@bevel-software/platform-core-backend 0.21.0 → 0.22.0

package/src/modules/workflow/agent-tools/workflow.tools.ts

@@ -5,6 +5,7 @@ import { toolDef, withBranchInput } from '../../tool-helpers/tool-def.js';
 import type { ToolHandlerFactory } from '../../tool-helpers/tool-handler.js';
 import { requireInternalSource } from '../../tool-auth/tool-auth.middleware.js';
 import type { KbContext } from '../../../shared/kb-context.js';
+import { assertBranchProvided } from '../../../shared/domain-errors.js';
 import { workspaceIdForBranch } from '../../../shared/workspace-id.js';
 import { assertInsideRepo, normalizePathArgs } from '../../kb-fs/repo-path.js';
 import { RETIRED_TOOL_MESSAGES } from '@bevel-software/platform-mcp-core';
@@ -144,16 +145,30 @@ export function registerWorkflowTools(
     write: boolean;
     /** Register on the internal catalog only (e.g. agent-control tools that make no sense to a remote caller). */
     internalOnly?: boolean;
-    /** Skip the auto-injected `branch` input — for a tool that already declares its own `branch` (switch_branch). */
+    /**
+     * Skip the auto-injected `branch` input — for a tool that declares its own
+     * `branch` with its own meaning (`create_branch`'s fork base,
+     * `switch_branch`'s target draft) or none at all (`merge_branch`,
+     * `open_change_request`, the repo-global reads). It says NOTHING about
+     * whether the tool requires a branch: that is read off the declared schema
+     * below, because reading it off this flag is what let `create_branch` opt
+     * out of the check while still demanding the input.
+     */
     skipBranch?: boolean;
     handler: ToolHandler;
   }): void => {
     const path = `/api/agent/tools/${spec.name}`;
+    const inputs = spec.skipBranch ? spec.inputs : withBranchInput(spec.inputs);
+    // The tool's OWN declaration is the only honest answer to "must this call
+    // name a branch": the injected input and a hand-declared one (the fork
+    // base, the draft to switch to) are equally required, and a tool that adds
+    // or drops the input later moves this with it.
+    const requiresBranch = ((inputs as { required?: string[] }).required ?? []).includes('branch');
     const def = toolDef({
       name: spec.name,
       description: spec.description,
       path,
-      inputs: spec.skipBranch ? spec.inputs : withBranchInput(spec.inputs),
+      inputs,
       outputs: spec.outputs,
       tags: spec.write ? ['workflow', 'write'] : ['workflow'],
     });
@@ -171,7 +186,27 @@ export function registerWorkflowTools(
       // normaliser: the root-anchored `/<kbDirName>/…` form names the same
       // workspace path, and a path with no prefix is placed under
       // `<kbDirName>/` rather than refused.
-      toolHandler((args, ctx) => spec.handler(normalizePathArgs(args, kbDirName), ctx), { write: spec.write }),
+      toolHandler(
+        (args, ctx) => {
+          // These tools hand `branch` STRAIGHT to `workspaceIdForBranch` —
+          // they address a workspace by id rather than going through
+          // `getFilesystem`, so the choke point that guards the file tools
+          // never sees them. Without this, a branch-less `commit_change`
+          // commits to a workspace id literally named "undefined", and a
+          // branch-less `create_branch` forks from one: it clones a branch of
+          // that name, fails, and answers `There is no branch named undefined.`
+          //
+          // Keyed on whether the SCHEMA requires `branch`, not on whether the
+          // input was injected. `create_branch` and `switch_branch` declare
+          // their own required `branch`; a check keyed on the injection skipped
+          // exactly those two, which is how the reported bug survived on
+          // `create_branch` — the one tool whose `branch` is a branch the
+          // caller must already have.
+          if (requiresBranch) assertBranchProvided(args.branch);
+          return spec.handler(normalizePathArgs(args, kbDirName), ctx);
+        },
+        { write: spec.write },
+      ),
     );
   };
 
