canopycms 0.8.1 → 0.8.2

package/dist/pr-comments.js

@@ -19,21 +19,25 @@ export const SYNC_PR_COMMENTS_ACTION = 'sync-pr-comments';
 export async function renderPrCommentsBody(options) {
     const original = options.body;
     let next = original;
-    try {
-        const threads = await new CommentStore(options.branchRoot).listThreadsStrict();
-        next =
-            mergeCommentsBlock(next, buildCommentsBlock(threads, options.branch, options.editorUrl)) ??
-                next;
-    }
-    catch (err) {
-        if (!(err instanceof SyntaxError || err instanceof CommentsFileMalformedError))
-            throw err;
-        options.warn(`Could not read the editor comments of ${options.branch}; the PR keeps its summary: ${getErrorMessage(err)}`);
+    if (!options.reviewBlockOnly) {
+        try {
+            const threads = await new CommentStore(options.branchRoot).listThreadsStrict();
+            next =
+                mergeCommentsBlock(next, buildCommentsBlock(threads, options.branch, options.editorUrl)) ??
+                    next;
+        }
+        catch (err) {
+            if (!(err instanceof SyntaxError || err instanceof CommentsFileMalformedError))
+                throw err;
+            options.warn(`Could not read the editor comments of ${options.branch}; the PR keeps its summary: ${getErrorMessage(err)}`);
+        }
     }
     try {
         const file = await readBranchMetadataFile(options.branchRoot);
-        if (file)
-            next = mergeReviewBlock(next, buildReviewBlock(file.branch.review)) ?? next;
+        if (file) {
+            const block = buildReviewBlock(file.branch.review, file.branch.keptOverGitHub);
+            next = mergeReviewBlock(next, block) ?? next;
+        }
     }
     catch (err) {
         if (!(err instanceof BranchMetadataCorruptError))
@@ -69,8 +73,10 @@ export async function refreshCommentsBlock(options) {
     }
     try {
         const file = await readBranchMetadataFile(options.branchRoot);
-        if (file)
-            section = mergeReviewBlock(section, buildReviewBlock(file.branch.review)) ?? section;
+        if (file) {
+            const block = buildReviewBlock(file.branch.review, file.branch.keptOverGitHub);
+            section = mergeReviewBlock(section, block) ?? section;
+        }
     }
     catch (err) {
         options.warn(`Could not re-read the review state of ${options.branch}; the PR gets it from submit time: ${getErrorMessage(err)}`);

package/dist/resource-generation.js

@@ -4,6 +4,7 @@ import { randomUUID } from 'node:crypto';
 import { atomicWriteFile } from './utils/atomic-write.js';
 import { getErrorMessage, isNodeError } from './utils/error.js';
 import { createDebugLogger } from './utils/debug.js';
+import { canopyLogWarn } from './utils/logger.js';
 /**
  * Cross-process generation marker for an on-disk resource cached under a
  * branch-clone root: several warm Lambda containers and the EC2 worker share
@@ -54,9 +55,7 @@ export async function bumpResourceGeneration(root, resource, options) {
         return token;
     }
     catch (err) {
-        log.warn('generation', `Failed to bump ${resource} generation for ${root}`, {
-            error: getErrorMessage(err),
-        });
+        canopyLogWarn(`CanopyCMS: failed to bump ${resource} generation for ${root}:`, getErrorMessage(err));
         if (options?.mustSucceed)
             throw err;
         return null;

package/dist/submission-attribution.d.ts

@@ -101,7 +101,7 @@ export interface PrSectionInput {
  * mention, reference an issue, carry HTML or spell a marker; the id is never written, and a
  * name that is only the id counts as none.
  */
-export declare function buildReviewBlock(review: BranchReview | undefined): string;
+export declare function buildReviewBlock(review: BranchReview | undefined, keptOverGitHub?: readonly string[]): string;
 /**
  * The editor-comment summary between its markers: the unresolved threads, oldest first, or
  * that every thread is resolved, or that there are none, or that they could not be read.

