orch/engine/runner/

git_ops.rs

//! Git operations — auto-commit, push, PR creation.
//!
//! These run after the agent completes to ensure all changes
//! are committed, pushed, and a PR is created.
//!
//! All GitHub API operations use [`GhHttp`] exclusively. The `gh` CLI
//! is not used as a fallback to ensure consistent behavior across
//! environments and simplify testing.

use crate::cmd::CommandErrorContext;
use crate::github::http::GhHttp;
use regex::Regex;
use std::path::Path;
use std::sync::LazyLock;
use std::sync::atomic::{AtomicU64, Ordering};

use tokio::process::Command;

/// Format a task ID for display in PR/issue footers.
///
/// GitHub task IDs are displayed as `#123` (creates a GH issue hyperlink).
/// Internal task IDs (`internal:13`) are displayed as `internal-13` (no `#`
/// to avoid creating a false issue link).
pub(crate) fn format_task_ref(task_id: &str) -> String {
    if task_id.starts_with("internal:") {
        task_id.replace(':', "-")
    } else {
        format!("#{task_id}")
    }
}

/// Errors that can occur during PR creation.
#[derive(Debug, thiserror::Error)]
pub enum PrCreateError {
    #[error("GitHub API error: {0}")]
    ApiError(#[from] anyhow::Error),
}

/// Result type for PR creation operations.
pub type PrCreateResult<T> = Result<T, PrCreateError>;

/// Check if the current branch has any commits ahead of the default branch.
pub async fn has_commits_ahead(dir: &Path, default_branch: &str) -> bool {
    let output = Command::new("git")
        .args([
            "rev-list",
            "--count",
            &format!("origin/{default_branch}..HEAD"),
        ])
        .current_dir(dir)
        .output()
        .await;
    match output {
        Ok(o) if o.status.success() => {
            let count: u32 = String::from_utf8_lossy(&o.stdout)
                .trim()
                .parse()
                .unwrap_or(0);
            count > 0
        }
        _ => {
            tracing::debug!(
                default_branch,
                "git rev-list failed for compare ref, assuming commits ahead"
            );
            // If we can't determine, assume there ARE commits ahead so we
            // attempt a push (better to try and fail loudly than silently
            // skip push and lose the PR creation path).
            true
        }
    }
}

/// Check if there are uncommitted changes in the working directory.
pub async fn has_changes(dir: &Path) -> bool {
    // Check for staged, unstaged, and untracked files
    let diff = Command::new("git")
        .args(["diff", "--quiet"])
        .current_dir(dir)
        .status()
        .await;

    let cached = Command::new("git")
        .args(["diff", "--cached", "--quiet"])
        .current_dir(dir)
        .status()
        .await;

    let untracked = Command::new("git")
        .args(["ls-files", "--others", "--exclude-standard"])
        .current_dir(dir)
        .output_with_context()
        .await;

    let has_diff = diff.is_ok_and(|s| !s.success());
    let has_cached = cached.is_ok_and(|s| !s.success());
    let has_untracked =
        untracked.is_ok_and(|o| !String::from_utf8_lossy(&o.stdout).trim().is_empty());

    has_diff || has_cached || has_untracked
}

pub(crate) fn find_stash_ref_by_hash(stash_list: &str, stash_hash: &str) -> Option<String> {
    stash_list.lines().find_map(|line| {
        let mut parts = line.split_whitespace();
        match (parts.next(), parts.next()) {
            (Some(hash), Some(reference)) if hash == stash_hash => Some(reference.to_string()),
            _ => None,
        }
    })
}

/// Options for [`stash_rebase_restore`].
pub(crate) struct StashRebaseOpts {
    /// Abort the rebase (via `git rebase --abort`) and restore the stash when the
    /// rebase fails.  Set to `false` when the caller intentionally leaves the working
    /// tree in the in-progress-rebase state so an agent can resolve conflicts.
    pub abort_on_failure: bool,
}

impl Default for StashRebaseOpts {
    fn default() -> Self {
        Self {
            abort_on_failure: true,
        }
    }
}

/// Outcome returned by [`stash_rebase_restore`].
#[derive(Debug)]
pub(crate) enum RebaseOutcome {
    /// Rebase completed successfully.
    Succeeded,
    /// Rebase failed.  When `abort_on_failure` is true the rebase was aborted and any
    /// stash was restored; when false the working tree is left in the in-progress-rebase
    /// state.
    Failed(String),
    /// A stash operation failed (push failed, or OID could not be captured); the
    /// rebase was skipped to preserve the dirty working tree.
    Skipped(String),
}

/// Stash uncommitted changes, rebase onto `target_ref`, then restore the stash.
///
/// This is the single canonical implementation of the stash → rebase → restore
/// pattern used in multiple call sites.  Callers are responsible for any
/// `git fetch` that should precede the rebase.
///
/// # Concurrency safety
/// Git stashes are repo-global; multiple worktrees share the same stash stack.
/// This function captures the stash OID immediately after pushing and applies by
/// that exact ref — never via `stash pop` — to avoid restoring a stash that
/// belongs to a different concurrently-running worktree.
///
/// # Stash failure handling
/// If the stash push fails, or the OID cannot be captured after a successful push,
/// the rebase is **skipped** and [`RebaseOutcome::Skipped`] is returned.  This
/// preserves the dirty working tree intact rather than risking data loss.
pub(crate) async fn stash_rebase_restore(
    dir: &Path,
    target_ref: &str,
    opts: StashRebaseOpts,
) -> anyhow::Result<RebaseOutcome> {
    let stash_ref: Option<String> = if has_changes(dir).await {
        let stash_out = Command::new("git")
            .args(["stash", "push", "--include-untracked", "-m", "orch-rebase"])
            .current_dir(dir)
            .output_with_context()
            .await;

        match stash_out {
            Ok(o) if o.status.success() => {
                let stdout_preview = String::from_utf8_lossy(&o.stdout)
                    .lines()
                    .next()
                    .unwrap_or("")
                    .to_string();
                tracing::debug!(
                    dir = %dir.display(),
                    stdout = %stdout_preview,
                    "git stash push succeeded before rebase"
                );

                // Capture the OID of the stash object just created so we can
                // apply it back by that exact ref, regardless of any stashes
                // that other worktrees may push between now and then.
                let ref_out = Command::new("git")
                    .args(["rev-parse", "refs/stash@{0}"])
                    .current_dir(dir)
                    .output_with_context()
                    .await;
                let stash_hash = ref_out
                    .ok()
                    .filter(|o| o.status.success())
                    .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())
                    .filter(|s| !s.is_empty());

                if stash_hash.is_none() {
                    // Stash was created but we can't track its ref.
                    // Pop immediately to avoid orphaning the changes, then skip.
                    tracing::warn!(
                        dir = %dir.display(),
                        "git stash succeeded but rev-parse failed — popping stash and skipping rebase"
                    );
                    let _ = Command::new("git")
                        .args(["stash", "pop"])
                        .current_dir(dir)
                        .output_with_context()
                        .await;
                    return Ok(RebaseOutcome::Skipped(
                        "stash OID capture failed".to_string(),
                    ));
                }
                stash_hash
            }
            Ok(o) => {
                let stderr = String::from_utf8_lossy(&o.stderr).trim().to_string();
                tracing::warn!(
                    dir = %dir.display(),
                    code = ?o.status.code(),
                    stderr = %stderr,
                    "git stash push failed — skipping rebase to preserve dirty state"
                );
                return Ok(RebaseOutcome::Skipped(format!(
                    "stash push failed: {stderr}"
                )));
            }
            Err(e) => {
                tracing::warn!(
                    dir = %dir.display(),
                    error = %e,
                    "failed to run git stash push — skipping rebase to preserve dirty state"
                );
                return Ok(RebaseOutcome::Skipped(format!("stash push error: {e}")));
            }
        }
    } else {
        None
    };

    let output = git()
        .await
        .args(["rebase", target_ref])
        .current_dir(dir)
        .output_with_context()
        .await;

    match output {
        Ok(o) if o.status.success() => {
            tracing::debug!(dir = %dir.display(), target_ref, "rebase succeeded");
            restore_stash_by_hash(dir, stash_ref.as_deref()).await;
            Ok(RebaseOutcome::Succeeded)
        }
        Ok(o) => {
            let stderr = String::from_utf8_lossy(&o.stderr).to_string();
            tracing::warn!(dir = %dir.display(), target_ref, err = %stderr, "rebase failed");
            if opts.abort_on_failure {
                let abort = Command::new("git")
                    .args(["rebase", "--abort"])
                    .current_dir(dir)
                    .output_with_context()
                    .await;
                match abort {
                    Err(e) => {
                        tracing::warn!(dir = %dir.display(), error = %e, "git rebase --abort failed — worktree may be in inconsistent state");
                    }
                    Ok(o) if !o.status.success() => {
                        let stderr = String::from_utf8_lossy(&o.stderr);
                        tracing::warn!(dir = %dir.display(), stderr = %stderr, "git rebase --abort returned non-zero — worktree may be in inconsistent state");
                    }
                    _ => {}
                }
            }
            restore_stash_by_hash(dir, stash_ref.as_deref()).await;
            Ok(RebaseOutcome::Failed(stderr))
        }
        Err(e) => {
            if opts.abort_on_failure {
                let abort = Command::new("git")
                    .args(["rebase", "--abort"])
                    .current_dir(dir)
                    .output_with_context()
                    .await;
                match abort {
                    Err(e) => {
                        tracing::warn!(dir = %dir.display(), error = %e, "git rebase --abort failed — worktree may be in inconsistent state");
                    }
                    Ok(o) if !o.status.success() => {
                        let stderr = String::from_utf8_lossy(&o.stderr);
                        tracing::warn!(dir = %dir.display(), stderr = %stderr, "git rebase --abort returned non-zero — worktree may be in inconsistent state");
                    }
                    _ => {}
                }
            }
            restore_stash_by_hash(dir, stash_ref.as_deref()).await;
            Err(e)
        }
    }
}

