feat: add inbox panel (#18)

Reviewed-on: #18

.github/workflows/release.yml

@@ -0,0 +1,173 @@
+name: Build and Release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    name: Build ${{ matrix.platform }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: windows-x64
+            os: windows-latest
+            target: x86_64-pc-windows-msvc
+          - platform: windows-arm64
+            os: windows-11-arm
+            target: aarch64-pc-windows-msvc
+          - platform: macos-x64
+            os: macos-15-intel
+            target: x86_64-apple-darwin
+          - platform: macos-arm64
+            os: macos-latest
+            target: aarch64-apple-darwin
+          - platform: linux-x64
+            os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - platform: linux-arm64
+            os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      # Windows and macOS builds using cargo-packager
+      - name: Build with cargo-packager (Windows/macOS)
+        if: runner.os != 'Linux'
+        working-directory: desktop
+        run: |
+          cargo install cargo-packager --locked
+          cargo packager --release
+
+      - name: Upload Windows/macOS artifacts
+        if: runner.os != 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.platform }}-artifacts
+          path: |
+            dist/*.dmg
+            dist/*.msi
+            dist/*.exe
+          if-no-files-found: error
+
+      # Linux builds using custom scripts
+      - name: Install Linux build dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y flatpak flatpak-builder snapd squashfs-tools jq gettext-base
+
+      - name: Install Snapcraft
+        if: runner.os == 'Linux'
+        run: sudo snap install snapcraft --classic
+
+      - name: Make scripts executable
+        if: runner.os == 'Linux'
+        run: |
+          chmod +x script/get-crate-version
+          chmod +x script/linux
+          chmod +x script/bundle-snap
+          chmod +x script/bundle-linux
+          chmod +x script/flatpak/deps
+          chmod +x script/flatpak/bundle-flatpak
+
+      - name: Install required dependencies
+        if: runner.os == 'Linux'
+        run: ./script/linux
+
+      # Build the release tarball on every Linux architecture
+      - name: Build release tarball
+        if: runner.os == 'Linux'
+        run: ./script/bundle-linux
+
+      # Only build Flatpak and Snap for x86_64 (most common use case)
+      - name: Build Flatpak
+        if: runner.os == 'Linux' && matrix.target == 'x86_64-unknown-linux-gnu'
+        run: |
+          ./script/flatpak/deps
+          ./script/flatpak/bundle-flatpak
+
+      - name: Build Snap
+        if: runner.os == 'Linux' && matrix.target == 'x86_64-unknown-linux-gnu'
+        run: |
+          VERSION=$(script/get-crate-version signed)
+          ./script/bundle-snap $VERSION
+
+      - name: Collect Linux artifacts
+        if: runner.os == 'Linux'
+        working-directory: ${{ github.workspace }}
+        run: |
+          mkdir -p linux-artifacts
+          # Copy the tarball created by bundle-linux
+          find target/release -name "*.tar.gz" -exec cp {} linux-artifacts/ \;
+          # Find and copy flatpak files (if they exist)
+          find . -name "*.flatpak" -exec cp {} linux-artifacts/ \; || true
+          # Find and copy snap files (if they exist)
+          find . -name "*.snap" -exec cp {} linux-artifacts/ \; || true
+          ls -la linux-artifacts/
+
+      - name: Upload Linux artifacts
+        if: runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.platform }}-artifacts
+          path: linux-artifacts/**/*
+          if-no-files-found: error
+
+  release:
+    name: Create Release
+    needs: build
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Make get-crate-version executable
+        run: chmod +x script/get-crate-version
+
+      - name: Get version
+        id: version
+        run: |
+          VERSION=$(script/get-crate-version signed)
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "tag=v$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Display artifacts structure
+        run: |
+          echo "Artifacts structure:"
+          find artifacts -type f -exec ls -la {} \;
+
+      - name: Create draft release
+        id: create_release
+        uses: akkuman/gitea-release-action@v1
+        with:
+          server_url: "https://git.reya.su/"
+          repository: "reya/signed"
+          token: ${{ secrets.GITEA_TOKEN }}
+          draft: true
+          prerelease: false
+          files: |
+            artifacts/**/*
+
+      - name: Output release info
+        run: |
+          echo "Created draft release: ${{ steps.create_release.outputs.url }}"
+          echo "Release ID: ${{ steps.create_release.outputs.id }}"

.github/workflows/rust.yml

@@ -0,0 +1,32 @@
+name: Rust
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["m**"]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        rustup: [stable]
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Linux build dependencies
+        run: chmod +x ./script/linux && ./script/linux
+        if: matrix.os == 'ubuntu-latest'
+
+      - name: Build
+        run: cargo build --verbose
+
+      - name: Run tests
+        run: cargo test --verbose

.gitignore

@@ -1 +1,20 @@
-/target
+# Generated by Cargo
+# will have compiled files and executables
+debug/
+target/
+dist/
+
+# Snap and Flatpak local build output
+/snap
+/su.reya.signed.json
+/linux-artifacts
+
+# Vendored dependencies + cargo config generated by script/prepare-flathub
+.cargo/
+vendor/
+
+# MSVC Windows builds of rustc generate these, which store debugging information
+*.pdb
+
+# macOS
+.DS_Store

.rules

@@ -0,0 +1,174 @@
+# Rust coding guidelines
+
+* Prioritize code correctness and clarity. Speed and efficiency are secondary priorities unless otherwise specified.
+* Do not write organizational or comments that summarize the code. Comments should only be written in order to explain "why" the code is written in some way in the case there is a reason that is tricky / non-obvious.
+* Prefer implementing functionality in existing files unless it is a new logical component. Avoid creating many small files.
+* Avoid using functions that panic like `unwrap()`, instead use mechanisms like `?` to propagate errors.
+* Be careful with operations like indexing which may panic if the indexes are out of bounds.
+* Never silently discard errors with `let _ =` on fallible operations. Always handle errors appropriately:
+  - Propagate errors with `?` when the calling function should handle them
+  - Use `.log_err()` or similar when you need to ignore errors but want visibility
+  - Use explicit error handling with `match` or `if let Err(...)` when you need custom logic
+  - Example: avoid `let _ = client.request(...).await?;` - use `client.request(...).await?;` instead
+* When implementing async operations that may fail, ensure errors propagate to the UI layer so users get meaningful feedback.
+* Avoid creative additions unless explicitly requested
+* Use full words for variable names (no abbreviations like "q" for "queue")
+* Use variable shadowing to scope clones in async contexts for clarity, minimizing the lifetime of borrowed references.
+  Example:
+  ```rust
+  executor.spawn({
+      let task_ran = task_ran.clone();
+      async move {
+          *task_ran.borrow_mut() = true;
+      }
+  });
+  ```
+
+# Timers in tests
+
+* In GPUI tests, prefer GPUI executor timers over `smol::Timer::after(...)` when you need timeouts, delays, or to drive `run_until_parked()`:
+  - Use `cx.background_executor().timer(duration).await` (or `cx.background_executor.timer(duration).await` in `TestAppContext`) so the work is scheduled on GPUI's dispatcher.
+  - Avoid `smol::Timer::after(...)` for test timeouts when you rely on `run_until_parked()`, because it may not be tracked by GPUI's scheduler and can lead to "nothing left to run" when pumping.
+
+# GPUI
+
+GPUI is a UI framework which also provides primitives for state and concurrency management.
+
+## Context
+
+Context types allow interaction with global state, windows, entities, and system services. They are typically passed to functions as the argument named `cx`. When a function takes callbacks they come after the `cx` parameter.
+
+* `App` is the root context type, providing access to global state and read and update of entities.
+* `Context<T>` is provided when updating an `Entity<T>`. This context dereferences into `App`, so functions which take `&App` can also take `&Context<T>`.
+* `AsyncApp` and `AsyncWindowContext` are provided by `cx.spawn` and `cx.spawn_in`. These can be held across await points.
+
+## `Window`
+
+`Window` provides access to the state of an application window. It is passed to functions as an argument named `window` and comes before `cx` when present. It is used for managing focus, dispatching actions, directly drawing, getting user input state, etc.
+
+## Entities
+
+An `Entity<T>` is a handle to state of type `T`. With `thing: Entity<T>`:
+
+* `thing.entity_id()` returns `EntityId`
+* `thing.downgrade()` returns `WeakEntity<T>`
+* `thing.read(cx: &App)` returns `&T`.
+* `thing.read_with(cx, |thing: &T, cx: &App| ...)` returns the closure's return value.
+* `thing.update(cx, |thing: &mut T, cx: &mut Context<T>| ...)` allows the closure to mutate the state, and provides a `Context<T>` for interacting with the entity. It returns the closure's return value.
+* `thing.update_in(cx, |thing: &mut T, window: &mut Window, cx: &mut Context<T>| ...)` takes a `AsyncWindowContext` or `VisualTestContext`. It's the same as `update` while also providing the `Window`.
+
+Within the closures, the inner `cx` provided to the closure must be used instead of the outer `cx` to avoid issues with multiple borrows.
+
+Trying to update an entity while it's already being updated must be avoided as this will cause a panic.
+
+`WeakEntity<T>` is a weak handle. It has `read_with`, `update`, and `update_in` methods that work the same, but always return an `anyhow::Result` so that they can fail if the entity no longer exists. This can be useful to avoid memory leaks - if entities have mutually recursive handles to each other they will never be dropped.
+
+## Concurrency
+
+All use of entities and UI rendering occurs on a single foreground thread.
+
+`cx.spawn(async move |cx| ...)` runs an async closure on the foreground thread. Within the closure, `cx` is `&mut AsyncApp`.
+
+When the outer cx is a `Context<T>`, the use of `spawn` instead looks like `cx.spawn(async move |this, cx| ...)`, where `this: WeakEntity<T>` and `cx: &mut AsyncApp`.
+
+To do work on other threads, `cx.background_spawn(async move { ... })` is used. Often this background task is awaited on by a foreground task which uses the results to update state.
+
+Both `cx.spawn` and `cx.background_spawn` return a `Task<R>`, which is a future that can be awaited upon. If this task is dropped, then its work is cancelled. To prevent this one of the following must be done:
+
+* Awaiting the task in some other async context.
+* Detaching the task via `task.detach()` or `task.detach_and_log_err(cx)`, allowing it to run indefinitely.
+* Storing the task in a field, if the work should be halted when the struct is dropped.
+
+A task which doesn't do anything but provide a value can be created with `Task::ready(value)`.
+
+## Elements
+
+The `Render` trait is used to render some state into an element tree that is laid out using flexbox layout. An `Entity<T>` where `T` implements `Render` is sometimes called a "view".
+
+Example:
+
+```
+struct TextWithBorder(SharedString);
+
+impl Render for TextWithBorder {
+    fn render(&mut self, _window: &mut Window, _cx: &mut Context<Self>) -> impl IntoElement {
+        div().border_1().child(self.0.clone())
+    }
+}
+```
+
+Since `impl IntoElement for SharedString` exists, it can be used as an argument to `child`. `SharedString` is used to avoid copying strings, and is either an `&'static str` or `Arc<str>`.
+
+UI components that are constructed just to be turned into elements can instead implement the `RenderOnce` trait, which is similar to `Render`, but its `render` method takes ownership of `self` and receives `&mut App` instead of `&mut Context<Self>`. Types that implement this trait can use `#[derive(IntoElement)]` to use them directly as children.
+
+The style methods on elements are similar to those used by Tailwind CSS.
+
+If some attributes or children of an element tree are conditional, `.when(condition, |this| ...)` can be used to run the closure only when `condition` is true. Similarly, `.when_some(option, |this, value| ...)` runs the closure when the `Option` has a value.
+
+## Input events
+
+Input event handlers can be registered on an element via methods like `.on_click(|event, window, cx: &mut App| ...)`.
+
+Often event handlers will want to update the entity that's in the current `Context<T>`. The `cx.listener` method provides this - its use looks like `.on_click(cx.listener(|this: &mut T, event, window, cx: &mut Context<T>| ...)`.
+
+## Actions
+
+Actions are dispatched via user keyboard interaction or in code via `window.dispatch_action(SomeAction.boxed_clone(), cx)` or `focus_handle.dispatch_action(&SomeAction, window, cx)`.
+
+Actions with no data are defined with the `actions!(some_namespace, [SomeAction, AnotherAction])` macro call. Otherwise the `Action` derive macro is used. Doc comments on actions are displayed to the user.
+
+Action handlers can be registered on an element via the event handler `.on_action(|action, window, cx| ...)`. Like other event handlers, this is often used with `cx.listener`.
+
+## Notify
+
+When a view's state has changed in a way that may affect its rendering, it should call `cx.notify()`. This will cause the view to be rerendered. It will also cause any observe callbacks registered for the entity with `cx.observe` to be called.
+
+## Entity events
+
+While updating an entity (`cx: Context<T>`), it can emit an event using `cx.emit(event)`. Entities register which events they can emit by declaring `impl EventEmitter<EventType> for EntityType {}`.
+
+Other entities can then register a callback to handle these events by doing `cx.subscribe(other_entity, |this, other_entity, event, cx| ...)`. This will return a `Subscription` which deregisters the callback when dropped.  Typically `cx.subscribe` happens when creating a new entity and the subscriptions are stored in a `_subscriptions: Vec<Subscription>` field.
+
+# Pull request hygiene
+
+When an agent opens or updates a pull request, it must:
+
+- Use a clear, correctly capitalized, imperative PR title (for example, `Fix crash in project panel`).
+- Avoid conventional commit prefixes in PR titles (`fix:`, `feat:`, `docs:`, etc.).
+- Avoid trailing punctuation in PR titles.
+- Optionally prefix the title with a crate name when one crate is the clear scope (for example, `git_ui: Add history view`).
+- Include a `Release Notes:` section as the final section in the PR body.
+- Use one bullet under `Release Notes:`:
+  - `- Added ...`, `- Fixed ...`, or `- Improved ...` for user-facing changes, or
+  - `- N/A` for docs-only and other non-user-facing changes.
+- Format release notes exactly with a blank line after the heading, for example:
+
+```
+Release Notes:
+
+- N/A
+```
+
+# Rules Hygiene
+
+These `.rules` files are read by every agent session. Keep them high-signal.
+
+## After any agentic session
+If you discover a non-obvious pattern that would help future sessions, include a **"Suggested .rules additions"** heading in your PR description with the proposed text. Do **not** edit `.rules` inline during normal feature/fix work. Reviewers decide what gets merged.
+
+## High bar for new rules
+Editing or clarifying existing rules is always welcome. New rules must meet **all three** criteria:
+1. **Non-obvious** — someone familiar with the codebase would still get it wrong without the rule.
+2. **Repeatedly encountered** — it came up more than once (multiple hits in one session counts).
+3. **Specific enough to act on** — a concrete instruction, not a vague principle.
+
+Rules that apply to a single crate belong in that crate's own `.rules` file, not the repo root.
+
+## What NOT to put in `.rules`
+Avoid architectural descriptions of a crate (module layout, data flow, key types). These go stale fast and the agent can gather them by reading the code. Rules should be **traps to avoid**, not **maps to follow**.
+
+## No drive-by additions
+Rules emerge from validated patterns, not one-off observations. The workflow is:
+1. Agent notes a pattern during a session.
+2. Team validates the pattern in code review.
+3. A dedicated commit adds the rule with context on *why* it exists.

AGENTS.md

@@ -0,0 +1 @@
+.rules

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "desktop"]
 default-members = ["desktop"]
 
 [workspace.package]
-version = "1.0.0"
+version = "0.1.0-alpha"
 edition = "2024"
 publish = false
 
@@ -15,11 +15,10 @@ gpui_platform = { git = "https://github.com/zed-industries/zed", features = ["fo
 gpui_tokio = { git = "https://github.com/zed-industries/zed" }
 reqwest_client = { git = "https://github.com/zed-industries/zed" }
 
-# `tree-sitter-languages` enables syntax highlighting for the TextView
-# code preview (fenced code blocks are highlighted with tree-sitter).
-gpui-component = { git = "https://github.com/longbridge/gpui-component", features = ["tree-sitter-languages"] }
-gpui-base = { git = "https://github.com/longbridge/gpui-component" }
-gpui-fps = { git = "https://github.com/longbridge/gpui-component" }
+# GPUI Kit
+gpui-component = { git = "https://github.com/longbridge/gpui-component", rev = "39c2c86dbee7ad445591462f8675f74082e10828", features = ["tree-sitter-languages"], }
+gpui-base = { git = "https://github.com/longbridge/gpui-component", rev = "39c2c86dbee7ad445591462f8675f74082e10828" }
+gpui-fps = { git = "https://github.com/longbridge/gpui-component", rev = "39c2c86dbee7ad445591462f8675f74082e10828" }
 
 dock = { path = "crates/dock" }
 settings = { path = "crates/settings" }
@@ -32,7 +31,7 @@ nostr-gossip-memory = { git = "https://github.com/rust-nostr/nostr" }
 nostr-connect = { git = "https://github.com/rust-nostr/nostr" }
 nostr-sdk = { git = "https://github.com/rust-nostr/nostr" }
 
-gix = { version = "0.87.1", default-features = false, features = ["sha1", "blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "worktree-mutation"] }
+gix = { version = "0.87.1", default-features = false, features = ["sha1", "blocking-network-client", "blocking-http-transport-reqwest-rust-tls", "worktree-mutation", "status"] }
 
 smol = "2"
 futures = "0.3"
@@ -58,7 +57,7 @@ strip = true
 opt-level = "z"
 lto = true
 codegen-units = 1
-panic = "abort"
+panic = "unwind"
 
 [profile.profiling]
 inherits = "release"

crates/dock/src/lib.rs

@@ -26,6 +26,19 @@ pub fn add_center_panel(
     area.add_panel_view(panel, DockPlacement::Center, None, window, cx);
 }
 
+/// Add an already-wrapped panel handle to the bottom dock of `area`.
+///
+/// Used for sub-views that hang under the center, such as the inbox's Unread
+/// and Archived lists.
+pub fn add_bottom_panel(
+    area: &mut DockArea,
+    panel: Arc<dyn PanelView>,
+    window: &mut Window,
+    cx: &mut Context<DockArea>,
+) {
+    area.add_panel_view(panel, DockPlacement::Bottom, None, window, cx);
+}
+
 /// The fixed height of the tab bar, which doubles as the window title bar.
 pub const TAB_BAR_HEIGHT: Pixels = px(44.);
 

crates/signed_core/Cargo.toml

@@ -6,3 +6,7 @@ publish.workspace = true
 
 [dependencies]
 nostr.workspace = true
+serde.workspace = true
+
+[dev-dependencies]
+serde_json.workspace = true

crates/signed_core/src/filters.rs

@@ -2,7 +2,7 @@ use std::time::Duration;
 
 use nostr::prelude::*;
 
-use crate::RepoAddr;
+use crate::{COVER_NOTE_KIND, RepoAddr};
 
 /// Kinds that make up the activity of a repository.
 pub const ACTIVITY_KINDS: [Kind; 9] = [
@@ -17,6 +17,41 @@ pub const ACTIVITY_KINDS: [Kind; 9] = [
     Kind::GitStatusDraft,
 ];
 
+/// Kinds that notify a user when they tag them via their `p` tag.
+pub const NOTIFICATION_KINDS: [Kind; 9] = [
+    Kind::GitIssue,
+    Kind::GitPullRequest,
+    Kind::GitPatch,
+    Kind::GitPullRequestUpdate,
+    COVER_NOTE_KIND,
+    Kind::GitStatusOpen,
+    Kind::GitStatusApplied,
+    Kind::GitStatusClosed,
+    Kind::GitStatusDraft,
+];
+
+/// Git root kinds that make a comment or cover note count as git activity.
+const GIT_ROOT_KINDS: [Kind; 4] = [
+    Kind::GitIssue,
+    Kind::GitPatch,
+    Kind::GitPullRequest,
+    Kind::GitRepoAnnouncement,
+];
+
+/// Value of the first tag named `name` on `event`.
+fn tag_value<'a>(event: &'a Event, name: &str) -> Option<&'a str> {
+    event
+        .tags
+        .iter()
+        .find(|tag| tag.kind() == name)
+        .and_then(|tag| tag.content())
+}
+
+/// Kind named by the first tag `name` on `event`.
+fn tag_kind(event: &Event, name: &str) -> Option<Kind> {
+    tag_value(event, name)?.parse::<Kind>().ok()
+}
+
 /// Latest announcement event for a repository.
 pub fn announcement(addr: &RepoAddr) -> Filter {
     Filter::new()
@@ -94,6 +129,68 @@ pub fn comments_for(roots: impl IntoIterator<Item = EventId>) -> Vec<Filter> {
     ]
 }
 
+/// NIP-22 comments on our issues, patches and pull requests.
+/// They are matched via the uppercase `P` and `K` tags, not authorship.
+pub fn notification_comments(me: PublicKey) -> Filter {
+    Filter::new()
+        .kind(Kind::Comment)
+        .custom_tags(SingleLetterTag::UPPERCASE_P, [me.to_hex()])
+        .custom_tags(SingleLetterTag::UPPERCASE_K, ["1621", "1617", "1618"])
+}
+
+/// Activity directed at us: comments on our roots, and git events tagging us
+/// via their lowercase `p` tag. `Filter::pubkey` sets that `p` tag.
+pub fn notifications(me: PublicKey) -> Vec<Filter> {
+    vec![
+        notification_comments(me),
+        Filter::new().kinds(NOTIFICATION_KINDS).pubkey(me),
+    ]
+}
+
+/// Git activity authored by `me`, for "Continue where you left off".
+///
+/// A comment on an unrelated kind is matched too, so results must be filtered
+/// through [`is_git_activity`] before display.
+pub fn authored_activity(me: PublicKey) -> Filter {
+    Filter::new()
+        .kinds(
+            ACTIVITY_KINDS
+                .into_iter()
+                .chain(std::iter::once(COVER_NOTE_KIND)),
+        )
+        .author(me)
+}
+
+/// Whether a kind-1111 comment targets a git root, checked via its `K` tag.
+fn is_git_comment(event: &Event) -> bool {
+    event.kind == Kind::Comment
+        && tag_kind(event, "K").is_some_and(|kind| GIT_ROOT_KINDS.contains(&kind))
+}
+
+/// Whether a kind-1624 cover note targets a git root, checked via its `k` tag.
+fn is_git_cover_note(event: &Event) -> bool {
+    event.kind == COVER_NOTE_KIND
+        && tag_kind(event, "k").is_some_and(|kind| GIT_ROOT_KINDS.contains(&kind))
+}
+
+/// Whether a status event references a git root, checked via its `k` tag.
+fn is_git_status(event: &Event) -> bool {
+    tag_kind(event, "k").is_some_and(|kind| GIT_ROOT_KINDS.contains(&kind))
+}
+
+/// Whether `event` is git activity worth showing in the activity list.
+pub fn is_git_activity(event: &Event) -> bool {
+    match event.kind {
+        Kind::GitIssue | Kind::GitPatch | Kind::GitPullRequest => true,
+        Kind::Comment => is_git_comment(event),
+        Kind::GitStatusOpen
+        | Kind::GitStatusApplied
+        | Kind::GitStatusClosed
+        | Kind::GitStatusDraft => is_git_status(event),
+        kind => kind == COVER_NOTE_KIND && is_git_cover_note(event),
+    }
+}
+
 /// All repository announcements, for global discovery.
 pub fn all_announcements() -> Filter {
     Filter::new().kind(Kind::GitRepoAnnouncement)
@@ -134,3 +231,94 @@ pub fn deletions_for_repo(addr: &RepoAddr) -> Vec<Filter> {
         Filter::new().kind(Kind::EventDeletion).coordinate(addr),
     ]
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn keys(seed: u8) -> Keys {
+        let mut hex = "00000000000000000000000000000000000000000000000000000000000000".to_string();
+        hex.push_str(&format!("{seed:02x}"));
+        Keys::new(SecretKey::from_hex(&hex).expect("valid secret key"))
+    }
+
+    fn signed(author: &Keys, kind: Kind, tags: Vec<Tag>) -> Event {
+        EventBuilder::new(kind, "")
+            .tags(tags)
+            .finalize(author)
+            .expect("signed event")
+    }
+
+    fn kind_tag(name: &str, kind: Kind) -> Tag {
+        Tag::parse([name, &kind.as_u16().to_string()]).expect("valid kind tag")
+    }
+
+    #[test]
+    fn root_git_kinds_are_activity() {
+        for kind in [Kind::GitIssue, Kind::GitPatch, Kind::GitPullRequest] {
+            assert!(is_git_activity(&signed(&keys(1), kind, Vec::new())));
+        }
+    }
+
+    #[test]
+    fn comment_activity_depends_on_the_uppercase_k_tag() {
+        let on_git = signed(&keys(1), Kind::Comment, vec![kind_tag("K", Kind::GitIssue)]);
+        let on_repo = signed(
+            &keys(1),
+            Kind::Comment,
+            vec![kind_tag("K", Kind::GitRepoAnnouncement)],
+        );
+        let on_note = signed(&keys(1), Kind::Comment, vec![kind_tag("K", Kind::TextNote)]);
+
+        assert!(is_git_activity(&on_git));
+        assert!(is_git_activity(&on_repo));
+        assert!(!is_git_activity(&on_note));
+        assert!(!is_git_activity(&signed(
+            &keys(1),
+            Kind::Comment,
+            Vec::new()
+        )));
+    }
+
+    #[test]
+    fn status_and_cover_note_activity_depend_on_the_lowercase_k_tag() {
+        let status = signed(
+            &keys(1),
+            Kind::GitStatusClosed,
+            vec![kind_tag("k", Kind::GitPullRequest)],
+        );
+        let cover = signed(
+            &keys(1),
+            COVER_NOTE_KIND,
+            vec![kind_tag("k", Kind::GitPatch)],
+        );
+        let unrelated = signed(
+            &keys(1),
+            Kind::GitStatusClosed,
+            vec![kind_tag("k", Kind::Metadata)],
+        );
+
+        assert!(is_git_activity(&status));
+        assert!(is_git_activity(&cover));
+        assert!(!is_git_activity(&unrelated));
+        assert!(!is_git_activity(&signed(
+            &keys(1),
+            Kind::GitStatusClosed,
+            Vec::new()
+        )));
+    }
+
+    #[test]
+    fn non_git_kinds_are_not_activity() {
+        assert!(!is_git_activity(&signed(
+            &keys(1),
+            Kind::TextNote,
+            Vec::new()
+        )));
+        assert!(!is_git_activity(&signed(
+            &keys(1),
+            Kind::GitPullRequestUpdate,
+            Vec::new(),
+        )));
+    }
+}

crates/signed_core/src/inbox.rs

@@ -0,0 +1,855 @@
+use std::collections::{HashMap, HashSet};
+use std::time::Duration;
+
+use nostr::prelude::*;
+use serde::{Deserialize, Serialize};
+
+use crate::{COVER_NOTE_KIND, RepoAddr, activity_subject};
+
+/// Window before `now` that an advanced cutoff retreats to.
+const ADVANCE_WINDOW: Duration = Duration::from_secs(3 * 24 * 60 * 60);
+
+/// Window before `now` that a mark-all cutoff retreats to.
+const MARK_ALL_WINDOW: Duration = Duration::from_secs(10 * 24 * 60 * 60);
+
+/// A thread of notification and own-activity events sharing one root.
+#[derive(Debug, Clone)]
+pub struct InboxItem {
+    /// The root issue, patch or pull request the events belong to.
+    pub root: EventId,
+    /// The root event itself, when it is known locally.
+    pub root_event: Option<Event>,
+    /// Kind of the root event, when it is known locally.
+    pub root_kind: Option<Kind>,
+    /// Repository the root belongs to, from the root's `a` tag.
+    pub address: Option<RepoAddr>,
+    /// Notification events directed at the user, newest first.
+    pub events: Vec<Event>,
+    /// The user's own events in the thread, newest first.
+    pub own_events: Vec<Event>,
+    /// Unread event ids, oldest first.
+    pub unread_ids: Vec<EventId>,
+    /// Whether every notification event in the thread is archived.
+    pub archived: bool,
+}
+
+impl InboxItem {
+    /// Title of the thread, read from its root issue/patch/PR when known.
+    pub fn title(&self) -> String {
+        self.root_event
+            .as_ref()
+            .or_else(|| self.own_events.first())
+            .or_else(|| self.events.first())
+            .map(activity_subject)
+            .unwrap_or_else(|| "Untitled".to_string())
+    }
+
+    /// Kind shown for the thread.
+    pub fn kind(&self) -> Option<Kind> {
+        self.root_kind.or_else(|| {
+            self.root_event
+                .as_ref()
+                .or_else(|| self.own_events.first())
+                .or_else(|| self.events.first())
+                .map(|event| event.kind)
+        })
+    }
+
+    /// Timestamp of the newest event in the thread.
+    pub fn latest_activity(&self) -> Timestamp {
+        self.root_event
+            .as_ref()
+            .into_iter()
+            .chain(self.own_events.first())
+            .chain(self.events.first())
+            .map(|event| event.created_at)
+            .max()
+            .unwrap_or_default()
+    }
+
+    /// Up to `limit` events of the thread, oldest first.
+    pub fn timeline(&self, limit: usize) -> Vec<Event> {
+        let mut seen: HashSet<EventId> = HashSet::new();
+        let mut events: Vec<Event> = Vec::new();
+
+        if let Some(root) = &self.root_event {
+            seen.insert(root.id);
+            events.push(root.clone());
+        }
+
+        let mut rest: Vec<Event> = self
+            .own_events
+            .iter()
+            .chain(self.events.iter())
+            .filter(|event| seen.insert(event.id))
+            .cloned()
+            .collect();
+
+        rest.sort_by(|a, b| {
+            b.created_at
+                .cmp(&a.created_at)
+                .then_with(|| b.id.to_hex().cmp(&a.id.to_hex()))
+        });
+        rest.truncate(limit.saturating_sub(events.len()));
+        events.extend(rest);
+
+        events.sort_by_key(|event| event.created_at);
+        events
+    }
+
+    /// Whether the thread has an unread event still visible in the inbox.
+    pub fn is_unread(&self) -> bool {
+        !self.archived && !self.unread_ids.is_empty()
+    }
+
+    /// Recompute the unread and archived flags from `state`.
+    pub fn apply_state(&mut self, state: &InboxReadState) {
+        self.unread_ids = self
+            .events
+            .iter()
+            .rev()
+            .filter(|event| !state.is_read(event))
+            .map(|event| event.id)
+            .collect();
+
+        // A thread without notification events is never archived.
+        self.archived =
+            !self.events.is_empty() && self.events.iter().all(|event| state.is_archived(event));
+    }
+}
+
+/// Root issue, patch or pull request of a notification event.
+///
+/// Returns `None` when the event is not git-related, or when its root is a
+/// coordinate rather than an event.
+///
+/// - issue (1621) / PR (1618): itself
+/// - patch (1617): its `e` parent patch, else itself
+/// - NIP-22 comment (1111): uppercase `E` root pointer
+/// - PR update (1619): uppercase `E`
+/// - statuses (1630-1633) / cover note (1624): NIP-10 root `e`
+pub fn notification_root<L>(event: &Event, lookup: &L) -> Option<EventId>
+where
+    L: Fn(EventId) -> Option<Event>,
+{
+    if event.kind == COVER_NOTE_KIND {
+        return nip10_root_id(event).map(|root| resolve_thread_root(root, lookup));
+    }
+    match event.kind {
+        Kind::GitIssue | Kind::GitPullRequest => Some(event.id),
+        Kind::GitPatch => Some(match first_e_id(event) {
+            Some(parent) => resolve_thread_root(parent, lookup),
+            None => event.id,
+        }),
+        Kind::Comment => match nip22::extract_root(event) {
+            Some(CommentTarget::Event { id, .. }) => Some(resolve_thread_root(id, lookup)),
+            _ => None,
+        },
+        Kind::GitPullRequestUpdate => {
+            first_uppercase_e_id(event).map(|root| resolve_thread_root(root, lookup))
+        }
+        Kind::GitStatusOpen
+        | Kind::GitStatusApplied
+        | Kind::GitStatusClosed
+        | Kind::GitStatusDraft => {
+            nip10_root_id(event).map(|root| resolve_thread_root(root, lookup))
+        }
+        _ => None,
+    }
+}
+
+/// Group notification events and the user's own events into one item per thread.
+pub fn group<E, O, L>(
+    events: E,
+    own: O,
+    me: PublicKey,
+    state: &InboxReadState,
+    lookup: &L,
+) -> Vec<InboxItem>
+where
+    E: IntoIterator<Item = Event>,
+    O: IntoIterator<Item = Event>,
+    L: Fn(EventId) -> Option<Event>,
+{
+    let mut groups: HashMap<EventId, Vec<Event>> = HashMap::new();
+    for event in events {
+        if event.pubkey == me {
+            continue;
+        }
+        let Some(root) = notification_root(&event, lookup) else {
+            continue;
+        };
+        groups.entry(root).or_default().push(event);
+    }
+
+    let mut own_groups: HashMap<EventId, Vec<Event>> = HashMap::new();
+    for event in own {
+        let root = notification_root(&event, lookup).unwrap_or(event.id);
+        own_groups.entry(root).or_default().push(event);
+    }
+
+    let mut roots: Vec<EventId> = groups.keys().chain(own_groups.keys()).copied().collect();
+    roots.sort();
+    roots.dedup();
+
+    let mut items: Vec<InboxItem> = roots
+        .into_iter()
+        .map(|root| {
+            let mut events = groups.remove(&root).unwrap_or_default();
+            let mut own_events = own_groups.remove(&root).unwrap_or_default();
+            sort_newest_first(&mut events);
+            sort_newest_first(&mut own_events);
+
+            let root_event = lookup(root);
+
+            let mut item = InboxItem {
+                root,
+                root_kind: root_event.as_ref().map(|event| event.kind),
+                address: root_event
+                    .as_ref()
+                    .and_then(|event| event.tags.coordinates().next()),
+                root_event,
+                events,
+                own_events,
+                unread_ids: Vec::new(),
+                archived: false,
+            };
+            item.apply_state(state);
+            item
+        })
+        .collect();
+
+    items.sort_by(|a, b| {
+        b.latest_activity()
+            .cmp(&a.latest_activity())
+            .then_with(|| b.root.to_hex().cmp(&a.root.to_hex()))
+    });
+
+    items
+}
+
+/// Sort thread events newest first, ties broken by id.
+fn sort_newest_first(events: &mut [Event]) {
+    events.sort_by(|a, b| {
+        b.created_at
+            .cmp(&a.created_at)
+            .then_with(|| b.id.to_hex().cmp(&a.id.to_hex()))
+    });
+}
+
+/// Read and archive state of the inbox, a high-water-mark model.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InboxReadState {
+    #[serde(default)]
+    pub read_before: Timestamp,
+    #[serde(default)]
+    pub read_ids: HashSet<EventId>,
+    #[serde(default)]
+    pub archived_before: Timestamp,
+    #[serde(default)]
+    pub archived_ids: HashSet<EventId>,
+}
+
+impl InboxReadState {
+    /// Whether `event` is at or before the read cutoff, or marked read.
+    pub fn is_read(&self, event: &Event) -> bool {
+        event.created_at <= self.read_before || self.read_ids.contains(&event.id)
+    }
+
+    /// Whether `event` is at or before the archived cutoff, or marked archived.
+    pub fn is_archived(&self, event: &Event) -> bool {
+        event.created_at <= self.archived_before || self.archived_ids.contains(&event.id)
+    }
+
+    /// Mark one event read. Events at or before the cutoff are already read.
+    pub fn mark_read(&mut self, event: &Event) {
+        if event.created_at > self.read_before {
+            self.read_ids.insert(event.id);
+        }
+    }
+
+    /// Mark one event archived. Events at or before the cutoff are already archived.
+    pub fn mark_archived(&mut self, event: &Event) {
+        if event.created_at > self.archived_before {
+            self.archived_ids.insert(event.id);
+        }
+    }
+
+    /// Mark every non-self event read, anchoring the cutoff ten days back.
+    pub fn mark_all_read(&mut self, all: &[Event], me: PublicKey, now: Timestamp) {
+        let cutoff = now - MARK_ALL_WINDOW;
+        self.read_before = cutoff;
+        self.read_ids = all
+            .iter()
+            .filter(|event| event.pubkey != me && event.created_at > cutoff)
+            .map(|event| event.id)
+            .collect();
+    }
+
+    /// Advance the read cutoff to the newest point that keeps unread events
+    /// unread, then prune the id set.
+    pub fn advance_read(&mut self, all: &[Event], me: PublicKey, now: Timestamp) {
+        let cutoff = advance_cutoff(all, me, now, self.read_before, |event| self.is_read(event));
+        self.read_before = cutoff;
+        prune_ids(&mut self.read_ids, all, cutoff);
+    }
+
+    /// Advance the archived cutoff, mirroring [`Self::advance_read`].
+    pub fn advance_archived(&mut self, all: &[Event], me: PublicKey, now: Timestamp) {
+        let cutoff = advance_cutoff(all, me, now, self.archived_before, |event| {
+            self.is_archived(event)
+        });
+        self.archived_before = cutoff;
+        prune_ids(&mut self.archived_ids, all, cutoff);
+    }
+}
+
+/// Newest cutoff that keeps unread events unread, never earlier than `current`.
+fn advance_cutoff<M>(
+    all: &[Event],
+    me: PublicKey,
+    now: Timestamp,
+    current: Timestamp,
+    is_marked: M,
+) -> Timestamp
+where
+    M: Fn(&Event) -> bool,
+{
+    let fallback = now - ADVANCE_WINDOW;
+
+    let oldest = all
+        .iter()
+        .filter(|event| event.pubkey != me && !is_marked(event))
+        .map(|event| event.created_at)
+        .min();
+
+    let candidate = match oldest {
+        Some(at) if at < fallback => at - 1,
+        _ => fallback,
+    };
+
+    candidate.max(current)
+}
+
+/// Drop ids whose event is unknown or now covered by the cutoff.
+fn prune_ids(ids: &mut HashSet<EventId>, all: &[Event], cutoff: Timestamp) {
+    let created_at: HashMap<EventId, Timestamp> = all
+        .iter()
+        .map(|event| (event.id, event.created_at))
+        .collect();
+    ids.retain(|id| created_at.get(id).is_some_and(|at| *at >= cutoff));
+}
+
+/// Follow NIP-10/NIP-22 parent pointers until a root item is reached.
+fn resolve_thread_root(id: EventId, lookup: &impl Fn(EventId) -> Option<Event>) -> EventId {
+    let mut seen = HashSet::new();
+    let mut root = id;
+
+    loop {
+        if !seen.insert(root) {
+            return id;
+        }
+
+        let Some(event) = lookup(root) else {
+            return root;
+        };
+
+        if matches!(event.kind, Kind::GitIssue | Kind::GitPullRequest) {
+            return root;
+        }
+
+        match parent_id(&event) {
+            Some(parent) => root = parent,
+            None => return root,
+        }
+    }
+}
+
+/// Parent of a thread event, mirroring gitworkshop's `getParentId`.
+fn parent_id(event: &Event) -> Option<EventId> {
+    for marker in ["reply", "root"] {
+        if let Some(id) = event
+            .tags
+            .iter()
+            .find_map(|tag| e_tag_with_marker(tag, marker))
+        {
+            return Some(id);
+        }
+    }
+
+    if let Some(id) = event.tags.iter().find_map(|tag| {
+        if tag.kind() != "e" {
+            return None;
+        }
+
+        let slice = tag.as_slice();
+        let is_mention = slice.len() == 4 && slice[3] == "mention";
+
+        if is_mention {
+            return None;
+        }
+
+        tag.content()
+            .and_then(|content| EventId::from_hex(content).ok())
+    }) {
+        return Some(id);
+    }
+
+    first_uppercase_e_id(event)
+}
+
+/// NIP-10 root of an event: the `e` tag marked `root`, else the first `e` tag.
+fn nip10_root_id(event: &Event) -> Option<EventId> {
+    event
+        .tags
+        .iter()
+        .find_map(|tag| e_tag_with_marker(tag, "root"))
+        .or_else(|| first_e_id(event))
+}
+
+/// First `e` tag id, in document order.
+fn first_e_id(event: &Event) -> Option<EventId> {
+    first_tag_id(event, "e")
+}
+
+/// First uppercase `E` tag id, in document order.
+fn first_uppercase_e_id(event: &Event) -> Option<EventId> {
+    first_tag_id(event, "E")
+}
+
+fn first_tag_id(event: &Event, name: &str) -> Option<EventId> {
+    event.tags.iter().find_map(|tag| {
+        if tag.kind() != name {
+            return None;
+        }
+        tag.content()
+            .and_then(|content| EventId::from_hex(content).ok())
+    })
+}
+
+/// Event id from a four-element `e` tag carrying `marker`.
+fn e_tag_with_marker(tag: &Tag, marker: &str) -> Option<EventId> {
+    let slice = tag.as_slice();
+    if tag.kind() != "e" || slice.len() != 4 || slice[3] != marker {
+        return None;
+    }
+    tag.content()
+        .and_then(|content| EventId::from_hex(content).ok())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn keys(seed: u8) -> Keys {
+        let mut hex = "00000000000000000000000000000000000000000000000000000000000000".to_string();
+        hex.push_str(&format!("{seed:02x}"));
+        Keys::new(SecretKey::from_hex(&hex).expect("valid secret key"))
+    }
+
+    fn signed(author: &Keys, kind: Kind, tags: Vec<Tag>, created_at: u64) -> Event {
+        EventBuilder::new(kind, "")
+            .tags(tags)
+            .custom_created_at(Timestamp::from_secs(created_at))
+            .finalize(author)
+            .expect("signed event")
+    }
+
+    fn e_tag(event: &Event) -> Tag {
+        Tag::parse(["e", &event.id.to_hex()]).expect("valid e tag")
+    }
+
+    fn marked_e_tag(event: &Event, marker: &str) -> Tag {
+        Tag::parse(["e", &event.id.to_hex(), "wss://relay.example.com", marker])
+            .expect("valid e tag")
+    }
+
+    fn uppercase_e_tag(event: &Event) -> Tag {
+        Tag::parse(["E", &event.id.to_hex()]).expect("valid E tag")
+    }
+
+    fn a_tag(owner: &PublicKey, id: &str) -> Tag {
+        Tag::parse(["a", &format!("30617:{}:{id}", owner.to_hex())]).expect("valid a tag")
+    }
+
+    fn lookup(events: &[Event]) -> impl Fn(EventId) -> Option<Event> + '_ {
+        move |id| events.iter().find(|event| event.id == id).cloned()
+    }
+
+    fn issue(author: &Keys, at: u64) -> Event {
+        signed(author, Kind::GitIssue, Vec::new(), at)
+    }
+
+    fn titled_issue(author: &Keys, title: &str, at: u64) -> Event {
+        signed(
+            author,
+            Kind::GitIssue,
+            vec![Tag::parse(["subject", title]).expect("valid subject tag")],
+            at,
+        )
+    }
+
+    #[test]
+    fn issue_and_pull_request_are_their_own_root() {
+        let events = [
+            issue(&keys(1), 100),
+            signed(&keys(1), Kind::GitPullRequest, Vec::new(), 100),
+        ];
+        let lookup = lookup(&events);
+        for event in &events {
+            assert_eq!(notification_root(event, &lookup), Some(event.id));
+        }
+    }
+
+    #[test]
+    fn comment_resolves_to_its_uppercase_root() {
+        let issue = issue(&keys(1), 100);
+        let comment = signed(
+            &keys(2),
+            Kind::Comment,
+            vec![
+                uppercase_e_tag(&issue),
+                Tag::parse(["K", "1621"]).expect("valid K tag"),
+            ],
+            200,
+        );
+        let events = [issue.clone(), comment.clone()];
+        assert_eq!(
+            notification_root(&comment, &lookup(&events)),
+            Some(issue.id)
+        );
+    }
+
+    #[test]
+    fn comment_without_root_pointer_has_no_root() {
+        let comment = signed(
+            &keys(2),
+            Kind::Comment,
+            vec![e_tag(&issue(&keys(1), 100))],
+            200,
+        );
+        assert_eq!(notification_root(&comment, &lookup(&[])), None);
+    }
+
+    #[test]
+    fn child_patch_resolves_to_the_root_patch() {
+        let root_patch = signed(&keys(1), Kind::GitPatch, Vec::new(), 100);
+        let child_patch = signed(&keys(1), Kind::GitPatch, vec![e_tag(&root_patch)], 200);
+        let events = [root_patch.clone(), child_patch.clone()];
+        assert_eq!(
+            notification_root(&child_patch, &lookup(&events)),
+            Some(root_patch.id)
+        );
+    }
+
+    #[test]
+    fn status_resolves_via_the_root_marker() {
+        let issue = issue(&keys(1), 100);
+        let status = signed(
+            &keys(2),
+            Kind::GitStatusClosed,
+            vec![marked_e_tag(&issue, "root")],
+            200,
+        );
+        let events = [issue.clone(), status.clone()];
+        assert_eq!(notification_root(&status, &lookup(&events)), Some(issue.id));
+    }
+
+    #[test]
+    fn pull_request_update_resolves_via_uppercase_e() {
+        let pr = signed(&keys(1), Kind::GitPullRequest, Vec::new(), 100);
+        let update = signed(
+            &keys(2),
+            Kind::GitPullRequestUpdate,
+            vec![uppercase_e_tag(&pr)],
+            200,
+        );
+        let events = [pr.clone(), update.clone()];
+        assert_eq!(notification_root(&update, &lookup(&events)), Some(pr.id));
+    }
+
+    #[test]
+    fn nested_comment_chain_follows_to_the_root() {
+        let issue = issue(&keys(1), 100);
+        let reply = signed(&keys(2), Kind::Comment, vec![uppercase_e_tag(&issue)], 200);
+        let nested = signed(&keys(3), Kind::Comment, vec![uppercase_e_tag(&reply)], 300);
+        let events = [issue.clone(), reply, nested.clone()];
+        assert_eq!(notification_root(&nested, &lookup(&events)), Some(issue.id));
+    }
+
+    #[test]
+    fn group_excludes_self_and_sorts_groups_newest_first() {
+        let me = keys(1);
+        let issue = issue(&keys(2), 100);
+        let comment = signed(&keys(3), Kind::Comment, vec![uppercase_e_tag(&issue)], 300);
+        let other_issue = signed(
+            &keys(2),
+            Kind::GitIssue,
+            vec![Tag::parse(["p", &me.public_key().to_hex()]).expect("valid p tag")],
+            200,
+        );
+        let mine = signed(&keys(1), Kind::Comment, vec![uppercase_e_tag(&issue)], 400);
+
+        let events = [issue.clone(), comment.clone(), other_issue.clone(), mine];
+        let items = group(
+            events,
+            Vec::new(),
+            me.public_key(),
+            &InboxReadState::default(),
+            &lookup(&[]),
+        );
+
+        assert_eq!(items.len(), 2);
+        assert_eq!(items[0].root, issue.id);
+        // The issue itself plus the comment; the self-authored comment is out.
+        assert_eq!(items[0].events.len(), 2);
+        assert_eq!(items[1].root, other_issue.id);
+    }
+
+    #[test]
+    fn group_reports_unread_oldest_first_and_archived() {
+        let me = keys(1);
+        let issue = issue(&keys(2), 100);
+        let older = signed(&keys(3), Kind::Comment, vec![uppercase_e_tag(&issue)], 200);
+        let newer = signed(&keys(4), Kind::Comment, vec![uppercase_e_tag(&issue)], 300);
+
+        let events = [issue.clone(), older.clone(), newer.clone()];
+        let items = group(
+            events,
+            Vec::new(),
+            me.public_key(),
+            &InboxReadState::default(),
+            &lookup(&[]),
+        );
+        assert_eq!(items[0].unread_ids, vec![issue.id, older.id, newer.id]);
+        assert!(!items[0].archived);
+        assert!(items[0].is_unread());
+
+        let state = InboxReadState {
+            archived_before: Timestamp::from_secs(1000),
+            ..Default::default()
+        };
+        let items = group(
+            [issue.clone(), older, newer],
+            Vec::new(),
+            me.public_key(),
+            &state,
+            &lookup(&[]),
+        );
+        assert!(items[0].archived);
+        assert!(!items[0].unread_ids.is_empty());
+        assert!(!items[0].is_unread());
+    }
+
+    #[test]
+    fn group_reads_root_kind_and_address_from_the_root_event() {
+        let me = keys(1);
+        let owner_keys = keys(2);
+        let owner = owner_keys.public_key();
+        let issue = signed(
+            &owner_keys,
+            Kind::GitIssue,
+            vec![a_tag(&owner, "my-repo")],
+            100,
+        );
+        let comment = signed(&keys(3), Kind::Comment, vec![uppercase_e_tag(&issue)], 200);
+
+        let events = [issue.clone(), comment];
+        let items = group(
+            events.clone(),
+            Vec::new(),
+            me.public_key(),
+            &InboxReadState::default(),
+            &lookup(&events),
+        );
+
+        assert_eq!(items[0].root_kind, Some(Kind::GitIssue));
+        assert_eq!(items[0].address, issue.tags.coordinates().next());
+    }
+
+    #[test]
+    fn group_merges_own_events_into_the_matching_thread() {
+        let me = keys(1);
+        let issue = titled_issue(&me, "Add retry logic", 100);
+        let mine = signed(
+            &me,
+            Kind::Comment,
+            vec![
+                uppercase_e_tag(&issue),
+                Tag::parse(["K", "1621"]).expect("K tag"),
+            ],
+            150,
+        );
+        let reply = signed(
+            &keys(2),
+            Kind::Comment,
+            vec![
+                uppercase_e_tag(&issue),
+                Tag::parse(["K", "1621"]).expect("K tag"),
+            ],
+            200,
+        );
+
+        let context = [issue.clone(), mine.clone(), reply.clone()];
+        let items = group(
+            [reply.clone()],
+            [issue.clone(), mine.clone()],
+            me.public_key(),
+            &InboxReadState::default(),
+            &lookup(&context),
+        );
+
+        assert_eq!(items.len(), 1);
+        assert_eq!(items[0].root, issue.id);
+        assert_eq!(
+            items[0].root_event.as_ref().map(|event| event.id),
+            Some(issue.id)
+        );
+        assert_eq!(items[0].kind(), Some(Kind::GitIssue));
+        assert_eq!(items[0].title(), "Add retry logic");
+        assert_eq!(items[0].events, vec![reply.clone()]);
+        // The own events are kept apart from the notifications, newest first.
+        assert_eq!(items[0].own_events, vec![mine.clone(), issue.clone()]);
+        assert_eq!(
+            items[0]
+                .timeline(5)
+                .iter()
+                .map(|event| event.id)
+                .collect::<Vec<_>>(),
+            vec![issue.id, mine.id, reply.id]
+        );
+    }
+
+    #[test]
+    fn mark_all_read_marks_known_recent_events() {
+        let me = keys(1);
+        let now = Timestamp::from_secs(1_000_000_000);
+        let recent = issue(&keys(2), now.as_secs() - 1000);
+        let old = issue(&keys(2), now.as_secs() - 5 * 24 * 60 * 60);
+        let ancient = issue(&keys(2), now.as_secs() - 20 * 24 * 60 * 60);
+        let mine = issue(&keys(1), now.as_secs() - 100);
+
+        let mut state = InboxReadState::default();
+        state.mark_all_read(
+            &[recent.clone(), old.clone(), ancient.clone(), mine.clone()],
+            me.public_key(),
+            now,
+        );
+
+        assert_eq!(state.read_before, now - MARK_ALL_WINDOW);
+        assert_eq!(state.read_ids, HashSet::from([recent.id, old.id]));
+        assert!(state.is_read(&recent));
+        assert!(state.is_read(&ancient));
+        assert!(!state.is_read(&mine));
+    }
+
+    #[test]
+    fn advance_read_never_moves_the_cutoff_backwards() {
+        let me = keys(1);
+        let unread = issue(&keys(2), 1_000);
+        let all = [unread];
+        let now = Timestamp::from_secs(1_000_000_000);
+
+        let mut state = InboxReadState {
+            read_before: Timestamp::from_secs(999_999_999),
+            ..Default::default()
+        };
+        state.advance_read(&all, me.public_key(), now);
+
+        assert_eq!(state.read_before, Timestamp::from_secs(999_999_999));
+    }
+
+    #[test]
+    fn advance_read_moves_before_the_oldest_unread_and_prunes_ids() {
+        let me = keys(1);
+        let now = Timestamp::from_secs(1_000_000_000);
+        let five_days = 5 * 24 * 60 * 60;
+        let old_unread = issue(&keys(2), now.as_secs() - five_days);
+        // Read ids that fall before and after the new cutoff.
+        let stale = signed(
+            &keys(2),
+            Kind::GitIssue,
+            Vec::new(),
+            now.as_secs() - five_days - 1000,
+        );
+        let fresh = signed(
+            &keys(2),
+            Kind::GitIssue,
+            Vec::new(),
+            now.as_secs() - 100_000,
+        );
+
+        let mut state = InboxReadState {
+            read_ids: HashSet::from([stale.id, fresh.id]),
+            ..Default::default()
+        };
+        state.advance_read(
+            &[old_unread.clone(), stale.clone(), fresh.clone()],
+            me.public_key(),
+            now,
+        );
+
+        assert_eq!(state.read_before, old_unread.created_at - 1);
+        assert_eq!(state.read_ids, HashSet::from([fresh.id]));
+    }
+
+    #[test]
+    fn mark_archived_skips_events_at_or_before_the_cutoff() {
+        let now = Timestamp::from_secs(1_000_000_000);
+        let event = issue(&keys(2), now.as_secs() - 1000);
+
+        let mut state = InboxReadState {
+            archived_before: now,
+            ..Default::default()
+        };
+        state.mark_archived(&event);
+        assert!(state.archived_ids.is_empty());
+
+        let mut state = InboxReadState::default();
+        state.mark_archived(&event);
+        assert_eq!(state.archived_ids, HashSet::from([event.id]));
+    }
+
+    #[test]
+    fn apply_state_recomputes_unread_and_archived() {
+        let now = Timestamp::from_secs(1_000_000_000);
+        let first = issue(&keys(2), now.as_secs() - 2000);
+        let second = issue(&keys(2), now.as_secs() - 1000);
+        let mut item = InboxItem {
+            root: first.id,
+            root_event: None,
+            root_kind: None,
+            address: None,
+            events: vec![second.clone(), first.clone()],
+            own_events: Vec::new(),
+            unread_ids: Vec::new(),
+            archived: false,
+        };
+
+        let state = InboxReadState {
+            read_before: first.created_at,
+            ..Default::default()
+        };
+        item.apply_state(&state);
+
+        assert_eq!(item.unread_ids, vec![second.id]);
+        assert!(!item.archived);
+    }
+
+    #[test]
+    fn serde_round_trip_preserves_state() {
+        let first = issue(&keys(1), 100);
+        let second = issue(&keys(2), 200);
+        let state = InboxReadState {
+            read_before: Timestamp::from_secs(150),
+            read_ids: HashSet::from([second.id]),
+            archived_before: Timestamp::from_secs(50),
+            archived_ids: HashSet::from([first.id]),
+        };
+
+        let json = serde_json::to_string(&state).expect("serialized");
+        let parsed: InboxReadState = serde_json::from_str(&json).expect("deserialized");
+
+        assert_eq!(parsed, state);
+    }
+}

