From f51436e43a4eb0c5d5c457e73aa291a6ebe227b1 Mon Sep 17 00:00:00 2001
From: JuanMa <juanma.garrido@gmail.com>
Date: Mon, 7 Sep 2026 14:36:21 +0200
Subject: [PATCH 1/2] Clone a new site with the bundled Git, partial rather
 than shallow

Flow 1 of phase 3 of #364 (#385): the first write the binary makes, and
the one whose blast radius is a repository that did not exist before.

src/git-clone.cjs runs `git clone --filter=blob:none --single-branch
--branch trunk --progress`, writes the repository config the app relies
on at clone time (core.autocrlf=false, core.symlinks=false, and
core.longpaths=true on Windows) and turns Git's progress lines into
`{ phase, loaded, total }` events, the same `<phase> <loaded>/<total>`
line the terminal panel already shows. Partial, not shallow: the whole
history comes down without the blobs, which is a merge base for every
pull request (#351) at about 57 MB, and nothing the app does afterwards
needs a blob that is not there.

wordpress:setup hands the child to the quit sweep for the length of the
clone and removes the directory it created if the clone fails, so a
half-written tree is never adopted as a site. isomorphic-git leaves
main.js; its remaining callers are the write flows behind the facades.

The wiring tests stub cloneSite where they stubbed isomorphic-git's
clone; a new integration test clones from a local repository over
file:// (a transport the old engine never had) and checks the config,
the promisor remote, the missing older blob and the progress shape. The
user guide stops saying Git is isomorphic-git.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J4uRM5JosAcMbKXowaXyVu
---
 .../instructions/code-review.instructions.md  |   2 +-
 AGENTS.md                                     |   2 +-
 docs/guide/creating-a-site.md                 |   4 +-
 docs/guide/getting-started.md                 |   2 +-
 src/git-clone.cjs                             | 183 ++++++++++++++++++
 src/main.js                                   |  45 +++--
 src/remove-tree.js                            |   9 +-
 src/setup-tracker.js                          |   2 +-
 tests/unit/git-clone.integration.test.cjs     |  79 ++++++++
 tests/unit/git-clone.test.cjs                 |  61 ++++++
 tests/unit/ipc-wiring.test.cjs                |  10 +-
 11 files changed, 366 insertions(+), 33 deletions(-)
 create mode 100644 src/git-clone.cjs
 create mode 100644 tests/unit/git-clone.integration.test.cjs
 create mode 100644 tests/unit/git-clone.test.cjs

diff --git a/.github/instructions/code-review.instructions.md b/.github/instructions/code-review.instructions.md
index 19859547..db5199f5 100644
--- a/.github/instructions/code-review.instructions.md
+++ b/.github/instructions/code-review.instructions.md
@@ -61,7 +61,7 @@ Invariants. Breaking one is a `[fix here]` finding even when the code works on t
 
 **Child processes run on Electron's bundled Node, never the host's.** Spawns go through `process.execPath` with `ELECTRON_RUN_AS_NODE=1` in the environment (see `runNpmWithEngineRetry` and the `playground:start` handler in `src/main.js`, and `buildChildEnv`). A bare `spawn('node')` or `spawn('npm')` assumes a host toolchain that is not there. On Windows child `npm` processes find a `node` at all only because of the `PATH` shim built by `ensureNodeShimDir` — new spawns must inherit that environment rather than build their own. The one exception is the bundled Git, which is not a Node process and gets its own environment from `src/git-binary.cjs` (next invariant).
 
-**Git is the binary the app ships, never the host's.** Since #364 the app bundles Git through `dugite`, unpacked from `app.asar`. `require('dugite')` appears in exactly one file, `src/git-binary.cjs`; every Git spawn resolves the binary with its `resolveGitBinary`, takes its environment from `buildGitEnv`, its options from `SPAWN_OPTIONS` (which already sets `detached` the way section 4 asks), and starts its arguments with `BASE_ARGS`. That env drops every `GIT_*` variable the host had (dugite would otherwise honour `LOCAL_GIT_DIRECTORY` and `GIT_EXEC_PATH` and run a different Git), turns the host's system and global config off, and turns prompting off, so the host's shell or `~/.gitconfig` cannot change what the app does. A `spawn('git')` that relies on `PATH`, a hand-joined path into the dugite tree, a `GitProcess.exec` outside that file, a Git call given `buildChildEnv`'s environment, or one spawned without an explicit `cwd` is a regression. Parse only porcelain-stable output, with the flag that pins it (`--porcelain=v2`, `-z`, an explicit `--format`); parsing human-facing output is a finding however convenient. `src/git-run.cjs` is the only module that spawns the binary and `src/git-read.cjs` the only one that parses its output; a new read belongs there, with a parser test on fixture bytes, not inline at a call site. Since #384 every read outside the write flows runs on the bundled Git and returns the same shapes the `isomorphic-git` calls returned (status rows included), so a facade signature that changes with the engine is a finding; the writes and the clone, with the reads inside them, still run on `isomorphic-git` until #385, and patch and diff generation stays hand-rolled in `src/main.js` until the phase that moves it.
+**Git is the binary the app ships, never the host's.** Since #364 the app bundles Git through `dugite`, unpacked from `app.asar`. `require('dugite')` appears in exactly one file, `src/git-binary.cjs`; every Git spawn resolves the binary with its `resolveGitBinary`, takes its environment from `buildGitEnv`, its options from `SPAWN_OPTIONS` (which already sets `detached` the way section 4 asks), and starts its arguments with `BASE_ARGS`. That env drops every `GIT_*` variable the host had (dugite would otherwise honour `LOCAL_GIT_DIRECTORY` and `GIT_EXEC_PATH` and run a different Git), turns the host's system and global config off, and turns prompting off, so the host's shell or `~/.gitconfig` cannot change what the app does. A `spawn('git')` that relies on `PATH`, a hand-joined path into the dugite tree, a `GitProcess.exec` outside that file, a Git call given `buildChildEnv`'s environment, or one spawned without an explicit `cwd` is a regression. Parse only porcelain-stable output, with the flag that pins it (`--porcelain=v2`, `-z`, an explicit `--format`); parsing human-facing output is a finding however convenient. `src/git-run.cjs` is the only module that spawns the binary and `src/git-read.cjs` the only one that parses its output; a new read belongs there, with a parser test on fixture bytes, not inline at a call site. Since #384 every read outside the write flows runs on the bundled Git and returns the same shapes the `isomorphic-git` calls returned (status rows included), so a facade signature that changes with the engine is a finding; the new-site clone runs on it too (`src/git-clone.cjs`, the one place that reads Git's human-facing progress lines, because there is no porcelain for progress); the remaining writes, with the reads inside them, still run on `isomorphic-git` until #385, and patch and diff generation stays hand-rolled in `src/main.js` until the phase that moves it.
 