@@ -330,6 +365,17 @@ export function registerWorkflowTools(
     handler: async (args, ctx: ToolContext) => {
       const name = args.name as string;
       const base = args.branch as string;
+      // `name` is declared required too, and the same-name refusal below quotes
+      // it. With nothing enforcing it, a call that named neither input compared
+      // undefined to undefined, matched, and answered "not 'undefined', the
+      // draft being created" — an absent value presented as a draft name, the
+      // very sentence this ticket exists to stop. Refused by name instead,
+      // without echoing what was not sent.
+      if (typeof name !== 'string' || name.length === 0) {
+        throw new ToolError('`name` is required: pass the name of the draft to create.', 400, {
+          kind: 'name-required',
+        });
+      }
       // The git op runs in the base's workspace, whose clone has the base
       // checked out — the new draft forks from its HEAD. Resolving a workspace
       // lazily clones its branch from origin, so a `branch` naming the

package/src/modules/workflow/git/__tests__/git.service.pull.test.ts

@@ -353,3 +353,124 @@ describe('GitService.pull', () => {
     await expect(svc.hasUnpushedCommits(workspaceId)).resolves.toBe(false);
   });
 });
+
+/**
+ * `preserveMerges` — why an unpushed MERGE must survive the pull's rebase.
+ *
+ * The change-request Update merges the target into the proposal branch and
+ * pushes. When that push fails, the merge sits in the clone, and the NEXT
+ * update pulls first. A plain `git rebase` replays `--no-merges
+ * upstream..HEAD`, which turns that merge commit into cherry-picks of the
+ * commits it merged: the target stops being a parent, so the branch never
+ * contains the target's head however many times the update runs, and the
+ * request stays behind for good.
+ */
+describe('GitService.pull — an unpushed merge commit', () => {
+  let root: string;
+  const workspaceId = 'alice%2Fdeal';
+
+  beforeEach(async () => {
+    root = await fs.mkdtemp(path.join(os.tmpdir(), 'bevel-git-pull-merges-'));
+  });
+
+  afterEach(async () => {
+    await fs.rm(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+  });
+
+  /**
+   * A clone of `alice/deal` holding a merge of `target-company-state` that
+   * origin has not seen, with origin's own `alice/deal` one commit further on
+   * so the pull has something to rebase ONTO.
+   */
+  async function seedUnpushedMerge(): Promise<{ repo: string; targetTip: string }> {
+    const upstream = path.join(root, 'upstream.git');
+    await runGit(root, ['init', '--bare', '-b', 'target-company-state', upstream]);
+
+    const seed = path.join(root, '.seed');
+    await fs.mkdir(seed);
+    await runGit(seed, ['init', '-b', 'target-company-state']);
+    await runGit(seed, ['remote', 'add', 'origin', upstream]);
+    await fs.writeFile(path.join(seed, 'shared.txt'), 'one\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'init']);
+    await runGit(seed, ['push', 'origin', 'target-company-state']);
+    // The proposal branch, forked here.
+    await runGit(seed, ['checkout', '-b', 'alice/deal']);
+    await fs.writeFile(path.join(seed, 'proposal.txt'), 'alice proposes\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'propose']);
+    await runGit(seed, ['push', 'origin', 'alice/deal']);
