@bevel-software/platform-core-backend 0.35.0 → 0.37.0

package/src/modules/{workflow → version-control}/git/git.service.ts

@@ -23,7 +23,7 @@ import type {
 import { isFolderPlaceholder } from '@bevel-software/platform-shared';
 import { mergeCommitMessageNames } from './merge-commit.js';
 import type { WorkspaceService } from '../../workspace/index.js';
-import type { WorkflowHooks, CommitValidationContext } from '../workflow-hooks.js';
+import type { VersionControlHooks, CommitValidationContext } from '../version-control-hooks.js';
 import type { IAccessControl } from '../../access/index.js';
 import { AccessDeniedError } from '../../access-model/index.js';
 import { WorkspaceIdMutex, type WorkspaceMutex, assertInsideRepo, cloneTrackingConfigArgs, SAFE_IMPLICIT_FETCH_ARGS, readRefSha } from '../../kb-fs/index.js';
@@ -42,8 +42,8 @@ import {
   AppliedChangeMismatchError,
   BranchAuthorshipError,
   BranchDeleteRefusedError,
-  WorkflowDomainError,
-  WorkflowValidationError,
+  VersionControlDomainError,
+  VersionControlValidationError,
   ProtectedBranchError,
   PullRebaseConflictError,
   RemoteBranchGoneError,
@@ -69,7 +69,7 @@ const crLog = logger('cr');
 
 
 /**
- * Fallback committer identity. Every workflow commit overrides the author via
+ * Fallback committer identity. Every version-control commit overrides the author via
  * `--author=…` so the real human shows up in `git log`; this is just the
  * committer git records need. Mirrors the value `WorkspaceService` stamps on
  * each clone — set again where an operation must not depend on that ambient
@@ -149,13 +149,13 @@ function buildDefaultCommitSummary(repoRelativePath: string): string {
 
 function assertValidAuthor(user: AuthUser): void {
   if (!user.name || !user.email) {
-    throw new WorkflowValidationError('commit author name and email are required');
+    throw new VersionControlValidationError('commit author name and email are required');
   }
   if (/[\r\n<>]/.test(user.name)) {
-    throw new WorkflowValidationError('commit author name contains invalid characters');
+    throw new VersionControlValidationError('commit author name contains invalid characters');
   }
   if (/[\r\n<>\s]/.test(user.email) || !/^[^@\s]+@[^@\s]+$/.test(user.email)) {
-    throw new WorkflowValidationError('commit author email is not a valid address');
+    throw new VersionControlValidationError('commit author email is not a valid address');
   }
 }
 
@@ -317,13 +317,13 @@ export class GitService implements IGitService {
   constructor(
     private readonly workspaceService: WorkspaceService,
     /**
-     * Workflow lifecycle hooks. This service only consults the ADVISORY
+     * Version-control lifecycle hooks. This service only consults the ADVISORY
      * `commitValidation` hooks (registered by the enterprise kb module in the
      * composition root — the constructor-injected `IKbValidator` this
      * replaced). No hooks registered = no commit-time validation, which is
      * safe because validation is advisory and never blocks a commit.
      */
-    private readonly hooks: WorkflowHooks,
+    private readonly hooks: VersionControlHooks,
     private readonly kb: KbContext,
     // Keyed by the CANONICAL workspace id: a route's Express-decoded `:id`
     // (`alice/feature`) and a tool's `alice%2Ffeature` name one clone, and
@@ -344,6 +344,36 @@ export class GitService implements IGitService {
     return this.kb.kbDirName;
   }
 
