Add version control command center

[Quicksaver]

PR id: 3177
PR url: #3177
PR title: Add version control command center
PR target: pingdotgg/t3code:main
PR head: Quicksaver:split/version-control-panel-work

Summary

Adds a Git-backed Version Control command center to the web right panel and a native mobile route. It is scoped to the active project/repository cwd, works from draft or existing conversations once repository context is available, and keeps Git operations server-authoritative across browser, desktop, VS Code, and remote clients.

The panel focuses on actionable repository work rather than being a full Git dashboard: dirty working trees, local branch sync state, stashes, remotes, sibling worktrees, likely fork branches, and open change-request bases.

What Changed

• Added SOURCE_CONTROL.md as the branch-specific behavior and validation reference for the Version Control panel.
• Added server-side SourceControlPanelService RPC support for snapshots, branch/stash/commit/compare data, selected-file commit and stash flows, discard operations, branch actions, remote actions, and provider-derived PR/MR base checks.
• Extended GitHub, GitLab, Azure DevOps, and Bitbucket source-control provider plumbing so actionable rows can account for open change-request bases while preserving bounded provider diagnostics.
• Added live VCS refresh support through VcsStatusBroadcaster and VcsLocalWatch, including ref-counted local watchers, .git/ event filtering, gitignore-aware suppression, explicit local refreshes, and sibling worktree watcher retention.
• Added the React Version Control panel UI with Actionable and Remotes sections, working-tree file selection, inline diffs, branch/stash/commit rows, searchable compare bases, guarded destructive actions, context menus, manual fetch controls, and a conservative five-minute Actionable remote fetch.
• Added a native mobile Version Control route from the Git menus with touch-oriented Actionable and Remotes sections, selected-file operations, branch/stash/remote actions, dedicated review-diff navigation, and stale-result protections.
• Centralized right-panel add-surface action metadata so the empty state and add menu share the same Version Control surface gating and action model.
• Added dirty sibling worktree rows and cwd-scoped right-panel File previews so Git operations and file reads target the checkout that owns the displayed changes.
• Hardened branch sync behavior around same-name remote tracking, fork branches, open PR/MR base branches, local-only publishing, diverged branch actions, branch and remote names containing slashes, and branch worktree cwd routing.
• Added concurrency and stale-result protections through per-target operation state, per-thread metadata sequencing, expectedBranch write guards, and environment/thread/cwd-scoped panel state.
• Hardened self-hosted GitLab open-MR discovery by passing a full project URL to glab mr list --repo instead of an ambiguous scheme-less host/path locator, without duplicating a configured base-URL path prefix already present in the remote path.
• Preserved typed Git and provider failures as bounded, sanitized diagnostics so process, authentication, API, and command-output causes remain distinguishable without exposing unbounded error payloads.
• Hardened working-tree handling for renamed files, quoted porcelain paths, mixed staged/unstaged rows, selected-file commit pathspec semantics, discard failures, generated commit failures, and branch deletion resolution.
• Hardened review follow-ups for source-control thread metadata sequencing after a thread is closed/reopened and default compare ref selection for repositories whose checked-out default branch is not named main or master.
• Hardened right-panel fallback behavior so an unavailable active Source Control surface falls back to another visible surface instead of forcing the empty right-panel state.
• Hardened cached Version Control panel restores so cached snapshots show the refresh indicator while revalidating, and restored expanded branch/stash rows hydrate missing detail payloads even when the snapshot fingerprint is unchanged.
• Hardened restored stash expansion and cached stash details so stash@{n} renumbering after stash create/drop operations does not show details for the wrong stash.
• Hardened native Version Control navigation and state so diff routes remain workspace overlays, each cwd fetches automatically only once per mounted route, stash detail identity survives positional-ref renumbering, remote rows bind only to locals tracking the exact remote-qualified ref, mutation completion accepts its authoritative full snapshot before requesting a status-driven incremental refresh, and remote checkout name collisions create a uniquely suffixed tracking branch instead of detaching HEAD.