crates/signed_core/src/lib.rs

@@ -3,6 +3,7 @@ pub mod annotations;
 pub mod clone_url;
 pub mod deletions;
 pub mod filters;
+pub mod inbox;
 pub mod model;
 pub mod state;
 pub mod status;
@@ -11,6 +12,13 @@ pub use addr::{RepoAddr, identifier_from_name, repo_addr};
 pub use annotations::{COVER_NOTE_KIND, cover_note, labels_and_subject, subject_override};
 pub use clone_url::{CloneTarget, parse_clone_url};
 pub use deletions::Deletions;
-pub use model::{Announcement, activity_subject, pull_request_patch, pull_request_patches};
+pub use filters::{
+    NOTIFICATION_KINDS, authored_activity, is_git_activity, notification_comments, notifications,
+};
+pub use inbox::{InboxItem, InboxReadState, group, notification_root};
+pub use model::{
+    Announcement, activity_subject, branch_name_of, clone_urls_of, current_commit_of,
+    fork_candidates, latest_update, merge_base_of, pull_request_patch, pull_request_patches,
+};
 pub use state::{build_state, parse_state};
 pub use status::{RepoStatus, references_root, resolve_status};

crates/signed_core/src/model.rs

@@ -180,7 +180,7 @@ fn forward_series<'a>(root: &'a Event, patches: &[&'a Event]) -> Vec<&'a Event>
 }
 
 /// The `c` tag of an event, the tip of the proposed branch, as hex.
-fn current_commit_of(event: &Event) -> Option<String> {
+pub fn current_commit_of(event: &Event) -> Option<String> {
     event
         .tags
         .iter()
@@ -190,6 +190,82 @@ fn current_commit_of(event: &Event) -> Option<String> {
         })
 }
 
+/// The `merge-base` tag of an event, the base commit a pull request diffs against.
+pub fn merge_base_of(event: &Event) -> Option<String> {
+    event
+        .tags
+        .iter()
+        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+            Ok(Nip34Tag::MergeBase(commit)) => Some(commit.to_string()),
+            _ => None,
+        })
+}
+
+/// The `clone` tag of an event, URLs the tip commit can be fetched from.
+pub fn clone_urls_of(event: &Event) -> Option<Vec<Url>> {
+    event
+        .tags
+        .iter()
+        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+            Ok(Nip34Tag::Clone(urls)) => Some(urls),
+            _ => None,
+        })
+}
+
+/// The `branch-name` tag of an event, the proposed branch's name.
+pub fn branch_name_of(event: &Event) -> Option<String> {
+    event
+        .tags
+        .iter()
+        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
+            Ok(Nip34Tag::BranchName(name)) => Some(name),
+            _ => None,
+        })
+}
+
+/// The newest `GitPullRequestUpdate` revising `root`, from the root's own author.
+///
+/// A pull request's tip is only mutable by its author, per NIP-34; updates
+/// from anyone else are ignored even if they are newer.
+pub fn latest_update<'a>(
+    events: impl Iterator<Item = &'a Event>,
+    root: &Event,
+) -> Option<&'a Event> {
+    let root_hex = root.id.to_hex();
+    events
+        .filter(|e| e.kind == Kind::GitPullRequestUpdate)
+        .filter(|e| e.pubkey == root.pubkey)
+        .filter(|e| {
+            e.tags
+                .iter()
+                .any(|t| t.kind() == "E" && t.content() == Some(root_hex.as_str()))
+        })
+        .max_by_key(|e| e.created_at)
+}
+
+/// The announced forks of `base` a new pull request compare can be built from.
+///
+/// The user's own forks are listed first.
+pub fn fork_candidates<'a>(
+    announcements: &'a [Announcement],
+    base: &RepoAddr,
+    base_euc: Option<&str>,
+    user: Option<PublicKey>,
+) -> Vec<&'a Announcement> {
+    let (mut own, mut others) = (Vec::new(), Vec::new());
+    for announcement in announcements {
+        if announcement.clone.is_empty() || !announcement.is_fork_of(base, base_euc) {
+            continue;
+        }
+        if Some(announcement.owner) == user {
+            own.push(announcement);
+        } else {
+            others.push(announcement);
+        }
+    }
+    own.into_iter().chain(others).collect()
+}
+
 /// Whether `patch` produces `commit`, found via its `commit` or `r` tag.
 ///
 /// It lets clients find existing patches for a specific commit.
@@ -727,4 +803,221 @@ mod tests {
             vec!["patch-one", "patch-two"]
         );
     }
+
+    const COMMIT_HEX: &str = "1111111111111111111111111111111111111111";
+    const OTHER_ROOT_HEX: &str = "2222222222222222222222222222222222222222";
+
+    /// Build a signed event of `kind` with the given tags and `created_at`.
+    fn signed_at(kind: Kind, tags: Vec<Tag>, created_at: u64) -> Event {
+        EventBuilder::new(kind, "")
+            .tags(tags)
+            .custom_created_at(Timestamp::from(created_at))
+            .finalize(&keys())
+            .expect("signed event")
+    }
+
+    fn pr_root() -> Event {
+        signed_at(
+            Kind::GitPullRequest,
+            vec![
+                Tag::parse(["c", COMMIT_HEX]).expect("valid tag"),
+                Tag::parse(["branch-name", "feature/x"]).expect("valid tag"),
+            ],
+            100,
+        )
+    }
+
+    #[test]
+    fn reads_current_commit_and_branch_name() {
+        let pr = pr_root();
+        assert_eq!(current_commit_of(&pr).as_deref(), Some(COMMIT_HEX));
+        assert_eq!(branch_name_of(&pr).as_deref(), Some("feature/x"));
+    }
+
+    #[test]
+    fn returns_none_without_pr_tags() {
+        let pr = signed_at(Kind::GitPullRequest, vec![], 100);
+        assert_eq!(current_commit_of(&pr), None);
+        assert_eq!(branch_name_of(&pr), None);
+    }
+
+    #[test]
+    fn latest_update_picks_newest_revision_of_the_root() {
+        let root = pr_root();
+        let root_hex = root.id.to_hex();
+
+        let revision = |created_at: u64| {
+            signed_at(
+                Kind::GitPullRequestUpdate,
+                vec![Tag::parse(["E", &root_hex]).expect("valid tag")],
+                created_at,
+            )
+        };
+        // An update revising a different PR must be ignored even though it is newer.
+        let unrelated = signed_at(
+            Kind::GitPullRequestUpdate,
+            vec![Tag::parse(["E", OTHER_ROOT_HEX]).expect("valid tag")],
+            999,
+        );
+
+        let events = [unrelated, revision(200), root.clone(), revision(300)];
+        let latest = latest_update(events.iter(), &root).expect("an update");
+
+        assert_eq!(latest.created_at.as_secs(), 300);
+        assert_eq!(latest.kind, Kind::GitPullRequestUpdate);
+    }
+
+    #[test]
+    fn latest_update_ignores_other_authors() {
+        let root = pr_root();
+        let root_hex = root.id.to_hex();
+        let other = Keys::new(
+            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000002")
+                .expect("valid secret key"),
+        );
+        let stranger = EventBuilder::new(Kind::GitPullRequestUpdate, "")
+            .tags([Tag::parse(["E", &root_hex]).expect("valid tag")])
+            .custom_created_at(Timestamp::from(999))
+            .finalize(&other)
+            .expect("signed event");
+
+        // The tip of a PR is only mutable by its author.
+        // A newer update from anyone else must not win.
+        assert!(latest_update([&stranger, &root].into_iter(), &root).is_none());
+    }
+
+    #[test]
+    fn latest_update_ignores_roots_without_revisions() {
+        let root = pr_root();
+        assert!(latest_update([&root].into_iter(), &root).is_none());
+    }
+
+    const OWNER_KEYS: [&str; 3] = [
+        "0000000000000000000000000000000000000000000000000000000000000001",
+        "0000000000000000000000000000000000000000000000000000000000000002",
+        "0000000000000000000000000000000000000000000000000000000000000003",
+    ];
+
+    /// Build a signed kind-30617 event for `owner` with the given tags.
+    fn owned_announcement_event(owner: &str, tags: &[&[&str]]) -> Event {
+        let keys = Keys::new(SecretKey::from_hex(owner).expect("valid secret key"));
+        let tags: Vec<Tag> = tags
+            .iter()
+            .map(|t| Tag::parse(t.to_vec()).expect("valid tag"))
+            .collect();
+        EventBuilder::new(Kind::GitRepoAnnouncement, "")
+            .tags(tags)
+            .finalize(&keys)
+            .expect("signed event")
+    }
+
+    fn owned_announcements(owner_ix: usize, tags: &[&[&str]]) -> Vec<Announcement> {
+        vec![
+            Announcement::from_event(&owned_announcement_event(OWNER_KEYS[owner_ix], tags))
+                .expect("parses"),
+        ]
+    }
+
+    #[test]
+    fn fork_candidates_orders_own_forks_first() {
+        let euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
+        let clone = "https://grasp.example/npub1x/my-fork.git";
+
+        let base_addr = crate::repo_addr(
+            PublicKey::from_hex(OWNER_KEYS[0]).expect("pubkey"),
+            "upstream",
+        );
+        // Newest first, as RepoListStore keeps them.
+        // Unrelated repo, the user's fork with the shared EUC, another fork with a `u` tag.
+        let all = vec![
+            owned_announcements(
+                2,
+                &[
+                    &["d", "other-project"],
+                    &["r", "bb231c4c6a5777dc89b42207b499891a344add5c", "euc"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+            owned_announcements(
+                1,
+                &[&["d", "my-fork"], &["r", euc, "euc"], &["clone", clone]],
+            )
+            .pop()
+            .unwrap(),
+            owned_announcements(
+                2,
+                &[
+                    &["d", "their-fork"],
+                    &["u", &base_addr.to_string()],
+                    &["clone", clone],
+                ],
+            )
+            .pop()
+            .unwrap(),
+        ];
+
+        let user = PublicKey::from_hex(OWNER_KEYS[1]).expect("pubkey");
+        let forks = fork_candidates(&all, &base_addr, Some(euc), Some(user));
+
+        // The user's fork comes first, then the other author's.
+        let ids: Vec<&str> = forks.iter().map(|a| a.id.as_str()).collect();
+        assert_eq!(ids, vec!["my-fork", "their-fork"]);
+    }
+
+    #[test]
+    fn fork_candidates_excludes_base_unrelated_and_unfetchable() {
+        let euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
+        let base_owner = PublicKey::from_hex(OWNER_KEYS[0]).expect("pubkey");
+        let base_addr = crate::repo_addr(base_owner, "upstream");
+
+        let mut all = vec![
+            owned_announcements(0, &[&["d", "upstream"], &["r", euc, "euc"]])
+                .pop()
+                .unwrap(),
+            owned_announcements(1, &[&["d", "no-clone-fork"], &["r", euc, "euc"]])
+                .pop()
+                .unwrap(),
+            owned_announcements(
+                2,
+                &[
+                    &["d", "other"],
+                    &["r", "cc231c4c6a5777dc89b42207b499891a344add5c", "euc"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+            owned_announcements(
+                2,
+                &[
+                    &["d", "mirror"],
+                    &["r", euc, "euc"],
+                    &["clone", "https://grasp.example/x/mirror.git"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+        ];
+
+        let forks = fork_candidates(&all, &base_addr, Some(euc), Some(base_owner));
+        assert_eq!(forks.len(), 1);
+        assert_eq!(forks[0].id, "mirror");
+
+        // Without a base EUC only `u`-tag forks match.
+        all.push(
+            owned_announcements(
+                2,
+                &[
+                    &["d", "u-fork"],
+                    &["u", &base_addr.to_string()],
+                    &["clone", "https://grasp.example/x/u-fork.git"],
+                ],
+            )
+            .pop()
+            .unwrap(),
+        );
+        let forks = fork_candidates(&all, &base_addr, None, Some(base_owner));
+        let ids: Vec<&str> = forks.iter().map(|a| a.id.as_str()).collect();
+        assert_eq!(ids, vec!["u-fork"]);
+    }
 }

crates/signed_git/Cargo.toml

@@ -9,7 +9,11 @@ signed_core = { path = "../signed_core" }
 
 nostr.workspace = true
 gix = { workspace = true, features = ["revision", "blob-diff"] }
+gix-worktree = "0.56"
+gix-worktree-state = "0.34"
 anyhow.workspace = true
+diffy = "0.5"
+ignore = "0.4"
 
 [dev-dependencies]
 tempfile = "3"

crates/signed_git/src/cache.rs

@@ -0,0 +1,96 @@
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use signed_core::{Announcement, RepoAddr};
+
+use crate::remote::{clone_repo, fetch_all};
+
+/// On-disk cache of cloned repositories, keyed by owner pubkey / repo id.
+#[derive(Debug, Clone)]
+pub struct GitCache {
+    root: PathBuf,
+}
+
+impl GitCache {
+    pub fn new(root: PathBuf) -> Self {
+        Self { root }
+    }
+
+    /// The root directory holding the mirror clones.
+    pub fn root(&self) -> &Path {
+        &self.root
+    }
+
+    /// Local path of the clone for a repository.
+    pub fn repo_path(&self, addr: &RepoAddr) -> PathBuf {
+        self.root
+            .join(addr.public_key.to_hex())
+            .join(sanitize_path_component(&addr.identifier))
+    }
+
+    /// Open an existing clone.
+    pub fn open(&self, addr: &RepoAddr) -> Result<Option<gix::Repository>> {
+        let path = self.repo_path(addr);
+        match gix::open(&path) {
+            Ok(repo) => Ok(Some(repo)),
+            Err(gix::open::Error::NotARepository { .. }) => Ok(None),
+            Err(gix::open::Error::Io(e)) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    /// Open the existing clone, fetching it first.
+    pub fn ensure_clone<U: AsRef<str>>(
+        &self,
+        addr: &RepoAddr,
+        clone_urls: &[U],
+    ) -> Result<gix::Repository> {
+        let path = self.repo_path(addr);
+
+        if let Some(repo) = self.open(addr)? {
+            fetch_all(&repo).ok();
+            return Ok(repo);
+        }
+
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent)
+                .with_context(|| format!("failed to create {}", parent.display()))?;
+        }
+
+        clone_repo(clone_urls, &path)?;
+        self.open(addr)?
+            .ok_or_else(|| anyhow::anyhow!("clone finished but the repository cannot be opened"))
+    }
+}
+
+/// Map an untrusted repository id or display name to a safe single path component.
+///
+/// Everything outside `[A-Za-z0-9._-]` becomes `_`.
+/// An id that maps to exactly `.` or `..` becomes `_`.
+pub fn sanitize_path_component(id: &str) -> String {
+    let sanitized: String = id
+        .chars()
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.') {
+                c
+            } else {
+                '_'
+            }
+        })
+        .collect();
+
+    if sanitized == "." || sanitized == ".." {
+        return "_".to_owned();
+    }
+
+    sanitized
+}
+
+/// The refs namespace of a fork's import in the target mirror.
+pub fn fork_namespace(announcement: &Announcement) -> String {
+    format!(
+        "{}/{}",
+        announcement.owner.to_hex(),
+        sanitize_path_component(&announcement.id)
+    )
+}

crates/signed_git/src/diff.rs

@@ -0,0 +1,304 @@
+use std::path::Path;
+
+use anyhow::Result;
+use gix::diff::blob::unified_diff::{ConsumeHunk, DiffLineKind as GixLineKind, HunkHeader};
+
+/// The kind of a [`DiffLine`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DiffLineKind {
+    /// An unchanged context line, present on both sides.
+    Context,
+    /// A line added by the commit.
+    Addition,
+    /// A line removed by the commit.
+    Deletion,
+}
+
+/// One line of a file diff.
+#[derive(Debug, Clone)]
+pub struct DiffLine {
+    pub kind: DiffLineKind,
+    /// 1-based line number in the old version, if the line exists there.
+    pub old: Option<u32>,
+    /// 1-based line number in the new version, if the line exists there.
+    pub new: Option<u32>,
+    /// Line content without the trailing newline.
+    pub text: String,
+}
+
+/// A hunk of a file diff, like `@@ -a,b +c,d @@`.
+#[derive(Debug, Clone)]
+pub struct DiffHunk {
+    /// 1-based start line in the old version.
+    pub old_start: u32,
+    /// Number of old lines covered by the hunk.
+    pub old_lines: u32,
+    /// 1-based start line in the new version.
+    pub new_start: u32,
+    /// Number of new lines covered by the hunk.
+    pub new_lines: u32,
+    pub lines: Vec<DiffLine>,
+}
+
+/// How a file changed in a commit.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DiffStatus {
+    Added,
+    Modified,
+    Deleted,
+    Renamed,
+    Copied,
+}
+
+/// The diff of one file in a commit.
+#[derive(Debug, Clone)]
+pub struct FileDiff {
+    /// Path of the file relative to the repo root.
+    ///
+    /// For renames and copies, this is the destination path.
+    pub path: String,
+    /// Previous path, for renames and copies.
+    pub old_path: Option<String>,
+    pub status: DiffStatus,
+    /// Number of added lines, 0 for binary files.
+    pub insertions: usize,
+    /// Number of removed lines, 0 for binary files.
+    pub deletions: usize,
+    /// True if either version is binary, then `hunks` is empty.
+    pub binary: bool,
+    pub hunks: Vec<DiffHunk>,
+}
+
+/// The changes of one commit.
+#[derive(Debug, Clone)]
+pub struct CommitDiff {
+    pub files: Vec<FileDiff>,
+}
+
+/// The changes of the commit `id`, short or full, in the repository at `workdir`.
+///
+/// Compared against its first parent, the empty tree for the root commit.
+pub fn worktree_commit_diff(workdir: &Path, id: &str) -> Result<CommitDiff> {
+    commit_diff(&gix::open(workdir)?, id)
+}
+
+fn commit_diff(repo: &gix::Repository, id: &str) -> Result<CommitDiff> {
+    let commit_id = repo.rev_parse_single(id.as_bytes())?;
+    let commit = commit_id.object()?.into_commit();
+    let new_tree = commit.tree()?;
+    let old_tree = match commit.parent_ids().next() {
+        Some(parent) => Some(parent.object()?.into_commit().tree()?),
+        None => None,
+    };
+    tree_diff(repo, old_tree.as_ref(), &new_tree)
+}
+
+/// The changes between two commits, `base`..`tip`, like `git diff base tip`.
+///
+/// Directories and submodules are skipped, files are sorted by path.
+pub fn worktree_commit_range_diff(workdir: &Path, base: &str, tip: &str) -> Result<CommitDiff> {
+    let repo = gix::open(workdir)?;
+    let base_tree = repo
+        .rev_parse_single(base.as_bytes())?
+        .object()?
+        .into_commit()
+        .tree()?;
+    let tip_tree = repo
+        .rev_parse_single(tip.as_bytes())?
+        .object()?
+        .into_commit()
+        .tree()?;
+    tree_diff(&repo, Some(&base_tree), &tip_tree)
+}
+/// The changes between two trees. Used by both [`commit_diff`] and [`worktree_commit_range_diff`].
+fn tree_diff(
+    repo: &gix::Repository,
+    old_tree: Option<&gix::Tree<'_>>,
+    new_tree: &gix::Tree<'_>,
+) -> Result<CommitDiff> {
+    use gix::diff::blob::platform::prepare_diff::Operation;
+    use gix::object::tree::diff::Change;
+    use gix::objs::tree::EntryKind;
+
+    let changes = repo.diff_tree_to_tree(old_tree, Some(new_tree), None)?;
+
+    let mut cache = repo.diff_resource_cache_for_tree_diff()?;
+    let mut files = Vec::new();
+
+    for change in changes {
+        let attached = Change::from_change_ref(change.to_ref(), repo, repo);
+
+        // Skip directory trees and submodule gitlinks, only files are listed.
+        let (path, old_path, status) = match attached {
+            Change::Addition {
+                location,
+                entry_mode,
+                ..
+            } if !matches!(entry_mode.kind(), EntryKind::Tree | EntryKind::Commit) => {
+                (location.to_owned(), None, DiffStatus::Added)
+            }
+            Change::Deletion {
+                location,
+                entry_mode,
+                ..
+            } if !matches!(entry_mode.kind(), EntryKind::Tree | EntryKind::Commit) => {
+                (location.to_owned(), None, DiffStatus::Deleted)
+            }
+            Change::Modification {
+                location,
+                previous_entry_mode,
+                entry_mode,
+                ..
+            } if !matches!(entry_mode.kind(), EntryKind::Tree | EntryKind::Commit)
+                && !matches!(
+                    previous_entry_mode.kind(),
+                    EntryKind::Tree | EntryKind::Commit
+                ) =>
+            {
+                (location.to_owned(), None, DiffStatus::Modified)
+            }
+            Change::Rewrite {
+                location,
+                source_location,
+                source_entry_mode,
+                entry_mode,
+                copy,
+                ..
+            } if !matches!(entry_mode.kind(), EntryKind::Tree | EntryKind::Commit)
+                && !matches!(
+                    source_entry_mode.kind(),
+                    EntryKind::Tree | EntryKind::Commit
+                ) =>
+            {
+                let status = if copy {
+                    DiffStatus::Copied
+                } else {
+                    DiffStatus::Renamed
+                };
+                (
+                    location.to_owned(),
+                    Some(source_location.to_owned()),
+                    status,
+                )
+            }
+            _ => continue,
+        };
+
+        // Always diff with the built-in algorithm.
+        // External diff drivers would shell out, out of scope for a read-only viewer.
+        let platform = attached.diff(&mut cache)?;
+        platform
+            .resource_cache
+            .options
+            .skip_internal_diff_if_external_is_configured = true;
+        let outcome = platform.resource_cache.prepare_diff()?;
+
+        let (binary, hunks, insertions, deletions) = match outcome.operation {
+            Operation::InternalDiff { algorithm } => {
+                let input = outcome.interned_input();
+                let diff = gix::diff::blob::diff_with_slider_heuristics(algorithm, &input);
+
+                let mut hunks = Vec::new();
+                let mut insertions = 0usize;
+                let mut deletions = 0usize;
+                let collector = HunkCollector {
+                    hunks: &mut hunks,
+                    insertions: &mut insertions,
+                    deletions: &mut deletions,
+                };
+                gix::diff::blob::UnifiedDiff::new(&diff, &input, collector, Default::default())
+                    .consume()?;
+                (false, hunks, insertions, deletions)
+            }
+            Operation::SourceOrDestinationIsBinary => (true, Vec::new(), 0, 0),
+            Operation::ExternalCommand { .. } => unreachable!("external diff drivers are disabled"),
+        };
+
+        files.push(FileDiff {
+            path: String::from_utf8_lossy(&path).into_owned(),
+            old_path: old_path.map(|p| String::from_utf8_lossy(&p).into_owned()),
+            status,
+            insertions,
+            deletions,
+            binary,
+            hunks,
+        });
+    }
+
+    files.sort_by(|a, b| a.path.cmp(&b.path));
+
+    Ok(CommitDiff { files })
+}
+
+/// Collects the hunks of one blob diff while tracking per-line numbers.
+struct HunkCollector<'a> {
+    hunks: &'a mut Vec<DiffHunk>,
+    insertions: &'a mut usize,
+    deletions: &'a mut usize,
+}
+
+impl ConsumeHunk for HunkCollector<'_> {
+    type Out = ();
+
+    fn consume_hunk(
+        &mut self,
+        header: HunkHeader,
+        lines: &[(GixLineKind, &[u8])],
+    ) -> std::io::Result<()> {
+        let mut old_ln = header.before_hunk_start;
+        let mut new_ln = header.after_hunk_start;
+        let mut out = Vec::with_capacity(lines.len());
+
+        for (kind, content) in lines {
+            let text = String::from_utf8_lossy(content).into_owned();
+            let line = match kind {
+                GixLineKind::Context => {
+                    let line = DiffLine {
+                        kind: DiffLineKind::Context,
+                        old: Some(old_ln),
+                        new: Some(new_ln),
+                        text,
+                    };
+                    old_ln += 1;
+                    new_ln += 1;
+                    line
+                }
+                GixLineKind::Remove => {
+                    *self.deletions += 1;
+                    let line = DiffLine {
+                        kind: DiffLineKind::Deletion,
+                        old: Some(old_ln),
+                        new: None,
+                        text,
+                    };
+                    old_ln += 1;
+                    line
+                }
+                GixLineKind::Add => {
+                    *self.insertions += 1;
+                    let line = DiffLine {
+                        kind: DiffLineKind::Addition,
+                        old: None,
+                        new: Some(new_ln),
+                        text,
+                    };
+                    new_ln += 1;
+                    line
+                }
+            };
+            out.push(line);
+        }
+
+        self.hunks.push(DiffHunk {
+            old_start: header.before_hunk_start,
+            old_lines: header.before_hunk_len,
+            new_start: header.after_hunk_start,
+            new_lines: header.after_hunk_len,
+            lines: out,
+        });
+
+        Ok(())
+    }
+
+    fn finish(self) {}
+}

crates/signed_git/src/history.rs

@@ -0,0 +1,267 @@
+use std::collections::HashSet;
+use std::path::{Path, PathBuf};
+
+use anyhow::Result;
+
+/// In-memory object cache for history walks, see [`open_with_cache`].
+///
+/// Without one, a walk re-decodes the same commit objects from the object database.
+/// Sized generously: a walk can cover a large portion of the repository's history.
+const OBJECT_CACHE_BYTES: usize = 64 * 1024 * 1024;
+
+/// Metadata of a commit, as shown in the repository browser's file header.
+#[derive(Debug, Clone)]
+pub struct FileCommit {
+    /// Shortened commit id, 7+ hex chars, disambiguated if needed.
+    pub id: String,
+    /// First line of the commit message.
+    pub summary: String,
+    /// Rest of the commit message after the title.
+    ///
+    /// `None` for single-line commit messages.
+    pub description: Option<String>,
+    /// Author name.
+    pub author: String,
+    /// Author time, seconds since the Unix epoch.
+    pub time: i64,
+}
+
+/// Open the repository at `workdir` with an in-memory object cache.
+///
+/// Only history walks use it, they re-decode the same commit objects repeatedly.
+/// Single-object reads open the repository plain.
+pub(crate) fn open_with_cache(workdir: &Path) -> Result<gix::Repository> {
+    let mut repo = gix::open(workdir)?;
+    repo.object_cache_size_if_unset(OBJECT_CACHE_BYTES);
+    Ok(repo)
+}
+
+/// A [`FileCommit`] from a commit, with author, message title, body and shortened id.
+///
+/// The diff panel fetches the full commit on demand.
+fn file_commit(commit: &gix::Commit<'_>) -> Result<FileCommit> {
+    file_commit_with_description(commit, true)
+}
+
+/// A [`FileCommit`] without the message body, for history lists that never display it.
+///
+/// Skipping the body saves an allocation per listed commit.
+fn file_commit_summary(commit: &gix::Commit<'_>) -> Result<FileCommit> {
+    file_commit_with_description(commit, false)
+}
+
+/// [`file_commit`] and [`file_commit_summary`], `include_description` picks the body.
+fn file_commit_with_description(
+    commit: &gix::Commit<'_>,
+    include_description: bool,
+) -> Result<FileCommit> {
+    let author = commit.author()?;
+    let message = commit.message()?;
+
+    Ok(FileCommit {
+        id: commit.id().shorten_or_id().to_string(),
+        summary: String::from_utf8_lossy(message.title).trim().to_string(),
+        description: if include_description {
+            message
+                .body
+                .map(|body| String::from_utf8_lossy(body).trim().to_string())
+                .filter(|body| !body.is_empty())
+        } else {
+            None
+        },
+        author: String::from_utf8_lossy(author.name).trim().to_string(),
+        time: author.time()?.seconds,
+    })
+}
+
+/// Find the most recent commit that changed `rel`, a path relative to the worktree.
+///
+/// `Ok(None)` when no commit touched the file, e.g. an untracked file.
+pub fn last_commit(repo: &gix::Repository, rel: &Path) -> Result<Option<FileCommit>> {
+    let rel = rel.to_path_buf();
+    Ok(last_commits(repo, std::slice::from_ref(&rel))?
+        .into_iter()
+        .next()
+        .map(|(_, commit)| commit))
+}
+
+/// Newest commit touching each of `rels`, like `git log -1 -- <rel>` per path.
+/// `rels` are paths relative to the worktree.
+///
+/// Paths without any commit, like untracked files, are absent from the result.
+pub fn worktree_last_commits(
+    workdir: &Path,
+    rels: &[PathBuf],
+) -> Result<Vec<(PathBuf, FileCommit)>> {
+    last_commits(&open_with_cache(workdir)?, rels)
+}
+
+/// The walk behind [`last_commit`] and [`worktree_last_commits`].
+///
+/// Stops as soon as every pending path has its commit.
+fn last_commits(repo: &gix::Repository, rels: &[PathBuf]) -> Result<Vec<(PathBuf, FileCommit)>> {
+    use gix::traverse::commit::simple::CommitTimeOrder;
+
+    let Some(head) = repo.head_id().ok() else {
+        return Ok(Vec::new());
+    };
+
+    // De-duplicate while preserving order.
+    let mut pending: Vec<PathBuf> = Vec::with_capacity(rels.len());
+    let mut seen: HashSet<&Path> = HashSet::with_capacity(rels.len());
+
+    for rel in rels {
+        if seen.insert(rel.as_path()) {
+            pending.push(rel.clone());
+        }
+    }
+
+    let walk = repo
+        .rev_walk([head])
+        .sorting(gix::revision::walk::Sorting::ByCommitTime(
+            CommitTimeOrder::NewestFirst,
+        ));
+
+    let mut found = Vec::new();
+    for info in walk.all()? {
+        if pending.is_empty() {
+            break;
+        }
+        let info = info?;
+        let commit = info.object()?;
+        let tree = commit.tree()?;
+        let parent_tree = match info.parent_ids().next() {
+            Some(parent) => Some(parent.object()?.into_commit().tree()?),
+            None => None,
+        };
+
+        // Compare each unresolved path against this commit and its first parent.
+        // Resolved paths leave the pending set.
+        let mut ix = 0;
+        while ix < pending.len() {
+            let rel = &pending[ix];
+            let blob = tree.lookup_entry_by_path(rel)?;
+            let parent_blob = match &parent_tree {
+                Some(tree) => tree.lookup_entry_by_path(rel)?,
+                None => None,
+            };
+
+            if blob.map(|entry| entry.id().detach()) != parent_blob.map(|entry| entry.id().detach())
+            {
+                found.push((rel.clone(), file_commit(&commit)?));
+                pending.swap_remove(ix);
+            } else {
+                ix += 1;
+            }
+        }
+    }
+
+    Ok(found)
+}
+
+/// Cap on [`CommitList::commits`]. The virtual list renders a window at a time,
+/// the tab badge shows the real count.
+///
+/// A huge history is never fully materialized in memory.
+pub const MAX_LISTED_COMMITS: usize = 20_000;
+
+/// Commits reachable from `HEAD`, newest first, possibly capped.
+pub struct CommitList {
+    /// Number of commits reachable from HEAD.
+    pub total: usize,
+    /// Newest commits, capped at [`MAX_LISTED_COMMITS`].
+    pub commits: Vec<FileCommit>,
+}
+
+/// All commits reachable from `HEAD`, newest first, with author and summary.
+///
+/// Returns an empty list for a repository without any commits yet.
+pub fn all_commits(repo: &gix::Repository) -> Result<CommitList> {
+    use gix::traverse::commit::simple::CommitTimeOrder;
+
+    let Some(head) = repo.head_id().ok() else {
+        return Ok(CommitList {
+            total: 0,
+            commits: Vec::new(),
+        });
+    };
+
+    let walk = repo
+        .rev_walk([head])
+        .sorting(gix::revision::walk::Sorting::ByCommitTime(
+            CommitTimeOrder::NewestFirst,
+        ));
+
+    let mut commits = Vec::new();
+    let mut total = 0;
+
+    for info in walk.all()? {
+        let info = info?;
+        total += 1;
+        if commits.len() < MAX_LISTED_COMMITS {
+            commits.push(file_commit_summary(&info.object()?)?);
+        }
+    }
+
+    Ok(CommitList { total, commits })
+}
+
+/// Like [`all_commits`], but opens the repository at `workdir` first.
+///
+/// For non-bare clones the clone root is the worktree.
+pub fn worktree_all_commits(workdir: &Path) -> Result<CommitList> {
+    all_commits(&open_with_cache(workdir)?)
+}
+
+/// Commits in the range `base`..`tip`, newest first, like `git log base..tip`.
+pub fn worktree_commit_range_commits(
+    workdir: &Path,
+    base: &str,
+    tip: &str,
+) -> Result<Vec<FileCommit>> {
+    use gix::traverse::commit::simple::CommitTimeOrder;
+
+    let repo = open_with_cache(workdir)?;
+    let base_id = repo.rev_parse_single(base.as_bytes())?;
+    let tip_id = repo.rev_parse_single(tip.as_bytes())?;
+    let walk = repo
+        .rev_walk([tip_id])
+        .sorting(gix::revision::walk::Sorting::ByCommitTime(
+            CommitTimeOrder::NewestFirst,
+        ))
+        .with_hidden([base_id]);
+
+    let mut commits = Vec::new();
+
+    for info in walk.all()? {
+        let info = info?;
+        commits.push(file_commit_summary(&info.object()?)?);
+    }
+
+    Ok(commits)
+}
+/// The commit HEAD points to, like `git log -1`.
+///
+/// `Ok(None)` for a repository without commits yet, an unborn HEAD.
+pub fn head_commit(repo: &gix::Repository) -> Result<Option<FileCommit>> {
+    let Some(head) = repo.head_id().ok() else {
+        return Ok(None);
+    };
+    let commit = head.object()?.into_commit();
+    Ok(Some(file_commit(&commit)?))
+}
+
+/// Full metadata of the commit `id`, short or full, in the repository at `workdir`.
+/// Like [`head_commit`] for an arbitrary commit.
+///
+/// `Ok(None)` when the id cannot be resolved.
+pub fn worktree_commit(workdir: &Path, id: &str) -> Result<Option<FileCommit>> {
+    let repo = gix::open(workdir)?;
+    match repo.rev_parse_single(id.as_bytes()) {
+        Ok(commit_id) => {
+            let commit = commit_id.object()?.into_commit();
+            Ok(Some(file_commit(&commit)?))
+        }
+        Err(_) => Ok(None),
+    }
+}