+  /**
+   * Every commit this service lands is reported here, once, to the hooks the
+   * composition root registered (`VersionControlHooks.onCommitLanded`): a
+   * single-file commit, a batch, a merge. Paths go out workspace-relative, as
+   * the notifier's contract has them. The hooks run isolated, so a reactor can
+   * neither fail nor unwind the commit it hears of. This is the ONE place a
+   * commit is announced from — a new way of committing reports here or it is
+   * not announced at all, which a test pins.
+   */
+  private landed(workspaceId: string, branch: string, user: AuthUser, repoRelativePaths: readonly string[]): void {
+    this.hooks.commitLanded({
+      workspaceId,
+      branch,
+      paths: repoRelativePaths.map((p) => `${this.kbDirName}/${p}`),
+      byUser: user,
+    });
+  }
+
+  /**
+   * The files the commit at HEAD changed, repo-relative, read from the commit
+   * itself rather than from the status listing that preceded it: every file
+   * of a new folder (status shows the folder), both ends of a rename (status
+   * shows one entry). A read that fails must not lose the report, so callers
+   * fall back to what they knew before the commit.
+   */
+  private async committedPaths(cwd: string): Promise<string[]> {
+    const { stdout } = await this.git(cwd, ['diff-tree', '--root', '--no-commit-id', '--name-only', '--no-renames', '-r', '-z', 'HEAD']);
+    return stdout.split('\0').filter(Boolean);
+  }
+
   /**
    * The credentials the runner authenticates with — for the services above
    * this one that scrub a message git or the host echoed a token into.
@@ -808,7 +838,7 @@ export class GitService implements IGitService {
       const cwd = await this.repoDir(workspaceId);
       const current = await this.currentBranch(cwd);
       if (current === name) {
-        throw new WorkflowValidationError(
+        throw new VersionControlValidationError(
           `Cannot delete "${name}" while it's the checked-out branch.`,
         );
       }
@@ -824,7 +854,7 @@ export class GitService implements IGitService {
         // not just their own — but keep the "refuse if origin still has the
         // ref" safety: a present remote means the branch is still live.
         if (await this.refExists(cwd, `refs/remotes/origin/${name}`)) {
-          throw new WorkflowValidationError(
+          throw new VersionControlValidationError(
             `Branch "${name}" still exists on origin — refusing to auto-prune.`,
           );
         }
@@ -1008,12 +1038,12 @@ export class GitService implements IGitService {
     req: ShareChangesRequest,
   ): Promise<CommitAttribution> {
     const subject = req.summary?.trim();
-    if (!subject) throw new WorkflowValidationError('commit summary is required');
+    if (!subject) throw new VersionControlValidationError('commit summary is required');
     if (subject.length > 200) {
-      throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+      throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
     }
     if (subject.includes('\n')) {
-      throw new WorkflowValidationError('commit summary must be a single line');
+      throw new VersionControlValidationError('commit summary must be a single line');
     }
     assertValidAuthor(user);
 
@@ -1033,12 +1063,12 @@ export class GitService implements IGitService {
       ]);
       const touched = parsePorcelainZ(porcelain);
       if (touched.length === 0) {
-        throw new WorkflowValidationError('No pending changes to commit', {
+        throw new VersionControlValidationError('No pending changes to commit', {
           kind: 'no-pending-changes',
         });
       }
       if (touched.length > 1) {
-        throw new WorkflowValidationError(
+        throw new VersionControlValidationError(
           `Each change must affect exactly one file. ${touched.length} files are currently pending: ${touched.join(', ')}. Commit them one at a time.`,
           { kind: 'too-many-files-dirty', paths: touched },
         );
@@ -1082,6 +1112,10 @@ export class GitService implements IGitService {
         args.push('-m', req.description.trim());
       }
       await this.git(cwd, args);
+      // The commit exists from here on: reported now, before the attribution
+      // read, which can fail without unmaking it — with the files the commit
+      // holds, or the status listing if even that read fails.
+      this.landed(workspaceId, branch, user, await this.committedPaths(cwd).catch(() => touched));
 
       const { stdout } = await this.git(cwd, [
         'log',
@@ -1206,7 +1240,7 @@ export class GitService implements IGitService {
       // **No access check at commit time.** Per the "disk is the source of
       // truth" rule, by the time content is on disk it must not be rejected.
       // The permission check that used to live here now runs at lock
-      // acquisition (see `WorkflowService.acquireLock`'s
+      // acquisition (see `VersionControlService.acquireLock`'s
       // `assertCanWriteAtPath`), so a user can't even start editing a file
       // they lack write permission on — they never reach this commit. The
       // legacy gate could destroy a user's edits when access changed
@@ -1235,10 +1269,10 @@ export class GitService implements IGitService {
 
       const subject = summary?.trim() || buildDefaultCommitSummary(repoRelativePath);
       if (subject.length > 200) {
-        throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
+        throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
       }
       if (subject.includes('\n')) {
-        throw new WorkflowValidationError('commit summary must be a single line');
+        throw new VersionControlValidationError('commit summary must be a single line');
       }
 