/// Apply a stash entry by its OID and drop it from the stack on success.
///
/// On failure the entry is preserved so it can be recovered manually.
async fn restore_stash_by_hash(dir: &Path, stash_hash: Option<&str>) {
    let Some(stash_hash) = stash_hash else {
        return;
    };

    let apply = Command::new("git")
        .args(["stash", "apply", stash_hash])
        .current_dir(dir)
        .output_with_context()
        .await;
    if apply.is_ok_and(|o| o.status.success()) {
        let list = Command::new("git")
            .args(["stash", "list", "--format=%H %gd"])
            .current_dir(dir)
            .output_with_context()
            .await;
        if let Ok(list_out) = list
            && list_out.status.success()
        {
            let list_str = String::from_utf8_lossy(&list_out.stdout);
            if let Some(stash_ref) = find_stash_ref_by_hash(&list_str, stash_hash) {
                match Command::new("git")
                    .args(["stash", "drop", &stash_ref])
                    .current_dir(dir)
                    .output_with_context()
                    .await
                {
                    Ok(drop_out) if !drop_out.status.success() => {
                        let stderr = String::from_utf8_lossy(&drop_out.stderr);
                        tracing::warn!(
                            dir = %dir.display(),
                            stash_ref = %stash_ref,
                            err = %stderr,
                            "stash drop failed after apply — entry may remain on stack"
                        );
                    }
                    Err(e) => {
                        tracing::warn!(
                            dir = %dir.display(),
                            stash_ref = %stash_ref,
                            error = %e,
                            "stash drop command failed after apply — entry may remain on stack"
                        );
                    }
                    _ => {}
                }
            } else {
                tracing::warn!(
                    dir = %dir.display(),
                    stash = %stash_hash,
                    "stash applied but could not find ref by hash — stash entry may be orphaned on stack"
                );
            }
        }
    } else {
        tracing::warn!(
            dir = %dir.display(),
            stash = %stash_hash,
            "stash apply failed after rebase — stash preserved for manual recovery"
        );
    }
}

/// Commit what the agent left, with the tool the repository uses (see `commit`).
pub async fn auto_commit(
    dir: &Path,
    task_id: &str,
    title: &str,
    agent: &str,
    attempt: u32,
    when: super::commit::When,
) -> anyhow::Result<bool> {
    if !has_changes(dir).await {
        return Ok(false);
    }

    tracing::info!(task_id, "auto-committing uncommitted changes");
    let task_ref = format_task_ref(task_id);
    let message = format!("{title}\n\nTask {task_ref}\nAgent: {agent}\nAttempt: {attempt}");
    match super::commit::commit_all(dir, &message, agent, when).await? {
        super::commit::Outcome::Committed => {
            tracing::info!(task_id, "auto-commit succeeded");
            Ok(true)
        }
        super::commit::Outcome::Nothing => Ok(false),
        super::commit::Outcome::Refused {
            by: super::commit::Tool::Git,
            reason,
        } => {
            tracing::warn!(task_id, err = %reason, "git commit failed");
            Ok(false)
        }
        super::commit::Outcome::Refused { reason, .. } => anyhow::bail!(reason),
    }
}

/// Maximum number of commits to replay during a rebase.
///
/// If a branch has diverged so far from the default branch that it would
/// require replaying more than this many commits, we skip the rebase entirely.
/// This prevents degenerate cases (e.g. a branch forked from the very first
/// commit that now sits 300+ commits behind main) from producing hundreds of
/// add/add conflicts that block the agent and leave the worktree unusable.
const MAX_REBASE_COMMITS: usize = 50;

/// Rebase the current branch on top of `origin/{branch}`.
///
/// Used for push-failure recovery: when another agent has pushed to the same
/// branch, we fetch the latest remote state and rebase local commits on top.
/// Returns `Ok(true)` if rebase succeeded, `Ok(false)` if there was nothing to
/// rebase, and `Err` if rebase failed (conflicts).
///
/// Similar to `rebase_on_default` but targets the feature branch instead of
/// the default branch, and is used after push failures rather than at startup.
pub async fn rebase_on_branch(dir: &Path, branch: &str) -> anyhow::Result<bool> {
    let origin_branch = format!("origin/{branch}");

    // Fetch the remote branch to get latest state.
    // 2-minute timeout mirrors the push timeout to prevent indefinite stalls.
    let fetch = tokio::time::timeout(
        std::time::Duration::from_secs(120),
        git()
            .await
            .args(["fetch", "origin", branch])
            .kill_on_drop(true)
            .current_dir(dir)
            .output(),
    )
    .await
    .map_err(|_| anyhow::anyhow!("git fetch timed out after 120s"))
    .and_then(|r| r.map_err(Into::into));

    match fetch {
        Ok(o) if o.status.success() => {}
        Ok(o) => {
            let stderr = String::from_utf8_lossy(&o.stderr);
            anyhow::bail!("failed to fetch origin/{branch}: {stderr}");
        }
        Err(e) => anyhow::bail!("failed to fetch origin/{branch}: {e}"),
    }

    // Check if there are local commits to rebase.
    let count_output = Command::new("git")
        .args(["rev-list", "--count", &format!("{origin_branch}..HEAD")])
        .current_dir(dir)
        .output_with_context()
        .await;

    let commit_count: usize = match count_output {
        Ok(o) if o.status.success() => {
            let raw = String::from_utf8_lossy(&o.stdout);
            raw.trim().parse().map_err(|e| {
                anyhow::anyhow!(
                    "failed to parse commit count from git rev-list output {:?}: {e}",
                    raw.trim()
                )
            })?
        }
        Ok(o) => {
            let stderr = String::from_utf8_lossy(&o.stderr);
            anyhow::bail!("git rev-list --count failed: {stderr}");
        }
        Err(e) => anyhow::bail!("failed to run git rev-list --count: {e}"),
    };

    if commit_count == 0 {
        // No local commits to rebase — nothing to do.
        return Ok(false);
    }

    if commit_count > MAX_REBASE_COMMITS {
        anyhow::bail!(
            "refusing to rebase {commit_count} commits on origin/{branch} (max {MAX_REBASE_COMMITS})"
        );
    }

    tracing::info!(
        branch = branch,
        commit_count,
        "rebasing local commits on origin/{branch}"
    );

    match stash_rebase_restore(dir, &origin_branch, StashRebaseOpts::default()).await? {
        RebaseOutcome::Succeeded => Ok(true),
        RebaseOutcome::Failed(e) => anyhow::bail!("rebase failed: {e}"),
        RebaseOutcome::Skipped(reason) => anyhow::bail!("rebase skipped: {reason}"),
    }
}

/// Rebase the current branch on the default branch.
///
/// Run before the agent starts to ensure the worktree has the latest code.
/// Fetches both the default branch and the current branch so agents never
/// need to run `git fetch` themselves (important for sandboxed agents like
/// codex whose workspace-write sandbox blocks writes outside the worktree).
/// Non-fatal: if rebase fails (conflicts), the agent may still be able to work.
pub async fn rebase_on_default(dir: &Path, default_branch: &str) {
    // auto_merge leaves a conflicted rebase in place for the agent, aborting it here would undo that
    if rebase_in_progress(dir).await {
        tracing::info!("rebase already in progress, skipping pre-dispatch rebase");
        return;
    }

    // A later force push leases this tip, so fetching someone else's commits cannot permit replacing them
    let branch = get_current_branch(dir).await;
    record_push_lease(dir, &branch, default_branch).await;

    // Fetch current branch (for retries with existing remote commits)
    // and default branch (for rebase) in one call.
    let _ = git()
        .await
        .args(["fetch", "origin"])
        .current_dir(dir)
        .output_with_context()
        .await;

    // Count commits that would be replayed.  If the branch diverged too far
    // back we skip the rebase: replaying hundreds of historical commits produces
    // massive add/add conflicts (the branch adds files that main already has)
    // and leaves the worktree stuck.
    let commit_count = Command::new("git")
        .args([
            "rev-list",
            "--count",
            &format!("origin/{default_branch}..HEAD"),
        ])
        .current_dir(dir)
        .output_with_context()
        .await
        .ok()
        .and_then(|o| {
            String::from_utf8_lossy(&o.stdout)
                .trim()
                .parse::<usize>()
                .ok()
        })
        .unwrap_or(0);

    if commit_count > MAX_REBASE_COMMITS {
        tracing::warn!(
            default_branch,
            commit_count,
            max = MAX_REBASE_COMMITS,
            "skipping rebase: branch has too many commits to replay safely"
        );
        return;
    }

    match stash_rebase_restore(
        dir,
        &format!("origin/{default_branch}"),
        StashRebaseOpts::default(),
    )
    .await
    {
        Ok(RebaseOutcome::Succeeded) => {
            tracing::debug!(default_branch, "rebased worktree on default branch");
        }
        Ok(RebaseOutcome::Failed(e)) => {
            tracing::warn!(default_branch, err = %e, "rebase failed, continuing with current state");
        }
        Ok(RebaseOutcome::Skipped(reason)) => {
            tracing::warn!(default_branch, %reason, "stash failed before rebase, continuing with current state");
        }
        Err(e) => tracing::warn!(err = %e, "rebase error"),
    }
}

async fn rebase_in_progress(dir: &Path) -> bool {
    for name in ["rebase-merge", "rebase-apply"] {
        let out = Command::new("git")
            .args(["rev-parse", "--git-path", name])
            .current_dir(dir)
            .output_with_context()
            .await;
        if let Ok(o) = out {
            let p = String::from_utf8_lossy(&o.stdout).trim().to_string();
            if !p.is_empty() && dir.join(p).exists() {
                return true;
            }
        }
    }
    false
}

/// Tool patterns no agent may run: a worktree shares `.git/config` with the operator's checkout,
/// so a rewritten remote or URL rule would change the main repository
pub(crate) fn remote_change_tools() -> Vec<String> {
    [
        "Bash(git remote set-url*)",
        "Bash(git remote add*)",
        "Bash(git remote remove*)",
        "Bash(git remote rm*)",
        "Bash(git remote rename*)",
        "Bash(git config*remote.*)",
        "Bash(git config*url.*)",
    ]
    .map(String::from)
    .to_vec()
}

/// A `git` command for every call orch makes: GitHub over HTTPS with the gh token, never SSH,
/// and no commit or tag signing, whatever the owner's git config says
pub(crate) async fn git() -> Command {
    let mut cmd = Command::new("git");
    cmd.envs(build_git_auth_env().await).kill_on_drop(true);
    cmd
}