crates/signed_git/src/patch.rs

@@ -0,0 +1,323 @@
+use std::io::Write;
+use std::path::Path;
+use std::process::{Command, Stdio};
+
+use anyhow::{Context, Result, bail};
+use diffy::patch_set::{FileOperation, FilePatch, ParseOptions, PatchSet};
+use diffy::{Hunk, Line};
+
+use crate::diff::{CommitDiff, DiffHunk, DiffLine, DiffLineKind, DiffStatus, FileDiff};
+use crate::history::FileCommit;
+
+/// Apply a `git format-patch` patch or series with `git am`,
+/// uses the git CLI because it handles the mbox format natively.
+///
+/// TODO: Replaced with a pure-Rust implementation later without changing callers.
+pub fn apply_patch(repo_path: &Path, patch: &str) -> Result<()> {
+    let mut child = Command::new("git")
+        .arg("am")
+        .current_dir(repo_path)
+        .stdin(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .context("failed to spawn `git am`")?;
+
+    child
+        .stdin
+        .as_mut()
+        .expect("stdin piped")
+        .write_all(patch.as_bytes())?;
+
+    let output = child.wait_with_output()?;
+
+    if !output.status.success() {
+        bail!("git am failed: {}", String::from_utf8_lossy(&output.stderr));
+    }
+
+    Ok(())
+}
+
+/// The `git format-patch` mbox series of `base..tip`, like `git format-patch --stdout`.
+/// Fails when the range has no commits.
+///
+/// The mbox is returned untrimmed. Trailing newlines are part of the format.
+pub fn format_patch_between(repo_path: &Path, base: &str, tip: &str) -> Result<String> {
+    let output = Command::new("git")
+        .arg("-C")
+        .arg(repo_path)
+        .args(["format-patch", "--stdout", &format!("{base}..{tip}")])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .stderr(Stdio::piped())
+        .output()
+        .context("failed to spawn `git format-patch`")?;
+
+    if !output.status.success() {
+        bail!(
+            "git format-patch failed: {}",
+            String::from_utf8_lossy(&output.stderr).trim()
+        );
+    }
+
+    let patch = String::from_utf8_lossy(&output.stdout).into_owned();
+
+    if patch.trim().is_empty() {
+        bail!("no commits between {base} and {tip}");
+    }
+
+    Ok(patch)
+}
+
+/// Split a `git format-patch` series into its individual patches, mbox messages.
+///
+/// A single patch yields one element.
+/// A malformed input yields one element covering it.
+pub fn split_patch_series(patch: &str) -> Vec<&str> {
+    let mut starts = vec![0usize];
+    let mut search_from = 1;
+
+    while let Some(rel) = patch[search_from..].find("\nFrom ") {
+        let ix = search_from + rel + 1;
+        let hex = patch[ix + 5..]
+            .split(|c: char| !c.is_ascii_hexdigit())
+            .next()
+            .unwrap_or("");
+        if hex.len() == 40 {
+            starts.push(ix);
+        }
+        search_from = ix + 1;
+    }
+
+    starts
+        .iter()
+        .enumerate()
+        .map(|(i, &start)| {
+            let end = starts.get(i + 1).copied().unwrap_or(patch.len());
+            &patch[start..end]
+        })
+        .collect()
+}
+
+/// Parse `git format-patch` output, a single patch or a series.
+///
+/// Backed by [`diffy::patch_set`], which implements git's extended diff format:
+/// `diff --git` headers, rename and copy detection, binary detection, and
+/// C-style quoted or octal-escaped paths.
+pub fn patch_diffs(patch: &str) -> Result<CommitDiff> {
+    if !patch.lines().any(|line| line.starts_with("diff --git ")) {
+        return Ok(CommitDiff { files: Vec::new() });
+    }
+
+    let mut files = Vec::new();
+
+    for file in PatchSet::parse(patch, ParseOptions::gitdiff()) {
+        files.push(file_diff(file?)?);
+    }
+
+    Ok(CommitDiff { files })
+}
+
+/// The [`FileDiff`] of one parsed file patch.
+fn file_diff(file: FilePatch<'_, str>) -> Result<FileDiff> {
+    // The `---`/`+++` paths carry the `a/`/`b/` prefix, so the first path
+    // component is dropped, the same way `git apply -p1` does.
+    // Rename and copy paths come from their own headers, unprefixed.
+    let stripped;
+    let operation = match file.operation() {
+        operation @ (FileOperation::Rename { .. } | FileOperation::Copy { .. }) => operation,
+        operation => {
+            stripped = operation.strip_prefix(1);
+            &stripped
+        }
+    };
+
+    let (path, old_path, status) = match operation {
+        FileOperation::Create(path) => (path.as_ref(), None, DiffStatus::Added),
+        FileOperation::Delete(path) => (path.as_ref(), None, DiffStatus::Deleted),
+        FileOperation::Modify { modified, .. } => (modified.as_ref(), None, DiffStatus::Modified),
+        FileOperation::Rename { from, to } => {
+            (to.as_ref(), Some(from.as_ref()), DiffStatus::Renamed)
+        }
+        FileOperation::Copy { from, to } => (to.as_ref(), Some(from.as_ref()), DiffStatus::Copied),
+    };
+
+    let mut insertions = 0usize;
+    let mut deletions = 0usize;
+    let mut hunks = Vec::new();
+
+    let patch = file.patch();
+
+    if let Some(text) = patch.as_text() {
+        for hunk in text.hunks() {
+            let hunk = hunk_diff(hunk);
+            insertions += hunk
+                .lines
+                .iter()
+                .filter(|line| line.kind == DiffLineKind::Addition)
+                .count();
+            deletions += hunk
+                .lines
+                .iter()
+                .filter(|line| line.kind == DiffLineKind::Deletion)
+                .count();
+            hunks.push(hunk);
+        }
+    }
+
+    Ok(FileDiff {
+        path: path.to_owned(),
+        old_path: old_path.map(str::to_owned),
+        status,
+        insertions,
+        deletions,
+        binary: patch.is_binary(),
+        hunks,
+    })
+}
+
+/// The [`DiffHunk`] of one parsed hunk, including the line number of every line.
+///
+/// `diffy` reports only the hunk header ranges. The per-line numbers are
+/// counted from them the way the header encodes them: context lines advance
+/// both sides, deletions only the old, insertions only the new.
+fn hunk_diff(hunk: &Hunk<'_, str>) -> DiffHunk {
+    let old_range = hunk.old_range();
+    let new_range = hunk.new_range();
+
+    let mut old = old_range.start() as u32;
+    let mut new = new_range.start() as u32;
+    let mut lines = Vec::with_capacity(hunk.lines().len());
+
+    for line in hunk.lines() {
+        let (kind, text) = match line {
+            Line::Context(text) => (DiffLineKind::Context, *text),
+            Line::Delete(text) => (DiffLineKind::Deletion, *text),
+            Line::Insert(text) => (DiffLineKind::Addition, *text),
+        };
+
+        let (old_no, new_no) = match kind {
+            DiffLineKind::Context => {
+                let numbers = (Some(old), Some(new));
+                old += 1;
+                new += 1;
+                numbers
+            }
+            DiffLineKind::Addition => {
+                let number = Some(new);
+                new += 1;
+                (None, number)
+            }
+            DiffLineKind::Deletion => {
+                let number = Some(old);
+                old += 1;
+                (number, None)
+            }
+        };
+
+        lines.push(DiffLine {
+            kind,
+            old: old_no,
+            new: new_no,
+            text: line_text(text),
+        });
+    }
+
+    DiffHunk {
+        old_start: old_range.start() as u32,
+        old_lines: old_range.len() as u32,
+        new_start: new_range.start() as u32,
+        new_lines: new_range.len() as u32,
+        lines,
+    }
+}
+
+/// The content of a parsed line without its line ending.
+///
+/// `diffy` keeps the trailing `\n`, the way `str::lines` splits it off.
+fn line_text(text: &str) -> String {
+    let text = text.strip_suffix('\n').unwrap_or(text);
+    text.strip_suffix('\r').unwrap_or(text).to_owned()
+}
+
+/// Commits of a `git format-patch` output, a single patch or a series.
+///
+/// Entries appear in patch order, oldest first as `git format-patch` produces them.
+pub fn patch_commits(patch: &str) -> Vec<FileCommit> {
+    let lines: Vec<&str> = patch.lines().collect();
+
+    let mut commits = Vec::new();
+    let mut i = 0;
+
+    while i < lines.len() {
+        // A patch starts with its `From <id> <date>` envelope line.
+        let Some(rest) = lines[i].strip_prefix("From ") else {
+            i += 1;
+            continue;
+        };
+
+        let Some(id) = rest.split_whitespace().next() else {
+            i += 1;
+            continue;
+        };
+
+        if id.len() != 40 {
+            i += 1;
+            continue;
+        }
+
+        let mut author = String::new();
+        let mut summary = String::new();
+        let mut time = 0i64;
+
+        // Envelope headers run up to the blank line before the commit message.
+        i += 1;
+        while i < lines.len() && !lines[i].is_empty() {
+            let header = lines[i];
+            if let Some(value) = header.strip_prefix("From: ") {
+                author = name_from_address(value);
+            } else if let Some(value) = header.strip_prefix("Subject: ") {
+                summary = strip_patch_prefix(value);
+            } else if let Some(value) = header.strip_prefix("Date: ") {
+                time = gix::date::parse(value.trim(), None)
+                    .map(|t| t.seconds)
+                    .unwrap_or(0);
+            }
+            i += 1;
+        }
+
+        commits.push(FileCommit {
+            id: id.to_string(),
+            summary,
+            description: None,
+            author,
+            time,
+        });
+    }
+
+    commits
+}
+
+/// The name part of a `From: Name <email>` header value.
+fn name_from_address(from: &str) -> String {
+    match from.trim().find('<') {
+        Some(ix) => from[..ix].trim().to_string(),
+        None => from.trim().to_string(),
+    }
+}
+
+/// Strip the patch prefix from a `Subject:` header.
+///
+/// Examples are `[PATCH]`, `[PATCH 1/2]` and `[RFC PATCH]`.
+fn strip_patch_prefix(subject: &str) -> String {
+    let trimmed = subject.trim();
+    let Some(rest) = trimmed.strip_prefix('[') else {
+        return trimmed.to_string();
+    };
+    let Some(end) = rest.find(']') else {
+        return trimmed.to_string();
+    };
+    if rest[..end].to_ascii_lowercase().contains("patch") {
+        rest[end + 1..].trim().to_string()
+    } else {
+        trimmed.to_string()
+    }
+}

crates/signed_git/src/remote.rs

@@ -0,0 +1,357 @@
+use std::collections::HashMap;
+use std::path::Path;
+use std::process::{Command, Stdio};
+
+use anyhow::{Context, Result, bail};
+use gix::interrupt::IS_INTERRUPTED;
+use gix::progress::Discard;
+
+/// Clone into `path` from the first working URL in `clone_urls`.
+///
+/// Unlike [`GitCache::ensure_clone`], the clone is not kept in any cache.
+pub fn clone_repo<U: AsRef<str>>(clone_urls: &[U], path: &Path) -> Result<()> {
+    if path.exists() {
+        bail!("destination {} already exists", path.display());
+    }
+
+    try_each_url(clone_urls, "clone", |url| {
+        let repo = clone(url, path)?;
+        // The initial clone uses the default refspecs. Also fetch the `refs/nostr/*` PR refs.
+        fetch_all(&repo).ok();
+        Ok(())
+    })
+}
+
+/// Fetch all configured refspecs from `origin`, plus the `refs/nostr/*` namespace.
+pub fn fetch_all(repo: &gix::Repository) -> Result<()> {
+    let options = gix::remote::ref_map::Options {
+        extra_refspecs: vec![
+            gix::refspec::parse(
+                gix::bstr::BStr::new("+refs/nostr/*:refs/nostr/*"),
+                gix::refspec::parse::Operation::Fetch,
+            )?
+            .to_owned(),
+        ],
+        ..Default::default()
+    };
+    repo.find_remote("origin")?
+        .connect(gix::remote::Direction::Fetch)?
+        .prepare_fetch(Discard, options)?
+        .receive(Discard, &IS_INTERRUPTED)?;
+    Ok(())
+}
+
+/// Push `commit` to `reference` on the server at `url`, from `repo_path`.
+pub fn push_commit_ref(repo_path: &Path, url: &str, commit: &str, reference: &str) -> Result<()> {
+    let output = Command::new("git")
+        .arg("-C")
+        .arg(repo_path)
+        .args(["push"])
+        .arg(url)
+        .arg(format!("{commit}:{reference}"))
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .stderr(Stdio::piped())
+        .output()
+        .context("failed to spawn `git push`")?;
+
+    if !output.status.success() {
+        bail!(
+            "git push failed: {}",
+            String::from_utf8_lossy(&output.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+/// Rewrite a grasp server URL to the https URL the git transport actually uses.
+///
+/// GRASP servers announce `grasp://<host>/<owner>/<repo>` clone URLs.
+/// The transport is git smart HTTP, so the scheme is rewritten for gix.
+fn transport_url(url: &str) -> String {
+    url.strip_prefix("grasp://")
+        .map(|rest| format!("https://{rest}"))
+        .unwrap_or_else(|| url.to_owned())
+}
+
+/// Run `attempt` against each URL in `urls` until one succeeds.
+///
+/// Returns the last error wrapped in `failed to {verb} from any mirror`,
+/// or `no clone URLs provided` when the list is empty.
+fn try_each_url<U: AsRef<str>, F>(urls: &[U], verb: &str, mut attempt: F) -> Result<()>
+where
+    F: FnMut(&str) -> Result<()>,
+{
+    let mut last_err: Option<anyhow::Error> = None;
+
+    for url in urls {
+        match attempt(url.as_ref()) {
+            Ok(()) => return Ok(()),
+            Err(e) => last_err = Some(e),
+        }
+    }
+
+    match last_err {
+        Some(e) => Err(e).context(format!("failed to {verb} from any mirror")),
+        None => bail!("no clone URLs provided"),
+    }
+}
+
+fn clone(url: &str, path: &Path) -> Result<gix::Repository> {
+    let url = transport_url(url);
+    let url = gix::url::parse(url).context("invalid clone URL")?;
+
+    let mut prepare = gix::prepare_clone(url, path)?;
+    let (mut checkout, _fetch) = prepare.fetch_then_checkout(Discard, &IS_INTERRUPTED)?;
+    let (repo, _checkout) = checkout.main_worktree(Discard, &IS_INTERRUPTED)?;
+
+    Ok(repo)
+}
+
+/// Push the `main` branch of the repository at `repo_path` to a grasp server.
+pub fn push_main(repo_path: &Path, base_url: &str, owner: &str, repo_id: &str) -> Result<()> {
+    push_refspecs(
+        repo_path,
+        base_url,
+        owner,
+        repo_id,
+        &["refs/heads/main:refs/heads/main"],
+    )
+}
+
+/// Push every local branch and tag of the repository at `repo_path` to a grasp server.
+///
+/// This mirrors an initialized repository's whole history.
+pub fn push_all(repo_path: &Path, base_url: &str, owner: &str, repo_id: &str) -> Result<()> {
+    push_refspecs(
+        repo_path,
+        base_url,
+        owner,
+        repo_id,
+        &["refs/heads/*:refs/heads/*", "refs/tags/*:refs/tags/*"],
+    )
+}
+
+/// Push `refspecs` to the grasp server URL derived from `base_url`, `owner` and `repo_id`.
+fn push_refspecs(
+    repo_path: &Path,
+    base_url: &str,
+    owner: &str,
+    repo_id: &str,
+    refspecs: &[&str],
+) -> Result<()> {
+    let url = format!("{base_url}/{owner}/{repo_id}.git");
+
+    let mut args: Vec<&str> = Vec::with_capacity(refspecs.len() + 2);
+    args.push("push");
+    args.push(&url);
+    args.extend_from_slice(refspecs);
+
+    let output = git_output(repo_path, &args, "git push")?;
+
+    if !output.status.success() {
+        bail!(
+            "git push to {base_url} failed: {}",
+            String::from_utf8_lossy(&output.stderr).trim()
+        );
+    }
+    Ok(())
+}
+
+/// Whether `url` advertises every ref in `expected` at the given commit.
+///
+/// Extra advertised refs are ignored: the question is whether the data this
+/// push wanted to land is already there, not whether the remote is an exact mirror.
+/// This is the convergence probe for a push that lost the compare-and-swap race
+/// to the grasp server's own background ref alignment.
+pub fn remote_has_refs(repo_path: &Path, url: &str, expected: &[(String, String)]) -> Result<bool> {
+    if expected.is_empty() {
+        return Ok(true);
+    }
+
+    let repo = gix::open(repo_path)?;
+    let url = transport_url(url);
+
+    // A URL-created remote has no configured fetch refspecs, and `ref_map` only
+    // keeps refs that match one. Match each expected ref by its exact name,
+    // like `git ls-remote <url> <name>` would; ref maps never write to the repository.
+    let refspecs = expected
+        .iter()
+        .map(|(name, _)| {
+            gix::refspec::parse(
+                gix::bstr::BStr::new(format!("+{name}:{name}").as_bytes()),
+                gix::refspec::parse::Operation::Fetch,
+            )
+            .map(|spec| spec.to_owned())
+        })
+        .collect::<Result<Vec<_>, _>>()
+        .context("invalid refspec")?;
+
+    let options = gix::remote::ref_map::Options {
+        extra_refspecs: refspecs,
+        ..Default::default()
+    };
+
+    let (refs, _) = repo
+        .remote_at(url.as_str())
+        .with_context(|| format!("cannot use remote {url}"))?
+        .connect(gix::remote::Direction::Fetch)
+        .with_context(|| format!("cannot connect to {url}"))?
+        .ref_map(Discard, options)
+        .with_context(|| format!("listing refs of {url} failed"))?;
+
+    // Peeled tag entries carry the tag object in their direct oid, so mapping
+    // each advertised ref to its direct oid matches `git ls-remote` while
+    // skipping the duplicated `^{}` lines.
+    let advertised: HashMap<String, String> = refs
+        .remote_refs
+        .iter()
+        .filter_map(|reference| {
+            let (name, object, _peeled) = reference.unpack();
+            object.map(|oid| (String::from_utf8_lossy(name).into_owned(), oid.to_string()))
+        })
+        .collect();
+
+    Ok(expected
+        .iter()
+        .all(|(name, oid)| advertised.get(name.as_str()) == Some(oid)))
+}
+
+/// Add `origin` pointing at `url` when the repository has no remote yet.
+///
+/// No-op if `origin` already exists.
+pub fn ensure_origin(repo_path: &Path, url: &str) -> Result<()> {
+    let repo = gix::open(repo_path)?;
+    if repo.find_remote("origin").is_ok() {
+        return Ok(());
+    }
+
+    // `git remote add` also configures the default fetch refspec.
+    edit_local_config(&repo, |config| {
+        config.set_raw_value("remote.origin.url", url)?;
+        config.set_raw_value("remote.origin.fetch", "+refs/heads/*:refs/remotes/origin/*")?;
+        Ok(())
+    })
+}
+
+/// Point `origin` at `url`, replacing an existing remote,
+/// used after a clone whose `origin` points at the cloned-from path.
+///
+/// A working copy cloned from a local mirror is re-targeted at the grasp server.
+pub fn set_origin(repo_path: &Path, url: &str) -> Result<()> {
+    let repo = gix::open(repo_path)?;
+    let had_origin = repo.find_remote("origin").is_ok();
+
+    edit_local_config(&repo, |config| {
+        // Replaces the existing url, like `git remote set-url origin <url>`.
+        // A pre-existing fetch refspec is left untouched.
+        config.set_raw_value("remote.origin.url", url)?;
+
+        if !had_origin {
+            config.set_raw_value("remote.origin.fetch", "+refs/heads/*:refs/remotes/origin/*")?;
+        }
+
+        Ok(())
+    })
+}
+
+/// Apply `edit` to the repository-local configuration and persist it.
+///
+/// The config file is locked while it is read, edited and written back,
+/// like git would when running `git config` or `git remote`.
+fn edit_local_config(
+    repo: &gix::Repository,
+    edit: impl FnOnce(&mut gix::config::File) -> Result<()>,
+) -> Result<()> {
+    let config_path = repo.common_dir().join("config");
+
+    let mut lock = gix::lock::File::acquire_to_update_resource(
+        &config_path,
+        gix::lock::acquire::Fail::Immediately,
+        None,
+    )
+    .context("failed to lock repository config")?;
+
+    let mut config =
+        match gix::config::File::from_path_no_includes(config_path, gix::config::Source::Local) {
+            Ok(config) => config,
+            // A repository without a config file yet starts from scratch.
+            Err(gix::config::file::init::from_paths::Error::Io { source, .. })
+                if source.kind() == std::io::ErrorKind::NotFound =>
+            {
+                gix::config::File::default()
+            }
+            Err(error) => return Err(error).context("failed to read repository config"),
+        };
+
+    edit(&mut config)?;
+
+    config
+        .write_to(&mut lock)
+        .context("failed to write repository config")?;
+
+    lock.commit().context("failed to save repository config")?;
+
+    Ok(())
+}
+
+/// Fetch `refspec` into `repo_path` from the first working URL in `urls`.
+/// When no URL works, the last error is returned.
+///
+/// Never touches the checked-out refs or the worktree.
+pub fn fetch_repo_refs<U: AsRef<str>>(repo_path: &Path, urls: &[U], refspec: &str) -> Result<()> {
+    let repo = gix::open(repo_path)?;
+    let refspec = gix::refspec::parse(
+        gix::bstr::BStr::new(refspec),
+        gix::refspec::parse::Operation::Fetch,
+    )
+    .context("invalid fetch refspec")?
+    .to_owned();
+
+    try_each_url(urls, "fetch", |url| {
+        let url = transport_url(url);
+        let options = gix::remote::ref_map::Options {
+            extra_refspecs: vec![refspec.clone()],
+            ..Default::default()
+        };
+        repo.remote_at(url.as_str())
+            .with_context(|| format!("fetch from {url} failed"))?
+            .connect(gix::remote::Direction::Fetch)
+            .with_context(|| format!("fetch from {url} failed"))?
+            .prepare_fetch(Discard, options)
+            .with_context(|| format!("fetch from {url} failed"))?
+            .receive(Discard, &IS_INTERRUPTED)
+            .with_context(|| format!("fetch from {url} failed"))?;
+        Ok(())
+    })
+}
+
+/// The URL of the `origin` remote of the repository at `workdir`.
+///
+/// `None` when it has no `origin` yet.
+pub fn origin_url(workdir: &Path) -> Result<Option<String>> {
+    let Ok(repo) = gix::open(workdir) else {
+        return Ok(None);
+    };
+
+    let Ok(remote) = repo.find_remote("origin") else {
+        return Ok(None);
+    };
+
+    Ok(remote
+        .url(gix::remote::Direction::Fetch)
+        .map(|url| url.to_string()))
+}
+
+/// Run `git -C dir args`, disabling the terminal prompt and capturing stderr.
+///
+/// `what` names the command in the spawn error.
+pub(crate) fn git_output(dir: &Path, args: &[&str], what: &str) -> Result<std::process::Output> {
+    Command::new("git")
+        .arg("-C")
+        .arg(dir)
+        .args(args)
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .stderr(Stdio::piped())
+        .output()
+        .with_context(|| format!("failed to spawn `{what}`"))
+}

crates/signed_git/src/repo.rs

@@ -0,0 +1,488 @@
+use std::path::Path;
+
+use anyhow::{Context, Result, bail};
+
+use crate::history::open_with_cache;
+use crate::worktree::{force_checkout, worktree_dirty};
+
+/// The merge base of two revisions in the repository at `repo_path`,
+/// revisions may be branch names, remote-tracking refs or commit ids.
+///
+/// `Ok(None)` when the revisions share no common ancestor.
+///
+/// Unresolvable revisions are errors.
+pub fn merge_base(repo_path: &Path, a: &str, b: &str) -> Result<Option<String>> {
+    let repo = open_with_cache(repo_path)?;
+    let a = repo.rev_parse_single(a.as_bytes())?;
+    let b = repo.rev_parse_single(b.as_bytes())?;
+    match repo.merge_base(a, b) {
+        Ok(id) => Ok(Some(id.to_string())),
+        // No common ancestor, a valid outcome for a proposal.
+        Err(gix::repository::merge_base::Error::NotFound { .. }) => Ok(None),
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// The commit HEAD points to in the repository at `repo_path`.
+///
+/// `None` when the repository has no commits yet, an unborn HEAD.
+pub fn head_commit_id(repo_path: &Path) -> Result<Option<String>> {
+    let Ok(repo) = gix::open(repo_path) else {
+        return Ok(None);
+    };
+
+    match repo.head_id() {
+        Ok(id) => Ok(Some(id.to_string())),
+        Err(_) => Ok(None),
+    }
+}
+
+/// The commits in `base..HEAD` of the repository at `repo_path`, oldest first.
+/// This is the order `git am` creates them.
+///
+/// `HEAD` alone when `base` is `None`.
+pub fn commits_since(repo_path: &Path, base: Option<&str>) -> Result<Vec<String>> {
+    let repo = match gix::open(repo_path) {
+        Ok(repo) => repo,
+        Err(_) if base.is_none() => return Ok(Vec::new()),
+        Err(e) => return Err(e.into()),
+    };
+
+    let head = match repo.head_id() {
+        Ok(head) => head,
+        Err(_) if base.is_none() => return Ok(Vec::new()),
+        Err(e) => return Err(e).context("repository has no commits"),
+    };
+
+    let Some(base) = base else {
+        // `HEAD` alone when no base is given.
+        return Ok(vec![head.to_string()]);
+    };
+
+    let base = repo.rev_parse_single(base.as_bytes())?;
+    let mut commits = Vec::new();
+
+    for info in repo
+        .rev_walk([head])
+        .sorting(gix::revision::walk::Sorting::ByCommitTime(
+            gix::traverse::commit::simple::CommitTimeOrder::NewestFirst,
+        ))
+        .with_hidden([base])
+        .all()?
+    {
+        commits.push(info?.id().to_string());
+    }
+
+    // Oldest first, like `git rev-list --reverse`, the order `git am` creates them.
+    commits.reverse();
+
+    Ok(commits)
+}
+
+/// The identity written to reflogs and commits created by this crate itself.
+///
+/// Like `git -c user.name=… -c user.email=…` per invocation: the repository works
+/// without a global git identity, and `gix` runs no hooks and never signs.
+pub(crate) fn repository_signature() -> (gix::actor::Signature, gix::date::parse::TimeBuf) {
+    let seconds = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|duration| duration.as_secs() as i64)
+        .unwrap_or_default();
+
+    let signature = gix::actor::Signature {
+        name: gix::bstr::BString::from("Signed"),
+        email: gix::bstr::BString::from("signed@localhost"),
+        time: gix::date::Time { seconds, offset: 0 },
+    };
+
+    (signature, gix::date::parse::TimeBuf::default())
+}
+
+/// Create a repository at `path` with an initial `main` branch.
+/// Write a `README.md` from `name` and `description`, then create the initial commit.
+///
+/// Returns the initial commit id.
+pub fn init_repository(path: &Path, name: &str, description: &str) -> Result<String> {
+    use gix::refs::transaction::{Change, LogChange, PreviousValue, RefEdit, RefLog};
+
+    std::fs::create_dir_all(path)
+        .with_context(|| format!("failed to create {}", path.display()))?;
+
+    let repo = gix::init(path)?;
+
+    let (signature, mut time_buf) = repository_signature();
+    let signature = signature.to_ref(&mut time_buf);
+
+    // The initial branch is `main`, regardless of `init.defaultBranch` in
+    // the user's git configuration: point the unborn HEAD there.
+    let head = gix::refs::FullName::try_from("HEAD")
+        .map_err(|e| anyhow::anyhow!("invalid ref name: {e}"))?;
+
+    repo.edit_references_as(
+        [RefEdit {
+            change: Change::Update {
+                log: LogChange {
+                    mode: RefLog::AndReference,
+                    force_create_reflog: false,
+                    message: "checkout: moving to main".into(),
+                },
+                expected: PreviousValue::Any,
+                new: gix::refs::Target::Symbolic(
+                    gix::refs::FullName::try_from("refs/heads/main")
+                        .map_err(|e| anyhow::anyhow!("invalid ref name: {e}"))?,
+                ),
+            },
+            name: head,
+            deref: false,
+        }],
+        Some(signature),
+    )?;
+
+    let readme = if description.trim().is_empty() {
+        format!("# {name}\n")
+    } else {
+        format!("# {name}\n\n{description}\n")
+    };
+
+    std::fs::write(path.join("README.md"), &readme).context("failed to write README.md")?;
+
+    let blob = repo.write_object(gix::objs::Blob {
+        data: readme.into_bytes(),
+    })?;
+
+    let tree = repo.write_object(gix::objs::Tree {
+        entries: vec![gix::objs::tree::Entry {
+            mode: gix::objs::tree::EntryKind::Blob.into(),
+            filename: gix::bstr::BString::from("README.md"),
+            oid: blob.into(),
+        }],
+    })?;
+
+    let commit = repo.commit_as(
+        signature,
+        signature,
+        "HEAD",
+        "Initial commit",
+        tree,
+        Vec::<gix::ObjectId>::new(),
+    )?;
+
+    // Populate the index so the fresh repository is clean,
+    // as `git add` and`git commit` would leave it.
+    let mut index = repo.index_from_tree(&tree)?;
+    index.write(gix::index::write::Options::default())?;
+
+    let commit = commit.to_string();
+    if commit.len() != 40 {
+        bail!("unexpected initial commit id: {commit}");
+    }
+
+    Ok(commit)
+}
+
+/// The earliest unique commit of the repository at `repo_path`.
+/// Used as the NIP-34 announcement's `euc` marker.
+///
+/// `None` for a repository without commits.
+pub fn root_commit(repo_path: &Path) -> Result<Option<String>> {
+    let Ok(repo) = gix::open(repo_path) else {
+        return Ok(None);
+    };
+
+    let Ok(head) = repo.head_id() else {
+        // An unborn HEAD with no commits yet has no root commit.
+        return Ok(None);
+    };
+
+    for info in repo
+        .rev_walk([head])
+        .sorting(gix::revision::walk::Sorting::ByCommitTime(
+            gix::traverse::commit::simple::CommitTimeOrder::NewestFirst,
+        ))
+        .all()?
+    {
+        let info = info?;
+        if info.parent_ids().next().is_none() {
+            let id = info.id().to_string();
+            return Ok((id.len() == 40).then_some(id));
+        }
+    }
+
+    Ok(None)
+}
+
+/// Full ref names under `prefix`, sorted lexicographically, like `git for-each-ref`.
+/// `prefix` is a ref namespace like `refs/fork/<owner>/<id>`.
+///
+/// Returns an empty list when nothing matches.
+pub fn refs_with_prefix(repo_path: &Path, prefix: &str) -> Result<Vec<String>> {
+    let pattern = prefix.trim_end_matches('/');
+    let repo = gix::open(repo_path)?;
+    let mut names = Vec::new();
+
+    for reference in repo.references()?.all()? {
+        let reference = reference.map_err(|error| anyhow::anyhow!("{error}"))?;
+        let name = String::from_utf8_lossy(reference.name().as_bstr()).into_owned();
+
+        // Match the pattern itself and everything beneath it, like `git for-each-ref`.
+        let under_pattern = name
+            .strip_prefix(pattern)
+            .is_some_and(|rest| rest.is_empty() || rest.starts_with('/'));
+
+        if under_pattern {
+            names.push(name);
+        }
+    }
+
+    // Sort lexicographically, like `git for-each-ref`.
+    names.sort();
+
+    Ok(names)
+}
+
+/// Delete every ref under `prefix` of the repository at `repo_path`.
+/// `prefix` is a ref namespace like `refs/fork/<owner>/<id>`.
+pub fn delete_refs_with_prefix(repo_path: &Path, prefix: &str) -> Result<()> {
+    use gix::refs::transaction::{Change, PreviousValue, RefEdit, RefLog};
+
+    let refs = refs_with_prefix(repo_path, prefix)?;
+    if refs.is_empty() {
+        return Ok(());
+    }
+
+    let repo = gix::open(repo_path)?;
+    let edits: Vec<RefEdit> = refs
+        .iter()
+        .map(|name| {
+            let full = gix::refs::FullName::try_from(name.as_str())
+                .map_err(|e| anyhow::anyhow!("invalid ref name {name}: {e}"))?;
+            Ok(RefEdit {
+                change: Change::Delete {
+                    expected: PreviousValue::Any,
+                    log: RefLog::AndReference,
+                },
+                name: full,
+                deref: false,
+            })
+        })
+        .collect::<Result<Vec<_>>>()?;
+
+    // Delete all refs with the given prefix.
+    repo.edit_references(edits)?;
+
+    Ok(())
+}
+
+/// Short name of the branch HEAD points to at `workdir`,
+/// `None` when detached or unreadable, like `git branch --show-current`.
+pub fn worktree_current_branch(workdir: &Path) -> Option<String> {
+    let repo = gix::open(workdir).ok()?;
+    let head = repo.head().ok()?;
+    let name = head.referent_name()?;
+    Some(String::from_utf8_lossy(name.shorten()).into_owned())
+}
+
+/// Whether the reference `name` exists in the repository at `workdir`.
+pub fn worktree_ref_exists(workdir: &Path, name: &str) -> bool {
+    let Ok(repo) = gix::open(workdir) else {
+        return false;
+    };
+    repo.find_reference(name).is_ok()
+}
+
+/// Fast-forward local branches that trail their remote-tracking counterpart.
+///
+/// Returns whether any branch moved.
+pub fn fast_forward_branches(workdir: &Path) -> Result<bool> {
+    let repo = gix::open(workdir)?;
+    let current = worktree_current_branch(workdir);
+    let heads = refs_with_prefix(workdir, "refs/heads")?;
+
+    let (signature, mut time_buf) = repository_signature();
+    let signature = signature.to_ref(&mut time_buf);
+
+    let mut moved = false;
+
+    for head in heads {
+        let Some(branch) = head.strip_prefix("refs/heads/") else {
+            continue;
+        };
+
+        let remote = format!("refs/remotes/origin/{branch}");
+        // No remote-tracking counterpart means the remote lacks this branch.
+        let Ok(mut remote_reference) = repo.find_reference(&remote) else {
+            continue;
+        };
+
+        let Ok(mut local_reference) = repo.find_reference(&head) else {
+            continue;
+        };
+
+        let Ok(remote_oid) = remote_reference.peel_to_id() else {
+            continue;
+        };
+
+        let Ok(local_oid) = local_reference.peel_to_id() else {
+            continue;
+        };
+
+        let remote_oid = remote_oid.detach();
+        let local_oid = local_oid.detach();
+
+        if local_oid == remote_oid {
+            continue;
+        }
+
+        // Only fast-forward.
+        // Local-only commits or diverged history must never be rewritten by a refresh.
+        let Ok(base) = repo.merge_base(local_oid, remote_oid) else {
+            continue;
+        };
+
+        if base != local_oid {
+            continue;
+        }
+
+        let full = gix::refs::FullName::try_from(head.as_str())
+            .map_err(|e| anyhow::anyhow!("invalid ref name: {e}"))?;
+
+        let edit = |new: gix::refs::Target| {
+            use gix::refs::transaction::{Change, LogChange, PreviousValue, RefEdit, RefLog};
+            RefEdit {
+                change: Change::Update {
+                    log: LogChange {
+                        mode: RefLog::AndReference,
+                        force_create_reflog: false,
+                        message: format!("merge {remote}: Fast-forward").into(),
+                    },
+                    expected: PreviousValue::ExistingMustMatch(gix::refs::Target::Object(
+                        local_oid,
+                    )),
+                    new,
+                },
+                name: full.clone(),
+                deref: false,
+            }
+        };
+
+        if current.as_deref() == Some(branch) {
+            // Merge so the checked-out worktree follows the branch.
+            // Only proceed on a clean worktree, like `git merge --ff-only`.
+            if worktree_dirty(workdir) {
+                continue;
+            }
+
+            let tree = repo.find_object(remote_oid)?.peel_to_tree()?.id;
+
+            // Check out the remote tree, discarding local changes.
+            force_checkout(&repo, &tree)?;
+
+            // Update the branch reference to point to the remote tree.
+            repo.edit_references_as(
+                [edit(gix::refs::Target::Object(remote_oid))],
+                Some(signature),
+            )?;
+
+            moved = true;
+        } else {
+            // Update the branch reference to point to the remote tree.
+            repo.edit_references_as(
+                [edit(gix::refs::Target::Object(remote_oid))],
+                Some(signature),
+            )?;
+
+            moved = true;
+        }
+    }
+
+    Ok(moved)
+}
+
+/// Short names of local branches, `refs/heads/*`, of `repo`, sorted alphabetically.
+pub fn repo_branches(repo: &gix::Repository) -> Result<Vec<String>> {
+    let mut names = Vec::new();
+    for reference in repo.references()?.local_branches()? {
+        let reference = reference.map_err(|error| anyhow::anyhow!("{error}"))?;
+        names.push(String::from_utf8_lossy(reference.name().shorten()).into_owned());
+    }
+    names.sort();
+    Ok(names)
+}
+
+/// Short names of tags, `refs/tags/*`, of `repo`, sorted alphabetically.
+pub fn repo_tags(repo: &gix::Repository) -> Result<Vec<String>> {
+    let mut names = Vec::new();
+    for reference in repo.references()?.tags()? {
+        let reference = reference.map_err(|error| anyhow::anyhow!("{error}"))?;
+        names.push(String::from_utf8_lossy(reference.name().shorten()).into_owned());
+    }
+    names.sort();
+    Ok(names)
+}
+
+/// Short names of local branches, `refs/heads/*`, sorted alphabetically.
+pub fn worktree_branches(workdir: &Path) -> Result<Vec<String>> {
+    repo_branches(&gix::open(workdir)?)
+}
+
+/// Short name of the branch HEAD points to, or `None` when detached.
+///
+/// Detached after checking out a tag or a commit directly.
+pub fn current_branch(repo: &gix::Repository) -> Result<Option<String>> {
+    let head = repo.head()?;
+    let Some(name) = head.referent_name() else {
+        return Ok(None);
+    };
+    Ok(Some(String::from_utf8_lossy(name.shorten()).into_owned()))
+}
+
+/// Branch, tag and HEAD refs of a repository.
+///
+/// Ready for a NIP-34 kind-30618 repository state announcement.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RepoRefState {
+    /// `(full refname, commit id)` pairs for heads and tags, sorted.
+    pub refs: Vec<(String, String)>,
+    /// Short branch name HEAD points to, or `None` when detached.
+    pub head: Option<String>,
+}
+
+/// Collect the refs of `repo`.
+///
+/// Local branches and tags become `(refname, commit-id)` pairs.
+/// Also reports the branch HEAD points to.
+pub fn repo_ref_state(repo: &gix::Repository) -> Result<RepoRefState> {
+    let mut refs = Vec::new();
+
+    for reference in repo.references()?.local_branches()? {
+        let reference = reference.map_err(|error| anyhow::anyhow!("{error}"))?;
+        refs.push((
+            String::from_utf8_lossy(reference.name().as_bstr()).into_owned(),
+            reference.id().to_string(),
+        ));
+    }
+
+    for reference in repo.references()?.tags()? {
+        let reference = reference.map_err(|error| anyhow::anyhow!("{error}"))?;
+        refs.push((
+            String::from_utf8_lossy(reference.name().as_bstr()).into_owned(),
+            reference.id().to_string(),
+        ));
+    }
+    refs.sort();
+
+    let head = match repo.head() {
+        Ok(head) => head
+            .referent_name()
+            .filter(|name| name.as_bstr().starts_with(b"refs/heads/"))
+            .map(|name| String::from_utf8_lossy(name.shorten()).into_owned()),
+        Err(_) => None,
+    };
+
+    Ok(RepoRefState { refs, head })
+}
+
+/// [`repo_ref_state`] for the repository at `workdir`.
+pub fn worktree_ref_state(workdir: &Path) -> Result<RepoRefState> {
+    repo_ref_state(&gix::open(workdir)?)
+}

crates/signed_git/src/scan.rs

@@ -0,0 +1,43 @@
+use std::path::{Path, PathBuf};
+
+use ignore::WalkBuilder;
+
+/// Maximum directory nesting depth when scanning for local repositories.
+///
+/// Pathological trees can't stall the scan.
+const SCAN_MAX_DEPTH: usize = 12;
+
+/// Walk `root` recursively and collect the paths of git repositories below it,
+/// honouring `.gitignore` (and `.ignore`) files.
+pub fn find_git_repos(root: &Path) -> Vec<PathBuf> {
+    if !root.is_dir() {
+        return Vec::new();
+    }
+
+    let walker = WalkBuilder::new(root)
+        .max_depth(Some(SCAN_MAX_DEPTH))
+        // Honour `.gitignore` even when the scan root is not itself a repository.
+        .require_git(false)
+        .build();
+
+    let mut repos: Vec<PathBuf> = walker
+        .flatten()
+        .filter(|entry| entry.file_type().is_some_and(|kind| kind.is_dir()))
+        .map(ignore::DirEntry::into_path)
+        .filter(|dir| dir.join(".git").exists())
+        .filter_map(|dir| dir.canonicalize().ok())
+        .collect();
+
+    repos.sort();
+    repos.dedup();
+
+    // A repository nested inside another, like a submodule worktree, is not reported.
+    let mut roots: Vec<PathBuf> = Vec::with_capacity(repos.len());
+    for repo in repos {
+        if !roots.iter().any(|kept| repo.starts_with(kept)) {
+            roots.push(repo);
+        }
+    }
+
+    roots
+}

crates/signed_git/src/worktree.rs

@@ -0,0 +1,354 @@
+use std::collections::HashSet;
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use gix::progress::Discard;
+
+use crate::history::{FileCommit, head_commit};
+use crate::repo::{current_branch, repository_signature};
+
+/// Whether the worktree of `workdir` has uncommitted changes.
+///
+/// Best-effort: any read failure is reported as clean.
+pub fn worktree_dirty(workdir: &Path) -> bool {
+    let Ok(repo) = gix::open(workdir) else {
+        return false;
+    };
+
+    // Changes to tracked files, staged or not; untracked files are excluded.
+    match repo.is_dirty() {
+        Ok(true) => return true,
+        Ok(false) => {}
+        Err(_) => return false,
+    }
+
+    // Untracked files surface as `DirectoryContents` items of the index-vs-worktree walk,
+    // tracked files only appear there when modified.
+    let Ok(platform) = repo.status(Discard) else {
+        return false;
+    };
+
+    let Ok(mut changes) = platform.into_index_worktree_iter(Vec::<gix::bstr::BString>::new())
+    else {
+        return false;
+    };
+
+    for change in changes.by_ref() {
+        match change {
+            Ok(gix::status::index_worktree::Item::DirectoryContents { .. }) => return true,
+            Ok(_) => {}
+            Err(_) => return false,
+        }
+    }
+
+    false
+}
+
+/// Commits in `base..branch` of the checkout at `workdir`.
+///
+/// Best-effort: 0 when the range cannot be computed.
+pub fn worktree_commits_ahead(workdir: &Path, base: &str, branch: &str) -> u32 {
+    let Ok(repo) = gix::open(workdir) else {
+        return 0;
+    };
+
+    let (Some(base), Some(branch)) = (resolve_commit(&repo, base), resolve_commit(&repo, branch))
+    else {
+        return 0;
+    };
+
+    let Ok(walk) = repo.rev_walk([branch]).with_hidden([base]).all() else {
+        return 0;
+    };
+
+    walk.filter_map(Result::ok).count().min(u32::MAX as usize) as u32
+}
+
+/// Resolve `rev` to a commit id, accepting full refs,
+/// symbolic refs and the bare branch names callers pass, like git's DWIM.
+fn resolve_commit<'a>(repo: &'a gix::Repository, rev: &str) -> Option<gix::Id<'a>> {
+    if let Ok(id) = repo.rev_parse_single(rev.as_bytes()) {
+        return Some(id);
+    }
+
+    // Branch names arrive bare, like git resolving `main`.
+    if rev.contains('/') {
+        return None;
+    }
+
+    repo.rev_parse_single(format!("refs/heads/{rev}").as_bytes())
+        .ok()
+}
+
+/// Relative paths of all entries in the worktree, files and directories.
+///
+/// The `.git` directory is skipped.
+pub fn worktree_entries(repo: &gix::Repository) -> Result<Vec<PathBuf>> {
+    let workdir = repo.workdir().context("repository has no worktree")?;
+
+    let mut entries: Vec<(PathBuf, bool)> = Vec::new();
+    collect_entries(workdir, workdir, &mut entries)?;
+
+    entries.sort_by(|(a, a_is_dir), (b, b_is_dir)| {
+        b_is_dir
+            .cmp(a_is_dir)
+            .then_with(|| a.as_os_str().cmp(b.as_os_str()))
+    });
+    Ok(entries.into_iter().map(|(path, _)| path).collect())
+}
+
+/// Read a file from the worktree.
+///
+/// Returns `Ok(None)` if the path is missing or not a regular file.
+pub fn worktree_read(repo: &gix::Repository, rel: &Path) -> Result<Option<Vec<u8>>> {
+    let workdir = repo.workdir().context("repository has no worktree")?;
+    let path = workdir.join(rel);
+
+    match std::fs::read(&path) {
+        Ok(bytes) => Ok(Some(bytes)),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(e) if e.kind() == std::io::ErrorKind::IsADirectory => Ok(None),
+        Err(e) => Err(e).with_context(|| format!("failed to read {}", path.display())),
+    }
+}
+
+/// Find the README file in the repository root.
+///
+/// Falls back to any other file whose name starts with `readme`.
+pub fn find_readme(repo: &gix::Repository) -> Result<Option<PathBuf>> {
+    let Some(workdir) = repo.workdir() else {
+        return Ok(None);
+    };
+
+    let mut candidates: Vec<PathBuf> = Vec::new();
+    for entry in std::fs::read_dir(workdir)? {
+        let entry = entry?;
+        let name = entry.file_name();
+        let Some(name) = name.to_str() else { continue };
+        if name.to_ascii_lowercase().starts_with("readme") {
+            candidates.push(entry.path());
+        }
+    }
+
+    candidates.sort_by_key(|path| {
+        let ext = path
+            .extension()
+            .map(|e| e.to_string_lossy().to_ascii_lowercase());
+        match ext.as_deref() {
+            Some("md") => 0,
+            Some("markdown") => 1,
+            Some("mdown") => 2,
+            Some("mkdn") => 3,
+            Some(_) => 5,
+            None => 4,
+        }
+    });
+
+    Ok(candidates
+        .into_iter()
+        .next()
+        .and_then(|path| path.strip_prefix(workdir).ok().map(Path::to_path_buf)))
+}
+
+/// Everything the browser needs to refresh after a branch or tag switch.
+pub struct WorktreeSnapshot {
+    /// Relative paths of all worktree entries, directories first.
+    pub entries: Vec<PathBuf>,
+    /// README path relative to the worktree, if any.
+    pub readme_path: Option<PathBuf>,
+    /// Contents of the README, if any.
+    pub readme: Option<Vec<u8>>,
+    /// Branch HEAD points to, `None` when detached, for example on a tag.
+    pub current_branch: Option<String>,
+    /// Commit HEAD points to, if any, see [`head_commit`].
+    pub head_commit: Option<FileCommit>,
+}
+
+/// Snapshot the worktree after a branch or tag switch.
+///
+/// Collects entries, the README, the branch HEAD points to and its commit.
+pub fn worktree_snapshot(workdir: &Path) -> Result<WorktreeSnapshot> {
+    let repo = gix::open(workdir)?;
+    let readme_path = find_readme(&repo)?;
+    let readme = match &readme_path {
+        Some(path) => worktree_read(&repo, path)?,
+        None => None,
+    };
+    Ok(WorktreeSnapshot {
+        entries: worktree_entries(&repo)?,
+        readme_path,
+        readme,
+        current_branch: current_branch(&repo)?,
+        head_commit: head_commit(&repo)?,
+    })
+}
+
+/// Check out `tree` into the worktree of `repo`
+pub(crate) fn force_checkout(repo: &gix::Repository, tree: &gix::hash::oid) -> Result<()> {
+    let workdir = repo
+        .workdir()
+        .context("repository has no worktree")?
+        .to_path_buf();
+
+    let mut index = repo.index_from_tree(tree)?;
+
+    // Files the previous index tracked but `tree` no longer contains are removed,
+    // like git deleting files that vanish between branches.
+    if let Ok(previous) = repo.index_or_empty() {
+        let keep: HashSet<PathBuf> = index
+            .entries()
+            .iter()
+            .map(|entry| PathBuf::from(String::from_utf8_lossy(entry.path(&index)).into_owned()))
+            .collect();
+        for entry in previous.entries() {
+            let rel = entry.path(&previous);
+            let rel = PathBuf::from(String::from_utf8_lossy(rel).into_owned());
+
+            if keep.contains(&rel) {
+                continue;
+            }
+
+            let path = workdir.join(&rel);
+
+            match std::fs::remove_file(&path) {
+                Ok(()) => {}
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                Err(error) => {
+                    return Err(error)
+                        .with_context(|| format!("failed to remove {}", path.display()));
+                }
+            }
+        }
+    }
+
+    let mut options =
+        repo.checkout_options(gix_worktree::stack::state::attributes::Source::IdMapping)?;
+    options.overwrite_existing = true;
+
+    let objects = repo.objects.clone().into_arc()?;
+    let files = gix::progress::Discard;
+    let bytes = gix::progress::Discard;
+
+    // Check out the index into the worktree.
+    gix_worktree_state::checkout(
+        &mut index,
+        workdir,
+        objects,
+        &files,
+        &bytes,
+        &gix::interrupt::IS_INTERRUPTED,
+        options,
+    )?;
+
+    // Write the index to disk.
+    index.write(gix::index::write::Options::default())?;
+
+    Ok(())
+}
+
+/// Point `HEAD` at `target` and record the switch in the reflog.
+fn move_head(
+    repo: &gix::Repository,
+    signature: gix::actor::SignatureRef<'_>,
+    target: gix::refs::Target,
+    message: &str,
+) -> Result<()> {
+    use gix::refs::transaction::{Change, LogChange, PreviousValue, RefEdit, RefLog};
+
+    let head = gix::refs::FullName::try_from("HEAD")
+        .map_err(|e| anyhow::anyhow!("invalid ref name: {e}"))?;
+
+    // Update the reference, creating a reflog entry.
+    repo.edit_references_as(
+        [RefEdit {
+            change: Change::Update {
+                log: LogChange {
+                    mode: RefLog::AndReference,
+                    force_create_reflog: false,
+                    message: message.into(),
+                },
+                expected: PreviousValue::Any,
+                new: target,
+            },
+            name: head,
+            deref: false,
+        }],
+        Some(signature),
+    )?;
+
+    Ok(())
+}
+
+/// Check out the local branch `name`, HEAD stays attached to it.
+pub fn worktree_checkout_branch(workdir: &Path, name: &str) -> Result<()> {
+    let repo = gix::open(workdir)?;
+    let full = format!("refs/heads/{name}");
+
+    let branch = gix::refs::FullName::try_from(full.as_str())
+        .map_err(|e| anyhow::anyhow!("invalid ref name: {e}"))?;
+
+    let mut reference = repo.find_reference(&full)?;
+    let tree = reference.peel_to_tree()?.id;
+
+    let (signature, mut time_buf) = repository_signature();
+    let signature = signature.to_ref(&mut time_buf);
+
+    // Move HEAD to the branch, creating a reflog entry.
+    move_head(
+        &repo,
+        signature,
+        gix::refs::Target::Symbolic(branch),
+        &format!("checkout: moving to {name}"),
+    )?;
+
+    // Check out the branch's tree, replacing index + worktree.
+    force_checkout(&repo, &tree)?;
+
+    Ok(())
+}
+
+/// Check out the tag `name`, HEAD becomes detached at the tagged commit.
+pub fn worktree_checkout_tag(workdir: &Path, name: &str) -> Result<()> {
+    let repo = gix::open(workdir)?;
+    let full = format!("refs/tags/{name}");
+
+    let mut reference = repo.find_reference(&full)?;
+
+    let commit = reference.peel_to_id()?;
+    let tree = reference.peel_to_tree()?.id;
+
+    let (signature, mut time_buf) = repository_signature();
+    let signature = signature.to_ref(&mut time_buf);
+
+    // Move HEAD to the tag, creating a reflog entry.
+    move_head(
+        &repo,
+        signature,
+        gix::refs::Target::Object(commit.detach()),
+        &format!("checkout: moving to {name}"),
+    )?;
+
+    // Check out the tag's tree, replacing index + worktree.
+    force_checkout(&repo, &tree)?;
+
+    Ok(())
+}
+
+fn collect_entries(root: &Path, dir: &Path, out: &mut Vec<(PathBuf, bool)>) -> Result<()> {
+    for entry in std::fs::read_dir(dir)? {
+        let entry = entry?;
+        if entry.file_name() == ".git" {
+            continue;
+        }
+
+        let is_dir = entry.file_type()?.is_dir();
+        let path = entry.path();
+        let rel = path.strip_prefix(root)?.to_path_buf();
+        out.push((rel, is_dir));
+
+        if is_dir {
+            collect_entries(root, &path, out)?;
+        }
+    }
+    Ok(())
+}

crates/signed_state/Cargo.toml

@@ -22,6 +22,7 @@ flume.workspace = true
 futures.workspace = true
 anyhow.workspace = true
 log.workspace = true
+serde_json.workspace = true
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 rustls = "0.23"

crates/signed_state/src/checkouts.rs

@@ -1,27 +1,32 @@
 use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
-use std::process::Command;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use anyhow::Error;
-use gpui::{App, AppContext, Context, Entity, Global, Subscription, Task};
+use gpui::{App, AppContext, Context, Entity, Global, Subscription};
 use nostr::prelude::*;
 use settings::{CheckoutRecord, SettingsStore};
 use signed_core::{Announcement, RepoAddr};
 
 use crate::backend::{Backend, BackendEvent};
 use crate::git_store::GitStore;
-use crate::local_repos::LocalReposStore;
 use crate::refresh::{RefreshGate, RefreshRequest};
-use crate::repo_list::RepoListStore;
+use crate::repos::{LocalReposStore, RepoListStore};
 
