code-foundry 0.33.0 → 0.34.0

package/.github/workflows/release.yml

@@ -300,8 +300,8 @@ jobs:
           if (!lines) process.exit(1)
           process.stdout.write(`${lines}\n`)
           NODE
-          git remote set-url origin "git@github.com:${GITHUB_REPOSITORY}.git"
-          echo "ssh_command=-F /dev/null -i $STAGING_KEY -o IdentitiesOnly=yes -o UserKnownHostsFile=$STAGING_HOSTS -o StrictHostKeyChecking=yes" >> "$GITHUB_OUTPUT"
+          git remote set-url --push origin "git@github.com:${GITHUB_REPOSITORY}.git"
+          echo "ssh_command=ssh -F /dev/null -i $STAGING_KEY -o IdentitiesOnly=yes -o UserKnownHostsFile=$STAGING_HOSTS -o StrictHostKeyChecking=yes" >> "$GITHUB_OUTPUT"
       - name: Configure git for trusted reconcile
         if: steps.staging.outputs.exists == 'true' && env.STAGING_DEPLOY_KEY_PRESENT != 'true'
         run: gh auth setup-git

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.34.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.33.0...v0.34.0) (2026-08-01)
+
+
+### Features
+
+* **release:** classify reconcile push failures and log sanitized details ([#307](https://github.com/0xPlayerOne/code-foundry/issues/307)) ([0651fca](https://github.com/0xPlayerOne/code-foundry/commit/0651fca3eb4f11eeb21b91462397eef865eee7cc))
+
+
+### Bug Fixes
+
+* **release:** include ssh executable in reconcile transport ([#308](https://github.com/0xPlayerOne/code-foundry/issues/308)) ([49713ed](https://github.com/0xPlayerOne/code-foundry/commit/49713edeaf5262a0ed872aa6d3fdf55927b6e1c5))
+* **release:** keep reconcile fetch over HTTPS ([#305](https://github.com/0xPlayerOne/code-foundry/issues/305)) ([022afad](https://github.com/0xPlayerOne/code-foundry/commit/022afade430a00b9656dcfa50af3056bb27a54e3))
+
 ## [0.33.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.32.4...v0.33.0) (2026-08-01)
 
 

package/docs/WORKFLOWS.md

@@ -62,8 +62,10 @@ a personal-repository ruleset for `staging` enforces a Deploy Key bypass for
 checkout + GitHub API calls.
 
 When used, the optional `STAGING_DEPLOY_KEY` is written at runtime only for
-reconcile, used to set `GIT_SSH_COMMAND` and trusted host settings for the
-`release reconcile` transport, then scrubbed after the step.
+reconcile, then used to set `GIT_SSH_COMMAND` and trusted host settings for
+`release reconcile` over SSH push operations only; regular `git fetch` reads still
+use HTTPS from the checked-out origin configuration. The key material is scrubbed
+after the step.
 
 When absent, the job keeps `GH_TOKEN = github.token` and runs `gh auth setup-git`
 so repositories without a Deploy Key ruleset bypass still reconcile successfully.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/commands/release.mjs

