Drop the workspaceRoot parameter from resolveToolchainPaths /
Toolchain.resolvePaths entirely. The old code resolved
\`<workspaceRoot>/native/dugite/bin/git\` as the git binary before
falling back to PATH — a malicious repo could commit an executable
at that path and clide would run it on the first auto-fired
git.status (which fires automatically on workspace open).
Dugite now resolves against trusted locations only:
1. CLIDE_DUGITE_DIR env var (dev override).
2. <exe-parent>/dugite/bin/git (production bundle).
3. <exe-parent>/lib/dugite/bin/git (alternate bundle layout).
Test plants `native/dugite/bin/git` in a temp workspace and asserts
the resolved git path is NOT inside the workspace.
Callers updated (8 sites): main.dart, backend_entry.dart twice,
test_app.dart three times (compute now wraps a no-arg call), plus
five test fixtures. backend.dart's now-vestigial hintRoot left in
the struct for cleanup under T-99.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`lib/kernel/src/toolchain.dart` is a `ChangeNotifier`, so it pulls in
`package:flutter/foundation.dart`. `GitClient` and `PqlClient` imported
it for the resolved binary paths, which leaked Flutter through the
`package:clide/clide.dart` barrel — breaking `dart test` on every core
subsystem suite (`ci/test_core.sh`), since pure Dart can't compile
Flutter packages.
Split the Flutter-free pieces into `toolchain_paths.dart`: `ResolvedPaths`,
`resolveToolchainPaths`, and a new read-only `ToolchainView` interface
with a `ToolchainView.resolved()` const factory. `Toolchain` now
implements `ToolchainView`; the clients depend on the interface. Core
test setups that built a `Toolchain` just to call `applyResolved`
switch to the factory.
Co-Authored-By: Claude <noreply@anthropic.com>
Two test additions toward finishing src/daemon/:
- test/daemon/dispatcher_test.dart (6 tests): the entire
DaemonDispatcher surface — ping + version default handlers,
unknown-command not-found error, register routing, isEmpty
before/after registration, clear preserving ping + version.
- test/daemon/git_commands_test.dart extended (14 new tests): the
git.* commands the existing suite didn't reach — git.diff with
paths, git.stage-hunk + git.unstage-hunk (happy + missing-patch
+ bad-patch GitException), git.branches, git.checkout (happy +
missing + unknown), git.log with count, git.push + git.pull both
with and without a local bare remote, git.stage accepting a
String single-path arg via _pathList.
Coverage: src/daemon/dispatcher.dart 8/22 -> 22/22 (100%);
src/daemon/git_commands.dart 73/146 -> 122/146 (84%). The
remaining 24 lines in git_commands are mid-call GitException
catch branches that need the git client to fail after the
dispatcher accepted the request.
Total coverage 77.05% -> 77.92%.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
12 imports flagged by `unnecessary_import` because the symbols
they bring in are also re-exported by the umbrella import already
present in the same file:
- bin/clide.dart: src/git/client.dart, src/pql/client.dart
(covered by package:clide/clide.dart).
- lib/builtin/decisions/, lib/builtin/tickets/ (4 files):
kernel/src/events/message_bus.dart (covered by kernel.dart).
- lib/kernel/src/ipc/in_process.dart: src/daemon/dispatcher.dart
(covered by clide.dart).
- lib/main.dart: kernel/src/toolchain.dart (covered by kernel.dart).
- test/builtin/ipc_status/widget_test.dart:
builtin/ipc_status/src/status_item.dart (covered by
ipc_status.dart).
- test/daemon/{git,pql}_commands_test.dart: src/git/client.dart and
src/pql/client.dart (covered by clide.dart).
- test/widgets/multitab_pane_test.dart: widgets/src/icons/x.dart
(covered by widgets.dart).
Mechanical change — every removed line was already a no-op for
symbol resolution; the umbrella imports define the public surface
each file is actually using.
Co-Authored-By: Claude <noreply@anthropic.com>
Toolchain centralizes binary resolution — replaces five ad-hoc
mechanisms (expandedPath, _resolveGit, _resolve, _resolvePtyc,
_existsOnPath). Resolves via Future.delayed after runApp to avoid
blocking the merged UI/platform thread on macOS.
GitClient wraps all git operations with a typed API. Every subprocess
call goes through _run() using toolchain.git + toolchain.gitEnv.
Replaces free functions in operations.dart.
Native directory picker: NSOpenPanel on macOS (method channel in
AppDelegate), GtkFileChooserDialog on Linux. Falls back to text-input
dialog on web or MissingPluginException. Shows "No git repo found"
dialog when the selected directory is not a git repository.
PqlClient and pane commands updated to use Toolchain. ToolCheck
replaced by Toolchain.missing/allOk. All IPC handlers now catch
GitException to prevent unhandled exceptions on the merged thread.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Shell-outs to git for status (porcelain v1/v2), unified-diff
parsing, and operations (stage, unstage, hunk-apply, discard,
commit, stash, log, pull, push). IPC verbs git.* registered on
the daemon dispatcher with git.changed event emission on
mutations. 42 new core tests.
Co-Authored-By: Claude <noreply@anthropic.com>
jpmschweitzerandClaude Opus 4.7