@bevel-software/platform-core-backend 0.35.0 → 0.37.0

package/dist/modules/{workflow → version-control}/git/git.service.js

@@ -10,7 +10,7 @@ import { utf8Text } from '../../../shared/utf8-text.js';
 import { lstatOrNull } from '../../../shared/rename-no-replace.js';
 import { linkedAncestor } from '../../../shared/no-link-below.js';
 import { assertValidBranchName, assertValidRelativePath, isBranchAuthoredBy, isOwnSuggestionsBranch, } from '../../kb-fs/index.js';
-import { AppliedChangeMismatchError, BranchAuthorshipError, BranchDeleteRefusedError, WorkflowDomainError, WorkflowValidationError, ProtectedBranchError, PullRebaseConflictError, RemoteBranchGoneError, VersionNotOnBranchError, isMissingRemoteBranchFailure, } from '../../../shared/domain-errors.js';
+import { AppliedChangeMismatchError, BranchAuthorshipError, BranchDeleteRefusedError, VersionControlDomainError, VersionControlValidationError, ProtectedBranchError, PullRebaseConflictError, RemoteBranchGoneError, VersionNotOnBranchError, isMissingRemoteBranchFailure, } from '../../../shared/domain-errors.js';
 import { GitRunError, assertOneSpecPerLine, redactGitToken, } from '../../../shared/git.contract.js';
 import { NodeGitRunner } from './node-git-runner.js';
 import { printable } from '../../../shared/printable.js';
@@ -19,7 +19,7 @@ import { sanitizeError } from '../sanitize-error.js';
 const log = logger('git');
 const crLog = logger('cr');
 /**
- * Fallback committer identity. Every workflow commit overrides the author via
+ * Fallback committer identity. Every version-control commit overrides the author via
  * `--author=…` so the real human shows up in `git log`; this is just the
  * committer git records need. Mirrors the value `WorkspaceService` stamps on
  * each clone — set again where an operation must not depend on that ambient
@@ -99,13 +99,13 @@ function buildDefaultCommitSummary(repoRelativePath) {
 }
 function assertValidAuthor(user) {
     if (!user.name || !user.email) {
-        throw new WorkflowValidationError('commit author name and email are required');
+        throw new VersionControlValidationError('commit author name and email are required');
     }
     if (/[\r\n<>]/.test(user.name)) {
-        throw new WorkflowValidationError('commit author name contains invalid characters');
+        throw new VersionControlValidationError('commit author name contains invalid characters');
     }
     if (/[\r\n<>\s]/.test(user.email) || !/^[^@\s]+@[^@\s]+$/.test(user.email)) {
-        throw new WorkflowValidationError('commit author email is not a valid address');
+        throw new VersionControlValidationError('commit author email is not a valid address');
     }
 }
 /**
@@ -260,7 +260,7 @@ export class GitService {
     static CHANGED_ENTRIES_MAX = 4096;
     constructor(workspaceService, 
     /**
-     * Workflow lifecycle hooks. This service only consults the ADVISORY
+     * Version-control lifecycle hooks. This service only consults the ADVISORY
      * `commitValidation` hooks (registered by the enterprise kb module in the
      * composition root — the constructor-injected `IKbValidator` this
      * replaced). No hooks registered = no commit-time validation, which is
@@ -289,6 +289,34 @@ export class GitService {
     get kbDirName() {
         return this.kb.kbDirName;
     }
+    /**
+     * Every commit this service lands is reported here, once, to the hooks the
+     * composition root registered (`VersionControlHooks.onCommitLanded`): a
+     * single-file commit, a batch, a merge. Paths go out workspace-relative, as
+     * the notifier's contract has them. The hooks run isolated, so a reactor can
+     * neither fail nor unwind the commit it hears of. This is the ONE place a
+     * commit is announced from — a new way of committing reports here or it is
+     * not announced at all, which a test pins.