+    // The target moves on, in a file the proposal does not touch.
+    await runGit(seed, ['checkout', 'target-company-state']);
+    await fs.writeFile(path.join(seed, 'elsewhere.txt'), 'someone else\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'target moves']);
+    await runGit(seed, ['push', 'origin', 'target-company-state']);
+    const targetTip = await gitOut(seed, ['rev-parse', 'HEAD']);
+
+    const workspaceDir = path.join(root, workspaceId);
+    const repo = path.join(workspaceDir, 'knowledge-base');
+    await fs.mkdir(workspaceDir, { recursive: true });
+    await runGit(root, ['clone', '-b', 'alice/deal', upstream, repo]);
+    await runGit(repo, ['config', 'user.email', 'workspace@bevel.test']);
+    await runGit(repo, ['config', 'user.name', 'bevel Workspace']);
+    await runGit(repo, ['config', 'core.autocrlf', 'false']);
+
+    // The Update that merged and could not push: a real merge commit in the
+    // clone, with the target's tip as its second parent.
+    await runGit(repo, ['fetch', 'origin']);
+    await runGit(repo, [
+      'merge', '--no-ff', '-m', 'Refresh alice/deal', 'origin/target-company-state',
+    ]);
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('1');
+
+    // Origin's alice/deal moves on too (the author saved from another client),
+    // so the pull has a real rebase to do rather than nothing.
+    await runGit(seed, ['checkout', 'alice/deal']);
+    await fs.writeFile(path.join(seed, 'proposal.txt'), 'alice proposes\nand adds\n');
+    await runGit(seed, ['add', '.']);
+    await runGit(seed, ['commit', '-m', 'another save']);
+    await runGit(seed, ['push', 'origin', 'alice/deal']);
+
+    return { repo, targetTip };
+  }
+
+  function svcFor(): GitService {
+    return new GitService(
+      stubWorkspaceService({ [workspaceId]: path.join(root, workspaceId) }),
+      stubWorkflowHooks(),
+      testKbContext(),
+    );
+  }
+
+  it('is flattened by a plain pull — the branch stops containing the target', async () => {
+    // The bug, stated as the behaviour that causes it. Kept as a test so the
+    // option below is never "simplified" away as redundant.
+    const { repo, targetTip } = await seedUnpushedMerge();
+    await svcFor().pull(workspaceId);
+
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('0');
+    const contains = await gitOut(repo, [
+      'merge-base', '--is-ancestor', targetTip, 'HEAD',
+    ]).then(() => true, () => false);
+    expect(contains).toBe(false);
+  });
+
+  it('survives `preserveMerges`, and the branch still contains the target', async () => {
+    const { repo, targetTip } = await seedUnpushedMerge();
+    await svcFor().pull(workspaceId, { preserveMerges: true });
+
+    // The merge is still a merge...
+    expect(await gitOut(repo, ['rev-list', '--count', '--merges', 'HEAD'])).toBe('1');
+    // ...so the target's head is an ancestor of the branch, which is exactly
+    // what "this request is no longer behind" means.
+    const contains = await gitOut(repo, [
+      'merge-base', '--is-ancestor', targetTip, 'HEAD',
+    ]).then(() => true, () => false);
+    expect(contains).toBe(true);
+    // And the save origin had that the clone did not is replayed on top.
+    expect(await fs.readFile(path.join(repo, 'proposal.txt'), 'utf8')).toBe(
+      'alice proposes\nand adds\n',
+    );
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.getPrDetail.test.ts

