Add version control command center

[Quicksaver]

Summary

Adds a Git-backed Version Control command center to the web right panel and a native mobile route. It is scoped to the active project/repository cwd, works from draft or existing conversations once repository context is available, and keeps Git operations server-authoritative across browser, desktop, VS Code, and remote clients.

The panel focuses on actionable repository work rather than being a full Git dashboard: dirty working trees, local branch sync state, stashes, remotes, sibling worktrees, likely fork branches, and open change-request bases.

What Changed

• Added SOURCE_CONTROL.md as the branch-specific behavior and validation reference for the Version Control panel.
• Added server-side SourceControlPanelService RPC support for snapshots, branch/stash/commit/compare data, selected-file commit and stash flows, discard operations, branch actions, remote actions, and provider-derived PR/MR base checks.
• Extended GitHub, GitLab, Azure DevOps, and Bitbucket source-control provider plumbing so actionable rows can account for open change-request bases while preserving bounded provider diagnostics.
• Added live VCS refresh support through VcsStatusBroadcaster and VcsLocalWatch, including ref-counted local watchers, .git/ event filtering, gitignore-aware suppression, explicit local refreshes, and sibling worktree watcher retention.
• Added the React Version Control panel UI with Actionable and Remotes sections, working-tree file selection, inline diffs, branch/stash/commit rows, searchable compare bases, guarded destructive actions, context menus, manual fetch controls, and a conservative five-minute Actionable remote fetch.
• Added a native mobile Version Control route from the Git menus with touch-oriented Actionable and Remotes sections, selected-file operations, branch/stash/remote actions, dedicated review-diff navigation, and stale-result protections.
• Centralized right-panel add-surface action metadata so the empty state and add menu share the same Version Control surface gating and action model.
• Added dirty sibling worktree rows and cwd-scoped right-panel File previews so Git operations and file reads target the checkout that owns the displayed changes.
• Hardened branch sync behavior around same-name remote tracking, fork branches, open PR/MR base branches, local-only publishing, diverged branch actions, branch and remote names containing slashes, and branch worktree cwd routing.
• Added concurrency and stale-result protections through per-target operation state, per-thread metadata sequencing, expectedBranch write guards, and environment/thread/cwd-scoped panel state.
• Hardened self-hosted GitLab open-MR discovery by passing a full project URL to glab mr list --repo instead of an ambiguous scheme-less host/path locator, without duplicating a configured base-URL path prefix already present in the remote path.
• Preserved typed Git and provider failures as bounded, sanitized diagnostics so process, authentication, API, and command-output causes remain distinguishable without exposing unbounded error payloads.
• Hardened working-tree handling for renamed files, quoted porcelain paths, mixed staged/unstaged rows, selected-file commit pathspec semantics, discard failures, generated commit failures, and branch deletion resolution.
• Hardened review follow-ups for source-control thread metadata sequencing after a thread is closed/reopened and default compare ref selection for repositories whose checked-out default branch is not named main or master.
• Hardened right-panel fallback behavior so an unavailable active Source Control surface falls back to another visible surface instead of forcing the empty right-panel state.
• Hardened cached Version Control panel restores so cached snapshots show the refresh indicator while revalidating, and restored expanded branch/stash rows hydrate missing detail payloads even when the snapshot fingerprint is unchanged.
• Hardened restored stash expansion and cached stash details so stash@{n} renumbering after stash create/drop operations does not show details for the wrong stash.
• Hardened native Version Control navigation and state so diff routes remain workspace overlays, each cwd fetches automatically only once per mounted route, stash detail identity survives positional-ref renumbering, remote rows bind only to locals tracking the exact remote-qualified ref, mutation completion accepts its authoritative full snapshot before requesting a status-driven incremental refresh, and remote checkout name collisions create a uniquely suffixed tracking branch instead of detaching HEAD.
• Hardened native Version Control publishing and detail loading so repositories with multiple remotes prompt for the destination, interrupted detail requests retry without surfacing cancellation errors, and interrupted diff reads cannot remain stuck on the loading screen.
• Hardened native Version Control date labels so missing or invalid branch and stash timestamps are omitted instead of appearing as recent activity.
• Hardened web refresh coalescing so a queued repository refresh still runs after the active request fails or is interrupted, instead of leaving the panel on stale state.
• Hardened web mutation failure handling so every attempted action reconciles VCS status and an authoritative panel snapshot before preserving its action error, keeping conflict-producing or partially applied results visible.
• Hardened commit-hook diagnostics so warning-like stdout/stderr enriches an actual failed Git result only after the process exits and never interrupts an otherwise successful commit.
• Routed Azure DevOps commit-avatar lookup through the organization encoded by HTTPS and SSH repository remotes and the stable Commits Get 7.1 API version instead of ambient CLI detection and a preview version.
• Hardened server review follow-ups so failed full snapshots release the per-cwd full-refresh barrier, checked-out worktree branches are rejected by server-side deletion, default-branch details retain a stable comparison base, and GitLab list-MR failures use bounded sanitized provider causes.
• Fixed native remote collapse behavior so a collapsed remote hides its branch rows together with its action row.
• Isolated selected-file commit preparation, message generation, and commit execution through a temporary selected-only Git index across root web, sibling-worktree web, and mobile flows; shared staging, unstaging, temporary intent-to-add, selected-file stash, and discard classification/mutation commands use literal-pathspec semantics, and selected paths synchronize into the real index only after success, so failures leave the user's staged state untouched while deselected staged changes remain staged. Post-commit index cleanup is best-effort so a cleanup failure cannot report that an already-created commit failed or suppress the caller's refresh.
• Promoted working-tree watcher refreshes to authoritative full snapshots while a full snapshot is in flight, preventing a newer incremental request from retaining pre-mutation branch, remote, fork, or stash data.
• Hardened native working-tree diffs so only staged-only rows request the cached side, while mixed, unstaged, and conflict-only rows request the working-tree side; failed branch, fork-comparison, and stash details now replace indefinite loading placeholders with scoped errors.
• Limited idle Git and filesystem churn with subscription-scoped watcher lifetimes, ignored-path suppression, focus/visibility refreshes, and a five-minute remote fetch interval.
• Extended shared RPC, IPC, Git, settings, client-runtime, and VCS contracts for the source-control snapshot and operation protocol.
• Added desktop and web context-menu separator support so destructive source-control actions remain grouped consistently after both automatic and explicit separators.
• Hardened rebase ref handling with an option separator so ref names cannot be interpreted as command flags.
• Added focused tests for source-control service behavior, provider base detection, VCS broadcaster/watch behavior, source-control panel state, shared Git contracts, and client-runtime VCS action helpers.

