetch 值在第二行伪造 error: Could not remove config section …）返回 409 remote_config_unparsable 且 section 存活。本轮采集的 12 个错误响应体中，0 个含绝对路径。

10. 在此 head 上本地重跑的门禁

套件	结果
core git-remotes + git-remotes-kill	275/275（244 + 31）
core git-branches	106/107 —— 见下注
cli workspace-git-remotes + workspace-git-branches	108/108（37 + 71）
cli workspace-git-remotes（宿主带继承的 remote.pushDefault）	37/37，0 skipped（§5）
sdk-typescript DaemonClient	447/447
web-shell BranchPickerPopover + remote-name-skeleton	151/151（139 + 12）
web-shell e2e web-shell.git-remotes.spec.ts（Playwright）	5/5

唯一失败的 git-branches 用例是 types the refusal with a lock hint when the index is wedged——它在 merge base 上逐字节相同，不在本 PR 的 diff 中，且依赖 git 版本：在 index.lock 卡死时，本机 git 2.47.3 输出 error: could not write index，其中不含 lock 子串。第 2 轮在 git 2.55 上是通过的。

11. 真正卡住合并的是什么

• 185 条评审线程，0 条未解决（GraphQL，完整分页）。
• head 上的必需通道全绿；唯一的红色是 §1 的新鲜度门禁，合入 main 即可消除。
• 因此剩下的门槛是「合一次 main + 人工批准」，而不是代码。

12. 沿用的非阻塞观察

• **N1（自第 1 轮 N3 / 第 2 轮 N1 沿用，未变）。**测试计划第 9 条仍写着「?cwd= 逃逸 workspace → 400」。本轮复测：对两个变更接口成立；GET 路由是刻意宽松的，返回 200 并给出 workspace 根目录的 remotes。仅措辞问题——补上「变更类接口」。
• N2（自第 2 轮 N3 沿用，仍可复现）。resets the remotes view and restores no focus after a workspace switch 在此 head 上逐字节未变，仍然在采样 activeBefore 之前没有冲掉弹层挂载时那个 50 ms 的自动聚焦定时器。在采样与 settle 之间插入一个 80 ms 的 act，即可在本机逐字复现 Windows 通道的报错：AssertionError: expected <input …(3)></input> to be <body><div>…(2)</div></body>。在采样前加一行测试侧的冲刷，就能让该通道不再背着一个看起来像本 PR 造成的红。不是产品缺陷。

🤖 Generated with Claude Code — Claude Opus 5 (1M context)

@qwen-code /triage

Disposition for the carried Critical (the removed-name certification resolves fetch-side only): fixed at the head that lands with this comment.

• The certification's union gate now reads url.*.pushInsteadOf prefixes from the same all-scope dump its section half already takes, so a name kept push-side-live by an alias racing in after the pre-flight read refuses 409 remote_still_configured rather than certifying — at zero extra spawns (the kill suite's spawn accounting is unchanged).
• The discount gate carries the same leg: an include-held residue equal to a push-live name is not discounted into a silent re-point.
• Reachability, verified against the current bytes: the steady-state shape (a section plus its alias) is refused by the pre-flight before destruction (pinned by the seven pushInsteadOf pre-flight witnesses), the no-section retry shape is skipped by the converge arm's alias conjunct, and the pair of new kill-suite witnesses pins the racing shape on both gates; each mutant reddens only its own witness.
• Both design docs state the push-side leg in both languages.

The skeleton-fold verification and the CI summary in the review are noted. The "not re-derived" items stand verified by the audit rounds behind this head: the win32 predicate was diffed against git master's C source (url_is_local_not_ssh, is_valid_win32_path, win32_has_dos_drive_prefix) and fuzzed over 68k strings with 0 unsafe divergences; the confusables measurements (21-of-4853, 1010-of-6564, six classes, line citations) reproduce exactly; and the R18 inline threads' fixes each carry discriminating witnesses with mutation evidence.

