Fix/resolve different bugs (#964)

* fix: don't overlap thinking banner over conversation * feat: support message queue and add attention indicator * fix(shell): use c to copy for claude * fix: strip timestamp tags from cursor * fix: select project when loading session from direct URL * feat: support attached images for all providers * feat(opencode): support permission options * fix: resolve source control and chat UX bugs - make staging real in the git panel: new /stage and /unstage endpoints, /status now reports the actual index via porcelain -z (handles renames, conflicts, and paths with spaces), and Stage/Unstage All run real git commands instead of toggling client-side state - add branch search to the header dropdown and Branches tab - persist the chosen permission mode per provider so a brand-new chat keeps it once the session id arrives, instead of reverting to default - replace cmdk's fuzzy model search with strict token matching so "chatgpt" no longer surfaces unrelated models - unit tests for the git status parser * feat(git): commit graph in history view and cross-spawn everywhere - render a VSCode-style commit graph in the source control history: lane-assignment algorithm, SVG strip with colored rails, merge and branch curves, commit dots, and branch/tag badges per commit - /commits returns parents and ref decorations across all branches (--branches --remotes --tags --topo-order) using unit-separator fields so pipes in commit subjects can't break parsing - collect stats via a single --shortstat pass instead of one `git show --stat` call per commit; raise the history limit to 50 - replace child_process spawn with cross-spawn in all runtimes, routes, and services: it resolves .cmd shims and PATHEXT on Windows (fixing taskmaster's npx invocations) and delegates to native spawn elsewhere, removing the per-file win32 ternaries - unit tests for the log parser and lane assignment * fix: remove gemini support since google discontinued it * fix: address code review findings - validate chat image attachments server-side: only files inside the ~/.cloudcli/assets upload store may reach provider file reads - harden asset serving with nosniff and attachment disposition for SVGs to prevent stored XSS - show the timestamp on image-only user messages - serialize git stage/unstage calls and defer the status re-sync so rapid toggles can't interleave or flicker - use a literal hex fallback for commit ref badges (alpha suffix on a var() string produced invalid CSS) - stop binding a URL session to a guening project instead - add the missing attentionRequiredIndicator key to all sidebar locales - clean up dangling conjunctions left the de/ru/tr/ja/zh-CN/zh-TW READMEs * fix: address code scanning findings - enforce a second image trust boundary in the provider builders: buildClaudeUserContent/buildCodexInputItems only accept files inside the upload store or the run's working directory (CodeQL path injection) - drop an always-true selectedProject check in handleSubmit - remove the unused resume option from spawnCursor * fix: use CodeQL-recognized containment check for image reads Replace the path.relative guard in isPathInsideDirectory with the resolve + startsWith(root + sep) idiom so the path-injection barrier is visible to code scanning; behavior is unchanged. * fix(security): canonicalize Claude image attachment reads Resolve image attachment paths with realpath before reading so symlinks inside allowed roots cannot escape to arbitrary files. Preserve support for symlinked project/upload roots and add focused coverage for both cases. * fix: show agent subtask * fix(sessions): title app-created sessions from the first user message App-created sessions (started by sending a message from cloudcli) were titled with placeholder names — "Untitled Codex Session" from the disk indexer and, briefly, "New session" from the empty canonical upsert — before a later sync finally settled on the right text, causing the sidebar title to flicker. - Codex/OpenCode synchronizers now title app-created sessions (distinct app id mapped to a provider id) from the first user message, while sessions found purely by indexing keep their existing setup. Claude keeps its AI-generated titles; Cursor already used the first message. - Decode OpenCode's JSON-string-literal prompts so titles no longer surface wrapped in quotes; hoist unwrapJsonStringLiteral into shared/utils since it's now used by both the reader and synchronizer. - Guard the sidebar upsert merge so an empty summary can never blank out a title that is already set. - Add codex/opencode