canopycms 0.0.64 → 0.0.65

package/dist/api/assets.js

@@ -256,6 +256,15 @@ async function serveLazyTransform(assetStore, key) {
     if (meta.kind !== 'raster') {
         return { ok: false, status: 400, error: 'Not a raster asset - svg/pdf are served statically' };
     }
+    // The slug is decorative in the URL but load-bearing in the stored key, so
+    // it must equal the asset's real slug: `[a-z0-9-]+` is all the parser can
+    // enforce, and every other string that passes it aliases the same image into
+    // a new cache key and a new stored object. Canopy's own URLs always carry
+    // `meta.slug` (assets/asset-url.ts). Mirrors the prod transform Lambda's
+    // handler.ts check - the two paths must agree, or dev accepts URLs prod 404s.
+    if (parsed.slug !== meta.slug) {
+        return { ok: false, status: 404, error: 'Not found' };
+    }
     // When the URL omits an explicit `f=` format, the transform preserves the
     // source format, so the URL's `{ext}` must match the source's real ext
     // exactly - the parser alone can't check this (it doesn't know the source

package/dist/auth/file-based-auth-cache.js

@@ -189,10 +189,22 @@ export async function writeAuthCacheSnapshot(cachePath, files) {
         await fs.writeFile(tmpPath, JSON.stringify(data, null, 2), 'utf-8');
         await fs.rename(tmpPath, finalPath);
     }
-    // Atomic symlink swap: create temp symlink, rename over current
+    // Atomic symlink swap: create temp symlink, rename over current.
+    //
+    // The target MUST be relative (the bare `snapshot-<ts>` basename), because
+    // writer and reader do not always share a mount namespace. In prod the EC2
+    // worker mounts the EFS filesystem root and writes through
+    // CANOPYCMS_WORKSPACE_ROOT=/mnt/efs/workspace (cachePath
+    // /mnt/efs/workspace/.cache), while the CMS Lambda mounts the /workspace
+    // access point at /mnt/efs and reads the SAME directory as /mnt/efs/.cache.
+    // An absolute target recorded by one is a nonexistent path to the other -
+    // `resolveActiveCacheDir`'s escape guard then correctly rejects it and falls
+    // back to the flat layout, where the worker never writes, leaving the Lambda
+    // with a permanently empty cache. A relative target resolves against
+    // whichever cachePath the reader was given, so it is correct from both.
     const currentLink = path.join(cachePath, 'current');
     const tmpLink = path.join(cachePath, `current-${timestamp}`);
-    await fs.symlink(snapshotDir, tmpLink);
+    await fs.symlink(path.basename(snapshotDir), tmpLink);
     await fs.rename(tmpLink, currentLink);
     // Clean up old snapshots (keep the 2 most recent)
     await cleanupOldSnapshots(cachePath, 2);

package/dist/branch-health.d.ts

@@ -34,6 +34,26 @@ export interface BranchHealthEntry {
      * repair-content-duplicates admin action.
      */
     duplicateContentIds?: DuplicateContentId[];
+    /**
+     * healthy only, and only when true: this clone has an interrupted rebase on
+     * disk (`.git/rebase-merge` / `.git/rebase-apply`).
+     *
+     * Deliberately an advisory flag on `healthy` rather than its own
+     * `BranchHealthKind`, for the same reason `duplicateContentIds` is: the
+     * branch's metadata is intact and the state is USUALLY transient -- the
+     * worker's sync loop aborts an interrupted rebase at the top of its next
+     * per-branch pass. What this flag buys is visibility in the window BEFORE
+     * that pass runs, where the branch otherwise scanned as unqualified
+     * `healthy` while being skipped as dirty every cycle.
+     *
+     * NOT self-recovering in every case, so a persisting value is the real
+     * signal and needs an operator. Two ways it sticks: the abort itself keeps
+     * failing, or the branch's status moved off `editing` after it wedged --
+     * the rebase loop filters by status BEFORE reaching the recovery step, so a
+     * clone that crashed mid-rebase and was then submitted or archived is never
+     * revisited, and this flag is the only thing that surfaces it.
+     */
+    rebaseInProgress?: boolean;
     /** corrupt-metadata only: message describing why the file failed to load. */
     parseError?: string;
     /** corrupt-metadata only: branch.json's mtime, ISO. Omitted if branch.json itself couldn't be stat'd. */

package/dist/branch-health.js

@@ -4,6 +4,7 @@ import { BranchMetadataFileManager, BranchMetadataCorruptError } from './branch-
 import { ContentIdIndex } from './content-id-index.js';
 import { sanitizeBranchName } from './paths/branch-name.js';
 import { getErrorMessage, isNodeError, isNotFoundError } from './utils/error.js';
+import { isRebaseInProgress } from './utils/git.js';
 /**
  * The on-disk path of the cross-process provisioning lock marker for a
  * given branch directory, matching `branch-workspace.ts`'s
@@ -139,13 +140,17 @@ export async function scanBranchHealth(baseRoot, opts) {
             continue;
         }
         if (meta) {
-            const duplicateContentIds = await scanDuplicateContentIds(branchRoot, contentRootName);
+            const [duplicateContentIds, rebaseInProgress] = await Promise.all([
+                scanDuplicateContentIds(branchRoot, contentRootName),
+                isRebaseInProgress(branchRoot),
+            ]);
             entries.push({
                 dirName,
                 kind: 'healthy',
                 ...(isBaseBranch ? { isBaseBranch } : {}),
                 branch: meta.branch,
                 ...(duplicateContentIds.length ? { duplicateContentIds } : {}),
+                ...(rebaseInProgress ? { rebaseInProgress } : {}),
             });
             continue;
         }

package/dist/cli/cli.d.ts

@@ -37,6 +37,23 @@ export declare function parseAuthFlag(value: string | boolean | undefined): Auth
 export declare function parseDualBuildFlag(value: unknown): boolean | undefined;
 declare const SYNC_SUBCOMMANDS: readonly ["push", "pull", "both", "abort"];
 type SyncSubcommand = (typeof SYNC_SUBCOMMANDS)[number];
+/** The auth modes `worker run-once` knows how to build a plugin for. */
+export declare const KNOWN_AUTH_MODES: readonly ["clerk", "dev"];
+export type KnownAuthMode = (typeof KNOWN_AUTH_MODES)[number];
+/**
+ * Whether `CANOPY_AUTH_MODE` names a provider the CLI can actually construct.
+ *
+ * Pure and exported so it is testable: the dispatch below branches on 'clerk'
+ * and 'dev' only, and the catch around plugin loading fires solely on an
+ * IMPORT failure -- so before this guard existed, any other value (a typo,
+ * wrong casing like 'Clerk', a stale value from another system) selected no
+ * plugin, skipped the auth refresh entirely, and let the command run to "Done"
+ * with exit code 0. A cron'd `CANOPY_AUTH_MODE=clerk canopycms worker
+ * run-once` that became `Clerk` refreshed nothing for as long as the typo
+ * survived, while the cache aged and a user removed from the Clerk org kept
+ * editor access.
+ */
+export declare function isKnownAuthMode(value: string): value is KnownAuthMode;
 /** Resolve sync subcommand from positional arg. Returns null if missing or invalid. Exported for testing. */
 export declare function resolveSyncSubcommand(sub: string | undefined): SyncSubcommand | null;
 export {};

