"Pull All" pulls into repositories with uncommitted changes without the confirmation the per-repo "Pull" button asks for

[matt-edmondson]

What's wrong

The two pull buttons take different paths:

• Pull (per repository) goes through PullRepoConfirmingUncommittedChanges. That calls DecidePull, and when git status --porcelain reports changes it asks "Pull anyway?" (ProjectDirector/ProjectDirector.cs:463-496, pinned by PullDecisionTests).
• Pull All (left panel, ProjectDirector.cs:829-832) calls PullAllRepos, which is Options.ClonedRepos.Values.ForEach(PullRepo) (:402). That goes straight to PullRepo(GitRepository) and runs git pull --ff-only in every cloned repository. DecidePull is never consulted.

Failure scenario

1. Edit a file in two cloned repositories and leave the edits uncommitted.
2. Click Pull on one of them. The "Uncommitted Changes" prompt appears.
3. Click Pull All. Both repositories are pulled at once, with no prompt.

What happens next depends on whether the upstream change touches the edited file:

• It does: the only feedback is a git failure line in the log panel, which keeps just 100 lines (The log panel scrolls itself to the bottom every frame and keeps only 100 lines, so a failed push, pull or commit can't be scrolled back to and is soon pushed out by auto-fetch lines #446).
• It doesn't: the pull goes ahead silently underneath the user's edits.

That is the situation the per-repo confirmation exists to warn about: "Pulling now may fail partway or leave the working tree in a confusing state".

Suggested fix

Route Pull All through the same decision:

• Call DecidePull for each repository.
• Pull the clean ones.
• For the dirty ones, either skip them and log "skipped : uncommitted changes", or show one confirmation that lists them all.

Extract the split as a pure method, such as PartitionForPullAll(repos) -> (clean, dirty), and cover it in PullDecisionTests, following CLAUDE.md's pattern for testable rules.

Acceptance criteria

• Pull All never pulls a repository for which DecidePull returns Confirm unless the user has agreed, either for the batch or for that repository.
• Skipped repositories are named in the log.
• The partition is covered by a test against throwaway repositories.

[matt-edmondson]

Triage

• Category: Bug
• Priority: Medium. Pull All skips a safety prompt the app shows everywhere else. Because it uses git pull --ff-only, git still refuses to overwrite local edits that conflict with the incoming changes, so the risk is confusion and silently merged-under-edits worktrees rather than lost data.
• Area / suggested assignment: ProjectDirector/ProjectDirector.cs (PullAllRepos :402, Pull All button :829-832, PullRepoConfirmingUncommittedChanges / DecidePull :463-496), PullDecisionTests
• Related: The log panel scrolls itself to the bottom every frame and keeps only 100 lines, so a failed push, pull or commit can't be scrolled back to and is soon pushed out by auto-fetch lines #446 (the 100-line log panel scrolls itself, so the git failure feedback is easily lost); Auto-fetch starts a git fetch for every cloned repository at the same moment every minute, with no concurrency limit and no in-flight check #448 (auto-fetch runs every repository at once with no concurrency limit, a similar batch operation that could share a helper).
• In progress? No open PR matches.
• Notes: Add a pure PartitionForPullAll(repos) -> (clean, dirty) built on DecidePull. Pull the clean repositories, and show one confirmation listing the dirty ones, or skip them and log each by name. The log panel scrolls itself to the bottom every frame and keeps only 100 lines, so a failed push, pull or commit can't be scrolled back to and is soon pushed out by auto-fetch lines #446 limits how useful the log-only option is.

---

Generated by Claude Code