@qwen-code /triage

Thanks for the focused pass. Disposition:

• The carried push-side certification finding is fixed as you verified; the legs now read url.*.pushInsteadOf prefixes from the same all-scope dump the section legs take, at zero extra spawns (kill-suite spawn accounting unchanged), with a discriminating witness per gate (union refusal, no-discount in the rollback gate) — each mutant reddens only its own witness.
• The two focused audits you name are being run against this exact revision now: (a) the shared Git error classifier's resistance to config-controlled diagnostic text (git echoes config-chosen refspec values / section names / alias URLs / remote names verbatim in its fatal lines, so every message shape the classifier matches is being enumerated and each asked whether a config value can steer it to a wrong branch), and its effect on the existing non-remotes routes; and (b) the workspace-scoped routes' runtime/trust/containment behavior across every downstream consumer (daemon registration, SDK client, web-shell caller), including a ?cwd= sibling-prefix containment probe. Their results land here; if either surfaces a defect it gets fixed per the same witness discipline, not argued about.
• The historical blocking-finding reconciliation against this exact revision is in flight alongside them.

CI on this head: the two "fail" rows are lanes from a superseded run cancelled by the concurrency group, not real failures; the successor run's lanes are green so far (Desktop Shell both platforms pass), and the bot review job is in progress.

The two focused audits landed; both were run against the exact revision reviewed.

Workspace-scoped routes (runtime/trust/containment across all downstream consumers): CLEAN. Containment probed, not just read: realpaths both sides and gates on a path.relative-based check, so a sibling sharing the workspace prefix (repo vs repo-evil), a .. escape, a duplicated ?cwd=, an empty one, and a symlink inside the workspace pointing out all answer 400 invalid_cwd on add/remove and fall back to the workspace root on GET (200 with only the root's remotes listed). Gate order is fail-closed per stage (strict POST gating before the handler, trust → generation → cwd → pre-spawn name/url validation, NUL rejected pre-spawn on both add and remove). Runtime env threads through gitEnv, which scrubs GIT_DIR/GIT_WORK_TREE/GIT_CONFIG_*/GIT_CONFIG_KEY_* and strips ext/fd from GIT_ALLOW_PROTOCOL — a probe runtime env carrying GIT_DIR=<sibling>/.git plus a GIT_CONFIG_KEY_0=remote.origin.url rewrite still listed only the contained repo. Path redaction covers the named host classes (workspace cwd, git root, linked-worktree/submodule gitdirs, $HOME/.gitconfig in both spellings, XDG with the empty-value fallback, /etc/gitconfig token prefixes, include targets via the in file tail, plus the fail-closed absolute-path sweep and the 512-char cap), with tests asserting the body never contains the path. Consumers are exactly three: SDK DaemonClient (449/449 green incl. per-call timeout abort races), web-shell BranchPickerPopover (mutationMeanStaleList covers the new codes with silent re-read and requestId fencing), and the e2e mockDaemon mirroring the 404/409 shapes. Suites: routes 37/37, SDK 449/449, popover 139/139.

Classifier (resistance to config-controlled diagnostic text + effect on non-remotes routes): 2 Suggestions, both fixed; no Critical. Anchoring is ^ without /m and config echoes land after git's literal prefix or on deeper lines: a real newline-bearing refspec value still classifies remote_config_unparsable (the injected line-2 prefix is invisible to every anchored arm), and mutant runs confirm the anchoring is load-bearing (deleting the No such remote arm reclassifies a keyword-named remote; adding /m flips the newline rows). Every dump-read catch in core strips the dump, and the remote verbs' failures carry empty stdout in all 16 probed shapes, so a line-1 forgery needs config-controlled stdout on a failing spawn — not constructible. Keyword-bearing names classify correctly (No such remote: 'remote still configured after removal' → 404). The two findings, both now pinned: (1) the invalid-refspec arm's 409 remote_config_unparsable now answers on the pre-existing pull route as well (was 500) — pinned by a new pull-route witness (corrupted fetch refspec → 409), so a future remotes-only narrowing cannot silently change the pull contract; (2) the removal rollback's own --local --add write reports a config lock single-line, which matched neither lock arm and degraded to an unclassified 500 — the single-line lock arm now answers 409 git_config_write_failed, pinned in the classification table. Two pre-existing notes the audit enumerated (loose keyword arms matching config-controlled URL text on pull/push, and config-parse errors echoing config values carrying loose keywords) are byte-identical to main and stay as recorded observations — clients ignore those codes on the affected routes (footer-only), and the bounded-slice discipline bounds the exposure.

The historical blocker reconciliation against this revision is what the reply above summarizes: the R18 inline set is closed with discriminating witnesses and mutation evidence; the carried Critical (push-side certification) is fixed as verified in source.