/// Build git config environment variables that inject GitHub token credentials.
///
/// This handles two scenarios:
/// - **SSH remotes** (`git@github.com:user/repo.git`): rewritten to
///   `https://x-access-token:TOKEN@github.com/…` via `insteadOf`.
/// - **HTTPS remotes** (`https://github.com/user/repo.git`): rewritten to
///   `https://x-access-token:TOKEN@github.com/…` via a second `insteadOf`.
///
/// When no token is available, falls back to the legacy SSH→HTTPS conversion
/// without credentials (works for repos that use credential helpers or SSH keys).
///
/// Returns a `Vec<(String, String)>` of environment variable key-value pairs.
/// These are NOT visible in the process list (`ps`), unlike `-c` args.
///
/// Git environment variables:
/// - `GIT_CONFIG_COUNT` — number of config entries
/// - `GIT_CONFIG_KEY_N` — config key for entry N
/// - `GIT_CONFIG_VALUE_N` — config value for entry N
///
/// Signing is switched off too, `commit.gpgsign=false` and `tag.gpgsign=false`
pub(crate) async fn build_git_auth_env() -> Vec<(String, String)> {
    let token = crate::github::token::shared()
        .get_token()
        .await
        .ok()
        .flatten();
    build_git_auth_env_for_token(token)
}

fn build_git_auth_env_for_token(token: Option<String>) -> Vec<(String, String)> {
    let mut config: Vec<(String, String)> = match token {
        Some(t) if !t.is_empty() => {
            let authed = format!("url.https://x-access-token:{t}@github.com/.insteadOf");
            vec![
                (authed.clone(), "https://github.com/".into()),
                (authed, "git@github.com:".into()),
            ]
        }
        _ => vec![(
            "url.https://github.com/.insteadOf".into(),
            "git@github.com:".into(),
        )],
    };
    // orch's git never signs, a signing key would ask the owner for a passphrase or a touch
    config.push(("commit.gpgsign".into(), "false".into()));
    config.push(("tag.gpgsign".into(), "false".into()));

    let mut env = vec![("GIT_CONFIG_COUNT".to_string(), config.len().to_string())];
    for (n, (key, value)) in config.into_iter().enumerate() {
        env.push((format!("GIT_CONFIG_KEY_{n}"), key));
        env.push((format!("GIT_CONFIG_VALUE_{n}"), value));
    }
    env
}

/// Returns `true` if the push error indicates that the GitHub token lacks the
/// `workflow` OAuth scope, which is required to push changes to
/// `.github/workflows/` files.
///
/// GitHub rejects pushes with: "refusing to allow an OAuth App to create or
/// update workflow `…` without `workflow` scope"
pub(crate) fn is_workflow_scope_error(stderr: &str) -> bool {
    stderr.contains("without `workflow` scope")
        || stderr.contains("without 'workflow' scope")
        || (stderr.contains("refusing to allow")
            && stderr.contains("workflow")
            && stderr.contains("scope"))
}

/// Remove `.github/workflows/` files from committed changes and amend the
/// commits so the branch can be pushed without the `workflow` OAuth scope.
///
/// Strategy: find all commits ahead of `origin/{default_branch}`, identify
/// which ones touch `.github/workflows/`, and rewrite them to exclude those
/// files. Uses `git filter-branch`-style approach via interactive rebase
/// with `exec` steps.
///
/// Returns `Ok(true)` if workflow files were removed and commits rewritten,
/// `Ok(false)` if no workflow files were found in the commits.
async fn strip_workflow_files(dir: &Path, default_branch: &str) -> anyhow::Result<bool> {
    // Find workflow files in commits ahead of the default branch
    let output = Command::new("git")
        .args([
            "diff",
            "--name-only",
            &format!("origin/{default_branch}...HEAD"),
            "--",
            ".github/workflows/",
        ])
        .current_dir(dir)
        .output_with_context()
        .await?;

    let workflow_files: Vec<String> = String::from_utf8_lossy(&output.stdout)
        .lines()
        .filter(|l| !l.is_empty())
        .map(std::string::ToString::to_string)
        .collect();

    if workflow_files.is_empty() {
        return Ok(false);
    }

    tracing::info!(
        files = ?workflow_files,
        "stripping workflow files from commits to bypass missing workflow scope"
    );

    // Remove workflow files from the index and amend each commit.
    // We use a soft reset → remove files → re-commit approach for simplicity.
    //
    // Count commits ahead of default branch
    let count_output = Command::new("git")
        .args([
            "rev-list",
            "--count",
            &format!("origin/{default_branch}..HEAD"),
        ])
        .current_dir(dir)
        .output_with_context()
        .await?;

    let commit_count: usize = String::from_utf8_lossy(&count_output.stdout)
        .trim()
        .parse()
        .unwrap_or(0);

    if commit_count == 0 {
        return Ok(false);
    }

    // Save the commit messages before resetting.
    // Use a null byte as the record prefix — null bytes cannot appear in git commit
    // messages, so this separator is unambiguous (unlike a string like ---COMMIT_SEP---
    // which an agent could write into a commit body, corrupting the parse).
    let log_output = Command::new("git")
        .args([
            "log",
            "--format=%x00%H%n%B",
            &format!("origin/{default_branch}..HEAD"),
        ])
        .current_dir(dir)
        .output_with_context()
        .await?;
    let log_text = String::from_utf8_lossy(&log_output.stdout).to_string();

    // Parse commits in reverse order (oldest first).
    // Each record starts with \0 (from %x00 in the format), so split on \0 and
    // discard any leading empty fragment before the first record.
    let commits: Vec<(String, String)> = log_text
        .split('\0')
        .filter(|s| !s.trim().is_empty())
        .map(|block| {
            let block = block.trim();
            let first_nl = block.find('\n').unwrap_or(block.len());
            let hash = block[..first_nl].to_string();
            let msg = block[first_nl..].trim().to_string();
            (hash, msg)
        })
        .collect::<Vec<_>>()
        .into_iter()
        .rev()
        .collect();

    if commits.is_empty() {
        return Ok(false);
    }

    // Soft reset to the base (origin/default_branch)
    let reset = Command::new("git")
        .args(["reset", "--soft", &format!("origin/{default_branch}")])
        .current_dir(dir)
        .output_with_context()
        .await?;

    if !reset.status.success() {
        let stderr = String::from_utf8_lossy(&reset.stderr);
        anyhow::bail!("git reset --soft failed during workflow file stripping: {stderr}");
    }

    // Remove workflow files from the index
    let mut rm_args = vec!["rm", "--cached", "--ignore-unmatch", "--"];
    let file_refs: Vec<&str> = workflow_files
        .iter()
        .map(std::string::String::as_str)
        .collect();
    rm_args.extend(file_refs);

    let rm = Command::new("git")
        .args(&rm_args)
        .current_dir(dir)
        .output_with_context()
        .await?;

    if !rm.status.success() {
        let stderr = String::from_utf8_lossy(&rm.stderr);
        tracing::warn!("git rm --cached for workflow files failed (non-fatal): {stderr}");
    }

    // Re-commit all remaining changes as a single commit preserving the first message.
    // This squashes multiple commits but preserves the work minus workflow files.
    let has_staged = Command::new("git")
        .args(["diff", "--cached", "--quiet"])
        .current_dir(dir)
        .status()
        .await
        .is_ok_and(|s| !s.success());

    if !has_staged {
        tracing::warn!(
            "after removing workflow files, no staged changes remain — \
             the only changes were workflow files"
        );
        // Reset back to where we were — nothing to push
        // Use the original HEAD from the first (newest) commit
        if let Some((hash, _)) = commits.last() {
            let _ = Command::new("git")
                .args(["reset", "--soft", hash])
                .current_dir(dir)
                .output_with_context()
                .await;
        }
        return Ok(false);
    }

    // Use the first commit's message (oldest commit)
    let commit_msg = if commits.len() == 1 {
        commits[0].1.clone()
    } else {
        // Combine messages when squashing
        let mut combined = String::new();
        for (i, (_, msg)) in commits.iter().enumerate() {
            if i > 0 {
                combined.push_str("\n\n");
            }
            combined.push_str(msg);
        }
        combined.push_str("\n\n[workflow files stripped: token lacks `workflow` scope]");
        combined
    };

    // A repair of commits already made, so it lands through git even where shipcheck commits
    let commit = super::commit::git_commit(dir, &commit_msg, "orchestrator").await?;

    if !commit.status.success() {
        let stderr = String::from_utf8_lossy(&commit.stderr);
        // Recovery: restore the original commits so the worktree isn't stuck
        if let Some((original_head, _)) = commits.last() {
            let _ = Command::new("git")
                .args(["reset", "--hard", original_head])
                .current_dir(dir)
                .output_with_context()
                .await;
        }
        anyhow::bail!("git commit failed during workflow file stripping: {stderr}");
    }

    tracing::info!(
        stripped_files = ?workflow_files,
        original_commits = commit_count,
        "successfully stripped workflow files from commits"
    );

    Ok(true)
}

const LEASE_ABSENT: &str = "absent";

/// Force pushes that found no recorded lease and fell back to the fetched tip
static LEASE_FALLBACKS: AtomicU64 = AtomicU64::new(0);

async fn git_stdout(dir: &Path, args: &[&str]) -> Option<String> {
    let out = Command::new("git")
        .args(args)
        .current_dir(dir)
        .output_with_context()
        .await
        .ok()?;
    if !out.status.success() {
        return None;
    }

    Some(String::from_utf8_lossy(&out.stdout).trim().to_string())
}

fn lease_key(branch: &str) -> String {
    format!("branch.{branch}.orchPushLease")
}

async fn read_push_lease(dir: &Path, branch: &str) -> Option<String> {
    git_stdout(dir, &["config", "--get", &lease_key(branch)]).await
}

async fn write_push_lease(dir: &Path, branch: &str, value: &str) {
    if git_stdout(dir, &["config", &lease_key(branch), value])
        .await
        .is_none()
    {
        tracing::warn!(branch, "failed to record push lease");
    }
}

async fn remote_tracking_sha(dir: &Path, branch: &str) -> Option<String> {
    let rev = format!("refs/remotes/origin/{branch}");
    git_stdout(dir, &["rev-parse", "--verify", "--quiet", &rev])
        .await
        .filter(|sha| crate::github::http::is_full_commit_sha(sha))
}

async fn is_ancestor(dir: &Path, ancestor: &str, descendant: &str) -> bool {
    git_stdout(dir, &["merge-base", "--is-ancestor", ancestor, descendant])
        .await
        .is_some()
}