 **`electron-store` is the only persistence layer.** No database, no sidecar JSON. It holds the site registry and per-site metadata and is the single source of truth for "known sites". A second store, a cache file, or state parked in a module-level variable that outlives a handler is architectural drift — flag it.
 
diff --git a/AGENTS.md b/AGENTS.md
index 405f4d4f..35d7fdd2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -87,7 +87,7 @@ When asked to add an existing pull request to an existing stack, preserve its co
 ## Architecture notes (non-obvious)
 
 - **Child processes run on Electron's own Node, not the system Node.** `npm install`, `npm run <script>`, and the Playground server are spawned via `process.execPath` + `ELECTRON_RUN_AS_NODE=1` — this is the mechanism behind "zero prerequisites." On Windows this requires shimming `node`/`npm`/`npx` into `PATH` so child `npm` processes can find a `node` binary at all.
-- **Git has no host dependency.** The app ships its own Git binary via `dugite` (#364), unpacked from `app.asar` and resolved only through `src/git-binary.cjs`, which also builds the environment it runs with (host system and global config off, prompting off, no `GIT_*` variable inherited from the host and nothing from a Node child). `require('dugite')` lives in that one file; `src/git-run.cjs` is the only place the binary is spawned, and `src/git-read.cjs` holds every read and its parser. Spawning a `git` found on `PATH`, or calling dugite's `GitProcess` from anywhere else, is a regression. As of #384 every read outside the write flows (status, branches, history, blobs, the patch walk) runs on the bundled binary; the writes and the clone, including the reads inside them, still run on `isomorphic-git` until #385 moves them flow by flow. Only porcelain-stable output (`--porcelain=v2`, `-z`, explicit `--format`) is ever parsed. Patch/diff generation is done by hand in `main.js`, not `git diff`: one status scan against the branch point each ticket recorded (#108), nothing staged, and `/dev/null` naming whichever side of an addition or a deletion does not exist — the app reads its own patches back when a mentor applies one, and that filename is the only thing its parser reads an add or a delete from (#85).
+- **Git has no host dependency.** The app ships its own Git binary via `dugite` (#364), unpacked from `app.asar` and resolved only through `src/git-binary.cjs`, which also builds the environment it runs with (host system and global config off, prompting off, no `GIT_*` variable inherited from the host and nothing from a Node child). `require('dugite')` lives in that one file; `src/git-run.cjs` is the only place the binary is spawned, and `src/git-read.cjs` holds every read and its parser. Spawning a `git` found on `PATH`, or calling dugite's `GitProcess` from anywhere else, is a regression. As of #384 every read outside the write flows (status, branches, history, blobs, the patch walk) runs on the bundled binary, and since #385's first flow so does the new-site clone (`src/git-clone.cjs`: partial, `--filter=blob:none`, repo config written at clone time); the remaining writes, including the reads inside them, still run on `isomorphic-git` until #385 moves them flow by flow. Only porcelain-stable output (`--porcelain=v2`, `-z`, explicit `--format`) is ever parsed. Patch/diff generation is done by hand in `main.js`, not `git diff`: one status scan against the branch point each ticket recorded (#108), nothing staged, and `/dev/null` naming whichever side of an addition or a deletion does not exist — the app reads its own patches back when a mentor applies one, and that filename is the only thing its parser reads an add or a delete from (#85).
 - **`electron-store` is the only persistence layer** — no separate DB. It holds the site registry and per-site metadata; treat it as the single source of truth for "known sites."
 - Long-running child-process output (installs, scripts, server) is streamed to the renderer via correlated IDs (`installId`/`runId`), not returned synchronously — expect async event handlers, not return values, when tracing that flow.
 
diff --git a/docs/guide/creating-a-site.md b/docs/guide/creating-a-site.md
index dc263be6..4b7f6742 100644
--- a/docs/guide/creating-a-site.md
+++ b/docs/guide/creating-a-site.md
@@ -21,9 +21,9 @@ Click **Create site** (or press Enter) to start. **Cancel** or Escape closes the
 
 ## What happens during setup
 
-The app clones the `wordpress-develop` repository from GitHub. Git is bundled with the app as `isomorphic-git`, a pure JavaScript implementation, so no system Git installation is involved.
+The app clones the `wordpress-develop` repository from GitHub with the Git it ships inside the app, so no system Git installation is involved. The clone carries the full history but fetches file contents on demand, so it is not much larger than a shallow one.
 
-While the clone runs, the site view shows a **Setting up new site…** card with the current phase and a terminal panel streaming progress output. The clone downloads the full repository, so expect it to take several minutes depending on your connection.
+While the clone runs, the site view shows a **Setting up new site…** card with the current phase and a terminal panel streaming progress output. Expect it to take a few minutes depending on your connection.
 
 The clone is the first step of the [initial setup checklist](./setup-wizard); the remaining steps stay locked until it finishes. Then the app carries on by itself — installing the dependencies and running the first build without waiting for you — so the only step left to click is starting the dev server.
 
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index 57730e41..27b4da30 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -67,7 +67,7 @@ Every ticket you link gets its own branch inside the site and keeps its own work
 