package/dist/submission-attribution.js

@@ -243,7 +243,7 @@ function reviewTime(at) {
  * mention, reference an issue, carry HTML or spell a marker; the id is never written, and a
  * name that is only the id counts as none.
  */
-export function buildReviewBlock(review) {
+export function buildReviewBlock(review, keptOverGitHub = []) {
     const verdict = review?.state === 'approved'
         ? 'Approved'
         : review?.state === 'changes-requested'
@@ -256,7 +256,25 @@ export function buildReviewBlock(review) {
         const when = reviewTime(review.at);
         status = `${verdict} in CanopyCMS by ${name ? codeSpan(name) : 'a reviewer'}${when ? ` on ${when}` : ''}.`;
     }
-    return `${PR_REVIEW_START}\n${status}\n${REVIEW_NOT_A_GITHUB_REVIEW}\n${PR_REVIEW_END}`;
+    const kept = keptOverGitHubNote(keptOverGitHub);
+    return `${PR_REVIEW_START}\n${status}\n${REVIEW_NOT_A_GITHUB_REVIEW}\n${kept}${PR_REVIEW_END}`;
+}
+const MAX_LISTED_KEPT_PATHS = 20;
+const MAX_KEPT_PATH_LENGTH = 120;
+/** The paths as code spans, one per line and bounded: a path comes from a commit on GitHub. */
+function keptOverGitHubNote(paths) {
+    if (paths.length === 0)
+        return '';
+    const listed = paths
+        .slice(0, MAX_LISTED_KEPT_PATHS)
+        .flatMap((p) => {
+        const clean = cleanPath(p);
+        return clean ? [`- ${codeSpan(truncate(clean, MAX_KEPT_PATH_LENGTH))}`] : [];
+    })
+        .join('\n');
+    const more = paths.length - MAX_LISTED_KEPT_PATHS;
+    return (`\nA commit on GitHub changed these files too. The editor's version was kept, and that ` +
+        `change is no longer in them:\n${listed}\n${more > 0 ? `...and ${more} more\n` : ''}`);
 }
 const MAX_LISTED_THREADS = 50;
 const MAX_EXCERPT_LENGTH = 80;

package/dist/task-queue/task-queue.d.ts

@@ -48,7 +48,11 @@ export declare function failTask(taskDir: string, taskId: string, error: string,
  * Moves from processing/ back to pending/ with incremented retryCount
  * and a retryAfter timestamp. Backoff: 5s → 10s → 20s → 40s → 60s cap.
  */
-export declare function retryTask(taskDir: string, taskId: string, error: string, logger?: TaskQueueLogger): Promise<void>;
+export declare function retryTask(taskDir: string, taskId: string, error: string, logger?: TaskQueueLogger, 
+/** `delayMs` replaces the backoff, for a retry that waits on something else happening first. */
+options?: {
+    delayMs?: number;
+}): Promise<void>;
 /**
  * Hand an in-flight task back to pending/ unchanged, with no retry spent and no
  * backoff, for a consumer abandoning it while shutting down. Safe only for an

package/dist/task-queue/task-queue.js

@@ -184,7 +184,9 @@ export async function failTask(taskDir, taskId, error, logger = nullLogger) {
  * Moves from processing/ back to pending/ with incremented retryCount
  * and a retryAfter timestamp. Backoff: 5s → 10s → 20s → 40s → 60s cap.
  */
-export async function retryTask(taskDir, taskId, error, logger = nullLogger) {
+export async function retryTask(taskDir, taskId, error, logger = nullLogger, 
+/** `delayMs` replaces the backoff, for a retry that waits on something else happening first. */
+options = {}) {
     const processingPath = path.join(taskDir, 'processing', `${taskId}.json`);
     const pendingDir = path.join(taskDir, 'pending');
     const pendingPath = path.join(pendingDir, `${taskId}.json`);
@@ -205,7 +207,7 @@ export async function retryTask(taskDir, taskId, error, logger = nullLogger) {
         throw err;
     }
     const retryCount = (task.retryCount ?? 0) + 1;
-    const backoffMs = Math.min(5000 * Math.pow(2, retryCount - 1), 60_000);
+    const backoffMs = options.delayMs ?? Math.min(5000 * Math.pow(2, retryCount - 1), 60_000);
     task.status = 'pending';
     task.retryCount = retryCount;
     task.retryAfter = new Date(Date.now() + backoffMs).toISOString();

