Merge pull request #782 from gsxdsm/feat/mobile-improvements

Feature: Comprehensive mobile improvements and bug fixes

.github/actions/setup-project/action.yml

@@ -25,17 +25,24 @@ runs:
         cache: 'npm'
         cache-dependency-path: package-lock.json
 
-    - name: Check for SSH URLs in lockfile
-      if: inputs.check-lockfile == 'true'
-      shell: bash
-      run: npm run lint:lockfile
-
     - name: Configure Git for HTTPS
       shell: bash
       # Convert SSH URLs to HTTPS for git dependencies (e.g., @electron/node-gyp)
       # This is needed because SSH authentication isn't available in CI
       run: git config --global url."https://github.com/".insteadOf "git@github.com:"
 
+    - name: Auto-fix SSH URLs in lockfile
+      if: inputs.check-lockfile == 'true'
+      shell: bash
+      # Auto-fix any git+ssh:// URLs in package-lock.json before linting
+      # This handles cases where npm reintroduces SSH URLs for git dependencies
+      run: node scripts/fix-lockfile-urls.mjs
+
+    - name: Check for SSH URLs in lockfile
+      if: inputs.check-lockfile == 'true'
+      shell: bash
+      run: npm run lint:lockfile
+
     - name: Install dependencies
       shell: bash
       # Use npm install instead of npm ci to correctly resolve platform-specific

.husky/pre-commit

@@ -38,6 +38,18 @@ else
   export PATH="$PATH:/usr/local/bin:/opt/homebrew/bin:/usr/bin"
 fi
 
+# Auto-fix git+ssh:// URLs in package-lock.json if it's being committed
+# This prevents CI failures from SSH URLs that npm introduces for git dependencies
+if git diff --cached --name-only | grep -q "^package-lock.json$"; then
+  if command -v node >/dev/null 2>&1; then
+    if grep -q "git+ssh://" package-lock.json 2>/dev/null; then
+      echo "Fixing git+ssh:// URLs in package-lock.json..."
+      node scripts/fix-lockfile-urls.mjs
+      git add package-lock.json
+    fi
+  fi
+fi
+
 # Run lint-staged - works with or without nvm
 # Prefer npx, fallback to npm exec, both work with system-installed Node.js
 if command -v npx >/dev/null 2>&1; then

apps/server/src/index.ts

@@ -66,6 +66,10 @@ import { createCodexRoutes } from './routes/codex/index.js';
 import { CodexUsageService } from './services/codex-usage-service.js';
 import { CodexAppServerService } from './services/codex-app-server-service.js';
 import { CodexModelCacheService } from './services/codex-model-cache-service.js';
+import { createZaiRoutes } from './routes/zai/index.js';
+import { ZaiUsageService } from './services/zai-usage-service.js';
+import { createGeminiRoutes } from './routes/gemini/index.js';
+import { GeminiUsageService } from './services/gemini-usage-service.js';
 import { createGitHubRoutes } from './routes/github/index.js';
 import { createContextRoutes } from './routes/context/index.js';
 import { createBacklogPlanRoutes } from './routes/backlog-plan/index.js';
@@ -300,7 +304,7 @@ app.use(
           callback(null, origin);
           return;
         }
-      } catch (err) {
+      } catch {
         // Ignore URL parsing errors
       }
 
@@ -328,6 +332,8 @@ const claudeUsageService = new ClaudeUsageService();
 const codexAppServerService = new CodexAppServerService();
 const codexModelCacheService = new CodexModelCacheService(DATA_DIR, codexAppServerService);
 const codexUsageService = new CodexUsageService(codexAppServerService);
+const zaiUsageService = new ZaiUsageService();
+const geminiUsageService = new GeminiUsageService();
 const mcpTestService = new MCPTestService(settingsService);
 const ideationService = new IdeationService(events, settingsService, featureLoader);
 
@@ -372,7 +378,7 @@ eventHookService.initialize(events, settingsService, eventHistoryService, featur
   let globalSettings: Awaited<ReturnType<typeof settingsService.getGlobalSettings>> | null = null;
   try {
     globalSettings = await settingsService.getGlobalSettings();
-  } catch (err) {
+  } catch {
     logger.warn('Failed to load global settings, using defaults');
   }
 
@@ -390,7 +396,7 @@ eventHookService.initialize(events, settingsService, eventHistoryService, featur
       const enableRequestLog = globalSettings.enableRequestLogging ?? true;
       setRequestLoggingEnabled(enableRequestLog);
       logger.info(`HTTP request logging: ${enableRequestLog ? 'enabled' : 'disabled'}`);
-    } catch (err) {
+    } catch {
       logger.warn('Failed to apply logging settings, using defaults');
     }
   }
@@ -417,6 +423,22 @@ eventHookService.initialize(events, settingsService, eventHistoryService, featur
         } else {
           logger.info('[STARTUP] Feature state reconciliation complete - no stale states found');
         }
+
+        // Resume interrupted features in the background after reconciliation.
+        // This uses the saved execution state to identify features that were running
+        // before the restart (their statuses have been reset to ready/backlog by
+        // reconciliation above). Running in background so it doesn't block startup.
+        if (totalReconciled > 0) {
+          for (const project of globalSettings.projects) {
+            autoModeService.resumeInterruptedFeatures(project.path).catch((err) => {
+              logger.warn(
+                `[STARTUP] Failed to resume interrupted features for ${project.path}:`,
+                err
+              );
+            });
+          }
+          logger.info('[STARTUP] Initiated background resume of interrupted features');
+        }
       }
     } catch (err) {
       logger.warn('[STARTUP] Failed to reconcile feature states:', err);
@@ -473,6 +495,8 @@ app.use('/api/terminal', createTerminalRoutes());
 app.use('/api/settings', createSettingsRoutes(settingsService));
 app.use('/api/claude', createClaudeRoutes(claudeUsageService));
 app.use('/api/codex', createCodexRoutes(codexUsageService, codexModelCacheService));
+app.use('/api/zai', createZaiRoutes(zaiUsageService, settingsService));
+app.use('/api/gemini', createGeminiRoutes(geminiUsageService, events));
 app.use('/api/github', createGitHubRoutes(events, settingsService));
 app.use('/api/context', createContextRoutes(settingsService));
 app.use('/api/backlog-plan', createBacklogPlanRoutes(events, settingsService));
@@ -575,7 +599,7 @@ wss.on('connection', (ws: WebSocket) => {
       logger.info('Sending event to client:', {
         type,
         messageLength: message.length,
-        sessionId: (payload as any)?.sessionId,
+        sessionId: (payload as Record<string, unknown>)?.sessionId,
       });
       ws.send(message);
     } else {
@@ -641,8 +665,15 @@ terminalWss.on('connection', (ws: WebSocket, req: import('http').IncomingMessage
   // Check if session exists
   const session = terminalService.getSession(sessionId);
   if (!session) {
-    logger.info(`Session ${sessionId} not found`);
-    ws.close(4004, 'Session not found');
+    logger.warn(
+      `Terminal session ${sessionId} not found. ` +
+        `The session may have exited, been deleted, or was never created. ` +
+        `Active terminal sessions: ${terminalService.getSessionCount()}`
+    );
+    ws.close(
+      4004,
+      'Session not found. The terminal session may have expired or been closed. Please create a new terminal.'
+    );
     return;
   }
 

apps/server/src/lib/cli-detection.ts

@@ -8,9 +8,6 @@ import { spawn, execSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { createLogger } from '@automaker/utils';
-
-const logger = createLogger('CliDetection');
 
 export interface CliInfo {
   name: string;
@@ -86,7 +83,7 @@ export async function detectCli(
   options: CliDetectionOptions = {}
 ): Promise<CliDetectionResult> {
   const config = CLI_CONFIGS[provider];
-  const { timeout = 5000, includeWsl = false, wslDistribution } = options;
+  const { timeout = 5000 } = options;
   const issues: string[] = [];
 
   const cliInfo: CliInfo = {

apps/server/src/lib/error-handler.ts

@@ -40,7 +40,7 @@ export interface ErrorClassification {
   suggestedAction?: string;
   retryable: boolean;
   provider?: string;
-  context?: Record<string, any>;
+  context?: Record<string, unknown>;
 }
 
 export interface ErrorPattern {
@@ -180,7 +180,7 @@ const ERROR_PATTERNS: ErrorPattern[] = [
 export function classifyError(
   error: unknown,
   provider?: string,
-  context?: Record<string, any>
+  context?: Record<string, unknown>
 ): ErrorClassification {
   const errorText = getErrorText(error);
 
@@ -281,18 +281,19 @@ function getErrorText(error: unknown): string {
 
   if (typeof error === 'object' && error !== null) {
     // Handle structured error objects
-    const errorObj = error as any;
+    const errorObj = error as Record<string, unknown>;
 
-    if (errorObj.message) {
+    if (typeof errorObj.message === 'string') {
       return errorObj.message;
     }
 
-    if (errorObj.error?.message) {
-      return errorObj.error.message;
+    const nestedError = errorObj.error;
+    if (typeof nestedError === 'object' && nestedError !== null && 'message' in nestedError) {
+      return String((nestedError as Record<string, unknown>).message);
     }
 
-    if (errorObj.error) {
-      return typeof errorObj.error === 'string' ? errorObj.error : JSON.stringify(errorObj.error);
+    if (nestedError) {
+      return typeof nestedError === 'string' ? nestedError : JSON.stringify(nestedError);
     }
 
     return JSON.stringify(error);
@@ -307,7 +308,7 @@ function getErrorText(error: unknown): string {
 export function createErrorResponse(
   error: unknown,
   provider?: string,
-  context?: Record<string, any>
+  context?: Record<string, unknown>
 ): {
   success: false;
   error: string;
@@ -335,7 +336,7 @@ export function logError(
   error: unknown,
   provider?: string,
   operation?: string,
-  additionalContext?: Record<string, any>
+  additionalContext?: Record<string, unknown>
 ): void {
   const classification = classifyError(error, provider, {
     operation,

apps/server/src/lib/git-log-parser.ts

@@ -0,0 +1,62 @@
+export interface CommitFields {
+  hash: string;
+  shortHash: string;
+  author: string;
+  authorEmail: string;
+  date: string;
+  subject: string;
+  body: string;
+}
+
+export function parseGitLogOutput(output: string): CommitFields[] {
+  const commits: CommitFields[] = [];
+
+  // Split by NUL character to separate commits
+  const commitBlocks = output.split('\0').filter((block) => block.trim());
+
+  for (const block of commitBlocks) {
+    const allLines = block.split('\n');
+
+    // Skip leading empty lines that may appear at block boundaries
+    let startIndex = 0;
+    while (startIndex < allLines.length && allLines[startIndex].trim() === '') {
+      startIndex++;
+    }
+    const fields = allLines.slice(startIndex);
+
+    // Validate we have all expected fields (at least hash, shortHash, author, authorEmail, date, subject)
+    if (fields.length < 6) {
+      continue; // Skip malformed blocks
+    }
+
+    const commit: CommitFields = {
+      hash: fields[0].trim(),
+      shortHash: fields[1].trim(),
+      author: fields[2].trim(),
+      authorEmail: fields[3].trim(),
+      date: fields[4].trim(),
+      subject: fields[5].trim(),
+      body: fields.slice(6).join('\n').trim(),
+    };
+
+    commits.push(commit);
+  }
+
+  return commits;
+}
+
+/**
+ * Creates a commit object from parsed fields, matching the expected API response format
+ */
+export function createCommitFromFields(fields: CommitFields, files?: string[]) {
+  return {
+    hash: fields.hash,
+    shortHash: fields.shortHash,
+    author: fields.author,
+    authorEmail: fields.authorEmail,
+    date: fields.date,
+    subject: fields.subject,
+    body: fields.body,
+    files: files || [],
+  };
+}

apps/server/src/lib/git.ts

@@ -0,0 +1,208 @@
+/**
+ * Shared git command execution utilities.
+ *
+ * This module provides the canonical `execGitCommand` helper and common
+ * git utilities used across services and routes.  All consumers should
+ * import from here rather than defining their own copy.
+ */
+
+import fs from 'fs/promises';
+import path from 'path';
+import { spawnProcess } from '@automaker/platform';
+import { createLogger } from '@automaker/utils';
+
+const logger = createLogger('GitLib');
+
+// ============================================================================
+// Secure Command Execution
+// ============================================================================
+
+/**
+ * Execute git command with array arguments to prevent command injection.
+ * Uses spawnProcess from @automaker/platform for secure, cross-platform execution.
+ *
+ * @param args - Array of git command arguments (e.g., ['worktree', 'add', path])
+ * @param cwd - Working directory to execute the command in
+ * @param env - Optional additional environment variables to pass to the git process.
+ *   These are merged on top of the current process environment.  Pass
+ *   `{ LC_ALL: 'C' }` to force git to emit English output regardless of the
+ *   system locale so that text-based output parsing remains reliable.
+ * @param abortController - Optional AbortController to cancel the git process.
+ *   When the controller is aborted the underlying process is sent SIGTERM and
+ *   the returned promise rejects with an Error whose message is 'Process aborted'.
+ * @returns Promise resolving to stdout output
+ * @throws Error with stderr/stdout message if command fails. The thrown error
+ *   also has `stdout` and `stderr` string properties for structured access.
+ *
+ * @example
+ * ```typescript
+ * // Safe: no injection possible
+ * await execGitCommand(['branch', '-D', branchName], projectPath);
+ *
+ * // Force English output for reliable text parsing:
+ * await execGitCommand(['rebase', '--', 'main'], worktreePath, { LC_ALL: 'C' });
+ *
+ * // With a process-level timeout:
+ * const controller = new AbortController();
+ * const timerId = setTimeout(() => controller.abort(), 30_000);
+ * try {
+ *   await execGitCommand(['fetch', '--all', '--quiet'], cwd, undefined, controller);
+ * } finally {
+ *   clearTimeout(timerId);
+ * }
+ *
+ * // Instead of unsafe:
+ * // await execAsync(`git branch -D ${branchName}`, { cwd });
+ * ```
+ */
+export async function execGitCommand(
+  args: string[],
+  cwd: string,
+  env?: Record<string, string>,
+  abortController?: AbortController
+): Promise<string> {
+  const result = await spawnProcess({
+    command: 'git',
+    args,
+    cwd,
+    ...(env !== undefined ? { env } : {}),
+    ...(abortController !== undefined ? { abortController } : {}),
+  });
+
+  // spawnProcess returns { stdout, stderr, exitCode }
+  if (result.exitCode === 0) {
+    return result.stdout;
+  } else {
+    const errorMessage =
+      result.stderr || result.stdout || `Git command failed with code ${result.exitCode}`;
+    throw Object.assign(new Error(errorMessage), {
+      stdout: result.stdout,
+      stderr: result.stderr,
+    });
+  }
+}
+
+// ============================================================================
+// Common Git Utilities
+// ============================================================================
+
+/**
+ * Get the current branch name for the given worktree.
+ *
+ * This is the canonical implementation shared across services.  Services
+ * should import this rather than duplicating the logic locally.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @returns The current branch name (trimmed)
+ */
+export async function getCurrentBranch(worktreePath: string): Promise<string> {
+  const branchOutput = await execGitCommand(['rev-parse', '--abbrev-ref', 'HEAD'], worktreePath);
+  return branchOutput.trim();
+}
+
+// ============================================================================
+// Index Lock Recovery
+// ============================================================================
+
+/**
+ * Check whether an error message indicates a stale git index lock file.
+ *
+ * Git operations that write to the index (e.g. `git stash push`) will fail
+ * with "could not write index" or "Unable to create ... .lock" when a
+ * `.git/index.lock` file exists from a previously interrupted operation.
+ *
+ * @param errorMessage - The error string from a failed git command
+ * @returns true if the error looks like a stale index lock issue
+ */
+export function isIndexLockError(errorMessage: string): boolean {
+  const lower = errorMessage.toLowerCase();
+  return (
+    lower.includes('could not write index') ||
+    (lower.includes('unable to create') && lower.includes('index.lock')) ||
+    lower.includes('index.lock')
+  );
+}
+
+/**
+ * Attempt to remove a stale `.git/index.lock` file for the given worktree.
+ *
+ * Uses `git rev-parse --git-dir` to locate the correct `.git` directory,
+ * which works for both regular repositories and linked worktrees.
+ *
+ * @param worktreePath - Path to the git worktree (or main repo)
+ * @returns true if a lock file was found and removed, false otherwise
+ */
+export async function removeStaleIndexLock(worktreePath: string): Promise<boolean> {
+  try {
+    // Resolve the .git directory (handles worktrees correctly)
+    const gitDirRaw = await execGitCommand(['rev-parse', '--git-dir'], worktreePath);
+    const gitDir = path.resolve(worktreePath, gitDirRaw.trim());
+    const lockFilePath = path.join(gitDir, 'index.lock');
+
+    // Check if the lock file exists
+    try {
+      await fs.access(lockFilePath);
+    } catch {
+      // Lock file does not exist — nothing to remove
+      return false;
+    }
+
+    // Remove the stale lock file
+    await fs.unlink(lockFilePath);
+    logger.info('Removed stale index.lock file', { worktreePath, lockFilePath });
+    return true;
+  } catch (err) {
+    logger.warn('Failed to remove stale index.lock file', {
+      worktreePath,
+      error: err instanceof Error ? err.message : String(err),
+    });
+    return false;
+  }
+}
+
+/**
+ * Execute a git command with automatic retry when a stale index.lock is detected.
+ *
+ * If the command fails with an error indicating a locked index file, this
+ * helper will attempt to remove the stale `.git/index.lock` and retry the
+ * command exactly once.
+ *
+ * This is particularly useful for `git stash push` which writes to the
+ * index and commonly fails when a previous git operation was interrupted.
+ *
+ * @param args - Array of git command arguments
+ * @param cwd - Working directory to execute the command in
+ * @param env - Optional additional environment variables
+ * @returns Promise resolving to stdout output
+ * @throws The original error if retry also fails, or a non-lock error
+ */
+export async function execGitCommandWithLockRetry(
+  args: string[],
+  cwd: string,
+  env?: Record<string, string>
+): Promise<string> {
+  try {
+    return await execGitCommand(args, cwd, env);
+  } catch (error: unknown) {
+    const err = error as { message?: string; stderr?: string };
+    const errorMessage = err.stderr || err.message || '';
+
+    if (!isIndexLockError(errorMessage)) {
+      throw error;
+    }
+
+    logger.info('Git command failed due to index lock, attempting cleanup and retry', {
+      cwd,
+      args: args.join(' '),
+    });
+
+    const removed = await removeStaleIndexLock(cwd);
+    if (!removed) {
+      // Could not remove the lock file — re-throw the original error
+      throw error;
+    }
+
+    // Retry the command once after removing the lock file
+    return await execGitCommand(args, cwd, env);
+  }
+}

apps/server/src/lib/permission-enforcer.ts

@@ -12,11 +12,18 @@ export interface PermissionCheckResult {
   reason?: string;
 }
 
+/** Minimal shape of a Cursor tool call used for permission checking */
+interface CursorToolCall {
+  shellToolCall?: { args?: { command: string } };
+  readToolCall?: { args?: { path: string } };
+  writeToolCall?: { args?: { path: string } };
+}
+
 /**
  * Check if a tool call is allowed based on permissions
  */
 export function checkToolCallPermission(
-  toolCall: any,
+  toolCall: CursorToolCall,
   permissions: CursorCliConfigFile | null
 ): PermissionCheckResult {
   if (!permissions || !permissions.permissions) {
@@ -152,7 +159,11 @@ function matchesRule(toolName: string, rule: string): boolean {
 /**
  * Log permission violations
  */
-export function logPermissionViolation(toolCall: any, reason: string, sessionId?: string): void {
+export function logPermissionViolation(
+  toolCall: CursorToolCall,
+  reason: string,
+  sessionId?: string
+): void {
   const sessionIdStr = sessionId ? ` [${sessionId}]` : '';
 
   if (toolCall.shellToolCall?.args?.command) {

apps/server/src/lib/worktree-metadata.ts

@@ -78,7 +78,7 @@ export async function readWorktreeMetadata(
     const metadataPath = getWorktreeMetadataPath(projectPath, branch);
     const content = (await secureFs.readFile(metadataPath, 'utf-8')) as string;
     return JSON.parse(content) as WorktreeMetadata;
-  } catch (error) {
+  } catch (_error) {
     // File doesn't exist or can't be read
     return null;
   }

apps/server/src/providers/claude-provider.ts

@@ -5,11 +5,10 @@
  * with the provider architecture.
  */
 
-import { query, type Options } from '@anthropic-ai/claude-agent-sdk';
+import { query, type Options, type SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
 import { BaseProvider } from './base-provider.js';
 import { classifyError, getUserFriendlyErrorMessage, createLogger } from '@automaker/utils';
-
-const logger = createLogger('ClaudeProvider');
+import { getClaudeAuthIndicators } from '@automaker/platform';
 import {
   getThinkingTokenBudget,
   validateBareModelId,
@@ -17,6 +16,14 @@ import {
   type ClaudeCompatibleProvider,
   type Credentials,
 } from '@automaker/types';
+import type {
+  ExecuteOptions,
+  ProviderMessage,
+  InstallationStatus,
+  ModelDefinition,
+} from './types.js';
+
+const logger = createLogger('ClaudeProvider');
 
 /**
  * ProviderConfig - Union type for provider configuration
@@ -25,37 +32,6 @@ import {
  * Both share the same connection settings structure.
  */
 type ProviderConfig = ClaudeApiProfile | ClaudeCompatibleProvider;
-import type {
-  ExecuteOptions,
-  ProviderMessage,
-  InstallationStatus,
-  ModelDefinition,
-} from './types.js';
-
-// Explicit allowlist of environment variables to pass to the SDK.
-// Only these vars are passed - nothing else from process.env leaks through.
-const ALLOWED_ENV_VARS = [
-  // Authentication
-  'ANTHROPIC_API_KEY',
-  'ANTHROPIC_AUTH_TOKEN',
-  // Endpoint configuration
-  'ANTHROPIC_BASE_URL',
-  'API_TIMEOUT_MS',
-  // Model mappings
-  'ANTHROPIC_DEFAULT_HAIKU_MODEL',
-  'ANTHROPIC_DEFAULT_SONNET_MODEL',
-  'ANTHROPIC_DEFAULT_OPUS_MODEL',
-  // Traffic control
-  'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC',
-  // System vars (always from process.env)
-  'PATH',
-  'HOME',
-  'SHELL',
-  'TERM',
-  'USER',
-  'LANG',
-  'LC_ALL',
-];
 
 // System vars are always passed from process.env regardless of profile
 const SYSTEM_ENV_VARS = ['PATH', 'HOME', 'SHELL', 'TERM', 'USER', 'LANG', 'LC_ALL'];
@@ -258,14 +234,14 @@ export class ClaudeProvider extends BaseProvider {
     };
 
     // Build prompt payload
-    let promptPayload: string | AsyncIterable<any>;
+    let promptPayload: string | AsyncIterable<SDKUserMessage>;
 
     if (Array.isArray(prompt)) {
       // Multi-part prompt (with images)
       promptPayload = (async function* () {
-        const multiPartPrompt = {
+        const multiPartPrompt: SDKUserMessage = {
           type: 'user' as const,
-          session_id: '',
+          session_id: sdkSessionId || '',
           message: {
             role: 'user' as const,
             content: prompt,
@@ -317,12 +293,16 @@ export class ClaudeProvider extends BaseProvider {
         ? `${userMessage}\n\nTip: If you're running multiple features in auto-mode, consider reducing concurrency (maxConcurrency setting) to avoid hitting rate limits.`
         : userMessage;
 
-      const enhancedError = new Error(message);
-      (enhancedError as any).originalError = error;
-      (enhancedError as any).type = errorInfo.type;
+      const enhancedError = new Error(message) as Error & {
+        originalError: unknown;
+        type: string;
+        retryAfter?: number;
+      };
+      enhancedError.originalError = error;
+      enhancedError.type = errorInfo.type;
 
       if (errorInfo.isRateLimit) {
-        (enhancedError as any).retryAfter = errorInfo.retryAfter;
+        enhancedError.retryAfter = errorInfo.retryAfter;
       }
 
       throw enhancedError;
@@ -334,13 +314,37 @@ export class ClaudeProvider extends BaseProvider {
    */
   async detectInstallation(): Promise<InstallationStatus> {
     // Claude SDK is always available since it's a dependency
-    const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
+    // Check all four supported auth methods, mirroring the logic in buildEnv():
+    // 1. ANTHROPIC_API_KEY environment variable
+    // 2. ANTHROPIC_AUTH_TOKEN environment variable
+    // 3. credentials?.apiKeys?.anthropic (credentials file, checked via platform indicators)
+    // 4. Claude Max CLI OAuth (SDK handles this automatically; detected via getClaudeAuthIndicators)
+    const hasEnvApiKey = !!process.env.ANTHROPIC_API_KEY;
+    const hasEnvAuthToken = !!process.env.ANTHROPIC_AUTH_TOKEN;
+
+    // Check credentials file and CLI OAuth indicators (same sources used by buildEnv)
+    let hasCredentialsApiKey = false;
+    let hasCliOAuth = false;
+    try {
+      const indicators = await getClaudeAuthIndicators();
+      hasCredentialsApiKey = !!indicators.credentials?.hasApiKey;
+      hasCliOAuth = !!(
+        indicators.credentials?.hasOAuthToken ||
+        indicators.hasStatsCacheWithActivity ||
+        (indicators.hasSettingsFile && indicators.hasProjectsSessions)
+      );
+    } catch {
+      // If we can't check indicators, fall back to env vars only
+    }
+
+    const hasApiKey = hasEnvApiKey || hasCredentialsApiKey;
+    const authenticated = hasEnvApiKey || hasEnvAuthToken || hasCredentialsApiKey || hasCliOAuth;
 
     const status: InstallationStatus = {
       installed: true,
       method: 'sdk',
       hasApiKey,
-      authenticated: hasApiKey,
+      authenticated,
     };
 
     return status;
@@ -364,6 +368,18 @@ export class ClaudeProvider extends BaseProvider {
         tier: 'premium' as const,
         default: true,
       },
+      {
+        id: 'claude-sonnet-4-6',
+        name: 'Claude Sonnet 4.6',
+        modelString: 'claude-sonnet-4-6',
+        provider: 'anthropic',
+        description: 'Balanced performance and cost with enhanced reasoning',
+        contextWindow: 200000,
+        maxOutputTokens: 64000,
+        supportsVision: true,
+        supportsTools: true,
+        tier: 'standard' as const,
+      },
       {
         id: 'claude-sonnet-4-20250514',
         name: 'Claude Sonnet 4',

apps/server/src/providers/codex-models.ts

@@ -32,6 +32,19 @@ export const CODEX_MODELS: ModelDefinition[] = [
     default: true,
     hasReasoning: true,
   },
+  {
+    id: CODEX_MODEL_MAP.gpt53CodexSpark,
+    name: 'GPT-5.3-Codex-Spark',
+    modelString: CODEX_MODEL_MAP.gpt53CodexSpark,
+    provider: 'openai',
+    description: 'Near-instant real-time coding model, 1000+ tokens/sec.',
+    contextWindow: CONTEXT_WINDOW_256K,
+    maxOutputTokens: MAX_OUTPUT_32K,
+    supportsVision: true,
+    supportsTools: true,
+    tier: 'premium' as const,
+    hasReasoning: true,
+  },
   {
     id: CODEX_MODEL_MAP.gpt52Codex,
     name: 'GPT-5.2-Codex',
@@ -71,6 +84,45 @@ export const CODEX_MODELS: ModelDefinition[] = [
     tier: 'basic' as const,
     hasReasoning: false,
   },
+  {
+    id: CODEX_MODEL_MAP.gpt51Codex,
+    name: 'GPT-5.1-Codex',
+    modelString: CODEX_MODEL_MAP.gpt51Codex,
+    provider: 'openai',
+    description: 'Original GPT-5.1 Codex agentic coding model.',
+    contextWindow: CONTEXT_WINDOW_256K,
+    maxOutputTokens: MAX_OUTPUT_32K,
+    supportsVision: true,
+    supportsTools: true,
+    tier: 'standard' as const,
+    hasReasoning: true,
+  },
+  {
+    id: CODEX_MODEL_MAP.gpt5Codex,
+    name: 'GPT-5-Codex',
+    modelString: CODEX_MODEL_MAP.gpt5Codex,
+    provider: 'openai',
+    description: 'Original GPT-5 Codex model.',
+    contextWindow: CONTEXT_WINDOW_128K,
+    maxOutputTokens: MAX_OUTPUT_16K,
+    supportsVision: true,
+    supportsTools: true,
+    tier: 'standard' as const,
+    hasReasoning: true,
+  },
+  {
+    id: CODEX_MODEL_MAP.gpt5CodexMini,
+    name: 'GPT-5-Codex-Mini',
+    modelString: CODEX_MODEL_MAP.gpt5CodexMini,
+    provider: 'openai',
+    description: 'Smaller, cheaper GPT-5 Codex variant.',
+    contextWindow: CONTEXT_WINDOW_128K,
+    maxOutputTokens: MAX_OUTPUT_16K,
+    supportsVision: true,
+    supportsTools: true,
+    tier: 'basic' as const,
+    hasReasoning: false,
+  },
 
   // ========== General-Purpose GPT Models ==========
   {
@@ -99,6 +151,19 @@ export const CODEX_MODELS: ModelDefinition[] = [
     tier: 'standard' as const,
     hasReasoning: true,
   },
+  {
+    id: CODEX_MODEL_MAP.gpt5,
+    name: 'GPT-5',
+    modelString: CODEX_MODEL_MAP.gpt5,
+    provider: 'openai',
+    description: 'Base GPT-5 model.',
+    contextWindow: CONTEXT_WINDOW_128K,
+    maxOutputTokens: MAX_OUTPUT_16K,
+    supportsVision: true,
+    supportsTools: true,
+    tier: 'standard' as const,
+    hasReasoning: true,
+  },
 ];
 
 /**

apps/server/src/providers/codex-provider.ts

@@ -30,7 +30,6 @@ import type {
   ModelDefinition,
 } from './types.js';
 import {
-  CODEX_MODEL_MAP,
   supportsReasoningEffort,
   validateBareModelId,
   calculateReasoningTimeout,
@@ -56,15 +55,10 @@ const CODEX_EXEC_SUBCOMMAND = 'exec';
 const CODEX_JSON_FLAG = '--json';
 const CODEX_MODEL_FLAG = '--model';
 const CODEX_VERSION_FLAG = '--version';
-const CODEX_SANDBOX_FLAG = '--sandbox';
-const CODEX_APPROVAL_FLAG = '--ask-for-approval';
-const CODEX_SEARCH_FLAG = '--search';
-const CODEX_OUTPUT_SCHEMA_FLAG = '--output-schema';
 const CODEX_CONFIG_FLAG = '--config';
-const CODEX_IMAGE_FLAG = '--image';
 const CODEX_ADD_DIR_FLAG = '--add-dir';
+const CODEX_OUTPUT_SCHEMA_FLAG = '--output-schema';
 const CODEX_SKIP_GIT_REPO_CHECK_FLAG = '--skip-git-repo-check';
-const CODEX_RESUME_FLAG = 'resume';
 const CODEX_REASONING_EFFORT_KEY = 'reasoning_effort';
 const CODEX_YOLO_FLAG = '--dangerously-bypass-approvals-and-sandbox';
 const OPENAI_API_KEY_ENV = 'OPENAI_API_KEY';
@@ -106,9 +100,6 @@ const TEXT_ENCODING = 'utf-8';
  */
 const CODEX_CLI_TIMEOUT_MS = DEFAULT_TIMEOUT_MS;
 const CODEX_FEATURE_GENERATION_BASE_TIMEOUT_MS = 300000; // 5 minutes for feature generation
-const CONTEXT_WINDOW_256K = 256000;
-const MAX_OUTPUT_32K = 32000;
-const MAX_OUTPUT_16K = 16000;
 const SYSTEM_PROMPT_SEPARATOR = '\n\n';
 const CODEX_INSTRUCTIONS_DIR = '.codex';
 const CODEX_INSTRUCTIONS_SECTION = 'Codex Project Instructions';
@@ -210,16 +201,42 @@ function isSdkEligible(options: ExecuteOptions): boolean {
   return isNoToolsRequested(options) && !hasMcpServersConfigured(options);
 }
 
+function isSdkEligibleWithApiKey(options: ExecuteOptions): boolean {
+  // When using an API key (not CLI OAuth), prefer SDK over CLI to avoid OAuth issues.
+  // SDK mode is used when MCP servers are not configured (MCP requires CLI).
+  // Tool requests are handled by the SDK, so we allow SDK mode even with tools.
+  return !hasMcpServersConfigured(options);
+}
+
 async function resolveCodexExecutionPlan(options: ExecuteOptions): Promise<CodexExecutionPlan> {
   const cliPath = await findCodexCliPath();
   const authIndicators = await getCodexAuthIndicators();
   const openAiApiKey = await resolveOpenAiApiKey();
   const hasApiKey = Boolean(openAiApiKey);
-  const cliAuthenticated = authIndicators.hasOAuthToken || authIndicators.hasApiKey || hasApiKey;
-  const sdkEligible = isSdkEligible(options);
   const cliAvailable = Boolean(cliPath);
+  // CLI OAuth login takes priority: if the user has logged in via `codex login`,
+  // use the CLI regardless of whether an API key is also stored.
+  // hasOAuthToken = OAuth session from `codex login`
+  // authIndicators.hasApiKey = API key stored in Codex's own auth file (via `codex login --api-key`)
+  // Both are "CLI-native" auth — distinct from an API key stored in Automaker's credentials.
+  const hasCliNativeAuth = authIndicators.hasOAuthToken || authIndicators.hasApiKey;
+  const sdkEligible = isSdkEligible(options);
 
-  if (hasApiKey) {
+  // If CLI is available and the user authenticated via the CLI (`codex login`),
+  // prefer CLI mode over SDK. This ensures `codex login` sessions take priority
+  // over API keys stored in Automaker's credentials.
+  if (cliAvailable && hasCliNativeAuth) {
+    return {
+      mode: CODEX_EXECUTION_MODE_CLI,
+      cliPath,
+      openAiApiKey,
+    };
+  }
+
+  // No CLI-native auth — prefer SDK when an API key is available.
+  // Using SDK with an API key avoids OAuth issues that can arise with the CLI.
+  // MCP servers still require CLI mode since the SDK doesn't support MCP.
+  if (hasApiKey && isSdkEligibleWithApiKey(options)) {
     return {
       mode: CODEX_EXECUTION_MODE_SDK,
       cliPath,
@@ -227,6 +244,16 @@ async function resolveCodexExecutionPlan(options: ExecuteOptions): Promise<Codex
     };
   }
 
+  // MCP servers are requested with an API key but no CLI-native auth — use CLI mode
+  // with the API key passed as an environment variable.
+  if (hasApiKey && cliAvailable) {
+    return {
+      mode: CODEX_EXECUTION_MODE_CLI,
+      cliPath,
+      openAiApiKey,
+    };
+  }
+
   if (sdkEligible) {
     if (!cliAvailable) {
       throw new Error(ERROR_CODEX_SDK_AUTH_REQUIRED);
@@ -237,15 +264,9 @@ async function resolveCodexExecutionPlan(options: ExecuteOptions): Promise<Codex
     throw new Error(ERROR_CODEX_CLI_REQUIRED);
   }
 
-  if (!cliAuthenticated) {
-    throw new Error(ERROR_CODEX_AUTH_REQUIRED);
-  }
-
-  return {
-    mode: CODEX_EXECUTION_MODE_CLI,
-    cliPath,
-    openAiApiKey,
-  };
+  // At this point, neither hasCliNativeAuth nor hasApiKey is true,
+  // so authentication is required regardless.
+  throw new Error(ERROR_CODEX_AUTH_REQUIRED);
 }
 
 function getEventType(event: Record<string, unknown>): string | null {
@@ -758,15 +779,12 @@ export class CodexProvider extends BaseProvider {
         options.cwd,
         codexSettings.sandboxMode !== 'danger-full-access'
       );
-      const resolvedSandboxMode = sandboxCheck.enabled
-        ? codexSettings.sandboxMode
-        : 'danger-full-access';
       if (!sandboxCheck.enabled && sandboxCheck.message) {
         console.warn(`[CodexProvider] ${sandboxCheck.message}`);
       }
       const searchEnabled =
         codexSettings.enableWebSearch || resolveSearchEnabled(resolvedAllowedTools, restrictTools);
-      const outputSchemaPath = await writeOutputSchemaFile(options.cwd, options.outputFormat);
+      const schemaPath = await writeOutputSchemaFile(options.cwd, options.outputFormat);
       const imageBlocks = codexSettings.enableImages ? extractImageBlocks(options.prompt) : [];
       const imagePaths = await writeImageFiles(options.cwd, imageBlocks);
       const approvalPolicy =
@@ -801,7 +819,7 @@ export class CodexProvider extends BaseProvider {
         overrides.push({ key: 'features.web_search_request', value: true });
       }
 
-      const configOverrides = buildConfigOverrides(overrides);
+      const configOverrideArgs = buildConfigOverrides(overrides);
       const preExecArgs: string[] = [];
 
       // Add additional directories with write access
@@ -811,6 +829,12 @@ export class CodexProvider extends BaseProvider {
         }
       }
 
+      // If images were written to disk, add the image directory so the CLI can access them
+      if (imagePaths.length > 0) {
+        const imageDir = path.join(options.cwd, CODEX_INSTRUCTIONS_DIR, IMAGE_TEMP_DIR);
+        preExecArgs.push(CODEX_ADD_DIR_FLAG, imageDir);
+      }
+
       // Model is already bare (no prefix) - validated by executeQuery
       const args = [
         CODEX_EXEC_SUBCOMMAND,
@@ -820,6 +844,8 @@ export class CodexProvider extends BaseProvider {
         CODEX_MODEL_FLAG,
         options.model,
         CODEX_JSON_FLAG,
+        ...configOverrideArgs,
+        ...(schemaPath ? [CODEX_OUTPUT_SCHEMA_FLAG, schemaPath] : []),
         '-', // Read prompt from stdin to avoid shell escaping issues
       ];
 
@@ -866,16 +892,36 @@ export class CodexProvider extends BaseProvider {
 
           // Enhance error message with helpful context
           let enhancedError = errorText;
-          if (errorText.toLowerCase().includes('rate limit')) {
+          const errorLower = errorText.toLowerCase();
+          if (errorLower.includes('rate limit')) {
             enhancedError = `${errorText}\n\nTip: You're being rate limited. Try reducing concurrent tasks or waiting a few minutes before retrying.`;
+          } else if (errorLower.includes('authentication') || errorLower.includes('unauthorized')) {
+            enhancedError = `${errorText}\n\nTip: Check that your OPENAI_API_KEY is set correctly or run 'codex login' to authenticate.`;
           } else if (
-            errorText.toLowerCase().includes('authentication') ||
-            errorText.toLowerCase().includes('unauthorized')
+            errorLower.includes('model does not exist') ||
+            errorLower.includes('requested model does not exist') ||
+            errorLower.includes('do not have access') ||
+            errorLower.includes('model_not_found') ||
+            errorLower.includes('invalid_model')
           ) {
-            enhancedError = `${errorText}\n\nTip: Check that your OPENAI_API_KEY is set correctly or run 'codex auth login' to authenticate.`;
+            enhancedError =
+              `${errorText}\n\nTip: The model '${options.model}' may not be available on your OpenAI plan. ` +
+              `See https://platform.openai.com/docs/models for available models. ` +
+              `Some models require a ChatGPT Pro/Plus subscription—authenticate with 'codex login' instead of an API key.`;
           } else if (
-            errorText.toLowerCase().includes('not found') ||
-            errorText.toLowerCase().includes('command not found')
+            errorLower.includes('stream disconnected') ||
+            errorLower.includes('stream ended') ||
+            errorLower.includes('connection reset')
+          ) {
+            enhancedError =
+              `${errorText}\n\nTip: The connection to OpenAI was interrupted. This can happen due to:\n` +
+              `- Network instability\n` +
+              `- The model not being available on your plan\n` +
+              `- Server-side timeouts for long-running requests\n` +
+              `Try again, or switch to a different model.`;
+          } else if (
+            errorLower.includes('command not found') ||
+            errorLower.includes('is not recognized as an internal or external command')
           ) {
             enhancedError = `${errorText}\n\nTip: Make sure the Codex CLI is installed. Run 'npm install -g @openai/codex-cli' to install.`;
           }
@@ -1033,7 +1079,6 @@ export class CodexProvider extends BaseProvider {
   async detectInstallation(): Promise<InstallationStatus> {
     const cliPath = await findCodexCliPath();
     const hasApiKey = Boolean(await resolveOpenAiApiKey());
-    const authIndicators = await getCodexAuthIndicators();
     const installed = !!cliPath;
 
     let version = '';
@@ -1045,7 +1090,7 @@ export class CodexProvider extends BaseProvider {
           cwd: process.cwd(),
         });
         version = result.stdout.trim();
-      } catch (error) {
+      } catch {
         version = '';
       }
     }

apps/server/src/providers/codex-sdk-client.ts

@@ -15,6 +15,9 @@ const SDK_HISTORY_HEADER = 'Current request:\n';
 const DEFAULT_RESPONSE_TEXT = '';
 const SDK_ERROR_DETAILS_LABEL = 'Details:';
 
+type SdkReasoningEffort = 'minimal' | 'low' | 'medium' | 'high' | 'xhigh';
+const SDK_REASONING_EFFORTS = new Set<string>(['minimal', 'low', 'medium', 'high', 'xhigh']);
+
 type PromptBlock = {
   type: string;
   text?: string;
@@ -99,38 +102,52 @@ export async function* executeCodexSdkQuery(
     const apiKey = resolveApiKey();
     const codex = new Codex({ apiKey });
 