Why

T3 Code needs a compact place to answer "what repository work needs attention now?" without forcing users into a full external Git UI. This change keeps the surface decision-oriented: commit or stash selected changes, inspect branch sync state, publish or sync branches, review stashes, and notice when a PR/MR base has moved.

The server-owned design keeps behavior consistent across clients and avoids browser-side Git execution, while the periodic fetch and local watchers keep the panel current without introducing a high-frequency polling loop.

Validation

• The latest review follow-up ran all 58 focused SourceControlPanelService tests; all passed. Targeted formatting/lint, server typecheck, and diff checks passed, with only six pre-existing Effect suggestions in unrelated orchestration code. A fixed-port Playwright pass committed only commit-warning-success.txt from the throwaway repository through a successful pre-commit hook that printed Cannot find native binding; the panel advanced from 11 to 12 commits ahead and refreshed from six to five working-tree files without surfacing a false failure.
• The latest review follow-up ran all 14 focused native Version Control model tests; all passed. Targeted formatting, lint, mobile native static checks, and diff checks passed. Mobile package typecheck remains blocked by the linked @t3tools/mobile-markdown-text package's missing React/JSX resolution and broad pre-existing downstream JSX errors. A compatible T3 Code Dev client was installed, but integrated iOS Simulator verification was blocked before application code loaded because Metro could not resolve its existing expo/virtual/env module through the worktree's shared pnpm symlink layout, including after a frozen install and client-env-disabled retry.
• The latest review follow-up ran all 18 focused web panel logic tests and all 19 focused Azure DevOps CLI/provider tests; all passed. Targeted formatting/lint, server typecheck, and diff checks passed. The web package typecheck remains blocked by unrelated implicit-any and atom-registry errors in branch-selector, model-picker, preview, and state files. A fixed-port Playwright pass used a failing pre-commit hook that created a second file: after the selected-file commit failed, the Version Control panel refreshed from one to two files, displayed generated-by-hook.txt, and preserved the commit failure message.
• The latest review follow-up ran all 68 focused SourceControlPanelService and GitLab provider tests; all passed. Server package typecheck, targeted lint, formatting, and diff checks passed. An isolated fixed-port web/server environment started successfully, but integrated browser assertions were unavailable because Playwright's profile was locked by another active session and the fallback controlled browser rejected its session credential before timing out.
• Focused server coverage passed for SourceControlPanelService, VCS broadcasting and Git driver behavior, provider base detection and error handling, self-hosted GitLab CLI behavior, and desktop context-menu integration.
• The latest review follow-up ran all 53 focused SourceControlPanelService tests and all 12 native Version Control model tests; both passed. The server package typecheck, targeted formatting/lint, mobile native static checks, and diff checks also passed. Mobile package typecheck remains unavailable because its linked @t3tools/mobile-markdown-text package cannot resolve React/JSX types and triggers broad pre-existing failures outside the changed files.
• The final review follow-up ran 80 focused SourceControlPanelService and GitVcsDriverCore tests plus 14 focused native Version Control model/request tests; all passed. Server typecheck, targeted lint, formatting, and diff checks also passed. The mobile package typecheck remains unavailable in this checkout because its linked @t3tools/mobile-markdown-text package cannot resolve React or @t3tools/shared/skillInlineTokens, producing unrelated pre-existing JSX/type failures across the mobile package.
• The latest review follow-up ran all 15 focused web panel logic tests and all 13 native Version Control model tests; both passed. Targeted lint, formatting, mobile native static checks, and diff checks passed. An isolated Playwright pass on the fixed branch ports rendered the Version Control panel, Actionable and Remotes sections, and the configured throwaway remote without page or Vite/HMR errors. The web package typecheck is currently blocked by unrelated errors in branch-selector, model-picker, preview, and atom registry files introduced by the latest upstream merges; the mobile package typecheck remains blocked by the linked markdown package's missing React/JSX types and broad pre-existing native JSX failures.
• Focused web coverage passed for Version Control panel logic and state, thread source-control metadata handling, and right-panel surface behavior.
• Focused shared coverage passed for Git contracts/utilities and client-runtime VCS actions.
• Focused native coverage passed for Version Control request and model behavior.
• pnpm exec vp check passed with 0 errors and 9 existing warnings in unrelated web files.
• pnpm exec vp run typecheck passed.
• pnpm exec vp run lint:mobile passed its available static checks; optional SwiftLint, ktlint, and detekt checks were skipped because those tools are not installed.
• Playwright against an isolated server on 13782, web client on 5742, and disposable throwaway repository verified that an intentional selected-file commit failure surfaces through vcs.panel.commitStaged without staging either file; after removing the failing hook, the selected-only commit succeeded, included only selected.txt, left deselected.txt unstaged, and left the real index empty.
• A final Playwright pass on the same fixed ports verified literal selected-file behavior with [literal].txt beside literal1.txt: discarding the bracketed path left the neighbor modified, and stashing the bracketed path produced a stash containing only [literal].txt while the neighbor remained modified.
• The latest fixed-port browser pass authenticated and rendered the Version Control panel against the throwaway repository. Playwright itself was unavailable because its browser profile was locked by another active session; the controlled fallback preview surfaced the fixture's existing selected-stash Git failure and then became unresponsive before a successful mutation round-trip.