       await this.git(cwd, [
@@ -1246,6 +1280,10 @@ export class GitService implements IGitService {
         `--author=${user.name} <${user.email}>`,
         '-m', subject,
       ]);
+      // The commit exists from here on: reported now, before the attribution
+      // read, which can fail without unmaking it — with the files the commit
+      // holds (the one path, as it was staged), or that path if the read fails.
+      this.landed(workspaceId, branch, user, await this.committedPaths(cwd).catch(() => [repoRelativePath]));
 
       const { stdout } = await this.git(cwd, [
         'log',
@@ -1292,9 +1330,9 @@ export class GitService implements IGitService {
   ): Promise<CommitAttribution | null> {
     assertValidAuthor(user);
     const subject = summary?.trim();
-    if (!subject) throw new WorkflowValidationError('commit summary is required');
-    if (subject.length > 200) throw new WorkflowValidationError('commit summary must be ≤ 200 characters');
-    if (subject.includes('\n')) throw new WorkflowValidationError('commit summary must be a single line');
+    if (!subject) throw new VersionControlValidationError('commit summary is required');
+    if (subject.length > 200) throw new VersionControlValidationError('commit summary must be ≤ 200 characters');
+    if (subject.includes('\n')) throw new VersionControlValidationError('commit summary must be a single line');
 
     return this.mutex.run(workspaceId, async () => {
       const cwd = await this.repoDir(workspaceId);
@@ -1383,6 +1421,10 @@ export class GitService implements IGitService {
       // committed" and restore their pre-edit bytes, which here would publish
       // a compensating revert of a commit that DID land. The attribution read
       // is best-effort; on failure fall back to what we already know.
+      // The commit exists: report it, with the files it holds — both ends of a
+      // rename, every file of a new folder — or the scoped status listing if
+      // that read fails. Neither the read nor the hooks can throw here.
+      this.landed(workspaceId, branch, user, await this.committedPaths(cwd).catch(() => touched));
       let sha = '';
       let authorName = user.name;
       let authorEmail = user.email;
@@ -1480,7 +1522,7 @@ export class GitService implements IGitService {
     }
   }
 
-  // `forcePush` method removed. The workflow layer no longer auto-force-pushes
+  // `forcePush` method removed. The version-control layer no longer auto-force-pushes
   // as a recovery — when the cooperative `pull --rebase` + retry can't
   // reconcile, we throw `PushNeedsAgentResolutionError` and hand off to the
   // agent. The agent has git + gh CLI access and can choose to run a raw
@@ -1493,7 +1535,7 @@ export class GitService implements IGitService {
 