@@ -49,7 +49,13 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
     const resolvePrShas = vi.fn(async () => ({ baseSha: BASE, headSha: HEAD }));
     const changedFilesForPr = vi.fn(async () => []);
     const forkPointForPr = vi.fn(async () => ({ mergeBaseSha: FORK, behind: true }));
-    const git = { resolvePrShas, changedFilesForPr, forkPointForPr } as unknown as GitService;
+    const pathsChangedBetween = vi.fn(async () => []);
+    const git = {
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+    } as unknown as GitService;
     const workspace = {
       findAnyWorkspaceId: async () => 'ws-main',
       ensureRemotesFetched: async () => undefined,
@@ -63,7 +69,14 @@ describe('PullRequestService.getPrDetail — git work per read', () => {
       getApprovalStates,
       evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
     });
-    return { svc, resolvePrShas, changedFilesForPr, forkPointForPr, getApprovalStates };
+    return {
+      svc,
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+      getApprovalStates,
+    };
   }
 
   it('pins the file list to the SHAs it just resolved, and keeps patches for a client read', async () => {
@@ -179,3 +192,133 @@ describe('PullRequestService — change request link', () => {
     expect(detail?.urlNote).toBe('Set PUBLIC_FRONTEND_URL to get absolute links.');
   });
 });
+
+/**
+ * `needsUpdate` — the answer the dialog acts on, as distinct from `behind`.
+ *
+ * `behind` is the honest git fact that the two branches have diverged. On a
+ * knowledge base where every shared save commits to the default branch it is
+ * true again minutes after every update, and acting on it made opening a
+ * request pay for a merge on almost every open — for changes to files the
+ * request does not contain. `needsUpdate` adds the half that matters: the
+ * target changed a file THIS request also changes.
+ */
+describe('PullRequestService.getPrDetail — needsUpdate', () => {
+  const FILE = 'Sales/Deal.md';
+  const OTHER = 'Ops/Runbook.md';
+
+  function harness(opts: {
+    behind?: boolean;
+    mergeBaseSha?: string | null;
+    files?: { path: string; previousPath?: string }[];
+    changedOnTarget?: string[];
+    changedOnTargetError?: Error;
+    state?: string;
+  } = {}) {
+    const resolvePrShas = vi.fn(async () => ({ baseSha: BASE, headSha: HEAD }));
+    const changedFilesForPr = vi.fn(async () => (opts.files ?? [{ path: FILE }]) as never);
+    const forkPointForPr = vi.fn(async () => ({
+      mergeBaseSha: opts.mergeBaseSha === undefined ? FORK : opts.mergeBaseSha,
+      behind: opts.behind ?? true,
+    }));
+    const pathsChangedBetween = opts.changedOnTargetError
+      ? vi.fn().mockRejectedValue(opts.changedOnTargetError)
+      : vi.fn(async () => opts.changedOnTarget ?? []);
+    const git = {
+      resolvePrShas,
+      changedFilesForPr,
+      forkPointForPr,
+      pathsChangedBetween,
+    } as unknown as GitService;
+    const workspace = {
+      findAnyWorkspaceId: async () => 'ws-main',
+      ensureRemotesFetched: async () => undefined,
+    } as unknown as WorkspaceService;
+    const access = { canWriteAtRef: async () => false } as unknown as IAccessControl;
+    const db = {
+      select: () => ({
+        from: () => ({
+          where: () => ({ limit: async () => [{ ...ROW, state: opts.state ?? 'open' }] }),
+        }),
+      }),
+    } as unknown as Database;
+    const svc = new PullRequestService(db, workspace, access, git);
+    svc.setDetailEnricher({
+      listComments: async () => [],
+      getApprovalStates: async () => [],
+      evaluateMergeGate: () => ({ mergeable: false, reasons: [], warnings: [] }),
+    });
+    return { svc, pathsChangedBetween };
+  }
+
+  it('is false when the target moved in files this request does not change', async () => {
+    // The case that made the message appear on essentially every open: a
+    // shared save somewhere else in the knowledge base.
+    const h = harness({ files: [{ path: FILE }], changedOnTarget: [OTHER] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.behind).toBe(true);
+    expect(detail?.needsUpdate).toBe(false);
+  });
+
+  it('is true when the target changed a file this request also changes', async () => {
+    const h = harness({ files: [{ path: FILE }], changedOnTarget: [OTHER, FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(true);
+    // Intersected over the fork point → the target's tip: the same two
+    // commits the rest of the detail is pinned to.
+    expect(h.pathsChangedBetween).toHaveBeenCalledWith('ws-main', FORK, BASE);
+  });
+
+  it('asks git nothing at all when the request is not behind', async () => {
+    // The common case, and the one that has to stay free.
+    const h = harness({ behind: false });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('asks git nothing when the request changes no files', async () => {
+    const h = harness({ files: [], changedOnTarget: [FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('counts a file the target RENAMED, under either of its names', async () => {
+    // `pathsChangedBetween` runs without rename detection, so the target's
+    // rename reports the path it left as well as the one it arrived at — and
+    // a request still editing the old name is affected.
+    const h = harness({
+      files: [{ path: FILE }],
+      changedOnTarget: [FILE, 'Sales/Deal-2026.md'],
+    });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('counts a file THIS request renamed, under the name it came from', async () => {
+    const h = harness({
+      files: [{ path: 'Sales/Deal-final.md', previousPath: FILE }],
+      changedOnTarget: [FILE],
+    });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('is true when the branches share no history — there is nothing to intersect', async () => {
+    const h = harness({ mergeBaseSha: null });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(true);
+    expect(h.pathsChangedBetween).not.toHaveBeenCalled();
+  });
+
+  it('is true when the comparison itself fails — an infra error is not "this is fine"', async () => {
+    const h = harness({ changedOnTargetError: new Error('git exploded') });
+    expect((await h.svc.getPrDetail(7, { fresh: true }))?.needsUpdate).toBe(true);
+  });
+
+  it('is false for a request that is not open, whatever git says', async () => {
+    const h = harness({ state: 'merged', changedOnTarget: [FILE] });
+    const detail = await h.svc.getPrDetail(7, { fresh: true });
+    expect(detail?.needsUpdate).toBe(false);
+    expect(detail?.behind).toBe(false);
+  });
+});