/// Record the remote tip this worktree may replace, before a fetch moves `origin/<branch>`. The lease
/// moves only to a tip HEAD contains, such as the agent's own push, never to one only fetched
pub(crate) async fn record_push_lease(dir: &Path, branch: &str, default_branch: &str) {
    if branch.is_empty() || branch == default_branch {
        return;
    }

    let tip = remote_tracking_sha(dir, branch).await;
    match (read_push_lease(dir, branch).await, tip) {
        (Some(lease), Some(tip)) if lease != tip && is_ancestor(dir, &tip, "HEAD").await => {
            write_push_lease(dir, branch, &tip).await;
        }
        (Some(_), _) => {}
        (None, tip) => {
            let expect = tip.unwrap_or_else(|| LEASE_ABSENT.to_string());
            write_push_lease(dir, branch, &expect).await;
        }
    }
}

/// Drop the lease of a branch whose remote was deleted, so the next dispatch records one for the recreated branch
pub(crate) async fn clear_push_lease(dir: &Path, branch: &str) {
    let _ = git_stdout(dir, &["config", "--unset", &lease_key(branch)]).await;
}

async fn note_pushed_head(dir: &Path, branch: &str) {
    if let Some(sha) = git_stdout(dir, &["rev-parse", "--verify", "HEAD"]).await {
        write_push_lease(dir, branch, &sha).await;
    }
}

/// True when `tip` is GitHub's "Update branch" of `lease`: a merge with first parent `lease` and
/// second parent on the default branch, or a rebase whose commits all have a twin in `lease`
async fn is_github_branch_update(dir: &Path, tip: &str, lease: &str, default_branch: &str) -> bool {
    let base = format!("origin/{default_branch}");
    let Some(line) = git_stdout(dir, &["rev-list", "--parents", "-n", "1", tip]).await else {
        return false;
    };
    let parents: Vec<&str> = line.split_whitespace().skip(1).collect();
    if let [first, second] = parents[..] {
        return first == lease && is_ancestor(dir, second, &base).await;
    }

    // `git cherry` marks each commit in base..tip with `-` when `lease` holds the same patch
    let Some(cherry) = git_stdout(dir, &["cherry", lease, tip, &base]).await else {
        return false;
    };
    is_ancestor(dir, &base, tip).await
        && !cherry.is_empty()
        && cherry.lines().all(|l| l.starts_with('-'))
}

async fn expected_force_sha(
    dir: &Path,
    branch: &str,
    default_branch: &str,
) -> anyhow::Result<String> {
    let tip = remote_tracking_sha(dir, branch).await;
    let base = format!("origin/{default_branch}");
    if let Some(tip) = &tip {
        // A tip the default branch already holds has no commits of its own, so a force push loses nothing
        if is_ancestor(dir, tip, &base).await {
            tracing::info!(branch, %tip, "remote tip is contained in the default branch, leasing it");
            return Ok(tip.clone());
        }
    }

    match read_push_lease(dir, branch).await {
        Some(lease) if lease == LEASE_ABSENT => anyhow::bail!(
            "force push rejected: remote branch {branch} was absent when the lease was recorded"
        ),
        Some(lease) => match tip {
            Some(tip)
                if tip != lease
                    && is_github_branch_update(dir, &tip, &lease, default_branch).await =>
            {
                tracing::info!(branch, %lease, %tip, "remote tip is GitHub's update of the leased branch, leasing it");
                Ok(tip)
            }
            _ => Ok(lease),
        },
        None => {
            let Some(tip) = tip else {
                anyhow::bail!("force push rejected: no remote sha recorded for {branch}");
            };
            let fallbacks = LEASE_FALLBACKS.fetch_add(1, Ordering::Relaxed) + 1;
            tracing::warn!(
                branch,
                fallbacks,
                "no push lease recorded, using the fetched origin tip"
            );
            Ok(tip)
        }
    }
}

/// Force-push `branch` only if the remote still holds the leased sha
pub(crate) async fn force_push_leased(
    dir: &Path,
    branch: &str,
    default_branch: &str,
) -> anyhow::Result<()> {
    let expected = expected_force_sha(dir, branch, default_branch).await?;
    let lease = format!("--force-with-lease={branch}:{expected}");
    tracing::info!(branch, expected_sha = %expected, "force-pushing with an expected remote sha");
    let output = git()
        .await
        .args([
            "-c",
            "lfs.locksverify=false",
            "push",
            &lease,
            "-u",
            "origin",
            branch,
        ])
        .current_dir(dir)
        .kill_on_drop(true)
        .output_with_context()
        .await?;
    if output.status.success() {
        note_pushed_head(dir, branch).await;
        return Ok(());
    }

    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
    anyhow::bail!("{}", sanitize_push_error(&stderr))
}

/// Push the branch to origin.
pub async fn push_branch(dir: &Path, branch: &str, default_branch: &str) -> anyhow::Result<bool> {
    let current = get_current_branch(dir).await;
    let branch_to_push = if current.is_empty() { branch } else { &current };

    // Guard against empty branch names (prevents git config corruption)
    if branch_to_push.is_empty() {
        anyhow::bail!("cannot push: branch name is empty");
    }

    // Skip push for main/master
    if branch_to_push == "main" || branch_to_push == "master" {
        return Ok(false);
    }

    // Check if there are commits to push and whether the remote branch exists
    let (remote_exists, has_unpushed) =
        check_push_needed(dir, branch_to_push, default_branch).await;
    if remote_exists && !has_unpushed {
        // Remote already has this branch and it's up to date — nothing to push.
        // Return true so callers know the branch IS on the remote and PR creation
        // is safe to attempt (e.g. a PR may already exist or can be created).
        tracing::debug!(
            branch = branch_to_push,
            "remote branch exists and is up to date, skipping push"
        );
        note_pushed_head(dir, branch_to_push).await;
        return Ok(true);
    }
    if !remote_exists && !has_unpushed {
        // Branch doesn't exist on the remote and has no commits ahead of the
        // default branch — push it anyway so the branch is created on the remote.
        // PR creation will then fail with "No commits between …" (422) which is
        // handled downstream, rather than with "head invalid" (422) which is
        // harder to distinguish from a real error.
        tracing::debug!(
            branch = branch_to_push,
            "remote branch missing with no new commits — pushing to create it on remote"
        );
    }

    tracing::info!(branch = branch_to_push, "pushing branch");

    // First attempt: normal push (no force).
    // lfs.locksverify=false skips the auxiliary LFS locks/verify roundtrip in
    // the pre-push hook; agents never hold LFS locks, and a transient timeout
    // on that endpoint must not fail the whole push.
    // A 2-minute timeout prevents an indefinitely-stalled push from blocking
    // post-processing and triggering a stuck-task re-dispatch race.
    let output = tokio::time::timeout(
        std::time::Duration::from_secs(120),
        git()
            .await
            .args([
                "-c",
                "lfs.locksverify=false",
                "push",
                "-u",
                "origin",
                branch_to_push,
            ])
            .kill_on_drop(true)
            .current_dir(dir)
            .output(),
    )
    .await
    .map_err(|_| anyhow::anyhow!("git push timed out after 120s"))??;

    if output.status.success() {
        tracing::info!(branch = branch_to_push, "push succeeded");
        note_pushed_head(dir, branch_to_push).await;
        return Ok(true);
    }

    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();

    // Transient network blip (timeout, reset) rather than a ref rejection —
    // retry the identical push once before classifying the run as failed.
    if is_transient_network_error(&stderr) {
        tracing::warn!(
            branch = branch_to_push,
            stderr = %sanitize_push_error(&stderr),
            "push failed with transient network error — retrying once"
        );
        let retry_output = tokio::time::timeout(
            std::time::Duration::from_secs(120),
            git()
                .await
                .args([
                    "-c",
                    "lfs.locksverify=false",
                    "push",
                    "-u",
                    "origin",
                    branch_to_push,
                ])
                .kill_on_drop(true)
                .current_dir(dir)
                .output(),
        )
        .await
        .map_err(|_| anyhow::anyhow!("git push (network retry) timed out after 120s"))??;

        if retry_output.status.success() {
            tracing::info!(branch = branch_to_push, "push succeeded on network retry");
            note_pushed_head(dir, branch_to_push).await;
            return Ok(true);
        }

        let retry_stderr = String::from_utf8_lossy(&retry_output.stderr)
            .trim()
            .to_string();
        tracing::warn!(
            branch = branch_to_push,
            stderr = %sanitize_push_error(&retry_stderr),
            "push retry also failed"
        );
        anyhow::bail!("push failed: {}", sanitize_push_error(&retry_stderr));
    }

    // Handle workflow scope error: the token lacks the `workflow` OAuth scope
    // required to push changes to `.github/workflows/`. Strip workflow files
    // from commits and retry the push.
    if is_workflow_scope_error(&stderr) {
        tracing::warn!(
            branch = branch_to_push,
            "push rejected: token lacks `workflow` scope — stripping workflow files and retrying"
        );

        match strip_workflow_files(dir, default_branch).await {
            Ok(true) => {
                // Workflow files stripped, retry push
                let retry_output = tokio::time::timeout(
                    std::time::Duration::from_secs(120),
                    git()
                        .await
                        .args([
                            "-c",
                            "lfs.locksverify=false",
                            "push",
                            "-u",
                            "origin",
                            branch_to_push,
                        ])
                        .kill_on_drop(true)
                        .current_dir(dir)
                        .output(),
                )
                .await
                .map_err(|_| anyhow::anyhow!("git push (retry) timed out after 120s"))??;

                if retry_output.status.success() {
                    tracing::info!(
                        branch = branch_to_push,
                        "push succeeded after stripping workflow files"
                    );
                    note_pushed_head(dir, branch_to_push).await;
                    return Ok(true);
                }

                let retry_stderr = String::from_utf8_lossy(&retry_output.stderr)
                    .trim()
                    .to_string();

                // If still failing with workflow scope, bail with clear message
                if is_workflow_scope_error(&retry_stderr) {
                    anyhow::bail!(
                        "push failed: token lacks `workflow` OAuth scope and workflow files \
                         could not be fully stripped — add `workflow` scope to your GitHub \
                         token or use a GitHub App for authentication"
                    );
                }

                anyhow::bail!("push failed after stripping workflow files: {retry_stderr}");
            }
            Ok(false) => {
                // No workflow files found to strip (shouldn't happen if error was detected)
                anyhow::bail!(
                    "push failed: token lacks `workflow` OAuth scope — add `workflow` scope \
                     to your GitHub token or use a GitHub App for authentication. \
                     Error: {stderr}"
                );
            }
            Err(e) => {
                tracing::error!(error = %e, "failed to strip workflow files from commits");
                anyhow::bail!(
                    "push failed: token lacks `workflow` OAuth scope and automatic \
                     recovery failed ({e}) — add `workflow` scope to your GitHub token \
                     or use a GitHub App for authentication"
                );
            }
        }
    }

