47 roadmap steps across 8 items · 9 issue fixes · 35 other changes
v0.5.17 adds a library-first surface for branches, tags, fetch/pull/push, merge/pick/revert conflicts, history editing and tree-sha256, plus non-UTF-8 path, empty-tree and SHAttered fixes.
Adds a linkable tree-sha256 digest engine that hashes canonical path records, recursively includes checked-out submodules, reports exclusions/cycles/missing submodules, and supports SHA-1 and SHA-256 repositories. Round 3 makes the golden vector self-contained by replacing an orphan gitlink with a complete Git bundle and retains the earlier recursion/path fixes.
Adds a linkable annotated-tag codec for tree-sha256 claims. Callers can read a typed claim from TagData or replace a claim while preserving unrelated tag headers in reference-tool byte order.
Adds a public repository API that verifies an annotated tag's appended SSH/OpenPGP signature and, when present, recomputes its tree-sha256 claim concurrently. It returns typed signature and digest verdicts, with documentation, an example binary, and compatibility/coverage tests.
Adds a modern multi-tag verification path that reports signature and tree-sha256 results in human, JSON, and Markdown forms, with exit status reflecting aggregate success. The round-4 correction makes argv preprocessing preserve post-subcommand global option values without regressing multiple tag names.
Makes collision-checked hashing the only object-id API and propagates collision errors through object creation, diff, pack, transfer, and worktree paths. Round 3 closes the remaining copy-detection error swallow, fixes the object-hash Criterion closure, and switches the hash benchmark from git.git's intentional collision payloads to an existing synthetic repacked repository.
Makes SHA-1 object-ID hashing collision-checked and fallible across grit-lib, propagates typed failures through all affected object/pack/diff paths, and removes a redundant large-payload collision pass from loose writes. It commits and registers the after-baseline, updates generated benchmark selection, and documents measured system-git comparisons.
Adds update-only and dry-run staging with path-level outcomes across the library and CLI, plus shared pathspec-file parsing and benchmark registrations. The latest fix handles deleted unmerged paths for pathless add -u, but the previously reported dry-run classification bug is still present.
Adds explicit intent-to-add and force-ignored staging to the library and exposes them as `grit add -N/--intent-to-add` and `-f/--force`. Intent entries use the repository's hash algorithm, serialize in a Git-compatible index, and are reported consistently in human, JSON, and Markdown output; this round fixes the previously missing Markdown path list.
Adds side-effect-free commit planning and `grit commit --dry-run`, returning typed per-file status (including rename origins) in library and CLI outcomes without writing objects, index, refs, reflogs, hooks, or commit-message state. The stacked work also supplies scoped commits, author/message/hook handling, reusable pathspec parsing, documentation, compatibility tests, and a daily dry-run benchmark.
Adds the modern commit P1 flags for author dates, trailers/signoff, author reset, message/author reuse, and signing overrides through a library-first `CommitRequest` API and thin CLI wiring. It also restores structured commit outcome/hook metadata, updates public API/docs, and adds CLI/library compatibility coverage against system Git.
Adds an end-to-end agent workflow for precise status, staging, path commits, staged commits, and conflict completion, backed by library-first staging/commit/status APIs and consistent CLI/docs output. The review fixes preserve dry-run state, correctly preview amend metadata, retain intent-to-add paths in Markdown, and restore accepted large-repository benchmark captures.
Adds worktree-only conflict restoration for unmerged paths: callers and CLI users can select ours/theirs or reconstruct merge, diff3, or zdiff3 markers. The review fixes make add/add and binary conflict shapes match system Git byte-for-byte while retaining the unmerged index and resolve-undo behavior.
This change centralizes merge-style conflict classification and operation guidance in grit-lib, then exposes structured conflict objects and actionable guidance through merge/pull JSON v2 and shared human/Markdown rendering. The review follow-up preserves both published v1 contracts and corrects snapshots, abort guidance, and generated schema links.