package/dist/cli/cli.js

@@ -592,7 +592,7 @@ async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLo
 async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 6e4, logger = nullLogger) {
   const now = Date.now();
   let cleaned = 0;
-  for (const subdir of ["completed", "failed"]) {
+  for (const subdir of ["completed", "failed", "corrupt"]) {
     const dir = path6.join(taskDir, subdir);
     let files;
     try {
@@ -810,6 +810,13 @@ function configImportPath(appDir, subdirs) {
   const totalDepth = appDepth + subdirs;
   return "../".repeat(totalDepth) + "canopycms.config";
 }
+async function firstExistingPath(projectDir, candidates) {
+  for (const candidate of candidates) {
+    if (await filePathExists2(path7.join(projectDir, candidate)))
+      return candidate;
+  }
+  return null;
+}
 async function init(options) {
   const { projectDir, mode, appDir, ai, force, nonInteractive } = options;
   const writeOpts = { force, nonInteractive };
@@ -864,15 +871,35 @@ async function init(options) {
     await writeFile(path7.join(projectDir, appDir, "ai/config.ts"), await aiConfig2(), writeOpts);
     await writeFile(path7.join(projectDir, appDir, `ai/[...path]/${serverRouteExt}`), await aiRoute2({ configImport: configImportPath(appDir, 2) }), writeOpts);
   }
-  await writeFile(path7.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
-  await writeFile(path7.join(projectDir, "middleware.ts"), await middleware2({ authProvider }), writeOpts);
+  const existingJsConfig = await firstExistingPath(projectDir, [
+    "next.config.js",
+    "next.config.mjs"
+  ]);
+  if (existingJsConfig) {
+    p.note([
+      `Found ${existingJsConfig}, which Next loads in preference to next.config.ts.`,
+      "Left it untouched rather than writing a second config Next would ignore.",
+      "",
+      "Wrap your existing config by hand:",
+      "",
+      "  import { withCanopy } from 'canopycms-next/config'",
+      "  export default withCanopy(yourConfig)"
+    ].join("\n"), "Manual step");
+  } else {
+    await writeFile(path7.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
+  }
+  await writeFile(path7.join(projectDir, path7.dirname(appDir), "middleware.ts"), await middleware2({ authProvider }), writeOpts);
   const gitignorePath = path7.join(projectDir, ".gitignore");
+  const CANOPY_GITIGNORE_BLOCK = "# CanopyCMS\n.canopy-dev/\n";
   if (await filePathExists2(gitignorePath)) {
     const content = await fs6.readFile(gitignorePath, "utf-8");
     if (!content.includes(".canopy-dev")) {
-      await fs6.appendFile(gitignorePath, "\n# CanopyCMS\n.canopy-dev/\n");
+      await fs6.appendFile(gitignorePath, `
+${CANOPY_GITIGNORE_BLOCK}`);
       p.log.success("updated: .gitignore");
     }
+  } else {
+    await writeFile(gitignorePath, CANOPY_GITIGNORE_BLOCK, writeOpts);
   }
   const packages = authProvider === "clerk" ? "canopycms canopycms-next canopycms-auth-clerk canopycms-auth-dev" : "canopycms canopycms-next canopycms-auth-dev";
   p.note([
@@ -11196,6 +11223,10 @@ async function requireProjectRoot(command) {
   }
   return root;
 }
+var KNOWN_AUTH_MODES = ["clerk", "dev"];
+function isKnownAuthMode(value) {
+  return KNOWN_AUTH_MODES.includes(value);
+}
 function resolveSyncSubcommand(sub) {
   if (sub && SYNC_SUBCOMMANDS.includes(sub))
     return sub;
@@ -11287,6 +11318,10 @@ async function main() {
       process.exit(1);
     }
     const authMode = process.env.CANOPY_AUTH_MODE || "dev";
+    if (!isKnownAuthMode(authMode)) {
+      console.error(`Unknown CANOPY_AUTH_MODE "${authMode}" \u2014 expected one of: ${KNOWN_AUTH_MODES.join(", ")}. No auth plugin was loaded, so the auth cache will NOT be refreshed.`);
+      process.exitCode = 1;
+    }
     let authPlugin;
     try {
       if (authMode === "clerk") {
@@ -11398,6 +11433,8 @@ if (isDirectRun) {
   });
 }
 export {
+  KNOWN_AUTH_MODES,
+  isKnownAuthMode,
   parseArgs,
   parseAuthFlag,
   parseDualBuildFlag,

package/dist/cli/init.js

@@ -1117,7 +1117,7 @@ async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLo
 async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 6e4, logger = nullLogger) {
   const now = Date.now();
   let cleaned = 0;
-  for (const subdir of ["completed", "failed"]) {
+  for (const subdir of ["completed", "failed", "corrupt"]) {
     const dir = path6.join(taskDir, subdir);
     let files;
     try {
@@ -1586,6 +1586,13 @@ function configImportPath(appDir, subdirs) {
   const totalDepth = appDepth + subdirs;
   return "../".repeat(totalDepth) + "canopycms.config";
 }
+async function firstExistingPath(projectDir, candidates) {
+  for (const candidate of candidates) {
+    if (await filePathExists(path7.join(projectDir, candidate)))
+      return candidate;
+  }
+  return null;
+}
 async function init(options) {
   const { projectDir, mode, appDir, ai, force, nonInteractive } = options;
   const writeOpts = { force, nonInteractive };
@@ -1640,15 +1647,35 @@ async function init(options) {
     await writeFile(path7.join(projectDir, appDir, "ai/config.ts"), await aiConfig2(), writeOpts);
     await writeFile(path7.join(projectDir, appDir, `ai/[...path]/${serverRouteExt}`), await aiRoute2({ configImport: configImportPath(appDir, 2) }), writeOpts);
   }
-  await writeFile(path7.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
-  await writeFile(path7.join(projectDir, "middleware.ts"), await middleware2({ authProvider }), writeOpts);
+  const existingJsConfig = await firstExistingPath(projectDir, [
+    "next.config.js",
+    "next.config.mjs"
+  ]);
+  if (existingJsConfig) {
+    p.note([
+      `Found ${existingJsConfig}, which Next loads in preference to next.config.ts.`,
+      "Left it untouched rather than writing a second config Next would ignore.",
+      "",
+      "Wrap your existing config by hand:",
+      "",
+      "  import { withCanopy } from 'canopycms-next/config'",
+      "  export default withCanopy(yourConfig)"
+    ].join("\n"), "Manual step");
+  } else {
+    await writeFile(path7.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
+  }
+  await writeFile(path7.join(projectDir, path7.dirname(appDir), "middleware.ts"), await middleware2({ authProvider }), writeOpts);
   const gitignorePath = path7.join(projectDir, ".gitignore");
+  const CANOPY_GITIGNORE_BLOCK = "# CanopyCMS\n.canopy-dev/\n";
   if (await filePathExists(gitignorePath)) {
     const content = await fs6.readFile(gitignorePath, "utf-8");
     if (!content.includes(".canopy-dev")) {
-      await fs6.appendFile(gitignorePath, "\n# CanopyCMS\n.canopy-dev/\n");
+      await fs6.appendFile(gitignorePath, `
+${CANOPY_GITIGNORE_BLOCK}`);
       p.log.success("updated: .gitignore");
     }
+  } else {
+    await writeFile(gitignorePath, CANOPY_GITIGNORE_BLOCK, writeOpts);
   }
   const packages = authProvider === "clerk" ? "canopycms canopycms-next canopycms-auth-clerk canopycms-auth-dev" : "canopycms canopycms-next canopycms-auth-dev";
   p.note([