    // Non-fast-forward after `rebase_on_default`. The lease was recorded before that fetch,
    // so this replaces only a tip this worktree already built on
    if push_needs_rebase(&stderr) && remote_exists {
        tracing::info!(
            branch = branch_to_push,
            "push rejected (non-fast-forward), force-pushing with lease"
        );
        let stderr = match force_push_leased(dir, branch_to_push, default_branch).await {
            Ok(()) => {
                tracing::info!(branch = branch_to_push, "force push succeeded");
                return Ok(true);
            }
            Err(e) => e.to_string(),
        };

        // Check if force push also hit the workflow scope error
        if is_workflow_scope_error(&stderr) {
            tracing::warn!(
                branch = branch_to_push,
                "force push also rejected due to workflow scope — stripping and retrying"
            );
            match strip_workflow_files(dir, default_branch).await {
                Ok(true) => {
                    if let Err(e) = force_push_leased(dir, branch_to_push, default_branch).await {
                        anyhow::bail!("force push failed after stripping workflow files: {e}");
                    }

                    tracing::info!(
                        branch = branch_to_push,
                        "force push succeeded after stripping workflow files"
                    );
                    return Ok(true);
                }
                Ok(false) => {
                    anyhow::bail!(
                        "force push failed: token lacks `workflow` OAuth scope — \
                         add `workflow` scope to your GitHub token or use a GitHub App. \
                         Error: {stderr}"
                    );
                }
                Err(e) => {
                    anyhow::bail!(
                        "force push failed: token lacks `workflow` scope and recovery \
                         failed ({e})"
                    );
                }
            }
        }

        // The remote branch moved since the last fetch (GitHub's "Update branch", another
        // clone), so the lease no longer matches. Replay local commits on the new tip once
        if is_stale_lease_error(&stderr) && rebase_on_branch(dir, branch_to_push).await? {
            let output = git()
                .await
                .args([
                    "-c",
                    "lfs.locksverify=false",
                    "push",
                    "-u",
                    "origin",
                    branch_to_push,
                ])
                .current_dir(dir)
                .output_with_context()
                .await?;
            if output.status.success() {
                tracing::info!(
                    branch = branch_to_push,
                    "push succeeded after rebasing on the moved remote branch"
                );
                note_pushed_head(dir, branch_to_push).await;
                return Ok(true);
            }

            let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
            anyhow::bail!("push failed after rebasing on the moved remote branch: {stderr}");
        }

        if is_stale_lease_error(&stderr) {
            tracing::info!(
                branch = branch_to_push,
                "remote branch already holds every local commit, nothing to push"
            );
            return Ok(true);
        }

        anyhow::bail!("force push failed: {stderr}");
    }

    anyhow::bail!("push failed: {stderr}")
}

fn push_needs_rebase(stderr: &str) -> bool {
    let lower = stderr.to_ascii_lowercase();
    lower.contains("non-fast-forward")
        || lower.contains("rejected")
        || lower.contains("fetch first")
        || lower.contains("behind")
}

/// True when `--force-with-lease` refused because the remote ref is not the one last fetched
fn is_stale_lease_error(stderr: &str) -> bool {
    let lower = stderr.to_ascii_lowercase();
    lower.contains("stale info") || lower.contains("remote ref updated since checkout")
}

/// True when a push failure looks like a transient network error (dial
/// timeout, i/o timeout, connection reset) rather than a ref rejection.
/// A refused ref must not be retried, but a blipped endpoint deserves one
/// immediate retry before the run is classified as `push_failed`.
fn is_transient_network_error(stderr: &str) -> bool {
    let lower = stderr.to_ascii_lowercase();
    lower.contains("i/o timeout")
        || lower.contains("dial tcp")
        || lower.contains("connection reset")
        || lower.contains("connection refused")
        || lower.contains("no route to host")
        || lower.contains("temporary failure in name resolution")
        || lower.contains("eof")
}

/// Strip credentials from push stderr before it is logged or returned:
/// URL userinfo (`https://x-access-token:TOKEN@…`) plus any secrets caught
/// by the leak patterns, so a failing push can never write a token to logs.
fn sanitize_push_error(stderr: &str) -> String {
    static URL_USERINFO: LazyLock<Regex> =
        LazyLock::new(|| Regex::new(r"://[^/@\s]+@").expect("valid url userinfo regex"));
    let no_userinfo = URL_USERINFO.replace_all(stderr, "://***@");
    crate::security::redact(&no_userinfo)
}

/// Drop sentences and list items about pushing or opening the PR
/// Agents report they could not push, orch already pushed, so those lines read as false on GitHub
fn strip_push_and_pr_creation(text: &str) -> String {
    let mut kept_lines: Vec<String> = Vec::new();
    for line in text.lines() {
        if line.trim().is_empty() {
            if kept_lines.last().is_some_and(|l| !l.is_empty()) {
                kept_lines.push(String::new());
            }
            continue;
        }

        let indent_len = line.len() - line.trim_start().len();
        let indent = &line[..indent_len];
        let trimmed = line.trim();
        let (marker, rest) = match list_marker(trimmed) {
            Some((m, r)) => (m, r),
            None => ("", trimmed),
        };

        let kept: Vec<&str> = split_statements(rest)
            .into_iter()
            .filter(|s| !is_push_or_pr_creation_statement(s))
            .collect();
        if kept.is_empty() {
            continue;
        }
        kept_lines.push(format!("{indent}{marker}{}", kept.join(" ")));
    }
    while kept_lines.last().is_some_and(String::is_empty) {
        kept_lines.pop();
    }
    kept_lines.join("\n")
}

fn split_statements(text: &str) -> Vec<&str> {
    static SEP: LazyLock<Regex> =
        LazyLock::new(|| Regex::new(r"(\.{2,}|(?:[.!?]))\s+").expect("valid statement separator"));
    let mut statements = Vec::new();
    let mut last = 0;
    for cap in SEP.captures_iter(text) {
        let full = cap.get(0).expect("full separator match");
        let punct = cap.get(1).expect("punctuation capture");
        let ellipsis = punct.as_str().len() >= 2 && punct.as_str().bytes().all(|b| b == b'.');
        let end = if ellipsis { punct.start() } else { punct.end() };
        let stmt = text[last..end].trim();
        if !stmt.is_empty() {
            statements.push(stmt);
        }
        last = full.end();
    }
    let rest = text[last..].trim();
    if !rest.is_empty() {
        statements.push(rest);
    }
    statements
}

fn list_marker(line: &str) -> Option<(&str, &str)> {
    for prefix in ["- ", "* ", "+ "] {
        if let Some(rest) = line.strip_prefix(prefix) {
            return Some((prefix, rest));
        }
    }
    let dot = line.find(". ")?;
    if !line[..dot].is_empty() && line[..dot].bytes().all(|b| b.is_ascii_digit()) {
        Some((&line[..dot + 2], &line[dot + 2..]))
    } else {
        None
    }
}

fn is_push_or_pr_creation_statement(text: &str) -> bool {
    static PAT: LazyLock<Regex> = LazyLock::new(|| {
        Regex::new(concat!(
            r"(?i)",
            r"\bgit\s+push\b",
            r"|\bgh\s+pr\s+create\b",
            r"|\bgh\s+pr\s+open\b",
            r"|\bpush\s+(was\s+)?(denied|blocked|rejected)\b",
            r"|\bpush\s+permission\b",
            r"|\bcouldn['’]?t\s+push\b",
            r"|\bcould\s+not\s+push\b",
            r"|\bcan['’]?t\s+push\b",
            r"|\bcannot\s+push\b",
            r"|\bdidn['’]?t\s+push\b",
            r"|\bdid\s+not\s+push\b",
            r"|\bnothing\s+is\s+on\s+the\s+remote\b",
            r"|\bnot\s+on\s+the\s+remote\b",
            r"|\bopen(?:ing)?\s+(?:the|a)\s+pr\b",
            r"|\bcreat(?:e|ing)\s+(?:the|a)\s+pr\b",
            r"|\bopen(?:ing)?\s+(?:the|a)\s+pull\s+request\b",
            r"|\bcreat(?:e|ing)\s+(?:the|a)\s+pull\s+request\b",
        ))
        .expect("valid push/pr-creation regex")
    });
    PAT.is_match(text)
}

fn cleaned_pr_items(items: &[String]) -> Vec<String> {
    items
        .iter()
        .filter_map(|item| {
            let cleaned = strip_push_and_pr_creation(item);
            (!cleaned.is_empty()).then_some(cleaned)
        })
        .collect()
}

/// Format the GitHub PR description from the agent summary, stripping push and PR-creation statements
#[expect(
    clippy::too_many_arguments,
    reason = "each argument is one section of the PR body"
)]
fn build_pr_body(
    title: &str,
    summary: &str,
    accomplished: &[String],
    remaining: &[String],
    files: &[String],
    task_id: &str,
    agent: &str,
    model: Option<&str>,
) -> String {
    use std::fmt::Write as _;
    let cleaned_summary = strip_push_and_pr_creation(summary);
    let summary_text = if cleaned_summary.is_empty() {
        title
    } else {
        cleaned_summary.as_str()
    };
    let accomplished = cleaned_pr_items(accomplished);
    let remaining = cleaned_pr_items(remaining);

    let mut body = format!("## Summary\n\n{summary_text}");

    if !accomplished.is_empty() {
        body.push_str("\n\n### What was done\n\n");
        for item in &accomplished {
            let _ = writeln!(body, "- {item}");
        }
    }

    if !remaining.is_empty() {
        body.push_str("\n\n### Remaining\n\n");
        for item in &remaining {
            let _ = writeln!(body, "- {item}");
        }
    }

    if !files.is_empty() {
        body.push_str("\n\n### Files changed\n\n");
        for file in files {
            let _ = writeln!(body, "- `{file}`");
        }
    }

    if !task_id.starts_with("internal:")
        && let Ok(issue_num) = task_id.parse::<u64>()
    {
        let _ = write!(body, "\n\nCloses #{issue_num}");
    }

    let model_str = model.map(|m| format!(" using `{m}`")).unwrap_or_default();
    let task_ref = format_task_ref(task_id);
    let _ = write!(
        body,
        "\n\n---\n*Task {task_ref} · Created by {agent}[bot] via [Orch](https://github.com/gabrielkoerich/orch){model_str}*"
    );
    body
}