@@ -44,7 +44,8 @@ export function reconcileRelease(root, options) {
     const remoteSha = remoteRefSha(target, head)
     if (remoteSha === state.stagingSha) {
       throw new Error(`${head} synchronization was rejected by an exact lease while remote ${head} tip remained ${state.stagingSha}. ` +
-        'Update branch protection or remote policy to permit this mutation, then retry.')
+        'Update branch protection or remote policy to permit this mutation, then retry. ' +
+        `Last failure detail: ${mutation.error}`)
     }
   }
   throw new Error(`Reconciliation of ${head} was retried but failed while the branch moved concurrently.`)
@@ -150,15 +151,55 @@ function remoteRefSha(target, branch) {
 function executeReconciliationMutation(target, head, state) {
   if (!state.plan.targetSha) return { success: false, retry: false, error: `No target SHA for ${head} reconciliation.` }
   if (state.plan.action === 'rebase-staging') {
-    const replaySha = replayOntoMain(target, state.mainSha, state.stagingOnlyCommits)
+    let replaySha
+    try {
+      replaySha = replayOntoMain(target, state.mainSha, state.stagingOnlyCommits)
+    } catch (error) {
+      return {
+        success: false,
+        retry: false,
+        error: `Replay conflict while applying staging-only commits before replay: ${String(error instanceof Error ? error.message : error)}`,
+      }
+    }
+
     const push = pushWithLease(target, head, state.stagingSha, replaySha)
     if (push.status === 0) return { success: true, result: { synchronization: 'replay', replaySha } }
-    return { success: false, retry: true, error: `Git push of replayed ${head} history failed: ${push.message}` }
+    const classification = classifyPushFailure(head, push.message)
+    if (classification.category === 'authentication') {
+      return {
+        success: false,
+        retry: false,
+        error: `${head} authentication failed during replay push: ${classification.message}`,
+      }
+    }
+    if (classification.category === 'policy') {
+      return {
+        success: false,
+        retry: false,
+        error: `${head} reconciliation was blocked by branch policy: ${classification.message}`,
+      }
+    }
+    return { success: false, retry: true, error: `${head} synchronization failed with lease: ${classification.message}` }
   }
   const targetSha = /** @type {string} */ (state.plan.targetSha)
   const leased = pushWithLease(target, head, state.stagingSha, targetSha)
   if (leased.status === 0) return { success: true, result: { synchronization: state.plan.action === 'aligned' ? 'synced' : 'leased' } }
-  return { success: false, retry: true, error: `${head} synchronization failed with lease: ${leased.message}` }
+  const classification = classifyPushFailure(head, leased.message)
+  if (classification.category === 'authentication') {
+    return {
+      success: false,
+      retry: false,
+      error: `${head} authentication failed during push: ${classification.message}`,
+    }
+  }
+  if (classification.category === 'policy') {
+    return {
+      success: false,
+      retry: false,
+      error: `${head} reconciliation was blocked by branch policy: ${classification.message}`,
+    }
+  }
+  return { success: false, retry: true, error: `${head} synchronization failed with lease: ${classification.message}` }
 }
 
 /** @param {string} target @param {string} head @param {string} expectedSha @param {string} tipSha */
@@ -169,10 +210,38 @@ function pushWithLease(target, head, expectedSha, tipSha) {
     `--force-with-lease=refs/heads/${head}:${expectedSha}`,
     `${tipSha}:refs/heads/${head}`,
   ], { cwd: target, encoding: 'utf8' })
+  const message = `${result.stdout?.trim() || ''}\n${result.stderr?.trim() || ''}`.trim() || `push with lease failed for ${head}.`
   return {
     status: result.status,
-    message: result.stdout?.trim() || result.stderr?.trim() || `push with lease failed for ${head}.`,
+    message: sanitizeReconcileOutput(message),
+  }
+}
+
+/**
+ * Classify a push failure to avoid leaking sensitive details and provide useful
+ * diagnostics while preserving exact-lease behavior.
+ * @param {string} branch
+ * @param {string} raw
+ */
+function classifyPushFailure(branch, raw) {
+  const message = sanitizeReconcileOutput(raw)
+  if (!message) return { category: 'other', message: `push with lease failed for ${branch}.` }
+  const lower = message.toLowerCase()
+  if (/permission denied|authentication failed|could not read from remote repository|publickey|not authorized|bad credentials/.test(lower)) {
+    return { category: 'authentication', message }
+  }
+  if (/remote:\s*error|protected branch|required status checks|pre-receive hook|branch policy|ruleset|gh006|gh007|gh008/.test(lower)) {
+    return { category: 'policy', message }
   }
+  return { category: 'other', message }
+}
+
+/** @param {string} value */
+function sanitizeReconcileOutput(value) {
+  return value
+    .replace(/https?:\/\/[^\s@]+:[^\s@]*@/g, 'https://***:***@')
+    .replace(/https?:\/\/[^\s@]+@/g, 'https://***@')
+    .trim()
 }
 
 /**
@@ -198,7 +267,8 @@ function replayOntoMain(target, mainSha, commits) {
       const cherryPick = spawnSync('git', [...identityArgs, 'cherry-pick', sha], { cwd: workspace, encoding: 'utf8' })
       if (cherryPick.status !== 0) {
         spawnSync('git', ['cherry-pick', '--abort'], { cwd: workspace, encoding: 'utf8' })
-        throw new Error(`Cherry-pick of ${sha} failed while replaying staging commits.`)
+        const details = [cherryPick.stdout?.trim(), cherryPick.stderr?.trim()].filter(Boolean).join('\n')
+        throw new Error(`Cherry-pick of ${sha} failed while replaying staging commits: ${sanitizeReconcileOutput(details)}`)
       }
     }
     const replayTip = git(workspace, ['rev-parse', 'HEAD'])