• Hardened native Version Control publishing and detail loading so repositories with multiple remotes prompt for the destination, interrupted detail requests retry without surfacing cancellation errors, and interrupted diff reads cannot remain stuck on the loading screen.
• Hardened native Version Control date labels so missing or invalid branch and stash timestamps are omitted instead of appearing as recent activity.
• Hardened web refresh coalescing so a queued repository refresh still runs after the active request fails or is interrupted, instead of leaving the panel on stale state.
• Hardened final retry, cancellation, and cwd sequencing so failed native initial snapshots expose an in-place Retry action with pending feedback, stale callbacks from a previous checkout cannot supersede the current cwd's snapshot, and interrupted web branch-commit pagination remains silent instead of surfacing a false panel error.
• Hardened web mutation failure handling so every attempted action reconciles VCS status and an authoritative panel snapshot before preserving its action error, keeping conflict-producing or partially applied results visible.
• Hardened commit-hook diagnostics so warning-like stdout/stderr enriches an actual failed Git result only after the process exits and never interrupts an otherwise successful commit.
• Routed Azure DevOps commit-avatar lookup through the organization encoded by HTTPS and SSH repository remotes and the stable Commits Get 7.1 API version instead of ambient CLI detection and a preview version.
• Hardened server review follow-ups so failed full snapshots release the per-cwd full-refresh barrier, checked-out worktree branches are rejected by server-side deletion, default-branch details retain a stable comparison base, and GitLab list-MR failures use bounded sanitized provider causes.
• Fixed native remote collapse behavior so a collapsed remote hides its branch rows together with its action row.
• Isolated selected-file commit preparation, message generation, and commit execution through a temporary selected-only Git index across root web, sibling-worktree web, and mobile flows; shared staging, unstaging, temporary intent-to-add, selected-file stash, and discard classification/mutation commands use literal-pathspec semantics, and selected paths synchronize into the real index only after success, so failures leave the user's staged state untouched while deselected staged changes remain staged. Post-commit index cleanup is best-effort so a cleanup failure cannot report that an already-created commit failed or suppress the caller's refresh.
• Hardened final review edges across clients and providers: mutation errors survive failed reconciliation, branch-detail and native cwd snapshot races cannot restore stale state, paginated branch commits cannot cross comparison bases, failed initial native snapshots expose their error/retry UI, copied files do not send rename source paths, selected stashes scope literal status/diff inputs, all-mode generated stash messages include staged changes, initial repositories use an empty temporary index, empty/tabbed commit subjects parse correctly, working-tree-left comparisons preserve direction, successful native detail retries clear only their own error, and Azure pull-request discovery uses the remote-derived organization.
• Promoted working-tree watcher refreshes to authoritative full snapshots while a full snapshot is in flight, preventing a newer incremental request from retaining pre-mutation branch, remote, fork, or stash data.
• Hardened native working-tree diffs so only staged-only rows request the cached side, while mixed, unstaged, and conflict-only rows request the working-tree side; failed branch, fork-comparison, and stash details now replace indefinite loading placeholders with scoped errors.
• Limited idle Git and filesystem churn with subscription-scoped watcher lifetimes, ignored-path suppression, focus/visibility refreshes, and a five-minute remote fetch interval.
• Extended shared RPC, IPC, Git, settings, client-runtime, and VCS contracts for the source-control snapshot and operation protocol.
• Added desktop and web context-menu separator support so destructive source-control actions remain grouped consistently after both automatic and explicit separators.
• Hardened rebase ref handling with an option separator so ref names cannot be interpreted as command flags.
• Added focused tests for source-control service behavior, provider base detection, VCS broadcaster/watch behavior, source-control panel state, shared Git contracts, and client-runtime VCS action helpers.