synchronizer tests for the app-created vs indexed naming paths. * fix(chat): make message queuing reliable across sessions and turn boundaries Queued messages had four related defects: - A queued message flashed and then vanished at flush time: concurrent transcript refreshes (the `complete` handler racing the watcher-triggered update) could resolve out of order, letting a stale response overwrite newer server messages after the optimistic row was pruned. Session slots now carry a monotonic fetch ticket and discard stale fetch/refresh/ fetchMore responses. - Switching sessions flushed the previous session's queued draft into the newly viewed one (sending it with the wrong provider's settings, e.g. a Claude model into a Codex session). The composer flush is now scoped to its session, and a draft restored into an idle session sends after a short grace period so a live-run ack can cancel it. - The thinking banner never appeared for a queued turn: the chat handler's session-keyed completeRun safety net could fire after a queued message had already started the session's next run, emitting a spurious `complete` that killed it. The safety net is now scoped to its own run via completeRunIfCurrent (with a regression test). - Queued messages only sent while their session was being viewed. Drafts now persist their send options (model, effort, permissions) at queue time, and a new app-level useQueuedMessageAutoSend hook dispatches a non-viewed session's queued message as soon as its run completes, using the storage key as the claim ticket to prevent double sends.
2026-07-09 07:25:43 +08:00 · 2026-07-08 11:32:32 +03:00
parent 41e0d309e0
commit 4cee5e7286
173 changed files with 4172 additions and 4296 deletions
--- a/server/routes/agent.js
+++ b/server/routes/agent.js
@@ -1,5 +1,6 @@
 import express from 'express';
-import { spawn } from 'child_process';
+// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution.
+import spawn from 'cross-spawn';
 import path from 'path';
 import os from 'os';
 import { promises as fs } from 'fs';
@@ -8,7 +9,6 @@ import { userDb, apiKeysDb, githubTokensDb, projectsDb } from '../modules/databa
 import { queryClaudeSDK } from '../claude-sdk.js';
 import { spawnCursor } from '../cursor-cli.js';
 import { queryCodex } from '../openai-codex.js';
-import { spawnGemini } from '../gemini-cli.js';
 import { spawnOpenCode } from '../opencode-cli.js';
 import { Octokit } from '@octokit/rest';
 import { providerModelsService } from '../modules/providers/services/provider-models.service.js';
@@ -636,7 +636,7 @@ class ResponseCollector {
 *                          - Source for auto-generated branch names (if createBranch=true and no branchName)
 *                          - Fallback for PR title if no commits are made
 *
- * @param {string} provider - (Optional) AI provider to use. Options: 'claude' | 'cursor' | 'codex' | 'gemini' | 'opencode'
+ * @param {string} provider - (Optional) AI provider to use. Options: 'claude' | 'cursor' | 'codex' | 'opencode'
 *                           Default: 'claude'
 *
 * @param {boolean} stream - (Optional) Enable Server-Sent Events (SSE) streaming for real-time updates.
@@ -648,7 +648,7 @@ class ResponseCollector {
 *
 *                        Claude models: 'default', 'sonnet', 'opus', 'haiku', 'sonnet[1m]', 'opus[1m]', 'fable'
 *                        Cursor models: 'gpt-5' (default), 'gpt-5.2', 'gpt-5.2-high', 'sonnet-4.5', 'opus-4.5',
- *                                       'gemini-3-pro', 'composer-1', 'auto', 'gpt-5.1', 'gpt-5.1-high',
+ *                                       'composer-1', 'auto', 'gpt-5.1', 'gpt-5.1-high',
 *                                       'gpt-5.1-codex', 'gpt-5.1-codex-high', 'gpt-5.1-codex-max',
 *                                       'gpt-5.1-codex-max-high', 'opus-4.1', 'grok', and thinking variants
 *                        Codex models: 'gpt-5.4' (default), 'gpt-5.5', 'gpt-5.4-mini'
@@ -759,7 +759,7 @@ class ResponseCollector {
 * Input Validations (400 Bad Request):
 *   - Either githubUrl OR projectPath must be provided (not neither)
 *   - message must be non-empty string
- *   - provider must be 'claude', 'cursor', 'codex', 'gemini', or 'opencode'
+ *   - provider must be 'claude', 'cursor', 'codex', or 'opencode'
 *   - createBranch/createPR requires githubUrl OR projectPath (not neither)
 *   - branchName must pass Git naming rules (if provided)
 *
@@ -870,8 +870,8 @@ router.post('/', validateExternalApiKey, async (req, res) => {
    return res.status(400).json({ error: 'message is required' });
  }