Adds a typed library operation that finishes an in-progress merge from the resolved index, then exposes it as `grit merge --continue`. It preserves Git repository compatibility, stamps the merge commit change-id, clears merge state, and reports stable human/JSON/Markdown next steps and source labels.
Adds an in-memory merge prediction API and exposes it as `grit merge --check`, returning clean, conflict, fast-forward, or up-to-date outcomes without modifying repository state. The final review fixes make benchmark execution independent of the grit CLI and ensure human and Markdown text describes predictions rather than completed or started merges.
Adds a public multi-commit pick/revert sequence engine that can stop on conflicts or empty changes, persist Git-compatible operation state, and continue, skip, or abort safely. The round-2 patch fixes partial-progress abort restoration, cumulative --no-commit behavior, and Git continuation option interoperability.
This stack introduces a reusable `grit-lib` replay-sequence engine and rewires `grit revert` for multi-commit/range operation, merge mainlines, conflict stop/resume/abort/skip, empty policies, no-commit, dry-run, and structured output. It also adds Git sequencer interoperability coverage, public API docs/examples, and expanded CLI schemas/tests.
Pull orchestration now lives in grit-lib, with the CLI reduced to argument forwarding and rendering. It supports up-to-date, fast-forward, merge, ff-only refusal, conflicts, and unborn-branch adoption outcomes, including config-driven pull.ff behavior and correct handling of missing configured upstream refs.
Adds typed explicit fetch-refspec resolution shared by local, wire, and bundle fetches, including DWIM sources, destinations, tracking updates, typed rejection errors, and FETCH_HEAD policies. Round-three restores established immutable progress API signatures, but the named-remote public entry point still omits FETCH_HEAD for explicit refspecs.
Adds atomic pull-with-rebase through the history rewrite engine, including config and CLI selection, structured outcomes, docs, compatibility coverage, and a daily benchmark scenario. The round-3 fix correctly replays a genuine two-line local merge without dropping either branch's content and refreshes the skill snapshot.
Adds a shared fetch argument group and supports explicit fetch refspecs, tag/prune overrides, dry-run, quiet mode, richer per-ref status output, and rejected-update exit behavior. The library resolves fetch invocation/refspec semantics and dry-run update classification; CLI code remains focused on argument forwarding and rendering.
Adds typed shallow-fetch depth control across grit-lib and the `grit fetch` CLI, including relative deepen and unshallow behavior. It negotiates the correct v0/v1 and v2 wire forms, updates local shallow boundaries, reports boundary deltas in JSON, and adds compatibility and daily benchmark coverage.
Adds typed push force policy to grit-lib and exposes unconditional force and tracking/value force-with-lease in the modern CLI. Push planning carries expected-old/expect-absent checks through deletion as well as update refspecs, reports stale leases in JSON/human output, updates tracking refs after success, and adds compatibility tests and a daily benchmark scenario.
Adds sequential multi-remote fetch to the library and exposes it as `grit fetch --all`. It honors config order, skipFetchAll, each remote's tag/prune settings, continues after individual failures, and returns a dedicated aggregate JSON shape with exit 1 on partial failure.
Adds modern push controls for setting upstreams, atomic updates, server push options, and following reachable annotated tags. The round-4 correction makes follow-tags work for commit refspecs targeting custom namespaces and keeps JSON upstream reporting correctly present only after an upstream is actually set.
Adds explicit remote/branch pull resolution through FETCH_HEAD, automatic dirty-worktree stashing, and a fetch-then-predict check mode without integrating. The CLI reuses shared fetch arguments and exposes stable human, JSON, and Markdown outcomes, while the daily benchmark matrix gains pull/check coverage.
Extends the embedded grit skill and user documentation with practical fetch, pull, and safe push workflows. The round-two fix commit also closes the five CLI behavior findings: mutually exclusive branch mutations, usage exit codes, zero fetch depth, ordered reverts, and dry-run sequencer safety.