+    // Build thread options with model
+    // The model must be passed to startThread/resumeThread so the SDK
+    // knows which model to use for the conversation. Without this,
+    // the SDK may use a default model that the user doesn't have access to.
+    const threadOptions: {
+      model?: string;
+      modelReasoningEffort?: SdkReasoningEffort;
+    } = {};
+
+    if (options.model) {
+      threadOptions.model = options.model;
+    }
+
+    // Add reasoning effort to thread options if model supports it
+    if (
+      options.reasoningEffort &&
+      options.model &&
+      supportsReasoningEffort(options.model) &&
+      options.reasoningEffort !== 'none' &&
+      SDK_REASONING_EFFORTS.has(options.reasoningEffort)
+    ) {
+      threadOptions.modelReasoningEffort = options.reasoningEffort as SdkReasoningEffort;
+    }
+
     // Resume existing thread or start new one
     let thread;
     if (options.sdkSessionId) {
       try {
-        thread = codex.resumeThread(options.sdkSessionId);
+        thread = codex.resumeThread(options.sdkSessionId, threadOptions);
       } catch {
         // If resume fails, start a new thread
-        thread = codex.startThread();
+        thread = codex.startThread(threadOptions);
       }
     } else {
-      thread = codex.startThread();
+      thread = codex.startThread(threadOptions);
     }
 
     const promptText = buildPromptText(options, systemPrompt);
 
-    // Build run options with reasoning effort if supported
+    // Build run options
     const runOptions: {
       signal?: AbortSignal;
-      reasoning?: { effort: string };
     } = {
       signal: options.abortController?.signal,
     };
 
-    // Add reasoning effort if model supports it and reasoningEffort is specified
-    if (
-      options.reasoningEffort &&
-      supportsReasoningEffort(options.model) &&
-      options.reasoningEffort !== 'none'
-    ) {
-      runOptions.reasoning = { effort: options.reasoningEffort };
-    }
-
     // Run the query
     const result = await thread.run(promptText, runOptions);
 
@@ -160,10 +177,42 @@ export async function* executeCodexSdkQuery(
   } catch (error) {
     const errorInfo = classifyError(error);
     const userMessage = getUserFriendlyErrorMessage(error);
-    const combinedMessage = buildSdkErrorMessage(errorInfo.message, userMessage);
+    let combinedMessage = buildSdkErrorMessage(errorInfo.message, userMessage);
+
+    // Enhance error messages with actionable tips for common Codex issues
+    // Normalize inputs to avoid crashes from nullish values
+    const errorLower = (errorInfo?.message ?? '').toLowerCase();
+    const modelLabel = options?.model ?? '<unknown model>';
+
+    if (
+      errorLower.includes('does not exist') ||
+      errorLower.includes('model_not_found') ||
+      errorLower.includes('invalid_model')
+    ) {
+      // Model not found - provide helpful guidance
+      combinedMessage +=
+        `\n\nTip: The model '${modelLabel}' may not be available on your OpenAI plan. ` +
+        `Some models (like gpt-5.3-codex) require a ChatGPT Pro/Plus subscription and OAuth login via 'codex login'. ` +
+        `Try using a different model (e.g., gpt-5.1 or gpt-5.2), or authenticate with 'codex login' instead of an API key.`;
+    } else if (
+      errorLower.includes('stream disconnected') ||
+      errorLower.includes('stream ended') ||
+      errorLower.includes('connection reset') ||
+      errorLower.includes('socket hang up')
+    ) {
+      // Stream disconnection - provide helpful guidance
+      combinedMessage +=
+        `\n\nTip: The connection to OpenAI was interrupted. This can happen due to:\n` +
+        `- Network instability\n` +
+        `- The model not being available on your plan (try 'codex login' for OAuth authentication)\n` +
+        `- Server-side timeouts for long-running requests\n` +
+        `Try again, or switch to a different model.`;
+    }
+
     console.error('[CodexSDK] executeQuery() error during execution:', {
       type: errorInfo.type,
       message: errorInfo.message,
+      model: options.model,
       isRateLimit: errorInfo.isRateLimit,
       retryAfter: errorInfo.retryAfter,
       stack: error instanceof Error ? error.stack : undefined,

apps/server/src/providers/copilot-provider.ts

@@ -42,7 +42,7 @@ import {
 const logger = createLogger('CopilotProvider');
 
 // Default bare model (without copilot- prefix) for SDK calls
-const DEFAULT_BARE_MODEL = 'claude-sonnet-4.5';
+const DEFAULT_BARE_MODEL = 'claude-sonnet-4.6';
 
 // =============================================================================
 // SDK Event Types (from @github/copilot-sdk)
@@ -85,10 +85,6 @@ interface SdkToolExecutionEndEvent extends SdkEvent {
   };
 }
 
-interface SdkSessionIdleEvent extends SdkEvent {
-  type: 'session.idle';
-}
-
 interface SdkSessionErrorEvent extends SdkEvent {
   type: 'session.error';
   data: {

apps/server/src/providers/cursor-provider.ts

@@ -31,7 +31,7 @@ import type {
 } from './types.js';
 import { validateBareModelId } from '@automaker/types';
 import { validateApiKey } from '../lib/auth-utils.js';
-import { getEffectivePermissions } from '../services/cursor-config-service.js';
+import { getEffectivePermissions, detectProfile } from '../services/cursor-config-service.js';
 import {
   type CursorStreamEvent,
   type CursorSystemEvent,
@@ -69,6 +69,7 @@ interface CursorToolHandler<TArgs = unknown, TResult = unknown> {
  * Registry of Cursor tool handlers
  * Each handler knows how to normalize its specific tool call type
  */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- handler registry stores heterogeneous tool type parameters
 const CURSOR_TOOL_HANDLERS: Record<string, CursorToolHandler<any, any>> = {
   readToolCall: {
     name: 'Read',
@@ -877,8 +878,12 @@ export class CursorProvider extends CliProvider {
 
     logger.debug(`CursorProvider.executeQuery called with model: "${options.model}"`);
 
-    // Get effective permissions for this project
+    // Get effective permissions for this project and detect the active profile
     const effectivePermissions = await getEffectivePermissions(options.cwd || process.cwd());
+    const activeProfile = detectProfile(effectivePermissions);
+    logger.debug(
+      `Active permission profile: ${activeProfile ?? 'none'}, permissions: ${JSON.stringify(effectivePermissions)}`
+    );
 
     // Debug: log raw events when AUTOMAKER_DEBUG_RAW_OUTPUT is enabled
     const debugRawEvents =

apps/server/src/providers/gemini-provider.ts

@@ -20,7 +20,6 @@ import type {
   ProviderMessage,
   InstallationStatus,
   ModelDefinition,
-  ContentBlock,
 } from './types.js';
 import { validateBareModelId } from '@automaker/types';
 import { GEMINI_MODEL_MAP, type GeminiAuthStatus } from '@automaker/types';

apps/server/src/providers/opencode-provider.ts

@@ -192,6 +192,28 @@ export interface OpenCodeToolErrorEvent extends OpenCodeBaseEvent {
   part?: OpenCodePart & { error: string };
 }
 
+/**
+ * Tool use event - The actual format emitted by OpenCode CLI when a tool is invoked.
+ * Contains the tool name, call ID, and the complete state (input, output, status).
+ * Note: OpenCode CLI emits 'tool_use' (not 'tool_call') as the event type.
+ */
+export interface OpenCodeToolUseEvent extends OpenCodeBaseEvent {
+  type: 'tool_use';
+  part: OpenCodePart & {
+    type: 'tool';
+    callID?: string;
+    tool?: string;
+    state?: {
+      status?: string;
+      input?: unknown;
+      output?: string;
+      title?: string;
+      metadata?: unknown;
+      time?: { start: number; end: number };
+    };
+  };
+}
+
 /**
  * Union type of all OpenCode stream events
  */
@@ -200,6 +222,7 @@ export type OpenCodeStreamEvent =
   | OpenCodeStepStartEvent
   | OpenCodeStepFinishEvent
   | OpenCodeToolCallEvent
+  | OpenCodeToolUseEvent
   | OpenCodeToolResultEvent
   | OpenCodeErrorEvent
   | OpenCodeToolErrorEvent;
@@ -311,8 +334,8 @@ export class OpencodeProvider extends CliProvider {
    * Arguments built:
    * - 'run' subcommand for executing queries
    * - '--format', 'json' for JSONL streaming output
-   * - '-c', '<cwd>' for working directory (using opencode's -c flag)
    * - '--model', '<model>' for model selection (if specified)
+   * - '--session', '<id>' for continuing an existing session (if sdkSessionId is set)
    *
    * The prompt is passed via stdin (piped) to avoid shell escaping issues.
    * OpenCode CLI automatically reads from stdin when input is piped.
@@ -326,6 +349,14 @@ export class OpencodeProvider extends CliProvider {
     // Add JSON output format for JSONL parsing (not 'stream-json')
     args.push('--format', 'json');
 
+    // Handle session resumption for conversation continuity.
+    // The opencode CLI supports `--session <id>` to continue an existing session.
+    // The sdkSessionId is captured from the sessionID field in previous stream events
+    // and persisted by AgentService for use in follow-up messages.
+    if (options.sdkSessionId) {
+      args.push('--session', options.sdkSessionId);
+    }
+
     // Handle model selection
     // Convert canonical prefix format (opencode-xxx) to CLI slash format (opencode/xxx)
     // OpenCode CLI expects provider/model format (e.g., 'opencode/big-model')
@@ -398,15 +429,225 @@ export class OpencodeProvider extends CliProvider {
     return subprocessOptions;
   }
 
+  /**
+   * Check if an error message indicates a session-not-found condition.
+   *
+   * Centralizes the pattern matching for session errors to avoid duplication.
+   * Strips ANSI escape codes first since opencode CLI uses colored stderr output
+   * (e.g. "\x1b[91m\x1b[1mError: \x1b[0mSession not found").
+   *
+   * IMPORTANT: Patterns must be specific enough to avoid false positives.
+   * Generic patterns like "notfounderror" or "resource not found" match
+   * non-session errors (e.g. "ProviderModelNotFoundError") which would
+   * trigger unnecessary retries that fail identically, producing confusing
+   * error messages like "OpenCode session could not be created".
+   *
+   * @param errorText - Raw error text (may contain ANSI codes)
+   * @returns true if the error indicates the session was not found
+   */
+  private static isSessionNotFoundError(errorText: string): boolean {
+    const cleaned = OpencodeProvider.stripAnsiCodes(errorText).toLowerCase();
+
+    // Explicit session-related phrases — high confidence
+    if (
+      cleaned.includes('session not found') ||
+      cleaned.includes('session does not exist') ||
+      cleaned.includes('invalid session') ||
+      cleaned.includes('session expired') ||
+      cleaned.includes('no such session')
+    ) {
+      return true;
+    }
+
+    // Generic "NotFoundError" / "resource not found" are only session errors
+    // when the message also references a session path or session ID.
+    // Without this guard, errors like "ProviderModelNotFoundError" or
+    // "Resource not found: /path/to/config.json" would false-positive.
+    if (cleaned.includes('notfounderror') || cleaned.includes('resource not found')) {
+      return cleaned.includes('/session/') || /\bsession\b/.test(cleaned);
+    }
+
+    return false;
+  }
+
+  /**
+   * Strip ANSI escape codes from a string.
+   *
+   * The OpenCode CLI uses colored stderr output (e.g. "\x1b[91m\x1b[1mError: \x1b[0m").
+   * These escape codes render as garbled text like "[91m[1mError: [0m" in the UI
+   * when passed through as-is. This utility removes them so error messages are
+   * clean and human-readable.
+   */
+  private static stripAnsiCodes(text: string): string {
+    return text.replace(/\x1b\[[0-9;]*m/g, '');
+  }
+
+  /**
+   * Clean a CLI error message for display.
+   *
+   * Strips ANSI escape codes AND removes the redundant "Error: " prefix that
+   * the OpenCode CLI prepends to error messages in its colored stderr output
+   * (e.g. "\x1b[91m\x1b[1mError: \x1b[0mSession not found" → "Session not found").
+   *
+   * Without this, consumers that wrap the message in their own "Error: " prefix
+   * (like AgentService or AgentExecutor) produce garbled double-prefixed output:
+   * "Error: Error: Session not found".
+   */
+  private static cleanErrorMessage(text: string): string {
+    let cleaned = OpencodeProvider.stripAnsiCodes(text).trim();
+    // Remove leading "Error: " prefix (case-insensitive) if present.
+    // The CLI formats errors as: \x1b[91m\x1b[1mError: \x1b[0m<actual message>
+    // After ANSI stripping this becomes: "Error: <actual message>"
+    cleaned = cleaned.replace(/^Error:\s*/i, '').trim();
+    return cleaned || text;
+  }
+
+  /**
+   * Execute a query with automatic session resumption fallback.
+   *
+   * When a sdkSessionId is provided, the CLI receives `--session <id>`.
+   * If the session no longer exists on disk the CLI will fail with a
+   * "NotFoundError" / "Resource not found" / "Session not found" error.
+   *
+   * The opencode CLI writes this to **stderr** and exits non-zero.
+   * `spawnJSONLProcess` collects stderr and **yields** it as
+   * `{ type: 'error', error: <stderrText> }` — it is NOT thrown.
+   * After `normalizeEvent`, the error becomes a yielded `ProviderMessage`
+   * with `type: 'error'`.  A simple try/catch therefore cannot intercept it.
+   *
+   * This override iterates the parent stream, intercepts yielded error
+   * messages that match the session-not-found pattern, and retries the
+   * entire query WITHOUT the `--session` flag so a fresh session is started.
+   *
+   * Session-not-found retry is ONLY attempted when `sdkSessionId` is set.
+   * Without the `--session` flag the CLI always creates a fresh session, so
+   * retrying without it would be identical to the first attempt and would
+   * fail the same way — producing a confusing "session could not be created"
+   * message for what is actually a different error (model not found, auth
+   * failure, etc.).
+   *
+   * All error messages (session or not) are cleaned of ANSI codes and the
+   * CLI's redundant "Error: " prefix before being yielded to consumers.
+   *
+   * After a successful retry, the consumer (AgentService) will receive a new
+   * session_id from the fresh stream events, which it persists to metadata —
+   * replacing the stale sdkSessionId and preventing repeated failures.
+   */
+  async *executeQuery(options: ExecuteOptions): AsyncGenerator<ProviderMessage> {
+    // When no sdkSessionId is set, there is nothing to "retry without" — just
+    // stream normally and clean error messages as they pass through.
+    if (!options.sdkSessionId) {
+      for await (const msg of super.executeQuery(options)) {
+        // Clean error messages so consumers don't get ANSI or double "Error:" prefix
+        if (msg.type === 'error' && msg.error && typeof msg.error === 'string') {
+          msg.error = OpencodeProvider.cleanErrorMessage(msg.error);
+        }
+        yield msg;
+      }
+      return;
+    }
+
+    // sdkSessionId IS set — the CLI will receive `--session <id>`.
+    // If that session no longer exists, intercept the error and retry fresh.
+    //
+    // To avoid buffering the entire stream in memory for long-lived sessions,
+    // we only buffer an initial window of messages until we observe a healthy
+    // (non-error) message. Once a healthy message is seen, we flush the buffer
+    // and switch to direct passthrough, while still watching for session errors
+    // via isSessionNotFoundError on any subsequent error messages.
+    const buffered: ProviderMessage[] = [];
+    let sessionError = false;
+    let seenHealthyMessage = false;
+
+    try {
+      for await (const msg of super.executeQuery(options)) {
+        if (msg.type === 'error') {
+          const errorText = msg.error || '';
+          if (OpencodeProvider.isSessionNotFoundError(errorText)) {
+            sessionError = true;
+            opencodeLogger.info(
+              `OpenCode session error detected (session "${options.sdkSessionId}") ` +
+                `— retrying without --session to start fresh`
+            );
+            break; // stop consuming the failed stream
+          }
+
+          // Non-session error — clean it
+          if (msg.error && typeof msg.error === 'string') {
+            msg.error = OpencodeProvider.cleanErrorMessage(msg.error);
+          }
+        } else {
+          // A non-error message is a healthy signal — stop buffering after this
+          seenHealthyMessage = true;
+        }
+
+        if (seenHealthyMessage && buffered.length > 0) {
+          // Flush the pre-healthy buffer first, then switch to passthrough
+          for (const bufferedMsg of buffered) {
+            yield bufferedMsg;
+          }
+          buffered.length = 0;
+        }
+
+        if (seenHealthyMessage) {
+          // Passthrough mode — yield directly without buffering
+          yield msg;
+        } else {
+          // Still in initial window — buffer until we see a healthy message
+          buffered.push(msg);
+        }
+      }
+    } catch (error) {
+      // Also handle thrown exceptions (e.g. from mapError in cli-provider)
+      const errMsg = error instanceof Error ? error.message : String(error);
+      if (OpencodeProvider.isSessionNotFoundError(errMsg)) {
+        sessionError = true;
+        opencodeLogger.info(
+          `OpenCode session error detected (thrown, session "${options.sdkSessionId}") ` +
+            `— retrying without --session to start fresh`
+        );
+      } else {
+        throw error;
+      }
+    }
+
+    if (sessionError) {
+      // Retry the entire query without the stale session ID.
+      const retryOptions = { ...options, sdkSessionId: undefined };
+      opencodeLogger.info('Retrying OpenCode query without --session flag...');
+
+      // Stream the retry directly to the consumer.
+      // If the retry also fails, it's a genuine error (not session-related)
+      // and should be surfaced as-is rather than masked with a misleading
+      // "session could not be created" message.
+      for await (const retryMsg of super.executeQuery(retryOptions)) {
+        if (retryMsg.type === 'error' && retryMsg.error && typeof retryMsg.error === 'string') {
+          retryMsg.error = OpencodeProvider.cleanErrorMessage(retryMsg.error);
+        }
+        yield retryMsg;
+      }
+    } else if (buffered.length > 0) {
+      // No session error and still have buffered messages (stream ended before
+      // any healthy message was observed) — flush them to the consumer
+      for (const msg of buffered) {
+        yield msg;
+      }
+    }
+    // If seenHealthyMessage is true, all messages have already been yielded
+    // directly in passthrough mode — nothing left to flush.
+  }
+
   /**
    * Normalize a raw CLI event to ProviderMessage format
    *
    * Maps OpenCode event types to the standard ProviderMessage structure:
    * - text -> type: 'assistant', content with type: 'text'
    * - step_start -> null (informational, no message needed)
-   * - step_finish with reason 'stop' -> type: 'result', subtype: 'success'
+   * - step_finish with reason 'stop'/'end_turn' -> type: 'result', subtype: 'success'
+   * - step_finish with reason 'tool-calls' -> null (intermediate step, not final)
    * - step_finish with error -> type: 'error'
-   * - tool_call -> type: 'assistant', content with type: 'tool_use'
+   * - tool_use -> type: 'assistant', content with type: 'tool_use' (OpenCode CLI format)
+   * - tool_call -> type: 'assistant', content with type: 'tool_use' (legacy format)
    * - tool_result -> type: 'assistant', content with type: 'tool_result'
    * - error -> type: 'error'
    *
@@ -459,7 +700,7 @@ export class OpencodeProvider extends CliProvider {
           return {
             type: 'error',
             session_id: finishEvent.sessionID,
-            error: finishEvent.part.error,
+            error: OpencodeProvider.cleanErrorMessage(finishEvent.part.error),
           };
         }
 
@@ -468,15 +709,40 @@ export class OpencodeProvider extends CliProvider {
           return {
             type: 'error',
             session_id: finishEvent.sessionID,
-            error: 'Step execution failed',
+            error: OpencodeProvider.cleanErrorMessage('Step execution failed'),
           };
         }
 
-        // Successful completion (reason: 'stop' or 'end_turn')
+        // Intermediate step completion (reason: 'tool-calls') — the agent loop
+        // is continuing because the model requested tool calls. Skip these so
+        // consumers don't mistake them for final results.
+        if (finishEvent.part?.reason === 'tool-calls') {
+          return null;
+        }
+
+        // Only treat an explicit allowlist of reasons as true success.
+        // Reasons like 'length' (context-window truncation) or 'content-filter'
+        // indicate the model stopped abnormally and must not be surfaced as
+        // successful completions.
+        const SUCCESS_REASONS = new Set(['stop', 'end_turn']);
+        const reason = finishEvent.part?.reason;
+
+        if (reason === undefined || SUCCESS_REASONS.has(reason)) {
+          // Final completion (reason: 'stop', 'end_turn', or unset)
+          return {
+            type: 'result',
+            subtype: 'success',
+            session_id: finishEvent.sessionID,
+            result: (finishEvent.part as OpenCodePart & { result?: string })?.result,
+          };
+        }
+
+        // Non-success, non-tool-calls reason (e.g. 'length', 'content-filter')
         return {
           type: 'result',
-          subtype: 'success',
+          subtype: 'error',
           session_id: finishEvent.sessionID,
+          error: `Step finished with non-success reason: ${reason}`,
           result: (finishEvent.part as OpenCodePart & { result?: string })?.result,
         };
       }
@@ -484,8 +750,10 @@ export class OpencodeProvider extends CliProvider {
       case 'tool_error': {
         const toolErrorEvent = openCodeEvent as OpenCodeBaseEvent;
 
-        // Extract error message from part.error
-        const errorMessage = toolErrorEvent.part?.error || 'Tool execution failed';
+        // Extract error message from part.error and clean ANSI codes
+        const errorMessage = OpencodeProvider.cleanErrorMessage(
+          toolErrorEvent.part?.error || 'Tool execution failed'
+        );
 
         return {
           type: 'error',
@@ -494,6 +762,45 @@ export class OpencodeProvider extends CliProvider {
         };
       }
 
+      // OpenCode CLI emits 'tool_use' events (not 'tool_call') when the model invokes a tool.
+      // The event format includes the tool name, call ID, and state with input/output.
+      // Handle both 'tool_use' (actual CLI format) and 'tool_call' (legacy/alternative) for robustness.
+      case 'tool_use': {
+        const toolUseEvent = openCodeEvent as OpenCodeToolUseEvent;
+        const part = toolUseEvent.part;
+
+        // Generate a tool use ID if not provided
+        const toolUseId = part?.callID || part?.call_id || generateToolUseId();
+        const toolName = part?.tool || part?.name || 'unknown';
+
+        const content: ContentBlock[] = [
+          {
+            type: 'tool_use',
+            name: toolName,
+            tool_use_id: toolUseId,
+            input: part?.state?.input || part?.args,
+          },
+        ];
+
+        // If the tool has already completed (state.status === 'completed'), also emit the result
+        if (part?.state?.status === 'completed' && part?.state?.output) {
+          content.push({
+            type: 'tool_result',
+            tool_use_id: toolUseId,
+            content: part.state.output,
+          });
+        }
+
+        return {
+          type: 'assistant',
+          session_id: toolUseEvent.sessionID,
+          message: {
+            role: 'assistant',
+            content,
+          },
+        };
+      }
+
       case 'tool_call': {
         const toolEvent = openCodeEvent as OpenCodeToolCallEvent;
 
@@ -560,6 +867,13 @@ export class OpencodeProvider extends CliProvider {
           errorMessage = errorEvent.part.error;
         }
 
+        // Clean error messages: strip ANSI escape codes AND the redundant "Error: "
+        // prefix the CLI adds. The OpenCode CLI outputs colored stderr like:
+        //   \x1b[91m\x1b[1mError: \x1b[0mSession not found
+        // Without cleaning, consumers that wrap in their own "Error: " prefix
+        // produce "Error: Error: Session not found".
+        errorMessage = OpencodeProvider.cleanErrorMessage(errorMessage);
+
         return {
           type: 'error',
           session_id: errorEvent.sessionID,
@@ -623,9 +937,9 @@ export class OpencodeProvider extends CliProvider {
         default: true,
       },
       {
-        id: 'opencode/glm-4.7-free',
-        name: 'GLM 4.7 Free',
-        modelString: 'opencode/glm-4.7-free',
+        id: 'opencode/glm-5-free',
+        name: 'GLM 5 Free',
+        modelString: 'opencode/glm-5-free',
         provider: 'opencode',
         description: 'OpenCode free tier GLM model',
         supportsTools: true,
@@ -643,19 +957,19 @@ export class OpencodeProvider extends CliProvider {
         tier: 'basic',
       },
       {
-        id: 'opencode/grok-code',
-        name: 'Grok Code (Free)',
-        modelString: 'opencode/grok-code',
+        id: 'opencode/kimi-k2.5-free',
+        name: 'Kimi K2.5 Free',
+        modelString: 'opencode/kimi-k2.5-free',
         provider: 'opencode',
-        description: 'OpenCode free tier Grok model for coding',
+        description: 'OpenCode free tier Kimi model for coding',
         supportsTools: true,
         supportsVision: false,
         tier: 'basic',
       },
       {
-        id: 'opencode/minimax-m2.1-free',
-        name: 'MiniMax M2.1 Free',
-        modelString: 'opencode/minimax-m2.1-free',
+        id: 'opencode/minimax-m2.5-free',
+        name: 'MiniMax M2.5 Free',
+        modelString: 'opencode/minimax-m2.5-free',
         provider: 'opencode',
         description: 'OpenCode free tier MiniMax model',
         supportsTools: true,
@@ -777,7 +1091,7 @@ export class OpencodeProvider extends CliProvider {
    *
    * OpenCode CLI output format (one model per line):
    * opencode/big-pickle
-   * opencode/glm-4.7-free
+   * opencode/glm-5-free
    * anthropic/claude-3-5-haiku-20241022
    * github-copilot/claude-3.5-sonnet
    * ...

apps/server/src/providers/simple-query-service.ts

@@ -16,8 +16,6 @@
 
 import { ProviderFactory } from './provider-factory.js';
 import type {
-  ProviderMessage,
-  ContentBlock,
   ThinkingLevel,
   ReasoningEffort,
   ClaudeApiProfile,
@@ -96,7 +94,7 @@ export interface StreamingQueryOptions extends SimpleQueryOptions {
 /**
  * Default model to use when none specified
  */
-const DEFAULT_MODEL = 'claude-sonnet-4-20250514';
+const DEFAULT_MODEL = 'claude-sonnet-4-6';
 
 /**
  * Execute a simple query and return the text result

apps/server/src/routes/agent/routes/history.ts

@@ -16,7 +16,7 @@ export function createHistoryHandler(agentService: AgentService) {
         return;
       }
 
-      const result = agentService.getHistory(sessionId);
+      const result = await agentService.getHistory(sessionId);
       res.json(result);
     } catch (error) {
       logError(error, 'Get history failed');

apps/server/src/routes/agent/routes/queue-list.ts

@@ -19,7 +19,7 @@ export function createQueueListHandler(agentService: AgentService) {
         return;
       }
 
-      const result = agentService.getQueue(sessionId);
+      const result = await agentService.getQueue(sessionId);
       res.json(result);
     } catch (error) {
       logError(error, 'List queue failed');

apps/server/src/routes/agent/routes/send.ts

@@ -53,7 +53,15 @@ export function createSendHandler(agentService: AgentService) {
           thinkingLevel,
         })
         .catch((error) => {
-          logger.error('Background error in sendMessage():', error);
+          const errorMsg = (error as Error).message || 'Unknown error';
+          logger.error(`Background error in sendMessage() for session ${sessionId}:`, errorMsg);
+
+          // Emit error via WebSocket so the UI is notified even though
+          // the HTTP response already returned 200. This is critical for
+          // session-not-found errors where sendMessage() throws before it
+          // can emit its own error event (no in-memory session to emit from).
+          agentService.emitSessionError(sessionId, errorMsg);
+
           logError(error, 'Send message failed (background)');
         });
 

apps/server/src/routes/agent/routes/start.ts

@@ -6,7 +6,7 @@ import type { Request, Response } from 'express';
 import { AgentService } from '../../../services/agent-service.js';
 import { createLogger } from '@automaker/utils';
 import { getErrorMessage, logError } from '../common.js';
-const logger = createLogger('Agent');
+const _logger = createLogger('Agent');
 
 export function createStartHandler(agentService: AgentService) {
   return async (req: Request, res: Response): Promise<void> => {

apps/server/src/routes/app-spec/common.ts

@@ -128,7 +128,7 @@ export function logAuthStatus(context: string): void {
  */
 export function logError(error: unknown, context: string): void {
   logger.error(`❌ ${context}:`);
-  logger.error('Error name:', (error as any)?.name);
+  logger.error('Error name:', (error as Error)?.name);
   logger.error('Error message:', (error as Error)?.message);
   logger.error('Error stack:', (error as Error)?.stack);
   logger.error('Full error object:', JSON.stringify(error, Object.getOwnPropertyNames(error), 2));

apps/server/src/routes/app-spec/generate-features-from-spec.ts

@@ -30,7 +30,7 @@ const DEFAULT_MAX_FEATURES = 50;
  * Timeout for Codex models when generating features (5 minutes).
  * Codex models are slower and need more time to generate 50+ features.
  */
-const CODEX_FEATURE_GENERATION_TIMEOUT_MS = 300000; // 5 minutes
+const _CODEX_FEATURE_GENERATION_TIMEOUT_MS = 300000; // 5 minutes
 
 /**
  * Type for extracted features JSON response

apps/server/src/routes/app-spec/sync-spec.ts

@@ -29,7 +29,6 @@ import {
   updateTechnologyStack,
   updateRoadmapPhaseStatus,
   type ImplementedFeature,
-  type RoadmapPhase,
 } from '../../lib/xml-extractor.js';
 import { getNotificationService } from '../../services/notification-service.js';
 

apps/server/src/routes/backlog-plan/generate-plan.ts

@@ -6,7 +6,7 @@
  */
 
 import type { EventEmitter } from '../../lib/events.js';
-import type { Feature, BacklogPlanResult, BacklogChange, DependencyUpdate } from '@automaker/types';
+import type { Feature, BacklogPlanResult } from '@automaker/types';
 import {
   DEFAULT_PHASE_MODELS,
   isCursorModel,

apps/server/src/routes/backlog-plan/routes/apply.ts

@@ -3,7 +3,7 @@
  */
 
 import type { Request, Response } from 'express';
-import type { BacklogPlanResult, BacklogChange, Feature } from '@automaker/types';
+import type { BacklogPlanResult } from '@automaker/types';
 import { FeatureLoader } from '../../../services/feature-loader.js';
 import { clearBacklogPlan, getErrorMessage, logError, logger } from '../common.js';
 
@@ -58,6 +58,9 @@ export function createApplyHandler() {
             if (feature.dependencies?.includes(change.featureId)) {
               const newDeps = feature.dependencies.filter((d) => d !== change.featureId);
               await featureLoader.update(projectPath, feature.id, { dependencies: newDeps });
+              // Mutate the in-memory feature object so subsequent deletions use the updated
+              // dependency list and don't reintroduce already-removed dependency IDs.
+              feature.dependencies = newDeps;
               logger.info(
                 `[BacklogPlan] Removed dependency ${change.featureId} from ${feature.id}`
               );

apps/server/src/routes/features/routes/export.ts

@@ -36,7 +36,7 @@ interface ExportRequest {
   };
 }
 
-export function createExportHandler(featureLoader: FeatureLoader) {
+export function createExportHandler(_featureLoader: FeatureLoader) {
   const exportService = getFeatureExportService();
 
   return async (req: Request, res: Response): Promise<void> => {

apps/server/src/routes/features/routes/generate-title.ts

@@ -34,7 +34,7 @@ export function createGenerateTitleHandler(
 ): (req: Request, res: Response) => Promise<void> {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { description, projectPath } = req.body as GenerateTitleRequestBody;
+      const { description } = req.body as GenerateTitleRequestBody;
 
       if (!description || typeof description !== 'string') {
         const response: GenerateTitleErrorResponse = {

apps/server/src/routes/features/routes/import.ts

@@ -33,7 +33,7 @@ interface ConflictInfo {
   hasConflict: boolean;
 }
 
-export function createImportHandler(featureLoader: FeatureLoader) {
+export function createImportHandler(_featureLoader: FeatureLoader) {
   const exportService = getFeatureExportService();
 
   return async (req: Request, res: Response): Promise<void> => {

apps/server/src/routes/fs/index.ts

@@ -19,6 +19,7 @@ import { createBrowseHandler } from './routes/browse.js';
 import { createImageHandler } from './routes/image.js';
 import { createSaveBoardBackgroundHandler } from './routes/save-board-background.js';
 import { createDeleteBoardBackgroundHandler } from './routes/delete-board-background.js';
+import { createBrowseProjectFilesHandler } from './routes/browse-project-files.js';
 
 export function createFsRoutes(_events: EventEmitter): Router {
   const router = Router();
@@ -37,6 +38,7 @@ export function createFsRoutes(_events: EventEmitter): Router {
   router.get('/image', createImageHandler());
   router.post('/save-board-background', createSaveBoardBackgroundHandler());
   router.post('/delete-board-background', createDeleteBoardBackgroundHandler());
+  router.post('/browse-project-files', createBrowseProjectFilesHandler());
 
   return router;
 }

apps/server/src/routes/fs/routes/browse-project-files.ts

@@ -0,0 +1,191 @@
+/**
+ * POST /browse-project-files endpoint - Browse files and directories within a project
+ *
+ * Unlike /browse which only lists directories (for project folder selection),
+ * this endpoint lists both files and directories relative to a project root.
+ * Used by the file selector for "Copy files to worktree" settings.
+ *
+ * Features:
+ * - Lists both files and directories
+ * - Hides .git, .worktrees, node_modules, and other build artifacts
+ * - Returns entries relative to the project root
+ * - Supports navigating into subdirectories
+ * - Security: prevents path traversal outside project root
+ */
+
+import type { Request, Response } from 'express';
+import * as secureFs from '../../../lib/secure-fs.js';
+import path from 'path';
+import { PathNotAllowedError } from '@automaker/platform';
+import { getErrorMessage, logError } from '../common.js';
+
+// Directories to hide from the listing (build artifacts, caches, etc.)
+const HIDDEN_DIRECTORIES = new Set([
+  '.git',
+  '.worktrees',
+  'node_modules',
+  '.automaker',
+  '__pycache__',
+  '.cache',
+  '.next',
+  '.nuxt',
+  '.svelte-kit',
+  '.turbo',
+  '.vercel',
+  '.output',
+  'coverage',
+  '.nyc_output',
+  'dist',
+  'build',
+  'out',
+  '.tmp',
+  'tmp',
+  '.venv',
+  'venv',
+  'target',
+  'vendor',
+  '.gradle',
+  '.idea',
+  '.vscode',
+]);
+
+interface ProjectFileEntry {
+  name: string;
+  relativePath: string;
+  isDirectory: boolean;
+  isFile: boolean;
+}
+
+export function createBrowseProjectFilesHandler() {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { projectPath, relativePath } = req.body as {
+        projectPath: string;
+        relativePath?: string; // Relative path within the project to browse (empty = project root)
+      };
+
+      if (!projectPath) {
+        res.status(400).json({ success: false, error: 'projectPath is required' });
+        return;
+      }
+
+      const resolvedProjectPath = path.resolve(projectPath);
+
+      // Determine the target directory to browse
+      let targetPath = resolvedProjectPath;
+      let currentRelativePath = '';
+
+      if (relativePath) {
+        // Security: normalize and validate the relative path
+        const normalized = path.normalize(relativePath);
+        if (normalized.startsWith('..') || path.isAbsolute(normalized)) {
+          res.status(400).json({
+            success: false,
+            error: 'Invalid relative path - must be within the project directory',
+          });
+          return;
+        }
+        targetPath = path.join(resolvedProjectPath, normalized);
+        currentRelativePath = normalized;
+
+        // Double-check the resolved path is within the project
+        // Use a separator-terminated prefix to prevent matching sibling dirs
+        // that share the same prefix (e.g. /projects/foo vs /projects/foobar).
+        const resolvedTarget = path.resolve(targetPath);
+        const projectPrefix = resolvedProjectPath.endsWith(path.sep)
+          ? resolvedProjectPath
+          : resolvedProjectPath + path.sep;
+        if (!resolvedTarget.startsWith(projectPrefix) && resolvedTarget !== resolvedProjectPath) {
+          res.status(400).json({
+            success: false,
+            error: 'Path traversal detected',
+          });
+          return;
+        }
+      }
+
+      // Determine parent relative path
+      let parentRelativePath: string | null = null;
+      if (currentRelativePath) {
+        const parent = path.dirname(currentRelativePath);
+        parentRelativePath = parent === '.' ? '' : parent;
+      }
+
+      try {
+        const stat = await secureFs.stat(targetPath);
+
+        if (!stat.isDirectory()) {
+          res.status(400).json({ success: false, error: 'Path is not a directory' });
+          return;
+        }
+
+        // Read directory contents
+        const dirEntries = await secureFs.readdir(targetPath, { withFileTypes: true });
+
+        // Filter and map entries
+        const entries: ProjectFileEntry[] = dirEntries
+          .filter((entry) => {
+            // Skip hidden directories (build artifacts, etc.)
+            if (entry.isDirectory() && HIDDEN_DIRECTORIES.has(entry.name)) {
+              return false;
+            }
+            // Skip entries starting with . (hidden files) except common config files
+            // We keep hidden files visible since users often need .env, .eslintrc, etc.
+            return true;
+          })
+          .map((entry) => {
+            const entryRelativePath = currentRelativePath
+              ? path.posix.join(currentRelativePath.replace(/\\/g, '/'), entry.name)
+              : entry.name;
+
+            return {
+              name: entry.name,
+              relativePath: entryRelativePath,
+              isDirectory: entry.isDirectory(),
+              isFile: entry.isFile(),
+            };
+          })
+          // Sort: directories first, then files, alphabetically within each group
+          .sort((a, b) => {
+            if (a.isDirectory !== b.isDirectory) {
+              return a.isDirectory ? -1 : 1;
+            }
+            return a.name.localeCompare(b.name);
+          });
+
+        res.json({
+          success: true,
+          currentRelativePath,
+          parentRelativePath,
+          entries,
+        });
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Failed to read directory';
+        const isPermissionError = errorMessage.includes('EPERM') || errorMessage.includes('EACCES');
+
+        if (isPermissionError) {
+          res.json({
+            success: true,
+            currentRelativePath,
+            parentRelativePath,
+            entries: [],
+            warning: 'Permission denied - unable to read this directory',
+          });
+        } else {
+          res.status(400).json({
+            success: false,
+            error: errorMessage,
+          });
+        }
+      }
+    } catch (error) {
+      if (error instanceof PathNotAllowedError) {
+        res.status(403).json({ success: false, error: getErrorMessage(error) });
+        return;
+      }
+
+      logError(error, 'Browse project files failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/fs/routes/mkdir.ts

@@ -35,9 +35,9 @@ export function createMkdirHandler() {
           error: 'Path exists and is not a directory',
         });
         return;
-      } catch (statError: any) {
+      } catch (statError: unknown) {
         // ENOENT means path doesn't exist - we should create it
-        if (statError.code !== 'ENOENT') {
+        if ((statError as NodeJS.ErrnoException).code !== 'ENOENT') {
           // Some other error (could be ELOOP in parent path)
           throw statError;
         }
@@ -47,7 +47,7 @@ export function createMkdirHandler() {
       await secureFs.mkdir(resolvedPath, { recursive: true });
 
       res.json({ success: true });
-    } catch (error: any) {
+    } catch (error: unknown) {
       // Path not allowed - return 403 Forbidden
       if (error instanceof PathNotAllowedError) {
         res.status(403).json({ success: false, error: getErrorMessage(error) });
@@ -55,7 +55,7 @@ export function createMkdirHandler() {
       }
 
       // Handle ELOOP specifically
-      if (error.code === 'ELOOP') {
+      if ((error as NodeJS.ErrnoException).code === 'ELOOP') {
         logError(error, 'Create directory failed - symlink loop detected');
         res.status(400).json({
           success: false,

apps/server/src/routes/fs/routes/resolve-directory.ts

@@ -10,7 +10,11 @@ import { getErrorMessage, logError } from '../common.js';
 export function createResolveDirectoryHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { directoryName, sampleFiles, fileCount } = req.body as {
+      const {
+        directoryName,
+        sampleFiles,
+        fileCount: _fileCount,
+      } = req.body as {
         directoryName: string;
         sampleFiles?: string[];
         fileCount?: number;

apps/server/src/routes/fs/routes/save-board-background.ts

@@ -11,10 +11,9 @@ import { getBoardDir } from '@automaker/platform';
 export function createSaveBoardBackgroundHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { data, filename, mimeType, projectPath } = req.body as {
+      const { data, filename, projectPath } = req.body as {
         data: string;
         filename: string;
-        mimeType: string;
         projectPath: string;
       };
 

apps/server/src/routes/fs/routes/save-image.ts

@@ -12,10 +12,9 @@ import { sanitizeFilename } from '@automaker/utils';
 export function createSaveImageHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { data, filename, mimeType, projectPath } = req.body as {
+      const { data, filename, projectPath } = req.body as {
         data: string;
         filename: string;
-        mimeType: string;
         projectPath: string;
       };
 

apps/server/src/routes/fs/routes/validate-path.ts

@@ -5,7 +5,7 @@
 import type { Request, Response } from 'express';
 import * as secureFs from '../../../lib/secure-fs.js';
 import path from 'path';
-import { isPathAllowed, PathNotAllowedError, getAllowedRootDirectory } from '@automaker/platform';
+import { isPathAllowed, getAllowedRootDirectory } from '@automaker/platform';
 import { getErrorMessage, logError } from '../common.js';
 
 export function createValidatePathHandler() {

apps/server/src/routes/gemini/index.ts

@@ -0,0 +1,66 @@
+import { Router, Request, Response } from 'express';
+import { GeminiProvider } from '../../providers/gemini-provider.js';
+import { GeminiUsageService } from '../../services/gemini-usage-service.js';
+import { createLogger } from '@automaker/utils';
+import type { EventEmitter } from '../../lib/events.js';
+
+const logger = createLogger('Gemini');
+
+export function createGeminiRoutes(
+  usageService: GeminiUsageService,
+  _events: EventEmitter
+): Router {
+  const router = Router();
+
+  // Get current usage/quota data from Google Cloud API
+  router.get('/usage', async (_req: Request, res: Response) => {
+    try {
+      const usageData = await usageService.fetchUsageData();
+
+      res.json(usageData);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      logger.error('Error fetching Gemini usage:', error);
+
+      // Return error in a format the UI expects
+      res.status(200).json({
+        authenticated: false,
+        authMethod: 'none',
+        usedPercent: 0,
+        remainingPercent: 100,
+        lastUpdated: new Date().toISOString(),
+        error: `Failed to fetch Gemini usage: ${message}`,
+      });
+    }
+  });
+
+  // Check if Gemini is available
+  router.get('/status', async (_req: Request, res: Response) => {
+    try {
+      const provider = new GeminiProvider();
+      const status = await provider.detectInstallation();
+
+      // Derive authMethod from typed InstallationStatus fields
+      const authMethod = status.authenticated
+        ? status.hasApiKey
+          ? 'api_key'
+          : 'cli_login'
+        : 'none';
+
+      res.json({
+        success: true,
+        installed: status.installed,
+        version: status.version || null,
+        path: status.path || null,
+        authenticated: status.authenticated || false,
+        authMethod,
+        hasCredentialsFile: false,
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      res.status(500).json({ success: false, error: message });
+    }
+  });
+
+  return router;
+}

apps/server/src/routes/git/index.ts

@@ -6,12 +6,18 @@ import { Router } from 'express';
 import { validatePathParams } from '../../middleware/validate-paths.js';
 import { createDiffsHandler } from './routes/diffs.js';
 import { createFileDiffHandler } from './routes/file-diff.js';
+import { createStageFilesHandler } from './routes/stage-files.js';
 
 export function createGitRoutes(): Router {
   const router = Router();
 
   router.post('/diffs', validatePathParams('projectPath'), createDiffsHandler());
   router.post('/file-diff', validatePathParams('projectPath', 'filePath'), createFileDiffHandler());
+  router.post(
+    '/stage-files',
+    validatePathParams('projectPath', 'files[]'),
+    createStageFilesHandler()
+  );
 
   return router;
 }

apps/server/src/routes/git/routes/stage-files.ts

@@ -0,0 +1,67 @@
+/**
+ * POST /stage-files endpoint - Stage or unstage files in the main project
+ */
+
+import type { Request, Response } from 'express';
+import { getErrorMessage, logError } from '../common.js';
+import { stageFiles, StageFilesValidationError } from '../../../services/stage-files-service.js';
+
+export function createStageFilesHandler() {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { projectPath, files, operation } = req.body as {
+        projectPath: string;
+        files: string[];
+        operation: 'stage' | 'unstage';
+      };
+
+      if (!projectPath) {
+        res.status(400).json({
+          success: false,
+          error: 'projectPath required',
+        });
+        return;
+      }
+
+      if (!Array.isArray(files) || files.length === 0) {
+        res.status(400).json({
+          success: false,
+          error: 'files array required and must not be empty',
+        });
+        return;
+      }
+
+      for (const file of files) {
+        if (typeof file !== 'string' || file.trim() === '') {
+          res.status(400).json({
+            success: false,
+            error: 'Each element of files must be a non-empty string',
+          });
+          return;
+        }
+      }
+
+      if (operation !== 'stage' && operation !== 'unstage') {
+        res.status(400).json({
+          success: false,
+          error: 'operation must be "stage" or "unstage"',
+        });
+        return;
+      }
+
+      const result = await stageFiles(projectPath, files, operation);
+
+      res.json({
+        success: true,
+        result,
+      });
+    } catch (error) {
+      if (error instanceof StageFilesValidationError) {
+        res.status(400).json({ success: false, error: error.message });
+        return;
+      }
+      logError(error, `${(req.body as { operation?: string })?.operation ?? 'stage'} files failed`);
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/github/routes/validation-endpoints.ts

