commandmate 0.11.4 → 0.12.0

package/dist/server/src/lib/git/git-errors.js

@@ -0,0 +1,336 @@
+"use strict";
+/**
+ * Git typed errors + API error mapping + network-stderr classification.
+ * Issue #921: extracted from git-utils.ts (god-module split, P1-a).
+ *
+ * Leaf module: depends only on next/server + logger. The exec layer
+ * (git-exec.ts) and every feature module import their typed errors from here,
+ * and `git-utils.ts` re-exports this barrel-style for backward compatibility.
+ *
+ * Security considerations:
+ * - handleGitApiError / classifyNetworkStderr never echo raw git stderr (which
+ *   may carry credential-bearing remote URLs or absolute paths) into the HTTP
+ *   body or the thrown error message. See the per-class notes below.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitNetworkError = exports.GitForceWithLeaseStaleError = exports.GitProtectedBranchError = exports.GitNoUpstreamError = exports.GitNonFastForwardError = exports.GitAuthFailedError = exports.GitResetDefaultBranchError = exports.GitNothingToStashError = exports.GitDefaultBranchError = exports.GitCurrentBranchError = exports.GitDirtyError = exports.GitBranchCheckedOutElsewhereError = exports.GitBranchNotMergedError = exports.GitBranchNotFoundError = exports.GitNothingToCommitError = exports.GitIndexLockedError = exports.GitNotRepoError = exports.GitTimeoutError = void 0;
+exports.handleGitApiError = handleGitApiError;
+exports.classifyNetworkStderr = classifyNetworkStderr;
+const server_1 = require("next/server");
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('git-errors');
+/**
+ * Custom error class for git command timeout
+ * Used by API layer to distinguish 504 (timeout) from 500 (general error)
+ */
+class GitTimeoutError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitTimeoutError';
+    }
+}
+exports.GitTimeoutError = GitTimeoutError;
+/**
+ * Custom error class for "not a git repository" errors
+ */
+class GitNotRepoError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitNotRepoError';
+    }
+}
+exports.GitNotRepoError = GitNotRepoError;
+/**
+ * Custom error class for "git index locked" errors (Issue #780).
+ * Thrown when `.git/index.lock` exists before a write op, or when an in-process
+ * write for the same worktree is still running. The API layer maps this to 409.
+ */
+class GitIndexLockedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitIndexLockedError';
+    }
+}
+exports.GitIndexLockedError = GitIndexLockedError;
+/**
+ * Custom error class for the "nothing to commit" condition (Issue #780).
+ * The API layer maps this to 400.
+ */
+class GitNothingToCommitError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitNothingToCommitError';
+    }
+}
+exports.GitNothingToCommitError = GitNothingToCommitError;
+// ============================================================================
+// Issue #781: branch-operation typed errors
+// ============================================================================
+/** A branch named in a checkout/delete does not exist (-> 404 branch_not_found). */
+class GitBranchNotFoundError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitBranchNotFoundError';
+    }
+}
+exports.GitBranchNotFoundError = GitBranchNotFoundError;
+/** `git branch -d` refused because the branch is not fully merged (-> 409 not_merged). */
+class GitBranchNotMergedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitBranchNotMergedError';
+    }
+}
+exports.GitBranchNotMergedError = GitBranchNotMergedError;
+/**
+ * The requested branch is checked out in another worktree (-> 409
+ * checked_out_elsewhere). Carries the occupying worktree's path; NOT bypassable
+ * with force.
