Richard Lavoura

Status, log, and branch reads go through git2 with a vendored libgit2, inside a headless domain::git module that never imports ratatui. Diffs and writes take the other path: git diff and git show subprocesses with lazygit's flag set, so diff drivers, rename detection, and hooks behave exactly as on the command line.

Staging a single hunk becomes a text slice of the diff fed to git apply --cached, parsed by a small byte-range scanner rather than a full diff library. The tradeoff is explicit: libgit2 where it is fast and stable, the git binary where fidelity to the user's own setup matters more than saving a process spawn.

exec::git(workdir) is the only place in the crate that builds a git Command, and a test scans the source tree to keep it that way. Every call lands in a command log: a bounded ring buffer, read versus write classification, captured output for writes, and secrets redacted before anything reaches the screen.

The same seam solves credentials. ferrit owns raw mode, so a git child has no TTY to prompt on. ferrit registers itself as SSH_ASKPASS and GIT_ASKPASS: the child re-invokes the binary, which reaches the running TUI over a per-process socket, raises a masked prompt for passwords and passphrases, and hands the answer back.

An in-process headless runner drives scripted sessions against deterministic fixture repos: fixed author, commit dates a minute apart, and local git config pinning signing and pull behaviour. Async keys run until the app reports idle instead of sleeping for a guessed duration.

Snapshot testing with insta was rejected because rendered frames contain branch ages that change every day. Every script must assert something, a planned flow that loses its script fails the build, and the hidden test flags are refused in release builds unless FERRIT_TEST is set.

Remote creation delegates to gh, injected as a program path rather than read from the environment. The target is validated, arguments are built only from checked fields, and repos are private by default: public needs an explicit y, and Enter cancels.

The call runs on the network worker slot with a timeout and cancellation, through a child-process runner split out of the git command builder so both share one supervision path.