package/dist/types.d.ts

@@ -34,6 +34,30 @@ export interface BranchReview {
     /** ISO timestamp of the verdict. */
     at: string;
 }
+/** What keeps a pull request behind its base. `base` is the branch GitHub says it targets now. */
+export type PullRequestHold = {
+    kind: 'conflicts';
+} | {
+    kind: 'retargeted';
+    base: string;
+};
+/** What the editor tells a branch's viewers is stuck, and needs a person. */
+export type BranchHold = PullRequestHold | {
+    kind: 'rewritten';
+}
+/**
+ * `opened`: a pull request's number is on record, from an earlier submit. `notQueued`: no task
+ * ran it, so there's nothing to retry.
+ */
+ | {
+    kind: 'submit-unfinished';
+    opened: boolean;
+    notQueued?: boolean;
+}
+/** Admins see what to do in System health. */
+ | {
+    kind: 'unpublished-at-merge';
+};
 export interface BranchMetadata {
     name: string;
     title?: string;
@@ -109,6 +133,43 @@ export interface BranchMetadata {
      * rebase loop's self-heal pass.
      */
     historyRewrittenFrom?: string;
+    /**
+     * The newest commit this deployment has seen on GitHub's branch, or knows it will hold once a
+     * queued push of a rewrite lands: the last one it pushed, took in or published, and any
+     * `remote.git` took from GitHub, whether or not the clone followed. A tip that no longer contains
+     * it was rewritten on GitHub, so it is not merged, which could restore what someone removed
+     * (worker/github-commits.ts).
+     */
+    lastGitHubTip?: string;
+    /**
+     * Repo-relative paths where a merge of GitHub's commits kept this branch's version over theirs.
+     * The PR body lists them, since the person whose change was replaced is not in the editor.
+     */
+    keptOverGitHub?: string[];
+    /**
+     * The commit GitHub's branch held and no longer contains, set while a rewrite there stands
+     * unresolved. The worker pushes nothing for this branch until GitHub's tip contains a commit
+     * it is known to have held, or GitHub no longer has the branch.
+     */
+    rewrittenOnGitHub?: string;
+    /**
+     * The last submit failed, so its pull request step hasn't run. Only a retry of that task or a new
+     * submit runs it, so nothing else clears the failed sync while the branch is in review.
+     */
+    submitUnfinished?: boolean;
+    /** The last submit's task couldn't be queued, so only a new submit runs it. Set by each submit. */
+    submitNotQueued?: boolean;
+    /**
+     * The pull request merged before a submit finished, so commits from that submit may not be in
+     * the merge. Archiving leaves no retry or new submit, so this stays for an admin until dismissed
+     * in System health, and only an admin may delete the branch meanwhile.
+     */
+    unpublishedAtMerge?: boolean;
+    /**
+     * What GitHub reports keeps this branch's open pull request from being updated from its base,
+     * as of the worker's last read while the branch was in review. Read only while it still is.
+     */
+    pullRequestHold?: PullRequestHold;
     /**
      * Short, sanitized reason the last GitHub sync failed, set alongside
      * `syncStatus: 'sync-failed'` by the worker's updateBranchMetadataOnFailure or a