+ */
+class GitBranchCheckedOutElsewhereError extends Error {
+    /** Absolute path of the worktree that already has the branch checked out. */
+    worktreePath;
+    constructor(message, worktreePath) {
+        super(message);
+        this.name = 'GitBranchCheckedOutElsewhereError';
+        this.worktreePath = worktreePath;
+    }
+}
+exports.GitBranchCheckedOutElsewhereError = GitBranchCheckedOutElsewhereError;
+/** A non-force checkout was attempted over a dirty working tree (-> 409 dirty). */
+class GitDirtyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitDirtyError';
+    }
+}
+exports.GitDirtyError = GitDirtyError;
+/** Attempted to delete the currently checked-out branch (-> 409 current_branch). */
+class GitCurrentBranchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitCurrentBranchError';
+    }
+}
+exports.GitCurrentBranchError = GitCurrentBranchError;
+/** Attempted to delete the default branch (origin/HEAD) (-> 409 default_branch). */
+class GitDefaultBranchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitDefaultBranchError';
+    }
+}
+exports.GitDefaultBranchError = GitDefaultBranchError;
+// ============================================================================
+// Issue #782: stash + reset/revert typed errors
+// ============================================================================
+/**
+ * `git stash push` found no local changes to save (-> 400 nothing_to_stash).
+ * Normalized from the "No local changes to save" stderr, mirroring how
+ * GitNothingToCommitError normalizes "nothing to commit" (#780).
+ */
+class GitNothingToStashError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitNothingToStashError';
+    }
+}
+exports.GitNothingToStashError = GitNothingToStashError;
+/**
+ * A hard reset was refused because the current branch is the default branch
+ * (-> 409 default_branch). DELIBERATELY SEPARATE from GitDefaultBranchError
+ * (S3-001(b)): the latter's body is the delete-specific "Cannot delete the
+ * default branch", which would mislead a reset caller. A dedicated class keeps
+ * the #781 delete reason body byte-identical while letting reset return a
+ * reset-appropriate message under the same `reason: 'default_branch'`.
+ */
+class GitResetDefaultBranchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitResetDefaultBranchError';
+    }
+}
+exports.GitResetDefaultBranchError = GitResetDefaultBranchError;
+// ============================================================================
+// Issue #783: network-operation typed errors (push / pull / fetch).
+//
+// DR4-003: each is constructed with NO stderr/message argument that gets echoed.
+// handleGitApiError maps each to a FIXED literal body (it never echoes
+// error.message), so raw git stderr — which may contain credential-bearing URLs
+// or absolute paths — never reaches the HTTP body. The default Error message is
+// a static label only.
+// ============================================================================
+/** Remote rejected the credentials (-> 401 auth_failed). */
+class GitAuthFailedError extends Error {
+    constructor() {
+        super('Authentication failed');
+        this.name = 'GitAuthFailedError';
+    }
+}
+exports.GitAuthFailedError = GitAuthFailedError;
+/** Push rejected because it was not a fast-forward (-> 409 non_fast_forward). */
+class GitNonFastForwardError extends Error {
+    constructor() {
+        super('Non-fast-forward');
+        this.name = 'GitNonFastForwardError';
+    }
+}
+exports.GitNonFastForwardError = GitNonFastForwardError;
+/** The branch has no upstream configured (-> 400 no_upstream). */
+class GitNoUpstreamError extends Error {
+    constructor() {
+        super('No upstream');
+        this.name = 'GitNoUpstreamError';
+    }
+}
+exports.GitNoUpstreamError = GitNoUpstreamError;
+/**
+ * A force push targeted the default branch (-> 409 protected_branch).
+ * DELIBERATELY a SEPARATE reason from `default_branch` (delete/reset): push can
+ * target an ARBITRARY branch via the `branch?` arg (delete/reset have fixed
+ * "delete-target / current-branch" semantics), so its protection trigger and
+ * meaning differ — a distinct reason lets the UI/acceptance criteria diverge
+ * (DR1-008).
+ */
+class GitProtectedBranchError extends Error {
+    constructor() {
+        super('Protected branch');
+        this.name = 'GitProtectedBranchError';
+    }
+}
+exports.GitProtectedBranchError = GitProtectedBranchError;
+/** `--force-with-lease` refused because the remote moved (-> 409 force_with_lease_stale). */
+class GitForceWithLeaseStaleError extends Error {
+    constructor() {
+        super('Stale info');
+        this.name = 'GitForceWithLeaseStaleError';
+    }
+}
+exports.GitForceWithLeaseStaleError = GitForceWithLeaseStaleError;
+/** Could not reach / resolve the remote (-> 502 network). */
+class GitNetworkError extends Error {
+    constructor() {
+        super('Network error');
+        this.name = 'GitNetworkError';
+    }
+}
+exports.GitNetworkError = GitNetworkError;
+/**
+ * Handle git-related errors in API routes and return appropriate NextResponse.