This change introduces a shared grit-lib reference query API for namespace filtering, short-name patterns, name/version/date sorting, reversal, limits, peeling, and in-memory remote-ref inputs. It routes tag helpers through that engine and adds public API, Git-compatibility, oracle, and benchmark coverage, but its portable version comparator is currently incorrect.
This adds force replacement, file/stdin messages, positional targets, and dry-run behavior to tag creation/deletion through a typed grit-lib API and thin CLI wiring. It also updates all output contracts, agent guidance, snapshots, and system-Git compatibility coverage.
Adds typed, library-first branch creation, force reset, safe/forced deletion, and upstream configuration. Branch creation now validates that start objects peel to commits before touching refs, shares tracking policy with switch, and preserves Git-compatible refs, reflogs, and branch config.
Remote reference advertisements now use the shared in-memory ref query for ls-remote tail patterns, name/version sorting, reverse order, and post-sort limits. The round-2 correction preserves match-all only for an absent pattern list and makes an explicitly empty pattern return no refs, matching system git.
Switch overwrite refusals are now typed library errors with stable reason/path data, and switch supports a true preflight mode that resolves and checks the target without changing repository state. The CLI exposes this as long-only --dry-run and renders consistent human, JSON, and Markdown results, with schemas and agent docs updated.
Adds a typed branch inventory and upstream-status API with cheap names-only and parallel full-detail modes, including worktree, commit subject/time, and ahead/behind data. Round 3 corrects full-detail subjects to match Git for whitespace-bearing and empty commit messages.
Adds a library-first branch rename operation that moves the branch ref and reflog transactionally, preserves branch config, and retargets HEAD in the main and linked worktrees. It supports files, packed refs, reftable, and injected ref stores, including force, dry-run, unborn HEAD, and case-only renames.
History rewrite results now carry a first-line commit subject in every rewritten row and expose `ref` as the canonical ref-update key while retaining deprecated `name` for one release. Human and Markdown output, JSON schemas, snapshots, tests, docs, and the public API snapshot are updated together.
Adds a typed library rebase-planning API that finds the merge-base fork, detects no-op rebases, returns conflicts as values, and bounds cherry detection to the divergent onto-side history. The round-3 fix preserves full-patch identity while using paths only to prune candidates, and isolates the benchmark/test counter per thread.
Adds the modern `grit history split` command for peeling selected paths into a newly inserted parent commit while preserving the target tree and replaying descendants. It forwards to the existing typed grit-lib split planner, supports dry-run and all output modes, and returns the shared history rewrite outcome.
Dry-run absorb plans now expose a stable hunk range, target commit, and target subject in human, JSON, and Markdown output. Markdown remains structurally valid when Git paths or commit subjects contain pipes, and dry-run behavior is regression-tested not to alter repository state.
Adds author rewriting to history reword while preserving the existing message-only API. Callers can change the message, author, or both; omitted author dates retain the original commit timestamp, and whitespace-only author input no longer blocks an otherwise valid message rewrite.
History rewrite flags are now consistent across drop, move, reword, fixup, squash, and absorb. Users can choose how replay-created empty commits are handled and preserve source committer lines, including on the squash fast path and absorb planning.
Adds a library-level resumable rebase session that preserves successfully replayed commits when a later commit conflicts. It leaves Git-compatible stop state, supports continue/skip/abort, keeps branch refs untouched until completion, and synchronizes HEAD, index, and worktree to the final rewritten tip.
History rewrites now leave a versioned, atomic record of their ref movement and expose a library-first undo operation that safely reverses the latest rewrite. The CLI adds `grit history undo`, including stable JSON/Markdown data and dry-run behavior, while a second undo reapplies the original rewrite.