 ## How it works under the hood
 
-- Git operations are handled by `isomorphic-git`, a pure JavaScript implementation of Git.
+- Git operations run on a Git binary bundled inside the app (never one installed on your machine). Some of the older flows still use `isomorphic-git`, a pure JavaScript implementation, while they are being moved over.
 - Node scripts and npm commands run on the Node.js runtime bundled with the Electron app. A small shim directory is injected into the `PATH` so subprocesses find `node`, `npm`, and `npx` without a system install.
 - The WordPress server runs on `@wp-playground/cli` from [WordPress Playground](https://wordpress.github.io/wordpress-playground/), backed by SQLite.
 - Patches are generated with the `diff` npm package.
diff --git a/src/git-clone.cjs b/src/git-clone.cjs
new file mode 100644
index 00000000..6067690a
--- /dev/null
+++ b/src/git-clone.cjs
@@ -0,0 +1,183 @@
+'use strict';
+
+/**
+ * Creating a site: the clone of `wordpress-develop` through the bundled Git
+ * (#385, flow 1 of phase 3 of #364). The first write the binary makes, and
+ * the one with the narrowest blast radius: a repository that did not exist
+ * before.
+ *
+ * Partial, not shallow. `--filter=blob:none` brings the whole history down
+ * (commits and trees, about 57 MB for wordpress-develop) and fetches a blob
+ * only when something asks for it, which a checkout of HEAD does and nothing
+ * the app does afterwards needs. What that buys is a merge base for every
+ * pull request without a full clone (#351), and a route `isomorphic-git`
+ * never had. A shallow clone would be smaller by that 57 MB and have no
+ * history at all. Measured in the #364 spike: 5.2 s for the history alone.
+ *
+ * The repository's own config is written at clone time, so a site the binary
+ * made never depends on the CRLF view git-read.cjs synthesises for sites the
+ * old engine made: `core.autocrlf=false` keeps the tree LF on every platform,
+ * which is what wordpress-develop's blobs are and what the patch builder
+ * assumes; `core.symlinks=false` matches what the old engine wrote; and on
+ * Windows `core.longpaths=true` because the tree has paths past MAX_PATH.
+ *
+ * Progress arrives on stderr as the lines Git prints for a human, which is
+ * the one place the app reads non-porcelain output: Git has no machine
+ * format for progress, the lines have had the same shape for fifteen years,
+ * and a line that does not parse is dropped rather than shown.
+ */
+
+const path = require('path');
+const { spawnGit, GitError } = require('./git-run.cjs');
+
+/**
+ * The branch a new site checks out. `trunk` is the pristine snapshot every
+ * ticket branch is diffed against (ticket-branches.js).
+ */
+const DEFAULT_BRANCH = 'trunk';
+
+/**
+ * @param {Object} root0
+ * @param {string} root0.url
+ * @param {string} root0.dir        Must not exist yet, or be empty.
+ * @param {string} [root0.branch]
+ * @param {string} [root0.platform]
+ * @return {string[]}
+ */
+function cloneArgs({ url, dir, branch = DEFAULT_BRANCH, platform = process.platform }) {
+	return [
+		'clone',
+		'--filter=blob:none',
+		'--single-branch',
+		'--branch', branch,
+		'--progress',
+		'--config', 'core.autocrlf=false',
+		'--config', 'core.symlinks=false',
+		...(platform === 'win32' ? ['--config', 'core.longpaths=true'] : []),
+		'--',
+		url,
+		dir
+	];
+}
+
+// `Receiving objects:  42% (1234/5678), 12.00 MiB | 3.00 MiB/s`, with or
+// without the `remote: ` prefix the server-side phases carry.
+const PROGRESS_LINE = /^(?:remote: )?([A-Za-z][A-Za-z ]*?):\s+(\d+)% \((\d+)\/(\d+)\)/;
+
+/**
+ * One progress event per phase line, from a chunk that may hold several
+ * lines and may end mid-line. Git separates updates to the same phase with
+ * `\r` and phases with `\n`; both end a segment here.
+ *
+ * @param {string} text
+ * @return {Array<{phase: string, percent: number, loaded: number, total: number}>}
+ */
+function parseProgressLines(text) {
+	const events = [];
+	for (const segment of text.split(/[\r\n]/)) {
+		const match = PROGRESS_LINE.exec(segment);
+		if (!match) continue;
+		events.push({
+			phase: match[1].toLowerCase(),
+			percent: Number(match[2]),
+			loaded: Number(match[3]),
+			total: Number(match[4])
+		});
+	}
+	return events;
+}
+
+/**
+ * Feeds chunks in, emits complete progress lines out, and holds back the
+ * tail that has not ended yet so a percentage split across two chunks is not
+ * reported twice, or wrongly.
+ *
+ * @param {Function} onEvent
+ * @return {{push: Function, flush: Function}}
+ */
+function createProgressReader(onEvent) {
+	let pending = '';
+	const emit = (text) => {
+		for (const event of parseProgressLines(text)) onEvent(event);
+	};
+	return {
+		push(chunk) {
+			pending += chunk;
+			const cut = Math.max(pending.lastIndexOf('\r'), pending.lastIndexOf('\n'));
+			if (cut === -1) return;
+			emit(pending.slice(0, cut + 1));
+			pending = pending.slice(cut + 1);
+		},
+		flush() {
+			if (pending) emit(pending);
+			pending = '';
+		}
+	};
+}
+
+/**
+ * Clones `url` into `dir`. Resolves when the checkout is complete; rejects
+ * with a GitError carrying Git's stderr when it is not, in which case `dir`
+ * holds whatever Git left and the caller decides what to do with it.
+ *
+ * @param {Object}   root0
+ * @param {string}   root0.url
+ * @param {string}   root0.dir
+ * @param {string}   [root0.branch]
+ * @param {Function} [root0.onProgress] `{ phase, percent, loaded, total }`
+ * @param {Function} [root0.onChild]    Handed the ChildProcess, so a quit can
+ *                                      kill it (killChildTree).
+ * @param {string}   [root0.platform]
+ * @param {Function} [root0.spawn]      Injection point for tests.
+ * @return {Promise<{dir: string}>}
+ */
+function cloneSite({ url, dir, branch = DEFAULT_BRANCH, onProgress = null, onChild = null, platform = process.platform, spawn } = {}) {
+	return new Promise((resolve, reject) => {
+		const args = cloneArgs({ url, dir, branch, platform });
+		// The parent is the working directory: `dir` may not exist yet, and a
+		// clone is the one command whose target is an argument, not the cwd.
+		const cwd = path.dirname(dir);
+		let child;
+		try {
+			child = spawnGit(args, { cwd, ...(spawn ? { spawn } : {}) });
+		} catch (error) {
+			reject(error);
+			return;
+		}
+		if (onChild) onChild(child);
+
+		const reader = createProgressReader((event) => { if (onProgress) onProgress(event); });
+		const stderr = [];
+		let settled = false;
+		child.stdout.on('data', () => {});
+		child.stderr.on('data', (chunk) => {
+			const text = chunk.toString('utf8');
+			stderr.push(text);
+			reader.push(text);
+		});
+		child.on('error', (error) => {
+			if (settled) return;
+			settled = true;
+			reject(new GitError(`git clone could not start: ${error.message}`, { code: error.code, signal: null, stderr: '', args, cwd }));
+		});
+		child.on('close', (status, signal) => {
+			if (settled) return;
+			settled = true;
+			reader.flush();
+			if (status === 0) {
+				resolve({ dir });
+				return;
+			}
+			const text = stderr.join('');
+			// Git's reason is its `fatal:` (or `error:`) line, which is not always
+			// the last one: "Please make sure you have the correct access rights
+			// and the repository exists." follows it. Fall back to the last line
+			// that is not a progress update.
+			const lines = text.split(/[\r\n]/).filter((line) => line.trim() && !PROGRESS_LINE.test(line));
+			const reason = lines.filter((line) => /^(fatal|error):/.test(line)).pop() || lines.pop() || (signal ? `killed by ${signal}` : 'no output');
+			reject(new GitError(`git clone failed (${status === null ? signal : status}): ${reason}`, { code: status, signal, stderr: text, args, cwd }));
+		});
+	});
+}
+
+module.exports = { DEFAULT_BRANCH, cloneArgs, parseProgressLines, createProgressReader, cloneSite };
diff --git a/src/main.js b/src/main.js
index 834524f8..b2e9b6b9 100644
--- a/src/main.js
+++ b/src/main.js
@@ -5,8 +5,6 @@ const crypto = require('crypto');
 const fs = require('fs');
 const fse = require('fs-extra');
 const nodeHttp = require('http');
-const git = require('isomorphic-git');
-const http = require('isomorphic-git/http/node');
 const JsDiff = require('diff');
 const { spawn } = require('child_process');
 const { SMTPServer } = require('smtp-server');
@@ -36,6 +34,7 @@ const { getClientId: getGithubClientId, requestDeviceCode, pollForToken, fetchVi
 const { openPullRequest, buildPullRequestBody, testMode: githubTestMode } = require('./github-pr.cjs');
 const { buildPullRequestEntries } = require('./pr-files.cjs');
 const { resolveRef, changesAgainst, readBlobs, readCommitInfo, treeEntryMode } = require('./git-read.cjs');
+const { cloneSite } = require('./git-clone.cjs');
 const { openAndScrape, fetchAttachment } = require('./trac-view');
 const { openExternalUrl, ALLOWED_URL_SCHEMES } = require('./external-url');
 const { deleteRegisteredSite, revealRegisteredSite, clearRegisteredSiteLog } = require('./site-registry');
@@ -248,6 +247,10 @@ function findAvailableDirName(rootDir, baseName) {
 