+ * Centralizes the error-to-HTTP-status mapping for GitNotRepoError, GitTimeoutError,
+ * and generic errors.
+ *
+ * @param error - The caught error
+ * @param logPrefix - Prefix for the console.error log message
+ * @returns NextResponse with the appropriate status code and error message
+ */
+function handleGitApiError(error, logPrefix) {
+    if (error instanceof GitNotRepoError) {
+        return server_1.NextResponse.json({ error: 'Not a git repository' }, { status: 400 });
+    }
+    // Issue #780: index.lock held by a concurrent git process -> 409 Conflict
+    if (error instanceof GitIndexLockedError) {
+        return server_1.NextResponse.json({ error: 'Git index is locked by another operation' }, { status: 409 });
+    }
+    // Issue #780: nothing staged to commit -> 400 (client retry-able)
+    if (error instanceof GitNothingToCommitError) {
+        return server_1.NextResponse.json({ error: 'Nothing to commit' }, { status: 400 });
+    }
+    // Issue #781: branch-operation failures carry a machine-readable `reason`.
+    if (error instanceof GitBranchNotFoundError) {
+        return server_1.NextResponse.json({ error: 'Branch not found', reason: 'branch_not_found' }, { status: 404 });
+    }
+    if (error instanceof GitBranchNotMergedError) {
+        return server_1.NextResponse.json({ error: 'Branch is not fully merged', reason: 'not_merged' }, { status: 409 });
+    }
+    if (error instanceof GitCurrentBranchError) {
+        return server_1.NextResponse.json({ error: 'Cannot operate on the current branch', reason: 'current_branch' }, { status: 409 });
+    }
+    if (error instanceof GitDefaultBranchError) {
+        return server_1.NextResponse.json({ error: 'Cannot delete the default branch', reason: 'default_branch' }, { status: 409 });
+    }
+    if (error instanceof GitDirtyError) {
+        return server_1.NextResponse.json({ error: 'Working tree has uncommitted changes', reason: 'dirty' }, { status: 409 });
+    }
+    if (error instanceof GitBranchCheckedOutElsewhereError) {
+        return server_1.NextResponse.json({
+            error: 'Branch is checked out in another worktree',
+            reason: 'checked_out_elsewhere',
+            worktreePath: error.worktreePath,
+        }, { status: 409 });
+    }
+    // Issue #782 (additive, BEFORE the GitTimeoutError branch so #780/#781 reason
+    // bodies above stay byte-identical): danger-zone reasons.
+    if (error instanceof GitNothingToStashError) {
+        return server_1.NextResponse.json({ error: 'No local changes to stash', reason: 'nothing_to_stash' }, { status: 400 });
+    }
+    if (error instanceof GitResetDefaultBranchError) {
+        return server_1.NextResponse.json({ error: 'Cannot hard-reset the default branch', reason: 'default_branch' }, { status: 409 });
+    }
+    // Issue #783 (additive, AFTER all existing branches and BEFORE GitTimeoutError
+    // so #780-#782 reason bodies above stay byte-identical — DR2-005 relative-order
+    // contract). DR4-003: each returns a FIXED literal body that never echoes
+    // error.message, so credential-bearing stderr / absolute paths never leak.
+    if (error instanceof GitAuthFailedError) {
+        return server_1.NextResponse.json({ error: 'Authentication failed; configure credentials in the terminal', reason: 'auth_failed' }, { status: 401 });
+    }
+    if (error instanceof GitNonFastForwardError) {
+        return server_1.NextResponse.json({ error: 'Push rejected (non-fast-forward); pull/rebase first', reason: 'non_fast_forward' }, { status: 409 });
+    }
+    if (error instanceof GitNoUpstreamError) {
+        return server_1.NextResponse.json({ error: 'No upstream branch configured', reason: 'no_upstream' }, { status: 400 });
+    }
+    if (error instanceof GitProtectedBranchError) {
+        return server_1.NextResponse.json({ error: 'Force push to the default branch is not allowed', reason: 'protected_branch' }, { status: 409 });
+    }
+    if (error instanceof GitForceWithLeaseStaleError) {
+        return server_1.NextResponse.json({ error: 'Stale info; remote has new commits', reason: 'force_with_lease_stale' }, { status: 409 });
+    }
+    if (error instanceof GitNetworkError) {
+        // First 502 for a git route: the remote was unreachable (not the client's fault).