   /**
    * Attempt a local merge of `origin/<targetBranch>` into the currently-
-   * checked-out branch. Used by the workflow module to auto-merge target →
+   * checked-out branch. Used by the version-control module to auto-merge target →
    * source when a change request is opened or refreshed (PLAN §1).
    *
    * Two outcomes:
@@ -1564,7 +1606,7 @@ export class GitService implements IGitService {
     assertValidBranchName(fromBranch);
     assertValidAuthor(user);
     if (/\n\s*\n/.test(opts.subject)) {
-      throw new WorkflowValidationError('merge commit subject must be a single paragraph');
+      throw new VersionControlValidationError('merge commit subject must be a single paragraph');
     }
     // Every resolution names a repository path; which of them are conflicted
     // is only known inside the merge, where they are matched exactly.
@@ -1579,12 +1621,12 @@ export class GitService implements IGitService {
       const p = this.stripRepoPrefix(r.path);
       const ways = [r.content !== undefined, r.choose !== undefined].filter(Boolean).length;
       if (ways !== 1) {
-        throw new WorkflowValidationError(`resolution for "${p}": give either \`content\` or \`choose\`, not ${ways === 0 ? 'neither' : 'both'}`);
+        throw new VersionControlValidationError(`resolution for "${p}": give either \`content\` or \`choose\`, not ${ways === 0 ? 'neither' : 'both'}`);
       }
       if (r.choose !== undefined && !['ours', 'theirs', 'delete'].includes(r.choose)) {
-        throw new WorkflowValidationError(`resolution for "${p}": \`choose\` is \`ours\`, \`theirs\` or \`delete\``);
+        throw new VersionControlValidationError(`resolution for "${p}": \`choose\` is \`ours\`, \`theirs\` or \`delete\``);
       }
-      if (resolutions.has(p)) throw new WorkflowValidationError(`"${p}" is resolved twice`);
+      if (resolutions.has(p)) throw new VersionControlValidationError(`"${p}" is resolved twice`);
       resolutions.set(p, { ...r, path: p });
     }
     return this.mutex.run(workspaceId, async () =>
@@ -1616,7 +1658,7 @@ export class GitService implements IGitService {
    *
    * `publish` runs over the merge commit inside this same reservation, so no
    * save or sync can land between the commit and its push; it is the
-   * caller's push policy (the workflow's `pushWithRecovery`: one replay onto
+   * caller's push policy (the version-control service's `pushWithRecovery`: one replay onto
    * the moved branch with the merge kept, `--rebase-merges`, then the typed
    * hand-off) over this checkout's own unlocked moves.
    */
@@ -1653,14 +1695,14 @@ export class GitService implements IGitService {
     if (opts.guardCheckout) {
       const checkedOut = await this.currentBranch(cwd);
       if (checkedOut !== branch) {
-        throw new WorkflowValidationError(`the workspace is on "${checkedOut}", not on "${branch}"`);
+        throw new VersionControlValidationError(`the workspace is on "${checkedOut}", not on "${branch}"`);
       }
       // A merge rewrites tracked files. Edits still on their way to a commit
       // (a save the worker has not landed) would be swept into the merge
       // commit under this user's name, or lost under the merge's version.
       const { stdout: dirty } = await this.git(cwd, ['status', '--porcelain=v1', '-z']);
       if (parsePorcelainZ(dirty).length > 0) {
-        throw new WorkflowDomainError(
+        throw new VersionControlDomainError(
           `"${branch}" has edits that are not committed yet. Try again once they are saved.`,
           409,
           { kind: 'branch-busy', branch },
@@ -1687,8 +1729,8 @@ export class GitService implements IGitService {
     // A merge with nothing to settle leaves no resolution a place to go: one
     // supplied anyway names a path that is not conflicted, and is refused as
     // such rather than dropped on the floor behind a published merge.
-    const noConflictsFor = (): WorkflowValidationError =>
-      new WorkflowValidationError(
+    const noConflictsFor = (): VersionControlValidationError =>
+      new VersionControlValidationError(
         `nothing conflicted, so nothing is resolved here: ${[...opts.resolutions.keys()].join(', ')}.`,
         { kind: 'not-conflicted', paths: [...opts.resolutions.keys()] },
       );