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CANOPYCMS_VERSION = "0.8.1";
+export declare const CANOPYCMS_VERSION = "0.8.2";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated by scripts/bump-version.mjs, its only writer. The package builds with plain
 // tsc (rootDir: src), so src/ cannot import ../package.json; version.test.ts keeps the two equal.
-export const CANOPYCMS_VERSION = '0.8.1';
+export const CANOPYCMS_VERSION = '0.8.2';

package/dist/worker/branch-merge.d.ts

@@ -0,0 +1,68 @@
+import type { SimpleGit } from 'simple-git';
+import { type ContentId } from '../paths/types.js';
+import type { ConflictStatus } from '../types.js';
+import type { WorkerContext } from './worker-context.js';
+/** What {@link buildMergeCommit} made of the two commits. */
+export type BuiltMerge = 
+/** `sha` is the merge, reachable from no ref yet. `conflicted` kept the branch's version. */
+{
+    kind: 'built';
+    sha: string;
+    conflicted: string[];
+}
+/** Git met conflicts no rule settles safely. Nothing was built. */
+ | {
+    kind: 'unsettled';
+    conflicts: string[];
+    paths: string[];
+};
+/**
+ * The merge of `other` into `head`, as a commit no ref names, with `head` the first parent. A path
+ * git cannot merge keeps `head`'s side, stage 2, at the path git reports, or stays deleted when
+ * `head` has no such stage: the rule the rebase loop applies to a conflict, since `head` has the
+ * editor's work. The commit takes its identity from the clone's `user.*`, written when the clone
+ * is provisioned.
+ */
+export declare function buildMergeCommit(git: SimpleGit, clonePath: string, args: {
+    head: string;
+    other: string;
+    message: string;
+    timeoutMs: number;
+}): Promise<BuiltMerge>;
+/**
+ * Whether `merged` holds exactly what `from` and `other` merge to cleanly, and so nothing else. A
+ * conflict counts as no: whoever settled it chose what `merged` holds.
+ */
+export declare function isCleanMergeOf(git: SimpleGit, merged: string, from: string, other: string): Promise<boolean>;
+/**
+ * Move `refs/heads/<branchRef>` in remote.git to `sha` as a plain push, so it can only ever
+ * fast-forward. Resolves false when it would not: under the caller's locks, the only writers left
+ * are this loop and a person, so remote.git holds a commit `sha` lacks. Any other failure throws.
+ */
+export declare function publishPlainToLocalRemote(ctx: Pick<WorkerContext, 'remoteGitPath' | 'taskTimeoutMs'>, clonePath: string, branchRef: string, sha: string): Promise<boolean>;
+/** Commits unique to each side: `[in a, not b]` and `[in b, not a]`. */
+export declare function commitsApart(git: SimpleGit, a: string, b: string): Promise<{
+    onlyA: number;
+    onlyB: number;
+}>;
+/**
+ * Map the file paths a rebase or merge kept the branch's version of onto the ContentIds the
+ * editor shows as conflicted, deduplicated. IDs rather than paths because they are
+ * immutable: a later slug rename must not orphan a conflict marker. Paths that
+ * carry no recoverable ID are dropped rather than guessed at.
+ *
+ * Pure.
+ */
+export declare function conflictFilesToContentIds(conflictedFiles: readonly string[], contentRoot: string): ContentId[];
+/**
+ * The conflict record after a rebase or merge: the IDs already recorded plus
+ * its own. A conflict means this branch's version replaced base's change to
+ * that entry, which a later clean rebase does not undo, so the record only
+ * grows until the branch merges (buildMergedBranchUpdate clears it).
+ *
+ * Pure.
+ */
+export declare function recordConflicts(recorded: readonly ContentId[] | undefined, found: readonly ContentId[]): {
+    conflictStatus: ConflictStatus;
+    conflictFiles: ContentId[];
+};