+     */
+    landed(workspaceId, branch, user, repoRelativePaths) {
+        this.hooks.commitLanded({
+            workspaceId,
+            branch,
+            paths: repoRelativePaths.map((p) => `${this.kbDirName}/${p}`),
+            byUser: user,
+        });
+    }
+    /**
+     * The files the commit at HEAD changed, repo-relative, read from the commit
+     * itself rather than from the status listing that preceded it: every file
+     * of a new folder (status shows the folder), both ends of a rename (status
+     * shows one entry). A read that fails must not lose the report, so callers
+     * fall back to what they knew before the commit.
+     */
+    async committedPaths(cwd) {
+        const { stdout } = await this.git(cwd, ['diff-tree', '--root', '--no-commit-id', '--name-only', '--no-renames', '-r', '-z', 'HEAD']);
+        return stdout.split('\0').filter(Boolean);
+    }
     /**
      * The credentials the runner authenticates with — for the services above
      * this one that scrub a message git or the host echoed a token into.
@@ -705,7 +733,7 @@ export class GitService {
             const cwd = await this.repoDir(workspaceId);
             const current = await this.currentBranch(cwd);
             if (current === name) {
-                throw new WorkflowValidationError(`Cannot delete "${name}" while it's the checked-out branch.`);
+                throw new VersionControlValidationError(`Cannot delete "${name}" while it's the checked-out branch.`);
             }
             if (opts.systemCleanup) {
                 // Internal post-merge retirement (never reachable from a route): the
@@ -719,7 +747,7 @@ export class GitService {
                 // not just their own — but keep the "refuse if origin still has the
                 // ref" safety: a present remote means the branch is still live.
                 if (await this.refExists(cwd, `refs/remotes/origin/${name}`)) {
-                    throw new WorkflowValidationError(`Branch "${name}" still exists on origin — refusing to auto-prune.`);
+                    throw new VersionControlValidationError(`Branch "${name}" still exists on origin — refusing to auto-prune.`);
                 }
             }
             else if (!(await this.mayDeleteBranch(workspaceId, name, user))) {
@@ -892,12 +920,12 @@ export class GitService {
     async commit(workspaceId, user, req) {
         const subject = req.summary?.trim();
         if (!subject)
-            throw new WorkflowValidationError('commit summary is required');
+            throw new VersionControlValidationError('commit summary is required');
         if (subject.length > 200) {
-            throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+            throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
         }
         if (subject.includes('\n')) {
-            throw new WorkflowValidationError('commit summary must be a single line');
+            throw new VersionControlValidationError('commit summary must be a single line');
         }
         assertValidAuthor(user);
         return this.mutex.run(workspaceId, async () => {
@@ -915,12 +943,12 @@ export class GitService {
             ]);
             const touched = parsePorcelainZ(porcelain);
             if (touched.length === 0) {
-                throw new WorkflowValidationError('No pending changes to commit', {
+                throw new VersionControlValidationError('No pending changes to commit', {
                     kind: 'no-pending-changes',
                 });
             }
             if (touched.length > 1) {
-                throw new WorkflowValidationError(`Each change must affect exactly one file. ${touched.length} files are currently pending: ${touched.join(', ')}. Commit them one at a time.`, { kind: 'too-many-files-dirty', paths: touched });
+                throw new VersionControlValidationError(`Each change must affect exactly one file. ${touched.length} files are currently pending: ${touched.join(', ')}. Commit them one at a time.`, { kind: 'too-many-files-dirty', paths: touched });
             }
             // Gate by access-control rules — but ONLY on protected branches.
             // Feature/draft branches are free-for-all: anyone can commit anything
@@ -953,6 +981,10 @@ export class GitService {
                 args.push('-m', req.description.trim());
             }
             await this.git(cwd, args);
+            // The commit exists from here on: reported now, before the attribution
+            // read, which can fail without unmaking it — with the files the commit
+            // holds, or the status listing if even that read fails.
+            this.landed(workspaceId, branch, user, await this.committedPaths(cwd).catch(() => touched));
             const { stdout } = await this.git(cwd, [
                 'log',
                 '-1',
@@ -1047,7 +1079,7 @@ export class GitService {
             // **No access check at commit time.** Per the "disk is the source of
             // truth" rule, by the time content is on disk it must not be rejected.