 /// Delay between a refresh request and the actual re-computation.
 const REFRESH_DEBOUNCE: Duration = Duration::from_millis(300);
 
-/// How often the statuses of open repository panels are refreshed.
+/// How often the statuses are recomputed against the local refs.
+///
+/// A commit lands in a checkout long before the remote reconciliation cadence,
+/// so this fast pass surfaces ready-to-push and ready-to-contribute checkouts
+/// within a second or two. It reads the tracking refs only, no network.
+const LOCAL_POLL: Duration = Duration::from_secs(2);
+
+/// How often a full pass refreshes the remotes while any repository panel is open.
 const STATUS_POLL: Duration = Duration::from_secs(15);
 
-/// Background poll interval for the `ready to push` badges of the user's own repositories.
+/// Remote refresh interval for the `ready to push` badges of the user's own repositories.
 const PUSH_POLL: Duration = Duration::from_secs(60);
 
 /// Maximum checkouts considered per repository when computing statuses.
@@ -92,7 +97,13 @@ pub struct CheckoutsStore {
     requested_head: HashMap<RepoAddr, Option<String>>,
     /// Refresh coalescing, see [`RefreshGate`].
     refresh: RefreshGate,
-    tasks: Vec<Task<Result<(), Error>>>,
+    /// A local status pass timer is pending.
+    local_pending: bool,
+    /// When the last full pass (with a remote refresh) completed.
+    ///
+    /// The local pass runs a full pass again once this is older than the
+    /// reconciliation cadence, so remote moves still land.
+    last_full_sync: Option<Instant>,
     _subscriptions: Vec<Subscription>,
 }
 
@@ -142,7 +153,16 @@ impl CheckoutsStore {
             }));
         }
 
-        let mut store = Self {
+        if !cfg!(target_arch = "wasm32") {
+            let weak = cx.entity().downgrade();
+            cx.defer(move |cx| {
+                if let Err(error) = weak.update(cx, |this, cx| this.refresh(cx)) {
+                    log::warn!("checkouts store dropped before initial refresh could run: {error}");
+                }
+            });
+        }
+
+        Self {
             by_repo: HashMap::new(),
             statuses: HashMap::new(),
             status_requested: HashSet::new(),
@@ -150,23 +170,10 @@ impl CheckoutsStore {
             push_statuses: HashMap::new(),
             requested_head: HashMap::new(),
             refresh: RefreshGate::default(),
-            tasks: Vec::new(),
+            local_pending: false,
+            last_full_sync: None,
             _subscriptions: subscriptions,
-        };
-
-        if !cfg!(target_arch = "wasm32") {
-            store.refresh(cx);
         }
-
-        store
-    }
-
-    /// Track a spawned task, pruning finished tasks first.
-    ///
-    /// Keeps the store's task list bounded by the number of in-flight tasks.
-    fn push_task(&mut self, task: Task<Result<(), Error>>) {
-        self.tasks.retain(|task| !task.is_ready());
-        self.tasks.push(task);
     }
 
     /// Remember a successful local-checkout use.
@@ -235,6 +242,35 @@ impl CheckoutsStore {
         self.refresh(cx);
     }
 
+    /// The checkout at `path` was just pushed to the remote.
+    ///
+    /// Its ready-to-push status is obsolete. Drop it from the cached statuses
+    /// and notify observers right away, so the sidebar badge and the push
+    /// banner update immediately instead of waiting for the next background
+    /// pass, which re-scans and re-fetches the remote. The debounced refresh
+    /// reconciles the remaining checkouts of the repository afterwards.
+    pub fn checkout_pushed(&mut self, addr: &RepoAddr, path: &Path, cx: &mut Context<Self>) {
+        let mut removed = false;
+
+        if let Some(statuses) = self.push_statuses.get_mut(addr) {
+            let before = statuses.len();
+            statuses.retain(|status| status.path.as_path() != path);
+            removed = statuses.len() != before;
+
+            if removed && statuses.is_empty() {
+                self.push_statuses.remove(addr);
+            }
+        }
+
+        if removed {
+            cx.notify();
+        }
+
+        // The other checkouts of this repository still need re-deriving
+        // against the remote, now that the pushed refs landed there.
+        self.request_push_statuses(addr, cx);
+    }
+
     /// The ready-to-push statuses of `addr`.
     ///
     /// Empty while none are known or nothing is unpushed.
@@ -258,15 +294,20 @@ impl CheckoutsStore {
             return;
         }
 
-        let task = cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             cx.background_executor().timer(REFRESH_DEBOUNCE).await;
             this.update(cx, |this, cx| this.run_refresh(cx))
-        });
-
-        self.push_task(task);
+        })
+        .detach();
     }
 
-    /// One resolve and apply cycle, the debounced entry point.
+    /// One full resolve and apply cycle, the debounced entry point.
+    ///
+    /// Re-resolves the associations from the settings, the scan and the
+    /// announcements, then recomputes the requested statuses against freshly
+    /// fetched remotes. Full passes run on every input change and on the
+    /// remote reconciliation cadence ([`Self::local_tick`]); they also restart
+    /// the fast local pass.
     fn run_refresh(&mut self, cx: &mut Context<Self>) {
         self.refresh.begin();
 
@@ -332,46 +373,22 @@ impl CheckoutsStore {
                 .map(|(addr, paths)| (addr, paths.into_iter().filter(|p| p.is_dir()).collect()))
                 .collect();
 
-            let mut statuses: HashMap<RepoAddr, Vec<CheckoutStatus>> = HashMap::new();
-            for (addr, announced_head) in &requested {
-                let Some(paths) = associations.get(addr) else {
-                    continue;
-                };
-                let list: Vec<CheckoutStatus> = paths
-                    .iter()
-                    .take(MAX_STATUS_CHECKOUTS)
-                    .filter_map(|path| checkout_status(path, announced_head.as_deref()))
-                    .collect();
-                if !list.is_empty() {
-                    statuses.insert(addr.clone(), list);
-                }
-            }
-
-            let mut push_statuses: HashMap<RepoAddr, Vec<CheckoutStatus>> = HashMap::new();
-            for addr in &push_requested {
-                let Some(paths) = associations.get(addr) else {
-                    continue;
-                };
-                let list: Vec<CheckoutStatus> = paths
-                    .iter()
-                    .take(MAX_STATUS_CHECKOUTS)
-                    .filter_map(|path| checkout_push_status(path))
-                    .collect();
-                if !list.is_empty() {
-                    push_statuses.insert(addr.clone(), list);
-                }
-            }
+            let (statuses, push_statuses) =
+                compute_statuses(&associations, &requested, &push_requested, true);
 
             Ok::<_, Error>((associations, statuses, push_statuses))
         });
 
-        self.push_task(cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             let (associations, statuses, push_statuses) = match work.await {
                 Ok(results) => results,
                 Err(_) => {
                     // Git reads are best-effort, keep the last results.
-                    return this.update(cx, |this, _cx| {
+                    return this.update(cx, |this, cx| {
                         this.refresh.abort();
+                        if poll {
+                            this.schedule_local_pass(cx);
+                        }
                     });
                 }
             };
@@ -385,13 +402,13 @@ impl CheckoutsStore {
                 this.statuses = statuses;
                 this.push_statuses = push_statuses;
 
-                // Poll cycles and identity re-requests recompute the same maps
-                // over and over. Notify only when something actually changed,
-                // so observers skip the no-op heartbeats.
+                // Notify only when something actually changed, so observers
+                // skip the no-op heartbeats.
                 if associations_changed || statuses_changed || push_statuses_changed {
                     cx.notify();
                 }
 
+                this.last_full_sync = Some(Instant::now());
                 this.refresh.finish()
             })?;
 
@@ -399,30 +416,133 @@ impl CheckoutsStore {
                 this.update(cx, |this, cx| this.refresh(cx))?;
             }
 
-            // Keep the statuses current while any repository panel is open.
+            // Restart the fast local pass so the freshly resolved
+            // associations drive it. The pass itself decides when the next
+            // full pass runs.
             this.update(cx, |this, cx| {
-                if poll && this.refresh.idle() {
-                    this.refresh.debounce();
+                if poll {
+                    this.schedule_local_pass(cx);
+                }
+            })?;
 
-                    // Open panels get the fast cadence.
-                    // Each cycle fetches every watched checkout's remote.
-                    let delay = if this.status_requested.is_empty() {
+            Ok(())
+        })
+        .detach();
+    }
+
+    /// Schedule the fast local status pass, unless one is already pending.
+    ///
+    /// Every [`LOCAL_POLL`] the pass recomputes the requested statuses against
+    /// the local refs — no network — so a new commit in a checkout surfaces in
+    /// a second or two instead of at the next remote reconciliation.
+    fn schedule_local_pass(&mut self, cx: &mut Context<Self>) {
+        if self.local_pending {
+            return;
+        }
+        self.local_pending = true;
+
+        cx.spawn(async move |this, cx| {
+            cx.background_executor().timer(LOCAL_POLL).await;
+            this.update(cx, |this, cx| {
+                this.local_pending = false;
+                this.local_tick(cx);
+            })
+        })
+        .detach();
+    }
+
+    /// The fast local status pass.
+    ///
+    /// Recomputes the statuses against the local refs; when the remote
+    /// reconciliation cadence elapsed, it runs a full pass instead so pushes
+    /// made elsewhere do not linger as `to push`.
+    fn local_tick(&mut self, cx: &mut Context<Self>) {
+        // Nothing watched: the chain idles out until a new request restarts it.
+        if self.status_requested.is_empty() && self.push_requested.is_empty() {
+            return;
+        }
+
+        // A full pass or a fresh request covers this tick, skip it.
+        if self.refresh.running() || self.refresh.debouncing() {
+            self.schedule_local_pass(cx);
+            return;
+        }
+
+        // Open panels get the faster remote cadence.
+        let cadence = if self.status_requested.is_empty() {
             PUSH_POLL
         } else {
             STATUS_POLL
         };
 
-                    let task = cx.spawn(async move |this, cx| {
-                        cx.background_executor().timer(delay).await;
-                        this.update(cx, |this, cx| this.run_refresh(cx))
+        let full_due = self
+            .last_full_sync
+            .is_none_or(|sync| sync.elapsed() >= cadence);
+
+        if full_due {
+            self.last_full_sync = Some(Instant::now());
+            self.refresh(cx);
+        } else {
+            self.run_local_statuses(cx);
+        }
+
+        self.schedule_local_pass(cx);
+    }
+
+    /// Recompute the requested statuses against the tracking refs only.
+    ///
+    /// The refs were last refreshed by a full pass. Comparing against them is
+    /// enough to pick up new local commits, and skipping the network keeps
+    /// this pass cheap enough to run every [`LOCAL_POLL`].
+    fn run_local_statuses(&mut self, cx: &mut Context<Self>) {
+        let associations = self.by_repo.clone();
+
+        let requested: Vec<(RepoAddr, Option<String>)> = self
+            .status_requested
+            .iter()
+            .map(|addr| {
+                (
+                    addr.clone(),
+                    self.requested_head.get(addr).cloned().flatten(),
+                )
+            })
+            .collect();
+
+        let push_requested: Vec<RepoAddr> = self.push_requested.iter().cloned().collect();
+
+        let work = cx.background_spawn(async move {
+            let (statuses, push_statuses) =
+                compute_statuses(&associations, &requested, &push_requested, false);
+            Ok::<_, Error>((statuses, push_statuses))
         });
 
-                    this.push_task(task);
+        let task: gpui::Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
+            let Ok((statuses, push_statuses)) = work.await else {
+                // Git reads are best-effort, keep the last results.
+                return Ok(());
+            };
+
+            this.update(cx, |this, cx| {
+                // A full pass or a fresh request will apply fresher data
+                // (the tracking refs move only when a full pass fetches).
+                if this.refresh.running() || this.refresh.debouncing() {
+                    return;
+                }
+
+                let statuses_changed = this.statuses != statuses;
+                let push_statuses_changed = this.push_statuses != push_statuses;
+
+                this.statuses = statuses;
+                this.push_statuses = push_statuses;
+
+                if statuses_changed || push_statuses_changed {
+                    cx.notify();
                 }
             })?;
 
             Ok(())
-        }));
+        });
+        task.detach();
     }
 }
 
@@ -488,67 +608,27 @@ fn resolve_associations<'a>(
     out
 }
 
-/// Whether the worktree of `path` has uncommitted changes.
-fn worktree_dirty(path: &Path) -> bool {
-    let output = Command::new("git")
-        .arg("-C")
-        .arg(path)
-        .args(["status", "--porcelain"])
-        .env("GIT_TERMINAL_PROMPT", "0")
-        .output();
-    match output {
-        Ok(output) => !String::from_utf8_lossy(&output.stdout).trim().is_empty(),
-        Err(_) => false,
-    }
-}
-
-/// Commits in `base..branch` of the checkout at `path`.
-fn commits_ahead(path: &Path, base: &str, branch: &str) -> u32 {
-    let output = Command::new("git")
-        .arg("-C")
-        .arg(path)
-        .args(["rev-list", "--count", &format!("{base}..{branch}")])
-        .env("GIT_TERMINAL_PROMPT", "0")
-        .output();
-    match output {
-        Ok(output) => String::from_utf8_lossy(&output.stdout)
-            .trim()
-            .parse()
-            .unwrap_or(0),
-        Err(_) => 0,
-    }
-}
-
-/// The branch checked out at `path`, read via `git branch --show-current`.
-fn current_branch_of(path: &Path) -> Option<String> {
-    let output = Command::new("git")
-        .arg("-C")
-        .arg(path)
-        .args(["branch", "--show-current"])
-        .env("GIT_TERMINAL_PROMPT", "0")
-        .output()
-        .ok()?;
-    let branch = String::from_utf8_lossy(&output.stdout).trim().to_owned();
-    (!branch.is_empty()).then_some(branch)
-}
-
 /// The ready-to-contribute status of one checkout.
 fn checkout_status(path: &Path, announced_head: Option<&str>) -> Option<CheckoutStatus> {
     let branches = signed_git::worktree_branches(path).ok()?;
-    if branches.is_empty() || worktree_dirty(path) {
+
+    if branches.is_empty() || signed_git::worktree_dirty(path) {
         return None;
     }
-    let branch = current_branch_of(path)?;
+
+    let branch = signed_git::worktree_current_branch(path)?;
     let head = signed_git::head_commit_id(path).ok().flatten()?;
     let base = announced_head
         .filter(|name| branches.iter().any(|b| b == name))
         .map(str::to_owned)
         .or_else(|| branches.iter().find(|b| *b == "main").cloned())
         .or_else(|| branches.first().cloned())?;
+
     if base == branch {
         return None;
     }
-    let ahead = commits_ahead(path, &base, &branch);
+
+    let ahead = signed_git::worktree_commits_ahead(path, &base, &branch);
     (ahead > 0).then_some(CheckoutStatus {
         path: path.to_path_buf(),
         branch,
@@ -558,43 +638,40 @@ fn checkout_status(path: &Path, announced_head: Option<&str>) -> Option<Checkout
     })
 }
 
-/// Whether the reference `name` exists in the checkout at `path`.
-///
-/// Example, `refs/remotes/origin/main`.
-fn ref_exists(path: &Path, name: &str) -> bool {
-    let output = Command::new("git")
-        .arg("-C")
-        .arg(path)
-        .args(["rev-parse", "--verify", "--quiet", name])
-        .env("GIT_TERMINAL_PROMPT", "0")
-        .output();
-    matches!(output, Ok(output) if output.status.success())
-}
-
 /// The `ready to push` status of one checkout of the user's own repository.
-fn checkout_push_status(path: &Path) -> Option<CheckoutStatus> {
-    if worktree_dirty(path) {
+///
+/// `fetch` refreshes the remote heads first, so a full pass sees pushes made
+/// elsewhere; the fast local pass skips it and compares against the tracking
+/// refs left by the last full pass, which is enough to detect local commits.
+fn checkout_push_status(path: &Path, fetch: bool) -> Option<CheckoutStatus> {
+    if signed_git::worktree_dirty(path) {
         return None;
     }
-    let branch = current_branch_of(path)?;
+
+    let branch = signed_git::worktree_current_branch(path)?;
     let head = signed_git::head_commit_id(path).ok().flatten()?;
     let origin = signed_git::origin_url(path).ok().flatten()?;
 
+    if fetch {
         // Refresh the remote heads first.
         // Commits made elsewhere or pushed from another machine must not linger as `to push`.
         signed_git::fetch_repo_refs(path, &[origin], "+refs/heads/*:refs/remotes/origin/*").ok();
+    }
 
     let remote = format!("refs/remotes/origin/{branch}");
+
     // A branch never fetched or pushed yet compares against the remote HEAD.
     // The remote HEAD is the fork point in practice.
-    let base = if ref_exists(path, &remote) {
+    let base = if signed_git::worktree_ref_exists(path, &remote) {
         remote
-    } else if ref_exists(path, "refs/remotes/origin/HEAD") {
+    } else if signed_git::worktree_ref_exists(path, "refs/remotes/origin/HEAD") {
         "refs/remotes/origin/HEAD".to_owned()
     } else {
         return None;
     };
-    let ahead = commits_ahead(path, &base, &branch);
+
+    let ahead = signed_git::worktree_commits_ahead(path, &base, &branch);
+
     (ahead > 0).then_some(CheckoutStatus {
         path: path.to_path_buf(),
         branch,
@@ -604,6 +681,57 @@ fn checkout_push_status(path: &Path) -> Option<CheckoutStatus> {
     })
 }
 
+/// Compute the requested statuses against the checkout paths of `associations`.
+///
+/// Shared by the full and the local pass. `fetch` refreshes the checkouts'
+/// remote heads first, so the full pass sees remote moves; the fast local
+/// pass reads the tracking refs only, which is enough to detect local commits.
+fn compute_statuses(
+    associations: &HashMap<RepoAddr, Vec<PathBuf>>,
+    requested: &[(RepoAddr, Option<String>)],
+    push_requested: &[RepoAddr],
+    fetch: bool,
+) -> (
+    HashMap<RepoAddr, Vec<CheckoutStatus>>,
+    HashMap<RepoAddr, Vec<CheckoutStatus>>,
+) {
+    let mut statuses: HashMap<RepoAddr, Vec<CheckoutStatus>> = HashMap::new();
+    for (addr, announced_head) in requested {
+        let Some(paths) = associations.get(addr) else {
+            continue;
+        };
+
+        let list: Vec<CheckoutStatus> = paths
+            .iter()
+            .take(MAX_STATUS_CHECKOUTS)
+            .filter_map(|path| checkout_status(path, announced_head.as_deref()))
+            .collect();
+
+        if !list.is_empty() {
+            statuses.insert(addr.clone(), list);
+        }
+    }
+
+    let mut push_statuses: HashMap<RepoAddr, Vec<CheckoutStatus>> = HashMap::new();
+    for addr in push_requested {
+        let Some(paths) = associations.get(addr) else {
+            continue;
+        };
+
+        let list: Vec<CheckoutStatus> = paths
+            .iter()
+            .take(MAX_STATUS_CHECKOUTS)
+            .filter_map(|path| checkout_push_status(path, fetch))
+            .collect();
+
+        if !list.is_empty() {
+            push_statuses.insert(addr.clone(), list);
+        }
+    }
+
+    (statuses, push_statuses)
+}
+
 /// Whether the pull request `pr` already proposes the same change as `checkout`.
 pub fn pr_proposes_checkout(
     pr: &Event,
@@ -632,6 +760,8 @@ pub fn pr_proposes_checkout(
 
 #[cfg(test)]
 mod tests {
+    use std::process::Command;
+
     use signed_core::{RepoAddr, repo_addr};
 
     use super::*;
@@ -878,21 +1008,26 @@ mod tests {
         };
 
         // A fresh clone has nothing to push.
-        assert_eq!(checkout_push_status(&checkout), None);
+        assert_eq!(checkout_push_status(&checkout, true), None);
 
         // One local commit, ready to push, counted against the remote.
         std::fs::write(checkout.join("work.txt"), "x\n").expect("write");
         run(&["add", "-A"]);
         run(&["commit", "-m", "local work"]);
-        let status = checkout_push_status(&checkout).expect("status");
+        let status = checkout_push_status(&checkout, true).expect("status");
         assert_eq!(status.branch, "main");
         assert_eq!(status.base, "refs/remotes/origin/main");
         assert_eq!(status.ahead, 1);
         assert_eq!(status.head.len(), 40);
 
+        // The local-only pass reads the tracking refs, no fetch needed:
+        // a commit lands locally long before the remote is reconciled.
+        let local = checkout_push_status(&checkout, false).expect("local status");
+        assert_eq!(local.ahead, 1);
+
         // After the push the same commit is on the remote, idle again.
         run(&["push", "origin", "main"]);
-        assert_eq!(checkout_push_status(&checkout), None);
+        assert_eq!(checkout_push_status(&checkout, true), None);
 
         // A commit made by someone else on the remote must not count as local work.
         // It is behind, not ahead.
@@ -911,7 +1046,7 @@ mod tests {
         std::fs::write(remote.join("other.txt"), "y\n").expect("write");
         remote_run(&["add", "-A"]);
         remote_run(&["commit", "-m", "remote work"]);
-        assert_eq!(checkout_push_status(&checkout), None);
+        assert_eq!(checkout_push_status(&checkout, true), None);
     }
 
     fn pr_event(author: &str, tags: &[&[&str]]) -> Event {

crates/signed_state/src/inbox.rs

@@ -0,0 +1,263 @@
+use std::collections::{HashMap, HashSet};
+
+use anyhow::Error;
+use gpui::{AppContext, Context, Task};
+use nostr_sdk::prelude::*;
+use signed_core::{Deletions, InboxItem, InboxReadState, filters, inbox};
+
+use crate::backend::Backend;
+
+/// The user's persisted inbox read state.
+#[derive(Default)]
+pub struct Inbox {
+    state: InboxReadState,
+    /// Set once the stored state has been read for the current user.
+    loaded: bool,
+}
+
+impl Inbox {
+    /// The current read/archive cutoffs.
+    pub fn state(&self) -> &InboxReadState {
+        &self.state
+    }
+
+    /// Whether the stored state has been read for the current user.
+    pub fn is_loaded(&self) -> bool {
+        self.loaded
+    }
+
+    /// Mark the events of one notification group read, then bound the id sets.
+    pub fn mark_read(
+        &mut self,
+        group: &[Event],
+        all: &[Event],
+        me: PublicKey,
+        cx: &mut Context<Self>,
+    ) {
+        for event in group {
+            self.state.mark_read(event);
+        }
+        self.state.advance_read(all, me, Timestamp::now());
+        self.persist(cx);
+        cx.notify();
+    }
+
+    /// Archive one notification group. Archived events are always read too.
+    pub fn mark_archived(
+        &mut self,
+        group: &[Event],
+        all: &[Event],
+        me: PublicKey,
+        cx: &mut Context<Self>,
+    ) {
+        for event in group {
+            self.state.mark_archived(event);
+            self.state.mark_read(event);
+        }
+
+        let now = Timestamp::now();
+        self.state.advance_archived(all, me, now);
+        self.state.advance_read(all, me, now);
+        self.persist(cx);
+        cx.notify();
+    }
+
+    /// Mark every known notification read.
+    pub fn mark_all_read(&mut self, all: &[Event], me: PublicKey, cx: &mut Context<Self>) {
+        self.state.mark_all_read(all, me, Timestamp::now());
+        self.persist(cx);
+        cx.notify();
+    }
+
+    /// Load the stored state for current user.
+    pub(crate) fn activate(&mut self, me: PublicKey, client: Client, cx: &mut Context<Self>) {
+        self.state = InboxReadState::default();
+        self.loaded = false;
+        cx.notify();
+
+        let backend = Backend::global(cx);
+        let work = cx.background_spawn(async move { load_state(&client, me).await });
+
+        cx.spawn(async move |this, cx| {
+            let loaded = work.await;
+
+            this.update(cx, |this, cx| {
+                if backend.read(cx).current_user() != Some(me) {
+                    return;
+                }
+
+                match loaded {
+                    Ok(Some(state)) => this.state = state,
+                    Ok(None) => this.state = InboxReadState::default(),
+                    Err(error) => log::warn!("failed to load inbox state: {error}"),
+                }
+
+                this.loaded = true;
+                cx.notify();
+            })?;
+
+            Ok::<(), Error>(())
+        })
+        .detach();
+    }
+
+    /// Clear the state of the signed-out user.
+    pub(crate) fn reset(&mut self, cx: &mut Context<Self>) {
+        self.state = InboxReadState::default();
+        self.loaded = false;
+        cx.notify();
+    }
+
+    /// Sign the state with a random key and store it locally.
+    fn persist(&mut self, cx: &mut Context<Self>) {
+        let Some(me) = Backend::global(cx).read(cx).current_user() else {
+            return;
+        };
+
+        let client = Backend::global(cx).read(cx).client();
+        let state = self.state.clone();
+
+        let task: Task<Result<(), Error>> = cx.background_spawn(async move {
+            if let Err(error) = save_state(&client, me, &state).await {
+                log::warn!("failed to save inbox state: {error}");
+            }
+            Ok(())
+        });
+
+        task.detach();
+    }
+}
+
+/// Derive the inbox home screen's threads for `me` from the local database.
+pub async fn query_inbox(
+    client: &Client,
+    me: PublicKey,
+    state: &InboxReadState,
+) -> Result<(Vec<InboxItem>, usize), Error> {
+    let deletion_events = client.database().query(filters::deletions()).await?;
+    let deletions = Deletions::from_events(deletion_events);
+
+    let (notification_events, mut by_id) = fetch_notifications(client, me, &deletions).await?;
+
+    let mut activity = Vec::new();
+    for event in client
+        .database()
+        .query(filters::authored_activity(me))
+        .await?
+    {
+        if deletions.is_deleted(&event) || !filters::is_git_activity(&event) {
+            continue;
+        }
+        by_id.entry(event.id).or_insert_with(|| event.clone());
+        activity.push(event);
+    }
+
+    let items = inbox::group(notification_events, activity, me, state, &|id| {
+        by_id.get(&id).cloned()
+    });
+
+    let unread_count = items.iter().filter(|item| item.is_unread()).count();
+
+    Ok((items, unread_count))
+}
+
+/// `d` tag identifying the inbox state event of `me`.
+fn inbox_state_d_tag(me: PublicKey) -> String {
+    format!("signed-inbox-state:{}", me.to_hex())
+}
+
+/// Newest stored state for `me`.
+async fn load_state(client: &Client, me: PublicKey) -> Result<Option<InboxReadState>, Error> {
+    let filter = Filter::new()
+        .kind(Kind::ApplicationSpecificData)
+        .identifier(inbox_state_d_tag(me));
+
+    let events = client.database().query(filter).await?;
+
+    let Some(event) = events.into_iter().max_by_key(|event| event.created_at) else {
+        return Ok(None);
+    };
+
+    match serde_json::from_str(&event.content) {
+        Ok(state) => Ok(Some(state)),
+        Err(error) => {
+            log::warn!("ignoring unreadable inbox state {}: {error}", event.id);
+            Ok(None)
+        }
+    }
+}
+
+/// Sign with a random key and store locally.
+async fn save_state(client: &Client, me: PublicKey, state: &InboxReadState) -> Result<(), Error> {
+    let event = EventBuilder::new(Kind::ApplicationSpecificData, serde_json::to_string(state)?)
+        .tags([Tag::identifier(inbox_state_d_tag(me))])
+        .finalize(&Keys::generate())?;
+
+    client.database().save_event(&event).await?;
+
+    Ok(())
+}
+
+/// Notification events and a lookup of every ancestor they reference.
+async fn fetch_notifications(
+    client: &Client,
+    me: PublicKey,
+    deletions: &Deletions,
+) -> Result<(Vec<Event>, HashMap<EventId, Event>), Error> {
+    let mut notifications: Vec<Event> = Vec::new();
+    let mut by_id: HashMap<EventId, Event> = HashMap::new();
+
+    for filter in filters::notifications(me) {
+        for event in client.database().query(filter).await? {
+            if deletions.is_deleted(&event) {
+                continue;
+            }
+
+            if by_id.insert(event.id, event.clone()).is_none() {
+                notifications.push(event);
+            }
+        }
+    }
+
+    let mut pending: Vec<EventId> = notifications.iter().flat_map(event_references).collect();
+    let mut seen: HashSet<EventId> = by_id.keys().copied().collect();
+
+    loop {
+        // Keep only ids not walked yet, and remember them.
+        pending.retain(|id| seen.insert(*id));
+
+        if pending.is_empty() {
+            break;
+        }
+
+        let ancestors = client
+            .database()
+            .query(Filter::new().ids(pending.iter().copied()))
+            .await?;
+
+        let mut next = Vec::new();
+
+        for event in ancestors {
+            if deletions.is_deleted(&event) {
+                continue;
+            }
+            next.extend(event_references(&event).filter(|id| !seen.contains(id)));
+            by_id.entry(event.id).or_insert(event);
+        }
+
+        pending = next;
+    }
+
+    Ok((notifications, by_id))
+}
+
+/// Event ids referenced by `event` through its `e` and `E` tags.
+fn event_references(event: &Event) -> impl Iterator<Item = EventId> + '_ {
+    event.tags.iter().filter_map(|tag| {
+        if tag.kind() != "e" && tag.kind() != "E" {
+            return None;
+        }
+        tag.content()
+            .and_then(|content| EventId::from_hex(content).ok())
+    })
+}

crates/signed_state/src/lib.rs

@@ -1,34 +1,34 @@
 mod backend;
 mod checkouts;
 mod git_store;
-mod local_repos;
+mod inbox;
 mod profile;
 mod refresh;
 mod repo;
-mod repo_list;
+mod repos;
 
 use std::path::{Path, PathBuf};
 
 pub use backend::{Backend, BackendEvent, user_grasp_list_servers};
 pub use checkouts::{CheckoutStatus, CheckoutsStore, pr_proposes_checkout};
 pub use git_store::GitStore;
-use gpui::{App, AppContext, Entity};
-pub use local_repos::LocalReposStore;
+use gpui::{App, AppContext};
+pub use inbox::{Inbox, query_inbox};
 pub use nostr_sdk::prelude::Timestamp;
 pub use profile::{Profile, ProfileStore};
+pub use refresh::{RefreshGate, RefreshRequest};
 pub use repo::RepoStore;
-pub use repo_list::{RepoActivityCounts, RepoListStore};
+pub use repos::{LocalReposStore, RepoActivityCounts, RepoListStore};
 use signed_nostr::new_backend;
 
 /// Initialize the backend and stores, and install them as globals.
-/// Call once at startup, before opening any window that uses the stores.
 #[cfg(not(target_arch = "wasm32"))]
 pub fn init(
     db_path: impl AsRef<Path>,
     repos_root: impl Into<PathBuf>,
     scan_paths: Vec<PathBuf>,
     cx: &mut App,
-) -> Entity<Backend> {
+) {
     // rustls uses the `aws_lc_rs` provider by default.
     let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
 
@@ -39,27 +39,22 @@ pub fn init(
             .expect("failed to initialize nostr backend")
     });
 
-    let entity = cx.new(|cx| Backend::new(client, signer, cx));
-    Backend::set_global(entity.clone(), cx);
+    Backend::set_global(cx.new(|cx| Backend::new(client, signer, cx)), cx);
     ProfileStore::set_global(cx.new(ProfileStore::new), cx);
     RepoListStore::set_global(cx.new(RepoListStore::new), cx);
     GitStore::set_global(repos_root, cx);
     LocalReposStore::set_global(cx.new(|cx| LocalReposStore::new(scan_paths, cx)), cx);
     CheckoutsStore::set_global(cx.new(CheckoutsStore::new), cx);
-
-    entity
 }
 
 /// Initialize the backend with an in-memory database on wasm.
 #[cfg(target_arch = "wasm32")]
-pub fn init(cx: &mut App) -> Entity<Backend> {
+pub fn init(cx: &mut App) {
     let (client, signer) = new_backend().expect("failed to initialize nostr backend");
-    let entity = cx.new(|cx| Backend::new(client, signer, cx));
-    Backend::set_global(entity.clone(), cx);
+    Backend::set_global(cx.new(|cx| Backend::new(client, signer, cx)), cx);
     ProfileStore::set_global(cx.new(ProfileStore::new), cx);
     RepoListStore::set_global(cx.new(RepoListStore::new), cx);
     GitStore::set_global(PathBuf::new(), cx);
     LocalReposStore::set_global(cx.new(|cx| LocalReposStore::new(Vec::new(), cx)), cx);
     CheckoutsStore::set_global(cx.new(|cx| CheckoutsStore::new(cx)), cx);
-    entity
 }

crates/signed_state/src/local_repos.rs

@@ -1,104 +0,0 @@
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-
-use anyhow::Error;
-use gpui::{App, AppContext, Context, Entity, Global, Task};
-use signed_git::find_git_repos;
-
-struct GlobalLocalReposStore(Entity<LocalReposStore>);
-
-impl Global for GlobalLocalReposStore {}
-
-/// Store of the git repositories discovered under a set of scan paths.
-pub struct LocalReposStore {
-    /// The directories being scanned.
-    pub roots: Arc<Vec<PathBuf>>,
-    /// Git repositories discovered under [`Self::roots`], sorted by path.
-    pub repos: Arc<Vec<PathBuf>>,
-    /// A scan is currently running.
-    pub scanning: bool,
-    /// A scan was requested while one was already running.
-    scan_dirty: bool,
-    tasks: Vec<Task<Result<(), Error>>>,
-}
-
-impl LocalReposStore {
-    /// Retrieve the global local-repositories store.
-    pub fn global(cx: &App) -> Entity<Self> {
-        cx.global::<GlobalLocalReposStore>().0.clone()
-    }
-
-    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
-        cx.set_global(GlobalLocalReposStore(entity));
-    }
-
-    /// Create a store scanning `roots` right away.
-    pub fn new(roots: Vec<PathBuf>, cx: &mut Context<Self>) -> Self {
-        let mut store = Self {
-            roots: Arc::new(roots),
-            repos: Arc::new(Vec::new()),
-            scanning: false,
-            scan_dirty: false,
-            tasks: Vec::new(),
-        };
-        store.rescan(cx);
-        store
-    }
-
-    /// Forget a repository that has just been published to NIP-34.
-    pub fn remove(&mut self, path: &Path, cx: &mut Context<Self>) {
-        self.repos = Arc::new(
-            self.repos
-                .iter()
-                .filter(|repo| repo.as_path() != path)
-                .cloned()
-                .collect(),
-        );
-        cx.notify();
-    }
-
-    /// Re-run the scan.
-    pub fn rescan(&mut self, cx: &mut Context<Self>) {
-        if self.scanning {
-            self.scan_dirty = true;
-            return;
-        }
-        if self.roots.is_empty() {
-            return;
-        }
-
-        self.scanning = true;
-        cx.notify();
-
-        let roots = self.roots.clone();
-        let work = cx.background_spawn(async move {
-            let mut repos = Vec::new();
-            for root in roots.iter() {
-                repos.extend(find_git_repos(root));
-            }
-            repos.sort();
-            repos.dedup();
-            repos
-        });
-
-        self.tasks.push(cx.spawn(async move |this, cx| {
-            let repos = work.await;
-            let again = this.update(cx, |this, cx| {
-                this.repos = Arc::new(repos);
-                this.scanning = false;
-                cx.notify();
-
-                let dirty = this.scan_dirty;
-                this.scan_dirty = false;
-                dirty
-            })?;
-
-            // Scans requested while this one ran are coalesced into one follow-up scan.
-            if again {
-                this.update(cx, |this, cx| this.rescan(cx))?;
-            }
-
-            Ok(())
-        }));
-    }
-}

crates/signed_state/src/profile.rs

@@ -75,7 +75,6 @@ pub struct ProfileStore {
     seen: RefCell<HashSet<PublicKey>>,
     /// Sender for queuing fetch requests, batched by a background task.
     sender: Sender<PublicKey>,
-    tasks: Vec<Task<Result<(), Error>>>,
     _subscription: Subscription,
 }
 
@@ -97,9 +96,14 @@ impl ProfileStore {
         let backend = Backend::global(cx);
 
         let subscription = cx.subscribe(&backend, |this, _backend, event, cx| match event {
-            BackendEvent::NostrUpdate(update) if update.kind == Kind::Metadata => {
+            BackendEvent::NostrUpdate(updates) => {
+                for update in updates
+                    .iter()
+                    .filter(|update| update.kind == Kind::Metadata)
+                {
                     this.apply_author(update.author, cx);
                 }
+            }
             BackendEvent::Published(event) if event.kind == Kind::Metadata => {
                 let metadata = Metadata::from_json(&event.content).unwrap_or_default();
                 this.profiles
@@ -114,30 +118,24 @@ impl ProfileStore {
         let (sender, receiver) = flume::unbounded::<PublicKey>();
         let entity = cx.entity().downgrade();
 
-        let mut tasks = Vec::new();
-
-        tasks.push(cx.spawn(async move |_this, cx| {
+        cx.spawn(async move |_this, cx| {
             Self::handle_requests(entity, &client, &receiver, cx).await
-        }));
+        })
+        .detach();
 
-        let mut store = Self {
+        let weak = cx.entity().downgrade();
+        cx.defer(move |cx| {
+            if let Err(error) = weak.update(cx, |this, cx| this.load(cx)) {
+                log::warn!("profile store dropped before initial load could run: {error}");
+            }
+        });
+
+        Self {
             profiles: HashMap::new(),
             seen: RefCell::new(HashSet::new()),
             sender,
-            tasks,
             _subscription: subscription,
-        };
-
-        store.load(cx);
-        store
         }
-
-    /// Track a spawned task, pruning finished tasks first.
-    ///
-    /// Keeps the store's task list bounded by the number of in-flight tasks.
-    fn push_task(&mut self, task: Task<Result<(), Error>>) {
-        self.tasks.retain(|task| !task.is_ready());
-        self.tasks.push(task);
     }
 
     /// Get a profile.
@@ -181,7 +179,7 @@ impl ProfileStore {
             Ok::<_, Error>(profiles)
         });
 
-        self.push_task(cx.spawn(async move |this, cx| {
+        let task: Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
             let profiles = work.await?;
 
             this.update(cx, |this, cx| {
@@ -192,7 +190,8 @@ impl ProfileStore {
             })?;
 
             Ok(())
-        }));
+        });
+        task.detach();
     }
 
     /// Re-read the latest metadata of an author from the local database.
@@ -217,7 +216,7 @@ impl ProfileStore {
             Ok::<_, Error>(profile)
         });
 
-        self.push_task(cx.spawn(async move |this, cx| {
+        let task: Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
             let profile = work.await?;
 
             this.update(cx, |this, cx| {
@@ -228,7 +227,8 @@ impl ProfileStore {
             })?;
 
             Ok(())
-        }));
+        });
+        task.detach();
     }
 
     /// Re-read the latest metadata of every requested author from the local database.
@@ -273,7 +273,7 @@ impl ProfileStore {
             Ok::<_, Error>(profiles)
         });
 
-        self.push_task(cx.spawn(async move |this, cx| {
+        let task: Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
             let profiles = work.await?;
 
             this.update(cx, |this, cx| {
@@ -284,7 +284,8 @@ impl ProfileStore {
             })?;
 
             Ok(())
-        }));
+        });
+        task.detach();
     }
 
     /// Sync metadata for requested authors in batches, debounced to collect requests.
@@ -337,7 +338,7 @@ impl ProfileStore {
             // Re-apply from the database afterwards.
             match sync_bootstrap_only(client, filter, SyncOptions::default()).await {
                 Ok(_) => {
-                    let _ = this.update(cx, |this, cx| this.apply_seen(cx));
+                    this.update(cx, |this, cx| this.apply_seen(cx)).ok();
                 }
                 Err(e) => log::warn!("profile sync failed: {e}"),
             }

crates/signed_state/src/refresh.rs

@@ -1,9 +1,4 @@
 /// Refresh coalescing shared by the event stores.
-///
-/// [`crate::RepoStore`], [`crate::RepoListStore`] and [`crate::CheckoutsStore`]
-/// re-query their inputs on a debounce timer with the same policy:
-/// a request arriving while a run is in flight is folded into a follow-up run,
-/// a request arriving while the debounce timer is pending is dropped by it.
 #[derive(Debug, Default)]
 pub struct RefreshGate {
     /// A run is in flight.
@@ -34,11 +29,6 @@ impl RefreshGate {
         self.debouncing
     }
 
-    /// Whether no run is in flight and no timer is pending.
-    pub fn idle(&self) -> bool {
-        !self.running && !self.debouncing
-    }
-
     /// A new refresh request arrived.
     ///
     /// Folded into a follow-up run while one is in flight, dropped while the
@@ -55,11 +45,6 @@ impl RefreshGate {
         }
     }
 
-    /// A timer was started without a request, e.g. a poll cycle.
-    pub fn debounce(&mut self) {
-        self.debouncing = true;
-    }
-
     /// The debounce timer fired and the run starts now.
     pub fn begin(&mut self) {
         self.debouncing = false;

crates/signed_state/src/repo.rs

@@ -3,9 +3,9 @@ use std::collections::{HashMap, HashSet};
 use std::path::PathBuf;
 use std::time::Duration;
 
-use anyhow::Error;
+use anyhow::{Error, bail};
 use bitcoin_hashes::sha1::Hash as Sha1Hash;
-use gpui::{AppContext, AsyncApp, Context, SharedString, Subscription, Task, WeakEntity};
+use gpui::{App, AppContext, AsyncApp, Context, SharedString, Subscription, Task, WeakEntity};
 use nostr::event::IntoEventBuilder;
 use nostr_sdk::prelude::*;
 use signed_core::{
@@ -14,10 +14,13 @@ use signed_core::{
 };
 
 use crate::backend::{
-    Backend, BackendEvent, grasp_base_url, grasp06_prs_url, pr_clone_urls, user_grasp_list_servers,
+    Backend, BackendEvent, grasp_base_url, grasp06_prs_url, pr_clone_urls, require_relay_accepted,
+    user_grasp_list_servers,
 };
+use crate::checkouts::CheckoutsStore;
 use crate::git_store::GitStore;
 use crate::refresh::{RefreshGate, RefreshRequest};
+use crate::repos::RepoListStore;
 
 /// Delay between a refresh request and the actual re-query.
 const REFRESH_DEBOUNCE: Duration = Duration::from_millis(300);
@@ -57,6 +60,18 @@ pub struct RepoStore {
     ///
     /// Example, a PR published without its commit reaching a grasp server.
     pub last_warning: Option<String>,
+    /// Warning of the last push that only some grasp servers accepted.
+    ///
+    /// The repository is out of sync on the rejected servers until it is republished.
+    pub last_push_warning: Option<String>,
+    /// A republish or a checkout push is in flight.
+    ///
+    /// Views show a spinner and disable their push triggers while it is set.
+    pub pushing: bool,
+    /// A clone-into-a-folder operation is in flight.
+    ///
+    /// Views show a spinner and disable the clone trigger while it is set.
+    pub cloning: bool,
     /// Relays already asked to connect to, from this repository's NIP-34 `relays` tag.
     ///
     /// Avoids re-subscribing and re-fetching on every refresh.
@@ -67,7 +82,6 @@ pub struct RepoStore {
     root_fetches: HashSet<EventId>,
     /// Refresh coalescing, see [`RefreshGate`].
     refresh: RefreshGate,
-    tasks: Vec<Task<Result<(), Error>>>,
     _subscription: Subscription,
 }
 