package/dist/worker/branch-merge.js

@@ -0,0 +1,228 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { extractIdFromFilename } from '../content-id-index.js';
+import { normalizeFilesystemPath } from '../paths/normalize.js';
+import { ROOT_COLLECTION_ID } from '../paths/types.js';
+import { isNonFastForwardRejection } from '../utils/git.js';
+import { getErrorMessage, redactCredentials } from '../utils/error.js';
+import { runGit } from './git-process.js';
+import { pinnedReceivePack, sharedRepoGit, sharedRepoProcessOptions } from './shared-repo-git.js';
+/**
+ * Merging into a branch workspace's history without touching its working tree: the merge is built
+ * as objects, and the clone only ever fast-forwards to it. So a refused merge changes nothing, and
+ * a clone is never left stopped on a merge's conflicts, which would need a second copy of the
+ * rebase loop's lossy interrupted-rebase recovery.
+ */
+const OBJECT_ID = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+/**
+ * The conflicts {@link buildMergeCommit} settles by keeping `head`'s side of one path. Every other
+ * kind (a rename colliding with another, a file meeting a directory, a directory rename) moves or
+ * joins paths, so no one side of one path is the branch's version, and settling it by rule loses a
+ * file. Messages that are not `CONFLICT` are git's notes, such as `Auto-merging`.
+ */
+const SETTLED_BY_KEEPING_HEAD = new Set([
+    'CONFLICT (contents)',
+    'CONFLICT (binary)',
+    'CONFLICT (modify/delete)',
+]);
+/**
+ * Parse `merge-tree --write-tree -z`: the tree, then each stage of each conflicted path, an empty
+ * field, then messages of a path count, the paths, a stable kind and a sentence. Reads the output
+ * rather than the exit status, since it exits 1 on a conflict with no stderr, which simple-git
+ * resolves, and any failure of its own writes stderr and throws.
+ */
+function parseMergeTree(output, head, other) {
+    const fields = output.split('\0');
+    const tree = fields[0];
+    if (!OBJECT_ID.test(tree))
+        throw new Error(`git merge-tree printed no tree for ${head}, ${other}`);
+    const stages = [];
+    let i = 1;
+    for (; i < fields.length && fields[i] !== ''; i++) {
+        const match = /^(\d+) ([0-9a-f]+) (\d)\t([\s\S]*)$/.exec(fields[i]);
+        if (!match)
+            throw new Error(`Unreadable git merge-tree entry: ${JSON.stringify(fields[i])}`);
+        const [, mode, oid, stage, path] = match;
+        stages.push({ mode, oid, stage, path });
+    }
+    const unsettled = new Set();
+    for (i++; i < fields.length && fields[i] !== '';) {
+        const kind = fields[i + parseInt(fields[i], 10) + 1];
+        if (kind?.startsWith('CONFLICT') && !SETTLED_BY_KEEPING_HEAD.has(kind))
+            unsettled.add(kind);
+        i += parseInt(fields[i], 10) + 3;
+    }
+    // A path git could not decode as UTF-8 reads back as U+FFFD, which names no file.
+    if (stages.some(({ path }) => path.includes('\ufffd')))
+        unsettled.add('an unreadable file name');
+    return { tree, stages, unsettled: [...unsettled] };
+}
+/**
+ * The merge of `other` into `head`, as a commit no ref names, with `head` the first parent. A path
+ * git cannot merge keeps `head`'s side, stage 2, at the path git reports, or stays deleted when
+ * `head` has no such stage: the rule the rebase loop applies to a conflict, since `head` has the
+ * editor's work. The commit takes its identity from the clone's `user.*`, written when the clone
+ * is provisioned.
+ */
+export async function buildMergeCommit(git, clonePath, args) {
+    const { head, other, message, timeoutMs } = args;
+    const output = await git.raw([