+        return server_1.NextResponse.json({ error: 'Could not reach the remote', reason: 'network' }, { status: 502 });
+    }
+    if (error instanceof GitTimeoutError) {
+        return server_1.NextResponse.json({ error: 'Git command timed out' }, { status: 504 });
+    }
+    logger.error('git:api-error', { prefix: logPrefix, error: error instanceof Error ? error.message : String(error) });
+    return server_1.NextResponse.json({ error: 'Failed to execute git command' }, { status: 500 });
+}
+/**
+ * Classify a git network-operation stderr into one of the 6 typed network errors
+ * (Issue #783, DR2-001 / DR4-003). Single source of truth for fetch/pull/push.
+ *
+ * Issue #921: relocated from git-utils.ts into git-errors.ts (alongside the
+ * network error classes it constructs) so the exec layer (execGitConflictAware /
+ * execGitNetworkAware) can import it without a git-exec <-> git-remote cycle.
+ * Behavior is unchanged; `@/lib/git/git-utils` still re-exports it.
+ *
+ * CRITICAL (DR4-003): every error is constructed with NO stderr/message argument,
+ * so the raw stderr — which can contain a credential-bearing remote URL
+ * (`scheme://user:pass@host`) or absolute filesystem paths — is NEVER retained on
+ * the thrown error. The stderr is read ONLY for regex matching, then discarded.
+ *
+ * Order matters: `stale info` (force-with-lease miss) is checked BEFORE
+ * non-fast-forward because git prints both for a `--force-with-lease` rejection.
+ * Unknown stderr maps to the generic, fixed-message Error (no raw stderr) that
+ * matches handleGitApiError's 500 fallback.
+ */
+function classifyNetworkStderr(stderr) {
+    const s = stderr || '';
+    if (/Authentication failed|could not read Username|could not read Password/i.test(s)) {
+        return new GitAuthFailedError();
+    }
+    if (/stale info/i.test(s)) {
+        return new GitForceWithLeaseStaleError();
+    }
+    if (/has no upstream branch|no upstream/i.test(s)) {
+        return new GitNoUpstreamError();
+    }
+    if (/\[rejected\][\s\S]*\(fetch first\)|non-fast-forward/i.test(s)) {
+        return new GitNonFastForwardError();
+    }
+    if (/Could not resolve host|unable to access|Could not read from remote|Connection (?:refused|timed out)|network is unreachable|Could not connect/i.test(s)) {
+        return new GitNetworkError();
+    }
+    return new Error('Failed to execute git command');
+}

package/dist/server/src/lib/git/git-exec.js

@@ -0,0 +1,285 @@
+"use strict";
+/**
+ * Git command execution layer + per-worktree write serialization.
+ * Issue #921: extracted from git-utils.ts (god-module split, P1-a).
+ *
+ * Owns the "execGit family" (execGitCommand / execGitCommandTyped /
+ * execGitConflictAware / execGitNetworkAware), the per-worktree in-process
+ * serialization (writeChains / runSerializedWrite / assertIndexNotLocked), and
+ * the shared ConflictResult contract. Feature modules import their execution
+ * primitives from here; typed errors come from git-errors.ts.