package/src/modules/workflow/git/__tests__/pull-request.service.viewer-can-delete.test.ts

@@ -0,0 +1,166 @@
+import { describe, it, expect } from 'vitest';
+import { computeViewerCanDelete } from '../pull-request.service.js';
+import { hashEmail } from '../../../../shared/email-identity.js';
+
+const EMAIL = 'juan@bevel.software';
+const AUTHOR_HASH = hashEmail(EMAIL);
+const OTHER_AUTHOR_HASH = hashEmail('someone-else@bevel.software');
+
+/**
+ * The truth table for who may delete a request outright — close it AND retire
+ * its branch. It must mirror `deleteChangeRequest`'s own check, which is why
+ * the interesting rows here are the ones where it DIFFERS from its siblings:
+ * an owner of every changed file is absent (they decline, they do not
+ * destroy), and a closed request still says yes (its leftover branch is still
+ * the server's to retire).
+ */
+describe('computeViewerCanDelete', () => {
+  it('lets the author delete their own open request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+  });
+
+  it('lets an admin delete someone else’s open request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('says yes once for a viewer who is both author and admin', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('refuses a signed-in user who is neither author nor admin', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('fails closed with no viewer, even on one’s own-looking request', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('fails closed for an anonymous admin-flagged read', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: undefined,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('refuses an APPLIED request to its author — applied history is nobody’s to delete', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'merged',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('refuses an APPLIED request to an admin too', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'merged',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(false);
+  });
+
+  it('still says yes on a CLOSED request: the leftover branch is the delete’s job', () => {
+    // Withdrawn in another tab. The server's delete still succeeds there and
+    // removes the branch the withdraw left behind, so the hint must not go
+    // quiet the moment the row flips — unlike `viewerCanCancel`, which is
+    // open-only because there is nothing left to cancel.
+    expect(
+      computeViewerCanDelete({
+        state: 'closed',
+        authorId: AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+    expect(
+      computeViewerCanDelete({
+        state: 'closed',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: true,
+      }),
+    ).toBe(true);
+  });
+
+  it('refuses a request with no stored author to a non-admin (opened outside this backend)', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: undefined,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+
+  it('leaves normalization to hashEmail, exactly as its siblings do', () => {
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: AUTHOR_HASH,
+        viewerEmail: '  Juan@Bevel.Software  ',
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(true);
+  });
+
+  it('does NOT grant the owner of every changed file — it takes no such input', () => {
+    // Decision 4. The owner of every changed file is exactly the person
+    // `computeViewerCanCancel` says yes to and this predicate must not: they
+    // may decline the request, which leaves the author's branch to rework.
+    // There is no input here to express that grant, and the row a
+    // file-owning non-admin produces reads false.
+    expect(
+      computeViewerCanDelete({
+        state: 'open',
+        authorId: OTHER_AUTHOR_HASH,
+        viewerEmail: EMAIL,
+        viewerCanBypassMerge: false,
+      }),
+    ).toBe(false);
+  });
+});