+        'merge-tree',
+        '--write-tree',
+        '-z',
+        '--end-of-options',
+        head,
+        other,
+    ]);
+    const { tree: mergedTree, stages, unsettled } = parseMergeTree(output, head, other);
+    const conflicted = [...new Set(stages.map(({ path }) => path))];
+    if (unsettled.length > 0)
+        return { kind: 'unsettled', conflicts: unsettled, paths: conflicted };
+    const tree = stages.length === 0
+        ? mergedTree
+        : await keepHeadStages(clonePath, { mergedTree, stages, conflicted, timeoutMs });
+    const sha = (await git.raw(['commit-tree', '-p', head, '-p', other, '-m', message, '--end-of-options', tree])).trim();
+    return { kind: 'built', sha, conflicted };
+}
+/**
+ * Whether `merged` holds exactly what `from` and `other` merge to cleanly, and so nothing else. A
+ * conflict counts as no: whoever settled it chose what `merged` holds.
+ */
+export async function isCleanMergeOf(git, merged, from, other) {
+    const output = await git.raw([
+        'merge-tree',
+        '--write-tree',
+        '-z',
+        '--end-of-options',
+        from,
+        other,
+    ]);
+    const { tree, stages } = parseMergeTree(output, from, other);
+    if (stages.length > 0)
+        return false;
+    return (await git.revparse(['--verify', '--end-of-options', `${merged}^{tree}`])).trim() === tree;
+}
+/** `mergedTree` with each of `conflicted` as `head` has it, through a throwaway index. */
+async function keepHeadStages(clonePath, args) {
+    const { mergedTree, stages, conflicted, timeoutMs } = args;
+    const shared = sharedRepoProcessOptions(clonePath, 'worktree');
+    const indexFile = path.join(clonePath, '.git', `canopy-merge-index-${randomUUID()}`);
+    const options = {
+        ...shared,
+        env: { ...shared.env, GIT_INDEX_FILE: indexFile },
+        inactivityTimeoutMs: timeoutMs,
+    };
+    const kept = new Map(stages.filter((s) => s.stage === '2').map((s) => [s.path, s]));
+    // Mode 0 removes a path: what is left when `head` has no side of it.
+    const zeros = '0'.repeat(mergedTree.length);
+    const entries = conflicted.map((file) => {
+        const entry = kept.get(file);
+        return `${entry?.mode ?? '0'} ${entry?.oid ?? zeros}\t${file}\0`;
+    });
+    try {
+        await runGit(['read-tree', '--end-of-options', mergedTree], options);
+        await runGit(['update-index', '-z', '--index-info'], { ...options, stdin: entries.join('') });
+        return (await runGit(['write-tree'], options)).trim();
+    }
+    finally {
+        await fs.rm(indexFile, { force: true }).catch(() => { });
+    }
+}
+/**
+ * Move `refs/heads/<branchRef>` in remote.git to `sha` as a plain push, so it can only ever
+ * fast-forward. Resolves false when it would not: under the caller's locks, the only writers left
+ * are this loop and a person, so remote.git holds a commit `sha` lacks. Any other failure throws.
+ */
+export async function publishPlainToLocalRemote(ctx, clonePath, branchRef, sha) {
+    const pushGit = sharedRepoGit(clonePath, 'worktree', { timeout: { block: ctx.taskTimeoutMs } });
+    try {
+        await pushGit.raw([
+            'push',
+            // Otherwise remote.git's own hooks run, as the worker.
+            `--receive-pack=${pinnedReceivePack()}`,
+            '--end-of-options',
+            ctx.remoteGitPath,
+            `${sha}:refs/heads/${branchRef}`,
+        ]);
+        return true;
+    }
+    catch (err) {
+        if (isNonFastForwardRejection(redactCredentials(getErrorMessage(err))))
+            return false;
+        throw err;
+    }
+}
+/** Commits unique to each side: `[in a, not b]` and `[in b, not a]`. */
