Add a read-only Git Graph tab to projects

[vivi7]

Summary

Adds a read-only Git Graph tab to projects, right after Git. It shows the commit graph of the attached repositories with ref labels, commit details and diffs.

Depends on #98. The commit-details file list reuses its buildGitChangeTree/gitTreeRows, so #98's two commits show up here until it merges. I'll rebase onto main then.

Following your review, this PR is now read-only. Nothing in it changes a repository. The settings drawer, avatars, the committed config file and every mutating action are gone. The actions can follow in a separate PR, or as a plugin once that system is ready.

What's included

• Graph: a lane layout for merges, octopus merges, multiple roots, stashes and the Uncommitted Changes row. Nodes are drawn at each table row's measured position, so they stay aligned with the rows, including when details open inline.
• Ref labels: branches, remote branches (combined with the local label when they match), tags, HEAD and stashes.
• Filters: a Branches/Tags dropdown with search, A→Z / Z→A, and Select All / Deselect All / Invert Selection, plus a Show Remote toggle.
• Commit details: click a commit to open its details inline. Ctrl/Cmd-click a second commit to compare them. The file list uses the Git tab's tree from Add list/tree view toggle to the Git tab's Changes list #98, and clicking a file opens it in the existing diff viewer in read-only mode.
• Table and navigation: find, resizable columns that can be hidden from the header's right-click menu, Load More with automatic loading on scroll, and auto refresh when the repository changes.
• Context menus: they only copy (hash, subject, ref names, file paths) or view (diff, file at a revision).

Review points addressed

Security

• Every attribute value is now escaped with escapeAttr, including data-gg-file-path. Every text value goes through escapeHtml.
• The renderer tests load the real escapeHtml/escapeAttr from utils.js. They push ", ', <, > and & through file paths, branch, remote and tag names, stash messages and commit subjects, and check the markup can't be broken out of.
• The dialogs you flagged are no longer part of this PR.

Bugs

• Loading more commits, from Load More or on scroll, keeps the scroll position.
• Shortcuts only act while the Git Graph tab is the one showing. The check now uses the active project and tab, not body.isConnected.
• Cmd/Ctrl+Arrow keys are left to the app. Plain ArrowUp/ArrowDown move the selection while details are open.
• The Cmd+R shortcut and its tooltip are gone, and no shortcut clashes with the app's own.
• The repository watcher is bound once and resolves the current tab body when it fires, so auto refresh keeps working after switching tabs.
• Double-click checkout and native alert/confirm are gone along with the actions.

Polish

• No horizontal scrollbar: columns shrink with ellipsis, and the last column's resize handle no longer overflows.
• Icons use the app's stroke conventions, and the details Tree/List toggle uses the existing .pane-seg control.

Overlap with #98: gitGraphBuildFileTree/gitGraphCompactFolders are removed in favour of #98's tree.

Changes to existing files

All additive:

• git.js: read helpers only.
• projects.js, main.js, preload.js: five read endpoints and a change event, each checking the folder is attached.
• The tab registration and a tag icon.
• escapeAttr in utils.js.
• An opt-in readOnly option for createUnifiedMergeViewer.

Size: about 5k lines, of which ~3.2k are code and ~1.9k tests.

Testing

• npm test: 523/523. The new tests cover the layout, the git read helpers against real temporary repositories, the attached-folder check on every endpoint, escaping with the real functions, the scroll and shortcut scoping, and watcher re-binding.
• End-to-end: I drove the real app (isolated data directory) against a fixture repository with 431 rows and hostile names: a file a"b<i>c&.txt, branch feat/a&b, tag v1'x, a stash message <b>"q"</b> and a subject <img src=x onerror=alert(1)>". I checked that:
  • every menu is read-only;
  • hostile names render as text;
  • scroll holds on load;
  • shortcuts don't fire from other tabs, and auto refresh works after switching back;
  • there is no horizontal overflow at 1400px and 1000px;
  • nodes stay aligned with their rows;
  • there are no console errors.

[abasiri]

Thanks so much for this, @vivi7! The graph itself looks really nice. It's clean, easy to read, and a real step up for seeing what's happening in a repo. It's clear a lot of care went into it, and the main-process side is well built too: every new IPC endpoint checks that the folder is attached, actions come from a fixed table, arguments are validated, and nothing runs through a shell.

We can't merge it quite as it stands, though. Here's what we found.

1. Security: repo content can inject HTML into the renderer. The renderer can run git actions through window.api, so this needs fixing before anything lands:

• project-git-graph-view.js:1290 puts file paths into data-gg-file-path="…" with escapeHtml, which doesn't escape quotes. A committed file name can break out of the attribute. Please use escapeAttr for every attribute value.
• Several dialog bodies insert names without escaping: git-graph-dialogs.js:661 (remote branch), :748 (tag name), :852 (stash message) and :1184 (file path). Tag and branch names can contain < and arrive with a fetch.
• The dialog tests stub escapeHtml/escapeAttr as identity functions, so they can't catch this. Please test with the real functions, and push " and < through paths, ref names and commit subjects.

2. Scope. About 13k lines, with 35 actions that change the repo, a settings system, avatar fetching and a trust model, is a lot for us to take on and maintain. Please split it the way you offered: a read-only graph first (layout, rendering, commit details, and diffs in the existing viewer), without the settings drawer, avatars or the committed config file. Mutating actions can follow in a separate PR.

3. Bugs

• When you scroll to the end and more commits load, the view jumps back to the top.
• Keyboard shortcuts stay active after you leave the tab. The keydown guard checks body.isConnected, which stays true when the project view is only hidden (project-git-graph-view.js:1483).
• Cmd+Up/Down is already the app's shortcut for switching sessions, so both actions run.
• Cmd+R is taken by the app, so the "Refresh (Ctrl/Cmd+R)" tooltip is wrong.
• Auto-refresh and progress updates stop after the first tab switch. gitGraphBindWatcher and gitGraphBindProgress bind once and keep the first body, which the next render replaces (:1612-1638).
• Fetch/push/pull errors never show: state.error is set, then cleared by the reload that runs straight after (:815, :434).
• Double-clicking a commit checks it out (detached HEAD) with no confirmation. Please also use in-app dialogs instead of native alert/confirm (git-graph-menus.js:60,76, git-graph-dialogs.js:98, git-graph-settings.js:35).

4. Visual polish. The settings tabs, the icons, and the horizontal scrollbar that's always showing need some work to match the rest of the app.

5. Overlap with #98. #98 adds a list/tree view to the Git tab with its own tree builder (buildGitChangeTree). Please reuse it for the commit-details file tree instead of adding a second one (gitGraphBuildFileTree / gitGraphCompactFolders).

Ali is also working on a plugin system, and Git Graph would fit really well there. We'll share more once it's ready.

— Claude, on behalf of Ali

[vivi7]

Thanks for the thorough review! I've reworked this PR as a read-only graph on top of #98, reusing its tree for the commit-details file list. Settings, avatars, the committed config and every mutating action are gone. The security, bug and polish points are addressed as listed in the updated description, with tests using the real escape functions. The actions are ready for a follow-up PR, or a plugin once that lands. Happy to adjust anything.