@@ -77,7 +91,7 @@ impl RepoStore {
 
         let subscription = cx.subscribe(&backend, |this, _backend, event, cx| {
             let relevant = match event {
-                BackendEvent::NostrUpdate(update) => {
+                BackendEvent::NostrUpdate(updates) => updates.iter().any(|update| {
                     // Deletions may target any event of this repository.
                     let deletion =
                         update.kind == Kind::EventDeletion || update.kind == Kind::RequestToVanish;
@@ -93,7 +107,7 @@ impl RepoStore {
                     let status = RepoStatus::from_kind(update.kind).is_some();
 
                     deletion || coordinate || (author && kind) || comment || status
-                }
+                }),
                 BackendEvent::Published(event) => {
                     let kind = event.kind == Kind::GitRepoAnnouncement;
                     let author = event.pubkey == this.addr.public_key;
@@ -113,7 +127,20 @@ impl RepoStore {
             }
         });
 
-        let mut store = Self {
+        let weak = cx.entity().downgrade();
+        cx.defer(move |cx| {
+            let result = weak.update(cx, |this, cx| {
+                this.subscribe_remote(cx);
+                this.connect_announced_relays(&announced_relays, cx);
+                this.refresh(cx);
+            });
+
+            if let Err(error) = result {
+                log::warn!("repo store dropped before bootstrap could run: {error}");
+            }
+        });
+
+        Self {
             addr,
             announcement: None,
             head: None,
@@ -127,20 +154,14 @@ impl RepoStore {
             version: 0,
             last_error: None,
             last_warning: None,
+            last_push_warning: None,
+            pushing: false,
+            cloning: false,
             repo_relays: HashSet::new(),
             root_fetches: HashSet::new(),
             refresh: RefreshGate::default(),
             _subscription: subscription,
-            tasks: Vec::new(),
-        };
-
-        store.subscribe_remote(cx);
-        // The announcement we opened the repo from may already list its relays.
-        // Connect to them right away.
-        // Do not wait for the bootstrap fetch to return the same event.
-        store.connect_announced_relays(&announced_relays, cx);
-        store.refresh(cx);
-        store
+        }
     }
 
     /// Returns the repository's address.
@@ -212,14 +233,12 @@ impl RepoStore {
             return;
         }
 
-        let task = cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             cx.background_executor().timer(REFRESH_DEBOUNCE).await;
 
             this.update(cx, |this, cx| this.run_refresh(cx))
-        });
-
-        self.tasks.retain(|task| !task.is_ready());
-        self.tasks.push(task);
+        })
+        .detach();
     }
 
     fn run_refresh(&mut self, cx: &mut Context<Self>) {
@@ -355,9 +374,7 @@ impl RepoStore {
             ))
         });
 
-        self.tasks.retain(|task| !task.is_ready());
-
-        self.tasks.push(cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             let (
                 announcement,
                 state,
@@ -449,7 +466,8 @@ impl RepoStore {
             }
 
             Ok(())
-        }));
+        })
+        .detach();
     }
 
     /// Resolve the status of a root event, an issue, patch or PR, per NIP-34.
@@ -497,7 +515,7 @@ impl RepoStore {
         }
         .into_event_builder();
 
-        self.send(builder, cx);
+        self.publish(builder, cx);
     }
 
     /// Comments on a root event, an issue or PR, oldest first.
@@ -528,7 +546,7 @@ impl RepoStore {
             .and_then(|a| a.relays.first())
             .cloned();
 
-        self.send(
+        self.publish(
             comment_builder(root, parent, relay_hint.as_ref(), &self.addr, content),
             cx,
         );
@@ -621,7 +639,7 @@ impl RepoStore {
                 .collect()
         };
 
-        self.tasks.push(cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             // The PR references the root patch event.
             // Viewers can then find the patch without carrying it inline.
             let root_patch = match publish_patch_series(
@@ -781,12 +799,15 @@ impl RepoStore {
                 }
             }
 
-            let publish_task = this.update(cx, |_this, cx| {
-                let backend = Backend::global(cx);
-                backend.update(cx, |backend, cx| backend.publish_event(event, cx))
-            })?;
+            let client = this.update(cx, |_this, cx| Backend::global(cx).read(cx).client())?;
 
-            let pr_event = match publish_task.await {
+            let publish_result: Result<Event, Error> = async {
+                let output = client.send_event(&event).broadcast().await?;
+                require_relay_accepted(output, event)
+            }
+            .await;
+
+            let pr_event = match publish_result {
                 Ok(event) => event,
                 Err(e) => {
                     return this.update(cx, |this, cx| {
@@ -796,6 +817,11 @@ impl RepoStore {
                 }
             };
 
+            this.update(cx, |_this, cx| {
+                Backend::global(cx)
+                    .update(cx, |backend, cx| backend.announce_published(pr_event.clone(), cx))
+            })?;
+
             // A draft PR carries a kind-1633 status event, NIP-34.
             // Publish it right after the PR event so viewers never show it open.
             if draft {
@@ -805,7 +831,61 @@ impl RepoStore {
             }
 
             Ok(())
-        }));
+        })
+        .detach();
+    }
+
+    /// Generate the patch between `merge_base` and `compare_ref` in `repo_path`,
+    /// then open a pull request from it.
+    ///
+    /// Fails descriptively when there are no commits to propose or the patch
+    /// could not be generated; otherwise publishes exactly like
+    /// [`Self::open_pull_request`].
+    #[allow(clippy::too_many_arguments)]
+    pub fn open_pull_request_from_refs(
+        &mut self,
+        repo_path: PathBuf,
+        merge_base: String,
+        compare_ref: String,
+        subject: Option<String>,
+        description: String,
+        branch_name: Option<String>,
+        draft: bool,
+        cx: &mut Context<Self>,
+    ) -> Task<Result<(), Error>> {
+        cx.spawn(async move |this, cx| {
+            // Regenerate the series at submit time.
+            // The published patch covers the current tip of the compare branch.
+            let patch = cx
+                .background_spawn({
+                    let repo_path = repo_path.clone();
+                    let merge_base = merge_base.clone();
+                    let compare_ref = compare_ref.clone();
+                    async move {
+                        signed_git::format_patch_between(&repo_path, &merge_base, &compare_ref)
+                    }
+                })
+                .await;
+
+            let patch = match patch {
+                Ok(patch) if !patch.is_empty() => patch,
+                Ok(_) => bail!("No commits between the branches to propose"),
+                Err(error) => bail!("Failed to generate the patch: {error}"),
+            };
+
+            this.update(cx, |this, cx| {
+                this.open_pull_request(
+                    subject,
+                    description,
+                    branch_name,
+                    patch,
+                    draft,
+                    Some(merge_base),
+                    Some(repo_path),
+                    cx,
+                );
+            })
+        })
     }
 
     /// Update a pull request.
@@ -877,7 +957,7 @@ impl RepoStore {
             .map(|a| a.clone.clone())
             .unwrap_or_default();
 
-        self.tasks.push(cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             if let Err(e) = publish_patch_series(
                 &this,
                 cx,
@@ -896,7 +976,7 @@ impl RepoStore {
                 });
             }
 
-            let update_task = this.update(cx, |this, cx| {
+            let builder = this.update(cx, |this, _cx| {
                 let builder = GitPullRequestUpdate {
                     repository: this.addr.clone(),
                     pull_request_event: root.id,
@@ -909,24 +989,44 @@ impl RepoStore {
 
                 // The `r` EUC tag lets clients subscribe to all PR updates.
                 // The SDK builder omits it.
-                let builder = match euc.as_deref() {
+                match euc.as_deref() {
                     Some(euc) => builder.tag(Tag::parse(["r", euc]).expect("valid r tag")),
                     None => builder,
-                };
-
-                let backend = Backend::global(cx);
-                backend.update(cx, |backend, cx| backend.send(builder, cx))
+                }
             })?;
 
-            if let Err(e) = update_task.await {
+            let (client, signer) = this.update(cx, |_this, cx| {
+                let backend = Backend::global(cx);
+                let backend = backend.read(cx);
+                (backend.client(), backend.signer())
+            })?;
+
+            let publish_result: Result<Event, Error> = async {
+                let event = builder.finalize_async(&signer).await?;
+                let output = client.send_event(&event).broadcast().await?;
+                require_relay_accepted(output, event)
+            }
+            .await;
+
+            match publish_result {
+                Ok(event) => {
+                    this.update(cx, |_this, cx| {
+                        Backend::global(cx).update(cx, |backend, cx| {
+                            backend.announce_published(event.clone(), cx)
+                        })
+                    })?;
+                }
+                Err(e) => {
                     return this.update(cx, |this, cx| {
                         this.last_error = Some(e.to_string());
                         cx.notify();
                     });
                 }
+            }
 
             Ok(())
-        }));
+        })
+        .detach();
     }
 
     /// Set the status of a root event.
@@ -965,7 +1065,7 @@ impl RepoStore {
             Tag::coordinate(self.addr.clone(), None),
         ]);
 
-        self.send(builder, cx);
+        self.publish(builder, cx);
     }
 
     /// Merge a pull request.
@@ -985,10 +1085,10 @@ impl RepoStore {
         let cache = GitStore::global(cx).cache().clone();
         let addr = self.addr.clone();
 
-        let clone_urls: Vec<String> = self
+        let clone_urls: Vec<Url> = self
             .announcement
             .as_ref()
-            .map(|a| a.clone.iter().map(ToString::to_string).collect())
+            .map(|a| a.clone.clone())
             .unwrap_or_default();
 
         let patch = pull_request_patch(root, self.patches.iter());
@@ -1023,7 +1123,7 @@ impl RepoStore {
             Ok::<_, Error>(applied)
         });
 
-        self.tasks.push(cx.spawn(async move |this, cx| {
+        let task: Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
             match apply.await {
                 Ok(applied) => {
                     this.update(cx, |this, cx| {
@@ -1045,7 +1145,218 @@ impl RepoStore {
                 }
             }
             Ok(())
-        }));
+        });
+        task.detach();
+    }
+
+    /// The latest announcement of this repository,
+    /// for operations that need its clone URLs and relays.
+    fn action_announcement(&self, cx: &App) -> Option<Announcement> {
+        self.announcement.clone().or_else(|| {
+            RepoListStore::global(cx)
+                .read(cx)
+                .announcements
+                .iter()
+                .find(|announcement| announcement.addr() == self.addr)
+                .cloned()
+        })
+    }
+
+    /// Re-push the repository's refs to its announced grasp servers, republish.
+    pub fn push_repository(&mut self, cx: &mut Context<Self>) -> Task<Result<(), Error>> {
+        if self.pushing {
+            return Task::ready(Err(anyhow::anyhow!(
+                "A push to this repository is already in progress"
+            )));
+        }
+        let Some(announcement) = self.action_announcement(cx) else {
+            return self.action_error("Repository announcement is not loaded yet", cx);
+        };
+
+        self.pushing = true;
+        self.last_error = None;
+        self.last_push_warning = None;
+        cx.notify();
+
+        let backend = Backend::global(cx);
+        let push = backend.update(cx, |backend, cx| backend.push_repository(announcement, cx));
+
+        cx.spawn(async move |this, cx| {
+            let result = push.await;
+
+            this.update(cx, |this, cx| {
+                this.pushing = false;
+
+                match &result {
+                    Ok(outcome) => {
+                        this.last_error = None;
+                        // A push only some grasp servers accepted is a warning:
+                        // the repo is out of sync on the rest until it is republished.
+                        this.last_push_warning = outcome.partial_warning();
+                    }
+                    Err(e) => {
+                        this.last_error = Some(format!("Push failed: {e}"));
+                        this.last_push_warning = None;
+                    }
+                }
+
+                cx.notify();
+            })?;
+
+            result.map(|_| ())
+        })
+    }
+
+    /// Push the unpushed commits of the local checkout at `path`.
+    pub fn push_checkout(
+        &mut self,
+        path: PathBuf,
+        cx: &mut Context<Self>,
+    ) -> Task<Result<(), Error>> {
+        if self.pushing {
+            return Task::ready(Err(anyhow::anyhow!(
+                "A push to this repository is already in progress"
+            )));
+        }
+
+        let Some(announcement) = self.action_announcement(cx) else {
+            return self.action_error("Repository announcement is not loaded yet", cx);
+        };
+
+        // The state event's `HEAD` stays the announced default branch.
+        // The checkout may be on a side branch.
+        let head = self.head.clone();
+        let addr = self.addr.clone();
+
+        self.pushing = true;
+        self.last_error = None;
+        self.last_push_warning = None;
+        cx.notify();
+
+        let checkouts = CheckoutsStore::global(cx);
+        let backend = Backend::global(cx);
+        let push = backend.update(cx, |backend, cx| {
+            backend.push_checkout(announcement, path.clone(), head, cx)
+        });
+
+        cx.spawn(async move |this, cx| {
+            let result = push.await;
+
+            this.update(cx, |this, cx| {
+                this.pushing = false;
+
+                match &result {
+                    Ok(outcome) => {
+                        this.last_error = None;
+                        // A push only some grasp servers accepted is a warning:
+                        // the repo is out of sync on the rest until it is republished.
+                        this.last_push_warning = outcome.partial_warning();
+                        // The remote moved, so recompute the ready-to-push statuses.
+                        checkouts.update(cx, |store, cx| {
+                            store.checkout_pushed(&addr, &path, cx);
+                        });
+                    }
+                    Err(e) => {
+                        this.last_error = Some(format!("Push failed: {e}"));
+                        this.last_push_warning = None;
+                    }
+                }
+
+                cx.notify();
+            })?;
+
+            result.map(|_| ())
+        })
+    }
+
+    /// Delete the repository from nostr, announcement, state and activity.
+    ///
+    /// Only the repository owner may delete it. The lists update when the
+    /// deletion events arrive.
+    pub fn delete_repository(&mut self, cx: &mut Context<Self>) -> Task<Result<(), Error>> {
+        let addr = self.addr.clone();
+        self.last_error = None;
+
+        let backend = Backend::global(cx);
+        let delete = backend.update(cx, |backend, cx| backend.delete_repository(addr, cx));
+
+        cx.spawn(async move |this, cx| {
+            let result = delete.await;
+            this.update(cx, |this, cx| {
+                if let Err(e) = &result {
+                    this.last_error = Some(format!("Delete failed: {e}"));
+                }
+                cx.notify();
+            })?;
+            result
+        })
+    }
+
+    /// Clone the repository into `destination`, a user-chosen folder outside
+    /// the cache, and remember the clone as a checkout of this repository.
+    pub fn clone_to_folder(
+        &mut self,
+        destination: PathBuf,
+        cx: &mut Context<Self>,
+    ) -> Task<Result<(), Error>> {
+        if self.cloning {
+            return Task::ready(Err(anyhow::anyhow!(
+                "A clone of this repository is already in progress"
+            )));
+        }
+        let Some(announcement) = self.action_announcement(cx) else {
+            return self.action_error("Repository announcement is not loaded yet", cx);
+        };
+
+        let clone_urls = announcement.clone.clone();
+        let addr = self.addr.clone();
+
+        self.cloning = true;
+        self.last_error = None;
+        cx.notify();
+
+        let clone = {
+            let destination = destination.clone();
+            cx.background_spawn(async move { signed_git::clone_repo(&clone_urls, &destination) })
+        };
+
+        cx.spawn(async move |this, cx| {
+            let result = clone.await;
+
+            this.update(cx, |this, cx| {
+                this.cloning = false;
+
+                match &result {
+                    Ok(()) => {
+                        // Remember the clone as a checkout of this repository.
+                        let checkouts = CheckoutsStore::global(cx);
+                        checkouts.update(cx, |store, cx| {
+                            store.record(destination.clone(), addr.clone(), cx);
+                        });
+                    }
+                    Err(e) => {
+                        this.last_error = Some(format!("Failed to clone: {e}"));
+                    }
+                }
+
+                cx.notify();
+            })?;
+
+            result
+        })
+    }
+
+    /// Fail an operation whose announcement is not loaded yet.
+    fn action_error(
+        &mut self,
+        message: impl Into<String>,
+        cx: &mut Context<Self>,
+    ) -> Task<Result<(), Error>> {
+        let message = message.into();
+        self.last_error = Some(message.clone());
+        cx.notify();
+
+        Task::ready(Err(anyhow::anyhow!("{message}")))
     }
 
     /// Publish a kind-1631 Applied status event for `root` after a merge.
@@ -1101,24 +1412,50 @@ impl RepoStore {
             }
         }
 
-        self.send(EventBuilder::new(Kind::GitStatusApplied, "").tags(tags), cx);
+        self.publish(EventBuilder::new(Kind::GitStatusApplied, "").tags(tags), cx);
     }
 
-    fn send(&mut self, builder: EventBuilder, cx: &mut Context<Self>) {
+    /// Sign `builder`, broadcast it and track the outcome in [`Self::last_error`].
+    ///
+    /// Every one-shot repository event (issue, comment, status) goes through
+    /// this. Multi-step flows (opening or updating a pull request, a patch
+    /// series) call the SDK directly instead, since their error handling and
+    /// post-conditions differ per step.
+    fn publish(&mut self, builder: EventBuilder, cx: &mut Context<Self>) {
         self.last_error = None;
 
         let backend = Backend::global(cx);
-        let task = backend.update(cx, |backend, cx| backend.send(builder, cx));
+        let (client, signer) = {
+            let backend = backend.read(cx);
+            (backend.client(), backend.signer())
+        };
 
-        self.tasks.push(cx.spawn(async move |this, cx| {
-            if let Err(e) = task.await {
+        let task: Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
+            let publish_result: Result<Event, Error> = async {
+                let event = builder.finalize_async(&signer).await?;
+                let output = client.send_event(&event).broadcast().await?;
+                require_relay_accepted(output, event)
+            }
+            .await;
+
+            match publish_result {
+                Ok(event) => {
+                    this.update(cx, |_this, cx| {
+                        Backend::global(cx)
+                            .update(cx, |backend, cx| backend.announce_published(event, cx))
+                    })?;
+                }
+                Err(e) => {
                     this.update(cx, |this, cx| {
                         this.last_error = Some(e.to_string());
                         cx.notify();
                     })?;
                 }
+            }
+
             Ok(())
-        }));
+        });
+        task.detach();
     }
 }
 
@@ -1199,6 +1536,12 @@ async fn publish_patch_series(
     first_marker: &str,
     reply_to: Option<EventId>,
 ) -> Result<Event, Error> {
+    let (client, signer) = this.update(cx, |_this, cx| {
+        let backend = Backend::global(cx);
+        let backend = backend.read(cx);
+        (backend.client(), backend.signer())
+    })?;
+
     let mut root: Option<Event> = None;
     let mut previous = reply_to;
 
@@ -1239,11 +1582,14 @@ async fn publish_patch_series(
 
         let builder = EventBuilder::new(Kind::GitPatch, part.clone()).tags(tags);
 
-        let task = this.update(cx, |_this, cx| {
-            let backend = Backend::global(cx);
-            backend.update(cx, |backend, cx| backend.send(builder, cx))
+        let event = builder.finalize_async(&signer).await?;
+        let output = client.send_event(&event).broadcast().await?;
+        let event = require_relay_accepted(output, event)?;
+        this.update(cx, |_this, cx| {
+            Backend::global(cx).update(cx, |backend, cx| {
+                backend.announce_published(event.clone(), cx)
+            })
         })?;
-        let event = task.await?;
 
         if root.is_none() {
             root = Some(event.clone());

crates/signed_state/src/repos.rs

@@ -1,4 +1,5 @@
 use std::collections::HashMap;
+use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -6,10 +7,116 @@ use anyhow::Error;
 use gpui::{App, AppContext, Context, Entity, Global, Subscription, Task};
 use nostr_sdk::prelude::*;
 use signed_core::{Announcement, Deletions, RepoAddr, filters, repo_addr};
+use signed_git::find_git_repos;
 
 use crate::backend::{Backend, BackendEvent};
 use crate::refresh::{RefreshGate, RefreshRequest};
 
+struct GlobalLocalReposStore(Entity<LocalReposStore>);
+
+impl Global for GlobalLocalReposStore {}
+
+/// Store of the git repositories discovered under a set of scan paths.
+pub struct LocalReposStore {
+    /// The directories being scanned.
+    pub roots: Arc<Vec<PathBuf>>,
+    /// Git repositories discovered under [`Self::roots`], sorted by path.
+    pub repos: Arc<Vec<PathBuf>>,
+    /// A scan is currently running.
+    pub scanning: bool,
+    /// A scan was requested while one was already running.
+    scan_dirty: bool,
+}
+
+impl LocalReposStore {
+    /// Retrieve the global local-repositories store.
+    pub fn global(cx: &App) -> Entity<Self> {
+        cx.global::<GlobalLocalReposStore>().0.clone()
+    }
+
+    pub(crate) fn set_global(entity: Entity<Self>, cx: &mut App) {
+        cx.set_global(GlobalLocalReposStore(entity));
+    }
+
+    /// Create a store scanning `roots` right away.
+    pub fn new(roots: Vec<PathBuf>, cx: &mut Context<Self>) -> Self {
+        let weak = cx.entity().downgrade();
+        cx.defer(move |cx| {
+            if let Err(error) = weak.update(cx, |this, cx| this.rescan(cx)) {
+                log::warn!("local repos store dropped before initial scan could run: {error}");
+            }
+        });
+
+        Self {
+            roots: Arc::new(roots),
+            repos: Arc::new(Vec::new()),
+            scanning: false,
+            scan_dirty: false,
+        }
+    }
+
+    /// Forget a repository that has just been published to NIP-34.
+    pub fn remove(&mut self, path: &Path, cx: &mut Context<Self>) {
+        self.repos = Arc::new(
+            self.repos
+                .iter()
+                .filter(|repo| repo.as_path() != path)
+                .cloned()
+                .collect(),
+        );
+        cx.notify();
+    }
+
+    /// Re-run the scan.
+    pub fn rescan(&mut self, cx: &mut Context<Self>) {
+        if self.scanning {
+            self.scan_dirty = true;
+            return;
+        }
+
+        if self.roots.is_empty() {
+            return;
+        }
+
+        self.scanning = true;
+        cx.notify();
+
+        let roots = self.roots.clone();
+
+        let work = cx.background_spawn(async move {
+            let mut repos = Vec::new();
+            for root in roots.iter() {
+                repos.extend(find_git_repos(root));
+            }
+            repos.sort();
+            repos.dedup();
+            repos
+        });
+
+        let task: Task<Result<(), Error>> = cx.spawn(async move |this, cx| {
+            let repos = work.await;
+            let again = this.update(cx, |this, cx| {
+                this.repos = Arc::new(repos);
+                this.scanning = false;
+                cx.notify();
+
+                let dirty = this.scan_dirty;
+                this.scan_dirty = false;
+                dirty
+            })?;
+
+            // Scans requested while this one ran are coalesced into one follow-up scan.
+            if again {
+                this.update(cx, |this, cx| this.rescan(cx))?;
+            }
+
+            Ok(())
+        });
+
+        task.detach();
+    }
+}
+
 /// Delay between a refresh request and the actual re-query.
 ///
 /// Bursts of events, e.g. sync progress ticks, collapse into one query.
@@ -55,7 +162,6 @@ pub struct RepoListStore {
     pub counts: Arc<HashMap<RepoAddr, RepoActivityCounts>>,
     /// Refresh coalescing, see [`RefreshGate`].
     refresh: RefreshGate,
-    tasks: Vec<Task<Result<(), Error>>>,
     _subscription: Subscription,
 }
 
@@ -75,7 +181,7 @@ impl RepoListStore {
 
         let subscription = cx.subscribe(&backend, |this, _backend, event, cx| {
             let relevant = match event {
-                BackendEvent::NostrUpdate(update) => {
+                BackendEvent::NostrUpdate(updates) => updates.iter().any(|update| {
                     // Deletions may target anything we list, always refresh.
                     if update.kind == Kind::EventDeletion || update.kind == Kind::RequestToVanish {
                         true
@@ -88,7 +194,7 @@ impl RepoListStore {
                         let is_repo_state = update.kind == Kind::RepoState;
                         is_announcement || is_repo_state
                     }
-                }
+                }),
                 BackendEvent::Published(event) => {
                     let announcement = event.kind == Kind::GitRepoAnnouncement;
 
@@ -99,7 +205,10 @@ impl RepoListStore {
 
                     announcement || deletion
                 }
-                BackendEvent::Synced | BackendEvent::SyncProgress { .. } => true,
+                // Only a completed sync refreshes the list.
+                // Progress ticks would re-scan the whole database several times
+                // per sync to reveal entries incrementally.
+                BackendEvent::Synced => true,
                 _ => false,
             };
 
@@ -108,20 +217,26 @@ impl RepoListStore {
             }
         });
 
-        let mut store = Self {
+        let weak = cx.entity().downgrade();
+        cx.defer(move |cx| {
+            let result = weak.update(cx, |this, cx| {
+                this.subscribe_remote(cx);
+                // Query the local database right away.
+                // The list never waits for the relay syncs started above to finish.
+                this.refresh_initial(cx);
+            });
+            if let Err(error) = result {
+                log::warn!("repo list store dropped before bootstrap could run: {error}");
+            }
+        });
+
+        Self {
             announcements: Arc::new(Vec::new()),
             last_activity: Arc::new(HashMap::new()),
             counts: Arc::new(HashMap::new()),
             refresh: RefreshGate::default(),
             _subscription: subscription,
-            tasks: Vec::new(),
-        };
-
-        store.subscribe_remote(cx);
-        // Query the local database right away.
-        // The list never waits for the relay syncs started above to finish.
-        store.refresh_initial(cx);
-        store
+        }
     }
 
     /// The announcements of `user`, newest first.
@@ -133,14 +248,6 @@ impl RepoListStore {
             .collect()
     }
 
-    /// Track a spawned task, pruning finished tasks first.
-    ///
-    /// Keeps the store's task list bounded by the number of in-flight tasks.
-    fn push_task(&mut self, task: Task<Result<(), Error>>) {
-        self.tasks.retain(|task| !task.is_ready());
-        self.tasks.push(task);
-    }
-
     /// Negentropy-sync announcements with the bootstrap relays.
     fn subscribe_remote(&mut self, cx: &mut Context<Self>) {
         let backend = Backend::global(cx);
@@ -171,13 +278,11 @@ impl RepoListStore {
             return;
         }
 
-        let task = cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             cx.background_executor().timer(REFRESH_DEBOUNCE).await;
-
             this.update(cx, |this, cx| this.run_refresh(cx))
-        });
-
-        self.push_task(task);
+        })
+        .detach();
     }
 
     /// One query and apply cycle, the debounced entry point.
@@ -294,7 +399,7 @@ impl RepoListStore {
             Ok::<_, Error>((announcements, last_activity, counts))
         });
 
-        self.push_task(cx.spawn(async move |this, cx| {
+        cx.spawn(async move |this, cx| {
             let (announcements, last_activity, counts) = match work.await {
                 Ok(results) => results,
                 // Database errors are transient, keep the last list.
@@ -321,6 +426,7 @@ impl RepoListStore {
             }
 
             Ok(())
-        }));
+        })
+        .detach();
     }
 }

crates/signed_ui/src/user_avatar.rs

@@ -1,7 +1,7 @@
 use gpui::prelude::*;
 use gpui::{App, SharedString, StyleRefinement, Window};
 use gpui_component::avatar::Avatar;
-use gpui_component::{ActiveTheme, Sizable, StyledExt};
+use gpui_component::{ActiveTheme, Sizable, Size, StyledExt};
 
 /// A small user avatar from gpui-component [`Avatar`], rounded with the theme radius.
 /// It shows the user's picture or falls back to name initials.
@@ -9,6 +9,7 @@ use gpui_component::{ActiveTheme, Sizable, StyledExt};
 pub struct UserAvatar {
     name: SharedString,
     picture: Option<SharedString>,
+    size: Size,
     style: StyleRefinement,
 }
 
@@ -19,6 +20,7 @@ impl UserAvatar {
         Self {
             name: name.into(),
             picture: None,
+            size: Size::Small,
             style: StyleRefinement::default(),
         }
     }
@@ -30,6 +32,13 @@ impl UserAvatar {
     }
 }
 
+impl Sizable for UserAvatar {
+    fn with_size(mut self, size: impl Into<Size>) -> Self {
+        self.size = size.into();
+        self
+    }
+}
+
 impl Styled for UserAvatar {
     fn style(&mut self) -> &mut StyleRefinement {
         &mut self.style
@@ -43,6 +52,6 @@ impl RenderOnce for UserAvatar {
             .when_some(self.picture, |this, url| this.src(url))
             .rounded(cx.theme().radius)
             .refine_style(&self.style)
-            .small()
+            .with_size(self.size)
     }
 }

crates/workspace/src/views/inbox.rs

@@ -0,0 +1,739 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::Duration;
+
+use anyhow::Error;
+use dock::{BasePanel, DockArea, Panel, PanelEvent};
+use gpui::prelude::*;
+use gpui::{
+    AnyElement, App, Context, Div, EventEmitter, FocusHandle, Focusable, ListAlignment, ListState,
+    Pixels, Render, SharedString, Stateful, Subscription, Task, WeakEntity, Window, div, list, px,
+};
+use gpui_component::button::{Button, ButtonVariants};
+use gpui_component::{ActiveTheme, Icon, IconName, IconNamed, Sizable, StyledExt, h_flex, v_flex};
+use nostr::prelude::{Event, EventId, Kind, PublicKey, Timestamp};
+use signed_core::{COVER_NOTE_KIND, InboxItem, InboxReadState, RepoAddr, filters};
+use signed_state::{
+    Backend, BackendEvent, ProfileStore, RefreshGate, RefreshRequest, RepoListStore, query_inbox,
+};
+use signed_ui::{CountBadge, UserAvatar};
+use utils::relative_time;
+
+use super::{RepoItem, open_repo_item};
+
+/// Delay between a refresh request and the actual re-query.
+const REFRESH_DEBOUNCE: Duration = Duration::from_millis(300);
+
+/// Extra list rows measured above and below the visible area.
+const LIST_OVERDRAW: Pixels = px(400.);
+
+/// Maximum number of sub-activity lines shown under a thread row.
+const MAX_SUB_ACTIVITIES: usize = 5;
+
+/// A repository's slice of the inbox: the threads that belong to it.
+struct InboxSection {
+    /// Repository the section groups, `None` for items without one.
+    address: Option<RepoAddr>,
+    /// Number of threads with an unread event.
+    unread: usize,
+    /// Indices into the threads, newest activity first.
+    entries: Vec<usize>,
+    /// Timestamp of the newest entry, used to order the sections.
+    latest: Timestamp,
+}
+
+#[derive(Clone, Copy)]
+enum InboxRow {
+    Repo(usize),
+    Entry(usize, usize),
+    Empty,
+}
+
+pub struct InboxView {
+    focus_handle: FocusHandle,
+    dock_area: WeakEntity<DockArea>,
+    /// One row per thread, merging notifications and own activity, newest first.
+    threads: Arc<Vec<InboxItem>>,
+    /// The threads grouped by repository, newest first.
+    sections: Arc<Vec<InboxSection>>,
+    /// The flattened repository headers and rows of the list.
+    rows: Arc<Vec<InboxRow>>,
+    /// Number of non-archived threads with an unread event.
+    unread_count: usize,
+    /// Copy of the global read state the current lists were derived with.
+    state: InboxReadState,
+    /// Set once the global state has been read for the current user.
+    state_loaded: bool,
+    refresh: RefreshGate,
+    list: ListState,
+    tasks: Vec<Task<Result<(), Error>>>,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl InboxView {
+    pub fn new(dock_area: WeakEntity<DockArea>, cx: &mut Context<Self>) -> Self {
+        let backend = Backend::global(cx);
+        let inbox = backend.read(cx).inbox();
+        let repos = RepoListStore::global(cx);
+        let weak = cx.entity().downgrade();
+
+        let list = ListState::new(0, ListAlignment::Top, LIST_OVERDRAW);
+        let mut subscriptions = vec![];
+
+        subscriptions.push(cx.observe(&inbox, |this, _inbox, cx| {
+            this.sync_state(cx);
+        }));
+
+        subscriptions.push(cx.subscribe(&backend, |this, _backend, event, cx| {
+            this.handle_backend_event(event, cx);
+        }));
+
+        // Rebuild when the user's own repositories load or change,
+        // so a repository without any activity still gets an empty section.
+        subscriptions.push(cx.observe(&repos, |this, _repos, cx| {
+            this.rebuild(cx);
+            cx.notify();
+        }));
+
+        // Derive the sections once the panel exists.
+        cx.defer(move |cx| {
+            if let Err(error) = weak.update(cx, |this, cx| this.sync_state(cx)) {
+                log::warn!("inbox dropped before bootstrap could run: {error}");
+            }
+        });
+
+        Self {
+            focus_handle: cx.focus_handle(),
+            dock_area,
+            threads: Arc::new(Vec::new()),
+            sections: Arc::new(Vec::new()),
+            rows: Arc::new(Vec::new()),
+            unread_count: 0,
+            state: InboxReadState::default(),
+            state_loaded: false,
+            refresh: RefreshGate::default(),
+            list,
+            tasks: vec![],
+            _subscriptions: subscriptions,
+        }
+    }
+
+    /// Mark every known notification read.
+    pub fn mark_all_read(&mut self, cx: &mut Context<Self>) {
+        let Some(me) = Backend::global(cx).read(cx).current_user() else {
+            return;
+        };
+
+        let all: Vec<Event> = self
+            .threads
+            .iter()
+            .flat_map(|item| item.events.iter().cloned())
+            .collect();
+
+        let backend = Backend::global(cx);
+        let inbox = backend.read(cx).inbox();
+
+        inbox.update(cx, |inbox, cx| inbox.mark_all_read(&all, me, cx));
+    }
+
+    /// Re-derive from the global state when it is loaded or changes.
+    pub fn sync_state(&mut self, cx: &mut Context<Self>) {
+        let backend = Backend::global(cx);
+        let inbox = backend.read(cx).inbox();
+
+        let (loaded, state) = {
+            let inbox = inbox.read(cx);
+            (inbox.is_loaded(), inbox.state().clone())
+        };
+
+        if !loaded {
+            let was_present =
+                self.state_loaded || !self.threads.is_empty() || !self.sections.is_empty();
+            self.clear();
+            if was_present {
+                cx.notify();
+            }
+            return;
+        }
+
+        if !self.state_loaded {
+            self.state_loaded = true;
+            self.state = state;
+            self.refresh_initial(cx);
+            return;
+        }
+
+        if self.state != state {
+            self.state = state;
+            self.regroup(cx);
+            cx.notify();
+        }
+    }
+
+    /// Handle a backend event that can change the derived sections.
+    fn handle_backend_event(&mut self, event: &BackendEvent, cx: &mut Context<Self>) {
+        match event {
+            BackendEvent::NostrUpdate(updates) => {
+                let relevant = updates.iter().any(|update| {
+                    let is_notification = filters::NOTIFICATION_KINDS.contains(&update.kind);
+                    let is_comment = update.kind == Kind::Comment;
+                    let is_event_deletion = update.kind == Kind::EventDeletion;
+                    let is_request_to_vanish = update.kind == Kind::RequestToVanish;
+
+                    is_notification || is_comment || is_event_deletion || is_request_to_vanish
+                });
+
+                if relevant {
+                    self.refresh(cx);
+                }
+            }
+            BackendEvent::Synced | BackendEvent::Published(_) => self.refresh(cx),
+            _ => {}
+        }
+    }
+
+    /// One-shot initial load, no debounce.
+    fn refresh_initial(&mut self, cx: &mut Context<Self>) {
+        debug_assert!(!self.refresh.debouncing());
+        if self.refresh.running() {
+            self.refresh.request();
+            return;
+        }
+        self.run_refresh(cx);
+    }
+
+    /// Re-query the local database.
+    fn refresh(&mut self, cx: &mut Context<Self>) {
+        if !self.state_loaded {
+            return;
+        }
+
+        if self.refresh.request() != RefreshRequest::Schedule {
+            return;
+        }
+
+        self.tasks.push(cx.spawn(async move |this, cx| {
+            cx.background_executor().timer(REFRESH_DEBOUNCE).await;
+            this.update(cx, |this, cx| this.run_refresh(cx))
+        }));
+    }
+
+    /// One query and apply cycle, the debounced entry point.
+    fn run_refresh(&mut self, cx: &mut Context<Self>) {
+        self.refresh.begin();
+
+        let backend = Backend::global(cx);
+        let Some(me) = backend.read(cx).current_user() else {
+            self.refresh.abort();
+            return;
+        };
+
+        let client = backend.read(cx).client();
+        let state = self.state.clone();
+
+        let work = cx.background_spawn(async move { query_inbox(&client, me, &state).await });
+
+        self.tasks.push(cx.spawn(async move |this, cx| {
+            let (threads, unread_count) = match work.await {
+                Ok(results) => results,
+                Err(error) => {
+                    log::warn!("inbox refresh failed: {error}");
+                    return this.update(cx, |this, _cx| this.refresh.abort());
+                }
+            };
+
+            let again = this.update(cx, |this, cx| {
+                if backend.read(cx).current_user() != Some(me) {
+                    this.refresh.abort();
+                    return false;
+                }
+
+                this.threads = Arc::new(threads);
+                this.unread_count = unread_count;
+                this.rebuild(cx);
+                cx.notify();
+
+                this.refresh.finish()
+            })?;
+
+            if again {
+                this.update(cx, |this, cx| this.refresh(cx))?;
+            }
+
+            Ok(())
+        }));
+    }
+
+    /// Recompute the unread and archived flags from the current state.
+    fn regroup(&mut self, cx: &mut Context<Self>) {
+        let mut items = (*self.threads).clone();
+
+        for item in items.iter_mut() {
+            item.apply_state(&self.state);
+        }
+
+        self.unread_count = items.iter().filter(|item| item.is_unread()).count();
+        self.threads = Arc::new(items);
+        self.rebuild(cx);
+    }
+
+    /// Regroup the current threads by repository and flatten them into rows.
+    fn rebuild(&mut self, cx: &mut Context<Self>) {
+        let backend = Backend::global(cx);
+        let repo_list = RepoListStore::global(cx);
+        let mut sections = self.group_sections();
+
+        if let Some(me) = backend.read(cx).current_user() {
+            for announcement in repo_list.read(cx).announcements_of(&me) {
+                let address = announcement.addr();
+                let known = sections
+                    .iter()
+                    .any(|section| section.address.as_ref() == Some(&address));
+
+                if !known {
+                    sections.push(InboxSection {
+                        address: Some(address),
+                        unread: 0,
+                        entries: Vec::new(),
+                        latest: Timestamp::default(),
+                    });
+                }
+            }
+        }
+
+        sections.sort_by_key(|section| std::cmp::Reverse(section.latest));
+
+        let rows = self.flatten_rows(&sections);
+        self.sections = Arc::new(sections);
+        self.rows = Arc::new(rows);
+    }
+
+    /// Group the threads into one section per repository.
+    fn group_sections(&self) -> Vec<InboxSection> {
+        let mut by_repo: HashMap<Option<RepoAddr>, InboxSection> = HashMap::new();
+
+        for (ix, item) in self.threads.iter().enumerate() {
+            if item.archived {
+                continue;
+            }
+
+            let address = item.address.clone();
+            let section = by_repo
+                .entry(address.clone())
+                .or_insert_with(move || InboxSection {
+                    address,
+                    unread: 0,
+                    entries: Vec::new(),
+                    latest: Timestamp::default(),
+                });
+
+            if item.is_unread() {
+                section.unread += 1;
+            }
+
+            section.latest = section.latest.max(item.latest_activity());
+            section.entries.push(ix);
+        }
+
+        let mut sections: Vec<InboxSection> = by_repo.into_values().collect();
+
+        for section in &mut sections {
+            section.entries.sort_by(|a, b| {
+                self.threads[*b]
+                    .latest_activity()
+                    .cmp(&self.threads[*a].latest_activity())
+            });
+        }
+
+        sections.sort_by_key(|section| std::cmp::Reverse(section.latest));
+        sections
+    }
+
+    /// Flatten the sections into the list of repository headers and their rows.
+    fn flatten_rows(&self, sections: &[InboxSection]) -> Vec<InboxRow> {
+        let mut rows = Vec::new();
+
+        for (section_ix, section) in sections.iter().enumerate() {
+            rows.push(InboxRow::Repo(section_ix));
+
+            if section.entries.is_empty() {
+                rows.push(InboxRow::Empty);
+                continue;
+            }
+
+            rows.extend(
+                (0..section.entries.len()).map(|entry_ix| InboxRow::Entry(section_ix, entry_ix)),
+            );
+        }
+
+        rows
+    }
+
+    /// Forget everything derived for the current user.
+    fn clear(&mut self) {
+        self.threads = Arc::new(Vec::new());
+        self.sections = Arc::new(Vec::new());
+        self.rows = Arc::new(Vec::new());
+        self.unread_count = 0;
+        self.state = InboxReadState::default();
+        self.state_loaded = false;
+        // Drop any in-flight or pending run belonging to the previous user.
+        self.refresh = RefreshGate::default();
+    }
+
+    fn open(
+        &self,
+        root: EventId,
+        kind: Option<Kind>,
+        address: Option<RepoAddr>,
+        window: &mut Window,
+        cx: &mut Context<Self>,
+    ) {
+        let Some(address) = address else {
+            return;
+        };
+
+        let Some(announcement) = RepoListStore::global(cx)
+            .read(cx)
+            .announcements
+            .iter()
+            .find(|announcement| announcement.addr() == address)
+            .cloned()
+        else {
+            return;
+        };
+
+        let item = match kind {
+            Some(Kind::GitIssue) => RepoItem::Issue(root),
+            Some(Kind::GitPullRequest) => RepoItem::PullRequest(root),
+            Some(Kind::GitPatch) => RepoItem::Patch,
+            _ => return,
+        };
+
+        open_repo_item(&self.dock_area, &announcement, item, window, cx);
+    }
+
+    fn render_entry(&self, ix: usize, cx: &Context<Self>) -> AnyElement {
+        let Some(row) = self.rows.get(ix) else {
+            return div().into_any_element();
+        };
+
+        match *row {
+            InboxRow::Empty => empty_section_row(cx),
+            InboxRow::Repo(section_ix) => {
+                let Some(section) = self.sections.get(section_ix) else {
+                    return div().into_any_element();
+                };
+                repo_header(section, cx)
+            }
+            InboxRow::Entry(section_ix, entry_ix) => {
+                let Some(section) = self.sections.get(section_ix) else {
+                    return div().into_any_element();
+                };
+
+                let Some(&thread_ix) = section.entries.get(entry_ix) else {
+                    return div().into_any_element();
+                };
+
+                let Some(item) = self.threads.get(thread_ix) else {
+                    return div().into_any_element();
+                };
+
+                let root = item.root;
+                let kind = item.root_kind;
+                let address = section.address.clone();
+                let first = entry_ix == 0;
+                let last = entry_ix + 1 == section.entries.len();
+
+                thread("inbox-row", ix, item, first, last, cx)
+                    .on_click(cx.listener(move |this, _ev, window, cx| {
+                        this.open(root, kind, address.clone(), window, cx)
+                    }))
+                    .into_any_element()
+            }
+        }
+    }
+}
+
+/// Display name of the repository at `addr`, from the announcement store.
+fn repo_name(addr: Option<&RepoAddr>, cx: &App) -> Option<SharedString> {
+    let repo_list = RepoListStore::global(cx);
+    let addr = addr?;
+    repo_list
+        .read(cx)
+        .announcements
+        .iter()
+        .find(|announcement| announcement.addr() == *addr)
+        .map(|announcement| announcement.name().map(SharedString::from))
+}
+
+/// Header of a repository section.
+fn repo_header(section: &InboxSection, cx: &App) -> AnyElement {
+    let name =
+        repo_name(section.address.as_ref(), cx).unwrap_or_else(|| SharedString::from("Untitled"));
+
+    h_flex()
+        .h_12()
+        .w_full()
+        .gap_1()
+        .items_center()
+        .child(
+            div()
+                .min_w_0()
+                .text_sm()
+                .whitespace_nowrap()
+                .text_ellipsis()
+                .child(name),
+        )
+        .when(section.unread > 0, |this| {
+            this.child(CountBadge::new(section.unread))
+        })
+        .into_any_element()
+}
+
+/// Placeholder under a repository header that has nothing to show.
+fn empty_section_row(cx: &App) -> AnyElement {
+    h_flex()
+        .h_12()
+        .w_full()
+        .px_3()
+        .text_xs()
+        .text_color(cx.theme().secondary_foreground)
+        .bg(cx.theme().secondary.alpha(0.6))
+        .rounded(cx.theme().radius)
+        .child(SharedString::from("No activity yet."))
+        .into_any_element()
+}
+
+fn thread(
+    prefix: &'static str,
+    ix: usize,
+    item: &InboxItem,
+    first: bool,
+    last: bool,
+    cx: &App,
+) -> Stateful<Div> {
+    let title = SharedString::from(item.title());
+    let unread = item.is_unread();
+
+    let backend = Backend::global(cx);
+    let me = backend.read(cx).current_user();
+
+    let mut timeline = v_flex().gap_2().w_full();
+
+    for event in item.timeline(MAX_SUB_ACTIVITIES) {
+        timeline = timeline.child(sub_activity(&event, me, cx));
+    }
+
+    v_flex()
+        .id((prefix, ix))
+        .w_full()
+        .px_3()
+        .py_2()
+        .gap_2()
+        .bg(cx.theme().secondary.alpha(0.6))
+        .when(first, |this| this.rounded_t(cx.theme().radius))
+        .when(last, |this| this.rounded_b(cx.theme().radius))
+        .when(!last, |this| {
+            this.border_b_1().border_color(cx.theme().background)
+        })
+        .hover(|this| this.bg(cx.theme().secondary_hover.alpha(0.8)))
+        .child(
+            h_flex()
+                .gap_2()
+                .text_sm()
+                .child(
+                    h_flex()
+                        .size_6()
+                        .flex_shrink_0()
+                        .items_center()
+                        .justify_center()
+                        .child(Icon::new(IconName::Bell)),
+                )
+                .child(
+                    div()
+                        .min_w_0()
+                        .whitespace_nowrap()
+                        .text_ellipsis()
+                        .child(title),
+                )
+                .child(div().flex_1())
+                .when(unread, |this| {
+                    this.child(
+                        div()
+                            .flex_shrink_0()
+                            .size_2()
+                            .rounded_full()
+                            .bg(cx.theme().primary),
+                    )
+                }),
+        )
+        .child(timeline)
+}
+
+fn sub_activity(event: &Event, me: Option<PublicKey>, cx: &App) -> AnyElement {
+    let profile_store = ProfileStore::global(cx).read(cx);
+    let profile = profile_store.get(&event.pubkey);
+
+    let name = if Some(event.pubkey) == me {
+        SharedString::from("You")
+    } else {
+        profile.name()
+    };
+
+    h_flex()
+        .w_full()
+        .gap_2()
+        .items_center()
+        .child(div().w_6().flex_shrink_0())
+        .child(
+            h_flex()
+                .flex_1()
+                .min_w_0()
+                .gap_1()
+                .items_center()
+                .text_xs()
+                .child(
+                    UserAvatar::new(name.clone())
+                        .picture(profile.picture())
+                        .xsmall(),
+                )
+                .child(name)
+                .child(SharedString::from(activity_phrase(event.kind)))
+                .child(div().flex_1())
+                .child(
+                    div()
+                        .text_color(cx.theme().muted_foreground)
+                        .child(SharedString::from(relative_time(event.created_at))),
+                ),
+        )
+        .into_any_element()
+}
+
+/// Phrase describing an activity event, read as `[name] [phrase]`.
+fn activity_phrase(kind: Kind) -> &'static str {
+    if kind == COVER_NOTE_KIND {
+        return "added a note";
+    }
+
+    match kind {
+        Kind::GitIssue => "opened an issue",
+        Kind::GitPullRequest => "opened a PR",
+        Kind::GitPullRequestUpdate => "updated a PR",
+        Kind::GitPatch => "created a patch",
+        Kind::Comment => "commented",
+        Kind::GitStatusOpen => "opened a status",
+        Kind::GitStatusApplied => "applied a status",
+        Kind::GitStatusClosed => "closed a status",
+        Kind::GitStatusDraft => "drafted a status",
+        _ => "did something",
+    }
+}
+
+/// Centered muted icon and message filling its container.
+fn empty_state(icon: impl IconNamed, message: &str, cx: &App) -> AnyElement {
+    v_flex()
+        .w_full()
+        .flex_1()
+        .min_h_0()
+        .items_center()
+        .justify_center()
+        .gap_2()
+        .py_8()
+        .child(
+            Icon::new(icon)
+                .large()
+                .text_color(cx.theme().muted_foreground),
+        )
+        .child(
+            div()
+                .text_sm()
+                .text_color(cx.theme().muted_foreground)
+                .child(SharedString::from(message)),
+        )
+        .into_any_element()
+}
+
+impl BasePanel for InboxView {
+    fn panel_name(&self) -> &'static str {
+        "inbox"
+    }
+}
+
+impl Panel for InboxView {
+    fn title(&mut self, _window: &mut Window, _cx: &mut Context<Self>) -> impl IntoElement {
+        div().text_sm().child(SharedString::from("Inbox"))
+    }
+}
+
+impl EventEmitter<PanelEvent> for InboxView {}
+
+impl Focusable for InboxView {
+    fn focus_handle(&self, _cx: &App) -> FocusHandle {
+        self.focus_handle.clone()
+    }
+}
+
+impl Render for InboxView {
+    fn render(&mut self, _window: &mut Window, cx: &mut Context<Self>) -> impl IntoElement {
+        let rows = self.rows.clone();
+
+        if self.list.item_count() != rows.len() {
+            self.list.reset(rows.len());
+        }
+
+        v_flex()
+            .image_cache(gpui::retain_all("inbox"))
+            .size_full()
+            .gap_2()
+            .child(
+                h_flex()
+                    .px_4()
+                    .h_12()
+                    .w_full()
+                    .gap_1()
+                    .items_center()
+                    .child(
+                        div()
+                            .text_sm()
+                            .font_semibold()
+                            .child(SharedString::from("Inbox")),
+                    )
+                    .child(div().flex_1())
+                    .child(
+                        Button::new("mark-all")
+                            .icon(IconName::CircleCheck)
+                            .secondary()
+                            .tooltip("Mark all as read")
+                            .on_click(cx.listener(move |this, _ev, _window, cx| {
+                                this.mark_all_read(cx);
+                            })),
+                    ),
+            )
+            .child(
+                div()
+                    .relative()
+                    .flex_1()
+                    .min_h_0()
+                    .px_4()
+                    .when_else(
+                        rows.is_empty(),
+                        |this| {
+                            this.child(empty_state(IconName::Inbox, "You're all caught up.", cx))
+                        },
+                        |this| {
+                            this.child(
+                                list(
+                                    self.list.clone(),
+                                    cx.processor(|this, ix, _window, cx| this.render_entry(ix, cx)),
+                                )
+                                .size_full()
+                                .min_h_0()
+                                .into_any_element(),
+                            )
+                        },
+                    )
+                    .child(div().h_6().w_full().flex_shrink_0()),
+            )
+    }
+}

crates/workspace/src/views/mod.rs

@@ -1,9 +1,11 @@
 mod dialog_state;
+mod inbox;
 mod repo_detail;
 mod repo_list;
 pub(crate) mod sidebar;
 