/// Create a PR if one doesn't already exist.
///
/// Uses [`GhHttp`] exclusively for GitHub API operations. No `gh` CLI
/// fallback is used, ensuring consistent behavior across environments.
///
/// # Returns
/// - `Ok(url)` - PR URL (newly created or already existed)
/// - `Err(PrCreateError)` - API error or other failure
#[expect(
    clippy::too_many_arguments,
    reason = "the PR needs its branch, body sections, attribution and target together"
)]
pub async fn create_pr_if_needed(
    dir: &Path,
    branch: &str,
    title: &str,
    summary: &str,
    accomplished: &[String],
    remaining: &[String],
    files: &[String],
    task_id: &str,
    agent: &str,
    model: Option<&str>,
    repo: &str,
    base_branch: &str,
) -> PrCreateResult<String> {
    // Retries for transient 5xx errors on PR creation below
    const MAX_RETRIES: u32 = 3;
    let gh = GhHttp::new()?;

    // Check if PR already exists using GhHttp API
    match gh.get_pr_number(repo, branch).await {
        Ok(Some(pr_number)) => {
            tracing::info!(task_id, pr = pr_number, "PR already exists");
            // Append attribution footer if the agent created the PR without one.
            append_pr_footer_if_missing(&gh, repo, pr_number, task_id, agent, model).await;
            // Fetch the existing PR to get its URL so the caller can store pr_number.
            let pr = match gh.get_pr(repo, pr_number).await {
                Ok(pr) => pr,
                Err(e) => {
                    tracing::warn!(task_id, error = %e, "get_pr API call failed after detecting existing PR");
                    return Err(PrCreateError::ApiError(e));
                }
            };
            return Ok(pr.html_url);
        }
        Ok(None) => {
            // No PR exists, proceed to create one
        }
        Err(e) => {
            tracing::warn!(task_id, error = %e, "get_pr_number API call failed");
            return Err(PrCreateError::ApiError(e));
        }
    }

    // When the agent didn't self-report files, derive them from git.
    let git_files: Vec<String>;
    let effective_files: &[String] = if files.is_empty() {
        match tokio::process::Command::new("git")
            .args([
                "diff",
                &format!("origin/{base_branch}...HEAD"),
                "--name-only",
            ])
            .current_dir(dir)
            .output()
            .await
        {
            Ok(output) if output.status.success() => {
                git_files = String::from_utf8_lossy(&output.stdout)
                    .lines()
                    .filter(|l| !l.is_empty())
                    .map(std::string::ToString::to_string)
                    .collect();
                &git_files
            }
            _ => files,
        }
    } else {
        files
    };

    let body = build_pr_body(
        title,
        summary,
        accomplished,
        remaining,
        effective_files,
        task_id,
        agent,
        model,
    );

    // Always use the short task title for the PR title (summary goes in body)
    let pr_title = title;

    // Create PR using GhHttp API with exponential backoff retry for transient 5xx errors.
    let mut last_error: Option<anyhow::Error> = None;
    let mut created_url: Option<String> = None;
    let mut had_transient_error = false;
    let mut effective_base = base_branch.to_string();
    let mut tried_api_fallback = false;

    for attempt in 1..=MAX_RETRIES {
        match gh
            .create_pr(repo, pr_title, &body, branch, &effective_base)
            .await
        {
            Ok(u) => {
                created_url = Some(u);
                break;
            }
            Err(e) => {
                let err_str = format!("{e}");
                if is_transient_github_error(&err_str) {
                    had_transient_error = true;
                    if attempt < MAX_RETRIES {
                        let delay = std::time::Duration::from_secs(2u64.pow(attempt));
                        tracing::warn!(
                            task_id,
                            attempt,
                            delay_secs = delay.as_secs(),
                            error = %e,
                            "transient GitHub API error during PR creation — retrying"
                        );
                        tokio::time::sleep(delay).await;
                    }
                } else if is_invalid_base_error(&err_str) && !tried_api_fallback {
                    // Local base branch detection was wrong (e.g. "remotes/origin/main").
                    // Query GitHub API for the canonical default branch and retry once.
                    tried_api_fallback = true;
                    tracing::warn!(
                        task_id,
                        base_branch = %effective_base,
                        error = %e,
                        "PR creation failed with invalid base — fetching default branch from GitHub API"
                    );
                    match gh.get_default_branch(repo).await {
                        Ok(api_default) if api_default != effective_base => {
                            tracing::info!(
                                task_id,
                                old_base = %effective_base,
                                new_base = %api_default,
                                "retrying PR creation with GitHub API default branch"
                            );
                            effective_base = api_default;
                            continue;
                        }
                        Ok(api_default) => {
                            tracing::warn!(
                                task_id,
                                base_branch = %api_default,
                                "GitHub API default branch matches local — no fallback possible"
                            );
                        }
                        Err(api_err) => {
                            tracing::warn!(
                                task_id,
                                error = %api_err,
                                "failed to fetch default branch from GitHub API"
                            );
                        }
                    }
                }
                last_error = Some(e);
            }
        }
    }

    let url = if let Some(u) = created_url {
        u
    } else {
        let e = last_error.unwrap_or_else(|| {
            anyhow::anyhow!("PR creation failed after retries (no error captured)")
        });
        let err_str = format!("{e}");
        // For transient 5xx errors, GitHub may have created the PR despite returning
        // an error (e.g. 502 after the write succeeded). Re-check for an existing PR
        // before propagating the failure so we don't orphan the PR from the task.
        // Also check when the final error is non-transient but a prior attempt had a
        // transient error — the PR may have been created on that earlier attempt (e.g.
        // attempt 1 returns 502, attempt 2 returns 422 "already exists").
        if is_transient_github_error(&err_str) || had_transient_error {
            tracing::warn!(
                task_id,
                error = %e,
                "transient GitHub API error after all retries — checking if PR was actually created"
            );
            match gh.get_pr_number(repo, branch).await {
                Ok(Some(pr_number)) => {
                    tracing::info!(
                        task_id,
                        pr = pr_number,
                        "PR was created despite transient errors — recovering"
                    );
                    append_pr_footer_if_missing(&gh, repo, pr_number, task_id, agent, model).await;
                    match gh.get_pr(repo, pr_number).await {
                        Ok(pr) => pr.html_url,
                        Err(get_err) => {
                            tracing::warn!(
                                task_id,
                                error = %get_err,
                                "failed to fetch PR URL after transient-error recovery"
                            );
                            return Err(PrCreateError::ApiError(e));
                        }
                    }
                }
                Ok(None) => {
                    tracing::warn!(
                        task_id,
                        "PR was not created after all retries — propagating original error"
                    );
                    return Err(PrCreateError::ApiError(e));
                }
                Err(check_err) => {
                    tracing::warn!(
                        task_id,
                        error = %check_err,
                        "failed to verify PR existence after transient error retries — propagating original error"
                    );
                    return Err(PrCreateError::ApiError(e));
                }
            }
        } else {
            return Err(PrCreateError::ApiError(e));
        }
    };

    tracing::info!(task_id, pr_url = %url, "created PR via GhHttp API");

    Ok(url)
}

/// Returns true if the error string indicates a transient GitHub API failure
/// (HTTP 5xx, network errors, DNS failures, TLS issues, rate limits), where
/// the operation may succeed on retry.
pub(crate) fn is_transient_github_error(err_str: &str) -> bool {
    // Treat transport/send failures and explicit GhHttp server-error messages
    // as transient. Older callers relied on parsing the "failed (NNN)" pattern
    // to detect 5xx — keep that, but also recognize the newer wrappers.
    if err_str.contains("HTTP send failed") {
        return true;
    }
    if err_str.contains("GitHub API server error") {
        return true;
    }

    // Check for HTTP 5xx status codes
    if extract_github_http_status(err_str).is_some_and(|s| (500..600).contains(&s)) {
        return true;
    }

    // Check for common network-level transient errors
    let lower = err_str.to_lowercase();

    // Connection and transport errors
    if lower.contains("connection reset")
        || lower.contains("broken pipe")
        || lower.contains("connection refused")
        || lower.contains("connection closed")
        || lower.contains("transport error")
        || lower.contains("failed to connect")
        || lower.contains("failed to connect to github.com port")
        || lower.contains("curl: (7) failed to connect")
        || lower.contains("couldn't connect to server")
        || lower.contains("could not connect to server")
    {
        return true;
    }

    // Timeout errors
    if lower.contains("timeout") {
        return true;
    }

    // DNS resolution errors
    if lower.contains("dns error")
        || lower.contains("resolve")
        || lower.contains("name resolution")
        || lower.contains("no such host")
    {
        return true;
    }

    // TLS/SSL errors
    if lower.contains("tls handshake")
        || lower.contains("certificate")
        || lower.contains("ssl error")
    {
        return true;
    }

    // Network unreachable errors
    if lower.contains("network is unreachable")
        || lower.contains("host unreachable")
        || lower.contains("temporary failure")
    {
        return true;
    }

    // EOF errors (connection dropped mid-request)
    if lower.contains("unexpected eof") || lower.contains("unexpected end of file") {
        return true;
    }

    // Internal circuit-breaker state (orch's own GitHub 5xx protection)
    if lower.contains("circuit-breaker") || lower.contains("circuit breaker") {
        return true;
    }

    // Rate limit errors (transient with cooldown/retry)
    if lower.contains("rate limit") || lower.contains("too many requests") {
        return true;
    }

    false
}

/// Returns true when the error indicates the PR base branch is invalid.
///
/// GitHub returns HTTP 422 with `PullRequest.base invalid` when the base
/// branch name is not a valid ref in the repository. This is a terminal
/// configuration error — retrying with the same base will never succeed.
pub(crate) fn is_invalid_base_error(err_str: &str) -> bool {
    let lower = err_str.to_lowercase();
    lower.contains("422") && lower.contains("base") && lower.contains("invalid")
}

/// Returns true when an error looks like a transient *GitHub API/CLI* failure.
///
/// This is stricter than [`is_transient_github_error`]: in addition to matching
/// a transient transport pattern, it requires GitHub-specific context in the
/// message. This prevents generic agent/runtime transport failures (for
/// example "broken pipe" from a model stream disconnect) from being treated as
/// GitHub retry signals in review reroute logic.
pub(crate) fn is_transient_github_api_error(err_str: &str) -> bool {
    if !is_transient_github_error(err_str) {
        return false;
    }

    if extract_github_http_status(err_str).is_some() {
        return true;
    }

    let lower = err_str.to_lowercase();
    lower.contains("github")
        || lower.contains("api.github.com")
        || lower.contains("gh api")
        || lower.contains("gh pr")
        || lower.contains("gh error")
        // `circuit-breaker` is orch's internal GitHub 5xx protection, set
        // exclusively by GhHttp.  It can never originate from agent/runtime
        // failures, so treating it as a GitHub-context marker is safe even
        // when upstream wrapping strips the "GitHub API" prefix.
        || lower.contains("circuit-breaker")
        || lower.contains("circuit breaker")
}