package/dist/cli/template-files/Dockerfile.cms.template

@@ -1,4 +1,10 @@
-FROM public.ecr.aws/docker/library/node:20-slim AS builder
+# Node 22. Node 20 reached upstream EOL on 2026-04-30, so it receives no
+# further security patches -- and the CMS Lambda runs this image.
+#
+# NOTE: the published canopycms packages declare `engines.node: ">=18"`,
+# so this is not an installability floor -- it is the runtime CanopyCMS is
+# actually built and tested on (.nvmrc is v22, as is the transform Lambda).
+FROM public.ecr.aws/docker/library/node:22-slim AS builder
 WORKDIR /app
 {{DOCKER_COPY}}
 # If your app uses `file:` dependencies (e.g. vendored tarballs under vendor/),
@@ -53,7 +59,7 @@ ARG NEXT_PUBLIC_CANOPY_MODE=dev
 ENV NEXT_PUBLIC_CANOPY_MODE=$NEXT_PUBLIC_CANOPY_MODE
 RUN {{DOCKER_BUILD}}
 
-FROM public.ecr.aws/docker/library/node:20-slim AS runner
+FROM public.ecr.aws/docker/library/node:22-slim AS runner
 # Git is required by CanopyCMS for branch operations
 RUN apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*
 # The runtime user's uid differs from the uid that owns EFS workspace files

package/dist/cli/template-files/cms-stack.ts.template

@@ -107,13 +107,35 @@ export class CmsStack extends Stack {
       reservedConcurrency: 10,
     })
 
-    // Media support (uploads, on-demand image transforms). Uncomment to give
-    // the deployed editor an asset backend, pass `assetBucket:
-    // assetSupport.bucket` to CanopyCmsService above, and wire
-    // `assetSupport.cloudFrontBehaviors` into the distribution below. See the
-    // assets section of docs/deploying-to-aws.md.
+    // Media support (uploads, on-demand image transforms). To enable it:
     //
-    // const assetSupport = new AssetSupport(this, 'Assets', {})
+    //   1. add `AssetSupport` to the `canopycms-cdk` import at the top;
+    //   2. uncomment the block below, moving it ABOVE `cmsService` (it has to
+    //      exist before you can pass its bucket);
+    //   3. pass `assetBucket: assetSupport.bucket` to CanopyCmsService;
+    //   4. pass the behaviors to CanopyCmsDistribution, `/assets/t/*` FIRST
+    //      (CloudFront matches in order, so the general pattern would
+    //      otherwise swallow the transform one):
+    //
+    //        additionalBehaviors: {
+    //          '/assets/t/*': assetSupport.assetBehaviors().assetsTransform,
+    //          '/assets/*': assetSupport.assetBehaviors().assets,
+    //        },
+    //
+    // `editorOrigins` is REQUIRED: it is the S3 CORS allowlist for the
+    // editor's presigned uploads, so it must list the origin the editor is
+    // served from. Include http://localhost:3000 only if you upload from a
+    // local dev editor against this bucket.
+    //
+    // Run `pnpm --filter canopycms-cdk run build:lambda` before deploying --
+    // the transform Lambda needs its native sharp binary, and the construct
+    // refuses to synth without it.
+    //
+    // See the assets section of docs/deploying-to-aws.md.
+    //
+    // const assetSupport = new AssetSupport(this, 'Assets', {
+    //   editorOrigins: [`https://${props.domainName}`],
+    // })
 
     // CloudFront + Route53, only when a domain is configured. Skipping this
     // leaves `cmsService.functionUrl` as the entry point, which is enough to
@@ -124,6 +146,11 @@ export class CmsStack extends Stack {
         functionUrl: cmsService.functionUrl,
         domainName: props.domainName,
         hostedZoneDomain: props.hostedZoneDomain,
+        // Keep CloudFront's origin read timeout equal to the Lambda's own.
+        // Both default to 60s, so this line changes nothing today -- it is
+        // here so that raising `timeout` above cannot silently leave
+        // CloudFront answering 504 at the edge on requests that succeed.
+        originReadTimeout: cmsService.timeout,
       })
     }
   }

package/dist/cli/template-files/deploy-cms.yml.template

@@ -39,10 +39,15 @@
 #   3. Install the CDK dependencies the app entry point needs:
 #      `{{ADD_DEV}} canopycms canopycms-cdk aws-cdk-lib constructs tsx aws-cdk`
 #   4. Set these repository secrets (Settings -> Secrets and variables ->
-#      Actions -> Secrets). Every one of them is read by `required()` in
-#      infrastructure/bin/app.ts, so a missing value fails the deploy at synth:
+#      Actions -> Secrets). All but AWS_DEPLOY_ROLE_ARN are read by `required()`
+#      in infrastructure/bin/app.ts, so a missing value fails the deploy at
+#      synth; a missing role ARN fails earlier, at the AWS credentials step:
 #        AWS_DEPLOY_ROLE_ARN            OIDC role ARN from step 2
-#        GITHUB_TOKEN_SECRET_ARN        FULL Secrets Manager ARN (with suffix)
+#        CANOPY_GITHUB_TOKEN_SECRET_ARN  FULL Secrets Manager ARN (with suffix)
+#          NOTE: the CANOPY_ prefix is required, not cosmetic. GitHub rejects any
+#          Actions secret whose name starts with GITHUB_ (a reserved prefix), so
+#          the otherwise-obvious GITHUB_TOKEN_SECRET_ARN cannot be created at all.
+#          The env var handed to CDK below keeps the unprefixed name.
 #        CLERK_SECRET_KEY_SECRET_ARN    FULL Secrets Manager ARN (with suffix)
 #        CLERK_JWT_KEY                  Clerk's public JWKS PEM
 #   5. Set these repository variables (same page -> Variables):
@@ -64,6 +69,14 @@ on:
       - 'src/**'
       - 'content/**'
       - 'canopycms.config.ts'
+      # The Next config is what `init-deploy aws` itself tells you to edit for
+      # the dual build, and `public/**` is copied into the runner image (and is
+      # load-bearing for editor/public preview parity). Omitting them meant an
+      # edit shipped days later, piggybacked on an unrelated content change --
+      # so any breakage was attributed to the wrong commit.
+      - 'next.config.*'
+      - 'middleware.ts'
+      - 'public/**'
       - 'Dockerfile.cms'
       - 'infrastructure/**'
       - 'cdk.json'
@@ -89,11 +102,11 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 20
+          node-version: 22
 