             // The permission check that used to live here now runs at lock
-            // acquisition (see `WorkflowService.acquireLock`'s
+            // acquisition (see `VersionControlService.acquireLock`'s
             // `assertCanWriteAtPath`), so a user can't even start editing a file
             // they lack write permission on — they never reach this commit. The
             // legacy gate could destroy a user's edits when access changed
@@ -1069,16 +1101,20 @@ export class GitService {
             await this.git(cwd, ['add', '--', repoRelativePath]);
             const subject = summary?.trim() || buildDefaultCommitSummary(repoRelativePath);
             if (subject.length > 200) {
-                throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+                throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
             }
             if (subject.includes('\n')) {
-                throw new WorkflowValidationError('commit summary must be a single line');
+                throw new VersionControlValidationError('commit summary must be a single line');
             }
             await this.git(cwd, [
                 'commit',
                 `--author=${user.name} <${user.email}>`,
                 '-m', subject,
             ]);
+            // The commit exists from here on: reported now, before the attribution
+            // read, which can fail without unmaking it — with the files the commit
+            // holds (the one path, as it was staged), or that path if the read fails.
+            this.landed(workspaceId, branch, user, await this.committedPaths(cwd).catch(() => [repoRelativePath]));
             const { stdout } = await this.git(cwd, [
                 'log',
                 '-1',
@@ -1119,11 +1155,11 @@ export class GitService {
         assertValidAuthor(user);
         const subject = summary?.trim();
         if (!subject)
-            throw new WorkflowValidationError('commit summary is required');
+            throw new VersionControlValidationError('commit summary is required');
         if (subject.length > 200)
-            throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+            throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
         if (subject.includes('\n'))
-            throw new WorkflowValidationError('commit summary must be a single line');
+            throw new VersionControlValidationError('commit summary must be a single line');
         return this.mutex.run(workspaceId, async () => {
             const cwd = await this.repoDir(workspaceId);
             const branch = await this.currentBranch(cwd);
@@ -1210,6 +1246,10 @@ export class GitService {
             // committed" and restore their pre-edit bytes, which here would publish
             // a compensating revert of a commit that DID land. The attribution read
             // is best-effort; on failure fall back to what we already know.
+            // The commit exists: report it, with the files it holds — both ends of a
+            // rename, every file of a new folder — or the scoped status listing if
+            // that read fails. Neither the read nor the hooks can throw here.
+            this.landed(workspaceId, branch, user, await this.committedPaths(cwd).catch(() => touched));
             let sha = '';
             let authorName = user.name;
             let authorEmail = user.email;
@@ -1289,7 +1329,7 @@ export class GitService {
             }
         }
     }
-    // `forcePush` method removed. The workflow layer no longer auto-force-pushes
+    // `forcePush` method removed. The version-control layer no longer auto-force-pushes
     // as a recovery — when the cooperative `pull --rebase` + retry can't
     // reconcile, we throw `PushNeedsAgentResolutionError` and hand off to the
     // agent. The agent has git + gh CLI access and can choose to run a raw
@@ -1301,7 +1341,7 @@ export class GitService {
     // automatic-recovery path.
     /**
      * Attempt a local merge of `origin/<targetBranch>` into the currently-
-     * checked-out branch. Used by the workflow module to auto-merge target →
+     * checked-out branch. Used by the version-control module to auto-merge target →
      * source when a change request is opened or refreshed (PLAN §1).
      *
      * Two outcomes:
@@ -1350,7 +1390,7 @@ export class GitService {
         assertValidBranchName(fromBranch);
         assertValidAuthor(user);
         if (/\n\s*\n/.test(opts.subject)) {
-            throw new WorkflowValidationError('merge commit subject must be a single paragraph');
+            throw new VersionControlValidationError('merge commit subject must be a single paragraph');
         }
         // Every resolution names a repository path; which of them are conflicted
         // is only known inside the merge, where they are matched exactly.
