@bevel-software/platform-core-backend 0.25.2 → 0.27.0

package/src/modules/workflow/sanitize-error.ts

@@ -65,3 +65,53 @@ export function sanitizeError(err: unknown, opts: { maxLen?: number } = {}): str
   }
   return out;
 }
+
+/**
+ * What a person reads about a failed push or pull: one of a few fixed
+ * sentences, chosen from the git failure but never quoting it.
+ *
+ * `sanitizeError` masks secrets but still returns the host's own words —
+ * `remote: Internal Server Error`, a git `fatal:` line, a URL — and those must
+ * not reach the browser (the sync banner, a route's answer). The raw text
+ * belongs in the server log, which is where the banner already sends whoever
+ * can act on it. Order matters: an auth failure also reads "unable to access",
+ * and a permission refusal is told apart from a rejected credential.
+ *
+ * `operation` says which side of the sync failed: the same 403 or
+ * "Repository not found" means "may not write here" on a push but "may not
+ * read this repository" on a pull, and the two are fixed in different places.
+ */
+export function describeSyncFailure(err: unknown, operation: 'push' | 'pull' = 'push'): string {
+  const raw = err instanceof Error ? err.message : String(err);
+  // `Permission denied (publickey…)` is ssh refusing the KEY — a rejected
+  // credential, not a missing permission.
+  if (
+    /authentication failed|could not read username|invalid username or (?:password|token)|invalid credentials|\b401\b|permission denied \(publickey/i.test(
+      raw,
+    )
+  ) {
+    return "The repository host did not accept this server's credentials.";
+  }
+  // Credentials the host accepted but that may not act here — a 403, the
+  // host's own "Permission to <repo> denied", a token scoped to other
+  // repositories (GitHub answers those "Repository not found"). Replacing the
+  // credential is the wrong fix; granting it access is the right one. Only
+  // the host's phrasing counts: a bare "Permission denied" is the server's
+  // own filesystem, handled below.
+  // `repository … not found` across the quoted URL git puts between the words.
+  if (/permission to \S+ denied|returned error: 403|write access .* not granted|repository\b.*\bnot found/i.test(raw)) {
+    return operation === 'pull'
+      ? "The repository host did not give this server's credentials access to this repository."
+      : "The repository host did not give this server's credentials permission to push here.";
+  }
+  if (/permission denied|insufficient permission/i.test(raw)) {
+    return "This server could not write to its own copy of the repository.";
+  }
+  if (/could not resolve host|failed to connect|couldn't connect|connection (refused|timed out|reset)|network is unreachable|\btimed out\b|ETIMEDOUT/i.test(raw)) {
+    return 'The repository host could not be reached.';
+  }
+  if (/non-fast-forward|fetch first|updates were rejected/i.test(raw)) {
+    return 'The branch changed on the repository host and could not be reconciled automatically.';
+  }
+  return 'The repository host refused the request.';
+}

package/src/modules/workflow/workflow.routes.ts

@@ -52,8 +52,13 @@ function toHttpError(
   return { status: 500, body: { error: 'Internal server error' } };
 }
 
-/** What a viewer who cannot read every touched file reads in place of a refusal's reason. */
-export const APPLY_FAILURE_REASON_WITHHELD = 'The reason names files you do not have access to read.';
+/**
+ * What a viewer who cannot read every touched file reads in place of a
+ * refusal's reason — one string, shared with the agent read tools, which
+ * withhold on the same predicate.
+ */
+export { APPLY_FAILURE_REASON_WITHHELD } from './agent-tools/change-request-read-shape.js';
+import { APPLY_FAILURE_REASON_WITHHELD } from './agent-tools/change-request-read-shape.js';
 
 function parsePrNumber(raw: string): number | null {
   if (!/^\d+$/.test(raw)) return null;