 /** @type {Record<string, import('child_process').ChildProcess>} */
 const runningInstalls = {};
+// The clone each site being created is running, keyed by its directory:
+// liveness only (setup-tracker.js has the boundary), so the quit sweep can
+// end a clone the same way it ends an install.
+const runningClones = new Map();
 /** @type {Record<string, import('child_process').ChildProcess>} */
 const runningScripts = {};
 // Children the user explicitly stopped, so a failed run is not retried.
@@ -1768,6 +1771,7 @@ app.on('before-quit', () => {
 	const children = [
 		...Object.values(runningInstalls),
 		...Object.values(runningScripts),
+		...runningClones.values(),
 		...Object.values(playgroundServers).map((s) => s.child),
 		...(playgroundWebServer?.child ? [playgroundWebServer.child] : [])
 	];
@@ -1904,21 +1908,26 @@ ipcMain.handle('wordpress:setup', async (event, destDir, options = {}) => {
 	// `track` releases the entry however this ends.
 	return setupTracker.track(siteDir, async () => {
 		event.sender.send('download:status', { phase: 'cloning', target: siteDir });
-		await git.clone({
-			http,
-			fs,
-			url: WORDPRESS_GIT_URL,
-			dir: siteDir,
-			singleBranch: true,
-			depth: 1,
-			ref: 'trunk',
-			onProgress: (evt) => {
-				// evt: {phase,total,loaded,lengthComputable} - forward as terminal-like output
-				const msg = `${evt.phase || 'clone'} ${evt.loaded || 0}/${evt.total || 0}`;
-				event.sender.send('download:progress', { target: siteDir, message: msg });
-			}
-		});
-		await ensureAutocrlf(siteDir);
+		try {
+			await cloneSite({
+				url: WORDPRESS_GIT_URL,
+				dir: siteDir,
+				onChild: (child) => { runningClones.set(siteDir, child); },
+				onProgress: (evt) => {
+					// Same line the old engine produced, so the terminal panel reads
+					// the same: `<phase> <loaded>/<total>`.
+					event.sender.send('download:progress', { target: siteDir, message: `${evt.phase} ${evt.loaded}/${evt.total}` });
+				}
+			});
+		} catch (error) {
+			// The directory is the app's own, picked so it did not exist before
+			// (findAvailableDirName), and a half-written clone in it would be
+			// adopted as a site by the next "Add a site" (#180's other half).
+			await removeTree(siteDir).catch((e) => logError('wordpress:setup', `removing the failed clone: ${String(e && e.message ? e.message : e)}`));
+			throw error;
+		} finally {
+			runningClones.delete(siteDir);
+		}
 		await ensureLocalExcludes(siteDir);
 