Adds stable 12-hex hunk identifiers to grit-lib and exposes `id` plus zero-based `index` in staged and unstaged patch-detail JSON. The round-3 peer-side duplicate ranking keeps a later byte-identical insertion selectable after an earlier twin is staged.
Adds index-only unified patch application to grit-lib and exposes it as `grit add --patch-file`, including dry-run and structured output. The follow-up commit closes the review’s compatibility gaps for newline markers, deletion preimages, SHA-256 repositories, path collisions, modes, snapshots, and lock ordering.
This makes normal and prehashed ODB writes distinguish a virtually readable empty tree from one actually stored in the repository. Empty-root commits and commits that remove every file now leave repositories that system Git can validate and clone cleanly.
Diff alignment now treats a terminated line as distinct from identical text at EOF without a newline, so appending after an unterminated last line produces the required delete/re-add pair. Human structured output, JSON/stat derivations, and Markdown now consistently preserve the two EOF markers.
Preserves non-UTF-8 repository paths losslessly across status, diff, staging, restore, clone, and checkout. The final review fixes ensure tracked restaging, slow checkout's up-to-date path, and gitlink untracked suppression all use raw index/OS bytes at filesystem boundaries instead of the reversible display string.
Grit now returns a typed library error when an add path crosses a symlinked directory instead of silently staging nothing. The review follow-up also covers directory-style trailing slashes and records the new error in the generated public API snapshot.
Worktree scans now silently exclude FIFOs, Unix sockets, device nodes, and other non-indexable entries before status or staging can open them. Regular files continue through add and commit, with library and CLI regressions covering status parity, staging, auto-stage commit, JSON output, and Git fsck compatibility.
Tree composition now removes a directory entry when recursively merging that directory produces Git's canonical empty tree. It also sanitizes an unchanged ours-side directory entry that already points at an empty tree, preventing replay and merge operations from creating commits with empty subtrees.
Push JSON now distinguishes the machine-readable branch from the human display label. A single branch deletion reports the deleted branch’s short name, while tag and multi-ref pushes omit the ambiguous field; human and Markdown text retain their prior labels.
Grit now accepts SHA-1 repositories and worktree content containing SHAttered test vectors instead of aborting on a raw-payload sha1dc signal. Canonical Git object ids remain byte-compatible, and fsck no longer treats this Git-accepted content as fatal.
Preserves arbitrary Unix filename bytes across status, diff, add, clone, restore, and checkout additions using a reversible stored-string representation and raw-byte worktree joins. Round two also makes the reserved encoding prefix injective, moves the regression to grit-lib APIs, and fixes the prior lint/Bugbot findings, but checkout deletions remain incorrect for those encoded paths.
Makes the POSIX pickaxe regex adapter compile and behave safely on musl without changing the bounded glibc/BSD path. It also locks in exact-length-buffer safety and correct ^ anchoring during continuation scans.
The branch keeps coexisting legacy `gitbutler-change-id` metadata when rewriting a commit that already has a canonical `change-id`, while still migrating legacy-only commits. It also teaches docs validation to recognize rustdoc's `tymethod.*` anchors for required trait methods; the effective tree contains and tests all three corrected conflict-rendering behaviors requested in round two.
Adds a read-only tree SHA-256 digest API with compatibility fixtures, documentation, examples, and benchmarks, then closes the final review defects in mode handling, stale-index diff composition, and golden generation. The round-2 changes hash all regular-file mode variants and preserve one-row-per-path WorktreeVsHead behavior.
This branch withdraws its branch-only change-id API work because the effective behavior fix already landed on main. Its resulting tree is exactly identical to origin/main, so integration would add an empty audit commit and no code.
This replaces repeated one-way scans of first-parent history with one two-sided ancestry classification that can stop near the answer, then reuses that result for merge-base and left/right counting. It also validates pack-bitmap source checksums by reading only the file trailer instead of loading an entire pack or MIDX.