+export async function commitsApart(git, a, b) {
+    const counts = (await git.raw(['rev-list', '--left-right', '--count', '--end-of-options', `${a}...${b}`])).trim();
+    const [left, right] = counts.split(/\s+/).map((n) => parseInt(n, 10));
+    if (!Number.isInteger(left) || !Number.isInteger(right)) {
+        throw new Error(`Unreadable rev-list output for ${a}...${b}: ${JSON.stringify(counts)}`);
+    }
+    return { onlyA: left, onlyB: right };
+}
+/**
+ * Map the file paths a rebase or merge kept the branch's version of onto the ContentIds the
+ * editor shows as conflicted, deduplicated. IDs rather than paths because they are
+ * immutable: a later slug rename must not orphan a conflict marker. Paths that
+ * carry no recoverable ID are dropped rather than guessed at.
+ *
+ * Pure.
+ */
+export function conflictFilesToContentIds(conflictedFiles, contentRoot) {
+    // Entry files carry their ID in the filename. A `.collection.json` has none
+    // of its own (extractIdFromFilename returns null for dot-prefixed files), so
+    // the ID comes from the parent directory; the root content directory has no
+    // embedded ID at all, so ROOT_COLLECTION_ID stands in -- but only for the
+    // configured contentRoot.
+    //
+    // Two different notions of "parent" are needed, and conflating them is the
+    // bug this guards against (see schema-store.ts's contentRootName doc comment
+    // for the same shape elsewhere):
+    //  - `parentDir` (a basename) recovers a SUB-collection's own embedded ID,
+    //    correct as a basename since a collection directory carries its ID in its
+    //    own name, one path segment;
+    //  - `parentPath` (the full normalized relative parent path) is what must be
+    //    compared against `contentRoot`, which is documented (config/helpers.ts)
+    //    as allowed to span multiple segments (e.g. "cms/content"). Comparing a
+    //    basename against that full value is always false, silently dropping the
+    //    root collection's conflict. Git reports POSIX paths and the configured
+    //    value may use either separator, so both sides go through
+    //    normalizeFilesystemPath first.
+    const normalizedContentRoot = normalizeFilesystemPath(contentRoot);
+    const conflictIds = [...new Set(conflictedFiles)]
+        .map((f) => {
+        const fileId = extractIdFromFilename(path.basename(f));
+        if (fileId)
+            return fileId;
+        const parentDir = path.basename(path.dirname(f));
+        const dirId = extractIdFromFilename(parentDir);
+        if (dirId)
+            return dirId;
+        // Only assign ROOT_COLLECTION_ID when the file's parent directory IS the
+        // configured content root. Other unrecognized paths are filtered out.
+        const parentPath = normalizeFilesystemPath(path.dirname(f));
+        if (path.basename(f) === '.collection.json' && parentPath === normalizedContentRoot) {
+            return ROOT_COLLECTION_ID;
+        }
+        return null;
+    })
+        .filter((id) => id !== null);
+    return [...new Set(conflictIds)];
+}
+/**
+ * The conflict record after a rebase or merge: the IDs already recorded plus
+ * its own. A conflict means this branch's version replaced base's change to
+ * that entry, which a later clean rebase does not undo, so the record only
+ * grows until the branch merges (buildMergedBranchUpdate clears it).
+ *
+ * Pure.
+ */
+export function recordConflicts(recorded, found) {
+    const conflictFiles = [...new Set([...(recorded ?? []), ...found])];
+    return {
+        conflictStatus: conflictFiles.length > 0 ? 'conflicts-detected' : 'clean',
+        conflictFiles,
+    };
+}