 		const s = await getStore();
@@ -1969,7 +1978,7 @@ ipcMain.handle('sites:delete', async (_e, sitePath) => {
 	const allowed = await deleteRegisteredSite(sitePath, {
 		sites: s.get('sites'),
 		// A site whose clone is still running is refused outright, registered or
-		// not: `remove` would be deleting a tree isomorphic-git is writing into.
+		// not: `remove` would be deleting a tree the clone is still writing into.
 		pending: setupTracker.paths(),
 		forget: () => {
 			s.set('sites', s.get('sites').filter((p) => p !== sitePath));
diff --git a/src/remove-tree.js b/src/remove-tree.js
index 63b58d43..a5f8cfb1 100644
--- a/src/remove-tree.js
+++ b/src/remove-tree.js
@@ -11,10 +11,11 @@
 // spike hit EPERM on every packaged Windows run; the CI suite proves the
 // POSIX half.
 //
-// Today the app mostly gets away with plain removal because isomorphic-git
-// sets no attribute. Any real Git writing into a checkout changes that — a
-// mentor making a commit with their own tools does — and `sites:delete`
-// swallowed whatever went wrong besides (#381).
+// Sites the old engine made got away with plain removal because isomorphic-git
+// sets no attribute. Since #385 the app's own clone is a real Git, so every new
+// site carries read-only objects from the first minute, the same as a mentor
+// making a commit with their own tools — and `sites:delete` used to swallow
+// whatever went wrong besides (#381).
 //
 // The shape: try the cheap removal first, and only when it fails with a
 // permission error walk whatever survived, restore the write bit, and remove
diff --git a/src/setup-tracker.js b/src/setup-tracker.js
index 5cd8ed80..c77ab3be 100644
--- a/src/setup-tracker.js
+++ b/src/setup-tracker.js
@@ -13,7 +13,7 @@
 // unregister-on-failure path cannot catch — a phantom site for a directory that
 // was never finished, which is the thing AGENTS.md's architecture rules single
 // out. It would also widen the allow-list for the recursive delete in
-// `sites:delete` to include a tree isomorphic-git is writing into.
+// `sites:delete` to include a tree the clone is still writing into.
 //
 // So this is the other half of the boundary, and the distinction it draws is
 // **liveness against truth**. The store answers "which sites exist"; this
diff --git a/tests/unit/git-clone.integration.test.cjs b/tests/unit/git-clone.integration.test.cjs
new file mode 100644
index 00000000..f9570028
--- /dev/null
+++ b/tests/unit/git-clone.integration.test.cjs
@@ -0,0 +1,79 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+
+const { cloneSite } = require('../../src/git-clone.cjs');
+const { git, tempDir } = require('./helpers/git.cjs');
+
+// A real clone by the bundled Git, from a local repository over `file://`
+// (a transport isomorphic-git never had, which is why the trunk-update suite
+// still carries a loopback HTTP server). Offline; the partial-clone filter
+// needs the source to allow it, which GitHub does and this fixture opts into.
+
+function makeSource(t) {
+	const src = tempDir(t, 'toolkit-clone-src-');
+	assert.equal(git(['init', '-q', '-b', 'trunk'], src).status, 0);
+	const commit = (msg) => assert.equal(git(['-c', 'user.name=T', '-c', 'user.email=t@example.com', 'commit', '-q', '-am', msg], src).status, 0);
+	fs.mkdirSync(path.join(src, 'src'));
+	fs.writeFileSync(path.join(src, 'src', 'wp-login.php'), '<?php // one\n');
+	assert.equal(git(['add', '.'], src).status, 0);
+	commit('one');
+	fs.writeFileSync(path.join(src, 'src', 'wp-login.php'), '<?php // two\n');
+	commit('two');
+	assert.equal(git(['config', 'uploadpack.allowFilter', 'true'], src).status, 0);
+	return src;
+}
+
+test('a site is cloned partial, on trunk, with the config the app relies on, and reports progress', async (t) => {
+	const src = makeSource(t);
+	const parent = tempDir(t, 'toolkit clone dest-');
+	const dir = path.join(parent, 'wp site');
+	const events = [];
+	let child = null;
+
+	const result = await cloneSite({ url: pathToFileURL(src).href, dir, onProgress: (e) => events.push(e), onChild: (c) => { child = c; } });
+	assert.equal(result.dir, dir);
+	assert.ok(child && typeof child.pid === 'number', 'the child was handed out for the quit sweep');
+
+	// The checkout is trunk at its tip, with the whole history and no shallow
+	// boundary, and the blob of the older commit was not fetched.
+	assert.equal(fs.readFileSync(path.join(dir, 'src', 'wp-login.php'), 'utf8'), '<?php // two\n');
+	assert.equal(git(['symbolic-ref', '--short', 'HEAD'], dir).stdout, 'trunk');
+	assert.equal(git(['rev-parse', '--is-shallow-repository'], dir).stdout, 'false');
+	assert.equal(git(['rev-list', '--count', 'HEAD'], dir).stdout, '2');
+	const missing = git(['rev-list', '--objects', '--missing=print', 'HEAD'], dir).stdout.split('\n').filter((l) => l.startsWith('?'));
+	assert.equal(missing.length, 1, 'exactly the older blob is left on the server');
+
+	const config = git(['config', '--local', '--list'], dir).stdout.split('\n');
+	for (const expected of ['core.autocrlf=false', 'core.symlinks=false', 'remote.origin.promisor=true', 'remote.origin.partialclonefilter=blob:none']) {
+		assert.ok(config.includes(expected), `${expected} missing from:\n${config.join('\n')}`);
+	}
+	if (process.platform === 'win32') assert.ok(config.includes('core.longpaths=true'));
+
+	// Progress came through as phases with counts; a local clone is quick, so
+	// only the shape is asserted, not which phases showed up.
+	assert.ok(events.length > 0, 'no progress events');
+	for (const e of events) {
+		assert.match(e.phase, /^[a-z ]+$/);
+		assert.ok(Number.isInteger(e.loaded) && Number.isInteger(e.total) && e.total >= e.loaded);
+	}
+});
+
+test('a clone that cannot start its transport rejects with Git\'s reason, and says nothing about progress', async (t) => {
+	const parent = tempDir(t, 'toolkit-clone-fail-');
+	const dir = path.join(parent, 'site');
+	const events = [];
+	await assert.rejects(
+		cloneSite({ url: pathToFileURL(path.join(parent, 'no-such-repo')).href, dir, onProgress: (e) => events.push(e) }),
+		(error) => {
+			assert.equal(error.name, 'GitError');
+			assert.equal(error.code, 128);
+			assert.match(error.message, /^git clone failed \(128\): fatal:/);
+			assert.ok(error.stderr.length > 0);
+			return true;
+		}
+	);
+	assert.deepEqual(events, []);
+});
diff --git a/tests/unit/git-clone.test.cjs b/tests/unit/git-clone.test.cjs
new file mode 100644
index 00000000..9c04eaff
--- /dev/null
+++ b/tests/unit/git-clone.test.cjs
@@ -0,0 +1,61 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const { cloneArgs, parseProgressLines, createProgressReader } = require('../../src/git-clone.cjs');
+
+// The argument list and the progress reader, without a Git. The clone itself
+// runs in git-clone.integration.test.cjs.
+
+test('the clone is partial, single-branch on trunk, and writes the repository config it relies on', () => {
+	const args = cloneArgs({ url: 'https://example.test/wp.git', dir: '/sites/wp', platform: 'darwin' });
+	assert.equal(args[0], 'clone');
+	assert.ok(args.includes('--filter=blob:none'), 'partial clone');
+	assert.ok(!args.some((a) => a.startsWith('--depth')), 'not shallow');
+	assert.ok(args.includes('--single-branch'));
+	assert.deepEqual(args.slice(args.indexOf('--branch'), args.indexOf('--branch') + 2), ['--branch', 'trunk']);
+	assert.ok(args.includes('--progress'));
+	const configs = args.filter((a, i) => args[i - 1] === '--config');
+	assert.deepEqual(configs, ['core.autocrlf=false', 'core.symlinks=false']);
+	// `--` before the url: a url or a directory starting with `-` is data.
+	assert.deepEqual(args.slice(-3), ['--', 'https://example.test/wp.git', '/sites/wp']);
+});
+
+test('Windows also gets long paths, which wordpress-develop needs', () => {
+	const args = cloneArgs({ url: 'u', dir: 'C:\\Sites\\wp', platform: 'win32' });
+	assert.ok(args.includes('core.longpaths=true'));
+	assert.ok(!cloneArgs({ url: 'u', dir: '/s', platform: 'linux' }).includes('core.longpaths=true'));
+});
+
+test('progress lines parse with and without the remote: prefix, and other lines are dropped', () => {
+	const text = [
+		"Cloning into '/sites/wp'...",
+		'remote: Enumerating objects: 4, done.        ',
+		'remote: Counting objects:  25% (1/4)        \rremote: Counting objects: 100% (4/4), done.        ',
+		'Receiving objects:  42% (1234/5678), 12.00 MiB | 3.00 MiB/s',
+		'Resolving deltas: 100% (10/10), done.',
+		'Updating files:  50% (100/200)',
+		'warning: something unrelated'
+	].join('\n');
+	assert.deepEqual(parseProgressLines(text), [
+		{ phase: 'counting objects', percent: 25, loaded: 1, total: 4 },
+		{ phase: 'counting objects', percent: 100, loaded: 4, total: 4 },
+		{ phase: 'receiving objects', percent: 42, loaded: 1234, total: 5678 },
+		{ phase: 'resolving deltas', percent: 100, loaded: 10, total: 10 },
+		{ phase: 'updating files', percent: 50, loaded: 100, total: 200 }
+	]);
+});
+
+test('a percentage split across two chunks is reported once, whole', () => {
+	const seen = [];
+	const reader = createProgressReader((e) => seen.push(e));
+	reader.push('Receiving objects:  4');
+	assert.deepEqual(seen, [], 'nothing until the line ends');
+	reader.push('2% (1234/5678)\rReceiving objects:  5');
+	assert.deepEqual(seen, [{ phase: 'receiving objects', percent: 42, loaded: 1234, total: 5678 }]);
+	reader.push('0% (2900/5678)\n');
+	assert.equal(seen.length, 2);
+	assert.equal(seen[1].percent, 50);
+	reader.push('Updating files: 100% (200/200)');
+	reader.flush();
+	assert.equal(seen[2].phase, 'updating files');
+});
diff --git a/tests/unit/ipc-wiring.test.cjs b/tests/unit/ipc-wiring.test.cjs
index 49bcbc13..77e3a172 100644
--- a/tests/unit/ipc-wiring.test.cjs
+++ b/tests/unit/ipc-wiring.test.cjs
@@ -3538,9 +3538,9 @@ test('dir:show refuses a path the registry does not hold, and logs it', async ()
 // --- creating a site, and opening it while it is still being created -----
 //
 // This handler was listed as NOT_REACHABLE, on the grounds that it clones
-// wordpress-develop over the network. It does not have to: `resolveStubs`
-// resolves bare packages through `require.resolve`, so `isomorphic-git` is
-// stubbable like any other module and the whole handler runs offline. That
+// wordpress-develop over the network. It does not have to: the clone lives in
+// its own module (git-clone.cjs, #385), so `cloneSite` is stubbable like any
+// other and the whole handler runs offline. That
 // matters here beyond coverage — #180 is a bug about *when* things are true
 // during the clone, and only a test that can be inside the clone can see it.
 
@@ -3564,8 +3564,8 @@ async function runSetup({ duringClone, cloneFails = false, existing = [], extraS
 		stubs: {
 			...silentLogging(),
 			...settings.stubs,
-			'isomorphic-git': { clone },
-			'./trunk-update': { ensureAutocrlf: async () => {}, readTrunkInfo: async () => ({ trunkOid: 'abc', trunkDate: '2026-01-01' }) },
+			'./git-clone.cjs': { cloneSite: clone },
+			'./trunk-update': { readTrunkInfo: async () => ({ trunkOid: 'abc', trunkDate: '2026-01-01' }) },
 			...extraStubs
 		}
 	});

From 981565da55c9d869a10f53a17484dbcc3ff93324 Mon Sep 17 00:00:00 2001
From: JuanMa <juanma.garrido@gmail.com>
Date: Mon, 7 Sep 2026 15:22:23 +0200
Subject: [PATCH 2/2] Answer the self-review on the clone swap

Findings from the judgement pass, all verified against the code.