+pub use inbox::InboxView;
 pub use repo_detail::RepoDetailView;
-pub(crate) use repo_detail::open_repo_panel;
+pub(crate) use repo_detail::{RepoItem, open_repo_item, open_repo_panel};
 pub use repo_list::RepoListView;
 pub use sidebar::SidebarPanel;

crates/workspace/src/views/repo_detail/diff.rs

@@ -325,8 +325,6 @@ pub struct CommitDiffView {
     error: Option<SharedString>,
     /// Changed-files explorer and per-file diff, also used by the new PR panel's compare view.
     pane: Entity<DiffPane>,
-    /// In-flight tasks, pruned on every push.
-    tasks: Vec<gpui::Task<Result<(), anyhow::Error>>>,
 }
 
 impl CommitDiffView {
@@ -358,7 +356,6 @@ impl CommitDiffView {
             loading: true,
             error: None,
             pane,
-            tasks: Vec::new(),
         }
     }
 
@@ -371,7 +368,8 @@ impl CommitDiffView {
         let worktree = self.worktree.clone();
         let id = self.commit.id.clone();
 
-        let task = cx.spawn_in(window, async move |this, cx| {
+        let task: gpui::Task<Result<(), anyhow::Error>> =
+            cx.spawn_in(window, async move |this, cx| {
                 let commit = cx
                     .background_spawn({
                         let worktree = worktree.clone();
@@ -406,7 +404,7 @@ impl CommitDiffView {
                 Ok(())
             });
 
-        self.tasks.push(task);
+        task.detach();
     }
 
     /// Header with the commit id, summary, author/time and overall change stats.

crates/workspace/src/views/repo_detail/new_pull_request.rs

@@ -6,8 +6,7 @@ use dock::{BasePanel, DockArea, Panel, PanelEvent, add_center_panel, panel_handl
 use gpui::prelude::*;
 use gpui::{
     AnyElement, App, Context, Entity, EventEmitter, FocusHandle, Focusable, PathPromptOptions,
-    Pixels, Render, SharedString, Size, Subscription, Task, WeakEntity, Window, div, px, relative,
-    size,
+    Pixels, Render, SharedString, Size, Subscription, WeakEntity, Window, div, px, relative, size,
 };
 use gpui_base::{Button as BaseButton, StyledExt};
 use gpui_component::button::{Button, ButtonVariants};
@@ -22,10 +21,10 @@ use gpui_component::{
     v_virtual_list,
 };
 use nostr::prelude::*;
-use signed_core::{Announcement, RepoAddr};
+use signed_core::{Announcement, RepoAddr, fork_candidates};
 use signed_git::{
-    delete_refs_with_prefix, fetch_repo_refs, format_patch_between, merge_base, refs_with_prefix,
-    sanitize_path_component, worktree_commit_range_commits, worktree_commit_range_diff,
+    delete_refs_with_prefix, fetch_repo_refs, fork_namespace, merge_base, refs_with_prefix,
+    worktree_commit_range_commits, worktree_commit_range_diff,
 };
 use signed_state::{Backend, CheckoutsStore, GitStore, RepoListStore, RepoStore};
 use signed_ui::{CountBadge, placeholder};
@@ -79,7 +78,6 @@ pub struct NewPullRequestView {
     scroll_handle: VirtualListScrollHandle,
     item_sizes: Rc<Vec<Size<Pixels>>>,
     _subscriptions: Vec<Subscription>,
-    tasks: Vec<Task<Result<(), anyhow::Error>>>,
 }
 
 /// A fork-backed compare.
@@ -104,36 +102,6 @@ impl ForkCompare {
     }
 }
 
-/// The refs namespace of a fork's import in the target mirror.
-fn fork_namespace(announcement: &Announcement) -> String {
-    format!(
-        "{}/{}",
-        announcement.owner.to_hex(),
-        sanitize_path_component(&announcement.id)
-    )
-}
-
-/// The announced forks of `base` a New PR compare can be built from.
-fn fork_candidates<'a>(
-    announcements: &'a [Announcement],
-    base: &RepoAddr,
-    base_euc: Option<&str>,
-    user: Option<PublicKey>,
-) -> Vec<&'a Announcement> {
-    let (mut own, mut others) = (Vec::new(), Vec::new());
-    for announcement in announcements {
-        if announcement.clone.is_empty() || !announcement.is_fork_of(base, base_euc) {
-            continue;
-        }
-        if Some(announcement.owner) == user {
-            own.push(announcement);
-        } else {
-            others.push(announcement);
-        }
-    }
-    own.into_iter().chain(others).collect()
-}
-
 /// The display name of an announcement.
 ///
 /// Its human-readable name, falling back to the repository id.
@@ -363,7 +331,6 @@ impl NewPullRequestView {
             scroll_handle: VirtualListScrollHandle::new(),
             item_sizes: Rc::new(Vec::new()),
             _subscriptions: subscriptions,
-            tasks: Vec::new(),
         };
 
         // Prefill with the store's freshest associated checkout, no folder dialog.
@@ -426,7 +393,8 @@ impl NewPullRequestView {
             prompt: Some("Choose local checkout".into()),
         });
 
-        let task = cx.spawn_in(window, async move |this, cx| {
+        let task: gpui::Task<Result<(), anyhow::Error>> =
+            cx.spawn_in(window, async move |this, cx| {
                 // `Ok(Ok(Some(paths)))` means the user picked a folder.
                 // A cancel or picker failure resolves to anything else.
                 let picked = match prompt.await {
@@ -444,7 +412,7 @@ impl NewPullRequestView {
 
                 Ok(())
             });
-        self.tasks.push(task);
+        task.detach();
     }
 
     /// Apply `path` as the local checkout, no picker.
@@ -453,7 +421,8 @@ impl NewPullRequestView {
     fn apply_folder_path(&mut self, path: PathBuf, window: &mut Window, cx: &mut Context<Self>) {
         let path = path.to_string_lossy().to_string();
 
-        let task = cx.spawn_in(window, async move |this, cx| {
+        let task: gpui::Task<Result<(), anyhow::Error>> =
+            cx.spawn_in(window, async move |this, cx| {
                 // Branches and the current branch are read off the UI thread.
                 let info = cx
                     .background_spawn({
@@ -474,7 +443,7 @@ impl NewPullRequestView {
 
                 Ok(())
             });
-        self.tasks.push(task);
+        task.detach();
     }
 
     /// Apply a picked checkout, filling the selectors and loading the compare.
@@ -592,14 +561,14 @@ impl NewPullRequestView {
         let cache = GitStore::global(cx).cache().clone();
         let mirror_path = cache.repo_path(&base);
         let namespace = fork_namespace(&announcement);
-        let clone_urls: Vec<String> = announcement.clone.iter().map(ToString::to_string).collect();
+        let clone_urls = announcement.clone.clone();
 
-        let base_clone_urls: Vec<String> = self
+        let base_clone_urls: Vec<Url> = self
             .store
             .read(cx)
             .announcement
             .as_ref()
-            .map(|a| a.clone.iter().map(ToString::to_string).collect())
+            .map(|a| a.clone.clone())
             .unwrap_or_default();
 
         // Keep the current compare and base when the fork is already applied.
@@ -615,7 +584,8 @@ impl NewPullRequestView {
         self.error = None;
         cx.notify();
 
-        let task = cx.spawn_in(window, async move |this, cx| {
+        let task: gpui::Task<Result<(), anyhow::Error>> =
+            cx.spawn_in(window, async move |this, cx| {
                 // The fork and base must share history for a merge-base to exist.
                 // The target's mirror is the object store both sides land in.
                 // `ensure_clone` fetches `origin` when the mirror already exists.
@@ -696,7 +666,7 @@ impl NewPullRequestView {
 
                 Ok(())
             });
-        self.tasks.push(task);
+        task.detach();
     }
 
     /// Apply an imported fork, filling the selectors and loading the compare.
@@ -834,7 +804,8 @@ impl NewPullRequestView {
             return;
         }
 
-        let task = cx.spawn_in(window, async move |this, cx| {
+        let task: gpui::Task<Result<(), anyhow::Error>> =
+            cx.spawn_in(window, async move |this, cx| {
                 let result = cx
                     .background_spawn({
                         let repo_path = repo_path.clone();
@@ -875,7 +846,8 @@ impl NewPullRequestView {
                         Ok((merge_base, commits, diff)) => {
                             this.merge_base = Some(merge_base);
                             let count = commits.len();
-                        this.item_sizes = Rc::new(vec![size(px(0.), px(COMMIT_ROW_HEIGHT)); count]);
+                            this.item_sizes =
+                                Rc::new(vec![size(px(0.), px(COMMIT_ROW_HEIGHT)); count]);
                             this.commits = Some(commits);
                             this.pane.update(cx, |pane, cx| pane.set_diff(diff, cx));
                         }
@@ -893,7 +865,7 @@ impl NewPullRequestView {
                 Ok(())
             });
 
-        self.tasks.push(task);
+        task.detach();
     }
 
     /// Publish the pull request.
@@ -927,56 +899,35 @@ impl NewPullRequestView {
         self.error = None;
         cx.notify();
 
-        let task = cx.spawn_in(window, async move |this, cx| {
+        let task: gpui::Task<Result<(), anyhow::Error>> =
+            cx.spawn_in(window, async move |this, cx| {
                 // Regenerate the series at submit time.
                 // The published patch covers the current tip of the compare branch.
-            let patch = cx
-                .background_spawn({
-                    let repo_path = repo_path.clone();
-                    let merge_base = merge_base.clone();
-                    let compare_ref = compare_ref.clone();
-                    async move {
-                        format_patch_between(Path::new(&repo_path), &merge_base, &compare_ref)
-                    }
-                })
-                .await;
-
-            let patch = match patch {
-                Ok(patch) if !patch.is_empty() => patch,
-                Ok(_) => {
-                    this.update_in(cx, |this, _window, cx| {
-                        this.submitting = false;
-                        this.error = Some("No commits between the branches to propose".into());
-                        cx.notify();
-                    })?;
-                    return Ok(());
-                }
-                Err(error) => {
-                    this.update_in(cx, |this, _window, cx| {
-                        this.submitting = false;
-                        this.error = Some(format!("Failed to generate the patch: {error}").into());
-                        cx.notify();
-                    })?;
-                    return Ok(());
-                }
-            };
-
-            this.update_in(cx, |this, window, cx| {
-                this.submitting = false;
-
-                store.update(cx, |store, cx| {
-                    store.open_pull_request(
+                let publish = store.update(cx, |store, cx| {
+                    store.open_pull_request_from_refs(
+                        repo_path,
+                        merge_base,
+                        compare_ref,
                         (!subject.is_empty()).then_some(subject),
                         description,
                         Some(branch_name),
-                        patch,
                         false,
-                        Some(merge_base),
-                        Some(repo_path),
                         cx,
-                    );
+                    )
                 });
 
+                if let Err(error) = publish.await {
+                    this.update_in(cx, |this, _window, cx| {
+                        this.submitting = false;
+                        this.error = Some(error.to_string().into());
+                        cx.notify();
+                    })?;
+                    return Ok(());
+                }
+
+                this.update_in(cx, |this, window, cx| {
+                    this.submitting = false;
+
                     // Close the panel once the publish is underway.
                     cx.defer_in(window, {
                         let dock_area = dock_area.clone();
@@ -996,7 +947,7 @@ impl NewPullRequestView {
                 Ok(())
             });
 
-        self.tasks.push(task);
+        task.detach();
     }
 
     /// Open the diff of `commit_id`, from the Commits tab, in a new panel.
@@ -1459,140 +1410,3 @@ impl Render for NewPullRequestView {
             )
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use nostr::prelude::*;
-    use signed_core::repo_addr;
-
-    use super::*;
-
-    const OWNER_KEYS: [&str; 3] = [
-        "0000000000000000000000000000000000000000000000000000000000000001",
-        "0000000000000000000000000000000000000000000000000000000000000002",
-        "0000000000000000000000000000000000000000000000000000000000000003",
-    ];
-
-    /// Build a signed kind-30617 event for `owner` with the given tags.
-    fn announcement_event(owner: &str, tags: &[&[&str]]) -> Event {
-        let keys = Keys::new(SecretKey::from_hex(owner).expect("valid secret key"));
-        let tags: Vec<Tag> = tags
-            .iter()
-            .map(|t| Tag::parse(t.to_vec()).expect("valid tag"))
-            .collect();
-        EventBuilder::new(Kind::GitRepoAnnouncement, "")
-            .tags(tags)
-            .finalize(&keys)
-            .expect("signed event")
-    }
-
-    fn announcements(owner_ix: usize, tags: &[&[&str]]) -> Vec<Announcement> {
-        vec![
-            Announcement::from_event(&announcement_event(OWNER_KEYS[owner_ix], tags))
-                .expect("parses"),
-        ]
-    }
-
-    #[test]
-    fn fork_candidates_orders_own_forks_first() {
-        let euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
-        let clone = "https://grasp.example/npub1x/my-fork.git";
-
-        let base_addr = repo_addr(
-            PublicKey::from_hex(OWNER_KEYS[0]).expect("pubkey"),
-            "upstream",
-        );
-        // Newest first, as RepoListStore keeps them.
-        // Unrelated repo, the user's fork with the shared EUC, another fork with a `u` tag.
-        let all = vec![
-            announcements(
-                2,
-                &[
-                    &["d", "other-project"],
-                    &["r", "bb231c4c6a5777dc89b42207b499891a344add5c", "euc"],
-                ],
-            )
-            .pop()
-            .unwrap(),
-            announcements(
-                1,
-                &[&["d", "my-fork"], &["r", euc, "euc"], &["clone", clone]],
-            )
-            .pop()
-            .unwrap(),
-            announcements(
-                2,
-                &[
-                    &["d", "their-fork"],
-                    &["u", &base_addr.to_string()],
-                    &["clone", clone],
-                ],
-            )
-            .pop()
-            .unwrap(),
-        ];
-
-        let user = PublicKey::from_hex(OWNER_KEYS[1]).expect("pubkey");
-        let forks = fork_candidates(&all, &base_addr, Some(euc), Some(user));
-
-        // The user's fork comes first, then the other author's.
-        let ids: Vec<&str> = forks.iter().map(|a| a.id.as_str()).collect();
-        assert_eq!(ids, vec!["my-fork", "their-fork"]);
-    }
-
-    #[test]
-    fn fork_candidates_excludes_base_unrelated_and_unfetchable() {
-        let euc = "aa231c4c6a5777dc89b42207b499891a344add5c";
-        let base_owner = PublicKey::from_hex(OWNER_KEYS[0]).expect("pubkey");
-        let base_addr = repo_addr(base_owner, "upstream");
-
-        let mut all = vec![
-            announcements(0, &[&["d", "upstream"], &["r", euc, "euc"]])
-                .pop()
-                .unwrap(),
-            announcements(1, &[&["d", "no-clone-fork"], &["r", euc, "euc"]])
-                .pop()
-                .unwrap(),
-            announcements(
-                2,
-                &[
-                    &["d", "other"],
-                    &["r", "cc231c4c6a5777dc89b42207b499891a344add5c", "euc"],
-                ],
-            )
-            .pop()
-            .unwrap(),
-            announcements(
-                2,
-                &[
-                    &["d", "mirror"],
-                    &["r", euc, "euc"],
-                    &["clone", "https://grasp.example/x/mirror.git"],
-                ],
-            )
-            .pop()
-            .unwrap(),
-        ];
-
-        let forks = fork_candidates(&all, &base_addr, Some(euc), Some(base_owner));
-        assert_eq!(forks.len(), 1);
-        assert_eq!(forks[0].id, "mirror");
-
-        // Without a base EUC only `u`-tag forks match.
-        all.push(
-            announcements(
-                2,
-                &[
-                    &["d", "u-fork"],
-                    &["u", &base_addr.to_string()],
-                    &["clone", "https://grasp.example/x/u-fork.git"],
-                ],
-            )
-            .pop()
-            .unwrap(),
-        );
-        let forks = fork_candidates(&all, &base_addr, None, Some(base_owner));
-        let ids: Vec<&str> = forks.iter().map(|a| a.id.as_str()).collect();
-        assert_eq!(ids, vec!["u-fork"]);
-    }
-}

crates/workspace/src/views/repo_detail/pull_request_detail.rs

@@ -6,7 +6,7 @@ use dock::{BasePanel, DockArea, DockPlacement, Panel, PanelEvent, panel_handle};
 use gpui::prelude::*;
 use gpui::{
     AnyElement, App, Context, Entity, EventEmitter, FocusHandle, Focusable, Pixels, Render,
-    SharedString, Size, Task, WeakEntity, Window, div, px, relative, size,
+    SharedString, Size, WeakEntity, Window, div, px, relative, size,
 };
 use gpui_component::button::{Button, ButtonVariants};
 use gpui_component::clipboard::Clipboard;
@@ -20,8 +20,11 @@ use gpui_component::{
     ActiveTheme, Sizable, StyledExt, VirtualListScrollHandle, WindowExt, h_flex, v_flex,
     v_virtual_list,
 };
-use nostr::prelude::{Event, EventId, Kind, Nip34Tag};
-use signed_core::{activity_subject, pull_request_patch};
+use nostr::prelude::{Event, EventId, Kind};
+use signed_core::{
+    activity_subject, branch_name_of, clone_urls_of, current_commit_of, latest_update,
+    merge_base_of, pull_request_patch,
+};
 use signed_git::{FileCommit, patch_commits, patch_diffs};
 use signed_state::{Backend, GitStore, ProfileStore, RepoStore};
 use signed_ui::{CountBadge, UserAvatar, placeholder, status_badge};
@@ -66,8 +69,6 @@ pub struct PullRequestDetailView {
     commit_item_sizes: Rc<Vec<Size<Pixels>>>,
     /// Virtual list state of the commits tab.
     commit_scroll_handle: VirtualListScrollHandle,
-    /// In-flight tasks, finished tasks are pruned on every push.
-    tasks: Vec<Task<Result<(), anyhow::Error>>>,
 }
 
 impl PullRequestDetailView {
@@ -106,7 +107,6 @@ impl PullRequestDetailView {
             pane,
             commit_item_sizes: Rc::new(Vec::new()),
             commit_scroll_handle: VirtualListScrollHandle::new(),
-            tasks: Vec::new(),
         }
     }
 
@@ -142,12 +142,8 @@ impl PullRequestDetailView {
                 .and_then(merge_base_of)
                 .or_else(|| merge_base_of(root));
 
-            let clone_urls = clone_urls_of(root).or_else(|| {
-                store
-                    .announcement
-                    .as_ref()
-                    .map(|a| a.clone.iter().map(ToString::to_string).collect())
-            });
+            let clone_urls = clone_urls_of(root)
+                .or_else(|| store.announcement.as_ref().map(|a| a.clone.clone()));
 
             (
                 root.content.clone(),
@@ -162,7 +158,8 @@ impl PullRequestDetailView {
 
         self.description = description.into();
 
-        let task = cx.spawn_in(window, async move |this, cx| {
+        let task: gpui::Task<Result<(), anyhow::Error>> =
+            cx.spawn_in(window, async move |this, cx| {
                 let nostr_diff = cx
                     .background_spawn({
                         let patch = patch.clone();
@@ -202,8 +199,8 @@ impl PullRequestDetailView {
                                 .ok_or_else(|| anyhow::anyhow!("repository has no worktree"))?
                                 .to_path_buf();
 
-                        let tip =
-                            tip.ok_or_else(|| anyhow::anyhow!("pull request has no tip commit"))?;
+                            let tip = tip
+                                .ok_or_else(|| anyhow::anyhow!("pull request has no tip commit"))?;
 
                             let base = match base {
                                 Some(base) => base,
@@ -217,7 +214,8 @@ impl PullRequestDetailView {
                                 }
                             };
 
-                        let diff = signed_git::worktree_commit_range_diff(&workdir, &base, &tip)?;
+                            let diff =
+                                signed_git::worktree_commit_range_diff(&workdir, &base, &tip)?;
                             let commits =
                                 signed_git::worktree_commit_range_commits(&workdir, &base, &tip)?;
 
@@ -237,7 +235,8 @@ impl PullRequestDetailView {
                     this.loading = false;
                     this.worktree = worktree;
                     this.current_commit = current_commit.map(SharedString::from);
-                this.commit_item_sizes = Rc::new(vec![size(px(0.), px(ROW_HEIGHT)); commits.len()]);
+                    this.commit_item_sizes =
+                        Rc::new(vec![size(px(0.), px(ROW_HEIGHT)); commits.len()]);
                     this.commits = commits;
 
                     match diff {
@@ -255,8 +254,7 @@ impl PullRequestDetailView {
                 Ok(())
             });
 
-        self.tasks.retain(|task| !task.is_ready());
-        self.tasks.push(task);
+        task.detach();
     }
 
     /// Open the diff of `commit_id` in the bottom dock of the area.
@@ -706,66 +704,6 @@ fn open_update_pull_request_dialog(
 }
 
 /// The `c` tag of a PR event, the commit the proposal points at.
-fn current_commit_of(root: &Event) -> Option<String> {
-    root.tags
-        .iter()
-        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::CurrentCommit(commit)) => Some(commit.to_string()),
-            _ => None,
-        })
-}
-
-/// The `merge-base` tag of a PR event, as hex.
-///
-/// The most recent common ancestor with the target branch.
-fn merge_base_of(event: &Event) -> Option<String> {
-    event
-        .tags
-        .iter()
-        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::MergeBase(commit)) => Some(commit.to_string()),
-            _ => None,
-        })
-}
-
-/// The `clone` tag of a PR event.
-///
-/// URLs where the proposed branch can be fetched, or `None` if the PR has none.
-fn clone_urls_of(event: &Event) -> Option<Vec<String>> {
-    event
-        .tags
-        .iter()
-        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::Clone(urls)) => Some(urls.iter().map(ToString::to_string).collect()),
-            _ => None,
-        })
-}
-
-/// The `branch-name` tag of a PR event, if any.
-fn branch_name_of(event: &Event) -> Option<String> {
-    event
-        .tags
-        .iter()
-        .find_map(|tag| match Nip34Tag::parse(tag.as_slice()) {
-            Ok(Nip34Tag::BranchName(name)) => Some(name),
-            _ => None,
-        })
-}
-
-/// The latest PR update, kind 1619, revising `root`.
-fn latest_update<'a>(events: impl Iterator<Item = &'a Event>, root: &Event) -> Option<&'a Event> {
-    let root_hex = root.id.to_hex();
-    events
-        .filter(|e| e.kind == Kind::GitPullRequestUpdate)
-        .filter(|e| e.pubkey == root.pubkey)
-        .filter(|e| {
-            e.tags
-                .iter()
-                .any(|t| t.kind() == "E" && t.content() == Some(root_hex.as_str()))
-        })
-        .max_by_key(|e| e.created_at)
-}
-
 /// One-line commit metadata for the commits list.
 ///
 /// Author and relative time, whichever is available.
@@ -826,104 +764,9 @@ impl Render for PullRequestDetailView {
 
 #[cfg(test)]
 mod tests {
-    use nostr::prelude::{Tag, *};
-
     use super::*;
 
     const COMMIT_HEX: &str = "1111111111111111111111111111111111111111";
-    const OTHER_ROOT_HEX: &str = "2222222222222222222222222222222222222222";
-
-    fn keys() -> Keys {
-        Keys::new(
-            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000001")
-                .expect("valid secret key"),
-        )
-    }
-
-    /// Build a signed event with a controlled `created_at`.
-    fn signed(kind: Kind, tags: Vec<Tag>, created_at: u64) -> Event {
-        EventBuilder::new(kind, "")
-            .tags(tags)
-            .custom_created_at(Timestamp::from(created_at))
-            .finalize(&keys())
-            .expect("signed event")
-    }
-
-    fn pr_root() -> Event {
-        signed(
-            Kind::GitPullRequest,
-            vec![
-                Tag::parse(["c", COMMIT_HEX]).expect("valid tag"),
-                Tag::parse(["branch-name", "feature/x"]).expect("valid tag"),
-            ],
-            100,
-        )
-    }
-
-    #[test]
-    fn reads_current_commit_and_branch_name() {
-        let pr = pr_root();
-        assert_eq!(current_commit_of(&pr).as_deref(), Some(COMMIT_HEX));
-        assert_eq!(branch_name_of(&pr).as_deref(), Some("feature/x"));
-    }
-
-    #[test]
-    fn returns_none_without_pr_tags() {
-        let pr = signed(Kind::GitPullRequest, vec![], 100);
-        assert_eq!(current_commit_of(&pr), None);
-        assert_eq!(branch_name_of(&pr), None);
-    }
-
-    #[test]
-    fn latest_update_picks_newest_revision_of_the_root() {
-        let root = pr_root();
-        let root_hex = root.id.to_hex();
-
-        let revision = |created_at: u64| {
-            signed(
-                Kind::GitPullRequestUpdate,
-                vec![Tag::parse(["E", &root_hex]).expect("valid tag")],
-                created_at,
-            )
-        };
-        // An update revising a different PR must be ignored even though it is newer.
-        let unrelated = signed(
-            Kind::GitPullRequestUpdate,
-            vec![Tag::parse(["E", OTHER_ROOT_HEX]).expect("valid tag")],
-            999,
-        );
-
-        let events = [unrelated, revision(200), root.clone(), revision(300)];
-        let latest = latest_update(events.iter(), &root).expect("an update");
-
-        assert_eq!(latest.created_at.as_secs(), 300);
-        assert_eq!(latest.kind, Kind::GitPullRequestUpdate);
-    }
-
-    #[test]
-    fn latest_update_ignores_other_authors() {
-        let root = pr_root();
-        let root_hex = root.id.to_hex();
-        let other = Keys::new(
-            SecretKey::from_hex("0000000000000000000000000000000000000000000000000000000000000002")
-                .expect("valid secret key"),
-        );
-        let stranger = EventBuilder::new(Kind::GitPullRequestUpdate, "")
-            .tags([Tag::parse(["E", &root_hex]).expect("valid tag")])
-            .custom_created_at(Timestamp::from(999))
-            .finalize(&other)
-            .expect("signed event");
-
-        // The tip of a PR is only mutable by its author.
-        // A newer update from anyone else must not win.
-        assert!(latest_update([&stranger, &root].into_iter(), &root).is_none());
-    }
-
-    #[test]
-    fn latest_update_ignores_roots_without_revisions() {
-        let root = pr_root();
-        assert!(latest_update([&root].into_iter(), &root).is_none());
-    }
 
     #[test]
     fn commit_meta_combines_author_and_time() {

crates/workspace/src/views/sidebar/mod.rs

@@ -23,7 +23,7 @@ use signed_state::{
 };
 use signed_ui::{NavItem, PixelAvatar, UserAvatar, title_bar_drag_handlers};
 
-use super::{RepoDetailView, RepoListView, open_repo_panel};
+use super::{InboxView, RepoDetailView, RepoListView, open_repo_panel};
 
 mod create_repo_dialog;
 pub(crate) mod grasp_servers;
@@ -37,6 +37,7 @@ use self::onboarding_dialog::OnboardingState;
 pub struct SidebarPanel {
     focus_handle: FocusHandle,
     dock_area: WeakEntity<DockArea>,
+    inbox: Option<WeakEntity<InboxView>>,
     explore: Option<WeakEntity<RepoListView>>,
     /// Artwork for the sign-in screen.
     banner: SharedString,
@@ -71,6 +72,7 @@ impl SidebarPanel {
 
             if signer_required {
                 this.banner = pick_banner();
+                cx.notify();
             }
 
             if this.refresh(cx) || signer_required {
@@ -99,9 +101,10 @@ impl SidebarPanel {
             }
         }));
 
-        let mut this = Self {
+        Self {
             focus_handle: cx.focus_handle(),
             dock_area,
+            inbox: None,
             explore: None,
             banner: pick_banner(),
             announcements: Arc::new(Vec::new()),
@@ -109,22 +112,9 @@ impl SidebarPanel {
             scanning: false,
             unpushed: HashMap::new(),
             _subscriptions: subscriptions,
-        };
-
-        // Seed the snapshot right away.
-        // The stores may already hold data from before the panel opened.
-        // The first render must not depend on a later store update.
-        this.refresh(cx);
-
-        this
+        }
     }
 
-    /// The sidebar renders only its own derived fields, never the stores
-    /// directly. Because the panel is a cached view, a store update alone does
-    /// not re-render it: the observers notify this panel, which re-runs
-    /// `render` over the fresh snapshot.
-    ///
-    /// Returns `true` when a rendered field changed.
     fn refresh(&mut self, cx: &mut Context<Self>) -> bool {
         let backend = Backend::global(cx);
         let user = backend.read(cx).current_user();
@@ -203,6 +193,20 @@ impl SidebarPanel {
         });
     }
 
+    /// Open the inbox home panel in the dock area's center.
+    pub fn open_inbox(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        if self.inbox.as_ref().and_then(WeakEntity::upgrade).is_some() {
+            return;
+        }
+
+        let panel = cx.new(|cx| InboxView::new(self.dock_area.clone(), cx));
+        self.inbox = Some(panel.downgrade());
+
+        let _ = self.dock_area.update(cx, |dock_area, cx| {
+            add_center_panel(dock_area, panel_handle(panel), window, cx);
+        });
+    }
+
     /// Open the Explore repository list panel in the dock area's center.
     pub fn open_explore(&mut self, window: &mut Window, cx: &mut Context<Self>) {
         if self
@@ -616,7 +620,7 @@ impl Render for SidebarPanel {
                             .child(
                                 NavItem::new("inbox", "Inbox", Icon::new(IconName::Inbox).small())
                                     .on_click(cx.listener(|this, _ev, window, cx| {
-                                        this.open_explore(window, cx)
+                                        this.open_inbox(window, cx)
                                     })),
                             )
                             .child(

desktop/Cargo.toml

@@ -8,6 +8,24 @@ publish.workspace = true
 name = "signed"
 path = "src/main.rs"
 
+[package.metadata.packager]
+name = "Signed"
+product-name = "Signed"
+description = "Nostr Git client for browsing repositories and collaborating"
+identifier = "su.reya.signed"
+category = "DeveloperTool"
+version = "0.1.0-alpha"
+out-dir = "../dist"
+before-packaging-command = "cargo build --release"
+resources = ["Cargo.toml", "src"]
+icons = [
+    "resources/32x32.png",
+    "resources/128x128.png",
+    "resources/128x128@2x.png",
+    "resources/icon.icns",
+    "resources/icon.ico",
+]
+
 [dependencies]
 assets = { path = "../crates/assets" }
 paths = { path = "../crates/paths" }

desktop/resources/flatpak/manifest-template.json

@@ -0,0 +1,58 @@
+{
+  "id": "$APP_ID",
+  "runtime": "org.freedesktop.Platform",
+  "runtime-version": "24.08",
+  "sdk": "org.freedesktop.Sdk",
+  "sdk-extensions": ["org.freedesktop.Sdk.Extension.rust-stable"],
+  "command": "signed",
+  "finish-args": [
+    "--talk-name=org.freedesktop.Flatpak",
+    "--device=dri",
+    "--share=ipc",
+    "--share=network",
+    "--socket=wayland",
+    "--socket=fallback-x11",
+    "--socket=pulseaudio",
+    "--filesystem=host"
+  ],
+  "build-options": {
+    "append-path": "/usr/lib/sdk/rust-stable/bin"
+  },
+  "modules": [
+    {
+      "name": "signed",
+      "buildsystem": "simple",
+      "build-options": {
+        "env": {
+          "APP_ID": "$APP_ID",
+          "APP_ICON": "$APP_ID",
+          "APP_NAME": "$APP_NAME",
+          "BRANDING_LIGHT": "$BRANDING_LIGHT",
+          "BRANDING_DARK": "$BRANDING_DARK",
+          "APP_CLI": "signed",
+          "APP_ARGS": "--foreground %U",
+          "DO_STARTUP_NOTIFY": "false"
+        }
+      },
+      "build-commands": [
+        "install -Dm644 $ICON_FILE.png /app/share/icons/hicolor/512x512/apps/$APP_ID.png",
+        "envsubst < signed.desktop.in > signed.desktop && install -Dm644 signed.desktop /app/share/applications/$APP_ID.desktop",
+        "envsubst < flatpak/signed.metainfo.xml.in > signed.metainfo.xml && install -Dm644 signed.metainfo.xml /app/share/metainfo/$APP_ID.metainfo.xml",
+        "sed -i -e '/@release_info@/{r flatpak/release-info/$CHANNEL' -e 'd}' /app/share/metainfo/$APP_ID.metainfo.xml",
+        "install -Dm755 bin/signed /app/bin/signed",
+        "install -Dm755 libexec/signed /app/libexec/signed",
+        "install -Dm755 lib/* -t /app/lib"
+      ],
+      "sources": [
+        {
+          "type": "archive",
+          "path": "./target/release/$ARCHIVE"
+        },
+        {
+          "type": "dir",
+          "path": "./desktop/resources"
+        }
+      ]
+    }
+  ]
+}

desktop/resources/flatpak/signed.metainfo.xml.in

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<component type="desktop-application">
+    <id>$APP_ID</id>
+    <metadata_license>MIT</metadata_license>
+    <project_license>GPL-3.0-or-later</project_license>
+
+    <name>$APP_NAME</name>
+    <summary>GPUI desktop Git client</summary>
+
+    <developer id="su.reya">
+        <name translate="no">Ren Amamiya</name>
+    </developer>
+
+    <description>
+        <p>
+            Signed is a desktop Git client built with GPUI.
+        </p>
+        <p>
+            Browse repositories and their history, review commits and diffs, and
+            collaborate through issues, pull requests, and patches.
+        </p>
+    </description>
+
+    <launchable type="desktop-id">$APP_ID.desktop</launchable>
+
+    <branding>
+        <color type="primary" scheme_preference="light">$BRANDING_LIGHT</color>
+        <color type="primary" scheme_preference="dark">$BRANDING_DARK</color>
+    </branding>
+
+    <content_rating type="oars-1.1"/>
+
+    <url type="homepage">https://git.reya.su/reya/signed</url>
+    <url type="bugtracker">https://git.reya.su/reya/signed/issues</url>
+    <url type="faq">https://git.reya.su/reya/signed</url>
+    <url type="help">https://git.reya.su/reya/signed/issues</url>
+    <url type="contact">https://reya.su/</url>
+    <url type="vcs-browser">https://git.reya.su/reya/signed</url>
+
+    <recommends>
+        <control>pointing</control>
+        <control>keyboard</control>
+        <display_length compare="ge">768</display_length>
+    </recommends>
+
+    <releases>
+		@release_info@
+		<release version="0.0.0" date="1970-01-01">
+			<description>
+				<p>Dummy release to keep flatpak-builder AppStream metadata validation from complaining</p>
+			</description>
+		</release>
+    </releases>
+</component>

desktop/resources/signed.desktop.in

@@ -0,0 +1,12 @@
+[Desktop Entry]
+Version=1.0
+Type=Application
+Name=$APP_NAME
+GenericName=Nostr Git Client
+Comment=Nostr Git client for browsing repositories and collaborating
+TryExec=$APP_CLI
+StartupNotify=$DO_STARTUP_NOTIFY
+Exec=$APP_CLI $APP_ARGS
+Icon=$APP_ICON
+Categories=Development;RevisionControl;
+Keywords=git;repository;diff;commit;pull-request;patch;

desktop/resources/snap/snapcraft.yaml.in

@@ -0,0 +1,57 @@
+name: signed
+title: Signed
+base: core24
+version: "$RELEASE_VERSION"
+summary: GPUI desktop Git client for browsing repositories and collaborating
+description: |
+  Browse repositories and their history, review commits and diffs, and
+  collaborate through issues, pull requests, and patches.
+grade: stable
+confinement: classic
+compression: lzo
+website: https://git.reya.su/reya/signed
+source-code: https://git.reya.su/reya/signed
+issues: https://git.reya.su/reya/signed/issues
+contact: https://reya.su
+
+parts:
+  signed:
+    plugin: dump
+    source: target/release/signed-linux-$ARCH_SUFFIX.tar.gz
+
+    organize:
+      # These renames seem to not be necessary, but it's tidier.
+      bin: usr/bin
+      libexec: usr/libexec
+
+    stage-packages:
+      - libasound2t64
+      # snapcraft has a lint that this is unused, but without it Signed exits with
+      # "Missing Vulkan entry points: LibraryLoadFailure" in blade_graphics.
+      - libvulkan1
+      # snapcraft has a lint that this is unused, but without it Signed exits with
+      # "NoWaylandLib" when run with Wayland.
+      - libwayland-client0
+      - libxcb1
+      - libxkbcommon-x11-0
+      - libxkbcommon0
+
+    build-attributes:
+      - enable-patchelf
+
+    prime:
+      # Omit unneeded files from the tarball
+      - -lib
+      - -licenses.md
+      - -share
+
+      # Omit unneeded files from stage-packages
+      - -etc
+      - -usr/share/doc
+      - -usr/share/lintian
+      - -usr/share/man
+
+apps:
+  signed:
+    command: usr/bin/signed
+    common-id: su.reya.signed

docs/PR_FLOW.md

@@ -1,173 +0,0 @@
-# Pull request flow
-
-How a pull request moves through Signed from creation to merge. A PR is a
-kind-1618 root event whose content is the markdown description; its changes
-live in a NIP-10-chained series of kind-1617 patch events (one per commit),
-whose root the PR references via an `e` tag. Revisions publish new patch
-events plus kind-1619 updates; statuses (kind 1630-1633) resolve the PR's
-state.
-
-## Whole lifecycle
-
-```mermaid
-graph TD
-    A["New pull request panel"] --> B{"Compare source"}
-    B -->|"Local checkout"| C["Pick folder (or auto-prefilled from remembered checkouts)"]
-    B -->|"Announced fork"| D["Pick fork repo + branch"]
-    D --> D1["Ensure base mirror (GitCache), fetch origin"]
-    D1 --> D2["Import fork heads as refs/fork/<owner>/<id>/*"]
-    C --> E["Defaults: target = announced HEAD, source = current branch / fork main"]
-    E --> F["merge-base + commits + diff of target..source (Files/Commits tabs)"]
-    F --> H["Submit: format-patch base..tip at publish time"]
-    H --> I["split_patch_series: one part per commit"]
-    I --> J{"Any part over 60 KB?"}
-    J -->|"Yes"| K["Refuse with message"]
-    J -->|"No"| L["tip = last part's From commit"]
-    L --> M["Publish kind-1617 patch series: first has t root, later parts e-reply chained"]
-    M --> N["Build kind-1618 PR event: c = tip, e = root patch, branch-name, merge-base, clone"]
-    N --> O["Sign early - learn the event id"]
-    O --> P["Push tip to refs/nostr/event-id: author /prs/ grasp servers first, then the announced servers"]
-    P -->|"All rejected"| Q["last_warning banner in PR list"]
-    P --> R["Publish kind-1618 PR event"]
-    Q --> R
-    R --> S{"Draft?"}
-    S -->|"Yes"| T["Publish kind-1633 draft status"]
-    S -->|"No"| U["PR open"]
-    T --> U
-    U --> V{"Author updates?"}
-    V -->|"Yes"| W["Publish revision patch series: first has t root-revision and e-replies to the original root"]
-    W --> X["Publish kind-1619 update: E/P NIP-22 tags, c = new tip"]
-    X --> U
-    V -->|"No"| Y{"Repository author merges?"}
-    Y -->|"Yes"| Z["Apply the series with git am on the mirror clone"]
-    Z --> AA["applied = rev-list previous-head..HEAD"]
-    AA --> AB["Publish kind-1631 applied status: applied-as-commits plus r per commit, q plus e-reply per patch event"]
-    AB --> AC["PR merged"]
-    Y -->|"Close instead"| AD["Publish kind-1632 closed status"]
-    AD --> AE["PR closed"]
-```
-
-Key points of the write side:
-
-- **Compare sources** (NIP-34 / GRASP-06 native, no fork identity on the
-  wire):
-  - *Local checkout*: both branch selectors list a picked folder's
-    branches; all git ops run in that folder. Checkouts of the target repo
-    are remembered (folder pick + app clones) and matched implicitly
-    (origin URL or EUC against the announcement), so the panel prefills the
-    freshest one - no folder dialog for the common case.
-  - *Announced fork*: the fork's heads are fetched into the target repo's
-    GitCache mirror under `refs/fork/<owner-hex>/<id>/*` (private
-    namespace; the browser never sees them). "Merge Into" lists the
-    mirror's `refs/remotes/origin/*`, "Pull From" the imported fork
-    branches, and every git op - merge-base, range diff/commits,
-    format-patch, tip push - runs in the mirror, which holds both
-    histories. Fork candidates are announcements related to the target by
-    `u` tag or shared EUC, own forks first, without `clone` URLs excluded.
-- **GRASP-06 hosting**: the tip is pushed under `refs/nostr/<event-id>`
-  (nak's convention) to the *author's* grasp servers first -
-  `https://<host>/prs/<author-npub>/<repo-id>.git`, resolved from the
-  author's kind-10317 grasp list, falling back to the settings defaults -
-  then to the base repository's announced grasp servers. The `clone` tag
-  lists those `/prs/` URLs first, then the announced clone URLs (fixed
-  before signing; dead URLs are inert, the patches stay the source of
-  truth). Contributing therefore never depends on the other project's
-  servers accepting a push.
-- **Patch series**: each commit becomes its own kind-1617 event so no event
-  grows past NIP-34's 60 KB guidance; the PR's `c` tag carries the *last*
-  commit of the series (the tip), and each part carries its own
-  `commit`/`r` tags.
-- **Push before publish**: failure is non-fatal - the patch events remain
-  the source of truth - and surfaces as a `last_warning` banner.
-- **1619 updates are paste-only today** (no repo path holds the new tip's
-  objects), so updates are not pushed; hosting them is deferred until the
-  update dialog gains a local-checkout source.
-
-## Creating a pull request - event ordering
-
-```mermaid
-sequenceDiagram
-    participant User
-    participant P as Base mirror (GitCache)
-    participant F as Fork grasp server
-    participant A as Author grasp (GRASP-06 /prs/)
-    participant B as Base repo grasps
-    participant R as Nostr relays
-
-    User->>P: ensure mirror (fork mode) / pick local checkout
-    P-->>F: fetch fork heads -> refs/fork/... (fork mode)
-    User->>P: merge-base, range commits, range diff
-    User->>P: submit: format-patch base..compare-ref
-    loop each patch of the series
-        User->>R: publish kind-1617 (first: t root, later: e reply)
-    end
-    User->>User: build and sign kind-1618 (clone = /prs/ URLs + announced)
-    User->>A: push tip to refs/nostr/event-id (author servers, first)
-    User->>B: push tip to refs/nostr/event-id (best-effort)
-    A-->>User: accepted or rejected (all rejected -> warning)
-    User->>R: publish kind-1618 PR event
-    opt draft
-        User->>R: publish kind-1633 draft status
-    end
-```
-
-## Ready to contribute (suggestions)
-
-Local checkouts are matched to announced repositories (remembered records
-freshest-first ∪ scanned matches by origin URL or EUC). While a repository's
-detail panel is open, each associated checkout is checked off the main
-thread: current branch vs its base (announced HEAD, else `main`, else the
-first branch), commits ahead, dirty worktrees excluded. A banner in the
-repository panel then offers a prefilled New PR panel for the first branch
-that is ahead with **no open PR by you** proposing it (`branch-name` tag,
-falling back to the `c` tip tag) - NIP-34-native dedupe, refreshed
-periodically and whenever the checkouts/announcements change. The panel
-never submits anything on its own; suggestions only navigate and prefill.
-
-## Updating and merging
-
-```mermaid
-sequenceDiagram
-    participant Author
-    participant Relays as Nostr relays
-    participant Maintainer
-    participant Clone as Mirror clone
-
-    Note over Author,Relays: Update - PR author only (paste flow, no push yet)
-    Author->>Relays: publish revision patch series (t root-revision, e reply to original root)
-    Author->>Relays: publish kind-1619 update (E/P tags, c = new tip)
-
-    Note over Maintainer,Clone: Merge - repository author only (store-only today)
-    Maintainer->>Clone: git am the patch series
-    Clone-->>Maintainer: applied commits (rev-list previous-head..HEAD)
-    Maintainer->>Relays: publish kind-1631 applied status
-    Note over Relays: applied-as-commits and r per commit, q and e-reply per applied patch event
-```
-
-## Reading side
-
-```mermaid
-graph TD
-    A["PR root kind-1618"] --> B{"Newest status event by author or maintainer?"}
-    B -->|"1633"| C["Draft"]
-    B -->|"1631"| D["Applied / merged"]
-    B -->|"1632"| E["Closed"]
-    B -->|"1630 or none"| F["Open"]
-    A --> G{"Newest kind-1619 update by PR author?"}
-    G -->|"Yes"| H["tip = update's c tag"]
-    G -->|"No"| I["tip = root's c tag"]
-    A --> J{"Patch set present?"}
-    J -->|"Yes"| K["Root patch via e tag, follow reply chain (newest wins per revision)"]
-    J -->|"No"| L["Diff merge-base..tip from the git clone"]
-```
-
-Reader rules that keep the flow consistent:
-
-- **Status**: only status events by the root author or a repository
-  maintainer count; the newest wins, `Open` is the default.
-- **Tip**: only kind-1619 updates by the PR author move the tip - a
-  stranger's update is ignored.
-- **Diff**: the patch set is preferred (NIP-34 `e`-linked chain); PRs from
-  other clients without patch events fall back to diffing
-  `merge-base..tip` in the local clone. Fetching tips from `clone` URLs
-  (ngit `pr checkout` analog) is not implemented yet.