/// Extract the HTTP status code from a GhHttp error string.
///
/// GhHttp formats errors as: `"GitHub API POST https://... failed (NNN): body"`
/// This parses the numeric status code from that format.
fn extract_github_http_status(err_str: &str) -> Option<u16> {
    let marker = "failed (";
    let start = err_str.find(marker)? + marker.len();
    let rest = &err_str[start..];
    let end = rest.find(')')?;
    rest[..end].parse().ok()
}

/// Append the Orch attribution footer to an existing PR body if not already present.
///
/// Called when the agent created the PR directly (bypassing orch's
/// `create_pr_if_needed`), so the footer was never added by `build_pr_body`.
async fn append_pr_footer_if_missing(
    gh: &GhHttp,
    repo: &str,
    pr_number: u64,
    task_id: &str,
    agent: &str,
    model: Option<&str>,
) {
    let pr = match gh.get_pr(repo, pr_number).await {
        Ok(pr) => pr,
        Err(e) => {
            tracing::debug!(task_id, error = %e, "failed to fetch PR for footer check");
            return;
        }
    };

    let body = pr.body.unwrap_or_default();
    if body.contains("via [Orch]") {
        return; // Footer already present
    }

    let model_str = model.map(|m| format!(" using `{m}`")).unwrap_or_default();
    let task_ref = format_task_ref(task_id);
    let footer = format!(
        "\n\n---\n*Task {task_ref} · Created by {agent}[bot] via [Orch](https://github.com/gabrielkoerich/orch){model_str}*"
    );
    let new_body = format!("{body}{footer}");

    match gh.update_pr_body(repo, pr_number, &new_body).await {
        Err(e) => {
            tracing::warn!(task_id, error = %e, "failed to append footer to PR (non-fatal)");
        }
        _ => {
            tracing::info!(
                task_id,
                pr = pr_number,
                "appended attribution footer to agent-created PR"
            );
        }
    }
}

/// Get the current branch name.
pub(crate) async fn get_current_branch(dir: &Path) -> String {
    let output = Command::new("git")
        .args(["branch", "--show-current"])
        .current_dir(dir)
        .output_with_context()
        .await;

    match output {
        Ok(o) if o.status.success() => String::from_utf8_lossy(&o.stdout).trim().to_string(),
        _ => String::new(),
    }
}

/// Count the number of changed files in the working directory.
pub async fn count_changed_files(dir: &Path) -> anyhow::Result<usize> {
    // Count modified and new files (excluding deleted)
    let output = Command::new("git")
        .args(["status", "--porcelain"])
        .current_dir(dir)
        .output_with_context()
        .await?;

    let status_output = String::from_utf8_lossy(&output.stdout);
    let count = status_output
        .lines()
        .filter(|line| {
            let prefix = line.get(0..2).unwrap_or("");
            // Count modified (M), added (A), renamed (R), copied (C), untracked (??)
            prefix.starts_with('M')
                || prefix.starts_with('A')
                || prefix.starts_with('R')
                || prefix.starts_with('C')
                || prefix.starts_with('?')
        })
        .count();

    Ok(count)
}

/// Check if there are unpushed commits.
/// Returns `(remote_exists, has_unpushed_commits)`.
///
/// - `remote_exists` — whether `origin/<branch>` is known to the local repo.
/// - `has_unpushed_commits` — whether there are local commits not yet on the
///   remote.  When the remote branch doesn't exist the comparison is against
///   `origin/<default_branch>` so we can still detect new work.
async fn check_push_needed(dir: &Path, branch: &str, default_branch: &str) -> (bool, bool) {
    // Check if remote tracking branch exists
    let remote_exists = Command::new("git")
        .args(["rev-parse", &format!("origin/{branch}")])
        .current_dir(dir)
        .output_with_context()
        .await
        .is_ok_and(|o| o.status.success());

    let compare_ref = if remote_exists {
        format!("origin/{branch}..HEAD")
    } else {
        // Compare against default branch (passed in, NOT detected from
        // current HEAD — in a worktree HEAD is the feature branch itself)
        format!("origin/{default_branch}..HEAD")
    };

    tracing::debug!(
        branch,
        compare_ref,
        remote_exists,
        "checking unpushed commits"
    );

    let output = Command::new("git")
        .args(["log", &compare_ref, "--oneline"])
        .current_dir(dir)
        .output_with_context()
        .await;

    let has_unpushed = match output {
        Ok(o) if o.status.success() => {
            let out = String::from_utf8_lossy(&o.stdout);
            let has = !out.trim().is_empty();
            tracing::debug!(branch, has_unpushed = has, "unpushed commits check result");
            has
        }
        _ => {
            tracing::debug!(branch, "git log failed for compare ref, assuming unpushed");
            // If we can't determine, assume there ARE commits to push
            // (better to attempt push and let it fail than silently skip)
            true
        }
    };

    (remote_exists, has_unpushed)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn pr_create_error_display() {
        let err = PrCreateError::ApiError(anyhow::anyhow!("test error"));
        assert_eq!(format!("{err}"), "GitHub API error: test error");
    }

    #[test]
    fn pr_create_error_from_anyhow() {
        let anyhow_err = anyhow::anyhow!("source error");
        let pr_err: PrCreateError = anyhow_err.into();
        assert!(matches!(pr_err, PrCreateError::ApiError(_)));
    }

    #[test]
    fn git_env_never_signs_with_or_without_a_token() {
        for env in [
            build_git_auth_env_for_token(None),
            build_git_auth_env_for_token(Some("ghp_testtoken1234".into())),
        ] {
            let get = |key: &str| env.iter().find(|(k, _)| k == key).map(|(_, v)| v.clone());
            let count: usize = get("GIT_CONFIG_COUNT").unwrap().parse().unwrap();
            let config: Vec<(String, String)> = (0..count)
                .map(|n| {
                    (
                        get(&format!("GIT_CONFIG_KEY_{n}")).unwrap(),
                        get(&format!("GIT_CONFIG_VALUE_{n}")).unwrap(),
                    )
                })
                .collect();
            assert!(config.contains(&("commit.gpgsign".into(), "false".into())));
            assert!(config.contains(&("tag.gpgsign".into(), "false".into())));
        }
    }

    #[test]
    fn build_git_auth_env_without_token_falls_back_to_ssh_https_conversion() {
        // Pass None directly to test the no-token path without relying on env vars
        // or the gh CLI, keeping the test deterministic regardless of local auth state.
        let env = build_git_auth_env_for_token(None);

        // When no token is available the fallback must include the SSH insteadOf rule.
        // The SSH→HTTPS conversion sets the target URL (the rewrite destination) to git@github.com:.
        let has_ssh_rule = env
            .iter()
            .any(|(k, v)| k == "GIT_CONFIG_VALUE_0" && v == "git@github.com:");
        assert!(
            has_ssh_rule,
            "expected SSH insteadOf fallback (value is git@github.com:), got: {env:?}"
        );
    }

    #[test]
    fn build_git_auth_env_with_token_covers_both_ssh_and_https() {
        // Pass a pre-built token directly to test the token path without touching env vars.
        let env = build_git_auth_env_for_token(Some("ghp_testtoken1234".into()));

        // Must contain the token in the auth URL (the token is in the value of GIT_CONFIG_KEY_N).
        let has_token = env
            .iter()
            .any(|(_, v)| v.contains("x-access-token:ghp_testtoken1234@github.com"));
        assert!(has_token, "expected token in auth URL, got: {env:?}");
        // Must cover HTTPS origins (GIT_CONFIG_VALUE_0 is the HTTPS source URL).
        let has_https_rule = env
            .iter()
            .any(|(k, v)| k == "GIT_CONFIG_VALUE_0" && v == "https://github.com/");
        assert!(
            has_https_rule,
            "expected HTTPS insteadOf rule, got: {env:?}"
        );
        // Must cover SSH origins (GIT_CONFIG_VALUE_1 is the SSH source URL).
        let has_ssh_rule = env
            .iter()
            .any(|(k, v)| k == "GIT_CONFIG_VALUE_1" && v == "git@github.com:");
        assert!(has_ssh_rule, "expected SSH insteadOf rule, got: {env:?}");
    }

    #[test]
    fn find_stash_ref_by_hash_returns_matching_reference() {
        let stash_list = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa stash@{1}\nbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb stash@{0}";

        assert_eq!(
            find_stash_ref_by_hash(stash_list, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
            Some("stash@{1}".to_string())
        );
        assert_eq!(
            find_stash_ref_by_hash(stash_list, "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"),
            Some("stash@{0}".to_string())
        );
    }

    #[test]
    fn find_stash_ref_by_hash_returns_none_when_missing_or_malformed() {
        let stash_list = "malformed-line\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa stash@{2}";

        assert_eq!(
            find_stash_ref_by_hash(stash_list, "cccccccccccccccccccccccccccccccccccccccc"),
            None
        );
        assert_eq!(find_stash_ref_by_hash("", "anything"), None);
    }

    #[test]
    fn push_needs_rebase_detects_common_rejections() {
        assert!(push_needs_rebase(
            "! [rejected] branch -> branch (fetch first)"
        ));
        assert!(push_needs_rebase("non-fast-forward update was rejected"));
        assert!(push_needs_rebase(
            "push rejected because the remote contains work"
        ));
    }

    #[test]
    fn is_transient_network_error_detects_lfs_locks_timeout() {
        let lfs_err = "Post \"https://x-access-token:***@github.com/o/r.git/info/lfs/locks/verify\": dial tcp 140.82.112.4:443: i/o timeout";
        assert!(is_transient_network_error(lfs_err));
        assert!(is_transient_network_error(
            "dial tcp 140.82.112.4:443: connect: connection refused"
        ));
        assert!(is_transient_network_error(
            "read tcp 10.0.0.1:51234->140.82.112.4:443: read: connection reset by peer"
        ));
    }

    #[test]
    fn is_transient_network_error_rejects_ref_rejections() {
        assert!(!is_transient_network_error(
            "! [rejected] branch -> branch (fetch first)"
        ));
        assert!(!is_transient_network_error(
            "remote: error: GH006: Protected branch update failed"
        ));
    }

