feat(diff): apply and revert hunks, lines and files from outside the working tree

[adehad]

Closes #70.

Stacked on #68 (a comment cleanup), because both touch rgitui_diff/src/lib.rs and would otherwise conflict on whichever merged second. The first commit here is #68's.

Adds apply and revert for diff content that comes from outside the working tree — a commit, a stash entry, or a pair of revisions — at the granularity the user is working at.

#65 stopped commit diffs from offering staging they could not honour. This gives them something they can: the hunk-level equivalents of cherry-pick and revert.

What a user gets

On a diff from a commit, stash or ref pair, the hunk headers offer Apply and Revert where a working-tree diff offers Stage and Unstage, and the header gains a File menu for whole-file operations. Three scopes, following what is selected:

Scope	When
The hunk	Default — the hunk under the cursor, or every hunk the selection spans
The selected lines	When a line selection exists, matching partial staging
The whole file	From the header's File menu, selection ignored

Rebindable, declared in the commands! registry in the diff namespace, context DiffViewer && !modal && !TextInput:

Command	Default
diff::ApplySelection	a, shift-a
diff::RevertSelection	r, shift-r
diff::ApplyFile	alt-a
diff::RevertFile	alt-r

alt-a/alt-r follow the existing alt-s/alt-u convention for the fixed-scope variant. Bare a and r are free in that context: the viewer's select-all is secondary-a, and the only other bare r is rebase::RebaseReword, which sits behind modal. the_default_keymap_has_no_conflicts and the_shipped_defaults_shadow_only_these pass unchanged — the new bindings introduce no shadowing.

Not only history: cross-branch is the point

DiffSource gains Compare { from, to }, and apply/revert resolve every non-mutable source to a tree pair through one path. So applying from a branch comparison brings that branch's content into the working tree, and reverting restores the other side — the same code as a commit hunk, not a special case. Nothing constructs Compare yet because there is no compare view in the UI; the plumbing is here so that view is additive when it arrives.

Why not repo.apply or git apply --3way

Both obvious routes are wrong for this case, which is worth stating since the module is doing something less obvious instead:

• libgit2's apply is a plain patch applier with no three-way fallback: it matches hunk context and fails outright when it does not line up. A dirty working tree is the normal case here, and an uncommitted edit anywhere in a hunk's three-line context window defeats it.
• git apply --3way merges into the index, and refuses with does not match index whenever the working-tree file differs from its index entry — precisely the dirty tree the fallback exists for. On failure it leaves conflict markers plus an unmerged index entry behind, which is a worse state to hand back than a refusal.

Instead worktree_patch.rs reconstructs the three sides itself — base (the file on the side the patch starts from), target (base with exactly the selected hunk or lines applied, computed from the diff rather than by matching context, so it is exact by construction), and ours (the working tree now) — and asks libgit2 for a three-way merge. Unrelated local edits merge cleanly, an overlapping edit conflicts, and the index is never touched.

Safety

These write to files on disk, unlike staging, so each operation records an undo entry carrying the file bytes it will restore — including recording a file as absent when the apply created it, so undo deletes it again. A reverse patch would not restore the original exactly when the forward operation merged, which is why the bytes are stored rather than the patch.

Failures are distinct, actionable messages rather than one generic error: content that will not merge, an operation that has already been applied, and a conflicting local edit each say what happened and what to do.

Tests

1215 passing, up from 1146 on main.

• 51 in worktree_patch, asserting file contents after the operation rather than just Ok: apply onto a clean tree, apply with unrelated local edits present, apply something already applied, revert, whole-file and line-subset patches, and direction correctness for a ref pair.
• 15 view-level tests driving a real DiffViewer through ViewTest: sources that cannot be staged emit apply/revert and never a staging request; Worktree and Index still emit exactly their staging request, which is the guard against a vacuously passing suite.

Note on the view tests: they call the public methods rather than simulating a/r, because rgitui_diff sits below rgitui_workspace and no action handler exists inside this crate's harness — a keystroke test here would assert nothing. That follows the pattern main's own staging_requests_after_stage_then_unstage already uses.

On #64

worktree_patch.rs needed no argsafe work and the reason is structural: it never shells out. The only user-controlled strings are Compare's endpoints, which go to repo.revparse_single rather than a command line. It also passes None for DiffOptions and filters deltas by exact Path equality in Rust, so the pathspec-fnmatch class of bug #64 fixed cannot occur — that is strictly tighter than a pathspec with disable_pathspec_match(true).

Verification

cargo test --workspace                                 -> 1215 passed, 6 ignored
cargo clippy --workspace --all-targets -- -D warnings  -> clean
cargo fmt --all -- --check                             -> clean
cargo build --package rgitui                           -> ok

Windows 11, pinned 1.94.1 toolchain. docs/KEYBINDINGS.md and docs/keymap.schema.json are re-blessed for the four new commands.

🤖 Generated with Claude Code