docs/inbox-plan.md

@@ -0,0 +1,973 @@
+# Inbox (home screen) implementation plan
+
+Ported from GitWorkshop's home screen, the `Dashboard` rendered at route `/` for a logged-in user.
+
+> **Correction to the first draft.** The first draft assumed the inbox was the `/notifications`
+> page. It is not. GitWorkshop's `Index` route (`src/pages/Index.tsx`) renders `<Dashboard />` when
+> an account is active, and that home screen is the inbox.
+
+> **Status.** Phases 0-4 are implemented and green on `feat/inbox`, then the screen was redesigned to
+> group **threads by repository** and to merge notifications with own activity into one row per thread
+> (see the repository-grouping and thread-merge notes in §7).
+> `cargo test -p signed_core` (69), `cargo test -p signed_state` (24),
+> `cargo test -p workspace` (7), `cargo test -p dock` (1), `cargo clippy -p workspace --all-targets`
+> clean, `cargo check --workspace --all-targets` succeeds.
+> Phase 5 is not started. This document reflects the implementation as it stands: the Phase 1
+> refactors, the §4.3 split of the inbox into a thin global `Inbox` and a panel-owned derivation, the
+> Phase 4 click-through, and the repository-grouped thread list. The Phase 3 bottom-dock sub-views were
+> removed before the redesign; their implementation notes in §7 are historical.
+
+## 1. What the GitWorkshop home screen is
+
+`Index.tsx`:
+
+```tsx
+if (account) return <Dashboard />;
+return <LandingPage />;
+```
+
+`Dashboard.tsx` layout:
+
+- Desktop: two columns.
+  - **Left column**: `GreetingHeader`, `NotificationsPanel`, `RecentActivitySection`.
+  - **Right column**: `MyRepositoriesPanel`, `AccessiblePrivateRepositoriesPanel`,
+    `FollowedReposPanel`.
+- Mobile: a single column in a different order.
+
+The panel that gives the screen its inbox identity is `NotificationsPanel`:
+
+- heading **Notifications** with a bell icon and an unread count badge,
+- a **Mark all read** action and a **View all** link to `/notifications`,
+- a compact list of the first 5 **non-archived** notification items,
+- the empty state reads **"Your inbox is empty"** (with an `Inbox` icon).
+
+So in GitWorkshop's vocabulary, "inbox" is the non-archived activity directed at you, surfaced
+inline on the home screen. The home screen also shows your own recent activity and your repositories.
+
+Data hooks:
+
+| Section | Hook | What it loads |
+|---|---|---|
+| Notifications (inbox) | `useNotifications()` | Notification model: grouped thread activity directed at you, read/archived state |
+| Continue where you left off | `useUserActivity(pubkey)` | Git activity authored by you: kinds 1621/1617/1618/1111 (git `K`)/1624/1630-1633, newest first, limit 50 |
+| My repositories | `useUserRepositories(pubkey)` | Kind 30617 announcements authored by you |
+| Followed repositories | `useUserFollowedRepos(pubkey)` | Repos you follow |
+| Accessible private repositories | `useAccessiblePrivateRepositories()` | Private repos from CI/services |
+
+## 2. Scope for Signed
+
+| Priority | Section | Notes |
+|---|---|---|
+| **P0** | Inbox panel | Activity directed at you and your own activity, **grouped by repository**; unread badge; mark all read; all groups shown |
+| **P1** | Click-through | Open the issue/PR detail panel at the relevant thread root |
+| **P2 (defer)** | Standalone notifications page, NIP-65 relay discovery, pagination | Web-app concerns |
+| **Out of scope** | Greeting header, my repositories, followed repositories, private repositories, pinned repositories, Unread/Archived sub-views | Not needed in Signed |
+
+Notes:
+
+- There is **no greeting header**. The screen starts with the inbox panel.
+- There is **no My repositories column**. The sidebar already lists the signed-in user's repositories, so the inbox is a single column.
+- The Unread/Archived sub-view panels were removed: the panel is a single repository-grouped list instead.
+
+## 3. The Signed screen
+
+`InboxView` is a center panel, opened by the sidebar's existing **Inbox** nav item. It is one bordered
+card holding a single virtual list. Every row is either a **repository header** or one of that
+repository's **threads**, newest first. A thread merges the notifications directed at the user with
+the user's own events in the same root, and shows the root's title plus up to five of its most recent
+events:
+The sections are **all of the user's own repositories**, seeded from `RepoListStore`, plus any other
+repository that has threads. Owned repositories with nothing to show render an
+empty state ("No activity yet.") under their header, and sort after the ones with activity (newest
+announcement first). Threads with no repository address fall into a single "Other repository" section.
+
+```
++-------------------------------------------------------------------------+
+| Inbox   (3 unread)                          [Mark all read]             |
+|-------------------------------------------------------------------------|
+| [repo] you/repo-a                                        (2)            |
+|   [icon] Add retry logic                              (unread dot)     |
+|     [avatar] You    opened an issue                    3d              |
+|     [avatar] alice  commented                          2d              |
+|   [icon] Fix flaky test                                                 |
+|     [avatar] You    opened a PR                        1h              |
+|-------------------------------------------------------------------------|
+| [repo] you/repo-b                                                       |
+|   No activity yet.                                                      |
+|-------------------------------------------------------------------------|
+| [repo] you/repo-c                                                       |
+|   No activity yet.                                                      |
++-------------------------------------------------------------------------+
+```
+
+The sections are the repositories that actually have threads, ordered by their
+newest row. A repository the user owns but that has no items is not shown. Threads with no repository
+address fall into a single "Other repository" section.
+
+## 4. Data layer
+
+### 4.1 `signed_core`: pure logic
+
+**`filters.rs`** (extend, next to `activity`/`comments_for`):
+
+```rust
+/// Kinds that notify a user when they tag them directly.
+pub const NOTIFICATION_KINDS: [Kind; 9] = [
+    Kind::GitIssue,
+    Kind::GitPullRequest,
+    Kind::GitPatch,
+    Kind::GitPullRequestUpdate,
+    COVER_NOTE_KIND,
+    Kind::GitStatusOpen,
+    Kind::GitStatusApplied,
+    Kind::GitStatusClosed,
+    Kind::GitStatusDraft,
+];
+
+/// Comments on our issues/PRs/patches.
+pub fn notification_comments(me: PublicKey) -> Filter {
+    Filter::new()
+        .kind(Kind::Comment)
+        .custom_tags(SingleLetterTag::UPPERCASE_P, [me.to_hex()])
+        .custom_tags(SingleLetterTag::UPPERCASE_K, ["1621", "1617", "1618"])
+}
+
+/// Activity directed at us: comments on our roots, and git events tagging us.
+pub fn notifications(me: PublicKey) -> Vec<Filter> {
+    vec![
+        notification_comments(me),
+        Filter::new().kinds(NOTIFICATION_KINDS).pubkey(me),
+    ]
+}
+
+/// Git activity authored by `me`, for "Continue where you left off".
+pub fn authored_activity(me: PublicKey) -> Filter {
+    Filter::new()
+        .kinds([ACTIVITY_KINDS.as_slice(), &[COVER_NOTE_KIND]].concat())
+        .author(me)
+}
+```
+
+`ACTIVITY_KINDS` already exists in this file. All builders use existing SDK APIs
+(`Filter::kind/kinds/pubkey/custom_tags`, `SingleLetterTag::{UPPERCASE_P, UPPERCASE_K}`).
+
+Comments authored by `me` are not all git comments, so the activity query needs a post-filter:
+keep kind 1111 only when its uppercase `K` tag is a git root kind (1621/1617/1618/30617), matching
+gitworkshop's `isGitComment`.
+
+**`inbox.rs`** (new file):
+
+```rust
+pub struct InboxItem {
+    pub root: EventId,
+    /// The root event itself, when known locally; drives the row title.
+    pub root_event: Option<Event>,
+    pub root_kind: Option<Kind>,
+    pub address: Option<RepoAddr>,
+    /// Notification events directed at the user, newest first.
+    pub events: Vec<Event>,
+    /// The user's own events in the same thread, newest first.
+    pub own_events: Vec<Event>,
+    /// Unread event ids, oldest first.
+    pub unread_ids: Vec<EventId>,
+    pub archived: bool,
+}
+
+impl InboxItem {
+    /// Title of the thread root; falls back to the newest event it has.
+    pub fn title(&self) -> String;
+    /// Kind of the thread root; falls back to the newest event it has.
+    pub fn kind(&self) -> Option<Kind>;
+    pub fn latest_activity(&self) -> Timestamp;
+    /// Up to `limit` most recent events of the thread, oldest first.
+    pub fn timeline(&self, limit: usize) -> Vec<Event>;
+    pub fn is_unread(&self) -> bool;
+    pub fn apply_state(&mut self, state: &InboxReadState);
+}
+
+/// The thread root of a notification event, or `None` if it isn't git-related.
+pub fn notification_root(
+    event: &Event,
+    lookup: &impl Fn(EventId) -> Option<Event>,
+) -> Option<EventId>;
+
+/// Group the notifications directed at the user together with the user's own
+/// events into one item per thread, newest activity first.
+pub fn group(
+    events: impl IntoIterator<Item = Event>,
+    own: impl IntoIterator<Item = Event>,
+    me: PublicKey,
+    state: &InboxReadState,
+    lookup: &impl Fn(EventId) -> Option<Event>,
+) -> Vec<InboxItem>;
+```
+
+Root resolution, ported from `getNotificationRootId`:
+
+- issue (1621) / PR (1618): itself
+- patch (1617): its `e` parent patch, else itself
+- NIP-22 comment (1111): uppercase `E` root pointer (SDK `nip22::extract_root`)
+- PR update (1619): uppercase `E`
+- statuses (1630-1633) / cover note (1624): NIP-10 root `e`
+- notification events authored by `me` are dropped; the user's own events are kept in
+  `own_events` instead, never in `events`
+- `unread_ids` and `archived` are derived from `events` only, so the user's own activity is never
+  unread and a thread with only own events is never archived
+
+Read/archive state, the compact high-water-mark model:
+
+```rust
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct InboxReadState {
+    #[serde(default)] pub read_before: Timestamp,
+    #[serde(default)] pub read_ids: HashSet<EventId>,
+    #[serde(default)] pub archived_before: Timestamp,
+    #[serde(default)] pub archived_ids: HashSet<EventId>,
+}
+
+impl InboxReadState {
+    pub fn is_read(&self, event: &Event) -> bool;
+    pub fn is_archived(&self, event: &Event) -> bool;
+    pub fn mark_read(&mut self, event: &Event);
+    pub fn mark_all_read(&mut self, all: &[Event], me: PublicKey);
+    /// Move the cutoff to `min(oldest unread - 1, now - 3 days)` and prune ids.
+    pub fn advance_read(&mut self, all: &[Event], me: PublicKey);
+    pub fn advance_archived(&mut self, all: &[Event], me: PublicKey);
+}
+```
+
+`activity_subject` in `model.rs` already gives an issue/PR title from the `subject` tag or first
+line; reuse it for the home screen rows.
+
+### 4.2 Persistence: NIP-78 in the local database, never published
+
+Read state is a normal NIP-78 (kind `30078`, `Kind::ApplicationSpecificData`) addressable event
+**written to LMDB only**. It is never broadcast to a relay, so the read state stays on this device.
+
+It is signed with a **random keypair**, never the user's signer. The event is local application
+storage, so its author carries no identity; this avoids a signing round-trip and does not depend on
+the signer type. The `d` tag identifies the owning user, so state does not leak across identities
+when the signed-in key changes.
+
+```rust
+/// d tag identifying the inbox read/archive state event of `me`.
+fn inbox_state_d_tag(me: PublicKey) -> String {
+    format!("signed-inbox-state:{}", me.to_hex())
+}
+
+/// Newest stored read state for `me`.
+async fn load_state(client: &Client, me: PublicKey) -> Result<Option<InboxReadState>, Error> {
+    // No author filter: the signing key is random per save.
+    let filter = Filter::new()
+        .kind(Kind::ApplicationSpecificData)
+        .identifier(inbox_state_d_tag(me));
+
+    let events = client.database().query(filter).await?;
+
+    let Some(event) = events.into_iter().max_by_key(|event| event.created_at) else {
+        return Ok(None);
+    };
+
+    match serde_json::from_str(&event.content) {
+        Ok(state) => Ok(Some(state)),
+        Err(error) => {
+            log::warn!("ignoring unreadable inbox state {}: {error}", event.id);
+            Ok(None)
+        }
+    }
+}
+
+/// Sign with a fresh random key and store locally.
+async fn save_state(client: &Client, me: PublicKey, state: &InboxReadState) -> Result<(), Error> {
+    let event = EventBuilder::new(Kind::ApplicationSpecificData, serde_json::to_string(state)?)
+        .tags([Tag::identifier(inbox_state_d_tag(me))])
+        .finalize(&Keys::generate())?; // synchronous: random key, no user signer
+    // Local-only: no `send_event`, no broadcast. The event lives in LMDB.
+    client.database().save_event(&event).await?;
+    Ok(())
+}
+```
+
+A fresh random key is generated on every save, so each save writes a new event rather than
+replacing the previous one. LMDB only auto-replaces an addressable event when the incoming event
+has the **same pubkey**, so old copies accumulate. Nothing prunes them; `load_state` reads the
+newest by `created_at`, so the behavior is correct. This is a deliberate trade for not caching a
+key in the store (see §4.3). An earlier implementation deleted the previous event by tracking its
+id across saves; that was removed as more derived state than it was worth.
+`NostrDatabase::{save_event, query}` and `Client::database()` are existing SDK APIs.
+
+### 4.3 Data layer: a thin global `Inbox`, a panel-owned derivation
+
+The inbox is split in two, because the expensive derivation is only needed while the home screen is
+open.
+
+**`Inbox`** is a child `Entity<Inbox>` owned by `Backend` (`inbox: Entity<Inbox>`) and is
+deliberately thin: it owns only the read/archive state that must outlive the panel and the NIP-78
+load/save.
+
+```rust
+// backend.rs
+pub struct Backend {
+    ...
+    inbox: Entity<Inbox>,
+}
+
+// inbox.rs
+#[derive(Default)]
+pub struct Inbox {
+    state: InboxReadState,
+    loaded: bool,
+}
+
+impl Inbox {
+    pub fn state(&self) -> &InboxReadState;
+    pub fn is_loaded(&self) -> bool;
+    pub fn mark_read(&mut self, group: &[Event], all: &[Event], me: PublicKey, cx);
+    pub fn mark_archived(&mut self, group: &[Event], all: &[Event], me: PublicKey, cx);
+    pub fn mark_all_read(&mut self, all: &[Event], me: PublicKey, cx);
+    pub(crate) fn activate(&mut self, me: PublicKey, client: Client, cx);
+    pub(crate) fn reset(&mut self, cx);
+}
+
+// inbox.rs (signed_state)
+/// One item per thread, notifications and own activity merged.
+pub async fn query_inbox(
+    client: &Client,
+    me: PublicKey,
+    state: &InboxReadState,
+) -> Result<(Vec<InboxItem>, usize), Error>;
+```
+
+**The panel owns the derivation.** `InboxView` itself holds the derived lists, the copy of the read
+state they were computed with, and the refresh coalescing. There is no separate store entity: the
+panel is the only consumer, so an `Entity<InboxStore>` would add an `update` indirection and a
+forwarding subscription without buying any sharing. The panel's own `unread_count` feeds its header
+badge only; there is no global count and no sidebar badge.
+
+```rust
+pub struct InboxView {
+    focus_handle: FocusHandle,
+    dock_area: WeakEntity<DockArea>,
+    threads: Arc<Vec<InboxItem>>,       // one row per thread, merged
+    sections: Arc<Vec<InboxSection>>,   // grouped by repository
+    rows: Arc<Vec<InboxRow>>,           // flattened list
+    unread_count: usize,
+    state: InboxReadState,
+    state_loaded: bool,
+    refresh: RefreshGate,
+    list: ListState,
+    _subscriptions: Vec<Subscription>,
+}
+
+impl InboxView {
+    pub fn new(dock_area: WeakEntity<DockArea>, cx: &mut Context<Self>);  // cx.defer(… sync_state)
+    pub fn sync_state(&mut self, cx);                     // observes the global Inbox
+    pub fn mark_all_read(&mut self, cx);
+    fn handle_backend_event(&mut self, event: &BackendEvent, cx);
+    fn refresh(&mut self, cx);
+    fn run_refresh(&mut self, cx);
+    fn regroup(&mut self, cx);                            // re-apply read state
+    fn rebuild(&mut self, cx);                            // group by repository, seed owned, flatten
+    fn clear(&mut self);
+}
+```
+
+The panel owns three subscriptions that carry logic: it observes the global `Inbox`
+(`InboxView::sync_state`), subscribes to `Backend` (`InboxView::handle_backend_event`), and observes
+`RepoListStore` to rebuild when the user's own repositories load. Re-rendering itself needs no
+subscription: GPUI invalidates a window for every entity it read during render, so the panel tracks
+`RepoListStore` and `ProfileStore` just by reading them in `render`. The panel does not write back
+to the global.
+
+**`signed_state::query_inbox`.** The database work stays in `signed_state`, so the UI crate never
+queries LMDB directly. `query_inbox` returns the grouped notifications, the user's own git
+activity and the unread count; the panel applies the results on the main thread. `RefreshGate` is
+re-exported for the panel's debounce.
+
+```rust
+pub async fn query_inbox(
+    client: &Client,
+    me: PublicKey,
+    state: &InboxReadState,
+) -> Result<(Vec<InboxItem>, Vec<Event>, usize), Error>;
+```
+
+**Lifespan.** `Inbox` is created with the backend but idles until the user has a signer. The
+derived lists live only as long as the panel. Nothing is wired from the `desktop` crate and
+`signed_state::init` gains no parameters.
+
+**No sidebar badge.** The sidebar's inbox nav item has no unread suffix (an earlier global count
+derivation was removed with it). The unread count lives entirely in the panel, which shows it in
+its header and per repository section. The trade-off is that the count is only current while the
+panel is open, which is acceptable now that nothing outside it displays one.
+
+The dependency chain is `Backend` → `Inbox` and `InboxView` → `query_inbox`.
+
+`Backend` owns the inbox lifecycle (`sync_inbox`); the panel subscribes to `Backend` directly for
+its lists. `BackendEvent::SignerChanged` and `SignerRequired` are still emitted and must stay:
+`CheckoutsStore` and `SidebarPanel` consume them. They no longer drive the inbox's activation
+directly.
+
+`InboxView::handle_backend_event` refreshes on:
+
+- `NostrUpdate(updates)`: when any update kind is in `NOTIFICATION_KINDS`, is `Kind::Comment`, or is
+  a deletion (`EventDeletion` / `RequestToVanish`).
+- `Synced` / `Published`.
+- everything else: ignored.
+
+**Signer lifecycle: `Backend::sync_inbox`.** `Backend` owns the wiring and calls `sync_inbox` from the
+three real signer transitions: `create_identity`, `set_signer` (nsec, bunker and passphrase restore)
+and `logout`. It starts the subscriptions and repo-relay connects, then calls `Inbox::activate` or
+`Inbox::reset`. The client is passed into `activate`, so the global inbox never reads `Backend`
+while `sync_inbox` is mid-update:
+
+```rust
+fn sync_inbox(&mut self, cx: &mut Context<Self>) {
+    let me = self.current_user;
+
+    if let Some(me) = me {
+        self.subscribe_bootstrap(filters::notifications(me), cx);
+        self.subscribe_bootstrap(vec![filters::authored_activity(me)], cx);
+
+        let relays: HashSet<RelayUrl> = RepoListStore::global(cx)
+            .read(cx)
+            .announcements_of(&me)
+            .into_iter()
+            .flat_map(|announcement| announcement.relays)
+            .collect();
+
+        if !relays.is_empty() {
+            let relays: Vec<RelayUrl> = relays.into_iter().collect();
+            self.connect_repo_relays(relays.clone(), filters::notifications(me), cx);
+            self.connect_repo_relays(relays, vec![filters::authored_activity(me)], cx);
+        }
+    }
+
+    let client = self.client.clone();
+    self.inbox.update(cx, |inbox, cx| match me {
+        Some(me) => inbox.activate(me, client, cx),
+        None => inbox.reset(cx),
+    });
+}
+```
+
+The repo relays are read from `RepoListStore::global(cx).read(cx).announcements_of(&me)` at call
+time and never cached. (NIP-65 outbox relay discovery is deferred; Signed does not fetch kind
+10002 yet.) `Inbox::activate` and `Inbox::reset` are `pub(crate)`; `Inbox` has no `subscribe_remote`
+/ `connect_own_repo_relays`.
+
+**Activation** clears the state and loads the NIP-78 state from LMDB. The panel clears its own
+lists and in-flight refresh when it sees the unloaded state, then refreshes once it is loaded:
+
+```rust
+pub(crate) fn activate(&mut self, me: PublicKey, client: Client, cx: &mut Context<Self>) {
+    // state = default; state_loaded = false; cx.notify();
+    // spawn load_state(client, me), then set state and state_loaded = true
+}
+```
+
+`reset` performs the same clearing without a state load, and is used on logout.
+
+Reading the state event needs no signer at all (the `d` tag carries the identity); activation is
+still gated on the signer because the fetch filters need the user's pubkey.
+
+**Fetch** reuses `Backend::subscribe_bootstrap` and `Backend::connect_repo_relays` through
+`Backend::sync_inbox` (see above). The query the panel runs is intentionally the offline-first cache
+read, not a wait on the network; see the note below.
+
+**Refresh** (`InboxView::run_refresh`, mirrors `RepoListStore::run_refresh`):
+
+- `cx.background_spawn`: query the notification filters and the activity filter from
+  `client.database()`.
+- Query `filters::deletions()`, build `Deletions`, skip deleted events.
+- Build `HashMap<EventId, Event>` for root walking; group the notification events with
+  `inbox::group`.
+- Filter the activity events: keep issues/PRs/patches/statuses/cover notes, and comments only when
+  their `K` tag is a git kind; sort newest first.
+- Cross back to the main thread: guard on `Backend::global(cx).read(cx).current_user() ==
+  Some(me)`; if the signer changed while the query ran, `refresh.abort()` instead of applying, so a
+  previous user's results never land. Then set `notifications`, `activity`, `unread_count`, rebuild the
+  repository sections (`rebuild`), `cx.notify()`, `refresh.finish()`.
+
+`InboxView::sync_state` reacts to the global `Inbox`: while the state is not loaded it clears the
+lists, on the first load it runs the initial refresh, and on a state change (a mark action) it
+re-derives the flags (`InboxItem::apply_state`).
+
+**Fetch vs. the immediate query.** `subscribe_bootstrap` / `connect_repo_relays` return immediately,
+so the query that follows them reads the local cache rather than waiting for the relays. That is
+deliberate offline-first behavior: cached content appears at once on a warm start and with no
+network, instead of blocking the home screen on the network. The gap is closed by the SDK, not by
+timing: received events are written to LMDB and surfaced as `ClientNotification::Event`, so
+`Backend`'s pump batches them into `BackendEvent::NostrUpdate` and the store refreshes. This was
+reviewed and left as-is.
+
+**Actions**: `mark_all_read()` lives on the panel, which passes every known notification event to the
+global `Inbox`. The global marks them, advances the cutoffs against *all* notification events to bound
+the id sets, saves the state to LMDB (signed with a fresh random key, see 4.2), and notifies. The
+panel then re-derives and publishes the unread count.
+
+**Repository names need no new store**: `RepoListStore` already holds every announcement and
+`repo_name` resolves an address to a display name.
+
+### 4.4 `Cargo.toml`
+
+- `signed_core`: add `serde.workspace` for the `InboxReadState` derives.
+- `signed_state`: add `serde_json.workspace` for the NIP-78 content.
+
+## 5. UI
+
+### 5.1 `InboxView` center panel
+
+`crates/workspace/src/views/inbox.rs`, a `BasePanel` + `Panel` + `Render`, like `RepoListView`.
+It owns the derived lists directly, so `cx.notify()` from an update re-renders it. The panel is one
+bordered card (`flex_1`, `min_h_0`) with a header bar and a scrolling body. The body is a single
+`gpui::list` virtual list (`ListState` + `ListAlignment::Top`, 400px overdraw) with a
+`vertical_scrollbar`; the panel itself does not scroll, so the list gets a definite viewport height.
+The list count is reset from `render` whenever the rendered row count changes.
+
+- **Header**: the unread count badge and **Mark all read**.
+- **Body**: the flattened repository-grouped rows. A repository header is a muted bar with a git icon,
+  the repository name (or "Other repository" when the address is unknown) and its unread badge. Rows
+  under it show the actor avatar, a kind icon, the subject, the kind label, a relative time, and an
+  unread dot (the subject is semibold while unread). A repository with nothing to show renders
+  "No activity yet."; the panel-level "You're all caught up." empty state appears only when there are
+  no sections at all (no owned repositories and no items).
+
+No greeting header, and no **My repositories** column - the sidebar already lists the user's
+repositories.
+
+### 5.2 Grouping by repository
+
+The grouping is panel-owned derivation, done once per data change in `InboxView::rebuild` (called
+from `run_refresh` and `regroup`), never per frame:
+
+```rust
+struct InboxSection {
+    address: Option<RepoAddr>,   // repository, None for items without one
+    unread: usize,               // unread notification groups
+    entries: Vec<InboxEntry>,    // newest first
+    latest: Timestamp,           // orders the sections
+}
+
+enum InboxEntry {                // indices into the panel's own lists
+    Notification(usize),
+    Activity(usize),
+}
+
+enum InboxRow {                  // the flattened list
+    Repo(usize),
+    Entry(usize, usize),
+    Empty,                       // "No activity yet." under an empty section
+}
+```
+
+The section list and the flattened rows are stored as `Arc`s and cloned into the `gpui::list`
+closure, which indexes the panel's `notifications` / `activity` lists - no per-frame deep copies.
+Notification groups carry their repository in `InboxItem::address`; activity events carry it in a
+`GitRepoAnnouncement` `a` tag (`repo_address`). Archived notification groups are left out.
+
+`rebuild` also seeds a section for every repository in `announcements_of(me)`. The panel observes
+`RepoListStore` so a repository that loads after the last refresh still appears (its own empty
+section, or with items if any arrived); this is the one logic subscription beyond the `Inbox` and
+`Backend` ones. Repository names are resolved per render through `repo_name` -> `RepoListStore`, so a
+late announcement still labels its section without re-deriving the grouping.
+
+### 5.3 Sidebar
+
+In `views/sidebar/mod.rs`:
+
+- Add `inbox: Option<WeakEntity<InboxView>>` (mirrors `explore`).
+- Add `fn open_inbox(&mut self, window, cx)` that returns when the panel is already open, else adds
+  a center panel (same shape as `open_explore`; there is no dock API to focus an existing tab).
+  `InboxView::new` takes the sidebar's `WeakEntity<DockArea>` so the panel can open a repo for a row.
+- Point the existing nav item at it:
+
+  ```rust
+  NavItem::new("inbox", "Inbox", Icon::new(IconName::Inbox).small())
+      .on_click(cx.listener(|this, _ev, window, cx| this.open_inbox(window, cx))),
+  ```
+
+- No unread badge. The nav item carries no suffix, and the sidebar does not observe the global
+  `Inbox`. The unread count lives in the panel only.
+
+### 5.4 Click-through (P1)
+
+The detail panels need a `Window`, and GPUI's `Entity::update_in` only exists on a `VisualContext`,
+which a synchronous `App` + `Window` pair is not - so the entry point is a free function rather than
+a `RepoDetailView::open_item` method. In `repo_detail/mod.rs`:
+
+```rust
+pub(crate) enum RepoItem {
+    Issue(EventId),
+    PullRequest(EventId),
+    Patch,
+}
+
+pub(crate) fn open_repo_item(
+    dock_area: &WeakEntity<DockArea>,
+    announcement: &Announcement,
+    item: RepoItem,
+    window: &mut Window,
+    cx: &mut App,
+) { /* build the RepoStore here, then a new IssueDetailView / PullRequestDetailView, added to the center */ }
+```
+
+- `open_repo_item` builds its own `RepoStore` from `announcement` (a private `repo_store` helper calls
+  `RepoStore::new(addr, relays, cx)`), so the item panel is the **only** panel docked. An earlier
+  version opened `RepoDetailView` first and reused its store via `RepoDetailView::store()`; that
+  docked the repository panel too, which surfaced the repository load state (a `not found` error for
+  an announced repo with no local worktree) and left two center tabs. `RepoDetailView::store()` was
+  removed with it.
+- `views/mod.rs` re-exports `RepoItem` and `open_repo_item`.
+- `InboxView::open_item` resolves `item.address` to an `Announcement` from `RepoListStore`, and calls
+  `open_repo_item` with the root id and kind. The detail panel renders a "not found" placeholder
+  until the store's fetch lands, then re-renders.
+- The item panel is added to the center group and activated.
+
+Patches have no detail view in Signed (they are only consumed inside `PullRequestDetailView`), so a
+patch-root click opens nothing. `RepoItem::Patch` carries no id for that reason. A group whose root is
+not an issue/PR/patch, or whose repository is not in `RepoListStore`, opens nothing.
+
+## 6. File-by-file change list
+
+| File | Change |
+|---|---|
+| `crates/signed_core/Cargo.toml` | add `serde` |
+| `crates/signed_core/src/filters.rs` | `NOTIFICATION_KINDS`, `notification_comments`, `notifications`, `authored_activity`, `is_git_activity`, `deletions` |
+| `crates/signed_core/src/inbox.rs` | **new**: `InboxItem` (root event, notifications, own events), `notification_root`, `group`, `InboxReadState`, tests |
+| `crates/signed_core/src/lib.rs` | `mod inbox;` and re-exports |
+| `crates/signed_state/Cargo.toml` | add `serde_json` |
+| `crates/signed_state/src/inbox.rs` | thin global `Inbox` (NIP-78 read state, mark actions) and `query_inbox` (query, merge notifications + activity into threads) |
+| `crates/signed_state/src/backend.rs` | `inbox: Entity<Inbox>` field, construction, `inbox()` accessor, `sync_inbox`, `RepoListStore` import |
+| `crates/signed_state/src/refresh.rs` | doc comment lists `Inbox` among the `RefreshGate` users |
+| `crates/signed_state/src/lib.rs` | `mod inbox;`, re-export `Inbox` and `query_inbox`; re-export `RefreshGate` (no global install) |
+| `crates/dock/src/lib.rs` | `add_bottom_panel` helper (currently unused; left over from the removed sub-views) |
+| `crates/workspace/src/views/inbox.rs` | `InboxView` home panel owning the threads, the repository grouping, and the thread click-through |
+| `crates/workspace/src/views/mod.rs` | `mod inbox; pub use inbox::InboxView;`; re-export `RepoItem`, `open_repo_item`, `open_repo_panel` |
+| `crates/workspace/src/views/sidebar/mod.rs` | `inbox` field, `open_inbox`, nav wiring |
+| `crates/workspace/src/views/repo_detail/mod.rs` | `RepoItem`, `open_repo_item` (builds its own `RepoStore` via the private `repo_store` helper) |
+
+No changes to `desktop` or `signed_nostr`. `signed_state::init` gains no parameters; `Backend::sync_inbox`
+activates the `Inbox` child entity at each signer transition.
+
+## 7. Phasing
+
+1. **Phase 0 - pure logic**: `signed_core` filters and `inbox.rs` plus tests. **DONE.**
+   Implemented as `filters::{NOTIFICATION_KINDS, notification_comments, notifications, authored_activity, is_git_activity}`
+   and `inbox::{InboxItem, notification_root, group, InboxReadState}`. Two deviations from the sketch:
+   the cutoff methods take an explicit `now: Timestamp` so the pure logic stays deterministic and testable,
+   and `authored_activity` results must pass through `is_git_activity` before display (comments on
+   non-git roots are matched by the filter). `cargo test -p signed_core` passes (66 tests at the
+   end of Phase 0; 68 after the two Phase 1 additions).
+2. **Phase 1 - store**: `Inbox` child entity, activated by `Backend::sync_inbox` once a signer
+   exists; both queries, unread count, and NIP-78 load/save to LMDB. **DONE.** See the
+   implementation notes below.
+3. **Phase 2 - screen**: `InboxView` (inbox + activity) and the sidebar nav item.
+   **DONE.** See the implementation notes below.
+4. **Phase 3 - sub-views**: `add_bottom_panel` and `InboxFilterView` for Unread / Archived.
+   **Done, then reverted.** The sub-views were removed before the repository-grouping redesign; the
+   notes below are historical.
+5. **Phase 4 - click-through**: `open_item` and announcement lookup. **DONE.** See the implementation
+   notes below.
+6. **Phase 5 (optional)**: standalone notifications page, NIP-65 relays, pagination, patch detail
+   view.
+
+Each phase compiles and is usable on its own.
+
+### Phase 1 implementation notes
+
+Files: `crates/signed_state/{Cargo.toml, src/inbox.rs, src/lib.rs, src/backend.rs, src/refresh.rs}`
+and two additions to `crates/signed_core/src/inbox.rs`.
+
+- `Inbox` is a child entity of `Backend` (`inbox: Entity<Inbox>`), created in `Backend::new` and
+  reached via `Backend::inbox()`. Nothing in `desktop` is wired and `signed_state::init` gains no
+  parameters. The dependency is strictly one-way: `Inbox` holds no `Backend` handle.
+- `Backend::emit` is the single funnel for every `BackendEvent`. It updates the inbox through
+  `cx.defer` and then emits to the other subscribers. The defer is required: every emit site runs
+  inside `Backend::update`, and the inbox handlers read `Backend`, so a synchronous call panics on
+  a re-entrant entity access.
+- The signer lifecycle lives in `Backend::sync_inbox`, called from `create_identity`, `set_signer`
+  and `logout`. It starts the subscriptions and repo-relay connects, then defers `inbox.activate`
+  / `inbox.reset`. `SignerChanged` / `SignerRequired` are still emitted for `CheckoutsStore` and
+  `SidebarPanel`, but no longer drive the inbox.
+- `Inbox` mirrors `RepoListStore`: `RefreshGate` coalescing, `cx.background_spawn` for the
+  database work, plain data applied on the main thread, refresh-on-`NostrUpdate`/`Synced`/`Published`.
+- Added `state_loaded: bool`, not in the sketch. Groups are derived from the read state, so a refresh
+  before the stored state is read would briefly mark everything unread. The first refresh is chained
+  after `load_state`, and later `refresh` calls are ignored until `state_loaded` is set.
+- Account switches are guarded. `activate` and `reset` both replace `self.refresh` with a fresh
+  `RefreshGate`, dropping any in-flight or pending run of the previous user, and the apply step of
+  `run_refresh` aborts instead of applying when `Backend::current_user()` no longer matches the
+  user the query was started for.
+- Two additions to `signed_core::inbox` that Phase 1 needs: `InboxReadState::mark_archived` (mirrors
+  `mark_read`) and `InboxItem::apply_state` (recomputes `unread_ids`/`archived`; `group` now uses it).
+  Both are covered by tests.
+- The thread-root lookup is built by walking every `e`/`E` ancestor transitively (`fetch_notifications`)
+  rather than a single hop, because a patch series chains through parent patches. Only the notification
+  events are grouped; ancestors are used solely as the lookup, so a root authored by someone else is
+  not mistaken for a notification.
+- The read/archive state event is written to LMDB only (`database().save_event`), signed with a fresh
+  `Keys::generate()` on each save and never published. Filtering is by `d` tag only, no author, so the
+  random key is irrelevant across sessions. `d` tag uses `me.to_hex()` rather than `Display`.
+- Actions: `mark_read(root)`, `mark_archived(root)`, `mark_all_read()`. Each marks the group, advances
+  the relevant cutoffs against **all** notification events (matching GitWorkshop's use of `allEvents`),
+  re-derives the groups locally so the UI updates immediately, then persists in the background.
+- The global `Inbox` keeps no derived state. The signing key is generated per save, the current user is read
+  from `Backend::current_user()` where needed, and the relays of the user's own repositories are
+  queried from `RepoListStore` in `Backend::sync_inbox` rather than cached. There is no prune logic
+  either: the newest state event is selected by `created_at`.
+- `Inbox::activate` / `Inbox::reset` are `pub(crate)`; the former `subscribe_remote` and
+  `connect_own_repo_relays` methods were deleted once their work moved into `Backend::sync_inbox`.
+- `cargo test -p signed_core` passes (68 tests), `cargo test -p signed_state` passes (24 tests);
+  `cargo clippy -p signed_state --all-targets` is clean; `cargo check --workspace` succeeds.
+
+### Phase 2 implementation notes
+
+Files: `crates/workspace/src/views/{inbox.rs, mod.rs, sidebar/mod.rs}`. No store changes.
+
+- `InboxView` is a plain center panel like `RepoListView`; the sidebar holds a
+  `WeakEntity<InboxView>` so there is no cycle. Re-rendering relies on GPUI's render-time entity
+  tracking rather than explicit observations. (Phase 2 introduced an `Entity<InboxStore>` here; it
+  was later folded into the panel - see the store-merge note below.)
+- The layout is a column of two flexible bordered cards (`gap_4`, `p_4`, each `flex_1`/`min_h_0`),
+  inbox over activity. Each card is a rounded `v_flex` with a header bar (`section`) and a
+  `gpui::list` body. There is no **My repositories** column: the sidebar already lists the user's
+  repositories, so the panel is a single column.
+- Notification rows read the newest event of each group for the actor, subject and time, and the
+  root's kind for the icon. The repo name is resolved from `item.address` through a linear scan of
+  `RepoListStore::announcements` (`repo_name`); the list is small and this keeps the store unchanged.
+- The **Unread** / **Archived** header buttons are intentionally absent: they need
+  `add_bottom_panel` / `InboxFilterView`, which are Phase 3. The header is only **Mark all read**,
+  so the panel is fully usable on its own.
+- `kind_icon` / `kind_label` map a `Kind` to a `CustomIconName`/`IconName` and a short noun. The
+  cover note is compared with `==` rather than matched, since `Kind` cannot appear in a pattern arm.
+- Sidebar: `open_inbox` mirrors `open_explore` (return if open, else add a center panel); the inbox
+  nav item is repointed. The screen is still opened by the nav item, not on app startup, matching the
+  "idle until signer" rule; auto-opening it as the post-login home is a possible follow-up.
+- The **My repositories** column (search `InputState`, **New** button, `open_repo_panel` rows) was
+  removed after Phase 2 as redundant with the sidebar, along with the panel's `dock_area`,
+  `open_repo` / `open_create_repo` helpers and the `create_repo_dialog` / `open_repo_panel` imports.
+  `InboxView::new` now takes only `cx`. `create_repo_dialog` is private again.
+- `cargo clippy -p workspace --all-targets` is clean and `cargo check --workspace --all-targets`
+  succeeds. `cargo test -p signed_core` (68) and `cargo test -p signed_state` (24) still pass.
+
+### Architecture refactor (after Phase 2)
+
+Phases 0-2 kept all derivation in the global `Inbox`, so every notification and activity query ran
+whether or not the home screen was open, and `Backend::emit` carried a deferred side effect just to
+feed it.
+
+- The global `Inbox` is now thin: `state: InboxReadState`, `state_loaded`, plus the NIP-78 load/save
+  and the mark actions.
+- `Backend::emit` is gone. All `BackendEvent`s are emitted with `cx.emit` again, and `sync_inbox`
+  updates the inbox synchronously, passing the client in so nothing reads `Backend` mid-update.
+- The panel became the client-side owner of the derivation, initially through a panel-scoped
+  `Entity<InboxStore>`.
+- `signed_core` is unchanged.
+
+### Store merged into the panel (after Phase 2)
+
+The `InboxStore` entity was then folded into `InboxView`, since the panel was its only consumer.
+
+- `InboxView` holds `notifications`, `activity`, `unread_count`, `state`, `state_loaded` and
+  `RefreshGate` as fields, and the store's methods (`sync_state`, `handle_backend_event`,
+  `refresh`/`run_refresh`, `regroup`, `publish_unread_count`, `clear`, the mark actions) became panel
+  methods. The two subscriptions call them directly, with no `update` indirection.
+- The database work stayed in `signed_state` as `pub async fn query_inbox(...)`; `RefreshGate` and
+  `RefreshRequest` are re-exported. The UI crate never queries LMDB directly.
+- `mark_read`, `mark_archived` and their `group_events` helper carry a scoped `#[allow(dead_code)]`
+  until the Phase 3 sub-views wire them up.
+- `cargo test -p signed_core` (68), `cargo test -p signed_state` (24) and `cargo test -p workspace`
+  (7) pass; clippy and `cargo check --workspace --all-targets` are clean.
+
+Trade-off: the unread count is derived by the panel, so it is only current while the panel is open.
+(`publish_unread_count` fed a sidebar badge at the time; both were removed later - see "Sidebar
+badge removed" below.)
+
+### Phase 3 implementation notes
+
+> Historical: the Unread/Archived sub-views below were later removed; the panel is now a single
+> repository-grouped list. Kept for the `add_bottom_panel` / sub-view rationale.
+
+Files: `crates/dock/src/lib.rs` and `crates/workspace/src/views/{inbox.rs, sidebar/mod.rs}`. No
+store changes.
+
+- `add_bottom_panel` sits next to `add_center_panel` and wraps
+  `DockArea::add_panel_view(panel, DockPlacement::Bottom, None, ...)`. A new bottom dock starts open,
+  and the workspace's existing `DockEvent::LayoutChanged` subscription removes an emptied bottom dock,
+  so a closed sub-view leaves no strip behind.
+- `InboxFilterView` is private to `views/inbox.rs`. It holds an `Entity<InboxView>` (strong; the
+  panel keeps only the weak `filter_view` back, so there is no cycle), the mode, and its own
+  `ListState`. There is no subscription: it reads the inbox entity during render, which is enough for
+  GPUI to invalidate the window when the inbox notifies.
+- `InboxFilter` is a private two-variant enum with `label()` and `matches(&InboxItem)`. The tab title
+  comes from `Panel::title`, so switching modes through `set_mode` retitles the same tab instead of
+  opening a second one.
+- `InboxView` regained a `dock_area: WeakEntity<DockArea>` (removed with the My-repositories column)
+  and takes it in `new`. `open_filter` reuses the existing panel, focuses it, and reopens the bottom
+  dock when it is collapsed; otherwise it creates and adds the panel. `InboxView::new` is now called
+  as `InboxView::new(self.dock_area.clone(), cx)` from `SidebarPanel::open_inbox`.
+- The three `#[allow(dead_code)]` markers on `mark_read`, `mark_archived` and `group_events` are gone:
+  Unread rows call `mark_read` on click and `mark_archived` from a trailing ghost icon button
+  (`Button` + `IconName::FolderClosed`, tooltip "Archive"). The button calls `cx.stop_propagation()`
+  so it does not also trigger the row's mark-read click. Archived rows are display-only; the read
+  state has no un-archive operation.
+- `notification_row` takes an id `prefix` and returns `Stateful<Div>` rather than `AnyElement`, so
+  callers can attach a click handler and a trailing action. The inbox list passes `"inbox-row"` and
+  the sub-view `"inbox-filter-row"`, because the two lists render in the same window and would
+  otherwise collide on `(str, ix)` ids.
+- `cargo clippy -p workspace -p dock --all-targets` is clean, `cargo check --workspace --all-targets`
+  succeeds, and `cargo test -p signed_core -p signed_state -p workspace` passes (68 / 24 / 7).
+
+### Phase 4 implementation notes
+
+Files: `crates/workspace/src/views/{inbox.rs, mod.rs, repo_detail/mod.rs}`. No store changes.
+
+- `RepoItem { Issue(EventId), PullRequest(EventId), Patch }` and `pub(crate) fn open_repo_item` live
+  in `repo_detail/mod.rs`, next to `open_repo_panel`. `open_repo_item` builds its own `RepoStore` from
+  the announcement (private `repo_store` helper), so only the item panel is docked.
+- It is a free function, not `RepoDetailView::open_item`: the detail constructors take a `Window`, and
+  a synchronous `&mut App` + `&mut Window` pair is not a `VisualContext`, so `Entity::update_in` is
+  not available. `InboxView` already has the window in the list's `on_click`, so it drives the free
+  function directly. The plan's original `detail.update_in(window, cx, ...)` sketch could not compile.
+- `InboxView::open_item` is also a free function (it needs nothing but `dock_area`, which it captures
+  from the panel) because the `gpui::list` item closure only receives `&mut App`. It resolves
+  `item.address` through `RepoListStore`, returns silently when the repository is unknown, maps the
+  root kind to a `RepoItem`, and calls `open_repo_item`.
+- Fixed: the first version opened `RepoDetailView` to borrow its store (`RepoDetailView::store()`),
+  which docked the repository panel alongside the item panel and showed its `not found` load error.
+  `open_repo_item` now builds the `RepoStore` itself and `RepoDetailView::store()` is gone.
+- Only the notification rows are clickable. Activity rows are display-only. The Phase 3 mark-read /
+  archive row behaviour is gone with the sub-views.
+- `RepoItem::Patch` is a unit variant because the id would be unused: patches have no detail panel, so
+  `open_repo_item` returns before doing anything and nothing is docked.
+- `cargo clippy -p workspace --all-targets` is clean, `cargo check --workspace --all-targets` succeeds,
+  and `cargo test -p signed_core -p signed_state -p workspace -p dock` passes (68 / 24 / 7 / 1).
+
+### Repository grouping redesign (after Phase 4)
+
+Files: `crates/workspace/src/views/inbox.rs`. No store, no `signed_core` changes.
+
+The two-card layout (notifications over activity) was replaced by a single repository-grouped list.
+
+- The panel now derives `sections: Vec<InboxSection>` and a flattened `rows: Vec<InboxRow>` in
+  `rebuild`, called from `run_refresh` and `regroup`. Both are stored as `Arc`s and cloned into the
+  `gpui::list` closure, which indexes `notifications` / `activity` - no deep copies per frame and no
+  data duplicated between the section list and the source lists.
+- `InboxSection` groups a repository's non-archived notification groups and the user's own activity,
+  newest first; sections are ordered by their newest entry. `InboxEntry` holds indices into the
+  panel's lists; `InboxRow::Repo` / `InboxRow::Entry` / `InboxRow::Empty` is the flattened shape the
+  list renders.
+- All of the user's own repositories are seeded as sections from `RepoListStore::announcements_of`,
+  so an owned repository with nothing to show gets an empty section ("No activity yet.") and sorts
+  after the sections with activity. The panel observes `RepoListStore` to rebuild when the user's
+  repositories load or change.
+- Activity is matched to a repository through a `GitRepoAnnouncement` `a` tag (`repo_address`).
+  Items without an address share the "Other repository" section.
+- `notification_row` / `activity_row` no longer render the repository name - the section header does.
+  That also drops one `RepoListStore` scan per row.
+- The single card has one `ListState`; the old `notifications_list` / `activity_list` and the
+  `render_inbox_panel` / `render_activity_panel` / `section` helpers are gone. `notification_row` still
+  takes an id prefix so rows stay unique within the list.
+- `cargo clippy -p workspace --all-targets` is clean and `cargo test -p signed_core -p signed_state
+  -p workspace -p dock` passes (68 / 24 / 7 / 1).
+
+### Sidebar badge removed (after the repository grouping redesign)
+
+Files: `crates/signed_core/src/filters.rs`, `crates/signed_state/src/{inbox.rs,backend.rs}`,
+`crates/workspace/src/views/{inbox.rs,sidebar/mod.rs}`.
+
+An intermediate change made the sidebar badge live by moving the unread count into the global
+`Inbox` (a `refresh_unread_count` driven by `Backend`). That was then reverted along with the badge
+itself, so the global is thin again.
+
+- The sidebar nav item no longer renders a `CountBadge`; `SidebarPanel` lost its `unread` field and
+  its observe of the global `Inbox`.
+- The global `Inbox` no longer stores an `unread_count` and has no `set_unread_count` /
+  `refresh_unread_count`. `Backend` has no `refresh_inbox_unread` and no per-batch or per-sync count
+  refresh. `filters::affects_inbox` and the `query_inbox` helper split were reverted with it.
+- `InboxView` keeps its local `unread_count` for its header badge and the per-section `unread` for
+  the repository headers; `publish_unread_count` stays deleted.
+- Consequence: the unread count is only current while the panel is open, and there is no unread
+  indication anywhere else in the app.
+- `cargo clippy -p signed_core -p signed_state -p workspace --all-targets` is clean,
+  `cargo check -p signed_core -p signed_state -p workspace --all-targets` succeeds, and
+  `cargo test -p signed_core -p signed_state -p workspace -p dock` passes (68 / 24 / 7 / 1).
+
+### Threads merged: notifications + activity (after the sidebar badge removal)
+
+Files: `crates/signed_core/src/inbox.rs`, `crates/signed_state/src/inbox.rs`,
+`crates/workspace/src/views/inbox.rs`.
+
+Notifications and own activity were two separate row kinds that could describe the same thread. They
+are now one item per thread: the notifications directed at the user and the user's own events in that
+thread live in the same `InboxItem`. A row shows the thread root's title and up to five of the
+thread's most recent events:
+
+```
+[icon] Add retry logic                                      (unread dot)
+  [avatar] You    opened an issue · 3d
+  [avatar] alice  commented · 2d
+```
+
+- `InboxItem` gained `root_event: Option<Event>` and `own_events: Vec<Event>`. `events` keeps only the
+  notifications (others' events); `own_events` holds the user's own. `unread_ids`/`archived` are
+  derived from `events` alone, so own activity is never unread and a thread with only own events is
+  never archived (`apply_state` guards the empty case).
+- New methods on `InboxItem`: `title()` (root event's subject, falling back to the newest event),
+  `kind()` (root kind, same fallback), and `timeline(limit)` (thread events deduplicated by id,
+  oldest first, always keeping the root event and filling the remaining slots with the most recent
+  others).
+- `group` now takes both `events` (notifications) and `own` (the user's activity) and merges them on
+  the resolved root. Own events resolve through the same `notification_root`; an unresolved own event
+  becomes its own root. `query_inbox` returns `(Vec<InboxItem>, usize)` - the separate activity list
+  is gone, and `by_id` is extended with the own events so a comment of ours resolves to its thread.
+- The panel holds `threads: Arc<Vec<InboxItem>>` instead of `notifications` + `activity`. The
+  `InboxEntry` enum, `entry_time`, `repo_address`, `related_activity`, `notification_row`,
+  `activity_row` and `kind_label` are gone. `thread_row` replaces both row kinds and is clickable like
+  the old notification row; `group_sections` now just buckets threads by `item.address`.
+- `sub_activity_line` is unchanged and still renders `[avatar] [name] [phrase] · [ago]`, with `You`
+  for the signed-in user and `activity_phrase(kind)` for the verb. Rows are variable height
+  (`py_2`), which `gpui::list` auto-measures.
+- Thread rows in a section are drawn as one stack: `render_entry` passes `first`/`last` within the
+  section (`entry_ix == 0` / `entry_ix + 1 == section.entries.len()`), and `thread_row` rounds the
+  outer edges (`rounded_t` on the first, `rounded_b` on the last, theme radius) and draws a
+  `border_b_1` divider on every row but the last.
+- Trade-off: the row title is the thread root's, not the newest event's, so a comment thread no longer
+  previews the comment text. That is the point of the merge - the row identifies the thread.
+- `cargo clippy -p signed_core -p signed_state -p workspace --all-targets` is clean,
+  `cargo check -p signed_core -p signed_state -p workspace --all-targets` succeeds, and
+  `cargo test -p signed_core -p signed_state -p workspace` passes (69 / 24 / 7).
+
+## 8. Validation
+
+- `cargo test -p signed_core` (69 tests): root resolution, grouping, merging, read-state cutoff, serde
+  round-trip.
+- `cargo test -p signed_state` (24 tests): the `Inbox` / `query_inbox` paths that do not need GPUI
+  (state round-trip, grouping helpers).
+- `cargo test -p workspace` (7 tests): repository-detail helpers.
+- `cargo clippy -p signed_state --all-targets`, `cargo clippy -p workspace --all-targets` and
+  `cargo check --workspace --all-targets` after each phase.
+- Manual: log in with a repo-owning identity; open the inbox from the sidebar and confirm the panel
+  populates from another identity's issue/comment, the activity list shows your own items, and that no
+  kind-30078 event is broadcast (watch the relays / `Published` events). Restart to confirm the read
+  state is read back from LMDB. Confirm the sidebar has no unread badge.
+
+## 9. SDK APIs used (verified in the pinned `5c669a4` checkout)
+
+- `Kind::{Comment, GitIssue, GitPullRequest, GitPatch, GitPullRequestUpdate,`
+  `GitStatusOpen/Applied/Closed/Draft, ApplicationSpecificData, EventDeletion, RequestToVanish}`
+- `Filter::{kind, kinds, pubkey, pubkeys, custom_tags, limit, since, events, coordinate, identifier}`
+  - Non-obvious: `Filter::pubkey`/`pubkeys` set the lowercase **`p` tag**, not `authors`. Use
+    `Filter::author`/`authors` for authorship. The `notifications` filter relies on this.
+- `SingleLetterTag::{LOWERCASE_P, LOWERCASE_E, UPPERCASE_P, UPPERCASE_K, UPPERCASE_E}`
+- `nostr::nips::nip22::{extract_root, extract_parent, CommentTarget}`: NIP-22 root/parent pointers
+- `Tags::{event_ids, public_keys, coordinates, identifier, hashtags}` iterators
+- `Client::{database, subscribe, sync, notifications, send_event, add_relay}`;
+  `NostrDatabase::{save_event, query}`; `NostrLmdb`, `NostrGossipMemory`
+- `EventBuilder::{new, tags, finalize}`, `Tag::identifier`, `Keys::generate`
+- `Timestamp`, `EventId` (hex serde), `PublicKey`, `Coordinate`
+- Fetch paths converge on the same notification: `client.subscribe(...)` and negentropy
+  `client.sync(...)` both persist received events to LMDB and surface them as
+  `ClientNotification::Event`, which `Backend`'s pump batches into `BackendEvent::NostrUpdate`.
+  This is why the query right after a fetch is a cache read, not a race.