@@ -1723,7 +1765,7 @@ export class GitService implements IGitService {
           // locks. Refused whole, before any resolution is applied — naming
           // the caller's own paths only, never the conflicted set (which the
           // caller is told of, cut to what they may read, by the answer).
-          throw new WorkflowValidationError(
+          throw new VersionControlValidationError(
             `not conflicted, so not resolved here: ${stray.join(', ')}.`,
             { kind: 'not-conflicted', paths: stray },
           );
@@ -1811,8 +1853,13 @@ export class GitService implements IGitService {
     opts: { subject: string; body: string; publish?: (ops: ReservedPushOps) => Promise<void> },
     resolvedPaths: string[],
   ): Promise<MergeIntoBranchOutcome> {
+    // What this merge brings onto the branch: the index holds the merged tree.
+    // NUL-delimited and with renames as a delete plus an add, so every path is
+    // named verbatim, both ends of a rename included.
+    const { stdout: merged } = await this.git(cwd, ['diff', '--cached', '--name-only', '--no-renames', '-z']);
     await this.git(cwd, ['commit', `--author=${user.name} <${user.email}>`, '-m', opts.subject, '-m', opts.body]);
     this.accessControl?.invalidate(workspaceId);
+    this.landed(workspaceId, branch, user, merged.split('\0').filter(Boolean));
     // The publish runs here, inside the reservation the merge was made in,
     // over this checkout's own push and pull-rebase (the merge kept as a
     // merge) — the caller's policy, the git layer's moves. Whatever it
@@ -1901,7 +1948,7 @@ export class GitService implements IGitService {
     // the way that is a link is refused, and a path that is itself a link is
     // replaced as a path (the link removed first), never written through.
     if ((await linkedAncestor(cwd, path.dirname(file))) !== null) {
-      throw new WorkflowValidationError(`"${r.path}" is reached through a link, so it is not resolved here`);
+      throw new VersionControlValidationError(`"${r.path}" is reached through a link, so it is not resolved here`);
     }
     if (r.content !== undefined) {
       if ((await lstatOrNull(file))?.isSymbolicLink()) await fs.unlink(file);
@@ -2029,7 +2076,7 @@ export class GitService implements IGitService {
     // `mergeCommitSubject` already flattens the title it builds from; this is the
     // guard that keeps any other caller from reintroducing the break.
     if (/\n\s*\n/.test(commit.subject)) {
-      throw new WorkflowValidationError('merge commit subject must be a single paragraph');
+      throw new VersionControlValidationError('merge commit subject must be a single paragraph');
     }
     const MAX_ATTEMPTS = 3;
     return this.mutex.run(baseWorkspaceId, async () => {
@@ -2044,7 +2091,7 @@ export class GitService implements IGitService {
         const { stdout: dirty } = await this.git(cwd, ['status', '--porcelain=v1', '-z']);
         const unpushed = await this.hasUnpushedCommitsAt(cwd);
         if (parsePorcelainZ(dirty).length > 0 || unpushed) {
-          throw new WorkflowDomainError(
+          throw new VersionControlDomainError(
             `"${targetBranch}" has edits that are not shared yet. Try the merge again once they are saved.`,
             409,
             { kind: 'merge-target-busy', targetBranch },
@@ -2124,8 +2171,10 @@ export class GitService implements IGitService {
         // finalize the row (a transient database fault between the push and the
         // update) has one, and it is the only place its file list survives — so
         // it is looked for rather than assumed absent (cubic P2 on #347).
-        const { stdout: staged } = await this.git(cwd, ['diff', '--cached', '--name-only']);
-        if (staged.trim() === '') {
+        // NUL-delimited and with renames as a delete plus an add, so every path
+        // the merge touches is named verbatim, both ends of a rename included.
+        const { stdout: staged } = await this.git(cwd, ['diff', '--cached', '--name-only', '--no-renames', '-z']);
+        if (staged === '') {
           const { stdout: sha } = await this.git(cwd, ['rev-parse', 'HEAD']);
           await this.git(cwd, ['merge', '--abort']).catch(() => undefined);
           const own =
@@ -2145,6 +2194,10 @@ export class GitService implements IGitService {
 