@@ -6,7 +6,6 @@ import type { Request, Response } from 'express';
 import type { EventEmitter } from '../../../lib/events.js';
 import type { IssueValidationEvent } from '@automaker/types';
 import {
-  isValidationRunning,
   getValidationStatus,
   getRunningValidations,
   abortValidation,
@@ -15,7 +14,6 @@ import {
   logger,
 } from './validation-common.js';
 import {
-  readValidation,
   getAllValidations,
   getValidationWithFreshness,
   deleteValidation,

apps/server/src/routes/models/routes/providers.ts

@@ -12,7 +12,7 @@ export function createProvidersHandler() {
       // Get installation status from all providers
       const statuses = await ProviderFactory.checkAllProviders();
 
-      const providers: Record<string, any> = {
+      const providers: Record<string, Record<string, unknown>> = {
         anthropic: {
           available: statuses.claude?.installed || false,
           hasApiKey: !!process.env.ANTHROPIC_API_KEY,

apps/server/src/routes/settings/routes/update-global.ts

@@ -46,16 +46,14 @@ export function createUpdateGlobalHandler(settingsService: SettingsService) {
       }
 
       // Minimal debug logging to help diagnose accidental wipes.
-      const projectsLen = Array.isArray((updates as any).projects)
-        ? (updates as any).projects.length
-        : undefined;
-      const trashedLen = Array.isArray((updates as any).trashedProjects)
-        ? (updates as any).trashedProjects.length
+      const projectsLen = Array.isArray(updates.projects) ? updates.projects.length : undefined;
+      const trashedLen = Array.isArray(updates.trashedProjects)
+        ? updates.trashedProjects.length
         : undefined;
       logger.info(
         `[SERVER_SETTINGS_UPDATE] Request received: projects=${projectsLen ?? 'n/a'}, trashedProjects=${trashedLen ?? 'n/a'}, theme=${
-          (updates as any).theme ?? 'n/a'
-        }, localStorageMigrated=${(updates as any).localStorageMigrated ?? 'n/a'}`
+          updates.theme ?? 'n/a'
+        }, localStorageMigrated=${updates.localStorageMigrated ?? 'n/a'}`
       );
 
       // Get old settings to detect theme changes

apps/server/src/routes/setup/routes/auth-claude.ts

@@ -4,13 +4,9 @@
 
 import type { Request, Response } from 'express';
 import { getErrorMessage, logError } from '../common.js';
-import { exec } from 'child_process';
-import { promisify } from 'util';
 import * as fs from 'fs';
 import * as path from 'path';
 
-const execAsync = promisify(exec);
-
 export function createAuthClaudeHandler() {
   return async (_req: Request, res: Response): Promise<void> => {
     try {

apps/server/src/routes/setup/routes/auth-opencode.ts

@@ -4,13 +4,9 @@
 
 import type { Request, Response } from 'express';
 import { logError, getErrorMessage } from '../common.js';
-import { exec } from 'child_process';
-import { promisify } from 'util';
 import * as fs from 'fs';
 import * as path from 'path';
 
-const execAsync = promisify(exec);
-
 export function createAuthOpencodeHandler() {
   return async (_req: Request, res: Response): Promise<void> => {
     try {

apps/server/src/routes/setup/routes/copilot-models.ts

@@ -10,9 +10,6 @@ import type { Request, Response } from 'express';
 import { CopilotProvider } from '../../../providers/copilot-provider.js';
 import { getErrorMessage, logError } from '../common.js';
 import type { ModelDefinition } from '@automaker/types';
-import { createLogger } from '@automaker/utils';
-
-const logger = createLogger('CopilotModelsRoute');
 
 // Singleton provider instance for caching
 let providerInstance: CopilotProvider | null = null;

apps/server/src/routes/setup/routes/opencode-models.ts

@@ -14,9 +14,6 @@ import {
 } from '../../../providers/opencode-provider.js';
 import { getErrorMessage, logError } from '../common.js';
 import type { ModelDefinition } from '@automaker/types';
-import { createLogger } from '@automaker/utils';
-
-const logger = createLogger('OpenCodeModelsRoute');
 
 // Singleton provider instance for caching
 let providerInstance: OpencodeProvider | null = null;

apps/server/src/routes/setup/routes/verify-claude-auth.ts

@@ -110,6 +110,7 @@ export function createVerifyClaudeAuthHandler() {
       let authenticated = false;
       let errorMessage = '';
       let receivedAnyContent = false;
+      let cleanupEnv: (() => void) | undefined;
 
       // Create secure auth session
       const sessionId = `claude-auth-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
@@ -151,13 +152,13 @@ export function createVerifyClaudeAuthHandler() {
         AuthSessionManager.createSession(sessionId, authMethod || 'api_key', apiKey, 'anthropic');
 
         // Create temporary environment override for SDK call
-        const cleanupEnv = createTempEnvOverride(authEnv);
+        cleanupEnv = createTempEnvOverride(authEnv);
 
         // Run a minimal query to verify authentication
         const stream = query({
           prompt: "Reply with only the word 'ok'",
           options: {
-            model: 'claude-sonnet-4-20250514',
+            model: 'claude-sonnet-4-6',
             maxTurns: 1,
             allowedTools: [],
             abortController,
@@ -194,8 +195,10 @@ export function createVerifyClaudeAuthHandler() {
           }
 
           // Check specifically for assistant messages with text content
-          if (msg.type === 'assistant' && (msg as any).message?.content) {
-            const content = (msg as any).message.content;
+          const msgRecord = msg as Record<string, unknown>;
+          const msgMessage = msgRecord.message as Record<string, unknown> | undefined;
+          if (msg.type === 'assistant' && msgMessage?.content) {
+            const content = msgMessage.content;
             if (Array.isArray(content)) {
               for (const block of content) {
                 if (block.type === 'text' && block.text) {
@@ -311,6 +314,8 @@ export function createVerifyClaudeAuthHandler() {
         }
       } finally {
         clearTimeout(timeoutId);
+        // Restore process.env to its original state
+        cleanupEnv?.();
         // Clean up the auth session
         AuthSessionManager.destroySession(sessionId);
       }

apps/server/src/routes/terminal/common.ts

@@ -5,7 +5,6 @@
 import { randomBytes } from 'crypto';
 import { createLogger } from '@automaker/utils';
 import type { Request, Response, NextFunction } from 'express';
-import { getTerminalService } from '../../services/terminal-service.js';
 
 const logger = createLogger('Terminal');
 

apps/server/src/routes/terminal/routes/auth.ts

@@ -9,7 +9,6 @@ import {
   generateToken,
   addToken,
   getTokenExpiryMs,
-  getErrorMessage,
 } from '../common.js';
 
 export function createAuthHandler() {

apps/server/src/routes/worktree/common.ts

@@ -2,59 +2,21 @@
  * Common utilities for worktree routes
  */
 
-import { createLogger } from '@automaker/utils';
-import { spawnProcess } from '@automaker/platform';
+import { createLogger, isValidBranchName, MAX_BRANCH_NAME_LENGTH } from '@automaker/utils';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { getErrorMessage as getErrorMessageShared, createLogError } from '../common.js';
 
+// Re-export execGitCommand from the canonical shared module so any remaining
+// consumers that import from this file continue to work.
+export { execGitCommand } from '../../lib/git.js';
+
 const logger = createLogger('Worktree');
 export const execAsync = promisify(exec);
 
-// ============================================================================
-// Secure Command Execution
-// ============================================================================
-
-/**
- * Execute git command with array arguments to prevent command injection.
- * Uses spawnProcess from @automaker/platform for secure, cross-platform execution.
- *
- * @param args - Array of git command arguments (e.g., ['worktree', 'add', path])
- * @param cwd - Working directory to execute the command in
- * @returns Promise resolving to stdout output
- * @throws Error with stderr message if command fails
- *
- * @example
- * ```typescript
- * // Safe: no injection possible
- * await execGitCommand(['branch', '-D', branchName], projectPath);
- *
- * // Instead of unsafe:
- * // await execAsync(`git branch -D ${branchName}`, { cwd });
- * ```
- */
-export async function execGitCommand(args: string[], cwd: string): Promise<string> {
-  const result = await spawnProcess({
-    command: 'git',
-    args,
-    cwd,
-  });
-
-  // spawnProcess returns { stdout, stderr, exitCode }
-  if (result.exitCode === 0) {
-    return result.stdout;
-  } else {
-    const errorMessage = result.stderr || `Git command failed with code ${result.exitCode}`;
-    throw new Error(errorMessage);
-  }
-}
-
-// ============================================================================
-// Constants
-// ============================================================================
-
-/** Maximum allowed length for git branch names */
-export const MAX_BRANCH_NAME_LENGTH = 250;
+// Re-export git validation utilities from the canonical shared module so
+// existing consumers that import from this file continue to work.
+export { isValidBranchName, MAX_BRANCH_NAME_LENGTH };
 
 // ============================================================================
 // Extended PATH configuration for Electron apps
@@ -98,17 +60,23 @@ export const execEnv = {
   PATH: extendedPath,
 };
 
-// ============================================================================
-// Validation utilities
-// ============================================================================
-
 /**
- * Validate branch name to prevent command injection.
- * Git branch names cannot contain: space, ~, ^, :, ?, *, [, \, or control chars.
- * We also reject shell metacharacters for safety.
+ * Validate git remote name to prevent command injection.
+ * Matches the strict validation used in add-remote.ts:
+ * - Rejects empty strings and names that are too long
+ * - Disallows names that start with '-' or '.'
+ * - Forbids the substring '..'
+ * - Rejects '/' characters
+ * - Rejects NUL bytes
+ * - Must consist only of alphanumerics, hyphens, underscores, and dots
  */
-export function isValidBranchName(name: string): boolean {
-  return /^[a-zA-Z0-9._\-/]+$/.test(name) && name.length < MAX_BRANCH_NAME_LENGTH;
+export function isValidRemoteName(name: string): boolean {
+  if (!name || name.length === 0 || name.length >= MAX_BRANCH_NAME_LENGTH) return false;
+  if (name.startsWith('-') || name.startsWith('.')) return false;
+  if (name.includes('..')) return false;
+  if (name.includes('/')) return false;
+  if (name.includes('\0')) return false;
+  return /^[a-zA-Z0-9._-]+$/.test(name);
 }
 
 /**

apps/server/src/routes/worktree/index.ts

@@ -51,9 +51,22 @@ import {
   createDeleteInitScriptHandler,
   createRunInitScriptHandler,
 } from './routes/init-script.js';
+import { createCommitLogHandler } from './routes/commit-log.js';
 import { createDiscardChangesHandler } from './routes/discard-changes.js';
 import { createListRemotesHandler } from './routes/list-remotes.js';
 import { createAddRemoteHandler } from './routes/add-remote.js';
+import { createStashPushHandler } from './routes/stash-push.js';
+import { createStashListHandler } from './routes/stash-list.js';
+import { createStashApplyHandler } from './routes/stash-apply.js';
+import { createStashDropHandler } from './routes/stash-drop.js';
+import { createCherryPickHandler } from './routes/cherry-pick.js';
+import { createBranchCommitLogHandler } from './routes/branch-commit-log.js';
+import { createGeneratePRDescriptionHandler } from './routes/generate-pr-description.js';
+import { createRebaseHandler } from './routes/rebase.js';
+import { createAbortOperationHandler } from './routes/abort-operation.js';
+import { createContinueOperationHandler } from './routes/continue-operation.js';
+import { createStageFilesHandler } from './routes/stage-files.js';
+import { createCheckChangesHandler } from './routes/check-changes.js';
 import type { SettingsService } from '../../services/settings-service.js';
 
 export function createWorktreeRoutes(
@@ -71,9 +84,13 @@ export function createWorktreeRoutes(
     '/merge',
     validatePathParams('projectPath'),
     requireValidProject,
-    createMergeHandler()
+    createMergeHandler(events)
+  );
+  router.post(
+    '/create',
+    validatePathParams('projectPath'),
+    createCreateHandler(events, settingsService)
   );
-  router.post('/create', validatePathParams('projectPath'), createCreateHandler(events));
   router.post('/delete', validatePathParams('projectPath', 'worktreePath'), createDeleteHandler());
   router.post('/create-pr', createCreatePRHandler());
   router.post('/pr-info', createPRInfoHandler());
@@ -105,7 +122,13 @@ export function createWorktreeRoutes(
     '/checkout-branch',
     validatePathParams('worktreePath'),
     requireValidWorktree,
-    createCheckoutBranchHandler()
+    createCheckoutBranchHandler(events)
+  );
+  router.post(
+    '/check-changes',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createCheckChangesHandler()
   );
   router.post(
     '/list-branches',
@@ -113,7 +136,12 @@ export function createWorktreeRoutes(
     requireValidWorktree,
     createListBranchesHandler()
   );
-  router.post('/switch-branch', requireValidWorktree, createSwitchBranchHandler());
+  router.post(
+    '/switch-branch',
+    validatePathParams('worktreePath'),
+    requireValidWorktree,
+    createSwitchBranchHandler(events)
+  );
   router.post('/open-in-editor', validatePathParams('worktreePath'), createOpenInEditorHandler());
   router.post(
     '/open-in-terminal',
@@ -192,5 +220,95 @@ export function createWorktreeRoutes(
     createAddRemoteHandler()
   );
 
+  // Commit log route
+  router.post(
+    '/commit-log',
+    validatePathParams('worktreePath'),
+    requireValidWorktree,
+    createCommitLogHandler(events)
+  );
+
+  // Stash routes
+  router.post(
+    '/stash-push',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createStashPushHandler(events)
+  );
+  router.post(
+    '/stash-list',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createStashListHandler(events)
+  );
+  router.post(
+    '/stash-apply',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createStashApplyHandler(events)
+  );
+  router.post(
+    '/stash-drop',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createStashDropHandler(events)
+  );
+
+  // Cherry-pick route
+  router.post(
+    '/cherry-pick',
+    validatePathParams('worktreePath'),
+    requireValidWorktree,
+    createCherryPickHandler(events)
+  );
+
+  // Generate PR description route
+  router.post(
+    '/generate-pr-description',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createGeneratePRDescriptionHandler(settingsService)
+  );
+
+  // Branch commit log route (get commits from a specific branch)
+  router.post(
+    '/branch-commit-log',
+    validatePathParams('worktreePath'),
+    requireValidWorktree,
+    createBranchCommitLogHandler(events)
+  );
+
+  // Rebase route
+  router.post(
+    '/rebase',
+    validatePathParams('worktreePath'),
+    requireValidWorktree,
+    createRebaseHandler(events)
+  );
+
+  // Abort in-progress merge/rebase/cherry-pick
+  router.post(
+    '/abort-operation',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createAbortOperationHandler(events)
+  );
+
+  // Continue in-progress merge/rebase/cherry-pick after resolving conflicts
+  router.post(
+    '/continue-operation',
+    validatePathParams('worktreePath'),
+    requireGitRepoOnly,
+    createContinueOperationHandler(events)
+  );
+
+  // Stage/unstage files route
+  router.post(
+    '/stage-files',
+    validatePathParams('worktreePath', 'files[]'),
+    requireGitRepoOnly,
+    createStageFilesHandler()
+  );
+
   return router;
 }

apps/server/src/routes/worktree/routes/abort-operation.ts

@@ -0,0 +1,117 @@
+/**
+ * POST /abort-operation endpoint - Abort an in-progress merge, rebase, or cherry-pick
+ *
+ * Detects which operation (merge, rebase, or cherry-pick) is in progress
+ * and aborts it, returning the repository to a clean state.
+ */
+
+import type { Request, Response } from 'express';
+import path from 'path';
+import * as fs from 'fs/promises';
+import { getErrorMessage, logError, execAsync } from '../common.js';
+import type { EventEmitter } from '../../../lib/events.js';
+
+/**
+ * Detect what type of conflict operation is currently in progress
+ */
+async function detectOperation(
+  worktreePath: string
+): Promise<'merge' | 'rebase' | 'cherry-pick' | null> {
+  try {
+    const { stdout: gitDirRaw } = await execAsync('git rev-parse --git-dir', {
+      cwd: worktreePath,
+    });
+    const gitDir = path.resolve(worktreePath, gitDirRaw.trim());
+
+    const [rebaseMergeExists, rebaseApplyExists, mergeHeadExists, cherryPickHeadExists] =
+      await Promise.all([
+        fs
+          .access(path.join(gitDir, 'rebase-merge'))
+          .then(() => true)
+          .catch(() => false),
+        fs
+          .access(path.join(gitDir, 'rebase-apply'))
+          .then(() => true)
+          .catch(() => false),
+        fs
+          .access(path.join(gitDir, 'MERGE_HEAD'))
+          .then(() => true)
+          .catch(() => false),
+        fs
+          .access(path.join(gitDir, 'CHERRY_PICK_HEAD'))
+          .then(() => true)
+          .catch(() => false),
+      ]);
+
+    if (rebaseMergeExists || rebaseApplyExists) return 'rebase';
+    if (mergeHeadExists) return 'merge';
+    if (cherryPickHeadExists) return 'cherry-pick';
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export function createAbortOperationHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath } = req.body as {
+        worktreePath: string;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath is required',
+        });
+        return;
+      }
+
+      const resolvedWorktreePath = path.resolve(worktreePath);
+
+      // Detect what operation is in progress
+      const operation = await detectOperation(resolvedWorktreePath);
+
+      if (!operation) {
+        res.status(400).json({
+          success: false,
+          error: 'No merge, rebase, or cherry-pick in progress',
+        });
+        return;
+      }
+
+      // Abort the operation
+      let abortCommand: string;
+      switch (operation) {
+        case 'merge':
+          abortCommand = 'git merge --abort';
+          break;
+        case 'rebase':
+          abortCommand = 'git rebase --abort';
+          break;
+        case 'cherry-pick':
+          abortCommand = 'git cherry-pick --abort';
+          break;
+      }
+
+      await execAsync(abortCommand, { cwd: resolvedWorktreePath });
+
+      // Emit event
+      events.emit('conflict:aborted', {
+        worktreePath: resolvedWorktreePath,
+        operation,
+      });
+
+      res.json({
+        success: true,
+        result: {
+          operation,
+          message: `${operation.charAt(0).toUpperCase() + operation.slice(1)} aborted successfully`,
+        },
+      });
+    } catch (error) {
+      logError(error, 'Abort operation failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/branch-commit-log.ts

@@ -0,0 +1,92 @@
+/**
+ * POST /branch-commit-log endpoint - Get recent commit history for a specific branch
+ *
+ * Similar to commit-log but allows specifying a branch name to get commits from
+ * any branch, not just the currently checked out one. Useful for cherry-pick workflows
+ * where you need to browse commits from other branches.
+ *
+ * The handler only validates input, invokes the service, streams lifecycle events
+ * via the EventEmitter, and sends the final JSON response.
+ *
+ * Note: Git repository validation (isGitRepo, hasCommits) is handled by
+ * the requireValidWorktree middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import type { EventEmitter } from '../../../lib/events.js';
+import { getErrorMessage, logError } from '../common.js';
+import { getBranchCommitLog } from '../../../services/branch-commit-log-service.js';
+import { isValidBranchName } from '@automaker/utils';
+
+export function createBranchCommitLogHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const {
+        worktreePath,
+        branchName,
+        limit = 20,
+      } = req.body as {
+        worktreePath: string;
+        branchName?: string;
+        limit?: number;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      // Validate branchName before forwarding to execGitCommand.
+      // Reject values that start with '-', contain NUL, contain path-traversal
+      // sequences, or include characters outside the safe whitelist.
+      // An absent branchName is allowed (the service defaults it to HEAD).
+      if (branchName !== undefined && !isValidBranchName(branchName)) {
+        res.status(400).json({
+          success: false,
+          error: 'Invalid branchName: value contains unsafe characters or sequences',
+        });
+        return;
+      }
+
+      // Emit start event so the frontend can observe progress
+      events.emit('branchCommitLog:start', {
+        worktreePath,
+        branchName: branchName || 'HEAD',
+        limit,
+      });
+
+      // Delegate all Git work to the service
+      const result = await getBranchCommitLog(worktreePath, branchName, limit);
+
+      // Emit progress with the number of commits fetched
+      events.emit('branchCommitLog:progress', {
+        worktreePath,
+        branchName: result.branch,
+        commitsLoaded: result.total,
+      });
+
+      // Emit done event
+      events.emit('branchCommitLog:done', {
+        worktreePath,
+        branchName: result.branch,
+        total: result.total,
+      });
+
+      res.json({
+        success: true,
+        result,
+      });
+    } catch (error) {
+      // Emit error event so the frontend can react
+      events.emit('branchCommitLog:error', {
+        error: getErrorMessage(error),
+      });
+
+      logError(error, 'Get branch commit log failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/branch-tracking.ts

@@ -31,8 +31,8 @@ export async function getTrackedBranches(projectPath: string): Promise<TrackedBr
     const content = (await secureFs.readFile(filePath, 'utf-8')) as string;
     const data: BranchTrackingData = JSON.parse(content);
     return data.branches || [];
-  } catch (error: any) {
-    if (error.code === 'ENOENT') {
+  } catch (error: unknown) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
       return [];
     }
     logger.warn('Failed to read tracked branches:', error);

apps/server/src/routes/worktree/routes/check-changes.ts

@@ -0,0 +1,104 @@
+/**
+ * POST /check-changes endpoint - Check for uncommitted changes in a worktree
+ *
+ * Returns a summary of staged, unstaged, and untracked files to help
+ * the user decide whether to stash before a branch operation.
+ *
+ * Note: Git repository validation (isGitRepo) is handled by
+ * the requireGitRepoOnly middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import { getErrorMessage, logError } from '../common.js';
+import { execGitCommand } from '../../../lib/git.js';
+
+/**
+ * Parse `git status --porcelain` output into categorised file lists.
+ *
+ * Porcelain format gives two status characters per line:
+ *   XY filename
+ * where X is the index (staged) status and Y is the worktree (unstaged) status.
+ *
+ *  - '?' in both columns → untracked
+ *  - Non-space/non-'?' in X → staged change
+ *  - Non-space/non-'?' in Y (when not untracked) → unstaged change
+ *
+ * A file can appear in both staged and unstaged if it was partially staged.
+ */
+function parseStatusOutput(stdout: string): {
+  staged: string[];
+  unstaged: string[];
+  untracked: string[];
+} {
+  const staged: string[] = [];
+  const unstaged: string[] = [];
+  const untracked: string[] = [];
+
+  const lines = stdout.trim().split('\n').filter(Boolean);
+
+  for (const line of lines) {
+    if (line.length < 3) continue;
+
+    const x = line[0]; // index status
+    const y = line[1]; // worktree status
+    // Handle renames which use " -> " separator
+    const rawPath = line.slice(3);
+    const filePath = rawPath.includes(' -> ') ? rawPath.split(' -> ')[1] : rawPath;
+
+    if (x === '?' && y === '?') {
+      untracked.push(filePath);
+    } else {
+      if (x !== ' ' && x !== '?') {
+        staged.push(filePath);
+      }
+      if (y !== ' ' && y !== '?') {
+        unstaged.push(filePath);
+      }
+    }
+  }
+
+  return { staged, unstaged, untracked };
+}
+
+export function createCheckChangesHandler() {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath } = req.body as {
+        worktreePath: string;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      // Get porcelain status (includes staged, unstaged, and untracked files)
+      const stdout = await execGitCommand(['status', '--porcelain'], worktreePath);
+
+      const { staged, unstaged, untracked } = parseStatusOutput(stdout);
+
+      const hasChanges = staged.length > 0 || unstaged.length > 0 || untracked.length > 0;
+
+      // Deduplicate file paths across staged, unstaged, and untracked arrays
+      // to avoid double-counting partially staged files
+      const uniqueFilePaths = new Set([...staged, ...unstaged, ...untracked]);
+
+      res.json({
+        success: true,
+        result: {
+          hasChanges,
+          staged,
+          unstaged,
+          untracked,
+          totalFiles: uniqueFilePaths.size,
+        },
+      });
+    } catch (error) {
+      logError(error, 'Check changes failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/checkout-branch.ts

@@ -1,6 +1,14 @@
 /**
  * POST /checkout-branch endpoint - Create and checkout a new branch
  *
+ * Supports automatic stash handling: when `stashChanges` is true, local changes
+ * are stashed before creating the branch and reapplied after. If the stash pop
+ * results in merge conflicts, returns a special response so the UI can create a
+ * conflict resolution task.
+ *
+ * Git business logic is delegated to checkout-branch-service.ts when stash
+ * handling is requested. Otherwise, falls back to the original simple flow.
+ *
  * Note: Git repository validation (isGitRepo, hasCommits) is handled by
  * the requireValidWorktree middleware in index.ts.
  * Path validation (ALLOWED_ROOT_DIRECTORY) is handled by validatePathParams
@@ -10,14 +18,22 @@
 import type { Request, Response } from 'express';
 import path from 'path';
 import { stat } from 'fs/promises';
-import { getErrorMessage, logError, isValidBranchName, execGitCommand } from '../common.js';
+import { getErrorMessage, logError, isValidBranchName } from '../common.js';
+import { execGitCommand } from '../../../lib/git.js';
+import type { EventEmitter } from '../../../lib/events.js';
+import { performCheckoutBranch } from '../../../services/checkout-branch-service.js';
 
-export function createCheckoutBranchHandler() {
+export function createCheckoutBranchHandler(events?: EventEmitter) {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { worktreePath, branchName } = req.body as {
+      const { worktreePath, branchName, baseBranch, stashChanges, includeUntracked } = req.body as {
         worktreePath: string;
         branchName: string;
+        baseBranch?: string;
+        /** When true, stash local changes before checkout and reapply after */
+        stashChanges?: boolean;
+        /** When true, include untracked files in the stash (defaults to true) */
+        includeUntracked?: boolean;
       };
 
       if (!worktreePath) {
@@ -46,9 +62,17 @@ export function createCheckoutBranchHandler() {
         return;
       }
 
+      // Validate base branch if provided
+      if (baseBranch && !isValidBranchName(baseBranch) && baseBranch !== 'HEAD') {
+        res.status(400).json({
+          success: false,
+          error:
+            'Invalid base branch name. Must contain only letters, numbers, dots, dashes, underscores, or slashes.',
+        });
+        return;
+      }
+
       // Resolve and validate worktreePath to prevent traversal attacks.
-      // The validatePathParams middleware checks against ALLOWED_ROOT_DIRECTORY,
-      // but we also resolve the path and verify it exists as a directory.
       const resolvedPath = path.resolve(worktreePath);
       try {
         const stats = await stat(resolvedPath);
@@ -67,7 +91,42 @@ export function createCheckoutBranchHandler() {
         return;
       }
 
-      // Get current branch for reference (using argument array to avoid shell injection)
+      // Use the service for stash-aware checkout
+      if (stashChanges) {
+        const result = await performCheckoutBranch(
+          resolvedPath,
+          branchName,
+          baseBranch,
+          {
+            stashChanges: true,
+            includeUntracked: includeUntracked ?? true,
+          },
+          events
+        );
+
+        if (!result.success) {
+          const statusCode = isBranchError(result.error) ? 400 : 500;
+          res.status(statusCode).json({
+            success: false,
+            error: result.error,
+            ...(result.stashPopConflicts !== undefined && {
+              stashPopConflicts: result.stashPopConflicts,
+            }),
+            ...(result.stashPopConflictMessage && {
+              stashPopConflictMessage: result.stashPopConflictMessage,
+            }),
+          });
+          return;
+        }
+
+        res.json({
+          success: true,
+          result: result.result,
+        });
+        return;
+      }
+
+      // Original simple flow (no stash handling)
       const currentBranchOutput = await execGitCommand(
         ['rev-parse', '--abbrev-ref', 'HEAD'],
         resolvedPath
@@ -77,7 +136,6 @@ export function createCheckoutBranchHandler() {
       // Check if branch already exists
       try {
         await execGitCommand(['rev-parse', '--verify', branchName], resolvedPath);
-        // Branch exists
         res.status(400).json({
           success: false,
           error: `Branch '${branchName}' already exists`,
@@ -87,8 +145,25 @@ export function createCheckoutBranchHandler() {
         // Branch doesn't exist, good to create
       }
 
-      // Create and checkout the new branch (using argument array to avoid shell injection)
-      await execGitCommand(['checkout', '-b', branchName], resolvedPath);
+      // If baseBranch is provided, verify it exists before using it
+      if (baseBranch) {
+        try {
+          await execGitCommand(['rev-parse', '--verify', baseBranch], resolvedPath);
+        } catch {
+          res.status(400).json({
+            success: false,
+            error: `Base branch '${baseBranch}' does not exist`,
+          });
+          return;
+        }
+      }
+
+      // Create and checkout the new branch
+      const checkoutArgs = ['checkout', '-b', branchName];
+      if (baseBranch) {
+        checkoutArgs.push(baseBranch);
+      }
+      await execGitCommand(checkoutArgs, resolvedPath);
 
       res.json({
         success: true,
@@ -99,8 +174,22 @@ export function createCheckoutBranchHandler() {
         },
       });
     } catch (error) {
+      events?.emit('switch:error', {
+        error: getErrorMessage(error),
+      });
+
       logError(error, 'Checkout branch failed');
       res.status(500).json({ success: false, error: getErrorMessage(error) });
     }
   };
 }
+
+/**
+ * Determine whether an error message represents a client error (400).
+ * Stash failures are server-side errors and are intentionally excluded here
+ * so they are returned as HTTP 500 rather than HTTP 400.
+ */
+function isBranchError(error?: string): boolean {
+  if (!error) return false;
+  return error.includes('already exists') || error.includes('does not exist');
+}

apps/server/src/routes/worktree/routes/cherry-pick.ts

@@ -0,0 +1,107 @@
+/**
+ * POST /cherry-pick endpoint - Cherry-pick one or more commits into the current branch
+ *
+ * Applies commits from another branch onto the current branch.
+ * Supports single or multiple commit cherry-picks.
+ *
+ * Git business logic is delegated to cherry-pick-service.ts.
+ * Events are emitted at key lifecycle points for WebSocket subscribers.
+ * The global event emitter is passed into the service so all lifecycle
+ * events (started, success, conflict, abort, verify-failed) are broadcast
+ * to WebSocket clients.
+ *
+ * Note: Git repository validation (isGitRepo, hasCommits) is handled by
+ * the requireValidWorktree middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import path from 'path';
+import { getErrorMessage, logError } from '../common.js';
+import type { EventEmitter } from '../../../lib/events.js';
+import { verifyCommits, runCherryPick } from '../../../services/cherry-pick-service.js';
+
+export function createCherryPickHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, commitHashes, options } = req.body as {
+        worktreePath: string;
+        commitHashes: string[];
+        options?: {
+          noCommit?: boolean;
+        };
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath is required',
+        });
+        return;
+      }
+
+      // Normalize the path to prevent path traversal and ensure consistent paths
+      const resolvedWorktreePath = path.resolve(worktreePath);
+
+      if (!commitHashes || !Array.isArray(commitHashes) || commitHashes.length === 0) {
+        res.status(400).json({
+          success: false,
+          error: 'commitHashes array is required and must contain at least one commit hash',
+        });
+        return;
+      }
+
+      // Validate each commit hash format (should be hex string)
+      for (const hash of commitHashes) {
+        if (!/^[a-fA-F0-9]+$/.test(hash)) {
+          res.status(400).json({
+            success: false,
+            error: `Invalid commit hash format: "${hash}"`,
+          });
+          return;
+        }
+      }
+
+      // Verify each commit exists via the service; emits cherry-pick:verify-failed if any hash is missing
+      const invalidHash = await verifyCommits(resolvedWorktreePath, commitHashes, events);
+      if (invalidHash !== null) {
+        res.status(400).json({
+          success: false,
+          error: `Commit "${invalidHash}" does not exist`,
+        });
+        return;
+      }
+
+      // Execute the cherry-pick via the service.
+      // The service emits: cherry-pick:started, cherry-pick:success, cherry-pick:conflict,
+      // and cherry-pick:abort at the appropriate lifecycle points.
+      const result = await runCherryPick(resolvedWorktreePath, commitHashes, options, events);
+
+      if (result.success) {
+        res.json({
+          success: true,
+          result: {
+            cherryPicked: result.cherryPicked,
+            commitHashes: result.commitHashes,
+            branch: result.branch,
+            message: result.message,
+          },
+        });
+      } else if (result.hasConflicts) {
+        res.status(409).json({
+          success: false,
+          error: result.error,
+          hasConflicts: true,
+          aborted: result.aborted,
+        });
+      }
+    } catch (error) {
+      // Emit failure event for unexpected (non-conflict) errors
+      events.emit('cherry-pick:failure', {
+        error: getErrorMessage(error),
+      });
+
+      logError(error, 'Cherry-pick failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/commit-log.ts

@@ -0,0 +1,72 @@
+/**
+ * POST /commit-log endpoint - Get recent commit history for a worktree
+ *
+ * The handler only validates input, invokes the service, streams lifecycle
+ * events via the EventEmitter, and sends the final JSON response.
+ *
+ * Git business logic is delegated to commit-log-service.ts.
+ * Events are emitted at key lifecycle points for WebSocket subscribers.
+ *
+ * Note: Git repository validation (isGitRepo, hasCommits) is handled by
+ * the requireValidWorktree middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import type { EventEmitter } from '../../../lib/events.js';
+import { getErrorMessage, logError } from '../common.js';
+import { getCommitLog } from '../../../services/commit-log-service.js';
+
+export function createCommitLogHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, limit = 20 } = req.body as {
+        worktreePath: string;
+        limit?: number;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      // Emit start event so the frontend can observe progress
+      events.emit('commitLog:start', {
+        worktreePath,
+        limit,
+      });
+
+      // Delegate all Git work to the service
+      const result = await getCommitLog(worktreePath, limit);
+
+      // Emit progress with the number of commits fetched
+      events.emit('commitLog:progress', {
+        worktreePath,
+        branch: result.branch,
+        commitsLoaded: result.total,
+      });
+
+      // Emit complete event
+      events.emit('commitLog:complete', {
+        worktreePath,
+        branch: result.branch,
+        total: result.total,
+      });
+
+      res.json({
+        success: true,
+        result,
+      });
+    } catch (error) {
+      // Emit error event so the frontend can react
+      events.emit('commitLog:error', {
+        error: getErrorMessage(error),
+      });
+
+      logError(error, 'Get commit log failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/commit.ts

@@ -6,18 +6,20 @@
  */
 
 import type { Request, Response } from 'express';
-import { exec } from 'child_process';
+import { exec, execFile } from 'child_process';
 import { promisify } from 'util';
 import { getErrorMessage, logError } from '../common.js';
 
 const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 export function createCommitHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { worktreePath, message } = req.body as {
+      const { worktreePath, message, files } = req.body as {
         worktreePath: string;
         message: string;
+        files?: string[];
       };
 
       if (!worktreePath || !message) {
@@ -44,11 +46,21 @@ export function createCommitHandler() {
         return;
       }
 
-      // Stage all changes
-      await execAsync('git add -A', { cwd: worktreePath });
+      // Stage changes - either specific files or all changes
+      if (files && files.length > 0) {
+        // Reset any previously staged changes first
+        await execFileAsync('git', ['reset', 'HEAD'], { cwd: worktreePath }).catch(() => {
+          // Ignore errors from reset (e.g., if nothing is staged)
+        });
+        // Stage only the selected files (args array avoids shell injection)
+        await execFileAsync('git', ['add', ...files], { cwd: worktreePath });
+      } else {
+        // Stage all changes (original behavior)
+        await execFileAsync('git', ['add', '-A'], { cwd: worktreePath });
+      }
 
-      // Create commit
-      await execAsync(`git commit -m "${message.replace(/"/g, '\\"')}"`, {
+      // Create commit (pass message as arg to avoid shell injection)
+      await execFileAsync('git', ['commit', '-m', message], {
         cwd: worktreePath,
       });
 

apps/server/src/routes/worktree/routes/continue-operation.ts

@@ -0,0 +1,151 @@
+/**
+ * POST /continue-operation endpoint - Continue an in-progress merge, rebase, or cherry-pick
+ *
+ * After conflicts have been resolved, this endpoint continues the operation.
+ * For merge: performs git commit (merge is auto-committed after conflict resolution)
+ * For rebase: runs git rebase --continue
+ * For cherry-pick: runs git cherry-pick --continue
+ */
+
+import type { Request, Response } from 'express';
+import path from 'path';
+import * as fs from 'fs/promises';
+import { getErrorMessage, logError, execAsync } from '../common.js';
+import type { EventEmitter } from '../../../lib/events.js';
+
+/**
+ * Detect what type of conflict operation is currently in progress
+ */
+async function detectOperation(
+  worktreePath: string
+): Promise<'merge' | 'rebase' | 'cherry-pick' | null> {
+  try {
+    const { stdout: gitDirRaw } = await execAsync('git rev-parse --git-dir', {
+      cwd: worktreePath,
+    });
+    const gitDir = path.resolve(worktreePath, gitDirRaw.trim());
+
+    const [rebaseMergeExists, rebaseApplyExists, mergeHeadExists, cherryPickHeadExists] =
+      await Promise.all([
+        fs
+          .access(path.join(gitDir, 'rebase-merge'))
+          .then(() => true)
+          .catch(() => false),
+        fs
+          .access(path.join(gitDir, 'rebase-apply'))
+          .then(() => true)
+          .catch(() => false),
+        fs
+          .access(path.join(gitDir, 'MERGE_HEAD'))
+          .then(() => true)
+          .catch(() => false),
+        fs
+          .access(path.join(gitDir, 'CHERRY_PICK_HEAD'))
+          .then(() => true)
+          .catch(() => false),
+      ]);
+
+    if (rebaseMergeExists || rebaseApplyExists) return 'rebase';
+    if (mergeHeadExists) return 'merge';
+    if (cherryPickHeadExists) return 'cherry-pick';
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check if there are still unmerged paths (unresolved conflicts)
+ */
+async function hasUnmergedPaths(worktreePath: string): Promise<boolean> {
+  try {
+    const { stdout: statusOutput } = await execAsync('git status --porcelain', {
+      cwd: worktreePath,
+    });
+    return statusOutput.split('\n').some((line) => /^(UU|AA|DD|AU|UA|DU|UD)/.test(line));
+  } catch {
+    return false;
+  }
+}
+
+export function createContinueOperationHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath } = req.body as {
+        worktreePath: string;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath is required',
+        });
+        return;
+      }
+
+      const resolvedWorktreePath = path.resolve(worktreePath);
+
+      // Detect what operation is in progress
+      const operation = await detectOperation(resolvedWorktreePath);
+
+      if (!operation) {
+        res.status(400).json({
+          success: false,
+          error: 'No merge, rebase, or cherry-pick in progress',
+        });
+        return;
+      }
+
+      // Check for unresolved conflicts
+      if (await hasUnmergedPaths(resolvedWorktreePath)) {
+        res.status(409).json({
+          success: false,
+          error:
+            'There are still unresolved conflicts. Please resolve all conflicts before continuing.',
+          hasUnresolvedConflicts: true,
+        });
+        return;
+      }
+
+      // Stage all resolved files first
+      await execAsync('git add -A', { cwd: resolvedWorktreePath });
+
+      // Continue the operation
+      let continueCommand: string;
+      switch (operation) {
+        case 'merge':
+          // For merge, we need to commit after resolving conflicts
+          continueCommand = 'git commit --no-edit';
+          break;
+        case 'rebase':
+          continueCommand = 'git rebase --continue';
+          break;
+        case 'cherry-pick':
+          continueCommand = 'git cherry-pick --continue';
+          break;
+      }
+
+      await execAsync(continueCommand, {
+        cwd: resolvedWorktreePath,
+        env: { ...process.env, GIT_EDITOR: 'true' }, // Prevent editor from opening
+      });
+
+      // Emit event
+      events.emit('conflict:resolved', {
+        worktreePath: resolvedWorktreePath,
+        operation,
+      });
+
+      res.json({
+        success: true,
+        result: {
+          operation,
+          message: `${operation.charAt(0).toUpperCase() + operation.slice(1)} continued successfully`,
+        },
+      });
+    } catch (error) {
+      logError(error, 'Continue operation failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/create-pr.ts