+ *
+ * Security considerations:
+ * - Uses execFile (not exec) to prevent command injection
+ * - worktreePath must be from DB only (trusted source)
+ * - Error details are logged server-side, not exposed to client
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GIT_LOG_TIMEOUT_MS = exports.execFileAsync = void 0;
+exports.execGitCommand = execGitCommand;
+exports.execGitCommandTyped = execGitCommandTyped;
+exports.runSerializedWrite = runSerializedWrite;
+exports.execGitConflictAware = execGitConflictAware;
+exports.execGitNetworkAware = execGitNetworkAware;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const logger_1 = require("../../lib/logger");
+const git_status_config_1 = require("../../config/git-status-config");
+const git_errors_1 = require("./git-errors");
+const logger = (0, logger_1.createLogger)('git-exec');
+/**
+ * Promisified execFile. Exported so the few helpers that must read stdout from a
+ * non-zero exit (getCommitsByDateRange / getWorkingTreeDiff) share the exact same
+ * binding the test suite mocks via `promisify`.
+ */
+exports.execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/** Timeout for git commands in milliseconds */
+const GIT_COMMAND_TIMEOUT_MS = 1000;
+/** Timeout for git log/show/diff commands in milliseconds (Issue #447) */
+exports.GIT_LOG_TIMEOUT_MS = 3000;
+/**
+ * Execute a git command with timeout
+ *
+ * @param args - Git command arguments
+ * @param cwd - Working directory (must be from DB, trusted source)
+ * @returns Command output or null on error
+ */
+async function execGitCommand(args, cwd) {
+    try {
+        const { stdout } = await (0, exports.execFileAsync)('git', args, {
+            cwd,
+            timeout: GIT_COMMAND_TIMEOUT_MS,
+        });
+        return stdout.trim();
+    }
+    catch (error) {
+        // Log error server-side only (no client exposure)
+        logger.error('git:command-failed', {
+            args: args.join(' '),
+            error: error instanceof Error ? error.message : 'Unknown error',
+        });
+        return null;
+    }
+}
+/**
+ * Execute a git command with timeout, distinguishing error types
+ * Unlike execGitCommand, this throws typed errors for API-level error handling.
+ *
+ * @param args - Git command arguments
+ * @param cwd - Working directory (must be from DB, trusted source)
+ * @param timeout - Timeout in milliseconds
+ * @returns Command stdout
+ * @throws {GitTimeoutError} When the command times out
+ * @throws {GitNotRepoError} When the directory is not a git repository
+ * @throws {Error} For other git errors
+ */
+async function execGitCommandTyped(args, cwd, timeout) {
+    try {
+        const { stdout } = await (0, exports.execFileAsync)('git', args, {
+            cwd,
+            timeout,
+        });
+        return stdout;
+    }
+    catch (error) {
+        const err = error;
+        // Check for timeout
+        if (err.killed || err.code === 'ERR_CHILD_PROCESS_EXEC_TIMEOUT' || err.code === 'ETIMEDOUT') {
+            throw new git_errors_1.GitTimeoutError(`Git command timed out after ${timeout}ms`);
+        }
+        // Check for "not a git repository"
+        const stderr = err.stderr || err.message || '';
+        if (stderr.includes('not a git repository')) {
+            throw new git_errors_1.GitNotRepoError('Not a git repository');
+        }
+        // Check for "unknown revision" / "bad object" (commit not found)
+        const combinedMsg = `${err.stderr || ''} ${err.message || ''}`;
+        if (combinedMsg.includes('unknown revision') || combinedMsg.includes('bad object')) {
+            throw new Error(combinedMsg.trim());
+        }
+        // Issue #780: preserve "nothing to commit" so gitCommit can normalize it to
+        // GitNothingToCommitError (400). Does not affect getGitStatus (execGitCommand).
+        if (/nothing to commit|no changes added to commit|nothing added to commit/i.test(combinedMsg)) {
+            throw new Error(combinedMsg.trim());
+        }
+        // Issue #782: preserve "No local changes to save" so stashPush can normalize
+        // it to GitNothingToStashError (400). Same approach as nothing-to-commit.
+        if (/No local changes to save|No local changes/i.test(combinedMsg)) {
+            throw new Error(combinedMsg.trim());
+        }
+        // Issue #781: preserve branch-operation stderr so checkout/create/delete can
+        // normalize it to typed errors (branch_not_found / not_merged). Read-path
+        // getGitStatus uses execGitCommand and is unaffected.