@@ -1365,13 +1405,13 @@ export class GitService {
             const p = this.stripRepoPrefix(r.path);
             const ways = [r.content !== undefined, r.choose !== undefined].filter(Boolean).length;
             if (ways !== 1) {
-                throw new WorkflowValidationError(`resolution for "${p}": give either \`content\` or \`choose\`, not ${ways === 0 ? 'neither' : 'both'}`);
+                throw new VersionControlValidationError(`resolution for "${p}": give either \`content\` or \`choose\`, not ${ways === 0 ? 'neither' : 'both'}`);
             }
             if (r.choose !== undefined && !['ours', 'theirs', 'delete'].includes(r.choose)) {
-                throw new WorkflowValidationError(`resolution for "${p}": \`choose\` is \`ours\`, \`theirs\` or \`delete\``);
+                throw new VersionControlValidationError(`resolution for "${p}": \`choose\` is \`ours\`, \`theirs\` or \`delete\``);
             }
             if (resolutions.has(p))
-                throw new WorkflowValidationError(`"${p}" is resolved twice`);
+                throw new VersionControlValidationError(`"${p}" is resolved twice`);
             resolutions.set(p, { ...r, path: p });
         }
         return this.mutex.run(workspaceId, async () => this.mergeRefIntoCheckout(workspaceId, await this.repoDir(workspaceId), branch, fromBranch, user, {
@@ -1400,7 +1440,7 @@ export class GitService {
      *
      * `publish` runs over the merge commit inside this same reservation, so no
      * save or sync can land between the commit and its push; it is the
-     * caller's push policy (the workflow's `pushWithRecovery`: one replay onto
+     * caller's push policy (the version-control service's `pushWithRecovery`: one replay onto
      * the moved branch with the merge kept, `--rebase-merges`, then the typed
      * hand-off) over this checkout's own unlocked moves.
      */
@@ -1409,14 +1449,14 @@ export class GitService {
         if (opts.guardCheckout) {
             const checkedOut = await this.currentBranch(cwd);
             if (checkedOut !== branch) {
-                throw new WorkflowValidationError(`the workspace is on "${checkedOut}", not on "${branch}"`);
+                throw new VersionControlValidationError(`the workspace is on "${checkedOut}", not on "${branch}"`);
             }
             // A merge rewrites tracked files. Edits still on their way to a commit
             // (a save the worker has not landed) would be swept into the merge
             // commit under this user's name, or lost under the merge's version.
             const { stdout: dirty } = await this.git(cwd, ['status', '--porcelain=v1', '-z']);
             if (parsePorcelainZ(dirty).length > 0) {
-                throw new WorkflowDomainError(`"${branch}" has edits that are not committed yet. Try again once they are saved.`, 409, { kind: 'branch-busy', branch });
+                throw new VersionControlDomainError(`"${branch}" has edits that are not committed yet. Try again once they are saved.`, 409, { kind: 'branch-busy', branch });
             }
         }
         // `git merge`/`git commit` need a committer identity (see `mergeChangeRequest`).
@@ -1440,7 +1480,7 @@ export class GitService {
         // A merge with nothing to settle leaves no resolution a place to go: one
         // supplied anyway names a path that is not conflicted, and is refused as
         // such rather than dropped on the floor behind a published merge.
-        const noConflictsFor = () => new WorkflowValidationError(`nothing conflicted, so nothing is resolved here: ${[...opts.resolutions.keys()].join(', ')}.`, { kind: 'not-conflicted', paths: [...opts.resolutions.keys()] });
+        const noConflictsFor = () => new VersionControlValidationError(`nothing conflicted, so nothing is resolved here: ${[...opts.resolutions.keys()].join(', ')}.`, { kind: 'not-conflicted', paths: [...opts.resolutions.keys()] });
         // Nothing to merge is a question of ANCESTRY, not of content: a source
         // the branch already reaches is merged; one it does not reach is merged
         // in even when the two trees are identical, so the branch records that
@@ -1468,7 +1508,7 @@ export class GitService {
                     // locks. Refused whole, before any resolution is applied — naming
                     // the caller's own paths only, never the conflicted set (which the
                     // caller is told of, cut to what they may read, by the answer).