         try {
           await this.git(cwd, ['push', 'origin', `HEAD:refs/heads/${targetBranch}`]);
+          // This merge commit is provisional until its push lands: a rejected
+          // push resets the checkout and the next attempt commits anew. So it
+          // is reported here, once, for the attempt that landed on the target.
+          this.landed(baseWorkspaceId, targetBranch, user, staged.split('\0').filter(Boolean));
           this.accessControl?.invalidate(baseWorkspaceId);
           // A commit of this request's own, with the subject the reader verifies.
           return { kind: 'merged' as const, sha: sha.trim(), mergeCommit: sha.trim() };
@@ -2453,7 +2506,7 @@ export class GitService implements IGitService {
 
   /**
    * Rebase the checked-out branch onto `remoteRef`, turning a content
-   * conflict into the typed error the workflow layer queues recovery for.
+   * conflict into the typed error the version-control layer queues recovery for.
    * Shared by `pull` and `syncFromRemote` so the two cannot drift.
    */
   private async rebaseOntoRemote(
@@ -2535,7 +2588,7 @@ export class GitService implements IGitService {
         abortSucceeded = false;
       });
       if (abortSucceeded && conflictedPaths.length > 0) {
-        // Typed so the workflow layer can queue background recovery — this
+        // Typed so the version-control layer can queue background recovery — this
         // divergence never resolves on its own (every retry pull hits the
         // same conflict) and the unpushed local commits are someone's saved
         // content stuck violating save=share.
@@ -3029,7 +3082,7 @@ export class GitService implements IGitService {
           // Only the genuinely empty separator lines are skipped.
           const touched = nameLine.endsWith('\r') ? nameLine.slice(0, -1) : nameLine;
           if (touched && touched !== repoRelativePath) {
-            throw new WorkflowValidationError(
+            throw new VersionControlValidationError(
               `"${relativePath}" is a directory at that point in history — history is served per file`,
             );
           }
@@ -3064,7 +3117,7 @@ export class GitService implements IGitService {
   ): Promise<string> {
     assertValidRelativePath(relativePath);
     if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-      throw new WorkflowValidationError('invalid commit sha');
+      throw new VersionControlValidationError('invalid commit sha');
     }
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
@@ -3119,7 +3172,7 @@ export class GitService implements IGitService {
   ): Promise<{ baseline: string | null; current: string | null }> {
     assertValidRelativePath(relativePath);
     if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-      throw new WorkflowValidationError('invalid commit sha');
+      throw new VersionControlValidationError('invalid commit sha');
     }
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
@@ -3160,7 +3213,7 @@ export class GitService implements IGitService {
     assertValidBranchName(fromBranch);
     assertValidBranchName(toBranch);
     if (fromBranch === toBranch) {
-      throw new WorkflowValidationError('from and to branches must differ');
+      throw new VersionControlValidationError('from and to branches must differ');
     }
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
@@ -3291,7 +3344,7 @@ export class GitService implements IGitService {
     if (opts.at) {
       for (const sha of [opts.at.baseSha, opts.at.headSha]) {
         if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-          throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+          throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
         }
       }
     }
@@ -3411,7 +3464,7 @@ export class GitService implements IGitService {
    * side for a merge commit, and for a squashed or fast-forwarded commit it is
    * simply the commit before — the same answer either way.
    *
-   * Throws `WorkflowValidationError` whenever the recorded commit cannot be
+   * Throws `VersionControlValidationError` whenever the recorded commit cannot be
    * PROVEN to be this request's own merge commit — see
    * {@link appliedChangeShas}. Every caller reads that as "the file set could
    * not be resolved" and falls back to its own fail-closed answer, which is what
@@ -3424,7 +3477,7 @@ export class GitService implements IGitService {
   ): Promise<{ baseSha: string; headSha: string }> {
     const { mergeSha, number } = applied;
     if (!/^[0-9a-f]{40,64}$/.test(mergeSha)) {
-      throw new WorkflowValidationError(`invalid commit sha: ${mergeSha}`);
+      throw new VersionControlValidationError(`invalid commit sha: ${mergeSha}`);
     }
     const revParse = async (rev: string): Promise<string | null> => {
       try {
@@ -3447,7 +3500,7 @@ export class GitService implements IGitService {
     // or a message that does not name the request) never becomes it, and is
     // reported as a mismatch the caller may remember.
     if (!(await revParse(`${mergeSha}^{commit}`))) {
-      throw new WorkflowValidationError(
+      throw new VersionControlValidationError(
         `commit ${mergeSha} is not in this clone, so change request #${number} cannot be read from it yet`,
       );
     }
@@ -3612,7 +3665,7 @@ export class GitService implements IGitService {
     // concurrent `fetch --prune origin` (`ensureRemotesFetched` and
     // `fetchPrRefs` both run outside this mutex, deliberately) can drop a
     // remote-tracking ref between the two, and re-resolving inside the mutex
-    // would then throw `WorkflowValidationError` — which `touchedPathsFor`
+    // would then throw `VersionControlValidationError` — which `touchedPathsFor`
     // swallows into an empty touched-path set, i.e. exactly the change
     // request missing from its own author's tree that the skip is guarded
     // against. The commits stay readable whatever happens to the ref names.
@@ -3792,7 +3845,7 @@ export class GitService implements IGitService {
   ): Promise<{ mergeBaseSha: string | null; behind: boolean }> {
     for (const sha of [at.baseSha, at.headSha]) {
       if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-        throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+        throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
       }
     }
     const cwd = await this.repoDir(workspaceId);
@@ -3835,7 +3888,7 @@ export class GitService implements IGitService {
   ): Promise<string[]> {
     for (const sha of [fromSha, toSha]) {
       if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-        throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+        throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
       }
     }
     const cwd = await this.repoDir(workspaceId);
@@ -3866,7 +3919,7 @@ export class GitService implements IGitService {
     assertValidBranchName(baseBranch);
     assertValidRelativePath(relativePath);
     if (!/^[0-9a-f]{40,64}$/.test(sha)) {
-      throw new WorkflowValidationError(`invalid commit sha: ${sha}`);
+      throw new VersionControlValidationError(`invalid commit sha: ${sha}`);
     }
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {
@@ -3876,7 +3929,7 @@ export class GitService implements IGitService {
         await this.git(cwd, ['merge-base', '--is-ancestor', sha, baseRef]);
       } catch (err) {
         if ((err as { exitCode?: number }).exitCode === 1) {
-          throw new WorkflowDomainError(
+          throw new VersionControlDomainError(
             `That commit is not part of "${baseBranch}" — it is not this request's fork point.`,
             404,
           );
@@ -4086,7 +4139,7 @@ export class GitService implements IGitService {
     try {
       return await this.publishedPrEnds(cwd, baseBranch, headBranch);
     } catch (err) {
-      if (err instanceof WorkflowValidationError) return null;
+      if (err instanceof VersionControlValidationError) return null;
       throw err;
     }
   }
@@ -4143,7 +4196,7 @@ export class GitService implements IGitService {
         if (!(err instanceof GitRunError) || err.timedOut || err.exitCode !== 1) throw err;
       }
     }
-    throw new WorkflowValidationError(`unknown branch: ${branch}`);
+    throw new VersionControlValidationError(`unknown branch: ${branch}`);
   }
 