This change makes blame skip unchanged history without retaining full commits or trees, while preserving one parsing behavior for loose and packed objects. It also avoids unnecessary tree decoding and pack inflater allocation, cutting the headline git.git blame workload from 940 ms/599 MiB to 385 ms/273 MiB in my measurements.
Repairs the Windows-only compilation paths and makes fixup compatibility tests compare like-for-like by disabling Grit change IDs in Git-oracle fixtures. The round-2 follow-up restores the history harness's monotonic timestamp contract for `commit-tree` and adds a regression test over a three-commit DAG.
Configured named remotes now populate FETCH_HEAD when fetched with an explicit refspec through `Remote::fetch`. The default source label comes from the effective fetch URL, and caller-supplied labels remain unchanged.
Adds non-mutating commit previews with stable JSON file/parent/author/hook fields, path-scoped and staged commit support, and documented human/JSON/Markdown behavior. The review follow-ups restore Markdown change IDs and harden staging paths, but the post-commit hook still receives the temporary partial-commit index.
Default-order bounded rev walks now stream until the requested page is full at any limit, instead of walking and sorting the entire reachable history above 4096 commits. The walk can also retain parsed commit data for the log renderer, eliminating a second object read/inflate while preserving Git order.
Repairs the CI-specific breakages around tag test construction, strict rustdoc, and the canonical module-layout guard. It also corrects pull command documentation/schema and uses the supported explicit v2 installer form for cargo-llvm-cov.
This adds a reusable ref-query engine for namespace filtering, patterns, name/version/date sorting, limits, and peeled targets, then routes tag listing through it. The review follow-up fixes empty prerelease suffix ordering, symbolic-ref peel leakage, and dangling-object date sorting, with direct system-Git compatibility coverage.
Nested submodule hashing now preserves a missing checkout’s already top-level-qualified path while unwinding recursion. A missing leaf under inner/mid is therefore reported as inner/mid/leaf through both tree_sha256 and signed-tag verification, instead of duplicating ancestor prefixes.
Pull planning and integration now live in grit-lib, including fetch-refspec-aware upstream resolution, local-remote handling, unborn-branch adoption, compare-and-swap ref updates, and typed outcomes/errors. The CLI is reduced to plan, fetch, integrate, and render, and failed post-update reflog appends are surfaced as warnings without falsely reporting a failed pull.
Adds modern commit controls for dates, trailers/signoff, author reset, message reuse, and signing overrides through a library-first API with thin CLI wiring. The final compatibility fix prevents malformed timezone text from reaching commit objects, while preserving canonical numeric offsets and normalizing Git-compatible raw dates.
This adds a typed library-level push planning layer and keeps the CLI as a renderer/transport caller. The final fixes make configured exclusions independent of config order, preserve Git-compatible matching behavior, correctly classify literal remotes, and restore the CLI architecture guard.
This consolidates every core.logAllRefUpdates value interpretation into one grit-lib parser and routes files/reftable decisions through it. It removes two hand-written config scanners, fixes reftable handling of standard boolean spellings, and adds six focused tests.
This change removes obsolete identity helpers that survived the deleted compatibility CLI and folds the loose committer name/email resolution into one direct, documented chain. Production identity code shrinks while preserving strict and best-effort fallback behavior; focused tests pin the subtle empty-variable and user.useConfigOnly cases.
This change removes avoidable allocation and sorting costs from status scans, and splits untracked traversal below a single top-level directory so workers stay busy on common synthetic and real layouts. It adds serial/system-git oracle coverage and documents the parallel traversal; round 2 removes five accidentally committed insta scratch files without changing the approved code.
Restores the missing daily benchmark scenario registrations and fixes CI-facing docs/rustdoc checks. It also makes commit dry-run build a correct in-memory index with real blob IDs, rejects CR/LF author injection, and keeps add dry-run list-only.
Corrects branch mutation dispatch so a leading positional branch is the rename source and local tracking previews use the same canonical upstream name as live creation. It also closes remaining incompatible delete-flag paths without changing repository formats or public signatures.