flathub/.gitignore

@@ -0,0 +1,14 @@
+# Generated files - do not commit to main repo
+# These are generated by script/prepare-flathub
+vendor/
+vendor.tar.gz
+su.reya.signed.yml
+su.reya.signed.metainfo.xml
+release-info.xml
+cargo-config.toml
+build/
+repo/
+
+# Keep the README and this .gitignore
+!README.md
+!.gitignore

flathub/README.md

@@ -0,0 +1,129 @@
+# Flathub Submission for Signed
+
+This directory contains the files needed to submit Signed to Flathub.
+
+## Prerequisites
+
+- Flatpak installed
+- `flatpak-builder` installed
+- Rust/Cargo installed (for vendoring)
+
+## Quick Start
+
+Run the preparation script from the repo root:
+
+```bash
+./script/prepare-flathub
+```
+
+This will:
+1. Vendor all Rust dependencies (crates.io + git)
+2. Generate the metainfo.xml with proper release info
+3. Create `su.reya.signed.yml` - the Flatpak manifest for Flathub
+
+## Files Generated
+
+| File | Purpose |
+|------|---------|
+| `su.reya.signed.yml` | Main Flatpak manifest (submit this to Flathub) |
+| `su.reya.signed.metainfo.xml` | AppStream metadata with release info |
+| `vendor.tar.gz` | Vendored Rust dependencies |
+| `cargo-config.toml` | Cargo configuration for offline builds |
+| `release-info.xml` | Release info snippet for metainfo |
+
+## Testing Locally
+
+Before submitting to Flathub, test the build:
+
+```bash
+cd flathub
+
+# Build and install locally
+flatpak-builder --user --install --force-clean build su.reya.signed.yml
+
+# Test the app
+flatpak run su.reya.signed
+
+# Run the Flathub linter (must pass!)
+flatpak run --command=flatpak-builder-lint org.flatpak.Builder manifest su.reya.signed.yml
+flatpak run --command=flatpak-builder-lint org.flatpak.Builder repo repo
+```
+
+## Submitting to Flathub
+
+### 1. Prepare Your Release
+
+Ensure you have:
+- [ ] Committed all changes
+- [ ] Tagged the release: `git tag -a v0.1.0 -m "Release v0.1.0"`
+- [ ] Pushed the tag: `git push origin v0.1.0`
+- [ ] Run `./script/prepare-flathub` to regenerate files
+
+### 2. Fork and Submit
+
+```bash
+# Fork https://github.com/flathub/flathub on GitHub first
+
+# Clone your fork (use the new-pr branch!)
+git clone --branch=new-pr git@github.com:YOUR_USERNAME/flathub.git
+cd flathub
+
+# Create a new branch
+git checkout -b su.reya.signed
+
+# Copy ONLY the manifest file from your project
+cp /path/to/signed/flathub/su.reya.signed.yml .
+
+# Commit and push
+git add su.reya.signed.yml
+git commit -m "Add su.reya.signed"
+git push origin su.reya.signed
+```
+
+### 3. Open Pull Request
+
+1. Go to your fork on GitHub
+2. Click "Compare & pull request"
+3. **Important:** Set base branch to `new-pr` (not `master`!)
+4. Fill in the PR template
+5. Submit and wait for review
+
+## What Happens Next?
+
+1. Flathub's automated CI will build your app
+2. A maintainer will review your submission
+3. Once approved, a new repo `flathub/su.reya.signed` will be created
+4. You'll get write access to maintain the app
+5. Future updates: Push new commits to `flathub/su.reya.signed`
+
+## Updating the App
+
+To release a new version:
+
+1. Update version in workspace `Cargo.toml`
+2. Tag the new release: `git tag -a v0.1.0 -m "Release v0.1.0"`
+3. Push the tag: `git push origin v0.1.0`
+4. Run `./script/prepare-flathub` to regenerate
+5. Clone the flathub repo: `git clone https://github.com/flathub/su.reya.signed.git`
+6. Update the manifest with new commit/tag and hashes
+7. Submit PR to `flathub/su.reya.signed`
+
+## Troubleshooting
+
+### Build fails with "network access not allowed"
+- Make sure `CARGO_NET_OFFLINE=true` is set in the manifest
+- Ensure `vendor.tar.gz` is properly extracted before building
+
+### Linter complains about metainfo
+- Ensure `su.reya.signed.metainfo.xml` has at least one `<release>` entry
+- Add accessible screenshot URLs if required
+
+### Missing dependencies
+- If new git dependencies are added, re-run `script/prepare-flathub`
+- The script vendors all dependencies from `Cargo.lock`
+
+## Resources
+
+- [Flathub Submission Docs](https://docs.flathub.org/docs/for-app-authors/submission)
+- [Flatpak Manifest Reference](https://docs.flatpak.org/en/latest/manifests.html)
+- [AppStream Metainfo Guide](https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html)

script/bundle-linux

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+# Function for displaying help info
+help_info() {
+  echo "
+Usage: ${0##*/}
+Build a release .tar.gz for Linux.
+"
+}
+
+# Parse all arguments manually
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        -h|--help)
+            help_info
+            exit 0
+            ;;
+        --)
+            shift
+            break
+            ;;
+        -*)
+            echo "Unknown option: $1" >&2
+            help_info
+            exit 1
+            ;;
+        *)
+            echo "Error: Unexpected argument: $1" >&2
+            help_info
+            exit 1
+            ;;
+    esac
+done
+
+target_dir="${CARGO_TARGET_DIR:-target}"
+
+version="$(script/get-crate-version signed)"
+# Set RELEASE_VERSION so it's compiled into the app and it knows about the version.
+export RELEASE_VERSION="${version}"
+
+commit=$(git rev-parse HEAD | cut -c 1-7)
+
+version_info=$(rustc --version --verbose)
+host_line=$(echo "$version_info" | grep host)
+target_triple=${host_line#*: }
+
+export CC=$(which clang)
+
+# Build binary in release mode
+export RUSTFLAGS="${RUSTFLAGS:-} -C link-args=-Wl,--disable-new-dtags,-rpath,\$ORIGIN/../lib"
+cargo build --release --target "${target_triple}" --package signed
+
+# Strip debug symbols and save them
+objcopy --only-keep-debug "${target_dir}/${target_triple}/release/signed" "${target_dir}/${target_triple}/release/signed.dbg"
+objcopy --strip-debug "${target_dir}/${target_triple}/release/signed"
+
+gzip -f "${target_dir}/${target_triple}/release/signed.dbg"
+
+# Move everything that should end up in the final package
+# into a temp directory.
+temp_dir=$(mktemp -d)
+signed_dir="${temp_dir}/signed.app"
+
+# Binary
+mkdir -p "${signed_dir}/bin" "${signed_dir}/libexec"
+cp "${target_dir}/${target_triple}/release/signed" "${signed_dir}/libexec/signed"
+cp "${target_dir}/${target_triple}/release/signed" "${signed_dir}/bin/signed"
+
+# Libs
+find_libs() {
+    ldd ${target_dir}/${target_triple}/release/signed |\
+        cut -d' ' -f3 |\
+        grep -v '\<\(libstdc++.so\|libc.so\|libgcc_s.so\|libm.so\|libpthread.so\|libdl.so\|libasound.so\)'
+}
+
+mkdir -p "${signed_dir}/lib"
+rm -rf "${signed_dir}/lib/*"
+cp $(find_libs) "${signed_dir}/lib"
+
+# Icons
+mkdir -p "${signed_dir}/share/icons/hicolor/512x512/apps"
+cp "desktop/resources/icon.png" "${signed_dir}/share/icons/hicolor/512x512/apps/signed.png"
+mkdir -p "${signed_dir}/share/icons/hicolor/1024x1024/apps"
+cp "desktop/resources/icon@2x.png" "${signed_dir}/share/icons/hicolor/1024x1024/apps/signed.png"
+
+# .desktop
+export DO_STARTUP_NOTIFY="true"
+export APP_CLI="signed"
+export APP_ICON="signed"
+export APP_ARGS="%U"
+export APP_NAME="Signed"
+
+mkdir -p "${signed_dir}/share/applications"
+envsubst < "desktop/resources/signed.desktop.in" > "${signed_dir}/share/applications/signed.desktop"
+
+# Create archive out of everything that's in the temp directory
+arch=$(uname -m)
+target="linux-${arch}"
+archive="signed-${target}.tar.gz"
+
+rm -rf "${archive}"
+remove_match="signed(-[a-zA-Z0-9]+)?-linux-$(uname -m)\.tar\.gz"
+ls "${target_dir}/release" | grep -E ${remove_match} | xargs -d "\n" -I {} rm -f "${target_dir}/release/{}" || true
+tar -czvf "${target_dir}/release/$archive" -C ${temp_dir} "signed.app"

script/bundle-macos

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# Build the macOS .app/.dmg bundle with cargo-packager.
+# Requires macOS. Linux/macOS users building on Windows are unsupported here.
+
+set -euxo pipefail
+cd "$(dirname "$0")/../desktop"
+
+if ! command -v cargo-packager >/dev/null 2>&1; then
+  cargo install cargo-packager --locked
+fi
+
+cargo packager --release

script/bundle-snap

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+set -euxo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 <release_version>"
+  exit 1
+fi
+
+ARCH=$(uname -m)
+# Snap uses its own architecture names, which must match the file name and
+# the architecture asserted inside the .snap. `x86_64`/`aarch64` here would
+# produce a file like signed_1.0.0_x86_64.snap that snapd cannot match.
+case "$ARCH" in
+  x86_64|amd64) ARCH_SUFFIX="amd64" ;;
+  aarch64|arm64) ARCH_SUFFIX="arm64" ;;
+  *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
+esac
+
+# Setup GUI files
+mkdir -p snap/gui
+export DO_STARTUP_NOTIFY="true"
+export APP_NAME="Signed"
+export APP_ICON="\${SNAP}/meta/gui/signed.png"
+export APP_ARGS="%U"
+envsubst < "desktop/resources/signed.desktop.in" > "snap/gui/signed.desktop"
+cp "desktop/resources/icon.png" "snap/gui/signed.png"
+
+# Generate snapcraft.yaml with version and architecture
+RELEASE_VERSION="$1" ARCH_SUFFIX="$ARCH_SUFFIX" envsubst < desktop/resources/snap/snapcraft.yaml.in > snap/snapcraft.yaml
+
+# Clean previous builds
+snapcraft clean
+
+# Build snap with architecture in filename
+SNAP_NAME="signed_${1}_${ARCH_SUFFIX}.snap"
+snapcraft --destructive-mode --output "$SNAP_NAME"
+
+echo "Created snap package: $SNAP_NAME"
+cat <<'EOF'
+
+Install locally (local builds are unsigned, so snapd requires --dangerous; a
+plain `snap install ./file.snap` fails with "cannot find signatures with
+metadata for snap/component ..."):
+
+  sudo snap install --dangerous ./signed_<version>_amd64.snap
+
+Distribute publicly via the Snap Store (signs the snap, users can then run
+plain `snap install signed`):
+
+  snapcraft login
+  snapcraft upload ./signed_<version>_amd64.snap
+  snapcraft release signed <uploaded-revision> stable
+EOF

script/bundle-windows

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+# Build the Windows .msi/.exe bundles with cargo-packager.
+# Requires Windows (MSVC toolchain) - run from Git Bash or MSYS2.
+
+set -euxo pipefail
+cd "$(dirname "$0")/../desktop"
+
+if ! command -v cargo-packager >/dev/null 2>&1; then
+  cargo install cargo-packager --locked
+fi
+
+cargo packager --release

script/flatpak/bundle-flatpak

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+cd "$(dirname "$0")/../.."
+shopt -s extglob
+
+# Get system architecture
+ARCH=$(uname -m)
+case "$ARCH" in
+  x86_64) ARCH_SUFFIX="x86_64" ;;
+  aarch64) ARCH_SUFFIX="aarch64" ;;
+  *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
+esac
+
+archive_match="signed(-[a-zA-Z0-9]+)?-linux-${ARCH_SUFFIX}\.tar\.gz"
+archive=$(ls "target/release" | grep -E ${archive_match})
+
+export ARCHIVE="$archive"
+export APP_ID="su.reya.signed"
+export APP_NAME="Signed"
+export BRANDING_LIGHT="#C6FF4D"
+export BRANDING_DARK="#C6FF4D"
+export ICON_FILE="icon"
+export CHANNEL="stable"
+
+# Generate manifest
+envsubst < "desktop/resources/flatpak/manifest-template.json" > "$APP_ID.json"
+
+# Build Flatpak
+flatpak-builder --user --install --force-clean build "$APP_ID.json"
+
+# Create bundle with architecture suffix
+OUTPUT_FILE="target/release/${APP_ID}_${ARCH_SUFFIX}.flatpak"
+flatpak build-bundle ~/.local/share/flatpak/repo "$OUTPUT_FILE" "$APP_ID"
+echo "Created '$OUTPUT_FILE'"

script/flatpak/deps

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+flatpak remote-add --if-not-exists --user flathub https://dl.flathub.org/repo/flathub.flatpakrepo
+
+arch=$(arch)
+fd_version=24.08
+flatpak install -y --user org.freedesktop.Platform/${arch}/${fd_version}
+flatpak install -y --user org.freedesktop.Sdk/${arch}/${fd_version}
+flatpak install -y --user org.freedesktop.Sdk.Extension.rust-stable/${arch}/${fd_version}

script/get-crate-version

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -eu
+
+if [[ $# -ne 1 ]]; then
+  echo "Usage: $0 <crate_name>" >&2
+  exit 1
+fi
+
+CRATE_NAME=$1
+
+cargo metadata \
+    --no-deps \
+    --format-version=1 \
+    | jq \
+        --raw-output \
+        ".packages[] | select(.name == \"${CRATE_NAME}\") | .version"

script/linux

@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+# if root or if sudo/unavailable, define an empty variable
+if [ "$(id -u)" -eq 0 ]
+then maysudo=''
+else maysudo="$(command -v sudo || command -v doas || true)"
+fi
+
+function finalize {
+  # after packages install (curl, etc), get the rust toolchain
+  which rustup > /dev/null 2>&1 || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  # verify the mold situation
+  if ! command -v mold >/dev/null 2>&1; then
+    echo "Warning: Mold binaries are unavailable on your system." >&2
+    echo "    Builds will be slower without mold. Try: script/install-mold" >&2
+  fi
+  echo "Finished installing Linux dependencies with script/linux"
+}
+
+# Ubuntu, Debian, Mint, Kali, Pop!_OS, Raspbian, etc.
+apt=$(command -v apt-get || true)
+if [[ -n $apt ]]; then
+  deps=(
+    gcc
+    g++
+    libasound2-dev
+    libfontconfig-dev
+    libwayland-dev
+    libx11-xcb-dev
+    libxkbcommon-x11-dev
+    libssl-dev
+    libzstd-dev
+    libvulkan1
+    libgit2-dev
+    libx11-dev
+    make
+    cmake
+    clang
+    jq
+    git
+    curl
+    gettext-base
+    elfutils
+    musl-tools
+    musl-dev
+    build-essential
+  )
+  if (grep -qP 'PRETTY_NAME="(Linux Mint 22|.+24\.(04|10))' /etc/os-release); then
+    deps+=( mold libstdc++-14-dev )
+  elif (grep -qP 'PRETTY_NAME="((Debian|Raspbian).+12|Linux Mint 21|.+22\.04)' /etc/os-release); then
+    deps+=( mold libstdc++-12-dev )
+  elif (grep -qP 'PRETTY_NAME="((Debian|Raspbian).+11|Linux Mint 20|.+20\.04)' /etc/os-release); then
+    deps+=( libstdc++-10-dev )
+  fi
+
+  $maysudo "$apt" update
+  $maysudo "$apt" install -y "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Fedora, CentOS, RHEL, Alma, Amazon 2023, Oracle, etc.
+dnf=$(command -v dnf || true)
+# Old Redhat (yum only): Amazon Linux 2, Oracle Linux 7, etc.
+yum=$(command -v yum || true)
+
+if [[ -n $dnf ]] || [[ -n $yum ]]; then
+  pkg_cmd="${dnf:-${yum}}"
+  deps=(
+    musl-gcc
+    gcc
+    clang
+    cmake
+    alsa-lib-devel
+    fontconfig-devel
+    wayland-devel
+    libxcb-devel
+    libxkbcommon-x11-devel
+    openssl-devel
+    libzstd-devel
+    vulkan-loader
+    jq
+    git
+    tar
+  )
+  # perl used for building openssl-sys crate. See: https://docs.rs/openssl/latest/openssl/
+  if grep -qP '^ID="?(fedora)' /etc/os-release; then
+    deps+=(
+      perl-FindBin
+      perl-IPC-Cmd
+      perl-File-Compare
+      perl-File-Copy
+      mold
+    )
+  elif grep -qP '^ID="?(rhel|rocky|alma|centos|ol)' /etc/os-release; then
+    deps+=( perl-interpreter )
+  fi
+
+  # gcc-c++ is g++ on RHEL8 and 8.x clones
+  if grep -qP '^ID="?(rhel|rocky|alma|centos|ol)' /etc/os-release \
+      && grep -qP '^VERSION_ID="?(8)' /etc/os-release; then
+    deps+=( gcc-c++ )
+  else
+    deps+=( g++ )
+  fi
+
+  # libxkbcommon-x11-devel is in a non-default repo on RHEL 8.x/9.x (except on AmazonLinux)
+  if grep -qP '^VERSION_ID="?(8|9)' /etc/os-release && grep -qP '^ID="?(rhel|rocky|centos|alma|ol)' /etc/os-release; then
+    $maysudo dnf install -y 'dnf-command(config-manager)'
+    if grep -qP '^PRETTY_NAME="(AlmaLinux 8|Rocky Linux 8)' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled powertools
+    elif grep -qP '^PRETTY_NAME="((AlmaLinux|Rocky|CentOS Stream) 9|Red Hat.+(8|9))' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled crb
+    elif grep -qP '^PRETTY_NAME="Oracle Linux Server 8' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled ol8_codeready_builder
+    elif grep -qP '^PRETTY_NAME="Oracle Linux Server 9' /etc/os-release; then
+      $maysudo dnf config-manager --set-enabled ol9_codeready_builder
+    else
+      echo "Unexpected distro" && grep 'PRETTY_NAME' /etc/os-release && exit 1
+    fi
+  fi
+
+  $maysudo "$pkg_cmd" install -y "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# openSUSE
+# https://software.opensuse.org/
+zyp=$(command -v zypper || true)
+if [[ -n $zyp ]]; then
+  deps=(
+    alsa-devel
+    clang
+    cmake
+    fontconfig-devel
+    gcc
+    gcc-c++
+    git
+    gzip
+    jq
+    libvulkan1
+    libx11-devel
+    libxcb-devel
+    libxkbcommon-devel
+    libxkbcommon-x11-devel
+    libzstd-devel
+    make
+    mold
+    openssl-devel
+    tar
+    wayland-devel
+    xcb-util-devel
+  )
+  $maysudo "$zyp" install -y "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Arch, Manjaro, etc.
+# https://archlinux.org/packages
+pacman=$(command -v pacman || true)
+if [[ -n $pacman ]]; then
+  deps=(
+    gcc
+    clang
+    musl
+    cmake
+    alsa-lib
+    fontconfig
+    wayland
+    libgit2
+    libxcb
+    libxkbcommon-x11
+    openssl
+    zstd
+    pkgconf
+    mold
+    jq
+    git
+  )
+  $maysudo "$pacman" -Syu --needed --noconfirm "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Void
+# https://voidlinux.org/packages/
+xbps=$(command -v xbps-install || true)
+if [[ -n $xbps ]]; then
+  deps=(
+    gettext-devel
+    clang
+    cmake
+    jq
+    elfutils-devel
+    gcc
+    alsa-lib-devel
+    fontconfig-devel
+    libxcb-devel
+    libxkbcommon-devel
+    libzstd-devel
+    openssl-devel
+    wayland-devel
+    vulkan-loader
+    mold
+  )
+  $maysudo "$xbps" -Syu "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+# Gentoo
+# https://packages.gentoo.org/
+emerge=$(command -v emerge || true)
+if [[ -n $emerge ]]; then
+  deps=(
+    app-arch/zstd
+    app-misc/jq
+    dev-libs/openssl
+    dev-libs/wayland
+    dev-util/cmake
+    media-libs/alsa-lib
+    media-libs/fontconfig
+    media-libs/vulkan-loader
+    x11-libs/libxcb
+    x11-libs/libxkbcommon
+    sys-devel/mold
+  )
+  $maysudo "$emerge" -u "${deps[@]}"
+  finalize
+  exit 0
+fi
+
+echo "Unsupported Linux distribution in script/linux"
+exit 1

script/macos

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+export HOMEBREW_NO_INSTALL_CLEANUP=1
+
+# if root or if sudo/unavailable, define an empty variable
+if [ "$(id -u)" -eq 0 ]
+then maysudo=''
+else maysudo="$(command -v sudo || command -v doas || true)"
+fi
+
+function finalize {
+  # after packages install (curl, etc), get the rust toolchain
+  which rustup > /dev/null 2>&1 || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+  # verify the mold situation
+  if ! command -v mold >/dev/null 2>&1; then
+    echo "Warning: Mold binaries are unavailable on your system." >&2
+    echo "    Builds will be slower without mold. Try: script/install-mold" >&2
+  fi
+  echo "Finished installing MacOS dependencies with script/macos"
+}
+
+# MacOS
+brew=$(command -v brew || true)
+if [[ -n $brew ]]; then
+  deps=(
+    gcc
+    libx11
+    libxkbcommon
+    openssl
+    zstd
+    vulkan-headers
+    libgit2
+    libx11
+    make
+    cmake
+    jq
+    git
+    curl
+    gettext
+  )
+
+  $brew update
+  for dep in "${deps[@]}";do
+  $brew search "$dep";
+  done
+  $brew install "${deps[@]}"
+  finalize
+  exit 0
+fi

script/prepare-flathub

@@ -0,0 +1,246 @@
+#!/usr/bin/env bash
+#
+# Prepare Flathub submission for Signed
+# This script:
+# 1. Vendors all Rust dependencies (crates.io + git)
+# 2. Generates release info for metainfo.xml
+# 3. Creates the Flathub manifest (su.reya.signed.yml)
+#
+# Usage: ./script/prepare-flathub [--release-date YYYY-MM-DD]
+
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# Configuration
+APP_ID="su.reya.signed"
+APP_NAME="Signed"
+REPO_URL="https://git.reya.su/reya/signed"
+BRANDING_LIGHT="#C6FF4D"
+BRANDING_DARK="#C6FF4D"
+
+# Parse arguments
+RELEASE_DATE=""
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --release-date)
+            RELEASE_DATE="$2"
+            shift 2
+            ;;
+        -h|--help)
+            echo "Usage: ${0##*/} [options]"
+            echo ""
+            echo "Options:"
+            echo "  --release-date DATE    Release date in YYYY-MM-DD format (default: today)"
+            echo "  -h, --help            Display this help and exit"
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1" >&2
+            exit 1
+            ;;
+    esac
+done
+
+# Get version from workspace
+VERSION=$(script/get-crate-version signed)
+if [[ -z "$RELEASE_DATE" ]]; then
+    RELEASE_DATE=$(date +%Y-%m-%d)
+fi
+
+echo "=== Preparing Flathub submission for $APP_NAME v$VERSION ==="
+echo ""
+
+# Create flathub directory
+mkdir -p flathub
+echo "[1/5] Created flathub/ directory"
+
+# Step 2: Vendor all dependencies
+echo "[2/5] Vendoring Rust dependencies..."
+if [[ -d vendor ]]; then
+    echo "      Removing old vendor directory..."
+    rm -rf vendor
+fi
+
+# Create cargo config for vendoring
+mkdir -p .cargo
+cat > .cargo/config.toml << 'EOF'
+[source.crates-io]
+replace-with = "vendored"
+
+[source.vendored]
+directory = "vendor"
+EOF
+
+# Vendor all dependencies (crates.io + git)
+cargo vendor --locked vendor/
+echo "      Vendored dependencies to vendor/"
+
+# Create tarball of vendored deps
+tar -czf flathub/vendor.tar.gz vendor/
+echo "      Created flathub/vendor.tar.gz"
+
+# Step 3: Generate release info for metainfo
+echo "[3/5] Generating release info..."
+cat > flathub/release-info.xml << EOF
+<release version="${VERSION}" date="${RELEASE_DATE}">
+  <description>
+    <p>Release version ${VERSION}</p>
+  </description>
+</release>
+EOF
+echo "      Created flathub/release-info.xml"
+
+# Step 4: Generate the metainfo file with release info
+echo "[4/5] Generating metainfo.xml..."
+export APP_ID APP_NAME BRANDING_LIGHT BRANDING_DARK
+cat desktop/resources/flatpak/signed.metainfo.xml.in | \
+    sed -e "/@release_info@/r flathub/release-info.xml" -e '/@release_info@/d' \
+    > flathub/${APP_ID}.metainfo.xml
+echo "      Created flathub/${APP_ID}.metainfo.xml"
+
+# Step 5: Generate the Flatpak manifest
+echo "[5/5] Generating Flatpak manifest..."
+
+# Get current commit hash
+COMMIT=$(git rev-parse HEAD)
+
+# Generate the YAML manifest
+cat > flathub/${APP_ID}.yml << 'MANIFEST_EOF'
+id: su.reya.signed
+runtime: org.freedesktop.Platform
+runtime-version: "24.08"
+sdk: org.freedesktop.Sdk
+sdk-extensions:
+  - org.freedesktop.Sdk.Extension.rust-stable
+  - org.freedesktop.Sdk.Extension.llvm18
+command: signed
+finish-args:
+  - --talk-name=org.freedesktop.Flatpak
+  - --device=dri
+  - --share=ipc
+  - --share=network
+  - --socket=wayland
+  - --socket=fallback-x11
+  - --socket=pulseaudio
+  - --filesystem=host
+
+build-options:
+  append-path: /usr/lib/sdk/rust-stable/bin:/usr/lib/sdk/llvm18/bin
+  env:
+    CC: clang
+    CXX: clang++
+
+modules:
+  - name: signed
+    buildsystem: simple
+    build-options:
+      env:
+        CARGO_HOME: /run/build/signed/cargo
+        CARGO_NET_OFFLINE: "true"
+        RELEASE_VERSION: "@VERSION@"
+    build-commands:
+      # Setup vendored dependencies
+      - mkdir -p .cargo
+      - cp cargo-config.toml .cargo/config.toml
+
+      # Extract vendored deps
+      - tar -xzf vendor.tar.gz
+
+      # Build the project (entire workspace, then install signed binary)
+      - cargo build --release --offline --package signed
+
+      # Install binary
+      - install -Dm755 target/release/signed /app/bin/signed
+
+      # Install icons
+      - install -Dm644 desktop/resources/icon.png /app/share/icons/hicolor/512x512/apps/su.reya.signed.png
+      - install -Dm644 desktop/resources/icon@2x.png /app/share/icons/hicolor/1024x1024/apps/su.reya.signed.png
+
+      # Install desktop file
+      - |
+        export APP_ID="su.reya.signed"
+        export APP_ICON="su.reya.signed"
+        export APP_NAME="Signed"
+        export APP_CLI="signed"
+        export APP_ARGS="%U"
+        export DO_STARTUP_NOTIFY="true"
+        envsubst < desktop/resources/signed.desktop.in > signed.desktop
+        install -Dm644 signed.desktop /app/share/applications/su.reya.signed.desktop
+
+      # Install metainfo (use pre-generated one with release info)
+      - install -Dm644 su.reya.signed.metainfo.xml /app/share/metainfo/su.reya.signed.metainfo.xml
+
+    sources:
+      # Main source code - specific commit
+      - type: git
+        url: https://git.reya.su/reya/signed.git
+        commit: "@COMMIT@"
+        tag: "v@VERSION@"
+
+      # Vendored dependencies tarball (generated by this script)
+      - type: file
+        path: vendor.tar.gz
+        sha256: "@VENDOR_SHA256@"
+
+      # Pre-generated metainfo with release info
+      - type: file
+        path: su.reya.signed.metainfo.xml
+        sha256: "@METAINFO_SHA256@"
+
+      # Cargo config for vendoring
+      - type: file
+        path: cargo-config.toml
+        sha256: "@CARGO_CONFIG_SHA256@"
+MANIFEST_EOF
+
+# Calculate SHA256 hashes
+VENDOR_SHA256=$(sha256sum flathub/vendor.tar.gz | cut -d' ' -f1)
+METAINFO_SHA256=$(sha256sum flathub/${APP_ID}.metainfo.xml | cut -d' ' -f1)
+
+# Create cargo-config.toml
+mkdir -p flathub
+cat > flathub/cargo-config.toml << 'EOF'
+[source.crates-io]
+replace-with = "vendored"
+
+[source.vendored]
+directory = "vendor"
+EOF
+CARGO_CONFIG_SHA256=$(sha256sum flathub/cargo-config.toml | cut -d' ' -f1)
+
+# Substitute values into the manifest
+sed -i.bak \
+    -e "s/@VERSION@/${VERSION}/g" \
+    -e "s/@COMMIT@/${COMMIT}/g" \
+    -e "s/@VENDOR_SHA256@/${VENDOR_SHA256}/g" \
+    -e "s/@METAINFO_SHA256@/${METAINFO_SHA256}/g" \
+    -e "s/@CARGO_CONFIG_SHA256@/${CARGO_CONFIG_SHA256}/g" \
+    flathub/${APP_ID}.yml
+rm -f flathub/${APP_ID}.yml.bak
+
+echo "      Created flathub/${APP_ID}.yml"
+
+echo ""
+echo "=== Flathub preparation complete! ==="
+echo ""
+echo "Files generated in flathub/:"
+echo "  - ${APP_ID}.yml           # Main Flatpak manifest (submit this to Flathub)"
+echo "  - ${APP_ID}.metainfo.xml  # AppStream metadata with release info"
+echo "  - vendor.tar.gz           # Vendored Rust dependencies"
+echo "  - cargo-config.toml       # Cargo configuration for vendoring"
+echo "  - release-info.xml        # Release info snippet"
+echo ""
+echo "Next steps:"
+echo "  1. Test the build locally:"
+echo "       cd flathub && flatpak-builder --user --install --force-clean build ${APP_ID}.yml"
+echo ""
+echo "  2. If build succeeds, submit to Flathub:"
+echo "     - Fork https://github.com/flathub/flathub"
+echo "     - Clone: git clone --branch=new-pr git@github.com:YOUR_USERNAME/flathub.git"
+echo "     - Copy ONLY ${APP_ID}.yml to the repo"
+echo "     - Submit PR against flathub/flathub:new-pr"
+echo ""
+echo "Note: Make sure you have:"
+echo "  - Committed all changes (commit: ${COMMIT})"
+echo "  - Tagged the release (tag: v${VERSION})"
+echo "  - Pushed the tag"

script/release

@@ -0,0 +1,132 @@
+#!/bin/bash
+
+# Script to release a new version of the application
+# Usage: ./release <new_version>
+
+set -e  # Exit on any error
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 <new_version>"
+    echo "Example: $0 1.0.0"
+    exit 1
+fi
+
+NEW_VERSION="$1"
+WORKSPACE_CARGO="Cargo.toml"
+CRATE_CARGO="desktop/Cargo.toml"
+
+# Check if both Cargo.toml files exist
+if [ ! -f "$WORKSPACE_CARGO" ]; then
+    echo "Error: $WORKSPACE_CARGO not found in current directory"
+    exit 1
+fi
+
+if [ ! -f "$CRATE_CARGO" ]; then
+    echo "Error: $CRATE_CARGO not found"
+    exit 1
+fi
+
+# Function to update version in a Cargo.toml file
+update_version() {
+    local file="$1"
+    local backup="${file}.bak"
+
+    # Backup the original file
+    cp "$file" "$backup"
+
+    # More flexible regex that handles various version formats and whitespace.
+    # Note: -i.bak works on both GNU and BSD sed.
+    if sed -i.bak -E "s/^[[:space:]]*version[[:space:]]*=[[:space:]]*\"[^\"]+\"/version = \"$NEW_VERSION\"/" "$file"; then
+        echo "✓ Updated version to $NEW_VERSION in $file"
+    else
+        echo "Error: Failed to update version in $file"
+        # Restore original backup
+        mv "$backup" "$file"
+        exit 1
+    fi
+
+    # Remove the backup file
+    rm -f "$backup"
+}
+
+# Update both Cargo.toml files
+echo "Updating versions..."
+update_version "$WORKSPACE_CARGO"
+update_version "$CRATE_CARGO"
+
+# Check git status before committing
+echo "Checking git status..."
+if git status --porcelain | grep -q .; then
+    echo "Current uncommitted changes:"
+    git status --short
+
+    # Ask user if they want to commit all changes or just version files
+    echo ""
+    echo "Do you want to:"
+    echo "1) Commit all current changes (including the version updates)"
+    echo "2) Commit only the version file changes"
+    echo "3) Abort the release"
+    read -p "Enter choice (1/2/3): " choice
+
+    case $choice in
+        1)
+            echo "Committing all changes..."
+            git add .
+            ;;
+        2)
+            echo "Committing only version file changes..."
+            git add "$WORKSPACE_CARGO" "$CRATE_CARGO"
+            ;;
+        3)
+            echo "Release aborted by user"
+            exit 0
+            ;;
+        *)
+            echo "Invalid choice. Release aborted."
+            exit 1
+            ;;
+    esac
+else
+    # Only version files were modified, add them specifically
+    echo "Only version files were modified, adding them for commit..."
+    git add "$WORKSPACE_CARGO" "$CRATE_CARGO"
+fi
+
+# Commit the changes
+COMMIT_MSG="chore: release version $NEW_VERSION"
+
+if git commit -m "$COMMIT_MSG"; then
+    echo "✓ Committed version changes"
+else
+    echo "Error: Failed to commit version changes"
+    exit 1
+fi
+
+# Push version changes to origin
+echo "Pushing version changes to origin..."
+if git push origin master; then
+    echo "✓ Successfully pushed version changes to origin"
+else
+    echo "Error: Failed to push version changes to origin"
+    exit 1
+fi
+
+# Create git tag
+TAG_NAME="v$NEW_VERSION"
+
+if git tag -a "$TAG_NAME" -m "$COMMIT_MSG"; then
+    echo "✓ Created git tag: $TAG_NAME"
+else
+    echo "Error: Failed to create git tag"
+    exit 1
+fi
+
+# Push tag to origin
+echo "Pushing tag to origin..."
+if git push origin "$TAG_NAME"; then
+    echo "✓ Successfully pushed tag to origin"
+    echo "✓ Release $NEW_VERSION completed successfully!"
+else
+    echo "Error: Failed to push tag to origin"
+    exit 1
+fi

script/try-snap

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# This script is intended to be run after `script/bundle-snap`.
+#
+# It expects a version to be passed as the first argument, and expects the
+# built `.snap` for that version to be in the current directory. bundle-snap
+# names it `signed_<version>_amd64.snap` (Snap's canonical amd64/arm64 naming).
+#
+# This will uninstall the current `signed` snap, replacing it with a snap
+# that directly uses the `snap/unpacked` directory.
+
+set -euxo pipefail
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 <release_version>"
+  exit 1
+fi
+
+# Rerun as root
+[ "$UID" -eq 0 ] || exec sudo bash -e "$0" "$@"
+
+snap remove signed || true
+mkdir -p snap
+rm -rf snap/unpacked
+unsquashfs -dest snap/unpacked "signed_$1_amd64.snap"
+snap try --classic snap/unpacked