Why

T3 Code needs a compact place to answer "what repository work needs attention now?" without forcing users into a full external Git UI. This change keeps the surface decision-oriented: commit or stash selected changes, inspect branch sync state, publish or sync branches, review stashes, and notice when a PR/MR base has moved.

The server-owned design keeps behavior consistent across clients and avoids browser-side Git execution, while the periodic fetch and local watchers keep the panel current without introducing a high-frequency polling loop.

Validation

• The latest native cwd-race follow-up ran all 19 focused Version Control model tests; all passed. Targeted formatting/lint, mobile native static checks, and diff checks passed with only the branch's existing split-module unused-import warnings and unavailable optional Swift/Kotlin linters. The installed iOS dev client again reached this worktree's Metro server, where integrated verification remained blocked before application code loaded by the existing expo/virtual/env shared-store resolution failure.
• The latest review follow-up ran 40 focused native Version Control model and web panel logic tests; all passed. Targeted formatting/lint and diff checks passed with only the branch's existing split-module unused-import warnings, and mobile native static checks completed with optional Swift/Kotlin linters unavailable. A fixed-port Playwright pass on server 13782 and web 5742 authenticated and rendered the Version Control panel with live Actionable and Remotes data from the throwaway repository. The installed iOS dev client reached this worktree's Metro server, but integrated native verification remained blocked before application code loaded because Metro could not resolve the existing expo/virtual/env virtual module through the shared pnpm-store layout; serve-sim also timed out, so simulator evidence was captured through XcodeBuildMCP.
• The final review sweep ran 85 focused web, native, server, parser, and Azure DevOps tests; all passed. Targeted formatting, lint, diff checks, and server typecheck passed, with warnings limited to the existing split-module unused imports and unrelated Effect suggestions. Two isolated fixed-port Playwright passes on server 13782 and web 5742 rendered the Version Control panel with live throwaway repository data, including the final late-review follow-up. A rebuilt iOS dev client reached the worktree Metro server on both attempts, but the integrated native pass was blocked before application code loaded because Metro could not resolve the existing expo/virtual/env virtual module through the shared pnpm-store layout. Web typecheck remains blocked by unrelated branch-selector, model-picker, preview, and atom-registry errors; mobile typecheck remains blocked by the linked markdown package's missing React/JSX resolution, with no errors reported from the changed Version Control files.
• The latest review follow-up ran all 58 focused SourceControlPanelService tests; all passed. Targeted formatting/lint, server typecheck, and diff checks passed, with only six pre-existing Effect suggestions in unrelated orchestration code. A fixed-port Playwright pass committed only commit-warning-success.txt from the throwaway repository through a successful pre-commit hook that printed Cannot find native binding; the panel advanced from 11 to 12 commits ahead and refreshed from six to five working-tree files without surfacing a false failure.
• The latest review follow-up ran all 14 focused native Version Control model tests; all passed. Targeted formatting, lint, mobile native static checks, and diff checks passed. Mobile package typecheck remains blocked by the linked @t3tools/mobile-markdown-text package's missing React/JSX resolution and broad pre-existing downstream JSX errors. A compatible T3 Code Dev client was installed, but integrated iOS Simulator verification was blocked before application code loaded because Metro could not resolve its existing expo/virtual/env module through the worktree's shared pnpm symlink layout, including after a frozen install and client-env-disabled retry.
• The latest review follow-up ran all 18 focused web panel logic tests and all 19 focused Azure DevOps CLI/provider tests; all passed. Targeted formatting/lint, server typecheck, and diff checks passed. The web package typecheck remains blocked by unrelated implicit-any and atom-registry errors in branch-selector, model-picker, preview, and state files. A fixed-port Playwright pass used a failing pre-commit hook that created a second file: after the selected-file commit failed, the Version Control panel refreshed from one to two files, displayed generated-by-hook.txt, and preserved the commit failure message.
• The latest review follow-up ran all 68 focused SourceControlPanelService and GitLab provider tests; all passed. Server package typecheck, targeted lint, formatting, and diff checks passed. An isolated fixed-port web/server environment started successfully, but integrated browser assertions were unavailable because Playwright's profile was locked by another active session and the fallback controlled browser rejected its session credential before timing out.
• Focused server coverage passed for SourceControlPanelService, VCS broadcasting and Git driver behavior, provider base detection and error handling, self-hosted GitLab CLI behavior, and desktop context-menu integration.
• The latest review follow-up ran all 53 focused SourceControlPanelService tests and all 12 native Version Control model tests; both passed. The server package typecheck, targeted formatting/lint, mobile native static checks, and diff checks also passed. Mobile package typecheck remains unavailable because its linked @t3tools/mobile-markdown-text package cannot resolve React/JSX types and triggers broad pre-existing failures outside the changed files.
• The final review follow-up ran 80 focused SourceControlPanelService and GitVcsDriverCore tests plus 14 focused native Version Control model/request tests; all passed. Server typecheck, targeted lint, formatting, and diff checks also passed. The mobile package typecheck remains unavailable in this checkout because its linked @t3tools/mobile-markdown-text package cannot resolve React or @t3tools/shared/skillInlineTokens, producing unrelated pre-existing JSX/type failures across the mobile package.
• The latest review follow-up ran all 15 focused web panel logic tests and all 13 native Version Control model tests; both passed. Targeted lint, formatting, mobile native static checks, and diff checks passed. An isolated Playwright pass on the fixed branch ports rendered the Version Control panel, Actionable and Remotes sections, and the configured throwaway remote without page or Vite/HMR errors. The web package typecheck is currently blocked by unrelated errors in branch-selector, model-picker, preview, and atom registry files introduced by the latest upstream merges; the mobile package typecheck remains blocked by the linked markdown package's missing React/JSX types and broad pre-existing native JSX failures.
• Focused web coverage passed for Version Control panel logic and state, thread source-control metadata handling, and right-panel surface behavior.
• Focused shared coverage passed for Git contracts/utilities and client-runtime VCS actions.
• Focused native coverage passed for Version Control request and model behavior.
• pnpm exec vp check passed with 0 errors and 9 existing warnings in unrelated web files.
• pnpm exec vp run typecheck passed.
• pnpm exec vp run lint:mobile passed its available static checks; optional SwiftLint, ktlint, and detekt checks were skipped because those tools are not installed.
• Playwright against an isolated server on 13782, web client on 5742, and disposable throwaway repository verified that an intentional selected-file commit failure surfaces through vcs.panel.commitStaged without staging either file; after removing the failing hook, the selected-only commit succeeded, included only selected.txt, left deselected.txt unstaged, and left the real index empty.
• A final Playwright pass on the same fixed ports verified literal selected-file behavior with [literal].txt beside literal1.txt: discarding the bracketed path left the neighbor modified, and stashing the bracketed path produced a stash containing only [literal].txt while the neighbor remained modified.
• The latest fixed-port browser pass authenticated and rendered the Version Control panel against the throwaway repository. Playwright itself was unavailable because its browser profile was locked by another active session; the controlled fallback preview surfaced the fixture's existing selected-stash Git failure and then became unresponsive before a successful mutation round-trip.