       - name: Install dependencies
         run: {{CI_INSTALL}}
@@ -124,7 +137,7 @@ jobs:
           fi
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
         with:
           role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -138,7 +151,7 @@ jobs:
       # in one place and not the other fails the deploy at synth.
       - name: Deploy
         env:
-          GITHUB_TOKEN_SECRET_ARN: ${{ secrets.GITHUB_TOKEN_SECRET_ARN }}
+          GITHUB_TOKEN_SECRET_ARN: ${{ secrets.CANOPY_GITHUB_TOKEN_SECRET_ARN }}
           CLERK_SECRET_KEY_SECRET_ARN: ${{ secrets.CLERK_SECRET_KEY_SECRET_ARN }}
           CLERK_JWT_KEY: ${{ secrets.CLERK_JWT_KEY }}
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ vars.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}

package/dist/dev-content-watcher.d.ts

@@ -15,6 +15,14 @@
  *
  * All logic lives here in the core package; framework adapters just call startDevContentWatcher() once
  * at dev startup. See packages/canopycms-next/src/context-wrapper.ts for the Next wiring.
+ *
+ * ## Divergence is a CONDITION, not an event
+ *
+ * It stays true until someone runs `sync push`, so the two things this module has to get right are
+ * (a) not re-printing the same condition into a scrolling request log, and (b) making the one printing
+ * of it hard to scroll past. Both are handled below by `reportOnce` + the gutter formatting; see
+ * `.claude/future-tasks/dev-divergence-in-app-surface.md` for the in-app surface that would replace
+ * the terminal as the primary home for this.
  */
 import type { CanopyServices } from './services.js';
 import type { DevContentSyncMode } from './config/types.js';
@@ -28,6 +36,8 @@ export interface StartDevContentWatcherOptions {
     /** Warning sink. Defaults to console.warn. */
     warn?: (message: string) => void;
 }
+/** Test-only: dispose every armed watcher and drop all cross-module dedupe state. */
+export declare function resetDevContentWatchersForTests(): void;
 /**
  * Start watching the working-tree content directory for divergence from the served dev branch clone.
  * Returns a disposer that stops the watcher. A no-op (returns immediately) when mode is 'off', when

package/dist/dev-content-watcher.js

@@ -15,35 +15,98 @@
  *
  * All logic lives here in the core package; framework adapters just call startDevContentWatcher() once
  * at dev startup. See packages/canopycms-next/src/context-wrapper.ts for the Next wiring.
+ *
+ * ## Divergence is a CONDITION, not an event
+ *
+ * It stays true until someone runs `sync push`, so the two things this module has to get right are
+ * (a) not re-printing the same condition into a scrolling request log, and (b) making the one printing
+ * of it hard to scroll past. Both are handled below by `reportOnce` + the gutter formatting; see
+ * `.claude/future-tasks/dev-divergence-in-app-surface.md` for the in-app surface that would replace
+ * the terminal as the primary home for this.
  */
 import fsSync from 'node:fs';
 import path from 'node:path';
 import chokidar from 'chokidar';
+import pc from 'picocolors';
 import { operatingStrategy } from './operating-mode/index.js';
 import { getErrorMessage } from './utils/error.js';
 import { diffContentTrees, isContentTreeDiffEmpty } from './sync-core.js';
-const MAX_LISTED_FILES = 10;
-// Dedupe watchers by working-tree content dir so HMR re-evaluating the adapter module (which discards
-// the disposer) doesn't accumulate watchers. This module lives in canopycms/server, so its state
-// survives app-side HMR. Each new start disposes any prior watcher for the same dir.
-const activeWatchers = new Map();
+/**
+ * Per-category cap on listed files. Deliberately small: the block is a prompt to run `sync push`,
+ * not a diff viewer, and a 30-line wall of paths is exactly as easy to scroll past as a 1-line
+ * warning. Each list carries its true count, so nothing is hidden -- only elided.
+ */
+const MAX_LISTED_FILES = 5;
+/**
+ * The registry lives on `globalThis`, NOT in module scope.
+ *
+ * Next's dev server compiles the server graph per route bundle and evaluates each copy in its own
+ * module scope, so a module-level `Map` is re-created empty per bundle -- every copy then believes it
+ * is the first watcher, arms its own, and re-prints the startup warning. (The duplicated
+ * "CanopyCMS dev-auth: Auto-configured ..." line in a dev log is the same effect on a different
+ * module-level latch.) A `globalThis` property is the one thing shared across those evaluations.
+ */
+const REGISTRY_KEY = '__canopycmsDevContentWatchers__';
+function watcherRegistry() {
+    const host = globalThis;
+    const existing = host[REGISTRY_KEY];
+    if (existing)
+        return existing;
+    const created = new Map();
+    host[REGISTRY_KEY] = created;
+    return created;
+}
+/** Test-only: dispose every armed watcher and drop all cross-module dedupe state. */
+export function resetDevContentWatchersForTests() {
+    const registry = watcherRegistry();
+    for (const state of registry.values())
+        state.dispose?.();
+    registry.clear();
+}
+/**
+ * One body line of the notice block. The left gutter (rather than a full box) is deliberate: content
+ * paths are long and unpredictable, and a right border would force either wrapping math or truncation
+ * of the very filenames the block exists to name.
+ */
+function body(line) {
+    const gutter = pc.yellow('|');
+    return line ? `${gutter} ${line}` : gutter;
+}
 function formatList(label, files) {
     if (files.length === 0)
-        return null;
-    const shown = files.slice(0, MAX_LISTED_FILES).join(', ');
-    const extra = files.length > MAX_LISTED_FILES ? `, …(+${files.length - MAX_LISTED_FILES} more)` : '';
-    return `  ${label}: ${shown}${extra}`;
+        return [];
+    const shown = files.slice(0, MAX_LISTED_FILES);
+    const lines = [body(pc.bold(`${label} (${files.length})`)), ...shown.map((f) => body(`  ${f}`))];
+    if (files.length > shown.length) {
+        lines.push(body(pc.dim(`  +${files.length - shown.length} more`)));
+    }
+    return lines;
 }
 function formatDivergenceWarning(branch, diff) {
-    const lines = [
-        `CanopyCMS: working-tree content has diverged from the dev branch clone "${branch}" — the dev ` +
-            'server is serving stale content. Run `npx canopycms sync push` to update it ' +
-            "(set dev.contentSync: 'off' to silence this).",
-        formatList('changed', diff.changed),
-        formatList('only in working tree', diff.added),
-        formatList('only in branch clone', diff.removed),
-    ].filter((line) => line !== null);
-    return lines.join('\n');
+    const total = diff.changed.length + diff.added.length + diff.removed.length;
+    // Blank lines top and bottom: the block's job is to be findable in a scrolling request log, and
+    // whitespace separation does more for that than any amount of in-block decoration.
+    return [
+        '',
+        `${pc.bgYellow(pc.black(' CanopyCMS '))} ${pc.bold(pc.yellow('working-tree content has diverged'))}`,
+        body(`The dev server is serving ${pc.bold('stale content')}: ${total} file(s) differ from the`),
+        body(`dev branch clone "${branch}".`),
+        body(''),
+        ...formatList('changed', diff.changed),
+        ...formatList('only in working tree', diff.added),
+        ...formatList('only in branch clone', diff.removed),
+        body(''),
+        body(`Fix:     ${pc.bold('npx canopycms sync push')}`),
+        body(pc.dim("Silence: set dev.contentSync: 'off' in your Canopy config")),
+        '',
+    ].join('\n');
+}
+function formatResolvedNotice(branch) {
+    return [
+        '',
+        `${pc.bgGreen(pc.black(' CanopyCMS '))} ${pc.green(`working-tree content is back in sync with "${branch}"`)}`,
+        '',
+    ].join('\n');
 }
 /**
  * Start watching the working-tree content directory for divergence from the served dev branch clone.
@@ -73,6 +136,27 @@ export function startDevContentWatcher(services, options = {}) {
         services.config.defaultActiveBranch ??
         services.config.defaultBaseBranch ??
         'main';
+    const registry = watcherRegistry();
+    let state = registry.get(workingTreeContentDir);
+    if (!state) {
+        state = { dispose: null, lastMessage: null, reportedDivergence: false };
+        registry.set(workingTreeContentDir, state);
+    }
+    const watcherState = state;
+    // Dispose any prior watcher for this dir (HMR re-start) before creating a new one. The registry
+    // ENTRY deliberately survives, carrying lastMessage/reportedDivergence into the new watcher.
+    watcherState.dispose?.();
+    /**
+     * Emit `message` unless it is verbatim what was emitted last for this directory. Covers the
+     * divergence block, the resolved notice and the error paths alike: in every case a repeat means
+     * "the condition is unchanged", which the reader already knows.
+     */
+    const reportOnce = (message) => {
+        if (watcherState.lastMessage === message)
+            return;
+        watcherState.lastMessage = message;
+        warn(message);
+    };
     let running = false;
     let pending = false;
     const check = async () => {
@@ -84,16 +168,26 @@ export function startDevContentWatcher(services, options = {}) {
         try {
             const branch = resolveBranch();
             const branchContentDir = path.join(strategy.getContentBranchRoot(branch, sourceRoot), contentRoot);
-            // No branch clone yet (e.g. before the first editor/dev request created it) → nothing to compare.
+            // No branch clone yet (e.g. before the first editor/dev request created it) -> nothing to
+            // compare. Deliberately leaves reportedDivergence alone: "cannot tell" is not "resolved".
             if (!fsSync.existsSync(branchContentDir))
                 return;
             const diff = await diffContentTrees(workingTreeContentDir, branchContentDir);
-            if (isContentTreeDiffEmpty(diff))
+            if (isContentTreeDiffEmpty(diff)) {
+                // Close the loop: a condition that was announced needs its retraction announced too, or the
+                // reader is left believing the dev server is still serving stale content.
+                if (watcherState.reportedDivergence) {
+                    watcherState.reportedDivergence = false;
+                    reportOnce(formatResolvedNotice(branch));
+                }
                 return;
-            warn(formatDivergenceWarning(branch, diff));
+            }
+            // Set BEFORE reporting so a deduped repeat still leaves the condition marked as outstanding.
+            watcherState.reportedDivergence = true;
+            reportOnce(formatDivergenceWarning(branch, diff));
         }
         catch (err) {
-            warn(`CanopyCMS: dev content-sync check failed: ${getErrorMessage(err)}`);
+            reportOnce(`CanopyCMS: dev content-sync check failed: ${getErrorMessage(err)}`);
         }
         finally {
             running = false;
@@ -103,22 +197,19 @@ export function startDevContentWatcher(services, options = {}) {
             }
         }
     };
-    // Dispose any prior watcher for this dir (HMR re-start) before creating a new one.
-    activeWatchers.get(workingTreeContentDir)?.();
     const watcher = chokidar.watch(workingTreeContentDir, { ignoreInitial: true });
     watcher.on('add', () => void check());
     watcher.on('change', () => void check());
     watcher.on('unlink', () => void check());
     // Handle watcher errors (e.g. inotify ENOSPC/EMFILE) so an unhandled 'error' event can't crash dev.
-    watcher.on('error', (err) => warn(`CanopyCMS: dev content-sync watcher error: ${getErrorMessage(err)}`));
+    watcher.on('error', (err) => reportOnce(`CanopyCMS: dev content-sync watcher error: ${getErrorMessage(err)}`));
     // Initial divergence check at startup.
     void check();
     const dispose = () => {
         void watcher.close();
-        if (activeWatchers.get(workingTreeContentDir) === dispose) {
-            activeWatchers.delete(workingTreeContentDir);
-        }
+        if (watcherState.dispose === dispose)
+            watcherState.dispose = null;
     };
-    activeWatchers.set(workingTreeContentDir, dispose);
+    watcherState.dispose = dispose;
     return dispose;
 }