package/src/modules/workflow/git/git.service.ts

@@ -1760,7 +1760,12 @@ export class GitService implements IGitService {
    * conflict into the typed error the workflow layer queues recovery for.
    * Shared by `pull` and `syncFromRemote` so the two cannot drift.
    */
-  private async rebaseOntoRemote(cwd: string, branch: string, remoteRef: string): Promise<void> {
+  private async rebaseOntoRemote(
+    cwd: string,
+    branch: string,
+    remoteRef: string,
+    opts: { preserveMerges?: boolean } = {},
+  ): Promise<void> {
     // An UNBORN HEAD (a clone of an upstream that was empty when cloned) has
     // no commit to replay and `git rebase` refuses to start from it, so the
     // branch is moved to the remote commit instead. That is only safe while
@@ -1798,7 +1803,20 @@ export class GitService implements IGitService {
       // the local commits onto origin, then reapplies them, so the retry
       // push can fast-forward. Untracked files don't block rebase and are
       // left untouched.
-      await this.git(cwd, ['rebase', '--autostash', remoteRef]);
+      // `--rebase-merges` is what keeps an unpushed MERGE a merge. Plain
+      // rebase replays `--no-merges upstream..HEAD`, which turns a merge
+      // commit the clone holds but origin has not seen into cherry-picks of
+      // the commits it merged — the merged branch stops being a parent, so
+      // "does the published head contain the target's head" answers no
+      // however many times the update runs. Only the change-request update
+      // asks for it; every other pull replays plain saves, where the two
+      // spellings produce the same history.
+      await this.git(cwd, [
+        'rebase',
+        '--autostash',
+        ...(opts.preserveMerges ? ['--rebase-merges'] : []),
+        remoteRef,
+      ]);
     } catch (err) {
       // Capture the contested paths BEFORE the abort wipes the rebase
       // state — `--diff-filter=U` lists exactly the files whose replay
@@ -1922,7 +1940,10 @@ export class GitService implements IGitService {
     });
   }
 
-  async pull(workspaceId: string): Promise<{ treeChanged: boolean }> {
+  async pull(
+    workspaceId: string,
+    opts: { preserveMerges?: boolean } = {},
+  ): Promise<{ treeChanged: boolean }> {
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
       const branch = await this.checkedOutBranch(cwd);
@@ -1935,7 +1956,7 @@ export class GitService implements IGitService {
       // Refresh WITHOUT `git pull`, and without touching `FETCH_HEAD` — see
       // `refreshRemoteBranchRef` for why both halves are load-bearing.
       const remoteRef = await this.refreshRemoteBranchRef(cwd, branch);
-      await this.rebaseOntoRemote(cwd, branch, remoteRef);
+      await this.rebaseOntoRemote(cwd, branch, remoteRef, opts);
       this.accessControl?.invalidate(workspaceId);
       const treeAfter = (await this.revParseOrNull(cwd, 'HEAD^{tree}')) ?? '';
       return { treeChanged: treeAfter !== treeBefore };

package/src/modules/workflow/git/node-git-runner.ts

@@ -250,6 +250,12 @@ export class NodeGitRunner implements IGitRunner {
     const timers: NodeJS.Timeout[] = [];
     let timedOut = false;
 
+    // A credential that expires is renewed before it is read. Renewing is
+    // the credential's own business and its failure is not this call's:
+    // plenty of git never leaves the disk, and a call that does is told by
+    // the host what the token in hand is worth.
+    await this.credentials.prepare?.().catch(() => undefined);
+
     try {
       const { promise: pending, child } = spawnGit(args, {
         cwd,