@@ -9,8 +9,11 @@ import {
   execAsync,
   execEnv,
   isValidBranchName,
+  isValidRemoteName,
   isGhCliAvailable,
 } from '../common.js';
+import { execGitCommand } from '../../../lib/git.js';
+import { spawnProcess } from '@automaker/platform';
 import { updateWorktreePRInfo } from '../../../lib/worktree-metadata.js';
 import { createLogger } from '@automaker/utils';
 import { validatePRState } from '@automaker/types';
@@ -20,16 +23,25 @@ const logger = createLogger('CreatePR');
 export function createCreatePRHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { worktreePath, projectPath, commitMessage, prTitle, prBody, baseBranch, draft } =
-        req.body as {
-          worktreePath: string;
-          projectPath?: string;
-          commitMessage?: string;
-          prTitle?: string;
-          prBody?: string;
-          baseBranch?: string;
-          draft?: boolean;
-        };
+      const {
+        worktreePath,
+        projectPath,
+        commitMessage,
+        prTitle,
+        prBody,
+        baseBranch,
+        draft,
+        remote,
+      } = req.body as {
+        worktreePath: string;
+        projectPath?: string;
+        commitMessage?: string;
+        prTitle?: string;
+        prBody?: string;
+        baseBranch?: string;
+        draft?: boolean;
+        remote?: string;
+      };
 
       if (!worktreePath) {
         res.status(400).json({
@@ -82,12 +94,9 @@ export function createCreatePRHandler() {
           logger.debug(`Running: git add -A`);
           await execAsync('git add -A', { cwd: worktreePath, env: execEnv });
 
-          // Create commit
+          // Create commit — pass message as a separate arg to avoid shell injection
           logger.debug(`Running: git commit`);
-          await execAsync(`git commit -m "${message.replace(/"/g, '\\"')}"`, {
-            cwd: worktreePath,
-            env: execEnv,
-          });
+          await execGitCommand(['commit', '-m', message], worktreePath);
 
           // Get commit hash
           const { stdout: hashOutput } = await execAsync('git rev-parse HEAD', {
@@ -110,17 +119,27 @@ export function createCreatePRHandler() {
         }
       }
 
-      // Push the branch to remote
+      // Validate remote name before use to prevent command injection
+      if (remote !== undefined && !isValidRemoteName(remote)) {
+        res.status(400).json({
+          success: false,
+          error: 'Invalid remote name contains unsafe characters',
+        });
+        return;
+      }
+
+      // Push the branch to remote (use selected remote or default to 'origin')
+      const pushRemote = remote || 'origin';
       let pushError: string | null = null;
       try {
-        await execAsync(`git push -u origin ${branchName}`, {
+        await execAsync(`git push ${pushRemote} ${branchName}`, {
           cwd: worktreePath,
           env: execEnv,
         });
-      } catch (error: unknown) {
+      } catch {
         // If push fails, try with --set-upstream
         try {
-          await execAsync(`git push --set-upstream origin ${branchName}`, {
+          await execAsync(`git push --set-upstream ${pushRemote} ${branchName}`, {
             cwd: worktreePath,
             env: execEnv,
           });
@@ -195,7 +214,7 @@ export function createCreatePRHandler() {
             }
           }
         }
-      } catch (error) {
+      } catch {
         // Couldn't parse remotes - will try fallback
       }
 
@@ -216,7 +235,7 @@ export function createCreatePRHandler() {
             originOwner = owner;
             repoUrl = `https://github.com/${owner}/${repo}`;
           }
-        } catch (error) {
+        } catch {
           // Failed to get repo URL from config
         }
       }
@@ -291,27 +310,35 @@ export function createCreatePRHandler() {
         // Only create a new PR if one doesn't already exist
         if (!prUrl) {
           try {
-            // Build gh pr create command
-            let prCmd = `gh pr create --base "${base}"`;
+            // Build gh pr create args as an array to avoid shell injection on
+            // title/body (backticks, $, \ were unsafe with string interpolation)
+            const prArgs = ['pr', 'create', '--base', base];
 
             // If this is a fork (has upstream remote), specify the repo and head
             if (upstreamRepo && originOwner) {
               // For forks: --repo specifies where to create PR, --head specifies source
-              prCmd += ` --repo "${upstreamRepo}" --head "${originOwner}:${branchName}"`;
+              prArgs.push('--repo', upstreamRepo, '--head', `${originOwner}:${branchName}`);
             } else {
               // Not a fork, just specify the head branch
-              prCmd += ` --head "${branchName}"`;
+              prArgs.push('--head', branchName);
             }
 
-            prCmd += ` --title "${title.replace(/"/g, '\\"')}" --body "${body.replace(/"/g, '\\"')}" ${draftFlag}`;
-            prCmd = prCmd.trim();
+            prArgs.push('--title', title, '--body', body);
+            if (draft) prArgs.push('--draft');
 
-            logger.debug(`Creating PR with command: ${prCmd}`);
-            const { stdout: prOutput } = await execAsync(prCmd, {
+            logger.debug(`Creating PR with args: gh ${prArgs.join(' ')}`);
+            const prResult = await spawnProcess({
+              command: 'gh',
+              args: prArgs,
               cwd: worktreePath,
               env: execEnv,
             });
-            prUrl = prOutput.trim();
+            if (prResult.exitCode !== 0) {
+              throw Object.assign(new Error(prResult.stderr || 'gh pr create failed'), {
+                stderr: prResult.stderr,
+              });
+            }
+            prUrl = prResult.stdout.trim();
             logger.info(`PR created: ${prUrl}`);
 
             // Extract PR number and store metadata for newly created PR

apps/server/src/routes/worktree/routes/create.ts

@@ -13,6 +13,8 @@ import { promisify } from 'util';
 import path from 'path';
 import * as secureFs from '../../../lib/secure-fs.js';
 import type { EventEmitter } from '../../../lib/events.js';
+import type { SettingsService } from '../../../services/settings-service.js';
+import { WorktreeService } from '../../../services/worktree-service.js';
 import { isGitRepo } from '@automaker/git-utils';
 import {
   getErrorMessage,
@@ -20,8 +22,8 @@ import {
   normalizePath,
   ensureInitialCommit,
   isValidBranchName,
-  execGitCommand,
 } from '../common.js';
+import { execGitCommand } from '../../../lib/git.js';
 import { trackBranch } from './branch-tracking.js';
 import { createLogger } from '@automaker/utils';
 import { runInitScript } from '../../../services/init-script-service.js';
@@ -81,7 +83,9 @@ async function findExistingWorktreeForBranch(
   }
 }
 
-export function createCreateHandler(events: EventEmitter) {
+export function createCreateHandler(events: EventEmitter, settingsService?: SettingsService) {
+  const worktreeService = new WorktreeService();
+
   return async (req: Request, res: Response): Promise<void> => {
     try {
       const { projectPath, branchName, baseBranch } = req.body as {
@@ -200,6 +204,20 @@ export function createCreateHandler(events: EventEmitter) {
       // normalizePath converts to forward slashes for API consistency
       const absoluteWorktreePath = path.resolve(worktreePath);
 
+      // Copy configured files into the new worktree before responding
+      // This runs synchronously to ensure files are in place before any init script
+      try {
+        await worktreeService.copyConfiguredFiles(
+          projectPath,
+          absoluteWorktreePath,
+          settingsService,
+          events
+        );
+      } catch (copyErr) {
+        // Log but don't fail worktree creation – files may be partially copied
+        logger.warn('Some configured files failed to copy to worktree:', copyErr);
+      }
+
       // Respond immediately (non-blocking)
       res.json({
         success: true,

apps/server/src/routes/worktree/routes/delete.ts

@@ -6,7 +6,8 @@ import type { Request, Response } from 'express';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { isGitRepo } from '@automaker/git-utils';
-import { getErrorMessage, logError, isValidBranchName, execGitCommand } from '../common.js';
+import { getErrorMessage, logError, isValidBranchName } from '../common.js';
+import { execGitCommand } from '../../../lib/git.js';
 import { createLogger } from '@automaker/utils';
 
 const execAsync = promisify(exec);
@@ -51,7 +52,7 @@ export function createDeleteHandler() {
       // Remove the worktree (using array arguments to prevent injection)
       try {
         await execGitCommand(['worktree', 'remove', worktreePath, '--force'], projectPath);
-      } catch (error) {
+      } catch {
         // Try with prune if remove fails
         await execGitCommand(['worktree', 'prune'], projectPath);
       }

apps/server/src/routes/worktree/routes/discard-changes.ts

@@ -1,27 +1,63 @@
 /**
- * POST /discard-changes endpoint - Discard all uncommitted changes in a worktree
+ * POST /discard-changes endpoint - Discard uncommitted changes in a worktree
  *
- * This performs a destructive operation that:
- * 1. Resets staged changes (git reset HEAD)
- * 2. Discards modified tracked files (git checkout .)
- * 3. Removes untracked files and directories (git clean -fd)
+ * Supports two modes:
+ * 1. Discard ALL changes (when no files array is provided)
+ *    - Resets staged changes (git reset HEAD)
+ *    - Discards modified tracked files (git checkout .)
+ *    - Removes untracked files and directories (git clean -fd)
+ *
+ * 2. Discard SELECTED files (when files array is provided)
+ *    - Unstages selected staged files (git reset HEAD -- <files>)
+ *    - Reverts selected tracked file changes (git checkout -- <files>)
+ *    - Removes selected untracked files (git clean -fd -- <files>)
  *
  * Note: Git repository validation (isGitRepo) is handled by
  * the requireGitRepoOnly middleware in index.ts
  */
 
 import type { Request, Response } from 'express';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { getErrorMessage, logError } from '../common.js';
+import * as path from 'path';
+import * as fs from 'fs';
+import { getErrorMessage, logError } from '@automaker/utils';
+import { execGitCommand } from '../../../lib/git.js';
 
-const execAsync = promisify(exec);
+/**
+ * Validate that a file path does not escape the worktree directory.
+ * Prevents path traversal attacks (e.g., ../../etc/passwd) and
+ * rejects symlinks inside the worktree that point outside of it.
+ */
+function validateFilePath(filePath: string, worktreePath: string): boolean {
+  // Resolve the full path relative to the worktree (lexical resolution)
+  const resolved = path.resolve(worktreePath, filePath);
+  const normalizedWorktree = path.resolve(worktreePath);
+
+  // First, perform lexical prefix check
+  const lexicalOk =
+    resolved.startsWith(normalizedWorktree + path.sep) || resolved === normalizedWorktree;
+  if (!lexicalOk) {
+    return false;
+  }
+
+  // Then, attempt symlink-aware validation using realpath.
+  // This catches symlinks inside the worktree that point outside of it.
+  try {
+    const realResolved = fs.realpathSync(resolved);
+    const realWorktree = fs.realpathSync(normalizedWorktree);
+    return realResolved.startsWith(realWorktree + path.sep) || realResolved === realWorktree;
+  } catch {
+    // If realpath fails (e.g., target doesn't exist yet for untracked files),
+    // fall back to the lexical startsWith check which already passed above.
+    return true;
+  }
+}
 
 export function createDiscardChangesHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { worktreePath } = req.body as {
+      const { worktreePath, files } = req.body as {
         worktreePath: string;
+        files?: string[];
       };
 
       if (!worktreePath) {
@@ -33,9 +69,7 @@ export function createDiscardChangesHandler() {
       }
 
       // Check for uncommitted changes first
-      const { stdout: status } = await execAsync('git status --porcelain', {
-        cwd: worktreePath,
-      });
+      const status = await execGitCommand(['status', '--porcelain'], worktreePath);
 
       if (!status.trim()) {
         res.json({
@@ -48,61 +82,195 @@ export function createDiscardChangesHandler() {
         return;
       }
 
-      // Count the files that will be affected
-      const lines = status.trim().split('\n').filter(Boolean);
-      const fileCount = lines.length;
-
       // Get branch name before discarding
-      const { stdout: branchOutput } = await execAsync('git rev-parse --abbrev-ref HEAD', {
-        cwd: worktreePath,
-      });
+      const branchOutput = await execGitCommand(
+        ['rev-parse', '--abbrev-ref', 'HEAD'],
+        worktreePath
+      );
       const branchName = branchOutput.trim();
 
-      // Discard all changes:
-      // 1. Reset any staged changes
-      await execAsync('git reset HEAD', { cwd: worktreePath }).catch(() => {
-        // Ignore errors - might fail if there's nothing staged
+      // Parse the status output to categorize files
+      // Git --porcelain format: XY PATH where X=index status, Y=worktree status
+      // Preserve the exact two-character XY status (no trim) to keep index vs worktree info
+      const statusLines = status.trim().split('\n').filter(Boolean);
+      const allFiles = statusLines.map((line) => {
+        const fileStatus = line.substring(0, 2);
+        const filePath = line.slice(3).trim();
+        return { status: fileStatus, path: filePath };
       });
 
-      // 2. Discard changes in tracked files
-      await execAsync('git checkout .', { cwd: worktreePath }).catch(() => {
-        // Ignore errors - might fail if there are no tracked changes
-      });
+      // Determine which files to discard
+      const isSelectiveDiscard = files && files.length > 0 && files.length < allFiles.length;
 
-      // 3. Remove untracked files and directories
-      await execAsync('git clean -fd', { cwd: worktreePath }).catch(() => {
-        // Ignore errors - might fail if there are no untracked files
-      });
+      if (isSelectiveDiscard) {
+        // Selective discard: only discard the specified files
+        const filesToDiscard = new Set(files);
 
-      // Verify all changes were discarded
-      const { stdout: finalStatus } = await execAsync('git status --porcelain', {
-        cwd: worktreePath,
-      });
+        // Validate all requested file paths stay within the worktree
+        const invalidPaths = files.filter((f) => !validateFilePath(f, worktreePath));
+        if (invalidPaths.length > 0) {
+          res.status(400).json({
+            success: false,
+            error: `Invalid file paths detected (path traversal): ${invalidPaths.join(', ')}`,
+          });
+          return;
+        }
+
+        // Separate files into categories for proper git operations
+        const trackedModified: string[] = []; // Modified/deleted tracked files
+        const stagedFiles: string[] = []; // Files that are staged
+        const untrackedFiles: string[] = []; // Untracked files (?)
+        const warnings: string[] = [];
+
+        for (const file of allFiles) {
+          if (!filesToDiscard.has(file.path)) continue;
+
+          // file.status is the raw two-character XY git porcelain status (no trim)
+          // X = index/staging status, Y = worktree status
+          const xy = file.status.substring(0, 2);
+          const indexStatus = xy.charAt(0);
+          const workTreeStatus = xy.charAt(1);
+
+          if (indexStatus === '?' && workTreeStatus === '?') {
+            untrackedFiles.push(file.path);
+          } else if (indexStatus === 'A') {
+            // Staged-new file: must be reset (unstaged) then cleaned (deleted).
+            // Never pass to trackedModified — the file has no HEAD version to
+            // check out, so `git checkout --` would fail or do nothing.
+            stagedFiles.push(file.path);
+            untrackedFiles.push(file.path);
+          } else {
+            // Check if the file has staged changes (index status X)
+            if (indexStatus !== ' ' && indexStatus !== '?') {
+              stagedFiles.push(file.path);
+            }
+            // Check for working tree changes (worktree status Y): handles MM, MD, etc.
+            if (workTreeStatus !== ' ' && workTreeStatus !== '?') {
+              trackedModified.push(file.path);
+            }
+          }
+        }
+
+        // 1. Unstage selected staged files (using execFile to bypass shell)
+        if (stagedFiles.length > 0) {
+          try {
+            await execGitCommand(['reset', 'HEAD', '--', ...stagedFiles], worktreePath);
+          } catch (error) {
+            const msg = getErrorMessage(error);
+            logError(error, `Failed to unstage files: ${msg}`);
+            warnings.push(`Failed to unstage some files: ${msg}`);
+          }
+        }
+
+        // 2. Revert selected tracked file changes
+        if (trackedModified.length > 0) {
+          try {
+            await execGitCommand(['checkout', '--', ...trackedModified], worktreePath);
+          } catch (error) {
+            const msg = getErrorMessage(error);
+            logError(error, `Failed to revert tracked files: ${msg}`);
+            warnings.push(`Failed to revert some tracked files: ${msg}`);
+          }
+        }
+
+        // 3. Remove selected untracked files
+        if (untrackedFiles.length > 0) {
+          try {
+            await execGitCommand(['clean', '-fd', '--', ...untrackedFiles], worktreePath);
+          } catch (error) {
+            const msg = getErrorMessage(error);
+            logError(error, `Failed to clean untracked files: ${msg}`);
+            warnings.push(`Failed to remove some untracked files: ${msg}`);
+          }
+        }
+
+        const fileCount = files.length;
+
+        // Verify the remaining state
+        const finalStatus = await execGitCommand(['status', '--porcelain'], worktreePath);
+
+        const remainingCount = finalStatus.trim()
+          ? finalStatus.trim().split('\n').filter(Boolean).length
+          : 0;
+        const actualDiscarded = allFiles.length - remainingCount;
+
+        let message =
+          actualDiscarded < fileCount
+            ? `Discarded ${actualDiscarded} of ${fileCount} selected files, ${remainingCount} files remaining`
+            : `Discarded ${actualDiscarded} ${actualDiscarded === 1 ? 'file' : 'files'}`;
 
-      if (finalStatus.trim()) {
-        // Some changes couldn't be discarded (possibly ignored files or permission issues)
-        const remainingCount = finalStatus.trim().split('\n').filter(Boolean).length;
         res.json({
           success: true,
           result: {
             discarded: true,
-            filesDiscarded: fileCount - remainingCount,
+            filesDiscarded: actualDiscarded,
             filesRemaining: remainingCount,
             branch: branchName,
-            message: `Discarded ${fileCount - remainingCount} files, ${remainingCount} files could not be removed`,
+            message,
+            ...(warnings.length > 0 && { warnings }),
           },
         });
       } else {
-        res.json({
-          success: true,
-          result: {
-            discarded: true,
-            filesDiscarded: fileCount,
-            filesRemaining: 0,
-            branch: branchName,
-            message: `Discarded ${fileCount} ${fileCount === 1 ? 'file' : 'files'}`,
-          },
-        });
+        // Discard ALL changes (original behavior)
+        const fileCount = allFiles.length;
+        const warnings: string[] = [];
+
+        // 1. Reset any staged changes
+        try {
+          await execGitCommand(['reset', 'HEAD'], worktreePath);
+        } catch (error) {
+          const msg = getErrorMessage(error);
+          logError(error, `git reset HEAD failed: ${msg}`);
+          warnings.push(`Failed to unstage changes: ${msg}`);
+        }
+
+        // 2. Discard changes in tracked files
+        try {
+          await execGitCommand(['checkout', '.'], worktreePath);
+        } catch (error) {
+          const msg = getErrorMessage(error);
+          logError(error, `git checkout . failed: ${msg}`);
+          warnings.push(`Failed to revert tracked changes: ${msg}`);
+        }
+
+        // 3. Remove untracked files and directories
+        try {
+          await execGitCommand(['clean', '-fd'], worktreePath);
+        } catch (error) {
+          const msg = getErrorMessage(error);
+          logError(error, `git clean -fd failed: ${msg}`);
+          warnings.push(`Failed to remove untracked files: ${msg}`);
+        }
+
+        // Verify all changes were discarded
+        const finalStatus = await execGitCommand(['status', '--porcelain'], worktreePath);
+
+        if (finalStatus.trim()) {
+          const remainingCount = finalStatus.trim().split('\n').filter(Boolean).length;
+          res.json({
+            success: true,
+            result: {
+              discarded: true,
+              filesDiscarded: fileCount - remainingCount,
+              filesRemaining: remainingCount,
+              branch: branchName,
+              message: `Discarded ${fileCount - remainingCount} files, ${remainingCount} files could not be removed`,
+              ...(warnings.length > 0 && { warnings }),
+            },
+          });
+        } else {
+          res.json({
+            success: true,
+            result: {
+              discarded: true,
+              filesDiscarded: fileCount,
+              filesRemaining: 0,
+              branch: branchName,
+              message: `Discarded ${fileCount} ${fileCount === 1 ? 'file' : 'files'}`,
+              ...(warnings.length > 0 && { warnings }),
+            },
+          });
+        }
       }
     } catch (error) {
       logError(error, 'Discard changes failed');

apps/server/src/routes/worktree/routes/generate-pr-description.ts

@@ -0,0 +1,453 @@
+/**
+ * POST /worktree/generate-pr-description endpoint - Generate an AI PR description from git diff
+ *
+ * Uses the configured model (via phaseModels.commitMessageModel) to generate a pull request
+ * title and description from the branch's changes compared to the base branch.
+ * Defaults to Claude Haiku for speed.
+ */
+
+import type { Request, Response } from 'express';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { createLogger } from '@automaker/utils';
+import { isCursorModel, stripProviderPrefix } from '@automaker/types';
+import { resolvePhaseModel } from '@automaker/model-resolver';
+import { ProviderFactory } from '../../../providers/provider-factory.js';
+import type { SettingsService } from '../../../services/settings-service.js';
+import { getErrorMessage, logError } from '../common.js';
+import { getPhaseModelWithOverrides } from '../../../lib/settings-helpers.js';
+
+const logger = createLogger('GeneratePRDescription');
+const execFileAsync = promisify(execFile);
+
+/** Timeout for AI provider calls in milliseconds (30 seconds) */
+const AI_TIMEOUT_MS = 30_000;
+
+/** Max diff size to send to AI (characters) */
+const MAX_DIFF_SIZE = 15_000;
+
+const PR_DESCRIPTION_SYSTEM_PROMPT = `You are a pull request description generator. Your task is to create a clear, well-structured PR title and description based on the git diff and branch information provided.
+
+Output your response in EXACTLY this format (including the markers):
+---TITLE---
+<a concise PR title, 50-72 chars, imperative mood>
+---BODY---
+## Summary
+<1-3 bullet points describing the key changes>
+
+## Changes
+<Detailed list of what was changed and why>
+
+Rules:
+- The title should be concise and descriptive (50-72 characters)
+- Use imperative mood for the title (e.g., "Add dark mode toggle" not "Added dark mode toggle")
+- The description should explain WHAT changed and WHY
+- Group related changes together
+- Use markdown formatting for the body
+- Do NOT include the branch name in the title
+- Focus on the user-facing impact when possible
+- If there are breaking changes, mention them prominently
+- The diff may include both committed changes and uncommitted working directory changes. Treat all changes as part of the PR since uncommitted changes will be committed when the PR is created
+- Do NOT distinguish between committed and uncommitted changes in the output - describe all changes as a unified set of PR changes`;
+
+/**
+ * Wraps an async generator with a timeout.
+ */
+async function* withTimeout<T>(
+  generator: AsyncIterable<T>,
+  timeoutMs: number
+): AsyncGenerator<T, void, unknown> {
+  let timerId: ReturnType<typeof setTimeout> | undefined;
+
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timerId = setTimeout(
+      () => reject(new Error(`AI provider timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+  });
+
+  const iterator = generator[Symbol.asyncIterator]();
+  let done = false;
+
+  try {
+    while (!done) {
+      const result = await Promise.race([iterator.next(), timeoutPromise]).catch(async (err) => {
+        // Timeout (or other error) — attempt to gracefully close the source generator
+        await iterator.return?.();
+        throw err;
+      });
+      if (result.done) {
+        done = true;
+      } else {
+        yield result.value;
+      }
+    }
+  } finally {
+    clearTimeout(timerId);
+  }
+}
+
+interface GeneratePRDescriptionRequestBody {
+  worktreePath: string;
+  baseBranch?: string;
+}
+
+interface GeneratePRDescriptionSuccessResponse {
+  success: true;
+  title: string;
+  body: string;
+}
+
+interface GeneratePRDescriptionErrorResponse {
+  success: false;
+  error: string;
+}
+
+export function createGeneratePRDescriptionHandler(
+  settingsService?: SettingsService
+): (req: Request, res: Response) => Promise<void> {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, baseBranch } = req.body as GeneratePRDescriptionRequestBody;
+
+      if (!worktreePath || typeof worktreePath !== 'string') {
+        const response: GeneratePRDescriptionErrorResponse = {
+          success: false,
+          error: 'worktreePath is required and must be a string',
+        };
+        res.status(400).json(response);
+        return;
+      }
+
+      // Validate that the directory exists
+      if (!existsSync(worktreePath)) {
+        const response: GeneratePRDescriptionErrorResponse = {
+          success: false,
+          error: 'worktreePath does not exist',
+        };
+        res.status(400).json(response);
+        return;
+      }
+
+      // Validate that it's a git repository
+      const gitPath = join(worktreePath, '.git');
+      if (!existsSync(gitPath)) {
+        const response: GeneratePRDescriptionErrorResponse = {
+          success: false,
+          error: 'worktreePath is not a git repository',
+        };
+        res.status(400).json(response);
+        return;
+      }
+
+      // Validate baseBranch to allow only safe branch name characters
+      if (baseBranch !== undefined && !/^[\w.\-/]+$/.test(baseBranch)) {
+        const response: GeneratePRDescriptionErrorResponse = {
+          success: false,
+          error: 'baseBranch contains invalid characters',
+        };
+        res.status(400).json(response);
+        return;
+      }
+
+      logger.info(`Generating PR description for worktree: ${worktreePath}`);
+
+      // Get current branch name
+      const { stdout: branchOutput } = await execFileAsync(
+        'git',
+        ['rev-parse', '--abbrev-ref', 'HEAD'],
+        { cwd: worktreePath }
+      );
+      const branchName = branchOutput.trim();
+
+      // Determine the base branch for comparison
+      const base = baseBranch || 'main';
+
+      // Get the diff between current branch and base branch (committed changes)
+      // Track whether the diff method used only includes committed changes.
+      // `git diff base...HEAD` and `git diff origin/base...HEAD` only show committed changes,
+      // while the fallback methods (`git diff HEAD`, `git diff --cached + git diff`) already
+      // include uncommitted working directory changes.
+      let diff = '';
+      let diffIncludesUncommitted = false;
+      try {
+        // First, try to get diff against the base branch
+        const { stdout: branchDiff } = await execFileAsync('git', ['diff', `${base}...HEAD`], {
+          cwd: worktreePath,
+          maxBuffer: 1024 * 1024 * 5, // 5MB buffer
+        });
+        diff = branchDiff;
+        // git diff base...HEAD only shows committed changes
+        diffIncludesUncommitted = false;
+      } catch {
+        // If branch comparison fails (e.g., base branch doesn't exist locally),
+        // try fetching and comparing against remote base
+        try {
+          const { stdout: remoteDiff } = await execFileAsync(
+            'git',
+            ['diff', `origin/${base}...HEAD`],
+            {
+              cwd: worktreePath,
+              maxBuffer: 1024 * 1024 * 5,
+            }
+          );
+          diff = remoteDiff;
+          // git diff origin/base...HEAD only shows committed changes
+          diffIncludesUncommitted = false;
+        } catch {
+          // Fall back to getting all uncommitted + committed changes
+          try {
+            const { stdout: allDiff } = await execFileAsync('git', ['diff', 'HEAD'], {
+              cwd: worktreePath,
+              maxBuffer: 1024 * 1024 * 5,
+            });
+            diff = allDiff;
+            // git diff HEAD includes uncommitted changes
+            diffIncludesUncommitted = true;
+          } catch {
+            // Last resort: get staged + unstaged changes
+            const { stdout: stagedDiff } = await execFileAsync('git', ['diff', '--cached'], {
+              cwd: worktreePath,
+              maxBuffer: 1024 * 1024 * 5,
+            });
+            const { stdout: unstagedDiff } = await execFileAsync('git', ['diff'], {
+              cwd: worktreePath,
+              maxBuffer: 1024 * 1024 * 5,
+            });
+            diff = stagedDiff + unstagedDiff;
+            // These already include uncommitted changes
+            diffIncludesUncommitted = true;
+          }
+        }
+      }
+
+      // Check for uncommitted changes (staged + unstaged) to include in the description.
+      // When creating a PR, uncommitted changes will be auto-committed, so they should be
+      // reflected in the generated description. We only need to fetch uncommitted diffs
+      // when the primary diff method (base...HEAD) was used, since it only shows committed changes.
+      let hasUncommittedChanges = false;
+      try {
+        const { stdout: statusOutput } = await execFileAsync('git', ['status', '--porcelain'], {
+          cwd: worktreePath,
+        });
+        hasUncommittedChanges = statusOutput.trim().length > 0;
+
+        if (hasUncommittedChanges && !diffIncludesUncommitted) {
+          logger.info('Uncommitted changes detected, including in PR description context');
+
+          let uncommittedDiff = '';
+
+          // Get staged changes
+          try {
+            const { stdout: stagedDiff } = await execFileAsync('git', ['diff', '--cached'], {
+              cwd: worktreePath,
+              maxBuffer: 1024 * 1024 * 5,
+            });
+            if (stagedDiff.trim()) {
+              uncommittedDiff += stagedDiff;
+            }
+          } catch {
+            // Ignore staged diff errors
+          }
+
+          // Get unstaged changes (tracked files only)
+          try {
+            const { stdout: unstagedDiff } = await execFileAsync('git', ['diff'], {
+              cwd: worktreePath,
+              maxBuffer: 1024 * 1024 * 5,
+            });
+            if (unstagedDiff.trim()) {
+              uncommittedDiff += unstagedDiff;
+            }
+          } catch {
+            // Ignore unstaged diff errors
+          }
+
+          // Get list of untracked files for context
+          const untrackedFiles = statusOutput
+            .split('\n')
+            .filter((line) => line.startsWith('??'))
+            .map((line) => line.substring(3).trim());
+
+          if (untrackedFiles.length > 0) {
+            // Add a summary of untracked (new) files as context
+            uncommittedDiff += `\n# New untracked files:\n${untrackedFiles.map((f) => `# + ${f}`).join('\n')}\n`;
+          }
+
+          // Append uncommitted changes to the committed diff
+          if (uncommittedDiff.trim()) {
+            diff = diff + uncommittedDiff;
+          }
+        }
+      } catch {
+        // Ignore errors checking for uncommitted changes
+      }
+
+      // Also get the commit log for context
+      let commitLog = '';
+      try {
+        const { stdout: logOutput } = await execFileAsync(
+          'git',
+          ['log', `${base}..HEAD`, '--oneline', '--no-decorate'],
+          {
+            cwd: worktreePath,
+            maxBuffer: 1024 * 1024,
+          }
+        );
+        commitLog = logOutput.trim();
+      } catch {
+        // If comparing against base fails, fall back to recent commits
+        try {
+          const { stdout: logOutput } = await execFileAsync(
+            'git',
+            ['log', '--oneline', '-10', '--no-decorate'],
+            {
+              cwd: worktreePath,
+              maxBuffer: 1024 * 1024,
+            }
+          );
+          commitLog = logOutput.trim();
+        } catch {
+          // Ignore commit log errors
+        }
+      }
+
+      if (!diff.trim() && !commitLog.trim()) {
+        const response: GeneratePRDescriptionErrorResponse = {
+          success: false,
+          error: 'No changes found to generate a PR description from',
+        };
+        res.status(400).json(response);
+        return;
+      }
+
+      // Truncate diff if too long
+      const truncatedDiff =
+        diff.length > MAX_DIFF_SIZE
+          ? diff.substring(0, MAX_DIFF_SIZE) + '\n\n[... diff truncated ...]'
+          : diff;
+
+      // Build the user prompt
+      let userPrompt = `Generate a pull request title and description for the following changes.\n\nBranch: ${branchName}\nBase Branch: ${base}\n`;
+
+      if (commitLog) {
+        userPrompt += `\nCommit History:\n${commitLog}\n`;
+      }
+
+      if (hasUncommittedChanges) {
+        userPrompt += `\nNote: This branch has uncommitted changes that will be included in the PR.\n`;
+      }
+
+      if (truncatedDiff) {
+        userPrompt += `\n\`\`\`diff\n${truncatedDiff}\n\`\`\``;
+      }
+
+      // Get model from phase settings with provider info
+      const {
+        phaseModel: phaseModelEntry,
+        provider: claudeCompatibleProvider,
+        credentials,
+      } = await getPhaseModelWithOverrides(
+        'commitMessageModel',
+        settingsService,
+        worktreePath,
+        '[GeneratePRDescription]'
+      );
+      const { model, thinkingLevel } = resolvePhaseModel(phaseModelEntry);
+
+      logger.info(
+        `Using model for PR description: ${model}`,
+        claudeCompatibleProvider ? `via provider: ${claudeCompatibleProvider.name}` : 'direct API'
+      );
+
+      // Get provider for the model type
+      const aiProvider = ProviderFactory.getProviderForModel(model);
+      const bareModel = stripProviderPrefix(model);
+
+      // For Cursor models, combine prompts
+      const effectivePrompt = isCursorModel(model)
+        ? `${PR_DESCRIPTION_SYSTEM_PROMPT}\n\n${userPrompt}`
+        : userPrompt;
+      const effectiveSystemPrompt = isCursorModel(model) ? undefined : PR_DESCRIPTION_SYSTEM_PROMPT;
+
+      logger.info(`Using ${aiProvider.getName()} provider for model: ${model}`);
+
+      let responseText = '';
+      const stream = aiProvider.executeQuery({
+        prompt: effectivePrompt,
+        model: bareModel,
+        cwd: worktreePath,
+        systemPrompt: effectiveSystemPrompt,
+        maxTurns: 1,
+        allowedTools: [],
+        readOnly: true,
+        thinkingLevel,
+        claudeCompatibleProvider,
+        credentials,
+      });
+
+      // Wrap with timeout
+      for await (const msg of withTimeout(stream, AI_TIMEOUT_MS)) {
+        if (msg.type === 'assistant' && msg.message?.content) {
+          for (const block of msg.message.content) {
+            if (block.type === 'text' && block.text) {
+              responseText += block.text;
+            }
+          }
+        } else if (msg.type === 'result' && msg.subtype === 'success' && msg.result) {
+          responseText = msg.result;
+        }
+      }
+
+      const fullResponse = responseText.trim();
+
+      if (!fullResponse || fullResponse.length === 0) {
+        logger.warn('Received empty response from model');
+        const response: GeneratePRDescriptionErrorResponse = {
+          success: false,
+          error: 'Failed to generate PR description - empty response',
+        };
+        res.status(500).json(response);
+        return;
+      }
+
+      // Parse the response to extract title and body
+      let title = '';
+      let body = '';
+
+      const titleMatch = fullResponse.match(/---TITLE---\s*\n([\s\S]*?)(?=---BODY---|$)/);
+      const bodyMatch = fullResponse.match(/---BODY---\s*\n([\s\S]*?)$/);
+
+      if (titleMatch && bodyMatch) {
+        title = titleMatch[1].trim();
+        body = bodyMatch[1].trim();
+      } else {
+        // Fallback: treat first line as title, rest as body
+        const lines = fullResponse.split('\n');
+        title = lines[0].trim();
+        body = lines.slice(1).join('\n').trim();
+      }
+
+      // Clean up title - remove any markdown or quotes
+      title = title.replace(/^#+\s*/, '').replace(/^["']|["']$/g, '');
+
+      logger.info(`Generated PR title: ${title.substring(0, 100)}...`);
+
+      const response: GeneratePRDescriptionSuccessResponse = {
+        success: true,
+        title,
+        body,
+      };
+      res.json(response);
+    } catch (error) {
+      logError(error, 'Generate PR description failed');
+      const response: GeneratePRDescriptionErrorResponse = {
+        success: false,
+        error: getErrorMessage(error),
+      };
+      res.status(500).json(response);
+    }
+  };
+}

apps/server/src/routes/worktree/routes/list-branches.ts

@@ -6,11 +6,12 @@
  */
 
 import type { Request, Response } from 'express';
-import { exec } from 'child_process';
+import { exec, execFile } from 'child_process';
 import { promisify } from 'util';
 import { getErrorMessage, logWorktreeError } from '../common.js';
 
 const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 interface BranchInfo {
   name: string;
@@ -92,6 +93,9 @@ export function createListBranchesHandler() {
               // Skip HEAD pointers like "origin/HEAD"
               if (cleanName.includes('/HEAD')) return;
 
+              // Skip bare remote names without a branch (e.g. "origin" by itself)
+              if (!cleanName.includes('/')) return;
+
               // Only add remote branches if a branch with the exact same name isn't already
               // in the list. This avoids duplicates if a local branch is named like a remote one.
               // Note: We intentionally include remote branches even when a local branch with the
@@ -128,15 +132,17 @@ export function createListBranchesHandler() {
       let hasRemoteBranch = false;
       try {
         // First check if there's a remote tracking branch
-        const { stdout: upstreamOutput } = await execAsync(
-          `git rev-parse --abbrev-ref ${currentBranch}@{upstream}`,
+        const { stdout: upstreamOutput } = await execFileAsync(
+          'git',
+          ['rev-parse', '--abbrev-ref', `${currentBranch}@{upstream}`],
           { cwd: worktreePath }
         );
 
         if (upstreamOutput.trim()) {
           hasRemoteBranch = true;
-          const { stdout: aheadBehindOutput } = await execAsync(
-            `git rev-list --left-right --count ${currentBranch}@{upstream}...HEAD`,
+          const { stdout: aheadBehindOutput } = await execFileAsync(
+            'git',
+            ['rev-list', '--left-right', '--count', `${currentBranch}@{upstream}...HEAD`],
             { cwd: worktreePath }
           );
           const [behind, ahead] = aheadBehindOutput.trim().split(/\s+/).map(Number);
@@ -147,8 +153,9 @@ export function createListBranchesHandler() {
         // No upstream branch set - check if the branch exists on any remote
         try {
           // Check if there's a matching branch on origin (most common remote)
-          const { stdout: remoteBranchOutput } = await execAsync(
-            `git ls-remote --heads origin ${currentBranch}`,
+          const { stdout: remoteBranchOutput } = await execFileAsync(
+            'git',
+            ['ls-remote', '--heads', 'origin', currentBranch],
             { cwd: worktreePath, timeout: 5000 }
           );
           hasRemoteBranch = remoteBranchOutput.trim().length > 0;

apps/server/src/routes/worktree/routes/list.ts

@@ -58,6 +58,90 @@ interface WorktreeInfo {
   hasChanges?: boolean;
   changedFilesCount?: number;
   pr?: WorktreePRInfo; // PR info if a PR has been created for this branch
+  /** Whether there are actual unresolved conflict files (conflictFiles.length > 0) */
+  hasConflicts?: boolean;
+  /** Type of git operation in progress (merge/rebase/cherry-pick), set independently of hasConflicts */
+  conflictType?: 'merge' | 'rebase' | 'cherry-pick';
+  /** List of files with conflicts */
+  conflictFiles?: string[];
+}
+
+/**
+ * Detect if a merge, rebase, or cherry-pick is in progress for a worktree.
+ * Checks for the presence of state files/directories that git creates
+ * during these operations.
+ */
+async function detectConflictState(worktreePath: string): Promise<{
+  hasConflicts: boolean;
+  conflictType?: 'merge' | 'rebase' | 'cherry-pick';
+  conflictFiles?: string[];
+}> {
+  try {
+    // Find the canonical .git directory for this worktree
+    const { stdout: gitDirRaw } = await execAsync('git rev-parse --git-dir', {
+      cwd: worktreePath,
+      timeout: 15000,
+    });
+    const gitDir = path.resolve(worktreePath, gitDirRaw.trim());
+
+    // Check for merge, rebase, and cherry-pick state files/directories
+    const [mergeHeadExists, rebaseMergeExists, rebaseApplyExists, cherryPickHeadExists] =
+      await Promise.all([
+        secureFs
+          .access(path.join(gitDir, 'MERGE_HEAD'))
+          .then(() => true)
+          .catch(() => false),
+        secureFs
+          .access(path.join(gitDir, 'rebase-merge'))
+          .then(() => true)
+          .catch(() => false),
+        secureFs
+          .access(path.join(gitDir, 'rebase-apply'))
+          .then(() => true)
+          .catch(() => false),
+        secureFs
+          .access(path.join(gitDir, 'CHERRY_PICK_HEAD'))
+          .then(() => true)
+          .catch(() => false),
+      ]);
+
+    let conflictType: 'merge' | 'rebase' | 'cherry-pick' | undefined;
+    if (rebaseMergeExists || rebaseApplyExists) {
+      conflictType = 'rebase';
+    } else if (mergeHeadExists) {
+      conflictType = 'merge';
+    } else if (cherryPickHeadExists) {
+      conflictType = 'cherry-pick';
+    }
+
+    if (!conflictType) {
+      return { hasConflicts: false };
+    }
+
+    // Get list of conflicted files using machine-readable git status
+    let conflictFiles: string[] = [];
+    try {
+      const { stdout: statusOutput } = await execAsync('git diff --name-only --diff-filter=U', {
+        cwd: worktreePath,
+        timeout: 15000,
+      });
+      conflictFiles = statusOutput
+        .trim()
+        .split('\n')
+        .filter((f) => f.trim().length > 0);
+    } catch {
+      // Fall back to empty list if diff fails
+    }
+
+    return {
+      hasConflicts: conflictFiles.length > 0,
+      conflictType,
+      conflictFiles,
+    };
+  } catch {
+    // If anything fails, assume no conflicts
+    return { hasConflicts: false };
+  }
 }
 
 async function getCurrentBranch(cwd: string): Promise<string> {
@@ -373,7 +457,7 @@ export function createListHandler() {
       // Read all worktree metadata to get PR info
       const allMetadata = await readAllWorktreeMetadata(projectPath);
 