-  if (!['claude', 'cursor', 'codex', 'gemini', 'opencode'].includes(provider)) {
-    return res.status(400).json({ error: 'provider must be "claude", "cursor", "codex", "gemini", or "opencode"' });
+  if (!['claude', 'cursor', 'codex', 'opencode'].includes(provider)) {
+    return res.status(400).json({ error: 'provider must be "claude", "cursor", "codex", or "opencode"' });
  }

  // Validate GitHub branch/PR creation requirements
@@ -950,7 +950,6 @@ router.post('/', validateExternalApiKey, async (req, res) => {
    }

    const codexModels = (await providerModelsService.getProviderModels('codex')).models;
-    const geminiModels = (await providerModelsService.getProviderModels('gemini')).models;
    const opencodeModels = (await providerModelsService.getProviderModels('opencode')).models;

    // Start the appropriate session
@@ -987,16 +986,6 @@ router.post('/', validateExternalApiKey, async (req, res) => {
        effort,
        permissionMode: 'bypassPermissions'
      }, writer);
-    } else if (provider === 'gemini') {
-      console.log('✨ Starting Gemini CLI session');
-
-      await spawnGemini(message.trim(), {
-        projectPath: finalProjectPath,
-        cwd: finalProjectPath,
-        sessionId: sessionId || null,
-        model: model || geminiModels.DEFAULT,
-        skipPermissions: true // CLI mode bypasses permissions
-      }, writer);
    } else if (provider === 'opencode') {
      console.log('Starting OpenCode CLI session');

@@ -1005,7 +994,8 @@ router.post('/', validateExternalApiKey, async (req, res) => {
        cwd: finalProjectPath,
        sessionId: sessionId || null,
        model: model || opencodeModels.DEFAULT,
-        effort
+        effort,
+        permissionMode: 'bypassPermissions' // Agent runs are non-interactive, like the other providers above
      }, writer);
    }

--- a/server/routes/commands.js
+++ b/server/routes/commands.js
@@ -15,13 +15,12 @@ const APP_ROOT = findAppRoot(__dirname);

 const router = express.Router();

-const MODEL_PROVIDERS = ["claude", "cursor", "codex", "gemini", "opencode"];
+const MODEL_PROVIDERS = ["claude", "cursor", "codex", "opencode"];

 const MODEL_PROVIDER_LABELS = {
  claude: "Claude",
  cursor: "Cursor",
  codex: "Codex",
-  gemini: "Gemini",
  opencode: "OpenCode",
 };

--- a/server/routes/gemini.js
+++ b/server/routes/gemini.js
@@ -1,25 +0,0 @@
-import express from 'express';
-
-import sessionManager from '../sessionManager.js';
-import { sessionsDb } from '../modules/database/index.js';
-
-const router = express.Router();
-
-router.delete('/sessions/:sessionId', async (req, res) => {
-    try {
-        const { sessionId } = req.params;
-
-        if (!sessionId || typeof sessionId !== 'string' || !/^[a-zA-Z0-9_.-]{1,100}$/.test(sessionId)) {
-            return res.status(400).json({ success: false, error: 'Invalid session ID format' });
-        }
-
-        await sessionManager.deleteSession(sessionId);
-        sessionsDb.deleteSessionById(sessionId);
-        res.json({ success: true });
-    } catch (error) {
-        console.error(`Error deleting Gemini session ${req.params.sessionId}:`, error);
-        res.status(500).json({ success: false, error: error.message });
-    }
-});
-
-export default router;
--- a/server/routes/git.js
+++ b/server/routes/git.js
@@ -1,5 +1,6 @@
 import express from 'express';
-import { spawn } from 'child_process';
+// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution.
+import spawn from 'cross-spawn';
 import path from 'path';
 import { promises as fs } from 'fs';
 import { projectsDb } from '../modules/database/index.js';
@@ -293,6 +294,76 @@ async function resolveRepositoryFilePath(projectPath, filePath) {
 }