package/dist/task-queue/task-queue.js

@@ -339,7 +339,16 @@ export async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 60_000, logge
 export async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 60_000, logger = nullLogger) {
     const now = Date.now();
     let cleaned = 0;
-    for (const subdir of ['completed', 'failed']) {
+    // `corrupt` included: unparseable task files are quarantined there by
+    // dequeue and orphan recovery and surfaced in admin listing, but the
+    // retention sweep never covered the directory, so it grew forever with
+    // deletion available only as a manual per-file admin action. Any recurring
+    // producer of malformed task JSON -- a partial write surviving a crash, a
+    // bad deploy writing schema-drifted tasks for a week -- accumulated files no
+    // automated path removed. Same stamp-based retention as the other two: a
+    // quarantined file older than the window has long since been triaged or
+    // forgotten.
+    for (const subdir of ['completed', 'failed', 'corrupt']) {
         const dir = path.join(taskDir, subdir);
         let files;
         try {

package/dist/utils/git.d.ts

@@ -72,6 +72,23 @@ export declare function isStaleLeaseRejection(message: string): boolean;
  * so callers MUST run git with a locale-pinning env (`gitChildEnv`).
  */
 export declare function isMissingRemoteRefFailure(message: string): boolean;
+/**
+ * Whether a repository has an INTERRUPTED rebase on disk — the `rebase-merge`
+ * (interactive/merge backend) or `rebase-apply` (am backend) state directory
+ * git leaves behind when a rebase stops for conflicts or the process dies
+ * mid-way.
+ *
+ * This state is invisible to every other check the worker makes: a clone left
+ * mid-rebase reports uncommitted changes, so the sync loop's dirty check skips
+ * it as `skippedDirty` on every cycle forever, and `branch-health` sees valid
+ * branch.json and scans it as healthy. Nothing self-heals, and recovery
+ * previously meant an operator running `git rebase --abort` on EFS by hand.
+ *
+ * Never throws — a missing or unreadable repo is reported as "no rebase",
+ * which is the safe direction for both callers (the worker only ever uses a
+ * `true` to justify an abort it holds the content-write lock for).
+ */
+export declare function isRebaseInProgress(repoPath: string): Promise<boolean>;
 /**
  * Detect the current HEAD branch name for a given repository root.
  * Returns the branch name, or the provided fallback (default 'main')