Proof

---

Note

High Risk
Large surface area touching Git mutations, multi-client VCS state, provider auth/API paths, and thread metadata—incorrect sync or stale snapshots could confuse or partially apply repo changes.

Overview
Introduces a Version Control command center as a singleton web right-panel surface and a native mobile full-screen route (plus diff overlay), backed by new server SourceControlPanelService RPCs for snapshots, working-tree actions, branch/remote/stash operations, and compare/detail loading. SOURCE_CONTROL.md and BRANCH_DETAILS.md document behavior, edge cases, and validation.

Web and threading: Panel instances are keyed by environment, thread, and repo cwd; multi-environment projects can show one panel per connected environment. Thread branch/worktree metadata updates use expectedBranch guards and scoped error state so stale checkouts do not overwrite newer state.

Mobile: VersionControlRouteScreen mirrors Actionable/Remotes (selected-file commit/stash/discard, branch sync, stashes, remotes) via panel atom APIs with forceRefresh, sequencing, and a dedicated VersionControlDiffRouteScreen using the existing review diff renderer. Entry points were added to Git header menus and GitOverviewSheet.

Server / providers: Azure DevOps gains getCommitAvatarUrl routed through the organization from the remote URL (Commits API 7.1); PR listing can scope --repository / --project. Provider failures flow through sourceControlProviderError with sanitizeErrorCause so panel RPC errors keep bounded structured causes. Desktop context menus now honor explicit separators and still group destructive items correctly.

^{Reviewed by Cursor Bugbot for commit 6f757f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add Version Control command center panel to web and mobile

• Introduces a new Version Control right panel surface in the web UI (ChatView, RightPanelTabs) that appears for threads in Git repositories, with lazy-loaded SourceControlPanel component covering branching, commits, diffs, stashes, remotes, and working-tree changes.
• Adds a full suite of VCS panel RPC endpoints in ws.ts backed by a new SourceControlPanelService, covering read operations (snapshot, branch details, file diff) and mutating operations (stage/unstage/discard, commit, push/pull, merge, rebase, stash, fetch, remote management).
• Adds Version Control and Diff screens to the mobile navigation stack with a panel API hook (useVersionControlPanelApi) and supporting model utilities in versionControlModel.ts.
• Extends all source control providers (GitHub, GitLab, GitLab CLI, Azure DevOps, Bitbucket) with getCommitAvatarUrl; adds a per-provider showCommitAuthorAvatar setting defaulting to false.
• Adds filesystem watching via VcsStatusBroadcaster to trigger debounced local status refreshes across worktrees on file changes.
• Adds forceRefresh option to executeAtomQuery and the useAtomQueryRunner hooks so VCS panel queries always resolve against fresh SWR cache.
• Changes the default automatic git fetch interval from 30 seconds to 5 minutes.
• Risk: the new WebSocket RPC surface is large; mutating operations trigger a refreshGitStatus side-effect after completion that may cause redundant status updates if the watcher also fires.

^{Macroscope summarized 6f757f7.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ec183356-7030-4438-9b25-61bc7060e870

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

Effect Service Conventions: one finding in DesktopBackendManager.ts. See inline comment.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 87910a1. Configure here.}