Git integration: branch picker + worktrees#3

src/main.ts:333 Replacing / with - can cause collisions (e.g., feature/test and feature-test both become feature-test). Consider using a more unique transformation or appending a hash to avoid conflicts.

No longer relevant as of 79fdda9deea9abd21c3036f6a1d1f5004db4a8b2

src/main.ts:359 Shell quoting uses POSIX single quotes, but runTerminalCommand invokes cmd.exe on Windows, so paths with spaces will break. Consider platform-aware quoting/escaping (e.g., double quotes on Windows) or a cross‑platform command builder.

No longer relevant as of 79fdda9deea9abd21c3036f6a1d1f5004db4a8b2

components/ChatView.tsx:162 After dispatching SET_THREAD_BRANCH, ensureSession still reads the stale activeThread from the closure, so worktreePath is null and the session starts in the wrong directory. Consider passing the new worktreePath directly to ensureSession (or to startSession) instead of relying on the updated state.

✅ Addressed in 79fdda9deea9abd21c3036f6a1d1f5004db4a8b2

components/ChatView.tsx:427 Consider setting isSending = true at the start of onSend (before the worktree creation block) to prevent race conditions from rapid submissions.

No longer relevant as of bc70cc4b74e5e0258d35ab90a80aedd3f20f75e2

🟡 Medium

src/git.ts:45 The child.killed flag becomes true immediately after child.kill("SIGTERM") is called, so the SIGKILL fallback is unreachable. Consider tracking process exit separately (e.g., with a flag set in the close event) instead of relying on child.killed.

🚀 Want me to fix this? Reply ex: "fix it for me".

src/git.ts:45 The child.killed flag becomes true immediately after child.kill("SIGTERM") is called, so the SIGKILL fallback is unreachable. Consider tracking process exit separately (e.g., with a flag set in the close event) instead of relying on child.killed.

No longer relevant as of 1d68c4abfadb8ae1dfb50e667622df56872ce227

src/terminal.ts:37 Consider adding a maximum buffer size for stdout and stderr to prevent OOM if commands produce excessive output. Truncate or reject once a limit is reached.

No longer relevant as of bc70cc4b74e5e0258d35ab90a80aedd3f20f75e2

components/BranchToolbar.tsx:150 The SET_THREAD_BRANCH dispatch (lines 169-179) runs even when the git checkout is skipped due to !api || !activeProject. Consider moving these dispatch calls inside the conditional block so UI state only updates after a successful checkout.

No longer relevant as of bc70cc4b74e5e0258d35ab90a80aedd3f20f75e2

🟢 Low

src/git.ts:55 Multi-byte UTF-8 characters split across chunks will corrupt to �. Consider using StringDecoder from node:string_decoder to properly handle partial characters.

🚀 Want me to fix this? Reply ex: "fix it for me".

src/git.ts:151 On Windows, cmd.exe doesn't handle single-quoted arguments correctly. Consider using double quotes on Windows or escaping appropriately for cross-platform compatibility.

✅ Addressed in 807e3d18dec858c9694a595deaea4f9ac588db5f

turbo.json:20 The dev task with "dependsOn": ["^dev"] and "persistent": false will hang indefinitely. Since vite dev servers never complete, dependent tasks wait forever. Consider reverting to the previous approach: depend on build tasks that complete (e.g., @t3tools/contracts#build) and set persistent: true.

No longer relevant as of 7e5cd01d26b21093947cb9b988f5963b8ed6ce26

⚠️ Potential issue | 🟡 Minor

Consider updating vitest to 4.0.18 and clarify tsdown stability.

tsdown@0.20.3 is already the latest stable release and does not represent a major update. However, vitest@4.0.0 is outdated—the current stable patch is 4.0.18. Both versions are compatible with TypeScript 5.7.3, but updating vitest to the latest patch is recommended for bug fixes and stability improvements. Note that the test script currently uses --passWithNoTests, suggesting minimal active test coverage; consider whether vitest configuration and test suite expansion are needed for this Electron desktop application.

⚠️ Potential issue | 🟡 Minor

Use bunx instead of npx in the verification snippet.
This keeps docs consistent with the Bun-only tooling standard.

Based on learnings: Use Bun as the package manager. Use bunx <BIN> when executing scripts from npm packages not installed as a project dependency.

⚠️ Potential issue | 🟠 Major

Replace Vite 8 beta with a stable release version.

Vite 8 remains in beta as of February 2026 with no announced stable release date. Using pre-release versions in production code introduces significant risk of breaking changes and instability. Update to Vite 7.x or wait for Vite 8 stable release before merging.

⚠️ Potential issue | 🟠 Major

Shell-quoted git commands will break on Windows cmd.exe.

Lines 132, 151, 163, and 175 wrap git arguments in single quotes; cmd.exe does not recognize single quotes as delimiters, so paths and branch names will be passed to git with quotes included as literal characters. This breaks on Windows, especially with spaces in paths or branch names.

To fix, spawn git directly with an arguments array instead of a shell command string:

This avoids cmd.exe's quoting rules entirely and works consistently across Windows, macOS, and Linux.

✅ Addressed in commit 198cc58

⚠️ Potential issue | 🟠 Major

Worktree base-branch selection gets overwritten by auto-sync.
In worktree mode (before a worktree exists), the sync effect resets activeThread.branch to the current checked-out branch, which defeats selecting a different base branch for the worktree. Guard the sync to run only for local mode (or only when activeThread.branch is null).

✅ Addressed in commit 807e3d1

Vitest run broken This config aliases @t3tools/contracts to the TypeScript source entry (packages/contracts/src/index.ts). With the PR’s build changes, tests now fail at runtime with TypeError: undefined is not an object (evaluating '__vite_ssr_import_0__.z.object'), which indicates the Zod import in those aliased sources isn’t being resolved correctly under Vitest’s SSR transform.