-      // If includeDetails is requested, fetch change status for each worktree
+      // If includeDetails is requested, fetch change status and conflict state for each worktree
       if (includeDetails) {
         for (const worktree of worktrees) {
           try {
@@ -390,6 +474,21 @@ export function createListHandler() {
             worktree.hasChanges = false;
             worktree.changedFilesCount = 0;
           }
+
+          // Detect merge/rebase/cherry-pick in progress
+          try {
+            const conflictState = await detectConflictState(worktree.path);
+            // Always propagate conflictType so callers know an operation is in progress,
+            // even when there are no unresolved conflict files yet.
+            if (conflictState.conflictType) {
+              worktree.conflictType = conflictState.conflictType;
+            }
+            // hasConflicts is true only when there are actual unresolved files
+            worktree.hasConflicts = conflictState.hasConflicts;
+            worktree.conflictFiles = conflictState.conflictFiles;
+          } catch {
+            // Ignore conflict detection errors
+          }
         }
       }
 

apps/server/src/routes/worktree/routes/merge.ts

@@ -8,15 +8,11 @@
  */
 
 import type { Request, Response } from 'express';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { getErrorMessage, logError, isValidBranchName, execGitCommand } from '../common.js';
-import { createLogger } from '@automaker/utils';
+import { getErrorMessage, logError } from '../common.js';
+import type { EventEmitter } from '../../../lib/events.js';
+import { performMerge } from '../../../services/merge-service.js';
 
-const execAsync = promisify(exec);
-const logger = createLogger('Worktree');
-
-export function createMergeHandler() {
+export function createMergeHandler(events: EventEmitter) {
   return async (req: Request, res: Response): Promise<void> => {
     try {
       const { projectPath, branchName, worktreePath, targetBranch, options } = req.body as {
@@ -38,102 +34,41 @@ export function createMergeHandler() {
       // Determine the target branch (default to 'main')
       const mergeTo = targetBranch || 'main';
 
-      // Validate source branch exists
-      try {
-        await execAsync(`git rev-parse --verify ${branchName}`, { cwd: projectPath });
-      } catch {
-        res.status(400).json({
-          success: false,
-          error: `Branch "${branchName}" does not exist`,
-        });
-        return;
-      }
+      // Delegate all merge logic to the service
+      const result = await performMerge(
+        projectPath,
+        branchName,
+        worktreePath,
+        mergeTo,
+        options,
+        events
+      );
 
-      // Validate target branch exists
-      try {
-        await execAsync(`git rev-parse --verify ${mergeTo}`, { cwd: projectPath });
-      } catch {
-        res.status(400).json({
-          success: false,
-          error: `Target branch "${mergeTo}" does not exist`,
-        });
-        return;
-      }
-
-      // Merge the feature branch into the target branch
-      const mergeCmd = options?.squash
-        ? `git merge --squash ${branchName}`
-        : `git merge ${branchName} -m "${options?.message || `Merge ${branchName} into ${mergeTo}`}"`;
-
-      try {
-        await execAsync(mergeCmd, { cwd: projectPath });
-      } catch (mergeError: unknown) {
-        // Check if this is a merge conflict
-        const err = mergeError as { stdout?: string; stderr?: string; message?: string };
-        const output = `${err.stdout || ''} ${err.stderr || ''} ${err.message || ''}`;
-        const hasConflicts =
-          output.includes('CONFLICT') || output.includes('Automatic merge failed');
-
-        if (hasConflicts) {
+      if (!result.success) {
+        if (result.hasConflicts) {
           // Return conflict-specific error message that frontend can detect
           res.status(409).json({
             success: false,
-            error: `Merge CONFLICT: Automatic merge of "${branchName}" into "${mergeTo}" failed. Please resolve conflicts manually.`,
+            error: result.error,
             hasConflicts: true,
+            conflictFiles: result.conflictFiles,
           });
           return;
         }
 
-        // Re-throw non-conflict errors to be handled by outer catch
-        throw mergeError;
-      }
-
-      // If squash merge, need to commit
-      if (options?.squash) {
-        await execAsync(`git commit -m "${options?.message || `Merge ${branchName} (squash)`}"`, {
-          cwd: projectPath,
+        // Non-conflict service errors (e.g. branch not found, invalid name)
+        res.status(400).json({
+          success: false,
+          error: result.error,
         });
-      }
-
-      // Optionally delete the worktree and branch after merging
-      let worktreeDeleted = false;
-      let branchDeleted = false;
-
-      if (options?.deleteWorktreeAndBranch) {
-        // Remove the worktree
-        try {
-          await execGitCommand(['worktree', 'remove', worktreePath, '--force'], projectPath);
-          worktreeDeleted = true;
-        } catch {
-          // Try with prune if remove fails
-          try {
-            await execGitCommand(['worktree', 'prune'], projectPath);
-            worktreeDeleted = true;
-          } catch {
-            logger.warn(`Failed to remove worktree: ${worktreePath}`);
-          }
-        }
-
-        // Delete the branch (but not main/master)
-        if (branchName !== 'main' && branchName !== 'master') {
-          if (!isValidBranchName(branchName)) {
-            logger.warn(`Invalid branch name detected, skipping deletion: ${branchName}`);
-          } else {
-            try {
-              await execGitCommand(['branch', '-D', branchName], projectPath);
-              branchDeleted = true;
-            } catch {
-              logger.warn(`Failed to delete branch: ${branchName}`);
-            }
-          }
-        }
+        return;
       }
 
       res.json({
         success: true,
-        mergedBranch: branchName,
-        targetBranch: mergeTo,
-        deleted: options?.deleteWorktreeAndBranch ? { worktreeDeleted, branchDeleted } : undefined,
+        mergedBranch: result.mergedBranch,
+        targetBranch: result.targetBranch,
+        deleted: result.deleted,
       });
     } catch (error) {
       logError(error, 'Merge worktree failed');

apps/server/src/routes/worktree/routes/pull.ts

@@ -1,22 +1,33 @@
 /**
  * POST /pull endpoint - Pull latest changes for a worktree/branch
  *
+ * Enhanced pull flow with stash management and conflict detection:
+ * 1. Checks for uncommitted local changes (staged and unstaged)
+ * 2. If local changes exist AND stashIfNeeded is true, automatically stashes them
+ * 3. Performs the git pull
+ * 4. If changes were stashed, attempts to reapply via git stash pop
+ * 5. Detects merge conflicts from both pull and stash reapplication
+ * 6. Returns structured conflict information for AI-assisted resolution
+ *
+ * Git business logic is delegated to pull-service.ts.
+ *
  * Note: Git repository validation (isGitRepo, hasCommits) is handled by
  * the requireValidWorktree middleware in index.ts
  */
 
 import type { Request, Response } from 'express';
-import { exec } from 'child_process';
-import { promisify } from 'util';
 import { getErrorMessage, logError } from '../common.js';
-
-const execAsync = promisify(exec);
+import { performPull } from '../../../services/pull-service.js';
+import type { PullResult } from '../../../services/pull-service.js';
 
 export function createPullHandler() {
   return async (req: Request, res: Response): Promise<void> => {
     try {
-      const { worktreePath } = req.body as {
+      const { worktreePath, remote, stashIfNeeded } = req.body as {
         worktreePath: string;
+        remote?: string;
+        /** When true, automatically stash local changes before pulling and reapply after */
+        stashIfNeeded?: boolean;
       };
 
       if (!worktreePath) {
@@ -27,67 +38,66 @@ export function createPullHandler() {
         return;
       }
 
-      // Get current branch name
-      const { stdout: branchOutput } = await execAsync('git rev-parse --abbrev-ref HEAD', {
-        cwd: worktreePath,
-      });
-      const branchName = branchOutput.trim();
+      // Execute the pull via the service
+      const result = await performPull(worktreePath, { remote, stashIfNeeded });
 
-      // Fetch latest from remote
-      await execAsync('git fetch origin', { cwd: worktreePath });
-
-      // Check if there are local changes that would be overwritten
-      const { stdout: status } = await execAsync('git status --porcelain', {
-        cwd: worktreePath,
-      });
-      const hasLocalChanges = status.trim().length > 0;
-
-      if (hasLocalChanges) {
-        res.status(400).json({
-          success: false,
-          error: 'You have local changes. Please commit them before pulling.',
-        });
-        return;
-      }
-
-      // Pull latest changes
-      try {
-        const { stdout: pullOutput } = await execAsync(`git pull origin ${branchName}`, {
-          cwd: worktreePath,
-        });
-
-        // Check if we pulled any changes
-        const alreadyUpToDate = pullOutput.includes('Already up to date');
-
-        res.json({
-          success: true,
-          result: {
-            branch: branchName,
-            pulled: !alreadyUpToDate,
-            message: alreadyUpToDate ? 'Already up to date' : 'Pulled latest changes',
-          },
-        });
-      } catch (pullError: unknown) {
-        const err = pullError as { stderr?: string; message?: string };
-        const errorMsg = err.stderr || err.message || 'Pull failed';
-
-        // Check for common errors
-        if (errorMsg.includes('no tracking information')) {
-          res.status(400).json({
-            success: false,
-            error: `Branch '${branchName}' has no upstream branch. Push it first or set upstream with: git branch --set-upstream-to=origin/${branchName}`,
-          });
-          return;
-        }
-
-        res.status(500).json({
-          success: false,
-          error: errorMsg,
-        });
-      }
+      // Map service result to HTTP response
+      mapResultToResponse(res, result);
     } catch (error) {
       logError(error, 'Pull failed');
       res.status(500).json({ success: false, error: getErrorMessage(error) });
     }
   };
 }
+
+/**
+ * Map a PullResult from the service to the appropriate HTTP response.
+ *
+ * - Successful results (including local-changes-detected info) → 200
+ * - Validation/state errors (detached HEAD, no upstream) → 400
+ * - Operational errors (fetch/stash/pull failures) → 500
+ */
+function mapResultToResponse(res: Response, result: PullResult): void {
+  if (!result.success && result.error) {
+    // Determine the appropriate HTTP status for errors
+    const statusCode = isClientError(result.error) ? 400 : 500;
+    res.status(statusCode).json({
+      success: false,
+      error: result.error,
+      ...(result.stashRecoveryFailed && { stashRecoveryFailed: true }),
+    });
+    return;
+  }
+
+  // Success case (includes partial success like local changes detected, conflicts, etc.)
+  res.json({
+    success: true,
+    result: {
+      branch: result.branch,
+      pulled: result.pulled,
+      hasLocalChanges: result.hasLocalChanges,
+      localChangedFiles: result.localChangedFiles,
+      hasConflicts: result.hasConflicts,
+      conflictSource: result.conflictSource,
+      conflictFiles: result.conflictFiles,
+      stashed: result.stashed,
+      stashRestored: result.stashRestored,
+      message: result.message,
+    },
+  });
+}
+
+/**
+ * Determine whether an error message represents a client error (400)
+ * vs a server error (500).
+ *
+ * Client errors are validation issues or invalid git state that the user
+ * needs to resolve (e.g. detached HEAD, no upstream, no tracking info).
+ */
+function isClientError(errorMessage: string): boolean {
+  return (
+    errorMessage.includes('detached HEAD') ||
+    errorMessage.includes('has no upstream branch') ||
+    errorMessage.includes('no tracking information')
+  );
+}

apps/server/src/routes/worktree/routes/rebase.ts

@@ -0,0 +1,124 @@
+/**
+ * POST /rebase endpoint - Rebase the current branch onto a target branch
+ *
+ * Rebases the current worktree branch onto a specified target branch
+ * (e.g., origin/main) for a linear history. Detects conflicts and
+ * returns structured conflict information for AI-assisted resolution.
+ *
+ * Git business logic is delegated to rebase-service.ts.
+ * Events are emitted at key lifecycle points for WebSocket subscribers.
+ *
+ * Note: Git repository validation (isGitRepo, hasCommits) is handled by
+ * the requireValidWorktree middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import path from 'path';
+import { getErrorMessage, logError, isValidBranchName } from '../common.js';
+import type { EventEmitter } from '../../../lib/events.js';
+import { runRebase } from '../../../services/rebase-service.js';
+
+export function createRebaseHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, ontoBranch } = req.body as {
+        worktreePath: string;
+        /** The branch/ref to rebase onto (e.g., 'origin/main', 'main') */
+        ontoBranch: string;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath is required',
+        });
+        return;
+      }
+
+      if (!ontoBranch) {
+        res.status(400).json({
+          success: false,
+          error: 'ontoBranch is required',
+        });
+        return;
+      }
+
+      // Normalize the path to prevent path traversal and ensure consistent paths
+      const resolvedWorktreePath = path.resolve(worktreePath);
+
+      // Validate the branch name (allow remote refs like origin/main)
+      if (!isValidBranchName(ontoBranch)) {
+        res.status(400).json({
+          success: false,
+          error: `Invalid branch name: "${ontoBranch}"`,
+        });
+        return;
+      }
+
+      // Emit started event
+      events.emit('rebase:started', {
+        worktreePath: resolvedWorktreePath,
+        ontoBranch,
+      });
+
+      // Execute the rebase via the service
+      const result = await runRebase(resolvedWorktreePath, ontoBranch);
+
+      if (result.success) {
+        // Emit success event
+        events.emit('rebase:success', {
+          worktreePath: resolvedWorktreePath,
+          branch: result.branch,
+          ontoBranch: result.ontoBranch,
+        });
+
+        res.json({
+          success: true,
+          result: {
+            branch: result.branch,
+            ontoBranch: result.ontoBranch,
+            message: result.message,
+          },
+        });
+      } else if (result.hasConflicts) {
+        // Emit conflict event
+        events.emit('rebase:conflict', {
+          worktreePath: resolvedWorktreePath,
+          ontoBranch,
+          conflictFiles: result.conflictFiles,
+          aborted: result.aborted,
+        });
+
+        res.status(409).json({
+          success: false,
+          error: result.error,
+          hasConflicts: true,
+          conflictFiles: result.conflictFiles,
+          aborted: result.aborted,
+        });
+      } else {
+        // Emit failure event for non-conflict failures
+        events.emit('rebase:failure', {
+          worktreePath: resolvedWorktreePath,
+          branch: result.branch,
+          ontoBranch: result.ontoBranch,
+          error: result.error,
+        });
+
+        res.status(500).json({
+          success: false,
+          error: result.error ?? 'Rebase failed',
+          hasConflicts: false,
+        });
+      }
+    } catch (error) {
+      // Emit failure event
+      events.emit('rebase:failure', {
+        error: getErrorMessage(error),
+      });
+
+      logError(error, 'Rebase failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/stage-files.ts

@@ -0,0 +1,74 @@
+/**
+ * POST /stage-files endpoint - Stage or unstage files in a worktree
+ *
+ * Supports two operations:
+ * 1. Stage files: `git add <files>` (adds files to the staging area)
+ * 2. Unstage files: `git reset HEAD -- <files>` (removes files from staging area)
+ *
+ * Note: Git repository validation (isGitRepo) is handled by
+ * the requireGitRepoOnly middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import { getErrorMessage, logError } from '../common.js';
+import { stageFiles, StageFilesValidationError } from '../../../services/stage-files-service.js';
+
+export function createStageFilesHandler() {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, files, operation } = req.body as {
+        worktreePath: string;
+        files: string[];
+        operation: 'stage' | 'unstage';
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      if (!Array.isArray(files) || files.length === 0) {
+        res.status(400).json({
+          success: false,
+          error: 'files array required and must not be empty',
+        });
+        return;
+      }
+
+      for (const file of files) {
+        if (typeof file !== 'string' || file.trim() === '') {
+          res.status(400).json({
+            success: false,
+            error: 'Each element of files must be a non-empty string',
+          });
+          return;
+        }
+      }
+
+      if (operation !== 'stage' && operation !== 'unstage') {
+        res.status(400).json({
+          success: false,
+          error: 'operation must be "stage" or "unstage"',
+        });
+        return;
+      }
+
+      const result = await stageFiles(worktreePath, files, operation);
+
+      res.json({
+        success: true,
+        result,
+      });
+    } catch (error) {
+      if (error instanceof StageFilesValidationError) {
+        res.status(400).json({ success: false, error: error.message });
+        return;
+      }
+      logError(error, `${(req.body as { operation?: string })?.operation ?? 'stage'} files failed`);
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/stash-apply.ts

@@ -0,0 +1,78 @@
+/**
+ * POST /stash-apply endpoint - Apply or pop a stash in a worktree
+ *
+ * Applies a specific stash entry to the working directory.
+ * Can either "apply" (keep stash) or "pop" (remove stash after applying).
+ *
+ * All git operations and conflict detection are delegated to StashService.
+ *
+ * Note: Git repository validation (isGitRepo) is handled by
+ * the requireGitRepoOnly middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import type { EventEmitter } from '../../../lib/events.js';
+import { getErrorMessage, logError } from '../common.js';
+import { applyOrPop } from '../../../services/stash-service.js';
+
+export function createStashApplyHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, stashIndex, pop } = req.body as {
+        worktreePath: string;
+        stashIndex: number;
+        pop?: boolean;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      if (stashIndex === undefined || stashIndex === null) {
+        res.status(400).json({
+          success: false,
+          error: 'stashIndex required',
+        });
+        return;
+      }
+
+      const idx = typeof stashIndex === 'string' ? Number(stashIndex) : stashIndex;
+
+      if (!Number.isInteger(idx) || idx < 0) {
+        res.status(400).json({
+          success: false,
+          error: 'stashIndex must be a non-negative integer',
+        });
+        return;
+      }
+
+      // Delegate all stash apply/pop logic to the service
+      const result = await applyOrPop(worktreePath, idx, { pop }, events);
+
+      if (!result.success) {
+        // applyOrPop already logs the error internally via logError — no need to double-log here
+        res.status(500).json({ success: false, error: result.error });
+        return;
+      }
+
+      res.json({
+        success: true,
+        result: {
+          applied: result.applied,
+          hasConflicts: result.hasConflicts,
+          conflictFiles: result.conflictFiles,
+          operation: result.operation,
+          stashIndex: result.stashIndex,
+          message: result.message,
+        },
+      });
+    } catch (error) {
+      logError(error, 'Stash apply failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/stash-drop.ts

@@ -0,0 +1,83 @@
+/**
+ * POST /stash-drop endpoint - Drop (delete) a stash entry
+ *
+ * The handler only validates input, invokes the service, streams lifecycle
+ * events via the EventEmitter, and sends the final JSON response.
+ *
+ * Git business logic is delegated to stash-service.ts.
+ * Events are emitted at key lifecycle points for WebSocket subscribers.
+ *
+ * Note: Git repository validation (isGitRepo) is handled by
+ * the requireGitRepoOnly middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import type { EventEmitter } from '../../../lib/events.js';
+import { getErrorMessage, logError } from '../common.js';
+import { dropStash } from '../../../services/stash-service.js';
+
+export function createStashDropHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, stashIndex } = req.body as {
+        worktreePath: string;
+        stashIndex: number;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      if (!Number.isInteger(stashIndex) || stashIndex < 0) {
+        res.status(400).json({
+          success: false,
+          error: 'stashIndex required',
+        });
+        return;
+      }
+
+      // Emit start event so the frontend can observe progress
+      events.emit('stash:start', {
+        worktreePath,
+        stashIndex,
+        stashRef: `stash@{${stashIndex}}`,
+        operation: 'drop',
+      });
+
+      // Delegate all Git work to the service
+      const result = await dropStash(worktreePath, stashIndex);
+
+      // Emit success event
+      events.emit('stash:success', {
+        worktreePath,
+        stashIndex,
+        operation: 'drop',
+        dropped: result.dropped,
+      });
+
+      res.json({
+        success: true,
+        result: {
+          dropped: result.dropped,
+          stashIndex: result.stashIndex,
+          message: result.message,
+        },
+      });
+    } catch (error) {
+      // Emit error event so the frontend can react
+      events.emit('stash:failure', {
+        worktreePath: req.body?.worktreePath,
+        stashIndex: req.body?.stashIndex,
+        operation: 'drop',
+        error: getErrorMessage(error),
+      });
+
+      logError(error, 'Stash drop failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/stash-list.ts

@@ -0,0 +1,76 @@
+/**
+ * POST /stash-list endpoint - List all stashes in a worktree
+ *
+ * The handler only validates input, invokes the service, streams lifecycle
+ * events via the EventEmitter, and sends the final JSON response.
+ *
+ * Git business logic is delegated to stash-service.ts.
+ * Events are emitted at key lifecycle points for WebSocket subscribers.
+ *
+ * Note: Git repository validation (isGitRepo) is handled by
+ * the requireGitRepoOnly middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import type { EventEmitter } from '../../../lib/events.js';
+import { getErrorMessage, logError } from '../common.js';
+import { listStash } from '../../../services/stash-service.js';
+
+export function createStashListHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath } = req.body as {
+        worktreePath: string;
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      // Emit start event so the frontend can observe progress
+      events.emit('stash:start', {
+        worktreePath,
+        operation: 'list',
+      });
+
+      // Delegate all Git work to the service
+      const result = await listStash(worktreePath);
+
+      // Emit progress with stash count
+      events.emit('stash:progress', {
+        worktreePath,
+        operation: 'list',
+        total: result.total,
+      });
+
+      // Emit success event
+      events.emit('stash:success', {
+        worktreePath,
+        operation: 'list',
+        total: result.total,
+      });
+
+      res.json({
+        success: true,
+        result: {
+          stashes: result.stashes,
+          total: result.total,
+        },
+      });
+    } catch (error) {
+      // Emit error event so the frontend can react
+      events.emit('stash:failure', {
+        worktreePath: req.body?.worktreePath,
+        operation: 'list',
+        error: getErrorMessage(error),
+      });
+
+      logError(error, 'Stash list failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/stash-push.ts

@@ -0,0 +1,81 @@
+/**
+ * POST /stash-push endpoint - Stash changes in a worktree
+ *
+ * The handler only validates input, invokes the service, streams lifecycle
+ * events via the EventEmitter, and sends the final JSON response.
+ *
+ * Git business logic is delegated to stash-service.ts.
+ * Events are emitted at key lifecycle points for WebSocket subscribers.
+ *
+ * Note: Git repository validation (isGitRepo) is handled by
+ * the requireGitRepoOnly middleware in index.ts
+ */
+
+import type { Request, Response } from 'express';
+import type { EventEmitter } from '../../../lib/events.js';
+import { getErrorMessage, logError } from '../common.js';
+import { pushStash } from '../../../services/stash-service.js';
+
+export function createStashPushHandler(events: EventEmitter) {
+  return async (req: Request, res: Response): Promise<void> => {
+    try {
+      const { worktreePath, message, files } = req.body as {
+        worktreePath: string;
+        message?: string;
+        files?: string[];
+      };
+
+      if (!worktreePath) {
+        res.status(400).json({
+          success: false,
+          error: 'worktreePath required',
+        });
+        return;
+      }
+
+      // Emit start event so the frontend can observe progress
+      events.emit('stash:start', {
+        worktreePath,
+        operation: 'push',
+      });
+
+      // Delegate all Git work to the service
+      const result = await pushStash(worktreePath, { message, files });
+
+      // Emit progress with stash result
+      events.emit('stash:progress', {
+        worktreePath,
+        operation: 'push',
+        stashed: result.stashed,
+        branch: result.branch,
+      });
+
+      // Emit success event
+      events.emit('stash:success', {
+        worktreePath,
+        operation: 'push',
+        stashed: result.stashed,
+        branch: result.branch,
+      });
+
+      res.json({
+        success: true,
+        result: {
+          stashed: result.stashed,
+          branch: result.branch,
+          message: result.message,
+        },
+      });
+    } catch (error) {
+      // Emit error event so the frontend can react
+      events.emit('stash:failure', {
+        worktreePath: req.body?.worktreePath,
+        operation: 'push',
+        error: getErrorMessage(error),
+      });
+
+      logError(error, 'Stash push failed');
+      res.status(500).json({ success: false, error: getErrorMessage(error) });
+    }
+  };
+}

apps/server/src/routes/worktree/routes/switch-branch.ts

@@ -1,67 +1,29 @@
 /**
  * POST /switch-branch endpoint - Switch to an existing branch
  *
- * Simple branch switching.
- * If there are uncommitted changes, the switch will fail and
- * the user should commit first.
+ * Handles branch switching with automatic stash/reapply of local changes.
+ * If there are uncommitted changes, they are stashed before switching and
+ * reapplied after. If the stash pop results in merge conflicts, returns
+ * a special response code so the UI can create a conflict resolution task.
+ *
+ * For remote branches (e.g., "origin/feature"), automatically creates a
+ * local tracking branch and checks it out.
+ *
+ * Also fetches the latest remote refs after switching.
+ *
+ * Git business logic is delegated to worktree-branch-service.ts.
+ * Events are emitted at key lifecycle points for WebSocket subscribers.
  *
  * Note: Git repository validation (isGitRepo, hasCommits) is handled by
  * the requireValidWorktree middleware in index.ts
  */
 
 import type { Request, Response } from 'express';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-import { getErrorMessage, logError } from '../common.js';
+import { getErrorMessage, logError, isValidBranchName } from '../common.js';
+import type { EventEmitter } from '../../../lib/events.js';
+import { performSwitchBranch } from '../../../services/worktree-branch-service.js';
 
-const execAsync = promisify(exec);
-
-function isUntrackedLine(line: string): boolean {
-  return line.startsWith('?? ');
-}
-
-function isExcludedWorktreeLine(line: string): boolean {
-  return line.includes('.worktrees/') || line.endsWith('.worktrees');
-}
-
-function isBlockingChangeLine(line: string): boolean {
-  if (!line.trim()) return false;
-  if (isExcludedWorktreeLine(line)) return false;
-  if (isUntrackedLine(line)) return false;
-  return true;
-}
-
-/**
- * Check if there are uncommitted changes in the working directory
- * Excludes .worktrees/ directory which is created by automaker
- */
-async function hasUncommittedChanges(cwd: string): Promise<boolean> {
-  try {
-    const { stdout } = await execAsync('git status --porcelain', { cwd });
-    const lines = stdout.trim().split('\n').filter(isBlockingChangeLine);
-    return lines.length > 0;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Get a summary of uncommitted changes for user feedback
- * Excludes .worktrees/ directory
- */
-async function getChangesSummary(cwd: string): Promise<string> {
-  try {
-    const { stdout } = await execAsync('git status --short', { cwd });
-    const lines = stdout.trim().split('\n').filter(isBlockingChangeLine);
-    if (lines.length === 0) return '';
-    if (lines.length <= 5) return lines.join(', ');
-    return `${lines.slice(0, 5).join(', ')} and ${lines.length - 5} more files`;
-  } catch {
-    return 'unknown changes';
-  }
-}
-
-export function createSwitchBranchHandler() {
+export function createSwitchBranchHandler(events?: EventEmitter) {
   return async (req: Request, res: Response): Promise<void> => {
     try {
       const { worktreePath, branchName } = req.body as {
@@ -85,62 +47,58 @@ export function createSwitchBranchHandler() {
         return;
       }
 
-      // Get current branch
-      const { stdout: currentBranchOutput } = await execAsync('git rev-parse --abbrev-ref HEAD', {
-        cwd: worktreePath,
-      });
-      const previousBranch = currentBranchOutput.trim();
-
-      if (previousBranch === branchName) {
-        res.json({
-          success: true,
-          result: {
-            previousBranch,
-            currentBranch: branchName,
-            message: `Already on branch '${branchName}'`,
-          },
-        });
-        return;
-      }
-
-      // Check if branch exists
-      try {
-        await execAsync(`git rev-parse --verify ${branchName}`, {
-          cwd: worktreePath,
-        });
-      } catch {
+      // Validate branch name using shared allowlist to prevent Git option injection
+      if (!isValidBranchName(branchName)) {
         res.status(400).json({
           success: false,
-          error: `Branch '${branchName}' does not exist`,
+          error: 'Invalid branch name',
         });
         return;
       }
 
-      // Check for uncommitted changes
-      if (await hasUncommittedChanges(worktreePath)) {
-        const summary = await getChangesSummary(worktreePath);
-        res.status(400).json({
+      // Execute the branch switch via the service
+      const result = await performSwitchBranch(worktreePath, branchName, events);
+
+      // Map service result to HTTP response
+      if (!result.success) {
+        // Determine status code based on error type
+        const statusCode = isBranchNotFoundError(result.error) ? 400 : 500;
+        res.status(statusCode).json({
           success: false,
-          error: `Cannot switch branches: you have uncommitted changes (${summary}). Please commit your changes first.`,
-          code: 'UNCOMMITTED_CHANGES',
+          error: result.error,
+          ...(result.stashPopConflicts !== undefined && {
+            stashPopConflicts: result.stashPopConflicts,
+          }),
+          ...(result.stashPopConflictMessage && {
+            stashPopConflictMessage: result.stashPopConflictMessage,
+          }),
         });
         return;
       }
 
-      // Switch to the target branch
-      await execAsync(`git checkout "${branchName}"`, { cwd: worktreePath });
-
       res.json({
         success: true,
-        result: {
-          previousBranch,
-          currentBranch: branchName,
-          message: `Switched to branch '${branchName}'`,
-        },
+        result: result.result,
       });
     } catch (error) {
+      events?.emit('switch:error', {
+        error: getErrorMessage(error),
+      });
+
       logError(error, 'Switch branch failed');
       res.status(500).json({ success: false, error: getErrorMessage(error) });
     }
   };
 }
+
+/**
+ * Determine whether an error message represents a client error (400)
+ * vs a server error (500).
+ *
+ * Client errors are validation issues like non-existent branches or
+ * unparseable remote branch names.
+ */
+function isBranchNotFoundError(error?: string): boolean {
+  if (!error) return false;
+  return error.includes('does not exist') || error.includes('Failed to parse remote branch name');
+}

apps/server/src/routes/zai/index.ts

@@ -0,0 +1,159 @@
+import { Router, Request, Response } from 'express';
+import { ZaiUsageService } from '../../services/zai-usage-service.js';
+import type { SettingsService } from '../../services/settings-service.js';
+import { createLogger } from '@automaker/utils';
+
+const logger = createLogger('Zai');
+
+export function createZaiRoutes(
+  usageService: ZaiUsageService,
+  settingsService: SettingsService
+): Router {
+  const router = Router();
+
+  // Initialize z.ai API token from credentials on startup
+  (async () => {
+    try {
+      const credentials = await settingsService.getCredentials();
+      if (credentials.apiKeys?.zai) {
+        usageService.setApiToken(credentials.apiKeys.zai);
+        logger.info('[init] Loaded z.ai API key from credentials');
+      }
+    } catch (error) {
+      logger.error('[init] Failed to load z.ai API key from credentials:', error);
+    }
+  })();
+
+  // Get current usage (fetches from z.ai API)
+  router.get('/usage', async (_req: Request, res: Response) => {
+    try {
+      // Check if z.ai API is configured
+      const isAvailable = usageService.isAvailable();
+      if (!isAvailable) {
+        // Use a 200 + error payload so the UI doesn't interpret it as session auth error
+        res.status(200).json({
+          error: 'z.ai API not configured',
+          message: 'Set Z_AI_API_KEY environment variable to enable z.ai usage tracking',
+        });
+        return;
+      }
+
+      const usage = await usageService.fetchUsageData();
+      res.json(usage);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+
+      if (message.includes('not configured') || message.includes('API token')) {
+        res.status(200).json({
+          error: 'API token required',
+          message: 'Set Z_AI_API_KEY environment variable to enable z.ai usage tracking',
+        });
+      } else if (message.includes('failed') || message.includes('request')) {
+        res.status(200).json({
+          error: 'API request failed',
+          message: message,
+        });
+      } else {
+        logger.error('Error fetching z.ai usage:', error);
+        res.status(500).json({ error: message });
+      }
+    }
+  });
+
+  // Configure API token (for settings page)
+  router.post('/configure', async (req: Request, res: Response) => {
+    try {
+      const { apiToken, apiHost } = req.body;
+
+      // Validate apiToken: must be present and a string
+      if (apiToken === undefined || apiToken === null || typeof apiToken !== 'string') {
+        res.status(400).json({
+          success: false,
+          error: 'Invalid request: apiToken is required and must be a string',
+        });
+        return;
+      }
+
+      // Validate apiHost if provided: must be a string and a well-formed URL
+      if (apiHost !== undefined && apiHost !== null) {
+        if (typeof apiHost !== 'string') {
+          res.status(400).json({
+            success: false,
+            error: 'Invalid request: apiHost must be a string',
+          });
+          return;
+        }
+        // Validate that apiHost is a well-formed URL
+        try {
+          const parsedUrl = new URL(apiHost);
+          if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+            res.status(400).json({
+              success: false,
+              error: 'Invalid request: apiHost must be a valid HTTP or HTTPS URL',
+            });
+            return;
+          }
+        } catch {
+          res.status(400).json({
+            success: false,
+            error: 'Invalid request: apiHost must be a well-formed URL',
+          });
+          return;
+        }
+      }
+
+      // Pass only the sanitized values to the service
+      const sanitizedToken = apiToken.trim();
+      const sanitizedHost = typeof apiHost === 'string' ? apiHost.trim() : undefined;
+
+      const result = await usageService.configure(
+        { apiToken: sanitizedToken, apiHost: sanitizedHost },
+        settingsService
+      );
+      res.json(result);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      logger.error('Error configuring z.ai:', error);
+      res.status(500).json({ error: message });
+    }
+  });
+
+  // Verify API key without storing it (for testing in settings)
+  router.post('/verify', async (req: Request, res: Response) => {
+    try {
+      const { apiKey } = req.body;
+      const result = await usageService.verifyApiKey(apiKey);
+      res.json(result);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      logger.error('Error verifying z.ai API key:', error);
+      res.json({
+        success: false,
+        authenticated: false,
+        error: `Network error: ${message}`,
+      });
+    }
+  });
+
+  // Check if z.ai is available
+  router.get('/status', async (_req: Request, res: Response) => {
+    try {
+      const isAvailable = usageService.isAvailable();
+      const hasEnvApiKey = Boolean(process.env.Z_AI_API_KEY);
+      const hasApiKey = usageService.getApiToken() !== null;
+
+      res.json({
+        success: true,
+        available: isAvailable,
+        hasApiKey,
+        hasEnvApiKey,
+        message: isAvailable ? 'z.ai API is configured' : 'z.ai API token not configured',
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      res.status(500).json({ success: false, error: message });
+    }
+  });
+
+  return router;
+}

apps/server/src/services/agent-executor.ts

@@ -42,6 +42,27 @@ export class AgentExecutor {
   private static readonly WRITE_DEBOUNCE_MS = 500;
   private static readonly STREAM_HEARTBEAT_MS = 15_000;
 
+  /**
+   * Sanitize a provider error value into clean text.
+   * Coalesces to string, removes ANSI codes, strips leading "Error:" prefix,
+   * trims, and returns 'Unknown error' when empty.
+   */
+  private static sanitizeProviderError(input: string | { error?: string } | undefined): string {
+    let raw: string;
+    if (typeof input === 'string') {
+      raw = input;
+    } else if (input && typeof input === 'object' && typeof input.error === 'string') {
+      raw = input.error;
+    } else {
+      raw = '';
+    }
+    const cleaned = raw
+      .replace(/\x1b\[[0-9;]*m/g, '')
+      .replace(/^Error:\s*/i, '')
+      .trim();
+    return cleaned || 'Unknown error';
+  }
+
   constructor(
     private eventBus: TypedEventBus,
     private featureStateManager: FeatureStateManager,
@@ -255,7 +276,7 @@ export class AgentExecutor {
             }
           }
         } else if (msg.type === 'error') {
-          throw new Error(msg.error || 'Unknown error');
+          throw new Error(AgentExecutor.sanitizeProviderError(msg.error));
         } else if (msg.type === 'result' && msg.subtype === 'success') scheduleWrite();
       }
       await writeToFile();
@@ -390,9 +411,15 @@ export class AgentExecutor {
                 input: b.input,
               });
           }
-        } else if (msg.type === 'error')
-          throw new Error(msg.error || `Error during task ${task.id}`);
-        else if (msg.type === 'result' && msg.subtype === 'success') {
+        } else if (msg.type === 'error') {
+          // Clean the error: strip ANSI codes and redundant "Error: " prefix
+          const cleanedError =
+            (msg.error || `Error during task ${task.id}`)
+              .replace(/\x1b\[[0-9;]*m/g, '')
+              .replace(/^Error:\s*/i, '')
+              .trim() || `Error during task ${task.id}`;
+          throw new Error(cleanedError);
+        } else if (msg.type === 'result' && msg.subtype === 'success') {
           taskOutput += msg.result || '';
           responseText += msg.result || '';
         }
@@ -444,17 +471,11 @@ export class AgentExecutor {
     callbacks: AgentExecutorCallbacks
   ): Promise<{ responseText: string; tasksCompleted: number }> {
     const {
-      workDir,
       featureId,
       projectPath,
-      abortController,
       branchName = null,
       planningMode = 'skip',
       provider,
-      effectiveBareModel,
-      credentials,
-      claudeCompatibleProvider,
-      mcpServers,
       sdkOptions,
     } = options;
     let responseText = initialResponseText,
@@ -562,7 +583,14 @@ export class AgentExecutor {
                     content: b.text,
                   });
                 }
-            if (msg.type === 'error') throw new Error(msg.error || 'Error during plan revision');
+            if (msg.type === 'error') {
+              const cleanedError =
+                (msg.error || 'Error during plan revision')
+                  .replace(/\x1b\[[0-9;]*m/g, '')
+                  .replace(/^Error:\s*/i, '')
+                  .trim() || 'Error during plan revision';
+              throw new Error(cleanedError);
+            }
             if (msg.type === 'result' && msg.subtype === 'success') revText += msg.result || '';
           }
           const mi = revText.indexOf('[SPEC_GENERATED]');
@@ -680,9 +708,15 @@ export class AgentExecutor {
               input: b.input,
             });
         }
-      else if (msg.type === 'error')
-        throw new Error(msg.error || 'Unknown error during implementation');
-      else if (msg.type === 'result' && msg.subtype === 'success') responseText += msg.result || '';
+      else if (msg.type === 'error') {
+        const cleanedError =
+          (msg.error || 'Unknown error during implementation')
+            .replace(/\x1b\[[0-9;]*m/g, '')
+            .replace(/^Error:\s*/i, '')
+            .trim() || 'Unknown error during implementation';
+        throw new Error(cleanedError);
+      } else if (msg.type === 'result' && msg.subtype === 'success')
+        responseText += msg.result || '';
     }
     return { responseText };
   }

apps/server/src/services/agent-service.ts

@@ -15,11 +15,9 @@ import {
   loadContextFiles,
   createLogger,
   classifyError,
-  getUserFriendlyErrorMessage,
 } from '@automaker/utils';
 import { ProviderFactory } from '../providers/provider-factory.js';
 import { createChatOptions, validateWorkingDirectory } from '../lib/sdk-options.js';
-import { PathNotAllowedError } from '@automaker/platform';
 import type { SettingsService } from './settings-service.js';
 import {
   getAutoLoadClaudeMdSetting,
@@ -98,6 +96,20 @@ export class AgentService {
     await secureFs.mkdir(this.stateDir, { recursive: true });
   }
 
+  /**
+   * Detect provider-side session errors (session not found, expired, etc.).
+   * Used to decide whether to clear a stale sdkSessionId.
+   */
+  private isStaleSessionError(rawErrorText: string): boolean {
+    const errorLower = rawErrorText.toLowerCase();
+    return (
+      errorLower.includes('session not found') ||
+      errorLower.includes('session expired') ||
+      errorLower.includes('invalid session') ||
+      errorLower.includes('no such session')
+    );
+  }
+
   /**
    * Start or resume a conversation
    */
@@ -108,32 +120,26 @@ export class AgentService {
     sessionId: string;
     workingDirectory?: string;
   }) {
-    if (!this.sessions.has(sessionId)) {
-      const messages = await this.loadSession(sessionId);
-      const metadata = await this.loadMetadata();
-      const sessionMetadata = metadata[sessionId];
-
-      // Determine the effective working directory
+    // ensureSession handles loading from disk if not in memory.
+    // For startConversation, we always want to create a session even if
+    // metadata doesn't exist yet (new session), so we fall back to creating one.
+    let session = await this.ensureSession(sessionId, workingDirectory);
+    if (!session) {
+      // Session doesn't exist on disk either — create a fresh in-memory session.
       const effectiveWorkingDirectory = workingDirectory || process.cwd();
       const resolvedWorkingDirectory = path.resolve(effectiveWorkingDirectory);
-
-      // Validate that the working directory is allowed using centralized validation
       validateWorkingDirectory(resolvedWorkingDirectory);
 
-      // Load persisted queue
-      const promptQueue = await this.loadQueueState(sessionId);
-
-      this.sessions.set(sessionId, {
-        messages,
+      session = {
+        messages: [],
         isRunning: false,
         abortController: null,
         workingDirectory: resolvedWorkingDirectory,
-        sdkSessionId: sessionMetadata?.sdkSessionId, // Load persisted SDK session ID
-        promptQueue,
-      });
+        promptQueue: [],
+      };
+      this.sessions.set(sessionId, session);
     }
 
-    const session = this.sessions.get(sessionId)!;
     return {
       success: true,
       messages: session.messages,
@@ -141,6 +147,98 @@ export class AgentService {
     };
   }
 