The trunk update re-shallowed the new clone. `updateToLatestTrunk` asked
for `depth: 1` unconditionally, and isomorphic-git applies the server's
`shallow <newTip>` line before the packfile is written, fails to read the
tip it was just told about and records the boundary anyway: the first
update a contributor ran threw away the history the partial clone had
just paid for, and with it the merge base every pull request needs
(#351). The depth now follows the repository, which answers the question
itself through `.git/shallow`: sites the old engine made stay shallow
and cost nothing more, sites the binary made keep their history. The
fetch fixture had been serving a truncated pack whatever the client
asked for, and its origin had no history behind the tip, so neither half
of the difference was visible; both are fixed, and the new test fails on
the old code.

Progress no longer reaches a destroyed window. The clone reports from a
stderr listener rather than from the awaited chain the old engine used,
and on macOS a closed window leaves the app and the clone running, so a
send into the dead webContents was an uncaught exception in the main
process rather than a rejected invoke. Every send in the handler goes
through one guarded `notify`; the clone still finishes and still
registers the site with nobody listening.

The failed-clone test asserted the store and the tracker but never that
the half-written directory was gone, so deleting the removal kept the
suite green. It writes into the directory before failing now, and the
removal is what the test pins.

`LC_ALL=C` is pinned with the rest of the environment. Git's progress
phases and its `fatal:` line are the one non-porcelain output the app
parses, Git for Windows ships the gettext translations, and a non-Latin
locale meant a contributor watched a several-minute clone with no
progress at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bqghuMjo6GQFEdRrZtNJS
---
 src/git-binary.cjs                            | 13 ++-
 src/main.js                                   | 18 +++-
 src/trunk-update.js                           | 33 +++++++-
 tests/unit/git-binary.test.cjs                |  9 ++
 tests/unit/ipc-wiring.test.cjs                | 33 +++++++-
 .../trunk-update-fetch.integration.test.cjs   | 82 +++++++++++++++----
 6 files changed, 163 insertions(+), 25 deletions(-)

diff --git a/src/git-binary.cjs b/src/git-binary.cjs
index 030ad188..cdbaff8b 100644
--- a/src/git-binary.cjs
+++ b/src/git-binary.cjs
@@ -77,7 +77,18 @@ const PINNED_ENV = Object.freeze({
 	// /dev/null as "no file" for this variable, and Git for Windows maps the
 	// name itself, so the literal works on every platform.
 	GIT_CONFIG_GLOBAL: '/dev/null',
-	GIT_TERMINAL_PROMPT: '0'
+	GIT_TERMINAL_PROMPT: '0',
+	// Git's human-facing output is translated through gettext, and Git for
+	// Windows ships the translations (the macOS dugite payload has none, so
+	// nothing here or in CI would ever show it). The one place the app reads
+	// that output is the clone's progress and its `fatal:` line
+	// (git-clone.cjs); on a localised Windows the phase names come back
+	// translated, and a non-Latin locale means the contributor watches a
+	// several-minute clone with no progress at all. `C` is the untranslated
+	// locale, and it also pins the number formatting the parsers assume.
+	// LANGUAGE, which would otherwise outrank it, is ignored by gettext once
+	// the locale is C.
+	LC_ALL: 'C'
 });
 
 // Arguments every Git call site puts before its own. `credential.helper` is
diff --git a/src/main.js b/src/main.js
index b2e9b6b9..5c33d4ae 100644
--- a/src/main.js
+++ b/src/main.js
@@ -1906,8 +1906,20 @@ ipcMain.handle('wordpress:setup', async (event, destDir, options = {}) => {
 	// guards refuse to open it for the whole clone (#180), and `sites:delete`
 	// would happily remove it if they did not. setup-tracker.js has the why;
 	// `track` releases the entry however this ends.
+	// The clone outlives the window that asked for it: on macOS closing it does
+	// not quit the app (`window-all-changed` only quits elsewhere), and the
+	// child keeps running until the quit sweep. Progress now arrives on a
+	// stderr listener rather than inside the awaited chain the old engine used,
+	// so a send into a destroyed webContents would throw "Object has been
+	// destroyed" straight into the stream — an uncaught exception in the main
+	// process rather than a rejected `invoke`. The clone still has to finish or
+	// clean up after itself, so the report is what is dropped, not the work.
+	const notify = (channel, payload) => {
+		if (!event.sender.isDestroyed()) event.sender.send(channel, payload);
+	};
+
 	return setupTracker.track(siteDir, async () => {
-		event.sender.send('download:status', { phase: 'cloning', target: siteDir });
+		notify('download:status', { phase: 'cloning', target: siteDir });
 		try {
 			await cloneSite({
 				url: WORDPRESS_GIT_URL,
@@ -1916,7 +1928,7 @@ ipcMain.handle('wordpress:setup', async (event, destDir, options = {}) => {
 				onProgress: (evt) => {
 					// Same line the old engine produced, so the terminal panel reads
 					// the same: `<phase> <loaded>/<total>`.
-					event.sender.send('download:progress', { target: siteDir, message: `${evt.phase} ${evt.loaded}/${evt.total}` });
+					notify('download:progress', { target: siteDir, message: `${evt.phase} ${evt.loaded}/${evt.total}` });
 				}
 			});
 		} catch (error) {
@@ -1953,7 +1965,7 @@ ipcMain.handle('wordpress:setup', async (event, destDir, options = {}) => {
 			} catch {}
 			s.set('siteMeta', meta);
 		}
-		event.sender.send('download:status', { phase: 'done', target: siteDir, sitePath: siteDir });
+		notify('download:status', { phase: 'done', target: siteDir, sitePath: siteDir });
 		return siteDir;
 	});
 });
diff --git a/src/trunk-update.js b/src/trunk-update.js
index c73837b4..ebcb4ef0 100644
--- a/src/trunk-update.js
+++ b/src/trunk-update.js
@@ -23,6 +23,31 @@ const {
 } = require('./git-update.cjs');
 const { readCommitInfo, resolveRef, statusRows, readBlobs, blobOid } = require('./git-read.cjs');
 