package/dist/utils/git.js

@@ -1,3 +1,5 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
 import { simpleGit } from 'simple-git';
 // Matches scheme://... URLs (http, https, ssh, git — case-insensitive).
 const NETWORK_SCHEME_PATTERN = /^(https?|ssh|git):\/\//i;
@@ -137,6 +139,65 @@ const MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find r
 export function isMissingRemoteRefFailure(message) {
     return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
 }
+/**
+ * Resolve a repository's git directory from its working-tree root, handling
+ * both layouts: a real `.git` directory, and a `.git` FILE containing a
+ * `gitdir: <path>` pointer (linked worktrees, submodules).
+ *
+ * Deliberately fs-only rather than `git rev-parse --git-dir`: the callers are
+ * a per-branch sync loop and an admin-facing health scan that already walk
+ * every branch directory, and neither should pay a subprocess per branch just
+ * to find a path.
+ */
+async function resolveGitDir(repoPath) {
+    const dotGit = path.join(repoPath, '.git');
+    let stat;
+    try {
+        stat = await fs.stat(dotGit);
+    }
+    catch {
+        return null;
+    }
+    if (stat.isDirectory())
+        return dotGit;
+    try {
+        const pointer = await fs.readFile(dotGit, 'utf-8');
+        const match = /^gitdir:\s*(.+)$/m.exec(pointer);
+        if (!match)
+            return null;
+        const target = match[1].trim();
+        return path.isAbsolute(target) ? target : path.resolve(repoPath, target);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a repository has an INTERRUPTED rebase on disk — the `rebase-merge`
+ * (interactive/merge backend) or `rebase-apply` (am backend) state directory
+ * git leaves behind when a rebase stops for conflicts or the process dies
+ * mid-way.
+ *
+ * This state is invisible to every other check the worker makes: a clone left
+ * mid-rebase reports uncommitted changes, so the sync loop's dirty check skips
+ * it as `skippedDirty` on every cycle forever, and `branch-health` sees valid
+ * branch.json and scans it as healthy. Nothing self-heals, and recovery
+ * previously meant an operator running `git rebase --abort` on EFS by hand.
+ *
+ * Never throws — a missing or unreadable repo is reported as "no rebase",
+ * which is the safe direction for both callers (the worker only ever uses a
+ * `true` to justify an abort it holds the content-write lock for).
+ */
+export async function isRebaseInProgress(repoPath) {
+    const gitDir = await resolveGitDir(repoPath);
+    if (!gitDir)
+        return false;
+    const results = await Promise.all(['rebase-merge', 'rebase-apply'].map((dir) => fs
+        .stat(path.join(gitDir, dir))
+        .then(() => true)
+        .catch(() => false)));
+    return results.some(Boolean);
+}
 /**
  * Detect the current HEAD branch name for a given repository root.
  * Returns the branch name, or the provided fallback (default 'main')

package/dist/worker/cms-worker.d.ts

@@ -217,6 +217,28 @@ export declare class CmsWorker {
      * is what makes simple-git reject the promise here.
      */
     private verifyBaseBranchExists;
+    /**
+     * Guarantee a bare repo's config carries NO `remote.origin.url`, and so no
+     * embedded bot token.
+     *
+     * `git clone https://x-access-token:<token>@github.com/...` records that URL
+     * verbatim as `remote.origin.url`, and for `remote.git` that config lives on
+     * shared EFS. The security model in docs/deploying-to-aws.md -- "If Lambda is
+     * compromised, an attacker can read/write content on EFS but cannot push to
+     * GitHub", "Secrets stay on the worker" -- is false while that string is
+     * there: a compromised Lambda could read the token off EFS and, despite
+     * having no egress of its own, exfiltrate it by writing it into branch
+     * content the worker then pushes to GitHub.
+     *
+     * Nothing needs the remote: every push passes the URL explicitly as an
+     * argument (see the `git.push(this.buildGitHubUrl(), ...)` call sites), and
+     * `verifyBaseBranchExists` reads local refs.
+     *
+     * VERIFIES rather than assuming: it re-reads the config and throws if the URL
+     * survives, because the previous code's `.catch(() => {})` meant a failed
+     * scrub was indistinguishable from a successful one.
+     */
+    private scrubPersistedRemote;
     /**
      * Ensure remote.git bare repo exists.
      * On first run, clone from GitHub as a bare repo.