+  /**
+   * Ensure a session is loaded into memory.
+   *
+   * Sessions may exist on disk (in metadata and session files) but not be
+   * present in the in-memory Map — for example after a server restart, or
+   * when a client calls sendMessage before explicitly calling startConversation.
+   *
+   * This helper transparently loads the session from disk when it is missing
+   * from memory, eliminating "session not found" errors for sessions that
+   * were previously created but not yet initialized in memory.
+   *
+   * If both metadata and session files are missing, the session truly doesn't
+   * exist. A detailed diagnostic log is emitted so developers can track down
+   * how the invalid session ID was generated.
+   *
+   * @returns The in-memory Session object, or null if the session doesn't exist at all
+   */
+  private async ensureSession(
+    sessionId: string,
+    workingDirectory?: string
+  ): Promise<Session | null> {
+    const existing = this.sessions.get(sessionId);
+    if (existing) {
+      return existing;
+    }
+
+    // Try to load from disk — the session may have been created earlier
+    // (e.g. via createSession) but never initialized in memory.
+    let metadata: Record<string, SessionMetadata>;
+    let messages: Message[];
+    try {
+      [metadata, messages] = await Promise.all([this.loadMetadata(), this.loadSession(sessionId)]);
+    } catch (error) {
+      // Disk read failure should not be treated as "session not found" —
+      // it's a transient I/O problem. Log and return null so callers can
+      // surface an appropriate error message.
+      this.logger.error(
+        `Failed to load session ${sessionId} from disk (I/O error — NOT a missing session):`,
+        error
+      );
+      return null;
+    }
+
+    const sessionMetadata = metadata[sessionId];
+
+    // If there's no metadata AND no persisted messages, the session truly doesn't exist.
+    // Log diagnostic info to help track down how we ended up with an invalid session ID.
+    if (!sessionMetadata && messages.length === 0) {
+      this.logger.warn(
+        `Session "${sessionId}" not found: no metadata and no persisted messages. ` +
+          `This can happen when a session ID references a deleted/expired session, ` +
+          `or when the server restarted and the session was never persisted to disk. ` +
+          `Available session IDs in metadata: [${Object.keys(metadata).slice(0, 10).join(', ')}${Object.keys(metadata).length > 10 ? '...' : ''}]`
+      );
+      return null;
+    }
+
+    const effectiveWorkingDirectory =
+      workingDirectory || sessionMetadata?.workingDirectory || process.cwd();
+    const resolvedWorkingDirectory = path.resolve(effectiveWorkingDirectory);
+
+    // Validate that the working directory is allowed using centralized validation
+    try {
+      validateWorkingDirectory(resolvedWorkingDirectory);
+    } catch (validationError) {
+      this.logger.warn(
+        `Session "${sessionId}": working directory "${resolvedWorkingDirectory}" is not allowed — ` +
+          `returning null so callers treat it as a missing session. Error: ${(validationError as Error).message}`
+      );
+      return null;
+    }
+
+    // Load persisted queue
+    const promptQueue = await this.loadQueueState(sessionId);
+
+    const session: Session = {
+      messages,
+      isRunning: false,
+      abortController: null,
+      workingDirectory: resolvedWorkingDirectory,
+      sdkSessionId: sessionMetadata?.sdkSessionId,
+      promptQueue,
+    };
+
+    this.sessions.set(sessionId, session);
+    this.logger.info(
+      `Auto-initialized session ${sessionId} from disk ` +
+        `(${messages.length} messages, sdkSessionId: ${sessionMetadata?.sdkSessionId ? 'present' : 'none'})`
+    );
+    return session;
+  }
+
   /**
    * Send a message to the agent and stream responses
    */
@@ -161,10 +259,18 @@ export class AgentService {
     thinkingLevel?: ThinkingLevel;
     reasoningEffort?: ReasoningEffort;
   }) {
-    const session = this.sessions.get(sessionId);
+    const session = await this.ensureSession(sessionId, workingDirectory);
     if (!session) {
-      this.logger.error('ERROR: Session not found:', sessionId);
-      throw new Error(`Session ${sessionId} not found`);
+      this.logger.error(
+        `Session not found: ${sessionId}. ` +
+          `The session may have been deleted, never created, or lost after a server restart. ` +
+          `In-memory sessions: ${this.sessions.size}, requested ID: ${sessionId}`
+      );
+      throw new Error(
+        `Session ${sessionId} not found. ` +
+          `The session may have been deleted or expired. ` +
+          `Please create a new session and try again.`
+      );
     }
 
     if (session.isRunning) {
@@ -327,7 +433,7 @@ export class AgentService {
 
       // When using a custom provider (GLM, MiniMax), use resolved Claude model for SDK config
       // (thinking level budgets, allowedTools) but we MUST pass the provider's model ID
-      // (e.g. "GLM-4.7") to the API - not "claude-sonnet-4-20250514" which causes "model not found"
+      // (e.g. "GLM-4.7") to the API - not "claude-sonnet-4-6" which causes "model not found"
       const modelForSdk = providerResolvedModel || model;
       const sessionModelForSdk = providerResolvedModel ? undefined : session.model;
 
@@ -441,8 +547,13 @@ export class AgentService {
       const toolUses: Array<{ name: string; input: unknown }> = [];
 
       for await (const msg of stream) {
-        // Capture SDK session ID from any message and persist it
-        if (msg.session_id && !session.sdkSessionId) {
+        // Capture SDK session ID from any message and persist it.
+        // Update when:
+        //  - No session ID set yet (first message in a new session)
+        //  - The provider returned a *different* session ID (e.g., after a
+        //    "Session not found" recovery where the provider started a fresh
+        //    session — the stale ID must be replaced with the new one)
+        if (msg.session_id && msg.session_id !== session.sdkSessionId) {
           session.sdkSessionId = msg.session_id;
           // Persist the SDK session ID to ensure conversation continuity across server restarts
           await this.updateSession(sessionId, { sdkSessionId: msg.session_id });
@@ -505,12 +616,36 @@ export class AgentService {
           // streamed error messages instead of throwing. Handle these here so the
           // Agent Runner UX matches the Claude/Cursor behavior without changing
           // their provider implementations.
-          const rawErrorText =
+
+          // Clean error text: strip ANSI escape codes and the redundant "Error: "
+          // prefix that CLI providers (especially OpenCode) add to stderr output.
+          // The OpenCode provider strips these in normalizeEvent/executeQuery, but
+          // we also strip here as a defense-in-depth measure.
+          //
+          // Without stripping the "Error: " prefix, the wrapping at line ~647
+          // (`content: \`Error: ${enhancedText}\``) produces double-prefixed text:
+          // "Error: Error: Session not found" — confusing for the user.
+          const rawMsgError =
             (typeof msg.error === 'string' && msg.error.trim()) ||
             'Unexpected error from provider during agent execution.';
+          let rawErrorText = rawMsgError.replace(/\x1b\[[0-9;]*m/g, '').trim() || rawMsgError;
+          // Remove the CLI's "Error: " prefix to prevent double-wrapping
+          rawErrorText = rawErrorText.replace(/^Error:\s*/i, '').trim() || rawErrorText;
 
           const errorInfo = classifyError(new Error(rawErrorText));
 
+          // Detect provider-side session errors and proactively clear the stale
+          // sdkSessionId so the next attempt starts a fresh provider session.
+          // This handles providers that don't have built-in session recovery
+          // (unlike OpenCode which auto-retries without the session flag).
+          if (session.sdkSessionId && this.isStaleSessionError(rawErrorText)) {
+            this.logger.info(
+              `Clearing stale sdkSessionId for session ${sessionId} after provider session error`
+            );
+            session.sdkSessionId = undefined;
+            await this.clearSdkSessionId(sessionId);
+          }
+
           // Keep the provider-supplied text intact (Codex already includes helpful tips),
           // only add a small rate-limit hint when we can detect it.
           const enhancedText = errorInfo.isRateLimit
@@ -571,13 +706,30 @@ export class AgentService {
 
       this.logger.error('Error:', error);
 
+      // Strip ANSI escape codes and the "Error: " prefix from thrown error
+      // messages so the UI receives clean text without double-prefixing.
+      let rawThrownMsg = ((error as Error).message || '').replace(/\x1b\[[0-9;]*m/g, '').trim();
+      rawThrownMsg = rawThrownMsg.replace(/^Error:\s*/i, '').trim() || rawThrownMsg;
+      const thrownErrorMsg = rawThrownMsg.toLowerCase();
+
+      // Check if the thrown error is a provider-side session error.
+      // Clear the stale sdkSessionId so the next retry starts fresh.
+      if (session.sdkSessionId && this.isStaleSessionError(rawThrownMsg)) {
+        this.logger.info(
+          `Clearing stale sdkSessionId for session ${sessionId} after thrown session error`
+        );
+        session.sdkSessionId = undefined;
+        await this.clearSdkSessionId(sessionId);
+      }
+
       session.isRunning = false;
       session.abortController = null;
 
+      const cleanErrorMsg = rawThrownMsg || (error as Error).message;
       const errorMessage: Message = {
         id: this.generateId(),
         role: 'assistant',
-        content: `Error: ${(error as Error).message}`,
+        content: `Error: ${cleanErrorMsg}`,
         timestamp: new Date().toISOString(),
         isError: true,
       };
@@ -587,7 +739,7 @@ export class AgentService {
 
       this.emitAgentEvent(sessionId, {
         type: 'error',
-        error: (error as Error).message,
+        error: cleanErrorMsg,
         message: errorMessage,
       });
 
@@ -598,8 +750,8 @@ export class AgentService {
   /**
    * Get conversation history
    */
-  getHistory(sessionId: string) {
-    const session = this.sessions.get(sessionId);
+  async getHistory(sessionId: string) {
+    const session = await this.ensureSession(sessionId);
     if (!session) {
       return { success: false, error: 'Session not found' };
     }
@@ -615,7 +767,7 @@ export class AgentService {
    * Stop current agent execution
    */
   async stopExecution(sessionId: string) {
-    const session = this.sessions.get(sessionId);
+    const session = await this.ensureSession(sessionId);
     if (!session) {
       return { success: false, error: 'Session not found' };
     }
@@ -637,9 +789,16 @@ export class AgentService {
     if (session) {
       session.messages = [];
       session.isRunning = false;
+      session.sdkSessionId = undefined; // Clear stale provider session ID to prevent "Session not found" errors
       await this.saveSession(sessionId, []);
     }
 
+    // Clear the sdkSessionId from persisted metadata so it doesn't get
+    // reloaded by ensureSession() after a server restart.
+    // This prevents "Session not found" errors when the provider-side session
+    // no longer exists (e.g., OpenCode CLI sessions expire on disk).
+    await this.clearSdkSessionId(sessionId);
+
     return { success: true };
   }
 
@@ -796,6 +955,23 @@ export class AgentService {
     return true;
   }
 
+  /**
+   * Clear the sdkSessionId from persisted metadata.
+   *
+   * This removes the provider-side session ID so that the next message
+   * starts a fresh provider session instead of trying to resume a stale one.
+   * Prevents "Session not found" errors from CLI providers like OpenCode
+   * when the provider-side session has been deleted or expired.
+   */
+  async clearSdkSessionId(sessionId: string): Promise<void> {
+    const metadata = await this.loadMetadata();
+    if (metadata[sessionId] && metadata[sessionId].sdkSessionId) {
+      delete metadata[sessionId].sdkSessionId;
+      metadata[sessionId].updatedAt = new Date().toISOString();
+      await this.saveMetadata(metadata);
+    }
+  }
+
   // Queue management methods
 
   /**
@@ -810,7 +986,7 @@ export class AgentService {
       thinkingLevel?: ThinkingLevel;
     }
   ): Promise<{ success: boolean; queuedPrompt?: QueuedPrompt; error?: string }> {
-    const session = this.sessions.get(sessionId);
+    const session = await this.ensureSession(sessionId);
     if (!session) {
       return { success: false, error: 'Session not found' };
     }
@@ -839,8 +1015,10 @@ export class AgentService {
   /**
    * Get the current queue for a session
    */
-  getQueue(sessionId: string): { success: boolean; queue?: QueuedPrompt[]; error?: string } {
-    const session = this.sessions.get(sessionId);
+  async getQueue(
+    sessionId: string
+  ): Promise<{ success: boolean; queue?: QueuedPrompt[]; error?: string }> {
+    const session = await this.ensureSession(sessionId);
     if (!session) {
       return { success: false, error: 'Session not found' };
     }
@@ -854,7 +1032,7 @@ export class AgentService {
     sessionId: string,
     promptId: string
   ): Promise<{ success: boolean; error?: string }> {
-    const session = this.sessions.get(sessionId);
+    const session = await this.ensureSession(sessionId);
     if (!session) {
       return { success: false, error: 'Session not found' };
     }
@@ -879,7 +1057,7 @@ export class AgentService {
    * Clear all prompts from the queue
    */
   async clearQueue(sessionId: string): Promise<{ success: boolean; error?: string }> {
-    const session = this.sessions.get(sessionId);
+    const session = await this.ensureSession(sessionId);
     if (!session) {
       return { success: false, error: 'Session not found' };
     }
@@ -962,10 +1140,24 @@ export class AgentService {
     }
   }
 
+  /**
+   * Emit an event to the agent stream (private, used internally).
+   */
   private emitAgentEvent(sessionId: string, data: Record<string, unknown>): void {
     this.events.emit('agent:stream', { sessionId, ...data });
   }
 
+  /**
+   * Emit an error event for a session.
+   *
+   * Public method so that route handlers can surface errors to the UI
+   * even when sendMessage() throws before it can emit its own error event
+   * (e.g., when the session is not found and no in-memory session exists).
+   */
+  emitSessionError(sessionId: string, error: string): void {
+    this.events.emit('agent:stream', { sessionId, type: 'error', error });
+  }
+
   private async getSystemPrompt(): Promise<string> {
     // Load from settings (no caching - allows hot reload of custom prompts)
     const prompts = await getPromptCustomization(this.settingsService, '[AgentService]');

apps/server/src/services/auto-loop-coordinator.ts

@@ -4,6 +4,7 @@
 
 import type { Feature } from '@automaker/types';
 import { createLogger, classifyError } from '@automaker/utils';
+import { areDependenciesSatisfied } from '@automaker/dependency-resolver';
 import type { TypedEventBus } from './typed-event-bus.js';
 import type { ConcurrencyManager } from './concurrency-manager.js';
 import type { SettingsService } from './settings-service.js';
@@ -64,6 +65,7 @@ export type ClearExecutionStateFn = (
 ) => Promise<void>;
 export type ResetStuckFeaturesFn = (projectPath: string) => Promise<void>;
 export type IsFeatureFinishedFn = (feature: Feature) => boolean;
+export type LoadAllFeaturesFn = (projectPath: string) => Promise<Feature[]>;
 
 export class AutoLoopCoordinator {
   private autoLoopsByProject = new Map<string, ProjectAutoLoopState>();
@@ -78,7 +80,8 @@ export class AutoLoopCoordinator {
     private clearExecutionStateFn: ClearExecutionStateFn,
     private resetStuckFeaturesFn: ResetStuckFeaturesFn,
     private isFeatureFinishedFn: IsFeatureFinishedFn,
-    private isFeatureRunningFn: (featureId: string) => boolean
+    private isFeatureRunningFn: (featureId: string) => boolean,
+    private loadAllFeaturesFn?: LoadAllFeaturesFn
   ) {}
 
   /**
@@ -158,10 +161,7 @@ export class AutoLoopCoordinator {
     const projectState = this.autoLoopsByProject.get(worktreeKey);
     if (!projectState) return;
     const { projectPath, branchName } = projectState.config;
-    let iterationCount = 0;
-
     while (projectState.isRunning && !projectState.abortController.signal.aborted) {
-      iterationCount++;
       try {
         const runningCount = await this.getRunningCountForWorktree(projectPath, branchName);
         if (runningCount >= projectState.config.maxConcurrency) {
@@ -181,9 +181,34 @@ export class AutoLoopCoordinator {
           await this.sleep(10000, projectState.abortController.signal);
           continue;
         }
-        const nextFeature = pendingFeatures.find(
-          (f) => !this.isFeatureRunningFn(f.id) && !this.isFeatureFinishedFn(f)
+
+        // Load all features for dependency checking (if callback provided)
+        const allFeatures = this.loadAllFeaturesFn
+          ? await this.loadAllFeaturesFn(projectPath)
+          : undefined;
+
+        // Filter to eligible features: not running, not finished, and dependencies satisfied.
+        // When loadAllFeaturesFn is not provided, allFeatures is undefined and we bypass
+        // dependency checks (returning true) to avoid false negatives caused by completed
+        // features being absent from pendingFeatures.
+        const eligibleFeatures = pendingFeatures.filter(
+          (f) =>
+            !this.isFeatureRunningFn(f.id) &&
+            !this.isFeatureFinishedFn(f) &&
+            (this.loadAllFeaturesFn ? areDependenciesSatisfied(f, allFeatures!) : true)
         );
+
+        // Sort eligible features by priority (lower number = higher priority, default 2)
+        eligibleFeatures.sort((a, b) => (a.priority ?? 2) - (b.priority ?? 2));
+
+        const nextFeature = eligibleFeatures[0] ?? null;
+
+        if (nextFeature) {
+          logger.info(
+            `Auto-loop selected feature "${nextFeature.title || nextFeature.id}" ` +
+              `(priority=${nextFeature.priority ?? 2}) from ${eligibleFeatures.length} eligible features`
+          );
+        }
         if (nextFeature) {
           projectState.hasEmittedIdleEvent = false;
           this.executeFeatureFn(
@@ -390,6 +415,10 @@ export class AutoLoopCoordinator {
       const projectId = settings.projects?.find((p) => p.path === projectPath)?.id;
       const autoModeByWorktree = settings.autoModeByWorktree;
       if (projectId && autoModeByWorktree && typeof autoModeByWorktree === 'object') {
+        // Normalize both null and 'main' to '__main__' to match the same
+        // canonicalization used by getWorktreeAutoLoopKey, ensuring that
+        // lookups for the primary branch always use the '__main__' sentinel
+        // regardless of whether the caller passed null or the string 'main'.
         const normalizedBranch =
           branchName === null || branchName === 'main' ? '__main__' : branchName;
         const worktreeId = `${projectId}::${normalizedBranch}`;

apps/server/src/services/auto-mode/facade.ts

@@ -15,12 +15,14 @@ import path from 'path';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import type { Feature, PlanningMode, ThinkingLevel } from '@automaker/types';
-import { DEFAULT_MAX_CONCURRENCY, stripProviderPrefix } from '@automaker/types';
+import { DEFAULT_MAX_CONCURRENCY, DEFAULT_MODELS, stripProviderPrefix } from '@automaker/types';
+import { resolveModelString } from '@automaker/model-resolver';
 import { createLogger, loadContextFiles, classifyError } from '@automaker/utils';
-import { getFeatureDir, spawnProcess } from '@automaker/platform';
+import { getFeatureDir } from '@automaker/platform';
 import * as secureFs from '../../lib/secure-fs.js';
 import { validateWorkingDirectory } from '../../lib/sdk-options.js';
 import { getPromptCustomization, getProviderByModelId } from '../../lib/settings-helpers.js';
+import { execGitCommand } from '@automaker/git-utils';
 import { TypedEventBus } from '../typed-event-bus.js';
 import { ConcurrencyManager } from '../concurrency-manager.js';
 import { WorktreeResolver } from '../worktree-resolver.js';
@@ -49,24 +51,6 @@ import type {
 const execAsync = promisify(exec);
 const logger = createLogger('AutoModeServiceFacade');
 
-/**
- * Execute git command with array arguments to prevent command injection.
- */
-async function execGitCommand(args: string[], cwd: string): Promise<string> {
-  const result = await spawnProcess({
-    command: 'git',
-    args,
-    cwd,
-  });
-
-  if (result.exitCode === 0) {
-    return result.stdout;
-  } else {
-    const errorMessage = result.stderr || `Git command failed with code ${result.exitCode}`;
-    throw new Error(errorMessage);
-  }
-}
-
 /**
  * AutoModeServiceFacade provides a clean interface for auto-mode functionality.
  *
@@ -198,23 +182,18 @@ export class AutoModeServiceFacade {
       return facadeInstance;
     };
 
-    // PipelineOrchestrator - runAgentFn is a stub; routes use AutoModeService directly
-    const pipelineOrchestrator = new PipelineOrchestrator(
-      eventBus,
-      featureStateManager,
-      agentExecutor,
-      testRunnerService,
-      worktreeResolver,
-      concurrencyManager,
-      settingsService,
-      // Callbacks
-      (pPath, featureId, status) =>
-        featureStateManager.updateFeatureStatus(pPath, featureId, status),
-      loadContextFiles,
-      buildFeaturePrompt,
-      (pPath, featureId, useWorktrees, _isAutoMode, _model, opts) =>
-        getFacade().executeFeature(featureId, useWorktrees, false, undefined, opts),
-      // runAgentFn - delegates to AgentExecutor
+    /**
+     * Shared agent-run helper used by both PipelineOrchestrator and ExecutionService.
+     *
+     * Resolves the model string, looks up the custom provider/credentials via
+     * getProviderByModelId, then delegates to agentExecutor.execute with the
+     * full payload.  The opts parameter uses an index-signature union so it
+     * accepts both the typed ExecutionService opts object and the looser
+     * Record<string, unknown> used by PipelineOrchestrator without requiring
+     * type casts at the call sites.
+     */
+    const createRunAgentFn =
+      () =>
       async (
         workDir: string,
         featureId: string,
@@ -223,9 +202,18 @@ export class AutoModeServiceFacade {
         pPath: string,
         imagePaths?: string[],
         model?: string,
-        opts?: Record<string, unknown>
-      ) => {
-        const resolvedModel = model || 'claude-sonnet-4-20250514';
+        opts?: {
+          planningMode?: PlanningMode;
+          requirePlanApproval?: boolean;
+          previousContent?: string;
+          systemPrompt?: string;
+          autoLoadClaudeMd?: boolean;
+          thinkingLevel?: ThinkingLevel;
+          branchName?: string | null;
+          [key: string]: unknown;
+        }
+      ): Promise<void> => {
+        const resolvedModel = resolveModelString(model, DEFAULT_MODELS.claude);
         const provider = ProviderFactory.getProviderForModel(resolvedModel);
         const effectiveBareModel = stripProviderPrefix(resolvedModel);
 
@@ -234,7 +222,7 @@ export class AutoModeServiceFacade {
           | import('@automaker/types').ClaudeCompatibleProvider
           | undefined;
         let credentials: import('@automaker/types').Credentials | undefined;
-        if (resolvedModel && settingsService) {
+        if (settingsService) {
           const providerResult = await getProviderByModelId(
             resolvedModel,
             settingsService,
@@ -275,7 +263,7 @@ export class AutoModeServiceFacade {
               featureStateManager.saveFeatureSummary(projPath, fId, summary),
             buildTaskPrompt: (task, allTasks, taskIndex, _planContent, template, feedback) => {
               let taskPrompt = template
-                .replace(/\{\{taskName\}\}/g, task.description)
+                .replace(/\{\{taskName\}\}/g, task.description || `Task ${task.id}`)
                 .replace(/\{\{taskIndex\}\}/g, String(taskIndex + 1))
                 .replace(/\{\{totalTasks\}\}/g, String(allTasks.length))
                 .replace(/\{\{taskDescription\}\}/g, task.description || `Task ${task.id}`);
@@ -286,7 +274,25 @@ export class AutoModeServiceFacade {
             },
           }
         );
-      }
+      };
+
+    // PipelineOrchestrator - runAgentFn delegates to AgentExecutor via shared helper
+    const pipelineOrchestrator = new PipelineOrchestrator(
+      eventBus,
+      featureStateManager,
+      agentExecutor,
+      testRunnerService,
+      worktreeResolver,
+      concurrencyManager,
+      settingsService,
+      // Callbacks
+      (pPath, featureId, status) =>
+        featureStateManager.updateFeatureStatus(pPath, featureId, status),
+      loadContextFiles,
+      buildFeaturePrompt,
+      (pPath, featureId, useWorktrees, _isAutoMode, _model, opts) =>
+        getFacade().executeFeature(featureId, useWorktrees, false, undefined, opts),
+      createRunAgentFn()
     );
 
     // AutoLoopCoordinator - ALWAYS create new with proper execution callbacks
@@ -324,95 +330,17 @@ export class AutoModeServiceFacade {
         feature.status === 'completed' ||
         feature.status === 'verified' ||
         feature.status === 'waiting_approval',
-      (featureId) => concurrencyManager.isRunning(featureId)
+      (featureId) => concurrencyManager.isRunning(featureId),
+      async (pPath) => featureLoader.getAll(pPath)
     );
 
-    // ExecutionService - runAgentFn calls AgentExecutor.execute
+    // ExecutionService - runAgentFn delegates to AgentExecutor via shared helper
     const executionService = new ExecutionService(
       eventBus,
       concurrencyManager,
       worktreeResolver,
       settingsService,
-      // runAgentFn - delegates to AgentExecutor
-      async (
-        workDir: string,
-        featureId: string,
-        prompt: string,
-        abortController: AbortController,
-        pPath: string,
-        imagePaths?: string[],
-        model?: string,
-        opts?: {
-          projectPath?: string;
-          planningMode?: PlanningMode;
-          requirePlanApproval?: boolean;
-          systemPrompt?: string;
-          autoLoadClaudeMd?: boolean;
-          thinkingLevel?: ThinkingLevel;
-          branchName?: string | null;
-        }
-      ) => {
-        const resolvedModel = model || 'claude-sonnet-4-20250514';
-        const provider = ProviderFactory.getProviderForModel(resolvedModel);
-        const effectiveBareModel = stripProviderPrefix(resolvedModel);
-
-        // Resolve custom provider (GLM, MiniMax, etc.) for baseUrl and credentials
-        let claudeCompatibleProvider:
-          | import('@automaker/types').ClaudeCompatibleProvider
-          | undefined;
-        let credentials: import('@automaker/types').Credentials | undefined;
-        if (resolvedModel && settingsService) {
-          const providerResult = await getProviderByModelId(
-            resolvedModel,
-            settingsService,
-            '[AutoModeFacade]'
-          );
-          if (providerResult.provider) {
-            claudeCompatibleProvider = providerResult.provider;
-            credentials = providerResult.credentials;
-          }
-        }
-
-        await agentExecutor.execute(
-          {
-            workDir,
-            featureId,
-            prompt,
-            projectPath: pPath,
-            abortController,
-            imagePaths,
-            model: resolvedModel,
-            planningMode: opts?.planningMode,
-            requirePlanApproval: opts?.requirePlanApproval,
-            systemPrompt: opts?.systemPrompt,
-            autoLoadClaudeMd: opts?.autoLoadClaudeMd,
-            thinkingLevel: opts?.thinkingLevel,
-            branchName: opts?.branchName,
-            provider,
-            effectiveBareModel,
-            credentials,
-            claudeCompatibleProvider,
-          },
-          {
-            waitForApproval: (fId, projPath) => planApprovalService.waitForApproval(fId, projPath),
-            saveFeatureSummary: (projPath, fId, summary) =>
-              featureStateManager.saveFeatureSummary(projPath, fId, summary),
-            updateFeatureSummary: (projPath, fId, summary) =>
-              featureStateManager.saveFeatureSummary(projPath, fId, summary),
-            buildTaskPrompt: (task, allTasks, taskIndex, planContent, template, feedback) => {
-              let taskPrompt = template
-                .replace(/\{\{taskName\}\}/g, task.description)
-                .replace(/\{\{taskIndex\}\}/g, String(taskIndex + 1))
-                .replace(/\{\{totalTasks\}\}/g, String(allTasks.length))
-                .replace(/\{\{taskDescription\}\}/g, task.description || task.description);
-              if (feedback) {
-                taskPrompt = taskPrompt.replace(/\{\{userFeedback\}\}/g, feedback);
-              }
-              return taskPrompt;
-            },
-          }
-        );
-      },
+      createRunAgentFn(),
       (context) => pipelineOrchestrator.executePipeline(context),
       (pPath, featureId, status) =>
         featureStateManager.updateFeatureStatus(pPath, featureId, status),
@@ -591,12 +519,22 @@ export class AutoModeServiceFacade {
     useWorktrees = false,
     _calledInternally = false
   ): Promise<void> {
-    return this.recoveryService.resumeFeature(
-      this.projectPath,
-      featureId,
-      useWorktrees,
-      _calledInternally
-    );
+    // Note: ExecutionService.executeFeature catches its own errors internally and
+    // does NOT re-throw them (it emits auto_mode_error and returns normally).
+    // Therefore, errors that reach this catch block are pre-execution failures
+    // (e.g., feature not found, context read error) that ExecutionService never
+    // handled — so calling handleFacadeError here does NOT produce duplicate events.
+    try {
+      return await this.recoveryService.resumeFeature(
+        this.projectPath,
+        featureId,
+        useWorktrees,
+        _calledInternally
+      );
+    } catch (error) {
+      this.handleFacadeError(error, 'resumeFeature', featureId);
+      throw error;
+    }
   }
 
   /**

apps/server/src/services/auto-mode/global-service.ts

@@ -10,7 +10,6 @@
  */
 
 import path from 'path';
-import type { Feature } from '@automaker/types';
 import { createLogger } from '@automaker/utils';
 import type { EventEmitter } from '../../lib/events.js';
 import { TypedEventBus } from '../typed-event-bus.js';

apps/server/src/services/branch-commit-log-service.ts

@@ -0,0 +1,172 @@
+/**
+ * Service for fetching branch commit log data.
+ *
+ * Extracts the heavy Git command execution and parsing logic from the
+ * branch-commit-log route handler so the handler only validates input,
+ * invokes this service, streams lifecycle events, and sends the response.
+ */
+
+import { execGitCommand } from '../lib/git.js';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface BranchCommit {
+  hash: string;
+  shortHash: string;
+  author: string;
+  authorEmail: string;
+  date: string;
+  subject: string;
+  body: string;
+  files: string[];
+}
+
+export interface BranchCommitLogResult {
+  branch: string;
+  commits: BranchCommit[];
+  total: number;
+}
+
+// ============================================================================
+// Service
+// ============================================================================
+
+/**
+ * Fetch the commit log for a specific branch (or HEAD).
+ *
+ * Runs a single `git log --name-only` invocation (plus `git rev-parse`
+ * when branchName is omitted) inside the given worktree path and
+ * returns a structured result.
+ *
+ * @param worktreePath - Absolute path to the worktree / repository
+ * @param branchName   - Branch to query (omit or pass undefined for HEAD)
+ * @param limit        - Maximum number of commits to return (clamped 1-100)
+ */
+export async function getBranchCommitLog(
+  worktreePath: string,
+  branchName: string | undefined,
+  limit: number
+): Promise<BranchCommitLogResult> {
+  // Clamp limit to a reasonable range
+  const parsedLimit = Number(limit);
+  const commitLimit = Math.min(Math.max(1, Number.isFinite(parsedLimit) ? parsedLimit : 20), 100);
+
+  // Use the specified branch or default to HEAD
+  const targetRef = branchName || 'HEAD';
+
+  // Fetch commit metadata AND file lists in a single git call.
+  // Uses custom record separators so we can parse both metadata and
+  // --name-only output from one invocation, eliminating the previous
+  // N+1 pattern that spawned a separate `git diff-tree` per commit.
+  //
+  // -m causes merge commits to be diffed against each parent so all
+  // files touched by the merge are listed (without -m, --name-only
+  // produces no file output for merge commits because they have 2+ parents).
+  // This means merge commits appear multiple times in the output (once per
+  // parent), so we deduplicate by hash below and merge their file lists.
+  // We over-fetch (2× the limit) to compensate for -m duplicating merge
+  // commit entries, then trim the result to the requested limit.
+  // Use ASCII control characters as record separators – these cannot appear in
+  // git commit messages, so these delimiters are safe regardless of commit
+  // body content.  %x00 and %x01 in git's format string emit literal NUL /
+  // SOH bytes respectively.
+  //
+  // COMMIT_SEP (\x00) – marks the start of each commit record.
+  // META_END   (\x01) – separates commit metadata from the --name-only file list.
+  //
+  // Full per-commit layout emitted by git:
+  //   \x00\n<hash>\n<shorthash>\n...\n<subject>\n<body>\x01<files...>
+  const COMMIT_SEP = '\x00';
+  const META_END = '\x01';
+  const fetchLimit = commitLimit * 2;
+
+  const logOutput = await execGitCommand(
+    [
+      'log',
+      targetRef,
+      `--max-count=${fetchLimit}`,
+      '-m',
+      '--name-only',
+      `--format=%x00%n%H%n%h%n%an%n%ae%n%aI%n%s%n%b%x01`,
+    ],
+    worktreePath
+  );
+
+  // Split output into per-commit blocks and drop the empty first chunk
+  // (the output starts with a NUL commit separator).
+  const commitBlocks = logOutput.split(COMMIT_SEP).filter((block) => block.trim());
+
+  // Use a Map to deduplicate merge commit entries (which appear once per
+  // parent when -m is used) while preserving insertion order.
+  const commitMap = new Map<string, BranchCommit>();
+
+  for (const block of commitBlocks) {
+    const metaEndIdx = block.indexOf(META_END);
+    if (metaEndIdx === -1) continue; // malformed block, skip
+
+    // --- Parse metadata (everything before the META_END delimiter) ---
+    const metaRaw = block.substring(0, metaEndIdx);
+    const metaLines = metaRaw.split('\n');
+
+    // The first line may be empty (newline right after COMMIT_SEP), skip it
+    const nonEmptyStart = metaLines.findIndex((l) => l.trim() !== '');
+    if (nonEmptyStart === -1) continue;
+
+    const fields = metaLines.slice(nonEmptyStart);
+    if (fields.length < 6) continue; // need at least hash..subject
+
+    const hash = fields[0].trim();
+    if (!hash) continue; // defensive: skip if hash is empty
+    const shortHash = fields[1]?.trim() ?? '';
+    const author = fields[2]?.trim() ?? '';
+    const authorEmail = fields[3]?.trim() ?? '';
+    const date = fields[4]?.trim() ?? '';
+    const subject = fields[5]?.trim() ?? '';
+    const body = fields.slice(6).join('\n').trim();
+
+    // --- Parse file list (everything after the META_END delimiter) ---
+    const filesRaw = block.substring(metaEndIdx + META_END.length);
+    const blockFiles = filesRaw
+      .trim()
+      .split('\n')
+      .filter((f) => f.trim());
+
+    // Merge file lists for duplicate entries (merge commits with -m)
+    const existing = commitMap.get(hash);
+    if (existing) {
+      // Add new files to the existing entry's file set
+      const fileSet = new Set(existing.files);
+      for (const f of blockFiles) fileSet.add(f);
+      existing.files = [...fileSet];
+    } else {
+      commitMap.set(hash, {
+        hash,
+        shortHash,
+        author,
+        authorEmail,
+        date,
+        subject,
+        body,
+        files: [...new Set(blockFiles)],
+      });
+    }
+  }
+
+  // Trim to the requested limit (we over-fetched to account for -m duplicates)
+  const commits = [...commitMap.values()].slice(0, commitLimit);
+
+  // If branchName wasn't specified, get current branch for display
+  let displayBranch = branchName;
+  if (!displayBranch) {
+    const branchOutput = await execGitCommand(['rev-parse', '--abbrev-ref', 'HEAD'], worktreePath);
+    displayBranch = branchOutput.trim();
+  }
+
+  return {
+    branch: displayBranch,
+    commits,
+    total: commits.length,
+  };
+}

apps/server/src/services/branch-utils.ts

@@ -0,0 +1,170 @@
+/**
+ * branch-utils - Shared git branch helper utilities
+ *
+ * Provides common git operations used by both checkout-branch-service and
+ * worktree-branch-service. Extracted to avoid duplication and ensure
+ * consistent behaviour across branch-related services.
+ */
+
+import { createLogger, getErrorMessage } from '@automaker/utils';
+import { execGitCommand, execGitCommandWithLockRetry } from '../lib/git.js';
+
+const logger = createLogger('BranchUtils');
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface HasAnyChangesOptions {
+  /**
+   * When true, lines that refer to worktree-internal paths (containing
+   * ".worktrees/" or ending with ".worktrees") are excluded from the count.
+   * Use this in contexts where worktree directory entries should not be
+   * considered as real working-tree changes (e.g. worktree-branch-service).
+   */
+  excludeWorktreePaths?: boolean;
+  /**
+   * When true (default), untracked files (lines starting with "??") are
+   * included in the change count. When false, untracked files are ignored so
+   * that hasAnyChanges() is consistent with stashChanges() called without
+   * --include-untracked.
+   */
+  includeUntracked?: boolean;
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+/**
+ * Returns true when a `git status --porcelain` output line refers to a
+ * worktree-internal path that should be ignored when deciding whether there
+ * are "real" local changes.
+ */
+function isExcludedWorktreeLine(line: string): boolean {
+  return line.includes('.worktrees/') || line.endsWith('.worktrees');
+}
+
+// ============================================================================
+// Exported Utilities
+// ============================================================================
+
+/**
+ * Check if there are any changes that should be stashed.
+ *
+ * @param cwd - Working directory of the git repository / worktree
+ * @param options - Optional flags controlling which lines are counted
+ * @param options.excludeWorktreePaths - When true, lines matching worktree
+ *   internal paths are excluded so they are not mistaken for real changes
+ * @param options.includeUntracked - When false, untracked files (lines
+ *   starting with "??") are excluded so this is consistent with a
+ *   stashChanges() call that does not pass --include-untracked.
+ *   Defaults to true.
+ */
+export async function hasAnyChanges(cwd: string, options?: HasAnyChangesOptions): Promise<boolean> {
+  try {
+    const includeUntracked = options?.includeUntracked ?? true;
+    const stdout = await execGitCommand(['status', '--porcelain'], cwd);
+    const lines = stdout
+      .trim()
+      .split('\n')
+      .filter((line) => {
+        if (!line.trim()) return false;
+        if (options?.excludeWorktreePaths && isExcludedWorktreeLine(line)) return false;
+        if (!includeUntracked && line.startsWith('??')) return false;
+        return true;
+      });
+    return lines.length > 0;
+  } catch (err) {
+    logger.error('hasAnyChanges: execGitCommand failed — returning false', {
+      cwd,
+      error: getErrorMessage(err),
+    });
+    return false;
+  }
+}
+
+/**
+ * Stash all local changes (including untracked files if requested).
+ * Returns true if a stash was created, false if there was nothing to stash.
+ * Throws on unexpected errors so callers abort rather than proceeding silently.
+ *
+ * @param cwd - Working directory of the git repository / worktree
+ * @param message - Stash message
+ * @param includeUntracked - When true, passes `--include-untracked` to git stash
+ */
+export async function stashChanges(
+  cwd: string,
+  message: string,
+  includeUntracked: boolean = true
+): Promise<boolean> {
+  try {
+    const args = ['stash', 'push'];
+    if (includeUntracked) {
+      args.push('--include-untracked');
+    }
+    args.push('-m', message);
+
+    const stdout = await execGitCommandWithLockRetry(args, cwd);
+
+    // git exits 0 but prints a benign message when there is nothing to stash
+    const stdoutLower = stdout.toLowerCase();
+    if (
+      stdoutLower.includes('no local changes to save') ||
+      stdoutLower.includes('nothing to stash')
+    ) {
+      logger.debug('stashChanges: nothing to stash', { cwd, message, stdout });
+      return false;
+    }
+
+    return true;
+  } catch (error) {
+    const errorMsg = getErrorMessage(error);
+
+    // Unexpected error – log full details and re-throw so the caller aborts
+    // rather than proceeding with an un-stashed working tree
+    logger.error('stashChanges: unexpected error during stash', {
+      cwd,
+      message,
+      error: errorMsg,
+    });
+    throw new Error(`Failed to stash changes in ${cwd}: ${errorMsg}`);
+  }
+}
+
+/**
+ * Pop the most recent stash entry.
+ * Returns an object indicating success and whether there were conflicts.
+ *
+ * @param cwd - Working directory of the git repository / worktree
+ */
+export async function popStash(
+  cwd: string
+): Promise<{ success: boolean; hasConflicts: boolean; error?: string }> {
+  try {
+    await execGitCommandWithLockRetry(['stash', 'pop'], cwd);
+    // If execGitCommandWithLockRetry succeeds (zero exit code), there are no conflicts
+    return { success: true, hasConflicts: false };
+  } catch (error) {
+    const errorMsg = getErrorMessage(error);
+    if (errorMsg.includes('CONFLICT') || errorMsg.includes('Merge conflict')) {
+      return { success: false, hasConflicts: true, error: errorMsg };
+    }
+    return { success: false, hasConflicts: false, error: errorMsg };
+  }
+}
+
+/**
+ * Check if a local branch already exists.
+ *
+ * @param cwd - Working directory of the git repository / worktree
+ * @param branchName - The branch name to look up (without refs/heads/ prefix)
+ */
+export async function localBranchExists(cwd: string, branchName: string): Promise<boolean> {
+  try {
+    await execGitCommand(['rev-parse', '--verify', `refs/heads/${branchName}`], cwd);
+    return true;
+  } catch {
+    return false;
+  }
+}

