fix(webui): locale-independent worktree discovery (P21) + dist gitleaks false-positive (P22)

packages/local-runtime/src/files/git-process.ts

@@ -12,6 +12,12 @@ export interface GitRunResult {
   code: number;
   stdout: string;
   stderr: string;
+  /**
+   * Set only when `git` never ran — a missing binary or an unusable working
+   * directory. Absent means Git produced a verdict, so `code` is a real exit
+   * status that callers may branch on instead of parsing a translated message.
+   */
+  spawnError?: string;
 }
 
 export async function git(args: string[], workspace: string): Promise<GitRunResult> {
@@ -29,6 +35,7 @@ export async function git(args: string[], workspace: string): Promise<GitRunResu
       code: typeof err.code === 'number' ? err.code : 1,
       stdout: bufferToString(err.stdout),
       stderr: bufferToString(err.stderr) || err.message,
+      ...(typeof err.code === 'string' ? { spawnError: err.code } : {}),
     };
   }
 }

packages/local-runtime/src/files/worktrees.ts

@@ -47,7 +47,7 @@ export async function listWorkspaceGitWorktrees(
       success: false,
       worktrees: [],
       error,
-      code: /not a git repository/i.test(error) ? 'not_git_repository' : 'workspace_unavailable',
+      code: await classifyUnresolvedWorkspace(workspace),
     };
   }
   const root = rootResult.stdout.trim();
@@ -111,6 +111,27 @@ export async function listWorkspaceGitWorktrees(
   };
 }
 
+/**
+ * Tell "this folder was never a repository" apart from "the repository here
+ * cannot be listed" without reading Git's diagnostics.
+ *
+ * Git translates `fatal: not a git repository ...` into the user's locale, so
+ * matching that sentence only classified an English-speaking host: under
+ * `LANG=zh_CN` every plain folder fell into the generic bucket and
+ * `not_git_repository` was unreachable. `git rev-parse --git-dir` states the
+ * same fact in its exit status — 0 inside a repository (bare included), 128
+ * outside one — and those bytes never change with the locale. A bare
+ * repository therefore lands in `workspace_unavailable`: it is a repository,
+ * just one without the work tree this listing walks.
+ */
+async function classifyUnresolvedWorkspace(workspace: string): Promise<WorktreeDiscoveryCode> {
+  const probe = await git(['rev-parse', '--git-dir'], workspace);
+  if (probe.spawnError !== undefined) return 'workspace_unavailable';
+  return probe.code === 0 && probe.stdout.trim() !== ''
+    ? 'workspace_unavailable'
+    : 'not_git_repository';
+}
+
 /** null means confirmed missing; undefined means metadata could not be read. */
 async function worktreeLastModifiedMs(worktreePath: string): Promise<number | undefined | null> {
   try {