   /**
@@ -4182,7 +4235,7 @@ export class GitService implements IGitService {
         // Try the next candidate.
       }
     }
-    throw new WorkflowValidationError(`unknown branch: ${branch}`);
+    throw new VersionControlValidationError(`unknown branch: ${branch}`);
   }
 
   // ── internals ──────────────────────────────────────────────────────────
@@ -4341,7 +4394,7 @@ export class GitService implements IGitService {
       throw err;
     }
     if (kind === 'tree') {
-      throw new WorkflowValidationError(
+      throw new VersionControlValidationError(
         `"${displayPath}" is a directory at that point in history — history is served per file`,
       );
     }
@@ -4497,7 +4550,7 @@ export class GitService implements IGitService {
   ): Promise<{ bytes: Buffer; blobId: string } | null> {
     assertValidRelativePath(relativePath);
     if (!/^[a-f0-9]{7,40}$/i.test(sha)) {
-      throw new WorkflowValidationError('invalid commit sha');
+      throw new VersionControlValidationError('invalid commit sha');
     }
     const repoRelativePath = this.stripRepoPrefix(relativePath);
     return this.mutex.run(workspaceId, async () => {

package/src/modules/{workflow → version-control}/git/node-git-runner.ts

@@ -65,7 +65,7 @@ const MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
  * The environment every invocation runs under, laid OVER whatever the caller
  * supplied so that none of it can be unset per call. Only what is safe for
  * EVERY caller belongs here. `GIT_LITERAL_PATHSPECS` does not: it is the
- * workflow service's answer to raw user paths, and the startup runner spells
+ * version-control service's answer to raw user paths, and the startup runner spells
  * its literal paths with `:(literal)` magic, which that setting would disable
  * — so each of them sets its own, per call.
  *

package/src/modules/{workflow → version-control}/git/pull-request.service.ts

@@ -19,7 +19,7 @@ import { changeRequests } from '../../database/index.js';
 import type { WorkspaceService } from '../../workspace/index.js';
 import type { IAccessControl } from '../../access/index.js';
 import { AccessUnreadableError } from '../../access-model/index.js';
-import { AppliedChangeMismatchError, WorkflowValidationError } from '../../../shared/domain-errors.js';
+import { AppliedChangeMismatchError, VersionControlValidationError } from '../../../shared/domain-errors.js';
 import { canonicalEmail, hashEmail } from '../../../shared/email-identity.js';
 import { changeRequestLink, changeRequestLinkBase } from './change-request-link.js';
 