+/**
+ * What `depth` the trunk fetch may ask for, which is not the same answer for
+ * every site any more (#385). A site the old engine created is shallow at
+ * depth 1, and a depth-1 re-fetch is what keeps it that way — dropping it
+ * would pull the whole of wordpress-develop's history on every update. A site
+ * the bundled Git created is a partial clone: it has the full commit history
+ * and no `.git/shallow`, and asking for depth 1 there would *make* it
+ * shallow, because isomorphic-git applies the server's `shallow <newTip>`
+ * lines before the packfile is written, fails to read the tip it was just
+ * told about, and records the shallow boundary anyway. That would cut off at
+ * the first update the history the clone paid 57 MB for, and with it the
+ * merge base every pull request needs (#351).
+ *
+ * `.git/shallow` is Git's own marker for the first kind, written by the
+ * shallow clone and removed when a repository is unshallowed, so the
+ * repository answers the question itself.
+ *
+ * @param {string}    dir
+ * @param {typeof fs} [fileSystem]
+ * @return {{depth?: number}} Spread into the fetch options.
+ */
+function fetchDepth(dir, fileSystem = fs) {
+	return fileSystem.existsSync(path.join(dir, '.git', 'shallow')) ? { depth: 1 } : {};
+}
+
 /**
  * Give isomorphic-git a Windows-only, in-memory view of core.autocrlf=true
  * when the repository has no explicit local value. Native Git may have
@@ -252,8 +277,9 @@ async function discardToBase(dir, baseOid) {
  * "the working tree was reset" would discard state — an applied patch's record
  * — over a failure that touched no file.
  *
- * Shallow-clone safe: a depth-1 re-fetch negotiates a new shallow tip, and
- * the forced checkout resets tracked files while untracked ones survive.
+ * The fetch depth follows the repository rather than being fixed: see
+ * `fetchDepth`. Either way the forced checkout resets tracked files while
+ * untracked ones survive.
  *
  * @param {Object}   root0
  * @param {string}   root0.dir
@@ -271,7 +297,7 @@ async function updateToLatestTrunk({ dir, url, onLog = () => {} }) {
 			fs: gitFs, http, dir, url,
 			ref: 'trunk',
 			singleBranch: true,
-			depth: 1,
+			...fetchDepth(dir),
 			tags: false,
 			onProgress: (evt) => onLog(`${evt.phase || 'fetch'} ${evt.loaded || 0}/${evt.total || 0}\r`)
 		});
@@ -326,6 +352,7 @@ async function updateToLatestTrunk({ dir, url, onLog = () => {} }) {
 module.exports = {
 	ensureAutocrlf,
 	createCrlfCompatibleFs,
+	fetchDepth,
 	readTrunkInfo,
 	collectDirtyFiles,
 	discardChanges,
diff --git a/tests/unit/git-binary.test.cjs b/tests/unit/git-binary.test.cjs
index 39c3ccb5..dc65dcdc 100644
--- a/tests/unit/git-binary.test.cjs
+++ b/tests/unit/git-binary.test.cjs
@@ -61,6 +61,15 @@ test('a host that points at its own Git through the real process env still gets
 	}
 });
 
+// The locale the app reads Git's own words in. Git for Windows ships the
+// gettext translations, so a contributor on a localised machine would get
+// translated progress phases and a translated `fatal:` line — the two things
+// git-clone.cjs parses, with no porcelain form to fall back on.
+test('the environment pins the locale, so Git speaks the language the parsers read', () => {
+	const env = buildGitEnv({ baseEnv: { HOME: '/home/mentor', LANG: 'ja_JP.UTF-8', LANGUAGE: 'ja', LC_ALL: 'ja_JP.UTF-8' } });
+	assert.equal(env.LC_ALL, 'C');
+});
+
 test('the environment pins host config off and prompting off', () => {
 	const env = buildGitEnv({ baseEnv: { HOME: '/home/contributor', PATH: '/usr/bin' } });
 	assert.equal(env.GIT_CONFIG_NOSYSTEM, '1');
diff --git a/tests/unit/ipc-wiring.test.cjs b/tests/unit/ipc-wiring.test.cjs
index 77e3a172..c9d5fe98 100644
--- a/tests/unit/ipc-wiring.test.cjs
+++ b/tests/unit/ipc-wiring.test.cjs
@@ -3547,7 +3547,7 @@ test('dir:show refuses a path the registry does not hold, and logs it', async ()
 // Runs `wordpress:setup` with a stubbed clone, and calls `duringClone` at the
 // moment the real clone would be running: the directory exists, nothing is in
 // the store yet. `clone` can be made to fail instead.
-async function runSetup({ duringClone, cloneFails = false, existing = [], extraStubs = {} } = {}) {
+async function runSetup({ duringClone, cloneFails = false, existing = [], extraStubs = {}, senderDestroyed = false } = {}) {
 	const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ipc-wiring-setup-'));
 	for (const name of existing) fs.mkdirSync(path.join(root, name));
 
@@ -3555,9 +3555,16 @@ async function runSetup({ duringClone, cloneFails = false, existing = [], extraS
 	const seen = [];
 	let inside;
 
-	const clone = async ({ dir }) => {
+	const clone = async ({ dir, onProgress }) => {
+		// The real clone reports progress from a stderr listener, and writes
+		// into the directory before it can fail: both are what the handler
+		// around it has to survive.
+		if (onProgress) onProgress({ phase: 'Receiving objects', percent: 42, loaded: 42, total: 100 });
 		if (duringClone) inside = await duringClone({ dir, root, main, settings });
-		if (cloneFails) throw new Error('clone failed');
+		if (cloneFails) {
+			fs.writeFileSync(path.join(dir, 'half-written'), 'partial\n');
+			throw new Error('clone failed');
+		}
 	};
 
 	const main = loadMain({
@@ -3571,6 +3578,10 @@ async function runSetup({ duringClone, cloneFails = false, existing = [], extraS
 	});
 
 	const event = createIpcEvent();
+	if (senderDestroyed) {
+		event.sender.isDestroyed = () => true;
+		event.sender.send = () => { throw new Error('Object has been destroyed'); };
+	}
 	const settled = await main.invokeWith('wordpress:setup', event, root, { siteName: 'demo', siteLabel: 'Demo' })
 		.then((siteDir) => ({ siteDir }), (error) => ({ error }));
 
@@ -3617,11 +3628,27 @@ test('a clone that fails leaves nothing registered and nothing in flight', async
 	assert.match(String(error), /clone failed/);
 	assert.deepEqual(settings.values.sites, []);
 	assert.deepEqual(settings.values.siteMeta, {});
+	// And nothing is left on disk either: the handler creates the directory
+	// before the clone starts and the clone writes into it, so without the
+	// removal the next "Add a site" would adopt a half-written repository
+	// (#180's other half). Drop the catch and this is the assertion that fails.
+	assert.equal(fs.existsSync(path.join(root, 'demo')), false, 'the half-written clone is removed');
 	// The entry is released however the setup ends, so the path is refused again
 	// rather than staying openable — and, more importantly, staying undeletable.
 	assert.equal((await main.invoke('dir:show', path.join(root, 'demo'))).ok, false);
 });
 
+// Closing the window does not quit the app on macOS, and the clone runs on
+// past it. Progress arrives on a stderr listener now, outside any promise
+// chain, so a send into the dead webContents is an uncaught exception in the
+// main process rather than a rejected invoke.
+test('a window closed while the clone runs does not take the setup down with it', async () => {
+	const { root, settings, siteDir } = await runSetup({ senderDestroyed: true });
+
+	assert.equal(siteDir, path.join(root, 'demo'));
+	assert.deepEqual(settings.values.sites, [siteDir], 'the site is registered even with nobody listening');
+});
+
 test('a name already taken on disk is the one that opens, from the first moment', async () => {
 	const { root, inside, siteDir } = await runSetup({
 		existing: ['demo'],
diff --git a/tests/unit/trunk-update-fetch.integration.test.cjs b/tests/unit/trunk-update-fetch.integration.test.cjs
index b7d289cd..ecd9a673 100644
--- a/tests/unit/trunk-update-fetch.integration.test.cjs
+++ b/tests/unit/trunk-update-fetch.integration.test.cjs
@@ -54,11 +54,12 @@ function parsePktLines(buffer) {
 	return lines;
 }
 