-                    throw new WorkflowValidationError(`not conflicted, so not resolved here: ${stray.join(', ')}.`, { kind: 'not-conflicted', paths: stray });
+                    throw new VersionControlValidationError(`not conflicted, so not resolved here: ${stray.join(', ')}.`, { kind: 'not-conflicted', paths: stray });
                 }
                 const unresolved = conflicted.filter((p) => !opts.resolutions.has(p));
                 if (unresolved.length > 0) {
@@ -1547,8 +1587,13 @@ export class GitService {
     }
     /** The merge commit, as `user`, and its publish when asked for. The caller settles a failure. */
     async commitMerge(workspaceId, cwd, branch, fromBranch, user, opts, resolvedPaths) {
+        // What this merge brings onto the branch: the index holds the merged tree.
+        // NUL-delimited and with renames as a delete plus an add, so every path is
+        // named verbatim, both ends of a rename included.
+        const { stdout: merged } = await this.git(cwd, ['diff', '--cached', '--name-only', '--no-renames', '-z']);
         await this.git(cwd, ['commit', `--author=${user.name} <${user.email}>`, '-m', opts.subject, '-m', opts.body]);
         this.accessControl?.invalidate(workspaceId);
+        this.landed(workspaceId, branch, user, merged.split('\0').filter(Boolean));
         // The publish runs here, inside the reservation the merge was made in,
         // over this checkout's own push and pull-rebase (the merge kept as a
         // merge) — the caller's policy, the git layer's moves. Whatever it
@@ -1640,7 +1685,7 @@ export class GitService {
         // the way that is a link is refused, and a path that is itself a link is
         // replaced as a path (the link removed first), never written through.
         if ((await linkedAncestor(cwd, path.dirname(file))) !== null) {
-            throw new WorkflowValidationError(`"${r.path}" is reached through a link, so it is not resolved here`);
+            throw new VersionControlValidationError(`"${r.path}" is reached through a link, so it is not resolved here`);
         }
         if (r.content !== undefined) {
             if ((await lstatOrNull(file))?.isSymbolicLink())
@@ -1718,7 +1763,7 @@ export class GitService {
         // `mergeCommitSubject` already flattens the title it builds from; this is the
         // guard that keeps any other caller from reintroducing the break.
         if (/\n\s*\n/.test(commit.subject)) {
-            throw new WorkflowValidationError('merge commit subject must be a single paragraph');
+            throw new VersionControlValidationError('merge commit subject must be a single paragraph');
         }
         const MAX_ATTEMPTS = 3;
         return this.mutex.run(baseWorkspaceId, async () => {
@@ -1733,7 +1778,7 @@ export class GitService {
                 const { stdout: dirty } = await this.git(cwd, ['status', '--porcelain=v1', '-z']);
                 const unpushed = await this.hasUnpushedCommitsAt(cwd);
                 if (parsePorcelainZ(dirty).length > 0 || unpushed) {
-                    throw new WorkflowDomainError(`"${targetBranch}" has edits that are not shared yet. Try the merge again once they are saved.`, 409, { kind: 'merge-target-busy', targetBranch });
+                    throw new VersionControlDomainError(`"${targetBranch}" has edits that are not shared yet. Try the merge again once they are saved.`, 409, { kind: 'merge-target-busy', targetBranch });
                 }
             }
             for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {
@@ -1798,8 +1843,10 @@ export class GitService {
                 // finalize the row (a transient database fault between the push and the
                 // update) has one, and it is the only place its file list survives — so
                 // it is looked for rather than assumed absent (cubic P2 on #347).
-                const { stdout: staged } = await this.git(cwd, ['diff', '--cached', '--name-only']);
-                if (staged.trim() === '') {
+                // NUL-delimited and with renames as a delete plus an add, so every path
+                // the merge touches is named verbatim, both ends of a rename included.
+                const { stdout: staged } = await this.git(cwd, ['diff', '--cached', '--name-only', '--no-renames', '-z']);
+                if (staged === '') {
                     const { stdout: sha } = await this.git(cwd, ['rev-parse', 'HEAD']);
                     await this.git(cwd, ['merge', '--abort']).catch(() => undefined);
                     const own = opts.appliedChangeNumber === undefined
@@ -1816,6 +1863,10 @@ export class GitService {
                 const { stdout: sha } = await this.git(cwd, ['rev-parse', 'HEAD']);
                 try {
                     await this.git(cwd, ['push', 'origin', `HEAD:refs/heads/${targetBranch}`]);
+                    // This merge commit is provisional until its push lands: a rejected
+                    // push resets the checkout and the next attempt commits anew. So it
+                    // is reported here, once, for the attempt that landed on the target.