@@ -141,9 +141,9 @@ export function changeSourceFor(row: {
 }
 
 /**
- * The slice of the review-workflow service this module needs to compose detail
+ * The slice of the change-request-review service this module needs to compose detail
  * responses. Kept narrow (just what `getPrDetail` stitches in) so the PR
- * service doesn't depend on the full workflow interface — and so the circular
+ * service doesn't depend on the full version-control interface — and so the circular
  * relationship in the composition root is explicit and minimal.
  */
 export interface PrDetailEnricher {
@@ -183,7 +183,7 @@ export interface PrDetailEnricher {
  * The durable facts (pairing, title/body, author, state) live in the row; the
  * head/base SHAs, file list, and diffs are derived live from git so a new commit
  * or force-push is always reflected. Per-file approvals and the merge gate
- * are stitched in from the review-workflow service (also DB-backed).
+ * are stitched in from the change-request-review service (also DB-backed).
  */
 export class PullRequestService implements IPullRequestService {
   /**
@@ -223,9 +223,9 @@ export class PullRequestService implements IPullRequestService {
   >();
 
   /**
-   * Optional — set by the composition root after ReviewWorkflowService exists.
+   * Optional — set by the composition root after ChangeRequestReviewService exists.
    * Setter-based wiring (not constructor) because PullRequestService is itself
-   * a dependency of ReviewWorkflowService's routes, and we want both to live
+   * a dependency of ChangeRequestReviewService's routes, and we want both to live
    * in the same container without a forward-declaration dance.
    */
   private detailEnricher: PrDetailEnricher | null = null;
@@ -354,7 +354,7 @@ export class PullRequestService implements IPullRequestService {
       // to shout about — it is this row's turn to be fetched, and the next list
       // read answers it. Warning per request on that would be the log flood the
       // network flood came with.
-      if (err instanceof WorkflowValidationError) {
+      if (err instanceof VersionControlValidationError) {
         log.debug(`${what} could not resolve ${where}; answering no touched paths:`, { err });
       } else {
         log.warn(`${what} failed for ${where}:`, { err });
@@ -610,7 +610,7 @@ export class PullRequestService implements IPullRequestService {
 
   async getPr(prNumber: number): Promise<PullRequestSummary | null> {
     if (!Number.isInteger(prNumber) || prNumber <= 0) {
-      throw new WorkflowValidationError('PR number must be a positive integer');
+      throw new VersionControlValidationError('PR number must be a positive integer');
     }
     const row = await this.findRow(prNumber);
     if (!row) return null;
@@ -677,7 +677,7 @@ export class PullRequestService implements IPullRequestService {
     opts: { fresh?: boolean; workspaceId?: string; viewerEmail?: string; patches?: boolean } = {},
   ): Promise<PullRequestDetail | null> {
     if (!Number.isInteger(prNumber) || prNumber <= 0) {
-      throw new WorkflowValidationError('PR number must be a positive integer');
+      throw new VersionControlValidationError('PR number must be a positive integer');
     }
     const generation = this.cacheGeneration;
     const row = await this.findRow(prNumber);
@@ -798,7 +798,7 @@ export class PullRequestService implements IPullRequestService {
       // a branch not yet published or a clone not yet caught up, and presenting
       // a live proposal as one that changes nothing would tell a reviewer the
       // opposite of the truth.
-      if (!(err instanceof WorkflowValidationError) || row.state === 'open') throw err;
+      if (!(err instanceof VersionControlValidationError) || row.state === 'open') throw err;
       log.warn(
         `change request #${prNumber} is ${row.state} and can no longer be diffed; answering from its row alone:`,
         { err },
@@ -835,7 +835,7 @@ export class PullRequestService implements IPullRequestService {
       })),
     );
 
-    // Approvals come from our own DB via the review-workflow service. The
+    // Approvals come from our own DB via the change-request-review service. The
     // enricher is optional — if it isn't wired yet (startup ordering, isolated
     // tests) we return an empty list rather than blocking the fetch.
     const approvals = this.detailEnricher
@@ -953,7 +953,7 @@ export class PullRequestService implements IPullRequestService {
       viewerIsAuthor,
       viewerCanDelete,
       // Who may close a request may also change what it asks: the same
-      // grants, so the same predicate (`WorkflowService.updateChangeRequest`
+      // grants, so the same predicate (`VersionControlService.updateChangeRequest`
       // enforces it).
       viewerCanEdit: viewerCanCancel,
     };