-// Everything reachable from a commit without following its parents — exactly
-// the object set a depth-1 fetch is entitled to.
-async function objectsAtDepthOne(gitdir, oid) {
-	const oids = new Set([oid]);
-	const { commit } = await git.readCommit({ fs, gitdir, oid });
+// The object set the request is entitled to: the tip's own tree when the
+// client sent `deepen 1`, the whole reachable history when it asked for no
+// depth. Serving the truncated set either way would hide the difference the
+// depth decision makes, which is the thing under test.
+async function reachableObjects(gitdir, oid, { depthOne }) {
+	const oids = new Set();
 	const walkTree = async (treeOid) => {
 		oids.add(treeOid);
 		const { tree } = await git.readTree({ fs, gitdir, oid: treeOid });
@@ -67,8 +68,22 @@ async function objectsAtDepthOne(gitdir, oid) {
 			else oids.add(entry.oid);
 		}
 	};
-	await walkTree(commit.tree);
-	return { oids: [...oids], hasParents: (commit.parent || []).length > 0 };
+
+	let hasParents = false;
+	const queue = [oid];
+	const seen = new Set();
+	while (queue.length) {
+		const commitOid = queue.shift();
+		if (seen.has(commitOid)) continue;
+		seen.add(commitOid);
+		oids.add(commitOid);
+		const { commit } = await git.readCommit({ fs, gitdir, oid: commitOid });
+		await walkTree(commit.tree);
+		const parents = commit.parent || [];
+		if (commitOid === oid) hasParents = parents.length > 0;
+		if (!depthOne) queue.push(...parents);
+	}
+	return { oids: [...oids], hasParents };
 }
 
 async function serveRepo(t, gitdir) {
@@ -109,12 +124,14 @@ async function serveRepo(t, gitdir) {
 				res.end('no want line');
 				return;
 			}
-			const { oids, hasParents } = await objectsAtDepthOne(gitdir, want);
+			const depthOne = lines.some((l) => l.startsWith('deepen '));
+			const { oids, hasParents } = await reachableObjects(gitdir, want, { depthOne });
 			const { packfile } = await git.packObjects({ fs, gitdir, oids, write: false });
 			const out = [];
 			// A truncated history is announced before the ack; a root commit
-			// has nothing to truncate, so real servers stay quiet there too.
-			if (hasParents) out.push(pktLine(`shallow ${want}\n`));
+			// has nothing to truncate, and a client that asked for no depth is
+			// not being truncated, so real servers stay quiet in both cases.
+			if (depthOne && hasParents) out.push(pktLine(`shallow ${want}\n`));
 			out.push(FLUSH, pktLine('NAK\n'));
 			// Band 1 is packfile data.
 			for (let i = 0; i < packfile.length; i += 8192) {
@@ -150,23 +167,29 @@ async function commitInOrigin(origin, files, message) {
 	return git.commit({ fs, dir: origin, message, author: AUTHOR });
 }
 
-// An origin repo with one commit, served over HTTP, and a site shallow-cloned
-// from it — the state a real site is in after setup.
-async function makeSiteAndOrigin(t) {
+// An origin repo with a history behind its tip, served over HTTP, and a site
+// cloned from it — the state a real site is in after setup, shallow for the
+// sites the old engine made and complete for the ones the bundled Git makes.
+//
+// The history matters: a shallow clone of a repository whose tip is the root
+// commit has nothing to truncate, so no `.git/shallow` is written and the
+// fixture would not be the shallow site it claims to be.
+async function makeSiteAndOrigin(t, { shallow = true } = {}) {
 	const root = fs.mkdtempSync(path.join(os.tmpdir(), 'trunk-update-fetch-test-'));
 	t.after(() => fs.rmSync(root, { recursive: true, force: true }));
 
 	const origin = path.join(root, 'origin');
 	fs.mkdirSync(origin);
 	await git.init({ fs, dir: origin, defaultBranch: 'trunk' });
+	const baseOid = await commitInOrigin(origin, { 'readme.txt': 'base\n' }, 'base');
 	await commitInOrigin(origin, { 'wp-config.php': 'first\n', 'package-lock.json': '{"lockfileVersion":1}\n' }, 'first');
 
 	const { url, uploadPackRequests } = await serveRepo(t, path.join(origin, '.git'));
 	const dir = path.join(root, 'site');
-	await git.clone({ fs, http: gitHttp, dir, url, ref: 'trunk', singleBranch: true, depth: 1, noTags: true });
+	await git.clone({ fs, http: gitHttp, dir, url, ref: 'trunk', singleBranch: true, ...(shallow ? { depth: 1 } : {}), noTags: true });
 	uploadPackRequests.length = 0; // the clone's request is not under test
 
-	return { origin, dir, url, uploadPackRequests };
+	return { origin, dir, url, uploadPackRequests, baseOid };
 }
 
 // --- tests -----------------------------------------------------------------
@@ -193,6 +216,35 @@ test('updateToLatestTrunk: fetches the new trunk commit and resets the worktree
 	assert.strictEqual(result.trunkDate, new Date(commit.committer.timestamp * 1000).toISOString());
 });
 
+// The other half of the same decision, and the reason it cannot stay a
+// constant (#385). A site the bundled Git cloned is partial, not shallow: it
+// has the whole commit history, which is what gives every pull request a
+// merge base (#351). Ask for `deepen 1` there and isomorphic-git applies the
+// server's `shallow <newTip>` line before the packfile is written, fails to
+// read the tip it was just told about, and records the boundary anyway — so
+// the first update a contributor runs throws away the history the clone paid
+// for. On the old code this test fails on both assertions below.
+test('updateToLatestTrunk: a site with full history is not made shallow by the update (issue #385)', async (t) => {
+	const { origin, dir, url, uploadPackRequests, baseOid } = await makeSiteAndOrigin(t, { shallow: false });
+	const firstOid = await git.resolveRef({ fs, dir, ref: 'HEAD' });
+	const secondOid = await commitInOrigin(origin, { 'wp-config.php': 'second\n' }, 'second');
+	const thirdOid = await commitInOrigin(origin, { 'wp-config.php': 'third\n' }, 'third');
+
+	const result = await updateToLatestTrunk({ dir, url });
+
+	assert.deepStrictEqual(uploadPackRequests.map((lines) => lines.filter((l) => l.startsWith('deepen '))), [[]],
+		'no depth is negotiated for a repository that is not shallow');
+	assert.strictEqual(fs.existsSync(path.join(dir, '.git', 'shallow')), false,
+		'and no shallow boundary is written');
+
+	assert.strictEqual(result.newOid, thirdOid);
+	assert.strictEqual(fs.readFileSync(path.join(dir, 'wp-config.php'), 'utf8'), 'third\n');
+	// The history is still walkable, which is the whole point of the partial
+	// clone: the commit the site started on is reachable from the new tip.
+	const log = await git.log({ fs, dir, ref: 'HEAD' });
+	assert.deepStrictEqual(log.map((entry) => entry.oid), [thirdOid, secondOid, firstOid, baseOid]);
+});
+
 test('updateToLatestTrunk: reports upToDate when the remote trunk has not moved (issue #147)', async (t) => {
 	const { dir, url } = await makeSiteAndOrigin(t);
 	const oid = await git.resolveRef({ fs, dir, ref: 'HEAD' });