package/dist/worker/cms-worker.js

@@ -14,7 +14,7 @@ import { GITHUB_TRACKING_REF_PREFIX, gitChildEnv, gitNetworkChildEnv } from '../
 import { resolveDeploymentName } from '../operating-mode/deployment-name.js';
 import { tryAcquireContentWriteLock } from '../utils/content-write-lock.js';
 import { getErrorMessage, isNodeError, redactCredentials } from '../utils/error.js';
-import { isNonFastForwardRejection, isStaleLeaseRejection } from '../utils/git.js';
+import { isNonFastForwardRejection, isRebaseInProgress, isStaleLeaseRejection } from '../utils/git.js';
 import { writeWorkerStatus } from './worker-status.js';
 import { workerLog, workerLogWarn, workerLogError } from './log.js';
 // Re-exported so the AWS entrypoint (packages/canopycms-cdk/worker/index.ts)
@@ -440,6 +440,87 @@ export class CmsWorker {
             `refs/heads/${this.baseBranch}`,
         ]);
     }
+    /**
+     * Guarantee a bare repo's config carries NO `remote.origin.url`, and so no
+     * embedded bot token.
+     *
+     * `git clone https://x-access-token:<token>@github.com/...` records that URL
+     * verbatim as `remote.origin.url`, and for `remote.git` that config lives on
+     * shared EFS. The security model in docs/deploying-to-aws.md -- "If Lambda is
+     * compromised, an attacker can read/write content on EFS but cannot push to
+     * GitHub", "Secrets stay on the worker" -- is false while that string is
+     * there: a compromised Lambda could read the token off EFS and, despite
+     * having no egress of its own, exfiltrate it by writing it into branch
+     * content the worker then pushes to GitHub.
+     *
+     * Nothing needs the remote: every push passes the URL explicitly as an
+     * argument (see the `git.push(this.buildGitHubUrl(), ...)` call sites), and
+     * `verifyBaseBranchExists` reads local refs.
+     *
+     * VERIFIES rather than assuming: it re-reads the config and throws if the URL
+     * survives, because the previous code's `.catch(() => {})` meant a failed
+     * scrub was indistinguishable from a successful one.
+     */
+    async scrubPersistedRemote(gitDir) {
+        const git = simpleGit({ baseDir: gitDir });
+        // `git config --get` exits 1 with no output when the key is absent.
+        // simple-git does NOT reliably throw on that -- verified against
+        // simple-git 3.36: it resolves with an empty string -- so an empty result
+        // must be read as "absent" too. Treating "" as a surviving URL is what
+        // made the first version of this reject every clean scrub.
+        //
+        // 'unreadable' is deliberately distinct from 'absent'. A read that fails
+        // for any OTHER reason must not be mistaken for "no token here": that
+        // would let the pre-check below short-circuit and skip the scrub entirely,
+        // silently leaving a token-bearing config on shared EFS -- the exact
+        // outcome this function exists to prevent. Fail closed and attempt the
+        // removal instead.
+        const readOriginUrl = async () => {
+            try {
+                const url = (await git.raw(['config', '--get', 'remote.origin.url'])).trim();
+                return url === '' ? null : url;
+            }
+            catch {
+                // ANY throw is 'unreadable', never 'absent'. The genuinely-absent case
+                // does not reach here at all -- simple-git resolves with '' (verified
+                // against 3.36: it only treats a task as failed when stderr is
+                // non-empty, and a missing key writes nothing to stderr). So a throw
+                // means something actually went wrong, and mapping that to "no token
+                // here" would be the one fail-OPEN reading available.
+                //
+                // An earlier version tried to classify git's exit-1 "key not found"
+                // from the message text. That was dead code -- simple-git's GitError
+                // message is raw stdout+stderr with no exit-code text -- and its
+                // empty-message fallback mapped a hypothetical throw to 'absent',
+                // which is exactly the direction this must not fail.
+                return 'unreadable';
+            }
+        };
+        const before = await readOriginUrl();
+        if (before === null)
+            return;
+        if (before === 'unreadable') {
+            workerLogWarn(`  Could not read remote.origin.url in ${gitDir}; attempting the scrub anyway rather than assuming it is absent`);
+        }
+        try {
+            await git.removeRemote('origin');
+        }
+        catch (err) {
+            // Reached only from the 'unreadable' path, where the remote may in fact
+            // not exist. Let the verification below decide rather than failing here:
+            // it is the authoritative check, and it fails closed.
+            workerLogWarn(`  removeRemote('origin') failed in ${gitDir}: ${getErrorMessage(err)} -- verifying directly`);
+        }
+        // Fails closed on BOTH a surviving URL and an unverifiable read: if we
+        // cannot prove the token is gone from shared storage, we do not proceed.
+        const remaining = await readOriginUrl();
+        if (remaining !== null) {
+            throw new Error(`Could not confirm the 'origin' remote is gone from ${gitDir} (${remaining === 'unreadable'
+                ? 'its config was unreadable'
+                : 'its config still records a URL'}). For a token-bearing clone URL that means the GitHub bot token may be persisted on ` +
+                `shared storage. Refusing to continue.`);
+        }
+    }
     /**
      * Ensure remote.git bare repo exists.
      * On first run, clone from GitHub as a bare repo.
@@ -465,6 +546,14 @@ export class CmsWorker {
             exists = false;
         }
         if (exists) {
+            // SELF-HEAL, before anything else touches this repo. The previous
+            // already-exists path fast-returned without ever re-checking the config,
+            // so a token that survived one scrub survived forever -- and a clone
+            // interrupted by SIGKILL/power-off between `git clone` and the scrub left
+            // a repo whose config already held the token, which additionally hit the
+            // "delete remote.git and restart" refusal below and so sat on EFS until
+            // an operator acted.
+            await this.scrubPersistedRemote(this.remoteGitPath);
             try {
                 await this.verifyBaseBranchExists(this.remoteGitPath);
             }
@@ -479,21 +568,30 @@ export class CmsWorker {
         }
         workerLog('Initializing remote.git from GitHub...');
         const git = simpleGit();
-        await git.clone(this.buildGitHubUrl(), this.remoteGitPath, ['--bare']);
+        // Clone under a TEMP name and rename into place only once the token has
+        // been scrubbed and the repo verified, so `remote.git` never exists on EFS
+        // in a token-bearing state. A crash mid-clone now leaves only this staging
+        // directory, which the next boot deletes -- rather than a poisoned
+        // `remote.git` that fs.stat cannot distinguish from a healthy one.
+        const stagingPath = `${this.remoteGitPath}.cloning`;
+        await fs.rm(stagingPath, { recursive: true, force: true });
         try {
-            await this.verifyBaseBranchExists(this.remoteGitPath);
+            await git.clone(this.buildGitHubUrl(), stagingPath, ['--bare']);
+            // Before the rename, so the token is gone from the config the moment the
+            // repo becomes reachable under its real name. Throws (rather than
+            // swallowing) if the scrub does not take.
+            await this.scrubPersistedRemote(stagingPath);
+            await this.verifyBaseBranchExists(stagingPath);
         }
         catch (err) {
-            workerLogError(`remote.git base branch verification failed after clone: ${getErrorMessage(err)}`);
+            workerLogError(`remote.git clone failed: ${redactCredentials(getErrorMessage(err))}`);
             // Deleting before throwing is what makes this recoverable: the next
             // start() sees no remote.git and re-clones, instead of being stuck
             // forever behind a poisoned bare repo that fs.stat alone can't detect.
-            await fs.rm(this.remoteGitPath, { recursive: true, force: true });
-            throw new Error(`remote.git clone of ${this.config.githubOwner}/${this.config.githubRepo} has no branch '${this.baseBranch}' - the GitHub repository is empty or the base branch does not exist. Push an initial commit to '${this.baseBranch}' and restart the worker (systemd will retry automatically).`);
+            await fs.rm(stagingPath, { recursive: true, force: true });
+            throw new Error(`remote.git clone of ${this.config.githubOwner}/${this.config.githubRepo} failed or has no branch '${this.baseBranch}' - the GitHub repository may be empty, or the base branch may not exist. Push an initial commit to '${this.baseBranch}' and restart the worker (systemd will retry automatically).`);
         }
-        // Remove the origin remote so the token doesn't persist in config
-        const bareGit = simpleGit({ baseDir: this.remoteGitPath });
-        await bareGit.removeRemote('origin').catch(() => { });
+        await fs.rename(stagingPath, this.remoteGitPath);
         workerLog('remote.git initialized');
     }
     /**
@@ -1908,6 +2006,83 @@ export class CmsWorker {
                     throw lockErr;
                 }
                 try {
+                    // Recover an INTERRUPTED rebase before anything else looks at this
+                    // tree. A clone left with .git/rebase-merge (or rebase-apply) reports
+                    // uncommitted changes, so without this the dirty check below would
+                    // classify it `skippedDirty` on every cycle FOREVER while
+                    // branch-health scanned it as healthy -- and editors would meanwhile
+                    // read, and be able to save over, conflict-marker content.
+                    //
+                    // An in-progress rebase is always this worker's own abandoned work:
+                    // it is the only thing that ever rebases these clones, and it got
+                    // here via a crash, an OOM, a spot interruption, or the ASG rolling
+                    // the instance (which happens on EVERY `cdk deploy`, while `stop()`
+                    // drains for at most taskTimeoutMs).
+                    //
+                    // NOT LOSSLESS, and it is important not to claim otherwise. `git
+                    // rebase --abort` hard-resets tracked files to the pre-rebase head.
+                    // While the worker was DOWN nothing held the [SYNC-C1] content-write
+                    // lock, so an editor could have saved into this wedged clone and
+                    // received a 200; that save is a working-tree modification, and the
+                    // abort reverts it. (New, untracked entry files survive; edits to
+                    // existing ones do not.) Taking the lock here stops any FURTHER save
+                    // racing the abort, but cannot recover one that already landed.
+                    //
+                    // Aborting anyway is still the right call: the alternative is a
+                    // branch wedged forever whose tree serves conflict-marker content to
+                    // editors. What must not happen is doing it SILENTLY -- so anything