Proof

---

Note

High Risk
Large surface area touching server-side Git mutations, multi-client sync, and provider/auth integrations; incorrect refresh or metadata sequencing could show stale repo state or overwrite thread branch info.

Overview
Adds a Git-backed Version Control command center on the web right panel and a native mobile route, driven by new server SourceControlPanel RPCs and documented in SOURCE_CONTROL.md / BRANCH_DETAILS.md.

Web and chat integration mounts a singleton source-control surface per environment/cwd (including multi-environment federated panels), with cached snapshots, incremental vs full refresh, thread metadata routing via expectedBranch, and cwd-scoped file previews for sibling worktrees.

Mobile wires VersionControl and VersionControlDiff stack routes from Git menus, a controller/view that mirrors Actionable/Remotes (selection, commit/stash/discard, branches, stashes, remotes), cwd-scoped snapshot sequencing, working-tree enrichment, and useAtomQueryRunner forceRefresh for panel queries.

Server and providers extend panel services, VCS watchers (.git/ filtering, worktrees), sanitized error causes (ErrorCause.ts), and provider paths—including Azure DevOps PR listing and commit avatars scoped to the remote organization and Commits API 7.1; commit author avatars are opt-in per provider setting.

Desktop context menus now honor explicit separator items and still insert a separator before the first destructive action when the menu does not start with one.

Cross-cutting behavior called out in the new docs: conservative automatic git fetch --all, selected-file commits via a temporary index, literal pathspecs, mutation-then-reconcile error handling, and focused unit/Playwright coverage expectations.

^{Reviewed by Cursor Bugbot for commit 30153d1. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add Version Control command center panel to web and mobile

• Adds a full Version Control panel to the web right panel and mobile navigation, exposing Git operations (stage/unstage/discard, commit, pull/push, branch management, stash, diffs) as a new right-panel surface alongside browser, terminal, and file panels.
• Introduces SourceControlPanelService on the server with comprehensive RPC endpoints for VCS panel operations, wired into the WebSocket layer with scope-based auth.
• Adds getCommitAvatarUrl to GitHub, GitLab, Azure DevOps, and Bitbucket providers, with per-provider settings in ServerSettings to control avatar display.
• Extends the contract layer (git.ts, ipc.ts, rpc.ts) with new schemas for change groups, worktree change sets, remotes, branch details, stash, and commit summaries.
• Adds filesystem-watch-driven local status refresh in VcsStatusBroadcaster, including sibling worktree discovery and ref-counted watcher lifecycle management.
• Adds cwd-scoped file surfaces and a singleton source-control surface to rightPanelStore, with migration preserving existing cwd overrides.
• Risk: the default automatic git fetch interval changes from 30 seconds to 5 minutes.

^{Macroscope summarized 30153d1.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 89697f25-68f0-493b-9037-d78fd28b1923

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

Effect Service Conventions: one finding in DesktopBackendManager.ts. See inline comment.

^{Posted via Macroscope — Effect Service Conventions}