 // Get git status for a project
+/**
+ * Parses `git status --porcelain=v1 -z` output into the response shape the
+ * git panel consumes. NUL-separated entries carry no path quoting, so names
+ * with spaces/unicode survive intact (the plain porcelain output quotes and
+ * escapes them, which broke the old line-based parser).
+ *
+ * `staged` lists paths with index-side changes. The UI renders its "Staged"
+ * section from this list so it always mirrors the real git index (including
+ * files staged outside the app, e.g. via VSCode or the terminal).
+ *
+ * Exported for tests.
+ */
+export function parseGitStatusOutput(statusOutput) {
+  const modified = [];
+  const added = [];
+  const deleted = [];
+  const untracked = [];
+  const staged = [];
+
+  const statusEntries = statusOutput.split('\0');
+  for (let entryIndex = 0; entryIndex < statusEntries.length; entryIndex++) {
+    const entry = statusEntries[entryIndex];
+    if (!entry || entry.length < 4) continue;
+
+    // Porcelain v1: X = index (staged) status, Y = worktree (unstaged) status.
+    const indexStatus = entry[0];
+    const worktreeStatus = entry[1];
+    const file = entry.slice(3);
+
+    // Renames/copies carry the original path as the following NUL entry;
+    // the UI tracks the post-rename path only.
+    if (indexStatus === 'R' || indexStatus === 'C') {
+      entryIndex += 1;
+    }
+
+    if (indexStatus === '?') {
+      untracked.push(file);
+      continue;
+    }
+    if (indexStatus === '!') {
+      continue; // ignored files are never reported
+    }
+
+    const isConflict =
+      indexStatus === 'U' || worktreeStatus === 'U' ||
+      (indexStatus === 'A' && worktreeStatus === 'A') ||
+      (indexStatus === 'D' && worktreeStatus === 'D');
+    if (isConflict) {
+      // Merge conflicts must be resolved in the worktree first; surface them
+      // as modified and never as staged.
+      modified.push(file);
+      continue;
+    }
+
+    if (indexStatus !== ' ') {
+      staged.push(file);
+    }
+
+    if (indexStatus === 'D' || worktreeStatus === 'D') {
+      deleted.push(file);
+    } else if (indexStatus === 'A' || worktreeStatus === 'A') {
+      added.push(file);
+    } else {
+      modified.push(file);
+    }
+  }
+
+  return { modified, added, deleted, untracked, staged };
+}
+
 router.get('/status', async (req, res) => {
  const { project } = req.query;

@@ -309,30 +380,8 @@ router.get('/status', async (req, res) => {
    const branch = await getCurrentBranchName(projectPath);
    const hasCommits = await repositoryHasCommits(projectPath);

-    // Get git status
-    const { stdout: statusOutput } = await spawnAsync('git', ['status', '--porcelain'], { cwd: projectPath });
-
-    const modified = [];
-    const added = [];
-    const deleted = [];
-    const untracked = [];
-
-    statusOutput.split('\n').forEach(line => {
-      if (!line.trim()) return;
-
-      const status = line.substring(0, 2);
-      const file = line.substring(3);
-
-      if (status === 'M ' || status === ' M' || status === 'MM') {
-        modified.push(file);
-      } else if (status === 'A ' || status === 'AM') {
-        added.push(file);
-      } else if (status === 'D ' || status === ' D') {
-        deleted.push(file);
-      } else if (status === '??') {
-        untracked.push(file);
-      }
-    });
+    const { stdout: statusOutput } = await spawnAsync('git', ['status', '--porcelain=v1', '-z'], { cwd: projectPath });
+    const { modified, added, deleted, untracked, staged } = parseGitStatusOutput(statusOutput);

    res.json({
      branch,
@@ -340,7 +389,8 @@ router.get('/status', async (req, res) => {
      modified,
      added,
      deleted,
-      untracked
+      untracked,
+      staged
    });
  } catch (error) {
    console.error('Git status error:', error);
@@ -593,6 +643,64 @@ router.post('/commit', async (req, res) => {
  }
 });