+                    this.landed(baseWorkspaceId, targetBranch, user, staged.split('\0').filter(Boolean));
                     this.accessControl?.invalidate(baseWorkspaceId);
                     // A commit of this request's own, with the subject the reader verifies.
                     return { kind: 'merged', sha: sha.trim(), mergeCommit: sha.trim() };
@@ -2108,7 +2159,7 @@ export class GitService {
     }
     /**
      * Rebase the checked-out branch onto `remoteRef`, turning a content
-     * conflict into the typed error the workflow layer queues recovery for.
+     * conflict into the typed error the version-control layer queues recovery for.
      * Shared by `pull` and `syncFromRemote` so the two cannot drift.
      */
     async rebaseOntoRemote(cwd, branch, remoteRef, opts = {}) {
@@ -2183,7 +2234,7 @@ export class GitService {
                 abortSucceeded = false;
             });
             if (abortSucceeded && conflictedPaths.length > 0) {
-                // Typed so the workflow layer can queue background recovery — this
+                // Typed so the version-control layer can queue background recovery — this
                 // divergence never resolves on its own (every retry pull hits the
                 // same conflict) and the unpushed local commits are someone's saved
                 // content stuck violating save=share.
@@ -2620,7 +2671,7 @@ export class GitService {
                     // Only the genuinely empty separator lines are skipped.
                     const touched = nameLine.endsWith('\r') ? nameLine.slice(0, -1) : nameLine;
                     if (touched && touched !== repoRelativePath) {
-                        throw new WorkflowValidationError(`"${relativePath}" is a directory at that point in history — history is served per file`);
+                        throw new VersionControlValidationError(`"${relativePath}" is a directory at that point in history — history is served per file`);
                     }
                 }
             }
@@ -2648,7 +2699,7 @@ export class GitService {
     async diffFileAtCommit(workspaceId, relativePath, sha) {
         assertValidRelativePath(relativePath);
         if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-            throw new WorkflowValidationError('invalid commit sha');
+            throw new VersionControlValidationError('invalid commit sha');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -2696,7 +2747,7 @@ export class GitService {
     async fileContentsAtCommit(workspaceId, relativePath, sha) {
         assertValidRelativePath(relativePath);
         if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-            throw new WorkflowValidationError('invalid commit sha');
+            throw new VersionControlValidationError('invalid commit sha');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -2732,7 +2783,7 @@ export class GitService {
         assertValidBranchName(fromBranch);
         assertValidBranchName(toBranch);
         if (fromBranch === toBranch) {
-            throw new WorkflowValidationError('from and to branches must differ');
+            throw new VersionControlValidationError('from and to branches must differ');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -2850,7 +2901,7 @@ export class GitService {
         if (opts.at) {
             for (const sha of [opts.at.baseSha, opts.at.headSha]) {
                 if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-                    throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+                    throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
                 }
             }
         }
@@ -2963,7 +3014,7 @@ export class GitService {
      * side for a merge commit, and for a squashed or fast-forwarded commit it is
      * simply the commit before — the same answer either way.
      *
-     * Throws `WorkflowValidationError` whenever the recorded commit cannot be
+     * Throws `VersionControlValidationError` whenever the recorded commit cannot be
      * PROVEN to be this request's own merge commit — see
      * {@link appliedChangeShas}. Every caller reads that as "the file set could
      * not be resolved" and falls back to its own fail-closed answer, which is what
@@ -2973,7 +3024,7 @@ export class GitService {
     async appliedEnds(cwd, applied) {
         const { mergeSha, number } = applied;
         if (!/^[0-9a-f]{40,64}$/.test(mergeSha)) {
-            throw new WorkflowValidationError(`invalid commit sha: ${mergeSha}`);
+            throw new VersionControlValidationError(`invalid commit sha: ${mergeSha}`);
         }
         const revParse = async (rev) => {
             try {
@@ -2998,7 +3049,7 @@ export class GitService {
         // or a message that does not name the request) never becomes it, and is
         // reported as a mismatch the caller may remember.
