@bevel-software/platform-core-backend 0.4.0 → 0.4.1

package/src/modules/workflow/git/git.service.ts

@@ -1403,12 +1403,23 @@ export class GitService implements IGitService {
         // A failed rebase leaves the repo in a "REBASE_HEAD" / detached-apply state,
         // which makes every subsequent git command behave unexpectedly. Return the
         // working tree to a clean state before surfacing the original error.
-        await this.git(cwd, ['rebase', '--abort']).catch(() => undefined);
-        if (conflictedPaths.length > 0) {
+        let abortSucceeded = true;
+        await this.git(cwd, ['rebase', '--abort']).catch(() => {
+          abortSucceeded = false;
+        });
+        if (abortSucceeded && conflictedPaths.length > 0) {
           // Typed so the workflow layer can queue background recovery — this
           // divergence never resolves on its own (every retry pull hits the
           // same conflict) and the unpushed local commits are someone's saved
           // content stuck violating save=share.
+          //
+          // Gated on the abort succeeding: a failed abort means either no
+          // rebase was ever active (the unmerged paths pre-date this pull —
+          // some earlier operation left the index broken) or the clone is in
+          // a state git itself can't unwind. Queueing recovery there would
+          // point the worker's commitFile at a repo mid-conflict, risking a
+          // commit full of conflict markers — surface the raw error instead
+          // and leave diagnosis to a human.
           throw new PullRebaseConflictError(
             branch,
             conflictedPaths,

package/src/modules/workflow/workflow.service.ts

@@ -327,10 +327,13 @@ export class WorkflowService implements IWorkflowService {
    * `needs_attention` row: once the ladder has escalated to a human, more
    * agent runs on the same divergence are just a loop.
    *
-   * One row, first conflicted path as the representative: the recovery
+   * One row, smallest conflicted path as the representative: the recovery
    * agent's job is "bring the BRANCH into a pushable state", so one ladder
    * per divergence — not one per conflicted file, which would multiply
-   * agent runs for a single underlying conflict.
+   * agent runs for a single underlying conflict. Sorted so the choice is
+   * stable across retries regardless of how the caller ordered the paths —
+   * a shifting representative would slip past `enqueueIfAbsent`'s
+   * per-(workspace, branch, path) dedup and start a second ladder.
    *
    * Best-effort by design — the caller is already surfacing the conflict
    * error; a queue hiccup must not mask it.
@@ -344,7 +347,7 @@ export class WorkflowService implements IWorkflowService {
       const queued = await this.pendingCommits.enqueueIfAbsent({
         workspaceId,
         branch: err.branch,
-        path: err.conflictedPaths[0],
+        path: [...err.conflictedPaths].sort()[0],
         authorEmail: user?.email ?? RECOVERY_BOT_EMAIL,
         authorName: user?.name ?? RECOVERY_BOT_NAME,
       });
@@ -1418,16 +1421,19 @@ export class WorkflowService implements IWorkflowService {
     // this a read right after a merge misses the just-merged change. Best-effort:
     // the merge already succeeded on origin, so a pull hiccup must not fail the
     // response (a later fetch/pull reconciles).
+    let targetWorkspaceId: string | undefined;
     try {
       const targetWorkspace = await this.workspaceService.getOrCreateForBranch(baseBranch);
+      targetWorkspaceId = targetWorkspace.id;
       await this.git.pull(targetWorkspace.id);
     } catch (err) {
       // Still best-effort for the merge response (the merge already landed
       // on origin) — but a rebase CONFLICT here means the target workspace
       // is stranded (local commits vs origin, never self-heals), so queue
-      // the background recovery ladder before shrugging.
-      if (err instanceof PullRebaseConflictError) {
-        const targetWorkspaceId = encodeURIComponent(baseBranch);
+      // the background recovery ladder before shrugging. A conflict can
+      // only have come from the pull, so the workspace id is always set on
+      // this arm — the guard just satisfies the narrowing.
+      if (err instanceof PullRebaseConflictError && targetWorkspaceId) {
         await this.queuePullConflictRecovery(targetWorkspaceId, err, user);
       }
       console.warn(