Adds the library-first pick/revert sequence engine, Git-compatible sequencer state, conflict stop/continue/skip/abort behavior, no-commit and empty policies, structured created-commit records, status guidance, public API documentation, and an executable conflict guide. The latest fix moves the empty resolved-tree validation ahead of step-head/todo mutation so a failed continue retains the current sequence entry.
This replaces repeated linear sparse-path scans with a prefix index, shares parsed trees, and avoids rebuilding and writing the checkout index twice. It also trusts an already-collected clean lstat in the dense worktree diff path, cutting pick and revert dramatically while preserving Git-readable trees and indexes.
Conflict continuation for `grit revert --no-commit` now advances the sequence without writing a commit, preserving the branch tip while keeping the resolved index. The broader branch adds multi-commit/range revert sequencing, mainline handling, stop/continue/abort/skip, modern CLI output, docs, and Git interoperability coverage.
Ref creation now avoids materializing every ref and reflog when checking namespace conflicts, indexes large packed-refs through a mapped view, and reuses the repository's ref/config state. The round-2 addition makes the final under-lock create check authoritative even if packed-refs is atomically replaced without an observable length/mtime change.
Repairs the CI-specific clippy, rustdoc, canonical-module, snapshot/JSON-contract, and revert-validation failures without changing on-disk or wire formats. The round-3 amendment makes the revert prevalidation closure rustfmt-clean while retaining the regression that proves a mixed commit/tree input cannot partially mutate a repository.
This change makes the SHA abstraction coverage guard distinguish actual `Sha256::` paths from longer identifiers such as `TreeSha256::`. It also caps Cargo build/link concurrency at one for coverage, normal workspace tests, and release threaded tests to avoid the observed lld signal-7 bus errors.
This hardens daily remote benchmarks so successful timing means the command actually changed the expected repository state. Push preparation now generates fresh commit IDs on every cycle, and transport-aware checks prove file and HTTP targets did not have the tip before timing and do have it afterward.
This change gives reftable parsing, stack locking, and compare-and-swap rejection a structured public error model instead of overloaded `InvalidRef`/`Message` strings. The reftable ref-store boundary now maps lock and CAS errors by type, and decoder error construction is kept off hot paths.
Adds an executable CI helper that removes large, unused hosted-runner SDK/tool caches and prunes Docker images. Coverage, workspace test, and release-threaded test jobs invoke it immediately after checkout, before their large Rust builds.
This branch repairs the 2026-10-21 performance and correctness regressions across show/log decoration lookup, bundle object walking, staged/worktree diff construction, gc/repack, commit-graph memory, SHA-1 collision handling, and daily worktree setup. The round-3 amendment restores fast standalone prune validation by checking packed blob IDs against pack indexes loaded once, while retaining missing-object and non-canonical tree-mode correctness.
This branch repairs fetch refspec planning so negative refspecs are honored and vanished explicit refs can be pruned. The round-2 changes additionally map short explicit fetches to configured tracking destinations and preserve missing HEAD as the symbolic ref, while CI selects GNU bfd for large test links.
Adds a public blob-level unified-diff application engine to grit-lib, including reverse application, offset/context search, no-newline handling, overlap protection, and typed failures. The follow-up makes zero-context duplicate-line hunks apply at their header location instead of being incorrectly pinned to EOF, while preserving EOF behavior for contextual hunks.
This keeper branch is empty because the reported fetch failures were fixed on main before the author finished. Both regression scenarios now pass on the reviewed tip and current main, so integrating this branch is a no-op.
Moves remote discovery, validation, add/config writes, remote argument resolution, peeled-ref folding, and fetch outcome classification into grit-lib, leaving grit-cli primarily responsible for rendering. The round-2 amendments ensure linked-worktree remote configuration matches Git and URL-less remote sections are classified consistently.