+// Stage files (git add). Mirrors what the UI shows as the "Staged" section,
+// so the app's staging state and the real git index never drift apart.
+router.post('/stage', async (req, res) => {
+  const { project, files } = req.body;
+
+  if (!project || !Array.isArray(files) || files.length === 0) {
+    return res.status(400).json({ error: 'Project id and files are required' });
+  }
+
+  try {
+    const projectPath = await getActualProjectPath(project);
+    await validateGitRepository(projectPath);
+    const repositoryRootPath = await getRepositoryRootPath(projectPath);
+
+    for (const file of files) {
+      const { repositoryRelativeFilePath } = await resolveRepositoryFilePath(projectPath, file);
+      await spawnAsync('git', ['add', '--', repositoryRelativeFilePath], { cwd: repositoryRootPath });
+    }
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Git stage error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// Unstage files (remove from the index, keep the worktree changes)
+router.post('/unstage', async (req, res) => {
+  const { project, files } = req.body;
+
+  if (!project || !Array.isArray(files) || files.length === 0) {
+    return res.status(400).json({ error: 'Project id and files are required' });
+  }
+
+  try {
+    const projectPath = await getActualProjectPath(project);
+    await validateGitRepository(projectPath);
+    const repositoryRootPath = await getRepositoryRootPath(projectPath);
+    const hasCommits = await repositoryHasCommits(projectPath);
+
+    for (const file of files) {
+      const { repositoryRelativeFilePath } = await resolveRepositoryFilePath(projectPath, file);
+      if (hasCommits) {
+        await spawnAsync('git', ['reset', 'HEAD', '--', repositoryRelativeFilePath], { cwd: repositoryRootPath });
+      } else {
+        // No HEAD to reset against before the first commit; dropping the
+        // index entry is the only way to unstage while keeping the file.
+        await spawnAsync('git', ['rm', '--cached', '-r', '--force', '--', repositoryRelativeFilePath], { cwd: repositoryRootPath });
+      }
+    }
+
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Git unstage error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
 // Revert latest local commit (keeps changes staged)
 router.post('/revert-local-commit', async (req, res) => {
  const { project } = req.body;
@@ -754,10 +862,57 @@ router.post('/delete-branch', async (req, res) => {
  }
 });