apps/server/src/services/checkout-branch-service.ts

@@ -0,0 +1,343 @@
+/**
+ * CheckoutBranchService - Create and checkout a new branch with stash handling
+ *
+ * Handles new branch creation with automatic stash/reapply of local changes.
+ * If there are uncommitted changes and the caller requests stashing, they are
+ * stashed before creating the branch and reapplied after. If the stash pop
+ * results in merge conflicts, returns a special response so the UI can create
+ * a conflict resolution task.
+ *
+ * Follows the same pattern as worktree-branch-service.ts (performSwitchBranch).
+ *
+ * The workflow:
+ * 1. Validate inputs (branch name, base branch)
+ * 2. Get current branch name
+ * 3. Check if target branch already exists
+ * 4. Optionally stash local changes
+ * 5. Create and checkout the new branch
+ * 6. Reapply stashed changes (detect conflicts)
+ * 7. Handle error recovery (restore stash if checkout fails)
+ */
+
+import { getErrorMessage } from '@automaker/utils';
+import { execGitCommand } from '../lib/git.js';
+import type { EventEmitter } from '../lib/events.js';
+import { hasAnyChanges, stashChanges, popStash, localBranchExists } from './branch-utils.js';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface CheckoutBranchOptions {
+  /** When true, stash local changes before checkout and reapply after */
+  stashChanges?: boolean;
+  /** When true, include untracked files in the stash */
+  includeUntracked?: boolean;
+}
+
+export interface CheckoutBranchResult {
+  success: boolean;
+  error?: string;
+  result?: {
+    previousBranch: string;
+    newBranch: string;
+    message: string;
+    hasConflicts?: boolean;
+    stashedChanges?: boolean;
+  };
+  /** Set when checkout fails and stash pop produced conflicts during recovery */
+  stashPopConflicts?: boolean;
+  /** Human-readable message when stash pop conflicts occur during error recovery */
+  stashPopConflictMessage?: string;
+}
+
+// ============================================================================
+// Main Service Function
+// ============================================================================
+
+/**
+ * Create and checkout a new branch, optionally stashing and restoring local changes.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param branchName - Name of the new branch to create
+ * @param baseBranch - Optional base branch to create from (defaults to current HEAD)
+ * @param options - Stash handling options
+ * @param events - Optional event emitter for lifecycle events
+ * @returns CheckoutBranchResult with detailed status information
+ */
+export async function performCheckoutBranch(
+  worktreePath: string,
+  branchName: string,
+  baseBranch?: string,
+  options?: CheckoutBranchOptions,
+  events?: EventEmitter
+): Promise<CheckoutBranchResult> {
+  const shouldStash = options?.stashChanges ?? false;
+  const includeUntracked = options?.includeUntracked ?? true;
+
+  // Emit start event
+  events?.emit('switch:start', { worktreePath, branchName, operation: 'checkout' });
+
+  // 1. Get current branch
+  let previousBranch: string;
+  try {
+    const currentBranchOutput = await execGitCommand(
+      ['rev-parse', '--abbrev-ref', 'HEAD'],
+      worktreePath
+    );
+    previousBranch = currentBranchOutput.trim();
+  } catch (branchError) {
+    const branchErrorMsg = getErrorMessage(branchError);
+    events?.emit('switch:error', {
+      worktreePath,
+      branchName,
+      error: branchErrorMsg,
+    });
+    return {
+      success: false,
+      error: `Failed to determine current branch: ${branchErrorMsg}`,
+    };
+  }
+
+  // 2. Check if branch already exists
+  if (await localBranchExists(worktreePath, branchName)) {
+    events?.emit('switch:error', {
+      worktreePath,
+      branchName,
+      error: `Branch '${branchName}' already exists`,
+    });
+    return {
+      success: false,
+      error: `Branch '${branchName}' already exists`,
+    };
+  }
+
+  // 3. Validate base branch if provided
+  if (baseBranch) {
+    try {
+      await execGitCommand(['rev-parse', '--verify', baseBranch], worktreePath);
+    } catch {
+      events?.emit('switch:error', {
+        worktreePath,
+        branchName,
+        error: `Base branch '${baseBranch}' does not exist`,
+      });
+      return {
+        success: false,
+        error: `Base branch '${baseBranch}' does not exist`,
+      };
+    }
+  }
+
+  // 4. Stash local changes if requested and there are changes
+  let didStash = false;
+
+  if (shouldStash) {
+    const hadChanges = await hasAnyChanges(worktreePath, { includeUntracked });
+    if (hadChanges) {
+      events?.emit('switch:stash', {
+        worktreePath,
+        previousBranch,
+        targetBranch: branchName,
+        action: 'push',
+      });
+
+      const stashMessage = `Auto-stash before switching to ${branchName}`;
+      try {
+        didStash = await stashChanges(worktreePath, stashMessage, includeUntracked);
+      } catch (stashError) {
+        const stashErrorMsg = getErrorMessage(stashError);
+        events?.emit('switch:error', {
+          worktreePath,
+          branchName,
+          error: `Failed to stash local changes: ${stashErrorMsg}`,
+        });
+        return {
+          success: false,
+          error: `Failed to stash local changes before creating branch: ${stashErrorMsg}`,
+        };
+      }
+    }
+  }
+
+  try {
+    // 5. Create and checkout the new branch
+    events?.emit('switch:checkout', {
+      worktreePath,
+      targetBranch: branchName,
+      isRemote: false,
+      previousBranch,
+    });
+
+    const checkoutArgs = ['checkout', '-b', branchName];
+    if (baseBranch) {
+      checkoutArgs.push(baseBranch);
+    }
+    await execGitCommand(checkoutArgs, worktreePath);
+
+    // 6. Reapply stashed changes if we stashed earlier
+    let hasConflicts = false;
+    let conflictMessage = '';
+    let stashReapplied = false;
+
+    if (didStash) {
+      events?.emit('switch:pop', {
+        worktreePath,
+        targetBranch: branchName,
+        action: 'pop',
+      });
+
+      // Isolate the pop in its own try/catch so a thrown exception does not
+      // propagate to the outer catch block, which would attempt a second pop.
+      try {
+        const popResult = await popStash(worktreePath);
+        // Mark didStash false so the outer error-recovery path cannot pop again.
+        didStash = false;
+        hasConflicts = popResult.hasConflicts;
+        if (popResult.hasConflicts) {
+          conflictMessage = `Created branch '${branchName}' but merge conflicts occurred when reapplying your local changes. Please resolve the conflicts.`;
+        } else if (!popResult.success) {
+          conflictMessage = `Created branch '${branchName}' but failed to reapply stashed changes: ${popResult.error}. Your changes are still in the stash.`;
+        } else {
+          stashReapplied = true;
+        }
+      } catch (popError) {
+        // Pop threw an unexpected exception. Record the error and clear didStash
+        // so the outer catch does not attempt a second pop.
+        didStash = false;
+        conflictMessage = `Created branch '${branchName}' but an error occurred while reapplying stashed changes: ${getErrorMessage(popError)}. Your changes may still be in the stash.`;
+        events?.emit('switch:pop', {
+          worktreePath,
+          targetBranch: branchName,
+          action: 'pop',
+          error: getErrorMessage(popError),
+        });
+      }
+    }
+
+    if (hasConflicts) {
+      events?.emit('switch:done', {
+        worktreePath,
+        previousBranch,
+        currentBranch: branchName,
+        hasConflicts: true,
+      });
+      return {
+        success: true,
+        result: {
+          previousBranch,
+          newBranch: branchName,
+          message: conflictMessage,
+          hasConflicts: true,
+          stashedChanges: true,
+        },
+      };
+    } else if (didStash && !stashReapplied) {
+      // Stash pop failed for a non-conflict reason — stash is still present
+      events?.emit('switch:done', {
+        worktreePath,
+        previousBranch,
+        currentBranch: branchName,
+        stashPopFailed: true,
+      });
+      return {
+        success: true,
+        result: {
+          previousBranch,
+          newBranch: branchName,
+          message: conflictMessage,
+          hasConflicts: false,
+          stashedChanges: true,
+        },
+      };
+    } else {
+      const stashNote = stashReapplied ? ' (local changes stashed and reapplied)' : '';
+      events?.emit('switch:done', {
+        worktreePath,
+        previousBranch,
+        currentBranch: branchName,
+        stashReapplied,
+      });
+      return {
+        success: true,
+        result: {
+          previousBranch,
+          newBranch: branchName,
+          message: `Created and checked out branch '${branchName}'${stashNote}`,
+          hasConflicts: false,
+          stashedChanges: stashReapplied,
+        },
+      };
+    }
+  } catch (checkoutError) {
+    // 7. If checkout failed and we stashed, try to restore the stash
+    if (didStash) {
+      try {
+        const popResult = await popStash(worktreePath);
+        if (popResult.hasConflicts) {
+          const checkoutErrorMsg = getErrorMessage(checkoutError);
+          events?.emit('switch:error', {
+            worktreePath,
+            branchName,
+            error: checkoutErrorMsg,
+            stashPopConflicts: true,
+          });
+          return {
+            success: false,
+            error: checkoutErrorMsg,
+            stashPopConflicts: true,
+            stashPopConflictMessage:
+              'Stash pop resulted in conflicts: your stashed changes were partially reapplied ' +
+              'but produced merge conflicts. Please resolve the conflicts before retrying.',
+          };
+        } else if (!popResult.success) {
+          const checkoutErrorMsg = getErrorMessage(checkoutError);
+          const combinedMessage =
+            `${checkoutErrorMsg}. Additionally, restoring your stashed changes failed: ` +
+            `${popResult.error ?? 'unknown error'} — your changes are still saved in the stash.`;
+          events?.emit('switch:error', {
+            worktreePath,
+            branchName,
+            error: combinedMessage,
+          });
+          return {
+            success: false,
+            error: combinedMessage,
+            stashPopConflicts: false,
+          };
+        }
+        // popResult.success === true: stash was cleanly restored
+      } catch (popError) {
+        // popStash itself threw — build a failure result rather than letting
+        // the exception propagate and produce an unhandled rejection.
+        const checkoutErrorMsg = getErrorMessage(checkoutError);
+        const popErrorMsg = getErrorMessage(popError);
+        const combinedMessage =
+          `${checkoutErrorMsg}. Additionally, an error occurred while attempting to restore ` +
+          `your stashed changes: ${popErrorMsg} — your changes may still be saved in the stash.`;
+        events?.emit('switch:error', {
+          worktreePath,
+          branchName,
+          error: combinedMessage,
+        });
+        return {
+          success: false,
+          error: combinedMessage,
+          stashPopConflicts: false,
+          stashPopConflictMessage: combinedMessage,
+        };
+      }
+    }
+    const checkoutErrorMsg = getErrorMessage(checkoutError);
+    events?.emit('switch:error', {
+      worktreePath,
+      branchName,
+      error: checkoutErrorMsg,
+    });
+    return {
+      success: false,
+      error: checkoutErrorMsg,
+      stashPopConflicts: false,
+    };
+  }
+}

apps/server/src/services/cherry-pick-service.ts

@@ -0,0 +1,179 @@
+/**
+ * CherryPickService - Cherry-pick git operations without HTTP
+ *
+ * Extracted from worktree cherry-pick route to encapsulate all git
+ * cherry-pick business logic in a single service. Follows the same
+ * pattern as merge-service.ts.
+ */
+
+import { createLogger } from '@automaker/utils';
+import { execGitCommand, getCurrentBranch } from '../lib/git.js';
+import { type EventEmitter } from '../lib/events.js';
+
+const logger = createLogger('CherryPickService');
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface CherryPickOptions {
+  noCommit?: boolean;
+}
+
+export interface CherryPickResult {
+  success: boolean;
+  error?: string;
+  hasConflicts?: boolean;
+  aborted?: boolean;
+  cherryPicked?: boolean;
+  commitHashes?: string[];
+  branch?: string;
+  message?: string;
+}
+
+// ============================================================================
+// Service Functions
+// ============================================================================
+
+/**
+ * Verify that each commit hash exists in the repository.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param commitHashes - Array of commit hashes to verify
+ * @param emitter - Optional event emitter for lifecycle events
+ * @returns The first invalid commit hash, or null if all are valid
+ */
+export async function verifyCommits(
+  worktreePath: string,
+  commitHashes: string[],
+  emitter?: EventEmitter
+): Promise<string | null> {
+  for (const hash of commitHashes) {
+    try {
+      await execGitCommand(['rev-parse', '--verify', hash], worktreePath);
+    } catch {
+      emitter?.emit('cherry-pick:verify-failed', { worktreePath, hash });
+      return hash;
+    }
+  }
+  return null;
+}
+
+/**
+ * Run the cherry-pick operation on the given worktree.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param commitHashes - Array of commit hashes to cherry-pick (in order)
+ * @param options - Cherry-pick options (e.g., noCommit)
+ * @param emitter - Optional event emitter for lifecycle events
+ * @returns CherryPickResult with success/failure information
+ */
+export async function runCherryPick(
+  worktreePath: string,
+  commitHashes: string[],
+  options?: CherryPickOptions,
+  emitter?: EventEmitter
+): Promise<CherryPickResult> {
+  const args = ['cherry-pick'];
+  if (options?.noCommit) {
+    args.push('--no-commit');
+  }
+  args.push(...commitHashes);
+
+  emitter?.emit('cherry-pick:started', { worktreePath, commitHashes });
+
+  try {
+    await execGitCommand(args, worktreePath);
+
+    const branch = await getCurrentBranch(worktreePath);
+
+    if (options?.noCommit) {
+      const result: CherryPickResult = {
+        success: true,
+        cherryPicked: false,
+        commitHashes,
+        branch,
+        message: `Staged changes from ${commitHashes.length} commit(s); no commit created due to --no-commit`,
+      };
+      emitter?.emit('cherry-pick:success', { worktreePath, commitHashes, branch });
+      return result;
+    }
+
+    const result: CherryPickResult = {
+      success: true,
+      cherryPicked: true,
+      commitHashes,
+      branch,
+      message: `Successfully cherry-picked ${commitHashes.length} commit(s)`,
+    };
+    emitter?.emit('cherry-pick:success', { worktreePath, commitHashes, branch });
+    return result;
+  } catch (cherryPickError: unknown) {
+    // Check if this is a cherry-pick conflict
+    const err = cherryPickError as { stdout?: string; stderr?: string; message?: string };
+    const output = `${err.stdout || ''} ${err.stderr || ''} ${err.message || ''}`;
+    const hasConflicts =
+      output.includes('CONFLICT') ||
+      output.includes('cherry-pick failed') ||
+      output.includes('could not apply');
+
+    if (hasConflicts) {
+      // Abort the cherry-pick to leave the repo in a clean state
+      const aborted = await abortCherryPick(worktreePath, emitter);
+
+      if (!aborted) {
+        logger.error(
+          'Failed to abort cherry-pick after conflict; repository may be in a dirty state',
+          { worktreePath }
+        );
+      }
+
+      emitter?.emit('cherry-pick:conflict', {
+        worktreePath,
+        commitHashes,
+        aborted,
+        stdout: err.stdout,
+        stderr: err.stderr,
+      });
+
+      return {
+        success: false,
+        error: aborted
+          ? 'Cherry-pick aborted due to conflicts; no changes were applied.'
+          : 'Cherry-pick failed due to conflicts and the abort also failed; repository may be in a dirty state.',
+        hasConflicts: true,
+        aborted,
+      };
+    }
+
+    // Non-conflict error - propagate
+    throw cherryPickError;
+  }
+}
+
+/**
+ * Abort an in-progress cherry-pick operation.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param emitter - Optional event emitter for lifecycle events
+ * @returns true if abort succeeded, false if it failed (logged as warning)
+ */
+export async function abortCherryPick(
+  worktreePath: string,
+  emitter?: EventEmitter
+): Promise<boolean> {
+  try {
+    await execGitCommand(['cherry-pick', '--abort'], worktreePath);
+    emitter?.emit('cherry-pick:abort', { worktreePath, aborted: true });
+    return true;
+  } catch (err: unknown) {
+    const error = err as { message?: string };
+    logger.warn('Failed to abort cherry-pick after conflict');
+    emitter?.emit('cherry-pick:abort', {
+      worktreePath,
+      aborted: false,
+      error: error.message ?? 'Unknown error during cherry-pick abort',
+    });
+    return false;
+  }
+}

apps/server/src/services/claude-usage-service.ts

@@ -295,7 +295,6 @@ export class ClaudeUsageService {
           }
           // Don't fail if we have data - return it instead
           // Check cleaned output since raw output has ANSI codes between words
-          // eslint-disable-next-line no-control-regex
           const cleanedForCheck = output
             .replace(/\x1B\[(\d+)C/g, (_m: string, n: string) => ' '.repeat(parseInt(n, 10)))
             .replace(/\x1B\[[0-9;?]*[A-Za-z@]/g, '');
@@ -332,7 +331,6 @@ export class ClaudeUsageService {
         // Convert cursor forward (ESC[nC) to spaces first to preserve word boundaries,
         // then strip remaining ANSI sequences. Without this, the Claude CLI TUI output
         // like "Current week (all models)" becomes "Currentweek(allmodels)".
-        // eslint-disable-next-line no-control-regex
         const cleanOutput = output
           .replace(/\x1B\[(\d+)C/g, (_match: string, n: string) => ' '.repeat(parseInt(n, 10)))
           .replace(/\x1B\[[0-9;?]*[A-Za-z@]/g, '');
@@ -492,7 +490,6 @@ export class ClaudeUsageService {
     // First, convert cursor movement sequences to whitespace to preserve word boundaries.
     // The Claude CLI TUI uses ESC[nC (cursor forward) instead of actual spaces between words.
     // Without this, "Current week (all models)" becomes "Currentweek(allmodels)" after stripping.
-    // eslint-disable-next-line no-control-regex
     let clean = text
       // Cursor forward (CSI n C): replace with n spaces to preserve word separation
       .replace(/\x1B\[(\d+)C/g, (_match, n) => ' '.repeat(parseInt(n, 10)))

apps/server/src/services/commit-log-service.ts

@@ -0,0 +1,161 @@
+/**
+ * Service for fetching commit log data from a worktree.
+ *
+ * Extracts the heavy Git command execution and parsing logic from the
+ * commit-log route handler so the handler only validates input,
+ * invokes this service, streams lifecycle events, and sends the response.
+ *
+ * Follows the same approach as branch-commit-log-service: a single
+ * `git log --name-only` call with custom separators to fetch both
+ * commit metadata and file lists, avoiding N+1 git invocations.
+ */
+
+import { execGitCommand } from '../lib/git.js';
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface CommitLogEntry {
+  hash: string;
+  shortHash: string;
+  author: string;
+  authorEmail: string;
+  date: string;
+  subject: string;
+  body: string;
+  files: string[];
+}
+
+export interface CommitLogResult {
+  branch: string;
+  commits: CommitLogEntry[];
+  total: number;
+}
+
+// ============================================================================
+// Service
+// ============================================================================
+
+/**
+ * Fetch the commit log for a worktree (HEAD).
+ *
+ * Runs a single `git log --name-only` invocation plus `git rev-parse`
+ * inside the given worktree path and returns a structured result.
+ *
+ * @param worktreePath - Absolute path to the worktree / repository
+ * @param limit        - Maximum number of commits to return (clamped 1-100)
+ */
+export async function getCommitLog(worktreePath: string, limit: number): Promise<CommitLogResult> {
+  // Clamp limit to a reasonable range
+  const parsedLimit = Number(limit);
+  const commitLimit = Math.min(Math.max(1, Number.isFinite(parsedLimit) ? parsedLimit : 20), 100);
+
+  // Use custom separators to parse both metadata and file lists from
+  // a single git log invocation (same approach as branch-commit-log-service).
+  //
+  // -m causes merge commits to be diffed against each parent so all
+  // files touched by the merge are listed (without -m, --name-only
+  // produces no file output for merge commits because they have 2+ parents).
+  // This means merge commits appear multiple times in the output (once per
+  // parent), so we deduplicate by hash below and merge their file lists.
+  // We over-fetch (2x the limit) to compensate for -m duplicating merge
+  // commit entries, then trim the result to the requested limit.
+  // Use ASCII control characters as record separators – these cannot appear in
+  // git commit messages, so these delimiters are safe regardless of commit
+  // body content.  %x00 and %x01 in git's format string emit literal NUL /
+  // SOH bytes respectively.
+  //
+  // COMMIT_SEP (\x00) – marks the start of each commit record.
+  // META_END   (\x01) – separates commit metadata from the --name-only file list.
+  //
+  // Full per-commit layout emitted by git:
+  //   \x00\n<hash>\n<shorthash>\n...\n<subject>\n<body>\x01<files...>
+  const COMMIT_SEP = '\x00';
+  const META_END = '\x01';
+  const fetchLimit = commitLimit * 2;
+
+  const logOutput = await execGitCommand(
+    [
+      'log',
+      `--max-count=${fetchLimit}`,
+      '-m',
+      '--name-only',
+      `--format=%x00%n%H%n%h%n%an%n%ae%n%aI%n%s%n%b%x01`,
+    ],
+    worktreePath
+  );
+
+  // Split output into per-commit blocks and drop the empty first chunk
+  // (the output starts with a NUL commit separator).
+  const commitBlocks = logOutput.split(COMMIT_SEP).filter((block) => block.trim());
+
+  // Use a Map to deduplicate merge commit entries (which appear once per
+  // parent when -m is used) while preserving insertion order.
+  const commitMap = new Map<string, CommitLogEntry>();
+
+  for (const block of commitBlocks) {
+    const metaEndIdx = block.indexOf(META_END);
+    if (metaEndIdx === -1) continue; // malformed block, skip
+
+    // --- Parse metadata (everything before the META_END delimiter) ---
+    const metaRaw = block.substring(0, metaEndIdx);
+    const metaLines = metaRaw.split('\n');
+
+    // The first line may be empty (newline right after COMMIT_SEP), skip it
+    const nonEmptyStart = metaLines.findIndex((l) => l.trim() !== '');
+    if (nonEmptyStart === -1) continue;
+
+    const fields = metaLines.slice(nonEmptyStart);
+    if (fields.length < 6) continue; // need at least hash..subject
+
+    const hash = fields[0].trim();
+    if (!hash) continue; // defensive: skip if hash is empty
+    const shortHash = fields[1]?.trim() ?? '';
+    const author = fields[2]?.trim() ?? '';
+    const authorEmail = fields[3]?.trim() ?? '';
+    const date = fields[4]?.trim() ?? '';
+    const subject = fields[5]?.trim() ?? '';
+    const body = fields.slice(6).join('\n').trim();
+
+    // --- Parse file list (everything after the META_END delimiter) ---
+    const filesRaw = block.substring(metaEndIdx + META_END.length);
+    const blockFiles = filesRaw
+      .trim()
+      .split('\n')
+      .filter((f) => f.trim());
+
+    // Merge file lists for duplicate entries (merge commits with -m)
+    const existing = commitMap.get(hash);
+    if (existing) {
+      // Add new files to the existing entry's file set
+      const fileSet = new Set(existing.files);
+      for (const f of blockFiles) fileSet.add(f);
+      existing.files = [...fileSet];
+    } else {
+      commitMap.set(hash, {
+        hash,
+        shortHash,
+        author,
+        authorEmail,
+        date,
+        subject,
+        body,
+        files: [...new Set(blockFiles)],
+      });
+    }
+  }
+
+  // Trim to the requested limit (we over-fetched to account for -m duplicates)
+  const commits = [...commitMap.values()].slice(0, commitLimit);
+
+  // Get current branch name
+  const branchOutput = await execGitCommand(['rev-parse', '--abbrev-ref', 'HEAD'], worktreePath);
+  const branch = branchOutput.trim();
+
+  return {
+    branch,
+    commits,
+    total: commits.length,
+  };
+}

apps/server/src/services/dev-server-service.ts

@@ -246,7 +246,7 @@ class DevServerService {
           // No process found on port, which is fine
         }
       }
-    } catch (error) {
+    } catch {
       // Ignore errors - port might not have any process
       logger.debug(`No process to kill on port ${port}`);
     }

apps/server/src/services/event-history-service.ts

@@ -13,12 +13,7 @@
 
 import { createLogger } from '@automaker/utils';
 import * as secureFs from '../lib/secure-fs.js';
-import {
-  getEventHistoryDir,
-  getEventHistoryIndexPath,
-  getEventPath,
-  ensureEventHistoryDir,
-} from '@automaker/platform';
+import { getEventHistoryIndexPath, getEventPath, ensureEventHistoryDir } from '@automaker/platform';
 import type {
   StoredEvent,
   StoredEventIndex,

apps/server/src/services/execution-service.ts

@@ -20,7 +20,6 @@ import type { TypedEventBus } from './typed-event-bus.js';
 import type { ConcurrencyManager, RunningFeature } from './concurrency-manager.js';
 import type { WorktreeResolver } from './worktree-resolver.js';
 import type { SettingsService } from './settings-service.js';
-import type { PipelineContext } from './pipeline-orchestrator.js';
 import { pipelineService } from './pipeline-service.js';
 
 // Re-export callback types from execution-types.ts for backward compatibility

apps/server/src/services/feature-export-service.ts

@@ -205,7 +205,6 @@ export class FeatureExportService {
     importData: FeatureImport
   ): Promise<FeatureImportResult> {
     const warnings: string[] = [];
-    const errors: string[] = [];
 
     try {
       // Extract feature from data (handle both raw Feature and wrapped FeatureExport)

apps/server/src/services/feature-loader.ts

@@ -195,9 +195,10 @@ export class FeatureLoader {
       }
 
       // Read all feature directories
+      // secureFs.readdir returns Dirent[] but typed as generic; cast to access isDirectory()
       const entries = (await secureFs.readdir(featuresDir, {
         withFileTypes: true,
-      })) as any[];
+      })) as import('fs').Dirent[];
       const featureDirs = entries.filter((entry) => entry.isDirectory());
 
       // Load all features concurrently with automatic recovery from backups

apps/server/src/services/gemini-usage-service.ts

@@ -0,0 +1,817 @@
+/**
+ * Gemini Usage Service
+ *
+ * Service for tracking Gemini CLI usage and quota.
+ * Uses the internal Google Cloud quota API (same as CodexBar).
+ * See: https://github.com/steipete/CodexBar/blob/main/docs/gemini.md
+ *
+ * OAuth credentials are extracted from the Gemini CLI installation,
+ * not hardcoded, to ensure compatibility with CLI updates.
+ */
+
+import { createLogger } from '@automaker/utils';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { execFileSync } from 'child_process';
+
+const logger = createLogger('GeminiUsage');
+
+// Quota API endpoint (internal Google Cloud API)
+const QUOTA_API_URL = 'https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuota';
+
+// Code Assist endpoint for getting project ID and tier info
+const CODE_ASSIST_URL = 'https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist';
+
+// Google OAuth endpoints for token refresh
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+
+/** Default timeout for fetch requests in milliseconds */
+const FETCH_TIMEOUT_MS = 10_000;
+
+/** TTL for cached credentials in milliseconds (5 minutes) */
+const CREDENTIALS_CACHE_TTL_MS = 5 * 60 * 1000;
+
+export interface GeminiQuotaBucket {
+  /** Model ID this quota applies to */
+  modelId: string;
+  /** Remaining fraction (0-1) */
+  remainingFraction: number;
+  /** ISO-8601 reset time */
+  resetTime: string;
+}
+
+/** Simplified quota info for a model tier (Flash or Pro) */
+export interface GeminiTierQuota {
+  /** Used percentage (0-100) */
+  usedPercent: number;
+  /** Remaining percentage (0-100) */
+  remainingPercent: number;
+  /** Reset time as human-readable string */
+  resetText?: string;
+  /** ISO-8601 reset time */
+  resetTime?: string;
+}
+
+export interface GeminiUsageData {
+  /** Whether authenticated via CLI */
+  authenticated: boolean;
+  /** Authentication method */
+  authMethod: 'cli_login' | 'api_key' | 'none';
+  /** Usage percentage (100 - remainingFraction * 100) - overall most constrained */
+  usedPercent: number;
+  /** Remaining percentage - overall most constrained */
+  remainingPercent: number;
+  /** Reset time as human-readable string */
+  resetText?: string;
+  /** ISO-8601 reset time */
+  resetTime?: string;
+  /** Model ID with lowest remaining quota */
+  constrainedModel?: string;
+  /** Flash tier quota (aggregated from all flash models) */
+  flashQuota?: GeminiTierQuota;
+  /** Pro tier quota (aggregated from all pro models) */
+  proQuota?: GeminiTierQuota;
+  /** Raw quota buckets for detailed view */
+  quotaBuckets?: GeminiQuotaBucket[];
+  /** When this data was last fetched */
+  lastUpdated: string;
+  /** Optional error message */
+  error?: string;
+}
+
+interface OAuthCredentials {
+  access_token?: string;
+  id_token?: string;
+  refresh_token?: string;
+  token_type?: string;
+  expiry_date?: number;
+  client_id?: string;
+  client_secret?: string;
+}
+
+interface OAuthClientCredentials {
+  clientId: string;
+  clientSecret: string;
+}
+
+interface QuotaResponse {
+  // The actual API returns 'buckets', not 'quotaBuckets'
+  buckets?: Array<{
+    modelId?: string;
+    remainingFraction?: number;
+    resetTime?: string;
+    tokenType?: string;
+  }>;
+  // Legacy field name (in case API changes)
+  quotaBuckets?: Array<{
+    modelId?: string;
+    remainingFraction?: number;
+    resetTime?: string;
+    tokenType?: string;
+  }>;
+}
+
+/**
+ * Gemini Usage Service
+ *
+ * Provides real usage/quota data for Gemini CLI users.
+ * Extracts OAuth credentials from the Gemini CLI installation.
+ */
+export class GeminiUsageService {
+  private cachedCredentials: OAuthCredentials | null = null;
+  private cachedCredentialsAt: number | null = null;
+  private cachedClientCredentials: OAuthClientCredentials | null = null;
+  private credentialsPath: string;
+  /** The actual path from which credentials were loaded (for write-back) */
+  private loadedCredentialsPath: string | null = null;
+
+  constructor() {
+    // Default credentials path for Gemini CLI
+    this.credentialsPath = path.join(os.homedir(), '.gemini', 'oauth_creds.json');
+  }
+
+  /**
+   * Check if Gemini CLI is authenticated
+   */
+  async isAvailable(): Promise<boolean> {
+    const creds = await this.loadCredentials();
+    return Boolean(creds?.access_token || creds?.refresh_token);
+  }
+
+  /**
+   * Fetch quota/usage data from Google Cloud API
+   */
+  async fetchUsageData(): Promise<GeminiUsageData> {
+    logger.info('[fetchUsageData] Starting...');
+
+    const creds = await this.loadCredentials();
+
+    if (!creds || (!creds.access_token && !creds.refresh_token)) {
+      logger.info('[fetchUsageData] No credentials found');
+      return {
+        authenticated: false,
+        authMethod: 'none',
+        usedPercent: 0,
+        remainingPercent: 100,
+        lastUpdated: new Date().toISOString(),
+        error: 'Not authenticated. Run "gemini auth login" to authenticate.',
+      };
+    }
+
+    try {
+      // Get a valid access token (refresh if needed)
+      const accessToken = await this.getValidAccessToken(creds);
+
+      if (!accessToken) {
+        return {
+          authenticated: false,
+          authMethod: 'none',
+          usedPercent: 0,
+          remainingPercent: 100,
+          lastUpdated: new Date().toISOString(),
+          error: 'Failed to obtain access token. Try running "gemini auth login" again.',
+        };
+      }
+
+      // First, get the project ID from loadCodeAssist endpoint
+      // This is required to get accurate quota data
+      let projectId: string | undefined;
+      try {
+        const codeAssistResponse = await fetch(CODE_ASSIST_URL, {
+          method: 'POST',
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({}),
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+
+        if (codeAssistResponse.ok) {
+          const codeAssistData = (await codeAssistResponse.json()) as {
+            cloudaicompanionProject?: string;
+            currentTier?: { id?: string; name?: string };
+          };
+          projectId = codeAssistData.cloudaicompanionProject;
+          logger.debug('[fetchUsageData] Got project ID:', projectId);
+        }
+      } catch (e) {
+        logger.debug('[fetchUsageData] Failed to get project ID:', e);
+      }
+
+      // Fetch quota from Google Cloud API
+      // Pass project ID to get accurate quota (without it, returns default 100%)
+      const response = await fetch(QUOTA_API_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(projectId ? { project: projectId } : {}),
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      });
+
+      if (!response.ok) {
+        const errorText = await response.text().catch(() => '');
+        logger.error('[fetchUsageData] Quota API error:', response.status, errorText);
+
+        // Still authenticated, but quota API failed
+        return {
+          authenticated: true,
+          authMethod: 'cli_login',
+          usedPercent: 0,
+          remainingPercent: 100,
+          lastUpdated: new Date().toISOString(),
+          error: `Quota API unavailable (${response.status})`,
+        };
+      }
+
+      const data = (await response.json()) as QuotaResponse;
+
+      // API returns 'buckets', with fallback to 'quotaBuckets' for compatibility
+      const apiBuckets = data.buckets || data.quotaBuckets;
+
+      logger.debug('[fetchUsageData] Raw buckets:', JSON.stringify(apiBuckets));
+
+      if (!apiBuckets || apiBuckets.length === 0) {
+        return {
+          authenticated: true,
+          authMethod: 'cli_login',
+          usedPercent: 0,
+          remainingPercent: 100,
+          lastUpdated: new Date().toISOString(),
+        };
+      }
+
+      // Group buckets into Flash and Pro tiers
+      // Flash: any model with "flash" in the name
+      // Pro: any model with "pro" in the name
+      let flashLowestRemaining = 1.0;
+      let flashResetTime: string | undefined;
+      let hasFlashModels = false;
+      let proLowestRemaining = 1.0;
+      let proResetTime: string | undefined;
+      let hasProModels = false;
+      let overallLowestRemaining = 1.0;
+      let constrainedModel: string | undefined;
+      let overallResetTime: string | undefined;
+
+      const quotaBuckets: GeminiQuotaBucket[] = apiBuckets.map((bucket) => {
+        const remaining = bucket.remainingFraction ?? 1.0;
+        const modelId = bucket.modelId?.toLowerCase() || '';
+
+        // Track overall lowest
+        if (remaining < overallLowestRemaining) {
+          overallLowestRemaining = remaining;
+          constrainedModel = bucket.modelId;
+          overallResetTime = bucket.resetTime;
+        }
+
+        // Group into Flash or Pro tier
+        if (modelId.includes('flash')) {
+          hasFlashModels = true;
+          if (remaining < flashLowestRemaining) {
+            flashLowestRemaining = remaining;
+            flashResetTime = bucket.resetTime;
+          }
+          // Also track reset time even if at 100%
+          if (!flashResetTime && bucket.resetTime) {
+            flashResetTime = bucket.resetTime;
+          }
+        } else if (modelId.includes('pro')) {
+          hasProModels = true;
+          if (remaining < proLowestRemaining) {
+            proLowestRemaining = remaining;
+            proResetTime = bucket.resetTime;
+          }
+          // Also track reset time even if at 100%
+          if (!proResetTime && bucket.resetTime) {
+            proResetTime = bucket.resetTime;
+          }
+        }
+
+        return {
+          modelId: bucket.modelId || 'unknown',
+          remainingFraction: remaining,
+          resetTime: bucket.resetTime || '',
+        };
+      });
+
+      const usedPercent = Math.round((1 - overallLowestRemaining) * 100);
+      const remainingPercent = Math.round(overallLowestRemaining * 100);
+
+      // Build tier quotas (only include if we found models for that tier)
+      const flashQuota: GeminiTierQuota | undefined = hasFlashModels
+        ? {
+            usedPercent: Math.round((1 - flashLowestRemaining) * 100),
+            remainingPercent: Math.round(flashLowestRemaining * 100),
+            resetText: flashResetTime ? this.formatResetTime(flashResetTime) : undefined,
+            resetTime: flashResetTime,
+          }
+        : undefined;
+
+      const proQuota: GeminiTierQuota | undefined = hasProModels
+        ? {
+            usedPercent: Math.round((1 - proLowestRemaining) * 100),
+            remainingPercent: Math.round(proLowestRemaining * 100),
+            resetText: proResetTime ? this.formatResetTime(proResetTime) : undefined,
+            resetTime: proResetTime,
+          }
+        : undefined;
+
+      return {
+        authenticated: true,
+        authMethod: 'cli_login',
+        usedPercent,
+        remainingPercent,
+        resetText: overallResetTime ? this.formatResetTime(overallResetTime) : undefined,
+        resetTime: overallResetTime,
+        constrainedModel,
+        flashQuota,
+        proQuota,
+        quotaBuckets,
+        lastUpdated: new Date().toISOString(),
+      };
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : 'Unknown error';
+      logger.error('[fetchUsageData] Error:', errorMsg);
+
+      return {
+        authenticated: true,
+        authMethod: 'cli_login',
+        usedPercent: 0,
+        remainingPercent: 100,
+        lastUpdated: new Date().toISOString(),
+        error: `Failed to fetch quota: ${errorMsg}`,
+      };
+    }
+  }
+
+  /**
+   * Load OAuth credentials from file.
+   * Implements TTL-based cache invalidation and file mtime checks.
+   */
+  private async loadCredentials(): Promise<OAuthCredentials | null> {
+    // Check if cached credentials are still valid
+    if (this.cachedCredentials && this.cachedCredentialsAt) {
+      const now = Date.now();
+      const cacheAge = now - this.cachedCredentialsAt;
+
+      if (cacheAge < CREDENTIALS_CACHE_TTL_MS) {
+        // Cache is within TTL - also check file mtime
+        const sourcePath = this.loadedCredentialsPath || this.credentialsPath;
+        try {
+          const stat = fs.statSync(sourcePath);
+          if (stat.mtimeMs <= this.cachedCredentialsAt) {
+            // File hasn't been modified since we cached - use cache
+            return this.cachedCredentials;
+          }
+          // File has been modified, fall through to re-read
+          logger.debug('[loadCredentials] File modified since cache, re-reading');
+        } catch {
+          // File doesn't exist or can't stat - use cache
+          return this.cachedCredentials;
+        }
+      } else {
+        // Cache TTL expired, discard
+        logger.debug('[loadCredentials] Cache TTL expired, re-reading');
+      }
+
+      // Invalidate cached credentials
+      this.cachedCredentials = null;
+      this.cachedCredentialsAt = null;
+    }
+
+    // Build unique possible paths (deduplicate)
+    const rawPaths = [
+      this.credentialsPath,
+      path.join(os.homedir(), '.config', 'gemini', 'oauth_creds.json'),
+    ];
+    const possiblePaths = [...new Set(rawPaths)];
+
+    for (const credPath of possiblePaths) {
+      try {
+        if (fs.existsSync(credPath)) {
+          const content = fs.readFileSync(credPath, 'utf8');
+          const creds = JSON.parse(content);
+
+          // Handle different credential formats
+          if (creds.access_token || creds.refresh_token) {
+            this.cachedCredentials = creds;
+            this.cachedCredentialsAt = Date.now();
+            this.loadedCredentialsPath = credPath;
+            logger.info('[loadCredentials] Loaded from:', credPath);
+            return creds;
+          }
+
+          // Some formats nest credentials under 'web' or 'installed'
+          if (creds.web?.client_id || creds.installed?.client_id) {
+            const clientCreds = creds.web || creds.installed;
+            this.cachedCredentials = {
+              client_id: clientCreds.client_id,
+              client_secret: clientCreds.client_secret,
+            };
+            this.cachedCredentialsAt = Date.now();
+            this.loadedCredentialsPath = credPath;
+            return this.cachedCredentials;
+          }
+        }
+      } catch (error) {
+        logger.debug('[loadCredentials] Failed to load from', credPath, error);
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Find the Gemini CLI binary path
+   */
+  private findGeminiBinaryPath(): string | null {
+    // Try 'which' on Unix-like systems, 'where' on Windows
+    const whichCmd = process.platform === 'win32' ? 'where' : 'which';
+    try {
+      const whichResult = execFileSync(whichCmd, ['gemini'], {
+        encoding: 'utf8',
+        timeout: 5000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      }).trim();
+      // 'where' on Windows may return multiple lines; take the first
+      const firstLine = whichResult.split('\n')[0]?.trim();
+      if (firstLine && fs.existsSync(firstLine)) {
+        return firstLine;
+      }
+    } catch {
+      // Ignore errors from 'which'/'where'
+    }
+
+    // Check common installation paths
+    const possiblePaths = [
+      // npm global installs
+      path.join(os.homedir(), '.npm-global', 'bin', 'gemini'),
+      '/usr/local/bin/gemini',
+      '/usr/bin/gemini',
+      // Homebrew
+      '/opt/homebrew/bin/gemini',
+      '/usr/local/opt/gemini/bin/gemini',
+      // nvm/fnm node installs
+      path.join(os.homedir(), '.nvm', 'versions', 'node'),
+      path.join(os.homedir(), '.fnm', 'node-versions'),
+      // Windows
+      path.join(os.homedir(), 'AppData', 'Roaming', 'npm', 'gemini.cmd'),
+      path.join(os.homedir(), 'AppData', 'Roaming', 'npm', 'gemini'),
+    ];
+
+    for (const p of possiblePaths) {
+      if (fs.existsSync(p)) {
+        return p;
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Extract OAuth client credentials from Gemini CLI installation
+   * This mimics CodexBar's approach of finding oauth2.js in the CLI
+   */
+  private extractOAuthClientCredentials(): OAuthClientCredentials | null {
+    if (this.cachedClientCredentials) {
+      return this.cachedClientCredentials;
+    }
+
+    const geminiBinary = this.findGeminiBinaryPath();
+    if (!geminiBinary) {
+      logger.debug('[extractOAuthClientCredentials] Gemini binary not found');
+      return null;
+    }
+
+    // Resolve symlinks to find actual location
+    let resolvedPath = geminiBinary;
+    try {
+      resolvedPath = fs.realpathSync(geminiBinary);
+    } catch {
+      // Use original path if realpath fails
+    }
+
+    const baseDir = path.dirname(resolvedPath);
+    logger.debug('[extractOAuthClientCredentials] Base dir:', baseDir);
+
+    // Possible locations for oauth2.js relative to the binary
+    // Based on CodexBar's search patterns
+    const possibleOAuth2Paths = [
+      // npm global install structure
+      path.join(
+        baseDir,
+        '..',
+        'lib',
+        'node_modules',
+        '@google',
+        'gemini-cli',
+        'dist',
+        'src',
+        'code_assist',
+        'oauth2.js'
+      ),
+      path.join(
+        baseDir,
+        '..',
+        'lib',
+        'node_modules',
+        '@google',
+        'gemini-cli-core',
+        'dist',
+        'src',
+        'code_assist',
+        'oauth2.js'
+      ),
+      // Homebrew/libexec structure
+      path.join(
+        baseDir,
+        '..',
+        'libexec',
+        'lib',
+        'node_modules',
+        '@google',
+        'gemini-cli',
+        'dist',
+        'src',
+        'code_assist',
+        'oauth2.js'
+      ),
+      path.join(
+        baseDir,
+        '..',
+        'libexec',
+        'lib',
+        'node_modules',
+        '@google',
+        'gemini-cli-core',
+        'dist',
+        'src',
+        'code_assist',
+        'oauth2.js'
+      ),
+      // Direct sibling
+      path.join(baseDir, '..', 'gemini-cli-core', 'dist', 'src', 'code_assist', 'oauth2.js'),
+      path.join(baseDir, '..', 'gemini-cli', 'dist', 'src', 'code_assist', 'oauth2.js'),
+      // Alternative node_modules structures
+      path.join(
+        baseDir,
+        '..',
+        '..',
+        'lib',
+        'node_modules',
+        '@google',
+        'gemini-cli',
+        'dist',
+        'src',
+        'code_assist',
+        'oauth2.js'
+      ),
+      path.join(
+        baseDir,
+        '..',
+        '..',
+        'lib',
+        'node_modules',
+        '@google',
+        'gemini-cli-core',
+        'dist',
+        'src',
+        'code_assist',
+        'oauth2.js'
+      ),
+    ];
+
+    for (const oauth2Path of possibleOAuth2Paths) {
+      try {
+        const normalizedPath = path.normalize(oauth2Path);
+        if (fs.existsSync(normalizedPath)) {
+          logger.debug('[extractOAuthClientCredentials] Found oauth2.js at:', normalizedPath);
+          const content = fs.readFileSync(normalizedPath, 'utf8');
+          const creds = this.parseOAuthCredentialsFromSource(content);
+          if (creds) {
+            this.cachedClientCredentials = creds;
+            logger.info('[extractOAuthClientCredentials] Extracted credentials from CLI');
+            return creds;
+          }
+        }
+      } catch (error) {
+        logger.debug('[extractOAuthClientCredentials] Failed to read', oauth2Path, error);
+      }
+    }
+
+    // Try finding oauth2.js by searching in node_modules (POSIX only)
+    if (process.platform !== 'win32') {
+      try {
+        const searchBase = path.resolve(baseDir, '..');
+        const searchResult = execFileSync(
+          'find',
+          [searchBase, '-name', 'oauth2.js', '-path', '*gemini*', '-path', '*code_assist*'],
+          { encoding: 'utf8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] }
+        )
+          .trim()
+          .split('\n')[0]; // Take first result
+
+        if (searchResult && fs.existsSync(searchResult)) {
+          logger.debug('[extractOAuthClientCredentials] Found via search:', searchResult);
+          const content = fs.readFileSync(searchResult, 'utf8');
+          const creds = this.parseOAuthCredentialsFromSource(content);
+          if (creds) {
+            this.cachedClientCredentials = creds;
+            logger.info(
+              '[extractOAuthClientCredentials] Extracted credentials from CLI (via search)'
+            );
+            return creds;
+          }
+        }
+      } catch {
+        // Ignore search errors
+      }
+    }
+
+    logger.warn('[extractOAuthClientCredentials] Could not extract credentials from CLI');
+    return null;
+  }
+
+  /**
+   * Parse OAuth client credentials from oauth2.js source code
+   */
+  private parseOAuthCredentialsFromSource(content: string): OAuthClientCredentials | null {
+    // Patterns based on CodexBar's regex extraction
+    // Look for: OAUTH_CLIENT_ID = "..." or const clientId = "..."
+    const clientIdPatterns = [
+      /OAUTH_CLIENT_ID\s*=\s*["']([^"']+)["']/,
+      /clientId\s*[:=]\s*["']([^"']+)["']/,
+      /client_id\s*[:=]\s*["']([^"']+)["']/,
+      /"clientId"\s*:\s*["']([^"']+)["']/,
+    ];
+
+    const clientSecretPatterns = [
+      /OAUTH_CLIENT_SECRET\s*=\s*["']([^"']+)["']/,
+      /clientSecret\s*[:=]\s*["']([^"']+)["']/,
+      /client_secret\s*[:=]\s*["']([^"']+)["']/,
+      /"clientSecret"\s*:\s*["']([^"']+)["']/,
+    ];
+
+    let clientId: string | null = null;
+    let clientSecret: string | null = null;
+
+    for (const pattern of clientIdPatterns) {
+      const match = content.match(pattern);
+      if (match && match[1]) {
+        clientId = match[1];
+        break;
+      }
+    }
+
+    for (const pattern of clientSecretPatterns) {
+      const match = content.match(pattern);
+      if (match && match[1]) {
+        clientSecret = match[1];
+        break;
+      }
+    }
+
+    if (clientId && clientSecret) {
+      logger.debug('[parseOAuthCredentialsFromSource] Found client credentials');
+      return { clientId, clientSecret };
+    }
+
+    return null;
+  }
+
+  /**
+   * Get a valid access token, refreshing if necessary
+   */
+  private async getValidAccessToken(creds: OAuthCredentials): Promise<string | null> {
+    // Check if current token is still valid (with 5 min buffer)
+    if (creds.access_token && creds.expiry_date) {
+      const now = Date.now();
+      if (creds.expiry_date > now + 5 * 60 * 1000) {
+        logger.debug('[getValidAccessToken] Using existing token (not expired)');
+        return creds.access_token;
+      }
+    }
+
+    // If we have a refresh token, try to refresh
+    if (creds.refresh_token) {
+      // Try to extract credentials from CLI first
+      const extractedCreds = this.extractOAuthClientCredentials();
+
+      // Use extracted credentials, then fall back to credentials in file
+      const clientId = extractedCreds?.clientId || creds.client_id;
+      const clientSecret = extractedCreds?.clientSecret || creds.client_secret;
+
+      if (!clientId || !clientSecret) {
+        logger.error('[getValidAccessToken] No client credentials available for token refresh');
+        // Return existing token even if expired - it might still work
+        return creds.access_token || null;
+      }
+
+      try {
+        logger.debug('[getValidAccessToken] Refreshing token...');
+        const response = await fetch(GOOGLE_TOKEN_URL, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+          body: new URLSearchParams({
+            client_id: clientId,
+            client_secret: clientSecret,
+            refresh_token: creds.refresh_token,
+            grant_type: 'refresh_token',
+          }),
+          signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+
+        if (response.ok) {
+          const data = (await response.json()) as { access_token?: string; expires_in?: number };
+          const newAccessToken = data.access_token;
+          const expiresIn = data.expires_in || 3600;
+
+          if (newAccessToken) {
+            logger.info('[getValidAccessToken] Token refreshed successfully');
+
+            // Update cached credentials
+            this.cachedCredentials = {
+              ...creds,
+              access_token: newAccessToken,
+              expiry_date: Date.now() + expiresIn * 1000,
+            };
+            this.cachedCredentialsAt = Date.now();
+
+            // Save back to the file the credentials were loaded from
+            const writePath = this.loadedCredentialsPath || this.credentialsPath;
+            try {
+              fs.writeFileSync(writePath, JSON.stringify(this.cachedCredentials, null, 2));
+            } catch (e) {
+              logger.debug('[getValidAccessToken] Could not save refreshed token:', e);
+            }
+
+            return newAccessToken;
+          }
+        } else {
+          const errorText = await response.text().catch(() => '');
+          logger.error('[getValidAccessToken] Token refresh failed:', response.status, errorText);
+        }
+      } catch (error) {
+        logger.error('[getValidAccessToken] Token refresh error:', error);
+      }
+    }
+
+    // Return current access token even if it might be expired
+    return creds.access_token || null;
+  }
+
+  /**
+   * Format reset time as human-readable string
+   */
+  private formatResetTime(isoTime: string): string {
+    try {
+      const resetDate = new Date(isoTime);
+      const now = new Date();
+      const diff = resetDate.getTime() - now.getTime();
+
+      if (diff < 0) {
+        return 'Resetting soon';
+      }
+
+      const minutes = Math.floor(diff / 60000);
+      const hours = Math.floor(minutes / 60);
+
+      if (hours > 0) {
+        const remainingMins = minutes % 60;
+        return remainingMins > 0 ? `Resets in ${hours}h ${remainingMins}m` : `Resets in ${hours}h`;
+      }
+
+      return `Resets in ${minutes}m`;
+    } catch {
+      return '';
+    }
+  }
+
+  /**
+   * Clear cached credentials (useful after logout)
+   */
+  clearCache(): void {
+    this.cachedCredentials = null;
+    this.cachedCredentialsAt = null;
+    this.cachedClientCredentials = null;
+  }
+}
+
+// Singleton instance
+let usageServiceInstance: GeminiUsageService | null = null;
+
+/**
+ * Get the singleton instance of GeminiUsageService
+ */
+export function getGeminiUsageService(): GeminiUsageService {
+  if (!usageServiceInstance) {
+    usageServiceInstance = new GeminiUsageService();
+  }
+  return usageServiceInstance;
+}