+        if (/did not match|not a valid ref|not found|invalid reference|not fully merged|couldn't find remote ref/i.test(combinedMsg)) {
+            throw new Error(combinedMsg.trim());
+        }
+        // Log and re-throw generic error
+        logger.error('git:command-failed', {
+            args: args.join(' '),
+            error: err.message,
+        });
+        throw new Error('Failed to execute git command');
+    }
+}
+// ----------------------------------------------------------------------------
+// Per-worktree in-process serialization + index.lock detection
+// ----------------------------------------------------------------------------
+/**
+ * Module-level chain of in-flight write operations keyed by worktree path.
+ * git's index can only safely accept one mutating operation at a time, so we
+ * serialize all write ops for the same worktree within this process. (We do NOT
+ * reuse the clone-manager DB-job pattern, which is built for long-lived clones.)
+ */
+const writeChains = new Map();
+/**
+ * Throw GitIndexLockedError if `.git/index.lock` exists for the worktree, which
+ * indicates another git process (CLI, another server) is mid-write.
+ *
+ * Note: `.git` may be a file (worktree gitdir pointer) — in that case we cannot
+ * cheaply resolve the lock path, so we skip the FS check and rely on git itself
+ * to fail (which execGitCommandTyped surfaces). This is best-effort defense.
+ */
+function assertIndexNotLocked(worktreePath) {
+    const lockPath = path_1.default.join(worktreePath, '.git', 'index.lock');
+    let exists = false;
+    try {
+        exists = fs_1.default.existsSync(lockPath);
+    }
+    catch {
+        exists = false;
+    }
+    if (exists) {
+        throw new git_errors_1.GitIndexLockedError('Git index is locked (.git/index.lock exists)');
+    }
+}
+/**
+ * Run a write operation serialized per worktree path, after verifying the index
+ * is not externally locked. Subsequent calls for the same path queue behind the
+ * current one; failures do not break the chain for later callers.
+ */
+async function runSerializedWrite(worktreePath, op) {
+    const previous = writeChains.get(worktreePath) ?? Promise.resolve();
+    const run = previous
+        .catch(() => undefined) // isolate prior failures from this op's gate
+        .then(() => {
+        assertIndexNotLocked(worktreePath);
+        return op();
+    });
+    // Keep the chain alive regardless of this op's outcome. Store the SAME
+    // settled promise we later compare against so cleanup can drop a stale entry.
+    const settled = run.then(() => undefined, () => undefined);
+    writeChains.set(worktreePath, settled);
+    try {
+        return await run;
+    }
+    finally {
+        // Best-effort cleanup: if no newer op queued behind us, drop the entry.
+        if (writeChains.get(worktreePath) === settled) {
+            writeChains.delete(worktreePath);
+        }
+    }
+}
+/** Extract `CONFLICT ... in <path>` file paths from git stdout (Issue #782). */
+function parseConflictFiles(stdout) {
+    const files = [];
+    for (const line of stdout.split('\n')) {
+        const m = line.match(/^CONFLICT \([^)]*\): Merge conflict in (.+)$/);
+        if (m)
+            files.push(m[1].trim());
+    }
+    return files;
+}
+/**
+ * Run a git command that may legitimately exit non-zero on a CONFLICT, via
+ * execFileAsync directly so the conflict patch on `err.stdout` is recoverable
+ * (Issue #782, S3-002). execGitCommandTyped discards stdout on reject, so it
+ * cannot be used here. We MANUALLY re-create the normalization
+ * execGitCommandTyped would otherwise provide:
+ *   - killed / ETIMEDOUT          -> GitTimeoutError (504)
+ *   - "not a git repository"      -> GitNotRepoError (400)
+ *   - exit-1 with CONFLICT stdout -> { conflict: true, conflictFiles }
+ *   - any other failure           -> generic Error (500)
+ *
+ * The caller is responsible for running this inside runSerializedWrite (which
+ * also performs the index.lock check), so serialization + lock detection are
+ * preserved on this path too.