-// Get recent commits
+// Fields are joined with the ASCII unit separator so pipes (or anything else
+// typed into a commit subject) cannot break parsing.
+const GIT_LOG_FIELD_SEPARATOR = '\u001f';
+const GIT_LOG_PRETTY_FORMAT = '%H%x1f%P%x1f%D%x1f%an%x1f%ae%x1f%ad%x1f%s';
+
+/**
+ * Parses `git log --shortstat` output produced with GIT_LOG_PRETTY_FORMAT.
+ *
+ * Each commit is one format line (hash, parent hashes, ref decorations,
+ * author, email, date, subject) optionally followed by its `--shortstat`
+ * summary line ("N files changed, ..."). Parents and refs feed the commit
+ * graph rendered by the History view; merge commits carry no shortstat line,
+ * so their `stats` stays empty.
+ *
+ * Exported for tests.
+ */
+export function parseGitLogWithStats(stdout) {
+  const commits = [];
+
+  for (const rawLine of stdout.split('\n')) {
+    const line = rawLine.trimEnd();
+    if (!line.trim()) continue;
+
+    if (line.includes(GIT_LOG_FIELD_SEPARATOR)) {
+      const [hash, parents, refs, author, email, date, ...messageParts] = line.split(GIT_LOG_FIELD_SEPARATOR);
+      commits.push({
+        hash,
+        parents: parents ? parents.split(' ').filter(Boolean) : [],
+        // `%D` decorations, e.g. "HEAD -> main", "origin/main", "tag: v1.0".
+        refs: refs ? refs.split(', ').filter(Boolean) : [],
+        author,
+        email,
+        date,
+        message: messageParts.join(GIT_LOG_FIELD_SEPARATOR),
+        stats: ''
+      });
+      continue;
+    }
+
+    if (commits.length > 0 && /files? changed/.test(line)) {
+      commits[commits.length - 1].stats = line.trim();
+    }
+  }
+
+  return commits;
+}
+
+// Get recent commits (across all branches, in graph order)
 router.get('/commits', async (req, res) => {
  const { project, limit = 10 } = req.query;
-  
+
  if (!project) {
    return res.status(400).json({ error: 'Project id is required' });
  }
@@ -769,42 +924,28 @@ router.get('/commits', async (req, res) => {
    const safeLimit = Number.isFinite(parsedLimit) && parsedLimit > 0
      ? Math.min(parsedLimit, 100)
      : 10;
-    
-    // Get commit log with stats
+
+    // Branches/remotes/tags (not --all, which would drag in refs/stash) with
+    // `--topo-order` guarantee children appear before their parents across
+    // every branch, which the frontend lane-assignment relies on.
+    // `--shortstat` replaces the previous per-commit `git show --stat` calls.
    const { stdout } = await spawnAsync(
      'git',
-      ['log', '--pretty=format:%H|%an|%ae|%ad|%s', '--date=iso-strict', '-n', String(safeLimit)],
+      [
+        'log',
+        '--branches',
+        '--remotes',
+        '--tags',
+        '--topo-order',
+        '--shortstat',
+        `--pretty=format:${GIT_LOG_PRETTY_FORMAT}`,
+        '--date=iso-strict',
+        '-n', String(safeLimit)
+      ],
      { cwd: projectPath },
    );
-    
-    const commits = stdout
-      .split('\n')
-      .filter(line => line.trim())
-      .map(line => {
-        const [hash, author, email, date, ...messageParts] = line.split('|');
-        return {
-          hash,
-          author,
-          email,
-          date,
-          message: messageParts.join('|')
-        };
-      });
-    
-    // Get stats for each commit
-    for (const commit of commits) {
-      try {
-        const { stdout: stats } = await spawnAsync(
-          'git', ['show', '--stat', '--format=', commit.hash],
-          { cwd: projectPath }
-        );
-        commit.stats = stats.trim().split('\n').pop(); // Get the summary line
-      } catch (error) {
-        commit.stats = '';
-      }
-    }
-    
-    res.json({ commits });
+
+    res.json({ commits: parseGitLogWithStats(stdout) });
  } catch (error) {
    console.error('Git commits error:', error);
    res.json({ error: error.message });
--- a/server/routes/git.test.js
+++ b/server/routes/git.test.js
@@ -0,0 +1,106 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { parseGitLogWithStats, parseGitStatusOutput } from './git.js';
+
+// Builds `git status --porcelain=v1 -z` output: NUL-separated entries with a
+// trailing NUL, exactly as git emits it.
+const porcelain = (...entries) => entries.join('\0') + '\0';
+
+test('parseGitStatusOutput buckets files and reports index-side staging', () => {
+  const output = porcelain(
+    'M  staged-modified.ts',
+    ' M unstaged-modified.ts',
+    'MM staged-and-unstaged.ts',
+    'A  staged-new.ts',
+    'D  staged-deleted.ts',
+    ' D unstaged-deleted.ts',
+    '?? untracked.ts',
+  );
+
+  const result = parseGitStatusOutput(output);