packages/local-runtime/test/unit/worktree-discovery-code.test.ts

@@ -0,0 +1,124 @@
+// Discovery-code classification for `listWorkspaceGitWorktrees`, driven by a
+// stubbed `git` so the assertions hold on hosts whose Git prints English only.
+//
+// Why the stub instead of a real repository: the regression this file pins is
+// that the classification read Git's human-readable diagnostic. That text is
+// translated by Git, so a real-subprocess test only reproduces it on a host
+// carrying the matching catalogue. Here the stub returns exactly what a
+// localized Git returns, and the code under test must classify it from the
+// exit status alone.
+
+import { mkdtemp, mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import type { GitRunResult } from '../../src/files/git-process.js';
+
+const gitStub = vi.fn<(args: string[], workspace: string) => Promise<GitRunResult>>();
+
+vi.mock('../../src/files/git-process.js', () => ({
+  git: (args: string[], workspace: string) => gitStub(args, workspace),
+}));
+
+const { listWorkspaceGitWorktrees } = await import('../../src/files/worktrees.js');
+
+const NOT_A_REPO_ZH = 'fatal: 不是 git 仓库（或者任何父目录）：.git';
+const NOT_A_REPO_EN = 'fatal: not a git repository (or any of the parent directories): .git';
+const NO_WORK_TREE_ZH = 'fatal: 该操作必须在一个工作区中运行';
+
+let workspace: string;
+
+beforeEach(async () => {
+  gitStub.mockReset();
+  workspace = await mkdtemp(join(tmpdir(), 'mcode-worktree-code-'));
+  await mkdir(join(workspace, 'plain-folder'), { recursive: true });
+});
+
+afterEach(async () => {
+  await rm(workspace, { recursive: true, force: true });
+});
+
+/** Answer the two `rev-parse` probes the discovery performs. */
+function stubRevParse(options: {
+  toplevel: GitRunResult;
+  gitDir: GitRunResult;
+}): void {
+  gitStub.mockImplementation(async (args) =>
+    args.includes('--git-dir') ? options.gitDir : options.toplevel,
+  );
+}
+
+function failed(code: number, stderr: string): GitRunResult {
+  return { code, stdout: '', stderr };
+}
+
+describe('listWorkspaceGitWorktrees discovery code', () => {
+  it.each([
+    ['zh_CN', NOT_A_REPO_ZH],
+    ['en_US', NOT_A_REPO_EN],
+  ])('classifies a plain folder as not_git_repository under %s diagnostics', async (_tag, stderr) => {
+    stubRevParse({
+      toplevel: failed(128, stderr),
+      gitDir: failed(128, stderr),
+    });
+
+    const result = await listWorkspaceGitWorktrees(join(workspace, 'plain-folder'));
+
+    expect(result.success).toBe(false);
+    expect(result.code).toBe('not_git_repository');
+    expect(result.error).toBe(stderr);
+  });
+
+  it('keeps a repository without a work tree out of the not-a-repository bucket', async () => {
+    // A bare repository answers `--git-dir` successfully while
+    // `--show-toplevel` fails; that is a repository this listing cannot walk,
+    // not a folder that was never one.
+    stubRevParse({
+      toplevel: failed(128, NO_WORK_TREE_ZH),
+      gitDir: { code: 0, stdout: '.\n', stderr: '' },
+    });
+
+    const result = await listWorkspaceGitWorktrees(workspace);
+
+    expect(result.success).toBe(false);
+    expect(result.code).toBe('workspace_unavailable');
+  });
+
+  it('falls back to the generic bucket when git could not run at all', async () => {
+    // No binary, unusable cwd: neither probe produced a Git verdict, so the
+    // discovery must not claim the folder was never a repository.
+    gitStub.mockImplementation(async () => ({
+      code: 1,
+      stdout: '',
+      stderr: 'spawn git ENOENT',
+      spawnError: 'ENOENT',
+    }));
+
+    const result = await listWorkspaceGitWorktrees(workspace);
+
+    expect(result.success).toBe(false);
+    expect(result.code).toBe('workspace_unavailable');
+  });
+
+  it('still lists the worktrees of a healthy repository', async () => {
+    gitStub.mockImplementation(async (args) => {
+      if (args.includes('--show-toplevel')) return { code: 0, stdout: `${workspace}\n`, stderr: '' };
+      if (args.includes('worktree')) {
+        return {
+          code: 0,
+          stdout: `worktree ${workspace}\nHEAD 1111111111111111111111111111111111111111\nbranch refs/heads/main\n\n`,
+          stderr: '',
+        };
+      }
+      return failed(1, 'unexpected call');
+    });
+
+    const result = await listWorkspaceGitWorktrees(workspace);
+
+    expect(result.success).toBe(true);
+    expect(result.worktrees).toHaveLength(1);
+    expect(result.worktrees[0]).toMatchObject({ branch: 'main', isMain: true });
+  });
+});