package/dist/worker/canopy-state.d.ts

@@ -10,6 +10,8 @@ import type { FileStatusResult, SimpleGit, StatusResult } from 'simple-git';
 export declare const TRACKED_CANOPY_STATE_FIX = "run `git rm -r --cached .canopy-meta` in the site repo, add `.canopy-meta/` to its .gitignore, and commit";
 /** Paths listed in worker-status.json per category; the admin panel shows them in a tooltip. */
 export declare const MAX_REPORTED_PATHS = 10;
+/** The schema cache's location in a clone before it moved under `.git/` (branch-schema-cache.ts). */
+export declare const RETIRED_SCHEMA_CACHE_PATH = ".canopy-meta/schema-cache.json";
 export declare function isUntracked(file: FileStatusResult): boolean;
 /** Files under `.canopy-meta/` that the clone's index tracks. */
 export declare function listTrackedCanopyState(git: SimpleGit): Promise<string[]>;

package/dist/worker/canopy-state.js

@@ -12,7 +12,7 @@ export const TRACKED_CANOPY_STATE_FIX = 'run `git rm -r --cached .canopy-meta` i
 /** Paths listed in worker-status.json per category; the admin panel shows them in a tooltip. */
 export const MAX_REPORTED_PATHS = 10;
 /** The schema cache's location in a clone before it moved under `.git/` (branch-schema-cache.ts). */
-const RETIRED_SCHEMA_CACHE_PATH = `${CANOPY_META_DIR}/${SCHEMA_CACHE_FILE}`;
+export const RETIRED_SCHEMA_CACHE_PATH = `${CANOPY_META_DIR}/${SCHEMA_CACHE_FILE}`;
 export function isUntracked(file) {
     return file.index === '?' && file.working_dir === '?';
 }

package/dist/worker/cms-worker.d.ts

@@ -189,6 +189,7 @@ export declare class CmsWorker {
     private shutdownController;
     private maxTasksPerCycle;
     private taskTimeoutMs;
+    private gitSyncIntervalMs;
     private maxRetries;
     private lockFilePath;
     private lockStaleMs;

package/dist/worker/cms-worker.js

@@ -260,6 +260,7 @@ export class CmsWorker {
             this.setBaseBranch(config.baseBranch);
         this.maxTasksPerCycle = config.maxTasksPerCycle ?? 10;
         this.taskTimeoutMs = config.taskTimeoutMs ?? DEFAULT_TASK_TIMEOUT;
+        this.gitSyncIntervalMs = config.gitSyncInterval ?? 5 * 60_000;
         this.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;
         this.lockFilePath = path.join(config.workspacePath, '.tasks', '.worker-lock');
         this.lockStaleMs = config.lockStaleMs ?? DEFAULT_LOCK_STALE_MS;
@@ -334,6 +335,7 @@ export class CmsWorker {
             contentRoot: this.contentRoot,
             schemaHoldMaxMs: this.schemaHoldMaxMs,
             taskTimeoutMs: this.taskTimeoutMs,
+            gitSyncIntervalMs: this.gitSyncIntervalMs,
             maxTasksPerCycle: this.maxTasksPerCycle,
             maxRetries: this.maxRetries,
             log: this.log,
@@ -476,7 +478,7 @@ export class CmsWorker {
         if (this.stopping)
             return;
         const taskInterval = this.config.taskPollInterval ?? 5_000;
-        const gitInterval = this.config.gitSyncInterval ?? 5 * 60_000;
+        const gitInterval = this.gitSyncIntervalMs;
         this.scheduleLoop('task queue', () => this.processTaskQueue(), taskInterval);
         this.scheduleLoop('git sync', () => this.syncGit(), gitInterval);
         if (this.config.refreshAuthCache) {
@@ -1252,8 +1254,8 @@ export class CmsWorker {
     // `rebaseActiveBranches` also has a consumer outside the test files:
     // apps/test-app/app/api/e2e-test/rebase/route.ts drives it from an e2e
     // fixture route. Do not delete it as unused.
-    async rebaseActiveBranches(gatewayPolicy) {
-        return runRebaseCycle(this.ctx(), gatewayPolicy);
+    async rebaseActiveBranches(gatewayPolicy, gitHub) {
+        return runRebaseCycle(this.ctx(), gatewayPolicy, gitHub);
     }
     // --- Git-sync cluster (worker/git-sync.ts) -----------------------------
     //