+
+  assert.deepEqual(result.modified, ['staged-modified.ts', 'unstaged-modified.ts', 'staged-and-unstaged.ts']);
+  assert.deepEqual(result.added, ['staged-new.ts']);
+  assert.deepEqual(result.deleted, ['staged-deleted.ts', 'unstaged-deleted.ts']);
+  assert.deepEqual(result.untracked, ['untracked.ts']);
+  // Only index-side (X) changes count as staged.
+  assert.deepEqual(result.staged, [
+    'staged-modified.ts',
+    'staged-and-unstaged.ts',
+    'staged-new.ts',
+    'staged-deleted.ts',
+  ]);
+});
+
+test('parseGitStatusOutput keeps paths with spaces intact (-z output has no quoting)', () => {
+  const result = parseGitStatusOutput(porcelain('M  src/my folder/some file.ts'));
+  assert.deepEqual(result.modified, ['src/my folder/some file.ts']);
+  assert.deepEqual(result.staged, ['src/my folder/some file.ts']);
+});
+
+test('parseGitStatusOutput tracks the post-rename path and skips the original', () => {
+  const output = porcelain('R  renamed-to.ts', 'renamed-from.ts', ' M other.ts');
+  const result = parseGitStatusOutput(output);
+
+  assert.deepEqual(result.modified, ['renamed-to.ts', 'other.ts']);
+  assert.deepEqual(result.staged, ['renamed-to.ts']);
+  // The pre-rename path is metadata, not a change entry.
+  assert.equal(JSON.stringify(result).includes('renamed-from.ts'), false);
+});
+
+test('parseGitStatusOutput never reports merge conflicts as staged', () => {
+  const output = porcelain('UU conflicted.ts', 'AA both-added.ts', 'DD both-deleted.ts');
+  const result = parseGitStatusOutput(output);
+
+  assert.deepEqual(result.modified, ['conflicted.ts', 'both-added.ts', 'both-deleted.ts']);
+  assert.deepEqual(result.staged, []);
+});
+
+test('parseGitStatusOutput handles empty output', () => {
+  assert.deepEqual(parseGitStatusOutput(''), {
+    modified: [],
+    added: [],
+    deleted: [],
+    untracked: [],
+    staged: [],
+  });
+});
+
+// Builds one `git log --pretty=format:%H%x1f%P%x1f%D%x1f%an%x1f%ae%x1f%ad%x1f%s` line.
+const US = '';
+const logLine = (hash, parents, refs, subject) =>
+  [hash, parents, refs, 'Alice', 'a@x.com', '2026-07-06T10:00:00+03:00', subject].join(US);
+
+test('parseGitLogWithStats parses commits with parents, refs, and shortstat lines', () => {
+  const output = [
+    logLine('c3', 'c2', 'HEAD -> main, origin/main, tag: v1.0', 'feat: add | pipes | to subject'),
+    ' 3 files changed, 10 insertions(+), 2 deletions(-)',
+    '',
+    logLine('c2', 'c1 c0', '', 'Merge branch feature'),
+    '',
+    logLine('c0', '', '', 'initial commit'),
+    ' 1 file changed, 1 insertion(+)',
+  ].join('\n');
+
+  const commits = parseGitLogWithStats(output);
+
+  assert.equal(commits.length, 3);
+  assert.deepEqual(commits[0].parents, ['c2']);
+  assert.deepEqual(commits[0].refs, ['HEAD -> main', 'origin/main', 'tag: v1.0']);
+  // Pipes in the subject survive because fields are joined with .
+  assert.equal(commits[0].message, 'feat: add | pipes | to subject');
+  assert.equal(commits[0].stats, '3 files changed, 10 insertions(+), 2 deletions(-)');
+
+  // Merge commit: two parents, no shortstat line.
+  assert.deepEqual(commits[1].parents, ['c1', 'c0']);
+  assert.equal(commits[1].stats, '');
+
+  // Root commit: no parents.
+  assert.deepEqual(commits[2].parents, []);
+  assert.equal(commits[2].stats, '1 file changed, 1 insertion(+)');
+});
+
+test('parseGitLogWithStats handles empty output', () => {
+  assert.deepEqual(parseGitLogWithStats(''), []);
+});
--- a/server/routes/taskmaster.js
+++ b/server/routes/taskmaster.js
@@ -12,7 +12,9 @@ import express from 'express';
 import fs from 'fs';
 import path from 'path';
 import { promises as fsPromises } from 'fs';
-import { spawn } from 'child_process';
+// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution — required
+// here since task-master/npx are .cmd shims on Windows.
+import spawn from 'cross-spawn';
 import { projectsDb } from '../modules/database/index.js';
 import { detectTaskMasterMCPServer } from '../utils/mcp-detector.js';
 import { broadcastTaskMasterProjectUpdate, broadcastTaskMasterTasksUpdate } from '../utils/taskmaster-websocket.js';
--- a/server/routes/user.js
+++ b/server/routes/user.js
@@ -1,8 +1,9 @@
 import express from 'express';
+// cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution.
+import spawn from 'cross-spawn';
 import { userDb } from '../modules/database/index.js';
 import { authenticateToken } from '../middleware/auth.js';
 import { getSystemGitConfig } from '../utils/gitConfig.js';
-import { spawn } from 'child_process';

 const router = express.Router();