apps/server/src/services/ideation-service.ts

@@ -27,7 +27,6 @@ import type {
 } from '@automaker/types';
 import { DEFAULT_IDEATION_CONTEXT_SOURCES } from '@automaker/types';
 import {
-  getIdeationDir,
   getIdeasDir,
   getIdeaDir,
   getIdeaPath,
@@ -407,7 +406,9 @@ export class IdeationService {
         return [];
       }
 
-      const entries = (await secureFs.readdir(ideasDir, { withFileTypes: true })) as any[];
+      const entries = (await secureFs.readdir(ideasDir, {
+        withFileTypes: true,
+      })) as import('fs').Dirent[];
       const ideaDirs = entries.filter((entry) => entry.isDirectory());
 
       const ideas: Idea[] = [];
@@ -855,15 +856,26 @@ ${contextSection}${existingWorkSection}`;
       }
 
       return parsed
-        .map((item: any, index: number) => ({
-          id: this.generateId('sug'),
-          category,
-          title: item.title || `Suggestion ${index + 1}`,
-          description: item.description || '',
-          rationale: item.rationale || '',
-          priority: item.priority || 'medium',
-          relatedFiles: item.relatedFiles || [],
-        }))
+        .map(
+          (
+            item: {
+              title?: string;
+              description?: string;
+              rationale?: string;
+              priority?: 'low' | 'medium' | 'high';
+              relatedFiles?: string[];
+            },
+            index: number
+          ) => ({
+            id: this.generateId('sug'),
+            category,
+            title: item.title || `Suggestion ${index + 1}`,
+            description: item.description || '',
+            rationale: item.rationale || '',
+            priority: item.priority || ('medium' as const),
+            relatedFiles: item.relatedFiles || [],
+          })
+        )
         .slice(0, count);
     } catch (error) {
       logger.warn('Failed to parse JSON response:', error);
@@ -1705,7 +1717,9 @@ ${contextSection}${existingWorkSection}`;
     const results: AnalysisFileInfo[] = [];
 
     try {
-      const entries = (await secureFs.readdir(dirPath, { withFileTypes: true })) as any[];
+      const entries = (await secureFs.readdir(dirPath, {
+        withFileTypes: true,
+      })) as import('fs').Dirent[];
 
       for (const entry of entries) {
         if (entry.isDirectory()) {

apps/server/src/services/merge-service.ts

@@ -4,8 +4,9 @@
  * Extracted from worktree merge route to allow internal service calls.
  */
 
-import { createLogger } from '@automaker/utils';
-import { spawnProcess } from '@automaker/platform';
+import { createLogger, isValidBranchName } from '@automaker/utils';
+import { type EventEmitter } from '../lib/events.js';
+import { execGitCommand } from '@automaker/git-utils';
 const logger = createLogger('MergeService');
 
 export interface MergeOptions {
@@ -18,6 +19,7 @@ export interface MergeServiceResult {
   success: boolean;
   error?: string;
   hasConflicts?: boolean;
+  conflictFiles?: string[];
   mergedBranch?: string;
   targetBranch?: string;
   deleted?: {
@@ -26,31 +28,6 @@ export interface MergeServiceResult {
   };
 }
 
-/**
- * Execute git command with array arguments to prevent command injection.
- */
-async function execGitCommand(args: string[], cwd: string): Promise<string> {
-  const result = await spawnProcess({
-    command: 'git',
-    args,
-    cwd,
-  });
-
-  if (result.exitCode === 0) {
-    return result.stdout;
-  } else {
-    const errorMessage = result.stderr || `Git command failed with code ${result.exitCode}`;
-    throw new Error(errorMessage);
-  }
-}
-
-/**
- * Validate branch name to prevent command injection.
- */
-function isValidBranchName(name: string): boolean {
-  return /^[a-zA-Z0-9._\-/]+$/.test(name) && name.length < 250;
-}
-
 /**
  * Perform a git merge operation directly without HTTP.
  *
@@ -65,7 +42,8 @@ export async function performMerge(
   branchName: string,
   worktreePath: string,
   targetBranch: string = 'main',
-  options?: MergeOptions
+  options?: MergeOptions,
+  emitter?: EventEmitter
 ): Promise<MergeServiceResult> {
   if (!projectPath || !branchName || !worktreePath) {
     return {
@@ -110,6 +88,9 @@ export async function performMerge(
     };
   }
 
+  // Emit merge:start after validating inputs
+  emitter?.emit('merge:start', { branchName, targetBranch: mergeTo, worktreePath });
+
   // Merge the feature branch into the target branch (using safe array-based commands)
   const mergeMessage = options?.message || `Merge ${branchName} into ${mergeTo}`;
   const mergeArgs = options?.squash
@@ -117,21 +98,107 @@ export async function performMerge(
     : ['merge', branchName, '-m', mergeMessage];
 
   try {
-    await execGitCommand(mergeArgs, projectPath);
+    // Set LC_ALL=C so git always emits English output regardless of the system
+    // locale, making text-based conflict detection reliable.
+    await execGitCommand(mergeArgs, projectPath, { LC_ALL: 'C' });
   } catch (mergeError: unknown) {
-    // Check if this is a merge conflict
+    // Check if this is a merge conflict.  We use a multi-layer strategy so
+    // that detection is reliable even when locale settings vary or git's text
+    // output changes across versions:
+    //
+    //  1. Primary (text-based): scan the error output for well-known English
+    //     conflict markers.  Because we pass LC_ALL=C above these strings are
+    //     always in English, but we keep the check as one layer among several.
+    //
+    //  2. Unmerged-path check: run `git diff --name-only --diff-filter=U`
+    //     (locale-stable) and treat any non-empty output as a conflict
+    //     indicator, capturing the file list at the same time.
+    //
+    //  3. Fallback status check: run `git status --porcelain` and look for
+    //     lines whose first two characters indicate an unmerged state
+    //     (UU, AA, DD, AU, UA, DU, UD).
+    //
+    // hasConflicts is true when ANY of the three layers returns positive.
     const err = mergeError as { stdout?: string; stderr?: string; message?: string };
     const output = `${err.stdout || ''} ${err.stderr || ''} ${err.message || ''}`;
-    const hasConflicts = output.includes('CONFLICT') || output.includes('Automatic merge failed');
+
+    // Layer 1 – text matching (locale-safe because we set LC_ALL=C above).
+    const textIndicatesConflict =
+      output.includes('CONFLICT') || output.includes('Automatic merge failed');
+
+    // Layers 2 & 3 – repository state inspection (locale-independent).
+    // Layer 2: get conflicted files via diff (also locale-stable output).
+    let conflictFiles: string[] | undefined;
+    let diffIndicatesConflict = false;
+    try {
+      const diffOutput = await execGitCommand(
+        ['diff', '--name-only', '--diff-filter=U'],
+        projectPath,
+        { LC_ALL: 'C' }
+      );
+      const files = diffOutput
+        .trim()
+        .split('\n')
+        .filter((f) => f.trim().length > 0);
+      if (files.length > 0) {
+        diffIndicatesConflict = true;
+        conflictFiles = files;
+      }
+    } catch {
+      // If we can't get the file list, leave conflictFiles undefined so callers
+      // can distinguish "no conflicts" (empty array) from "unknown due to diff failure" (undefined)
+    }
+
+    // Layer 3: check for unmerged paths via machine-readable git status.
+    let hasUnmergedPaths = false;
+    try {
+      const statusOutput = await execGitCommand(['status', '--porcelain'], projectPath, {
+        LC_ALL: 'C',
+      });
+      // Unmerged status codes occupy the first two characters of each line.
+      // Standard unmerged codes: UU, AA, DD, AU, UA, DU, UD.
+      const unmergedLines = statusOutput
+        .split('\n')
+        .filter((line) => /^(UU|AA|DD|AU|UA|DU|UD)/.test(line));
+      hasUnmergedPaths = unmergedLines.length > 0;
+
+      // If Layer 2 did not populate conflictFiles (e.g. diff failed or returned
+      // nothing) but Layer 3 does detect unmerged paths, parse the status lines
+      // to extract filenames and assign them to conflictFiles so callers always
+      // receive an accurate file list when conflicts are present.
+      if (hasUnmergedPaths && conflictFiles === undefined) {
+        const parsedFiles = unmergedLines
+          .map((line) => line.slice(2).trim())
+          .filter((f) => f.length > 0);
+        // Deduplicate (e.g. rename entries can appear twice)
+        conflictFiles = [...new Set(parsedFiles)];
+      }
+    } catch {
+      // git status failing is itself a sign something is wrong; leave
+      // hasUnmergedPaths as false and rely on the other layers.
+    }
+
+    const hasConflicts = textIndicatesConflict || diffIndicatesConflict || hasUnmergedPaths;
 
     if (hasConflicts) {
+      // Emit merge:conflict event with conflict details
+      emitter?.emit('merge:conflict', { branchName, targetBranch: mergeTo, conflictFiles });
+
       return {
         success: false,
         error: `Merge CONFLICT: Automatic merge of "${branchName}" into "${mergeTo}" failed. Please resolve conflicts manually.`,
         hasConflicts: true,
+        conflictFiles,
       };
     }
 
+    // Emit merge:error for non-conflict errors before re-throwing
+    emitter?.emit('merge:error', {
+      branchName,
+      targetBranch: mergeTo,
+      error: err.message || String(mergeError),
+    });
+
     // Re-throw non-conflict errors
     throw mergeError;
   }
@@ -139,7 +206,18 @@ export async function performMerge(
   // If squash merge, need to commit (using safe array-based command)
   if (options?.squash) {
     const squashMessage = options?.message || `Merge ${branchName} (squash)`;
-    await execGitCommand(['commit', '-m', squashMessage], projectPath);
+    try {
+      await execGitCommand(['commit', '-m', squashMessage], projectPath);
+    } catch (commitError: unknown) {
+      const err = commitError as { message?: string };
+      // Emit merge:error so subscribers always receive either merge:success or merge:error
+      emitter?.emit('merge:error', {
+        branchName,
+        targetBranch: mergeTo,
+        error: err.message || String(commitError),
+      });
+      throw commitError;
+    }
   }
 
   // Optionally delete the worktree and branch after merging
@@ -163,19 +241,22 @@ export async function performMerge(
 
     // Delete the branch (but not main/master)
     if (branchName !== 'main' && branchName !== 'master') {
-      if (!isValidBranchName(branchName)) {
-        logger.warn(`Invalid branch name detected, skipping deletion: ${branchName}`);
-      } else {
-        try {
-          await execGitCommand(['branch', '-D', branchName], projectPath);
-          branchDeleted = true;
-        } catch {
-          logger.warn(`Failed to delete branch: ${branchName}`);
-        }
+      try {
+        await execGitCommand(['branch', '-D', branchName], projectPath);
+        branchDeleted = true;
+      } catch {
+        logger.warn(`Failed to delete branch: ${branchName}`);
       }
     }
   }
 
+  // Emit merge:success with merged branch, target branch, and deletion info
+  emitter?.emit('merge:success', {
+    mergedBranch: branchName,
+    targetBranch: mergeTo,
+    deleted: options?.deleteWorktreeAndBranch ? { worktreeDeleted, branchDeleted } : undefined,
+  });
+
   return {
     success: true,
     mergedBranch: branchName,

apps/server/src/services/pipeline-orchestrator.ts

@@ -519,7 +519,8 @@ export class PipelineOrchestrator {
         targetBranch || 'main',
         {
           deleteWorktreeAndBranch: false,
-        }
+        },
+        this.eventBus.getUnderlyingEmitter()
       );
 
       if (!result.success) {

apps/server/src/services/pull-service.ts

@@ -0,0 +1,452 @@
+/**
+ * PullService - Pull git operations without HTTP
+ *
+ * Encapsulates the full git pull workflow including:
+ * - Branch name and detached HEAD detection
+ * - Fetching from remote
+ * - Status parsing and local change detection
+ * - Stash push/pop logic
+ * - Upstream verification (rev-parse / --verify)
+ * - Pull execution and conflict detection
+ * - Conflict file list collection
+ *
+ * Extracted from the worktree pull route to improve organization
+ * and testability. Follows the same pattern as rebase-service.ts
+ * and cherry-pick-service.ts.
+ */
+
+import { createLogger, getErrorMessage } from '@automaker/utils';
+import { execGitCommand, getConflictFiles } from '@automaker/git-utils';
+import { execGitCommandWithLockRetry, getCurrentBranch } from '../lib/git.js';
+
+const logger = createLogger('PullService');
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface PullOptions {
+  /** Remote name to pull from (defaults to 'origin') */
+  remote?: string;
+  /** When true, automatically stash local changes before pulling and reapply after */
+  stashIfNeeded?: boolean;
+}
+
+export interface PullResult {
+  success: boolean;
+  error?: string;
+  branch?: string;
+  pulled?: boolean;
+  hasLocalChanges?: boolean;
+  localChangedFiles?: string[];
+  stashed?: boolean;
+  stashRestored?: boolean;
+  stashRecoveryFailed?: boolean;
+  hasConflicts?: boolean;
+  conflictSource?: 'pull' | 'stash';
+  conflictFiles?: string[];
+  message?: string;
+}
+
+// ============================================================================
+// Helper Functions
+// ============================================================================
+
+/**
+ * Fetch the latest refs from a remote.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param remote - Remote name (e.g. 'origin')
+ */
+export async function fetchRemote(worktreePath: string, remote: string): Promise<void> {
+  await execGitCommand(['fetch', remote], worktreePath);
+}
+
+/**
+ * Parse `git status --porcelain` output into a list of changed file paths.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @returns Object with hasLocalChanges flag and list of changed file paths
+ */
+export async function getLocalChanges(
+  worktreePath: string
+): Promise<{ hasLocalChanges: boolean; localChangedFiles: string[] }> {
+  const statusOutput = await execGitCommand(['status', '--porcelain'], worktreePath);
+  const hasLocalChanges = statusOutput.trim().length > 0;
+
+  let localChangedFiles: string[] = [];
+  if (hasLocalChanges) {
+    localChangedFiles = statusOutput
+      .trim()
+      .split('\n')
+      .filter((line) => line.trim().length > 0)
+      .map((line) => {
+        const entry = line.substring(3).trim();
+        const arrowIndex = entry.indexOf(' -> ');
+        return arrowIndex !== -1 ? entry.substring(arrowIndex + 4).trim() : entry;
+      });
+  }
+
+  return { hasLocalChanges, localChangedFiles };
+}
+
+/**
+ * Stash local changes with a descriptive message.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param branchName - Current branch name (used in stash message)
+ * @returns Promise<void> — resolves on success, throws on failure
+ */
+export async function stashChanges(worktreePath: string, branchName: string): Promise<void> {
+  const stashMessage = `automaker-pull-stash: Pre-pull stash on ${branchName}`;
+  await execGitCommandWithLockRetry(
+    ['stash', 'push', '--include-untracked', '-m', stashMessage],
+    worktreePath
+  );
+}
+
+/**
+ * Pop the top stash entry.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @returns The stdout from stash pop
+ */
+export async function popStash(worktreePath: string): Promise<string> {
+  return await execGitCommandWithLockRetry(['stash', 'pop'], worktreePath);
+}
+
+/**
+ * Try to pop the stash, returning whether the pop succeeded.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @returns true if stash pop succeeded, false if it failed
+ */
+async function tryPopStash(worktreePath: string): Promise<boolean> {
+  try {
+    await execGitCommandWithLockRetry(['stash', 'pop'], worktreePath);
+    return true;
+  } catch (stashPopError) {
+    // Stash pop failed - leave it in stash list for manual recovery
+    logger.error('Failed to reapply stash during error recovery', {
+      worktreePath,
+      error: getErrorMessage(stashPopError),
+    });
+    return false;
+  }
+}
+
+/**
+ * Result of the upstream/remote branch check.
+ * - 'tracking': the branch has a configured upstream tracking ref
+ * - 'remote': no tracking ref, but the remote branch exists
+ * - 'none': neither a tracking ref nor a remote branch was found
+ */
+export type UpstreamStatus = 'tracking' | 'remote' | 'none';
+
+/**
+ * Check whether the branch has an upstream tracking ref, or whether
+ * the remote branch exists.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param branchName - Current branch name
+ * @param remote - Remote name
+ * @returns UpstreamStatus indicating tracking ref, remote branch, or neither
+ */
+export async function hasUpstreamOrRemoteBranch(
+  worktreePath: string,
+  branchName: string,
+  remote: string
+): Promise<UpstreamStatus> {
+  try {
+    await execGitCommand(['rev-parse', '--abbrev-ref', `${branchName}@{upstream}`], worktreePath);
+    return 'tracking';
+  } catch {
+    // No upstream tracking - check if the remote branch exists
+    try {
+      await execGitCommand(['rev-parse', '--verify', `${remote}/${branchName}`], worktreePath);
+      return 'remote';
+    } catch {
+      return 'none';
+    }
+  }
+}
+
+/**
+ * Check whether an error output string indicates a merge conflict.
+ */
+function isConflictError(errorOutput: string): boolean {
+  return errorOutput.includes('CONFLICT') || errorOutput.includes('Automatic merge failed');
+}
+
+/**
+ * Check whether an output string indicates a stash conflict.
+ */
+function isStashConflict(output: string): boolean {
+  return output.includes('CONFLICT') || output.includes('Merge conflict');
+}
+
+// ============================================================================
+// Main Service Function
+// ============================================================================
+
+/**
+ * Perform a full git pull workflow on the given worktree.
+ *
+ * The workflow:
+ * 1. Get current branch name (detect detached HEAD)
+ * 2. Fetch from remote
+ * 3. Check for local changes
+ * 4. If local changes and stashIfNeeded, stash them
+ * 5. Verify upstream tracking or remote branch exists
+ * 6. Execute `git pull`
+ * 7. If stash was created and pull succeeded, reapply stash
+ * 8. Detect and report conflicts from pull or stash reapplication
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param options - Pull options (remote, stashIfNeeded)
+ * @returns PullResult with detailed status information
+ */
+export async function performPull(
+  worktreePath: string,
+  options?: PullOptions
+): Promise<PullResult> {
+  const targetRemote = options?.remote || 'origin';
+  const stashIfNeeded = options?.stashIfNeeded ?? false;
+
+  // 1. Get current branch name
+  let branchName: string;
+  try {
+    branchName = await getCurrentBranch(worktreePath);
+  } catch (err) {
+    return {
+      success: false,
+      error: `Failed to get current branch: ${getErrorMessage(err)}`,
+    };
+  }
+
+  // 2. Check for detached HEAD state
+  if (branchName === 'HEAD') {
+    return {
+      success: false,
+      error: 'Cannot pull in detached HEAD state. Please checkout a branch first.',
+    };
+  }
+
+  // 3. Fetch latest from remote
+  try {
+    await fetchRemote(worktreePath, targetRemote);
+  } catch (fetchError) {
+    return {
+      success: false,
+      error: `Failed to fetch from remote '${targetRemote}': ${getErrorMessage(fetchError)}`,
+    };
+  }
+
+  // 4. Check for local changes
+  let hasLocalChanges: boolean;
+  let localChangedFiles: string[];
+  try {
+    ({ hasLocalChanges, localChangedFiles } = await getLocalChanges(worktreePath));
+  } catch (err) {
+    return {
+      success: false,
+      error: `Failed to get local changes: ${getErrorMessage(err)}`,
+    };
+  }
+
+  // 5. If there are local changes and stashIfNeeded is not requested, return info
+  if (hasLocalChanges && !stashIfNeeded) {
+    return {
+      success: true,
+      branch: branchName,
+      pulled: false,
+      hasLocalChanges: true,
+      localChangedFiles,
+      message:
+        'Local changes detected. Use stashIfNeeded to automatically stash and reapply changes.',
+    };
+  }
+
+  // 6. Stash local changes if needed
+  let didStash = false;
+  if (hasLocalChanges && stashIfNeeded) {
+    try {
+      await stashChanges(worktreePath, branchName);
+      didStash = true;
+    } catch (stashError) {
+      return {
+        success: false,
+        error: `Failed to stash local changes: ${getErrorMessage(stashError)}`,
+      };
+    }
+  }
+
+  // 7. Verify upstream tracking or remote branch exists
+  const upstreamStatus = await hasUpstreamOrRemoteBranch(worktreePath, branchName, targetRemote);
+  if (upstreamStatus === 'none') {
+    let stashRecoveryFailed = false;
+    if (didStash) {
+      const stashPopped = await tryPopStash(worktreePath);
+      stashRecoveryFailed = !stashPopped;
+    }
+    return {
+      success: false,
+      error: `Branch '${branchName}' has no upstream branch on remote '${targetRemote}'. Push it first or set upstream with: git branch --set-upstream-to=${targetRemote}/${branchName}${stashRecoveryFailed ? ' Local changes remain stashed and need manual recovery (run: git stash pop).' : ''}`,
+      stashRecoveryFailed: stashRecoveryFailed ? stashRecoveryFailed : undefined,
+    };
+  }
+
+  // 8. Pull latest changes
+  // When the branch has a configured upstream tracking ref, let Git use it automatically.
+  // When only the remote branch exists (no tracking ref), explicitly specify remote and branch.
+  const pullArgs = upstreamStatus === 'tracking' ? ['pull'] : ['pull', targetRemote, branchName];
+  let pullConflict = false;
+  let pullConflictFiles: string[] = [];
+  try {
+    const pullOutput = await execGitCommand(pullArgs, worktreePath);
+
+    const alreadyUpToDate = pullOutput.includes('Already up to date');
+
+    // If no stash to reapply, return success
+    if (!didStash) {
+      return {
+        success: true,
+        branch: branchName,
+        pulled: !alreadyUpToDate,
+        hasLocalChanges: false,
+        stashed: false,
+        stashRestored: false,
+        message: alreadyUpToDate ? 'Already up to date' : 'Pulled latest changes',
+      };
+    }
+  } catch (pullError: unknown) {
+    const err = pullError as { stderr?: string; stdout?: string; message?: string };
+    const errorOutput = `${err.stderr || ''} ${err.stdout || ''} ${err.message || ''}`;
+
+    if (isConflictError(errorOutput)) {
+      pullConflict = true;
+      try {
+        pullConflictFiles = await getConflictFiles(worktreePath);
+      } catch {
+        pullConflictFiles = [];
+      }
+    } else {
+      // Non-conflict pull error
+      let stashRecoveryFailed = false;
+      if (didStash) {
+        const stashPopped = await tryPopStash(worktreePath);
+        stashRecoveryFailed = !stashPopped;
+      }
+
+      // Check for common errors
+      const errorMsg = err.stderr || err.message || 'Pull failed';
+      if (errorMsg.includes('no tracking information')) {
+        return {
+          success: false,
+          error: `Branch '${branchName}' has no upstream branch. Push it first or set upstream with: git branch --set-upstream-to=${targetRemote}/${branchName}${stashRecoveryFailed ? ' Local changes remain stashed and need manual recovery (run: git stash pop).' : ''}`,
+          stashRecoveryFailed: stashRecoveryFailed ? stashRecoveryFailed : undefined,
+        };
+      }
+
+      return {
+        success: false,
+        error: `${errorMsg}${stashRecoveryFailed ? ' Local changes remain stashed and need manual recovery (run: git stash pop).' : ''}`,
+        stashRecoveryFailed: stashRecoveryFailed ? stashRecoveryFailed : undefined,
+      };
+    }
+  }
+
+  // 9. If pull had conflicts, return conflict info (don't try stash pop)
+  if (pullConflict) {
+    return {
+      success: false,
+      branch: branchName,
+      pulled: true,
+      hasConflicts: true,
+      conflictSource: 'pull',
+      conflictFiles: pullConflictFiles,
+      stashed: didStash,
+      stashRestored: false,
+      message:
+        `Pull resulted in merge conflicts. ${didStash ? 'Your local changes are still stashed.' : ''}`.trim(),
+    };
+  }
+
+  // 10. Pull succeeded, now try to reapply stash
+  if (didStash) {
+    return await reapplyStash(worktreePath, branchName);
+  }
+
+  // Shouldn't reach here, but return a safe default
+  return {
+    success: true,
+    branch: branchName,
+    pulled: true,
+    message: 'Pulled latest changes',
+  };
+}
+
+/**
+ * Attempt to reapply stashed changes after a successful pull.
+ * Handles both clean reapplication and conflict scenarios.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param branchName - Current branch name
+ * @returns PullResult reflecting stash reapplication status
+ */
+async function reapplyStash(worktreePath: string, branchName: string): Promise<PullResult> {
+  try {
+    await popStash(worktreePath);
+
+    // Stash pop succeeded cleanly (popStash throws on non-zero exit)
+    return {
+      success: true,
+      branch: branchName,
+      pulled: true,
+      hasConflicts: false,
+      stashed: true,
+      stashRestored: true,
+      message: 'Pulled latest changes and restored your stashed changes.',
+    };
+  } catch (stashPopError: unknown) {
+    const err = stashPopError as { stderr?: string; stdout?: string; message?: string };
+    const errorOutput = `${err.stderr || ''} ${err.stdout || ''} ${err.message || ''}`;
+
+    // Check if stash pop failed due to conflicts
+    // The stash remains in the stash list when conflicts occur, so stashRestored is false
+    if (isStashConflict(errorOutput)) {
+      let stashConflictFiles: string[] = [];
+      try {
+        stashConflictFiles = await getConflictFiles(worktreePath);
+      } catch {
+        stashConflictFiles = [];
+      }
+
+      return {
+        success: true,
+        branch: branchName,
+        pulled: true,
+        hasConflicts: true,
+        conflictSource: 'stash',
+        conflictFiles: stashConflictFiles,
+        stashed: true,
+        stashRestored: false,
+        message: 'Pull succeeded but reapplying your stashed changes resulted in merge conflicts.',
+      };
+    }
+
+    // Non-conflict stash pop error - stash is still in the stash list
+    logger.warn('Failed to reapply stash after pull', { worktreePath, error: errorOutput });
+
+    return {
+      success: true,
+      branch: branchName,
+      pulled: true,
+      hasConflicts: false,
+      stashed: true,
+      stashRestored: false,
+      message:
+        'Pull succeeded but failed to reapply stashed changes. Your changes are still in the stash list.',
+    };
+  }
+}

apps/server/src/services/rebase-service.ts

@@ -0,0 +1,223 @@
+/**
+ * RebaseService - Rebase git operations without HTTP
+ *
+ * Handles git rebase operations with conflict detection and reporting.
+ * Follows the same pattern as merge-service.ts and cherry-pick-service.ts.
+ */
+
+import fs from 'fs/promises';
+import path from 'path';
+import { createLogger, getErrorMessage } from '@automaker/utils';
+import { execGitCommand, getCurrentBranch, getConflictFiles } from '@automaker/git-utils';
+
+const logger = createLogger('RebaseService');
+
+// ============================================================================
+// Types
+// ============================================================================
+
+export interface RebaseResult {
+  success: boolean;
+  error?: string;
+  hasConflicts?: boolean;
+  conflictFiles?: string[];
+  aborted?: boolean;
+  branch?: string;
+  ontoBranch?: string;
+  message?: string;
+}
+
+// ============================================================================
+// Service Functions
+// ============================================================================
+
+/**
+ * Run a git rebase operation on the given worktree.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @param ontoBranch - The branch to rebase onto (e.g., 'origin/main')
+ * @returns RebaseResult with success/failure information
+ */
+export async function runRebase(worktreePath: string, ontoBranch: string): Promise<RebaseResult> {
+  // Reject empty, whitespace-only, or dash-prefixed branch names.
+  const normalizedOntoBranch = ontoBranch?.trim() ?? '';
+  if (normalizedOntoBranch === '' || normalizedOntoBranch.startsWith('-')) {
+    return {
+      success: false,
+      error: `Invalid branch name: "${ontoBranch}" must not be empty or start with a dash.`,
+    };
+  }
+
+  // Get current branch name before rebase
+  let currentBranch: string;
+  try {
+    currentBranch = await getCurrentBranch(worktreePath);
+  } catch (branchErr) {
+    return {
+      success: false,
+      error: `Failed to resolve current branch for worktree "${worktreePath}": ${getErrorMessage(branchErr)}`,
+    };
+  }
+
+  try {
+    // Pass ontoBranch after '--' so git treats it as a ref, not an option.
+    // Set LC_ALL=C so git always emits English output regardless of the system
+    // locale, making text-based conflict detection reliable.
+    await execGitCommand(['rebase', '--', normalizedOntoBranch], worktreePath, { LC_ALL: 'C' });
+
+    return {
+      success: true,
+      branch: currentBranch,
+      ontoBranch: normalizedOntoBranch,
+      message: `Successfully rebased ${currentBranch} onto ${normalizedOntoBranch}`,
+    };
+  } catch (rebaseError: unknown) {
+    // Check if this is a rebase conflict.  We use a multi-layer strategy so
+    // that detection is reliable even when locale settings vary or git's text
+    // output changes across versions:
+    //
+    //  1. Primary (text-based): scan the error output for well-known English
+    //     conflict markers.  Because we pass LC_ALL=C above these strings are
+    //     always in English, but we keep the check as one layer among several.
+    //
+    //  2. Repository-state check: run `git rev-parse --git-dir` to find the
+    //     actual .git directory, then verify whether the in-progress rebase
+    //     state directories (.git/rebase-merge or .git/rebase-apply) exist.
+    //     These are created by git at the start of a rebase and are the most
+    //     reliable indicator that a rebase is still in progress (i.e. stopped
+    //     due to conflicts).
+    //
+    //  3. Unmerged-path check: run `git status --porcelain` (machine-readable,
+    //     locale-independent) and look for lines whose first two characters
+    //     indicate an unmerged state (UU, AA, DD, AU, UA, DU, UD).
+    //
+    // hasConflicts is true when ANY of the three layers returns positive.
+    const err = rebaseError as { stdout?: string; stderr?: string; message?: string };
+    const output = `${err.stdout || ''} ${err.stderr || ''} ${err.message || ''}`;
+
+    // Layer 1 – text matching (locale-safe because we set LC_ALL=C above).
+    const textIndicatesConflict =
+      output.includes('CONFLICT') ||
+      output.includes('could not apply') ||
+      output.includes('Resolve all conflicts') ||
+      output.includes('fix conflicts');
+
+    // Layers 2 & 3 – repository state inspection (locale-independent).
+    let rebaseStateExists = false;
+    let hasUnmergedPaths = false;
+    try {
+      // Find the canonical .git directory for this worktree.
+      const gitDir = (await execGitCommand(['rev-parse', '--git-dir'], worktreePath)).trim();
+      // git rev-parse --git-dir returns a path relative to cwd when the repo is
+      // a worktree, so we resolve it against worktreePath.
+      const resolvedGitDir = path.resolve(worktreePath, gitDir);
+
+      // Layer 2: check for rebase state directories.
+      const rebaseMergeDir = path.join(resolvedGitDir, 'rebase-merge');
+      const rebaseApplyDir = path.join(resolvedGitDir, 'rebase-apply');
+      const [rebaseMergeExists, rebaseApplyExists] = await Promise.all([
+        fs
+          .access(rebaseMergeDir)
+          .then(() => true)
+          .catch(() => false),
+        fs
+          .access(rebaseApplyDir)
+          .then(() => true)
+          .catch(() => false),
+      ]);
+      rebaseStateExists = rebaseMergeExists || rebaseApplyExists;
+    } catch {
+      // If rev-parse fails the repo may be in an unexpected state; fall back to
+      // text-based detection only.
+    }
+
+    try {
+      // Layer 3: check for unmerged paths via machine-readable git status.
+      const statusOutput = await execGitCommand(['status', '--porcelain'], worktreePath, {
+        LC_ALL: 'C',
+      });
+      // Unmerged status codes occupy the first two characters of each line.
+      // Standard unmerged codes: UU, AA, DD, AU, UA, DU, UD.
+      hasUnmergedPaths = statusOutput
+        .split('\n')
+        .some((line) => /^(UU|AA|DD|AU|UA|DU|UD)/.test(line));
+    } catch {
+      // git status failing is itself a sign something is wrong; leave
+      // hasUnmergedPaths as false and rely on the other layers.
+    }
+
+    const hasConflicts = textIndicatesConflict || rebaseStateExists || hasUnmergedPaths;
+
+    if (hasConflicts) {
+      // Attempt to fetch the list of conflicted files.  We wrap this in its
+      // own try/catch so that a failure here does NOT prevent abortRebase from
+      // running – keeping the repository in a clean state is the priority.
+      let conflictFiles: string[] | undefined;
+      let conflictFilesError: unknown;
+      try {
+        conflictFiles = await getConflictFiles(worktreePath);
+      } catch (getConflictFilesError: unknown) {
+        conflictFilesError = getConflictFilesError;
+        logger.warn('Failed to retrieve conflict files after rebase conflict', {
+          worktreePath,
+          error: getErrorMessage(getConflictFilesError),
+        });
+      }
+
+      // Abort the rebase to leave the repo in a clean state.  This must
+      // always run regardless of whether getConflictFiles succeeded.
+      const aborted = await abortRebase(worktreePath);
+
+      if (!aborted) {
+        logger.error('Failed to abort rebase after conflict; repository may be in a dirty state', {
+          worktreePath,
+        });
+      }
+
+      // Re-throw a composed error so callers retain both the original rebase
+      // failure context and any conflict-file lookup failure.
+      if (conflictFilesError !== undefined) {
+        const composedMessage = [
+          `Rebase of "${currentBranch}" onto "${normalizedOntoBranch}" failed due to conflicts.`,
+          `Original rebase error: ${getErrorMessage(rebaseError)}`,
+          `Additionally, fetching conflict files failed: ${getErrorMessage(conflictFilesError)}`,
+          aborted
+            ? 'The rebase was aborted; no changes were applied.'
+            : 'The rebase abort also failed; repository may be in a dirty state.',
+        ].join(' ');
+        throw new Error(composedMessage);
+      }
+
+      return {
+        success: false,
+        error: aborted
+          ? `Rebase of "${currentBranch}" onto "${normalizedOntoBranch}" aborted due to conflicts; no changes were applied.`
+          : `Rebase of "${currentBranch}" onto "${normalizedOntoBranch}" failed due to conflicts and the abort also failed; repository may be in a dirty state.`,
+        hasConflicts: true,
+        conflictFiles,
+        aborted,
+        branch: currentBranch,
+        ontoBranch: normalizedOntoBranch,
+      };
+    }
+
+    // Non-conflict error - propagate
+    throw rebaseError;
+  }
+}
+
+/**
+ * Abort an in-progress rebase operation.
+ *
+ * @param worktreePath - Path to the git worktree
+ * @returns true if abort succeeded, false if it failed (logged as warning)
+ */
+export async function abortRebase(worktreePath: string): Promise<boolean> {
+  try {
+    await execGitCommand(['rebase', '--abort'], worktreePath);
+    return true;
+  } catch (err) {
+    logger.warn('Failed to abort rebase after conflict', err instanceof Error ? err.message : err);
+    return false;
+  }
+}