feat(web-shell): manage git remotes from the workspace branch picker

eslint.config.js

@@ -56,6 +56,11 @@ export default tseslint.config(
       'node_modules/*',
       'packages/**/dist/**',
       'packages/web-templates/src/generated/**',
+      // Generated UTS #39 confusables table (6.5k-entry literal): the
+      // type-aware rules OOM the eslint heap on it, and generated data
+      // has no idiom to enforce. Regenerate via
+      // packages/web-shell/scripts/generate-confusables.mjs.
+      'packages/web-shell/client/utils/unicodeConfusables.ts',
       'integrations/**/dist/**',
       'bundle/**',
       'package/bundle/**',

package.json

@@ -38,7 +38,7 @@
     "debug": "cross-env DEBUG=1 node --inspect-brk scripts/start.js",
     "generate": "node scripts/generate-git-commit-info.js",
     "generate:settings-schema": "node --import tsx/esm scripts/generate-settings-schema.ts",
-    "build": "cross-env NODE_OPTIONS=\"--max-old-space-size=3072\" node scripts/build.js",
+    "build": "cross-env NODE_OPTIONS=\"--max-old-space-size=4096\" node scripts/build.js",
     "build-and-start": "npm run build && npm run start",
     "build:vscode": "node scripts/build_vscode_companion.js",
     "build:all": "npm run build && npm run build:sandbox && npm run build:vscode",

packages/cli/src/serve/process-env-guard.test.ts

@@ -284,6 +284,15 @@ const allowedProcessEnvAccesses = normalizeAllowances([
       },
     },
   ],
+  [
+    'packages/cli/src/serve/routes/workspace-git-branches.ts',
+    {
+      reason:
+        "The git error redaction mirrors the daemon process's own HOME/" +
+        'XDG_CONFIG_HOME to label the inherited config paths git echoes.',
+      accesses: { 'key:HOME': 1, 'key:XDG_CONFIG_HOME': 1 },
+    },
+  ],
   [
     'packages/cli/src/serve/server/fs-factory.ts',
     {