+ */
+async function execGitConflictAware(args, worktreePath, 
+// Issue #783 (DR2-007): additive timeout param. The 3 existing callers
+// (stashPop / stashApply / gitRevert) omit it -> default GIT_WRITE_TIMEOUT_MS
+// -> byte-invariant (#782). gitPull (Part 2) will pass GIT_PULL_TIMEOUT_MS.
+timeout = git_status_config_1.GIT_WRITE_TIMEOUT_MS, 
+// Issue #783 (DR4-002 / DR2-001): additive flag. When true (gitPull only), the
+// generic-failure branch routes stderr through classifyNetworkStderr (throwing
+// a typed network error) and does NOT log the raw err.message — which for an
+// HTTPS remote can echo a credential-bearing URL. The 3 #782 callers omit it
+// -> false -> existing log + generic Error -> byte-invariant.
+classifyNetwork = false) {
+    try {
+        await (0, exports.execFileAsync)('git', args, { cwd: worktreePath, timeout });
+        return { conflict: false };
+    }
+    catch (error) {
+        const err = error;
+        // Timeout BEFORE the conflict recovery so a killed process is never mistaken
+        // for a "normal" conflicting exit.
+        if (err.killed || err.code === 'ERR_CHILD_PROCESS_EXEC_TIMEOUT' || err.code === 'ETIMEDOUT') {
+            throw new git_errors_1.GitTimeoutError(`Git command timed out after ${timeout}ms`);
+        }
+        const combined = `${err.stderr || ''} ${err.message || ''}`;
+        if (combined.includes('not a git repository')) {
+            throw new git_errors_1.GitNotRepoError('Not a git repository');
+        }
+        // A conflict leaves the merge markers and prints `CONFLICT ...` on stdout.
+        const stdout = typeof err.stdout === 'string' ? err.stdout : '';
+        if (stdout.includes('CONFLICT')) {
+            return { conflict: true, conflictFiles: parseConflictFiles(stdout) };
+        }
+        // Issue #783 (DR4-002 / DR2-001): the network path (gitPull) classifies the
+        // stderr into a typed network error WITHOUT logging the raw message (which
+        // can contain a credential-bearing remote URL). classifyNetworkStderr builds
+        // the error with no message argument, so no stderr/URL is retained.
+        if (classifyNetwork) {
+            throw (0, git_errors_1.classifyNetworkStderr)(combined);
+        }
+        logger.error('git:conflict-aware-failed', {
+            args: args.join(' '),
+            error: err.message,
+        });
+        throw new Error('Failed to execute git command');
+    }
+}
+/**
+ * Run a git NETWORK command (fetch / push) via execFileAsync directly (Issue
+ * #783, §4.4.1). Mirrors execGitConflictAware's manual normalization but has no
+ * conflict-recovery path (fetch/push don't leave merge markers):
+ *   - killed / ETIMEDOUT     -> GitTimeoutError (504)
+ *   - "not a git repository" -> GitNotRepoError (400)
+ *   - any other failure      -> classifyNetworkStderr (typed network error)
+ *
+ * Does NOT use execGitCommandTyped (whose preserve regex stays unmodified) and
+ * does NOT log the raw stderr/message (DR4-002): a failed network op's stderr can
+ * echo a credential-bearing remote URL, and the typed error carries no message.
+ */
+async function execGitNetworkAware(args, worktreePath, timeout) {
+    try {
+        const { stdout } = await (0, exports.execFileAsync)('git', args, { cwd: worktreePath, timeout });
+        return stdout;
+    }
+    catch (error) {
+        const err = error;
+        if (err.killed || err.code === 'ERR_CHILD_PROCESS_EXEC_TIMEOUT' || err.code === 'ETIMEDOUT') {
+            throw new git_errors_1.GitTimeoutError(`Git command timed out after ${timeout}ms`);
+        }
+        const combined = `${err.stderr || ''} ${err.message || ''}`;
+        if (combined.includes('not a git repository')) {
+            throw new git_errors_1.GitNotRepoError('Not a git repository');
+        }
+        throw (0, git_errors_1.classifyNetworkStderr)(combined);
+    }
+}