         if (!(await revParse(`${mergeSha}^{commit}`))) {
-            throw new WorkflowValidationError(`commit ${mergeSha} is not in this clone, so change request #${number} cannot be read from it yet`);
+            throw new VersionControlValidationError(`commit ${mergeSha} is not in this clone, so change request #${number} cannot be read from it yet`);
         }
         // The SECOND parent first, because its absence is the whole P1: a merge
         // `--no-ff` always has one, and a commit that does not is not a merge this
@@ -3125,7 +3176,7 @@ export class GitService {
         // concurrent `fetch --prune origin` (`ensureRemotesFetched` and
         // `fetchPrRefs` both run outside this mutex, deliberately) can drop a
         // remote-tracking ref between the two, and re-resolving inside the mutex
-        // would then throw `WorkflowValidationError` — which `touchedPathsFor`
+        // would then throw `VersionControlValidationError` — which `touchedPathsFor`
         // swallows into an empty touched-path set, i.e. exactly the change
         // request missing from its own author's tree that the skip is guarded
         // against. The commits stay readable whatever happens to the ref names.
@@ -3274,7 +3325,7 @@ export class GitService {
     async forkPointForPr(workspaceId, at) {
         for (const sha of [at.baseSha, at.headSha]) {
             if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-                throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+                throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
             }
         }
         const cwd = await this.repoDir(workspaceId);
@@ -3314,7 +3365,7 @@ export class GitService {
     async pathsChangedBetween(workspaceId, fromSha, toSha) {
         for (const sha of [fromSha, toSha]) {
             if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-                throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+                throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
             }
         }
         const cwd = await this.repoDir(workspaceId);
@@ -3339,7 +3390,7 @@ export class GitService {
         assertValidBranchName(baseBranch);
         assertValidRelativePath(relativePath);
         if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-            throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+            throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {
@@ -3350,7 +3401,7 @@ export class GitService {
             }
             catch (err) {
                 if (err.exitCode === 1) {
-                    throw new WorkflowDomainError(`That commit is not part of "${baseBranch}" — it is not this request's fork point.`, 404);
+                    throw new VersionControlDomainError(`That commit is not part of "${baseBranch}" — it is not this request's fork point.`, 404);
                 }
                 throw err;
             }
@@ -3532,7 +3583,7 @@ export class GitService {
             return await this.publishedPrEnds(cwd, baseBranch, headBranch);
         }
         catch (err) {
-            if (err instanceof WorkflowValidationError)
+            if (err instanceof VersionControlValidationError)
                 return null;
             throw err;
         }
@@ -3584,7 +3635,7 @@ export class GitService {
                     throw err;
             }
         }
-        throw new WorkflowValidationError(`unknown branch: ${branch}`);
+        throw new VersionControlValidationError(`unknown branch: ${branch}`);
     }
     /**
      * Every commit `branch` resolves to in this repository — its local head
@@ -3623,7 +3674,7 @@ export class GitService {
                 // Try the next candidate.
             }
         }
-        throw new WorkflowValidationError(`unknown branch: ${branch}`);
+        throw new VersionControlValidationError(`unknown branch: ${branch}`);
     }
     // ── internals ──────────────────────────────────────────────────────────
     async statusInternal(workspaceId) {
@@ -3759,7 +3810,7 @@ export class GitService {
             throw err;
         }
         if (kind === 'tree') {
-            throw new WorkflowValidationError(`"${displayPath}" is a directory at that point in history — history is served per file`);
+            throw new VersionControlValidationError(`"${displayPath}" is a directory at that point in history — history is served per file`);
         }
     }
     async readFileAtRef(workspaceId, ref, repoRelativePath) {
@@ -3899,7 +3950,7 @@ export class GitService {
     async fileBytesAtCommit(workspaceId, relativePath, sha, side) {
         assertValidRelativePath(relativePath);
         if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-            throw new WorkflowValidationError('invalid commit sha');
+            throw new VersionControlValidationError('invalid commit sha');
         }
         const repoRelativePath = this.stripRepoPrefix(relativePath);
         return this.mutex.run(workspaceId, async () => {