Since bun run test is part of the repo workflow, this needs to be fixed before merge (either by adjusting the alias/optimizeDeps/ssr settings or changing how contracts are imported in tests).

🟢 Low

src/git.ts:191 Suggestion: user-supplied branch names can be misparsed as options or pathspecs. Add -- before branch arguments across git calls (e.g., branch, checkout), or prefer git switch for switching branches to avoid ambiguity.

🚀 Want me to fix this? Reply ex: "fix it for me".

🟡 Medium

components/BranchToolbar.tsx:75 The useEffect at line 75 reverts the thread branch to match Git HEAD when activeWorktreePath is null. However, the new worktree mode (lines 118-123) also has null activeWorktreePath but intentionally sets a different branch without checkout. Consider adding envMode !== "worktree" to the effect's early return to prevent it from overwriting the user's base branch selection.

🚀 Want me to fix this? Reply ex: "fix it for me".

🟢 Low

components/BranchToolbar.tsx:57 The chained createBranch().then(checkout) in createBranchMutation can leave git state out of sync with UI if checkout fails after branch creation succeeds. Consider separating these into distinct operations or refreshing branch state in onError to stay in sync.

🚀 Want me to fix this? Reply ex: "fix it for me".

⚠️ Potential issue | 🟠 Major

Remove trailing commas to fix JSONC parse errors.

Biome reports parse errors at the closing braces; the trailing commas before } are the likely cause and will break lint/CI.

⚠️ Potential issue | 🟠 Major

Remove trailing commas to fix JSONC parse errors.

Biome reports parse errors at the closing braces; the trailing commas before } are the likely cause and will break lint/CI.

⚠️ Potential issue | 🟠 Major

Remove trailing commas to fix JSONC parse errors.

Biome reports parse errors at the closing braces; the trailing commas before } are the likely cause and will break lint/CI.

⚠️ Potential issue | 🟡 Minor

Chained mutation may leave inconsistent state on partial failure.

If createBranch succeeds but checkout fails (e.g., due to uncommitted changes), the error message incorrectly says "Failed to create branch" even though the branch was created. Additionally, since onSuccess won't fire, the branch list won't refresh, hiding the newly created branch from the user.

Consider separating into two distinct operations or providing accurate error messaging for partial success scenarios.

⚠️ Potential issue | 🟡 Minor

Align port environment variable names between web and desktop dev scripts.

The web app uses PORT while the desktop dev script uses ELECTRON_RENDERER_PORT. Both default to 5173, so they match in typical usage, but if someone sets only one to a custom value, the Electron app will fail to connect to the dev server. Either use a single env var name across both or document the relationship clearly.

Medium: isRepo logic is inverted from the stated intent

The comment says "Default to true while loading," but the expression doesn't do that:

On a cold first load, data is undefined and isLoading is true, so undefined ?? false = false — the "Initialize git" button flashes even for valid repos.

The intent (per the comment) should be:

Additionally, the "Initialize git" button is not disabled during query loading (disabled={!branchCwd || initMutation.isPending}), so a user could click git init on an already-initialized repo during the brief loading window.

High: Schemas defined but never enforced

The zod schemas in packages/contracts/src/git.ts (gitListBranchesInputSchema, gitCreateWorktreeInputSchema, etc.) are well-defined but purely decorative — every git handler casts request.params as never, skipping validation entirely.

While the shell-free runGit prevents shell injection, unvalidated branch names with git metacharacters (e.g. --, leading -, ..) could cause argument injection into git commands. For example, a branch name like --upload-pack passed to git checkout could trigger unexpected behavior.

Should be:

The contracts package exists specifically for this — the schemas should be the enforcement boundary.

Medium: Orphaned worktree on downstream failure

The worktree is created and dispatched to the store here, but if ensureSession (line 496) or sendTurn subsequently fails, the worktree directory remains on disk with no cleanup. There's a removeGitWorktree IPC method but it's never called on any error path.

Consider wrapping the entire send flow (worktree creation → ensureSession → sendTurn) in a try/catch that rolls back the worktree:

Also — this ~30 lines of branch-naming + worktree creation + dispatch + error handling is embedded directly in handleSend. Per AGENTS.md's maintainability guidance, it should be extracted into a prepareWorktreeSession() helper.

Medium: Worktree path collision on identical repo basenames

path.basename(input.cwd) extracts only the final directory component. Two repos with the same basename (e.g. ~/work/t3code and ~/projects/t3code) produce colliding worktree paths:

The second repo's git worktree add would fail with "already exists" or silently reuse the first repo's worktree.

Consider incorporating a short hash of the full cwd:

Low: branchCwd! non-null assertions in mutations

The query is gated with enabled: !!api && !!branchCwd, but the mutations all use branchCwd! without re-checking. If activeProject?.cwd is undefined (e.g. project not yet loaded), the mutation sends cwd: undefined to the server, which would fail or behave unexpectedly.

Consider guarding each mutation with an early return:

Low: Hardcoded codething/ prefix

This is the legacy project name. It should be a named constant or configurable, especially since the rest of the codebase uses "t3" branding (~/.t3/worktrees/...).

Low: runTerminalCommand left in git.ts

This general-purpose shell executor (spawn with -lc / /d /s /c) sits alongside the shell-free runGit. It's only used by the test helper now (git.test.ts). Shipping a shell-execution function in the git module is a latent footgun — it could easily be reused for user-facing operations, reintroducing the shell quoting/injection surface that runGit was specifically created to eliminate.

Consider moving it to a separate shell.ts module or making it test-only (not exported from the production module).