packages/local-runtime/test/unit/worktree-locale-parity.test.ts

@@ -0,0 +1,105 @@
+// Locale parity for the worktree discovery codes, against a real `git`.
+//
+// The discovery used to recognise "not a repository" by matching Git's
+// English diagnostic, so on a host whose Git speaks the user's language every
+// plain folder degraded to the generic `workspace_unavailable` bucket. These
+// cases run the real subprocess under a fixed locale and assert the discovery
+// code, never the wording — a Git build without the requested catalogue simply
+// stays in English and the expectation still holds.
+
+import { execFile as execFileCallback } from 'node:child_process';
+import { mkdtemp, mkdir, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+
+import { listWorkspaceGitWorktrees } from '../../src/files/worktrees.js';
+
+const execFile = promisify(execFileCallback);
+
+const LOCALES = ['zh_CN.utf8', 'en_US.UTF-8'];
+
+let fixture: string;
+let plainFolder: string;
+let repository: string;
+
+beforeEach(async () => {
+  fixture = await mkdtemp(join(tmpdir(), 'mcode-worktree-locale-'));
+  plainFolder = join(fixture, 'plain-folder');
+  repository = join(fixture, 'repository');
+  await mkdir(plainFolder, { recursive: true });
+  await mkdir(repository, { recursive: true });
+  await git(repository, ['-c', 'init.defaultBranch=main', 'init', '-q']);
+  await git(repository, [
+    '-c',
+    'user.name=P21',
+    '-c',
+    'user.email=p21@example.test',
+    'commit',
+    '-q',
+    '--allow-empty',
+    '-m',
+    'initial',
+  ]);
+});
+
+afterEach(async () => {
+  await rm(fixture, { recursive: true, force: true });
+});
+
+async function git(cwd: string, args: string[]): Promise<void> {
+  await execFile('git', args, { cwd, encoding: 'utf-8' });
+}
+
+/**
+ * `git` translates its diagnostics from `LC_ALL`/`LANG`/`LC_MESSAGES`; the
+ * discovery inherits this process's environment, so pinning the variables here
+ * is what fixes the subprocess locale. Restoration is unconditional: another
+ * case in this file must not inherit the previous locale.
+ */
+async function withLocale<T>(locale: string, run: () => Promise<T>): Promise<T> {
+  const saved = ['LANG', 'LC_ALL', 'LC_MESSAGES'].map((key) => [key, process.env[key]] as const);
+  process.env.LANG = locale;
+  process.env.LC_ALL = locale;
+  delete process.env.LC_MESSAGES;
+  try {
+    return await run();
+  } finally {
+    for (const [key, value] of saved) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  }
+}
+
+describe('listWorkspaceGitWorktrees locale parity', () => {
+  it.each(LOCALES)('reports a plain folder as not_git_repository under %s', async (locale) => {
+    const result = await withLocale(locale, () => listWorkspaceGitWorktrees(plainFolder));
+
+    expect(result.success).toBe(false);
+    expect(result.code).toBe('not_git_repository');
+    expect(result.error).toBeTruthy();
+  });
+
+  it.each(LOCALES)('lists the worktrees of a repository under %s', async (locale) => {
+    const result = await withLocale(locale, () => listWorkspaceGitWorktrees(repository));
+
+    expect(result.success).toBe(true);
+    expect(result.code).toBeUndefined();
+    expect(result.worktrees).toHaveLength(1);
+    expect(result.worktrees[0]).toMatchObject({ branch: 'main', isMain: true, isActive: true });
+  });
+
+  it('produces the same codes regardless of the locale in force', async () => {
+    const perLocale = [];
+    for (const locale of LOCALES) {
+      perLocale.push(
+        (await withLocale(locale, () => listWorkspaceGitWorktrees(plainFolder))).code,
+        (await withLocale(locale, () => listWorkspaceGitWorktrees(repository))).code,
+      );
+    }
+    expect(perLocale).toEqual(['not_git_repository', undefined, 'not_git_repository', undefined]);
+  });
+});

packages/webui/server/engine/model-source.js

@@ -310,9 +310,14 @@ export function publicApiKeyStatus(status) {
   const record = status && typeof status === "object" ? status : {};
   const cached = record.cachedStatus && typeof record.cachedStatus === "object" ? record.cachedStatus : {};
   const lastTested = typeof cached.lastTestedAt === "number" ? cached.lastTestedAt : null;
+  // Destructured, not read as `record.hasApiKey` in the projection: the bundler
+  // renames `record` to a generated identifier, and a `hasKey: <renamed>.<member>`
+  // pair reads to the credential scanner as `hasKey = <16+ char secret>` inside the
+  // bundled distribution, failing the release audit on a boolean comparison.
+  const { hasApiKey } = record;
   return {
     available: true,
-    hasKey: record.hasApiKey === true,
+    hasKey: hasApiKey === true,
     masked: typeof record.maskedApiKey === "string" ? record.maskedApiKey : null,
     testState: typeof cached.state === "string" ? cached.state : null,
     lastTestedAtMs: lastTested,

test/vitest-suites.json

@@ -110,6 +110,8 @@
       "packages/local-runtime/test/unit/thread-goal/host-integration-settlement.test.ts",
       "packages/local-runtime/test/unit/thread-goal/host-integration-verifier-charge-rearm.test.ts",
       "packages/local-runtime/test/unit/token-counter-adapter-routing.test.ts",
+      "packages/local-runtime/test/unit/worktree-discovery-code.test.ts",
+      "packages/local-runtime/test/unit/worktree-locale-parity.test.ts",
       "packages/mcode-tools-host/test/unit/lease-broker.test.ts",
       "packages/mcode-tools-host/test/unit/resource-manifest.test.ts",
       "packages/mcode-tools-host/test/unit/resource.test.ts",