+                    // modified beyond the rebase's own conflict state is logged by path
+                    // first, which is the only record an operator would have.
+                    if (await isRebaseInProgress(branchPath)) {
+                        const preAbort = await branchGit.status().catch(() => null);
+                        // Keyed on the WORKING-TREE column only. The two porcelain columns
+                        // mean different things here, and conflating them produces a false
+                        // data-loss report on essentially every conflict-wedged recovery
+                        // (verified against real git, mid-rebase):
+                        //
+                        //   `M ` index=M, wd=' '  -- the interrupted replay's own cleanly
+                        //                            merged files, already STAGED. These
+                        //                            are committed history and survive the
+                        //                            abort untouched. Not collateral.
+                        //   ` M` index=' ', wd=M  -- a working-tree modification nothing
+                        //                            staged: an editor's save landing while
+                        //                            the worker was down. The abort
+                        //                            discards exactly these.
+                        //   `??`                  -- untracked; the abort leaves them.
+                        //
+                        // KNOWN GAP, stated rather than hidden: a save onto one of the
+                        // rebase's own conflicted paths (the "saved over conflict-marker
+                        // content" case) is excluded below, because the file reads `UU`
+                        // whether or not an editor touched it -- status alone cannot tell
+                        // the two apart. Those discards go unlogged.
+                        const collateral = (preAbort?.files ?? [])
+                            .filter((f) => !preAbort?.conflicted.includes(f.path))
+                            .filter((f) => f.working_dir !== ' ' && f.working_dir !== '?')
+                            .map((f) => f.path);
+                        if (collateral.length > 0) {
+                            workerLogWarn(`  ${branchDir}: aborting the interrupted rebase will DISCARD working-tree changes to ` +
+                                `${collateral.length} file(s) saved while the worker was down: ${collateral.join(', ')}`);
+                        }
+                        workerLogWarn(`  ${branchDir}: found an interrupted rebase (this worker's own abandoned work) -- aborting it to recover the branch`);
+                        try {
+                            await branchGit.rebase(['--abort']);
+                        }
+                        catch (abortErr) {
+                            // Leave it for the next cycle rather than pressing on: every step
+                            // below assumes a clean tree.
+                            const reason = redactCredentials(`could not abort interrupted rebase: ${getErrorMessage(abortErr)}`);
+                            workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+                            failed.push({ branch: branchDir, error: reason });
+                            // Record on branch metadata too, like the other two failure exits
+                            // (`!completed` and the outer catch). Without this a persistently
+                            // un-abortable wedge appeared in worker-status.json but never set
+                            // a `syncFailureReason`, so the admin branch panel showed nothing
+                            // -- and this is precisely the state that needs an operator,
+                            // since it is the one the next cycle cannot fix by itself.
+                            await this.recordRebaseFailure(branchPath, branchDir, reason);
+                            continue;
+                        }
+                    }
                     // Skip dirty branches — editor has unsaved changes that can't be rebased.
                     // Now inside the lock, so no write can land between this check and the
                     // rebase below.
@@ -2031,11 +2206,59 @@ export class CmsWorker {
                                 await this.afterConflictDetectedForTesting();
                                 // During rebase, --theirs = the branch being replayed (editor's work).
                                 // (git rebase reverses ours/theirs: "ours" is the rebase target, "theirs" is the branch.)
+                                //
+                                // MODIFY/DELETE conflicts have no "their version" to check out
+                                // and must be resolved by staging a delete or an add instead.
+                                // `git checkout --theirs` on one exits non-zero ("path ... does
+                                // not have their version") and simple-git throws -- and because
+                                // this loop body IS the round loop's catch, that throw escapes
+                                // the round loop entirely, skipping BOTH `rebase --abort` sites
+                                // below and leaving the clone wedged mid-rebase forever. The
+                                // index/working-tree code pair identifies which side deleted
+                                // (verified against real git, not inferred):
+                                //
+                                //   U/D  "deleted by them"  -- the BRANCH deleted it, base
+                                //        modified it. Git leaves base's version in the tree.
+                                //        Keep-branch-version means honouring the delete: git rm.
+                                //   D/U  "deleted by us"    -- base deleted it, the BRANCH
+                                //        modified it. Git leaves the branch's version in the
+                                //        tree. Keep-branch-version means keeping it: git add.
+                                //
+                                // Any per-file resolution that STILL fails routes into the
+                                // `!completed` path below (which aborts and records) instead of
+                                // escaping -- deliberately NOT a rethrow, since a throw from
+                                // here is exactly the bug being fixed.
+                                const conflictKind = new Map(st.files.map((f) => [f.path, `${f.index}${f.working_dir}`]));
+                                let resolutionFailure;
                                 for (const file of st.conflicted) {
-                                    await branchGit.raw(['checkout', '--theirs', file]);
-                                    await branchGit.add(file);
+                                    const kind = conflictKind.get(file);
+                                    try {
+                                        if (kind === 'UD') {
+                                            await branchGit.raw(['rm', '-f', '--', file]);
+                                        }
+                                        else if (kind === 'DU') {
+                                            await branchGit.add(file);
+                                        }
+                                        else {
+                                            await branchGit.raw(['checkout', '--theirs', file]);
+                                            await branchGit.add(file);
+                                        }
+                                    }
+                                    catch (resolveErr) {
+                                        resolutionFailure =
+                                            `failed to resolve conflicted file '${file}' (status ${kind ?? '??'}): ` +
+                                                getErrorMessage(resolveErr);
+                                        break;
+                                    }
                                     conflictedFiles.push(file);
                                 }
+                                if (resolutionFailure !== undefined) {
+                                    // Same exit shape as the "unexpected error" branch below: set
+                                    // failureReason and break, letting the `!completed` block do
+                                    // the single `rebase --abort` and record the failure once.
+                                    failureReason = resolutionFailure;
+                                    break;
+                                }
                                 // nextAction stays 'continue'
                             }
                             else {
@@ -2232,6 +2455,34 @@ export class CmsWorker {
                     }
                 }
                 finally {
+                    // Last-resort guarantee that NO exit path leaves this clone
+                    // mid-rebase -- including an unexpected throw from any git step
+                    // above, which lands in the outer catch and previously only logged.
+                    //
+                    // It must live HERE rather than in that outer catch: the catch runs
+                    // AFTER this finally has released the content-write lock, so aborting
+                    // there would hard-reset a working tree an editor's save could
+                    // already be racing -- precisely the [SYNC-C1] hazard the lock
+                    // exists to prevent. Inside the finally the lock is still held --
+                    // EXCEPT on the narrow path where it was compromised mid-hold, in
+                    // which case a newly-admitted writer may already be live and this
+                    // abort carries the same exposure as the compromise path's own abort
+                    // above. Not special-cased: leaving a clone wedged mid-rebase is the
+                    // worse outcome, and the writer in that window is already being told
+                    // to retry.
+                    //
+                    // Guarded on actual rebase state so the happy path and the `continue`
+                    // exits cost one stat and do nothing.
+                    try {
+                        if (await isRebaseInProgress(branchPath)) {
+                            workerLogWarn(`  ${branchDir}: rebase still in progress on exit -- aborting so the clone is not left wedged`);
+                            await branchGit.rebase(['--abort']);
+                        }
+                    }
+                    catch (abortErr) {
+                        // Best effort: the next cycle's recovery check retries this.
+                        workerLogWarn(`  Failed to abort in-progress rebase for ${branchDir}: ${getErrorMessage(abortErr)}`);
+                    }
                     // [SYNC-C1] Released on EVERY exit -- the `continue`s above, a throw
                     // into the outer catch, and the happy path alike. A stranded lock
                     // would wedge every write to this branch until it went stale.

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.64",
+  "version": "0.0.65",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {
@@ -103,6 +103,7 @@
     "minimatch": "^9.0.7",
     "minimist": "^1.2.8",
     "pathe": "^1.1.2",
+    "picocolors": "^1.1.1",
     "proper-lockfile": "^4.1.2",
     "react-easy-crop": "^6.2.2",
     "react-split-pane": "^0.1.92",