    #[test]
    fn sanitize_push_error_strips_url_credentials() {
        // Shape must not look like a real GitHub PAT so gitleaks stays clean
        let raw = "Post \"https://x-access-token:test-secret-1234567890abcdef@github.com/o/r.git/info/lfs/locks/verify\": dial tcp 140.82.112.4:443: i/o timeout";
        let sanitized = sanitize_push_error(raw);
        assert!(!sanitized.contains("test-secret-1234567890abcdef"));
        assert!(sanitized.contains("://***@github.com"));
        assert!(sanitized.contains("i/o timeout"));
    }

    #[test]
    fn extract_github_http_status_parses_ghhttp_error_format() {
        let err =
            "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (502): Bad Gateway";
        assert_eq!(extract_github_http_status(err), Some(502));

        let err500 = "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (500): Internal Server Error";
        assert_eq!(extract_github_http_status(err500), Some(500));

        let err422 = "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (422): Unprocessable Entity";
        assert_eq!(extract_github_http_status(err422), Some(422));

        let not_github = "some other error";
        assert_eq!(extract_github_http_status(not_github), None);
    }

    #[test]
    fn is_transient_github_error_matches_5xx_only() {
        let err502 =
            "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (502): Bad Gateway";
        assert!(is_transient_github_error(err502));

        let err503 = "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (503): Service Unavailable";
        assert!(is_transient_github_error(err503));

        let err422 = "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (422): Unprocessable Entity";
        assert!(!is_transient_github_error(err422));

        let err404 =
            "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (404): Not Found";
        assert!(!is_transient_github_error(err404));
    }

    #[test]
    fn is_transient_github_error_matches_connection_errors() {
        // Connection-related transient errors
        assert!(is_transient_github_error("connection refused"));
        assert!(is_transient_github_error("Connection reset by peer"));
        assert!(is_transient_github_error("broken pipe"));
        assert!(is_transient_github_error("connection closed unexpectedly"));
        assert!(is_transient_github_error(
            "transport error: connection lost"
        ));

        // Git/Curl connect-failure patterns (review push failures)
        assert!(is_transient_github_error(
            "fatal: unable to access 'https://github.com/owner/repo.git/': Failed to connect to github.com port 443 after 20990 ms: Couldn't connect to server"
        ));
        assert!(is_transient_github_error(
            "Failed to connect to github.com port 443: Connection timed out"
        ));
        assert!(is_transient_github_error(
            "Failed to connect to github.com port 443: Connection refused"
        ));
        assert!(is_transient_github_error(
            "curl: (7) Failed to connect to github.com port 443: Couldn't connect to server"
        ));
        assert!(is_transient_github_error(
            "fatal: unable to access 'https://github.com/owner/repo.git/': Couldn't connect to server"
        ));
    }

    #[test]
    fn is_transient_github_error_matches_dns_errors() {
        // DNS resolution failures
        assert!(is_transient_github_error("dns error: failed to lookup"));
        assert!(is_transient_github_error("failed to resolve hostname"));
        assert!(is_transient_github_error("name resolution failed"));
        assert!(is_transient_github_error("no such host: api.github.com"));
    }

    #[test]
    fn is_transient_github_error_matches_tls_errors() {
        // TLS/SSL handshake failures
        assert!(is_transient_github_error("tls handshake failed"));
        assert!(is_transient_github_error("certificate verification failed"));
        assert!(is_transient_github_error("ssl error: unknown ca"));
    }

    #[test]
    fn is_transient_github_error_matches_network_unreachable() {
        // Network unreachable errors
        assert!(is_transient_github_error("network is unreachable"));
        assert!(is_transient_github_error("host unreachable"));
        assert!(is_transient_github_error(
            "temporary failure in name resolution"
        ));
    }

    #[test]
    fn is_transient_github_error_matches_eof_errors() {
        // EOF/connection dropped errors
        assert!(is_transient_github_error("unexpected eof while reading"));
        assert!(is_transient_github_error("unexpected end of file"));
    }

    #[test]
    fn is_transient_github_error_matches_rate_limit() {
        // Rate limit errors (transient with cooldown)
        assert!(is_transient_github_error("rate limit exceeded"));
        assert!(is_transient_github_error("429 Too Many Requests"));
        assert!(is_transient_github_error("too many requests, retry later"));
    }

    #[test]
    fn is_transient_github_error_matches_timeout() {
        // Timeout errors
        assert!(is_transient_github_error("operation timeout"));
        assert!(is_transient_github_error("request timeout"));
    }

    #[test]
    fn is_transient_github_error_rejects_non_transient() {
        // Non-transient errors should not match
        assert!(!is_transient_github_error("permission denied"));
        assert!(!is_transient_github_error("file not found"));
        assert!(!is_transient_github_error("invalid argument"));
        assert!(!is_transient_github_error("authentication failed"));
        assert!(!is_transient_github_error("bad credentials"));
    }

    #[test]
    fn is_transient_github_api_error_requires_github_context() {
        assert!(is_transient_github_api_error(
            "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (502): Bad Gateway"
        ));
        assert!(is_transient_github_api_error(
            "gh error: transport error: connection reset by peer"
        ));
        assert!(is_transient_github_api_error(
            "push failed: fatal: unable to access 'https://github.com/owner/repo.git/': Failed to connect to github.com port 443 after 20990 ms: Couldn't connect to server"
        ));
        assert!(!is_transient_github_api_error(
            "codex failed: Reconnecting... (stream disconnected before completion: Broken pipe)"
        ));
        assert!(!is_transient_github_api_error(
            "agent stream failed: failed to connect to local relay"
        ));
    }

    #[test]
    fn is_transient_github_api_error_matches_circuit_breaker() {
        // Full message from GhHttp
        assert!(is_transient_github_api_error(
            "GitHub API transient 5xx circuit-breaker active for 240s"
        ));
        // Wrapped through PrCreateError + response_handler
        assert!(is_transient_github_api_error(
            "create PR failed: GitHub API error: GitHub API transient 5xx circuit-breaker active"
        ));
        // Shortened form where upstream wrapping stripped the "GitHub API" prefix —
        // circuit-breaker alone must still be recognized as a GitHub signal.
        assert!(is_transient_github_api_error(
            "create PR failed: circuit-breaker"
        ));
        // Spaced variant
        assert!(is_transient_github_api_error(
            "create PR failed: circuit breaker tripped"
        ));
    }

    #[tokio::test]
    async fn auto_commit_unstages_files_on_commit_failure() {
        // Create a temp git repo with one initial commit
        let dir =
            std::env::temp_dir().join(format!("orch_test_auto_commit_{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();

        // Init repo
        let _ = Command::new("git")
            .args(["init"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.email", "test@test.com"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.name", "Test"])
            .current_dir(&dir)
            .output()
            .await;
        // Create initial file and commit
        std::fs::write(dir.join("init.txt"), "init").unwrap();
        let _ = Command::new("git")
            .args(["add", "init.txt"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["-c", "commit.gpgsign=false", "commit", "-m", "init"])
            .current_dir(&dir)
            .output()
            .await;

        // Create a new file (unstaged)
        std::fs::write(dir.join("new_file.txt"), "content").unwrap();

        // Verify has_changes sees it
        assert!(has_changes(&dir).await);

        // auto_commit should return false (no git user.email configured for this
        // test repo would cause commit to fail if we hadn't set it, but we did —
        // so this test verifies the happy path too).
        // For this test, the commit should succeed since we set user.email/name.
        let result = auto_commit(
            &dir,
            "1",
            "Test title",
            "test",
            1,
            super::super::commit::When::Always,
        )
        .await;
        assert!(result.unwrap());

        // Verify no changes remain
        assert!(!has_changes(&dir).await);

        // Cleanup
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[tokio::test]
    async fn auto_commit_ignores_repo_signing_config() {
        // Repo demands signing via a signer that always fails — auto_commit
        // must still commit (it passes -c commit.gpgsign=false)
        let dir =
            std::env::temp_dir().join(format!("orch_test_auto_commit_gpg_{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();

        for args in [
            vec!["init"],
            vec!["config", "user.email", "test@test.com"],
            vec!["config", "user.name", "Test"],
            vec!["config", "commit.gpgsign", "true"],
            vec!["config", "gpg.program", "/usr/bin/false"],
        ] {
            let _ = Command::new("git")
                .args(&args)
                .current_dir(&dir)
                .output()
                .await;
        }
        std::fs::write(dir.join("init.txt"), "init").unwrap();
        let _ = Command::new("git")
            .args(["add", "init.txt"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["-c", "commit.gpgsign=false", "commit", "-m", "init"])
            .current_dir(&dir)
            .output()
            .await;

        std::fs::write(dir.join("signed_off.txt"), "content").unwrap();
        assert!(has_changes(&dir).await);

        let result = auto_commit(
            &dir,
            "3",
            "Test title",
            "test",
            1,
            super::super::commit::When::Always,
        )
        .await;
        assert!(result.unwrap());
        assert!(!has_changes(&dir).await);

        let _ = std::fs::remove_dir_all(&dir);
    }

    #[tokio::test]
    async fn auto_commit_unstages_on_pre_commit_hook_failure() {
        // Create a temp git repo where commit always fails (via pre-commit hook)
        let dir =
            std::env::temp_dir().join(format!("orch_test_auto_commit_hook_{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();

        // Init repo
        let _ = Command::new("git")
            .args(["init"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.email", "test@test.com"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.name", "Test"])
            .current_dir(&dir)
            .output()
            .await;
        // Create initial commit
        std::fs::write(dir.join("init.txt"), "init").unwrap();
        let _ = Command::new("git")
            .args(["add", "init.txt"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["-c", "commit.gpgsign=false", "commit", "-m", "init"])
            .current_dir(&dir)
            .output()
            .await;

        // Install a pre-commit hook that always fails
        let hooks_dir = dir.join(".git/hooks");
        std::fs::create_dir_all(&hooks_dir).unwrap();
        std::fs::write(hooks_dir.join("pre-commit"), "#!/bin/sh\nexit 1\n").unwrap();
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            let mut perms = std::fs::metadata(hooks_dir.join("pre-commit"))
                .unwrap()
                .permissions();
            perms.set_mode(0o755);
            std::fs::set_permissions(hooks_dir.join("pre-commit"), perms).unwrap();
        }

        // Create a new file
        std::fs::write(dir.join("staged_file.txt"), "content").unwrap();

        // Verify has_changes sees it
        assert!(has_changes(&dir).await);

        // auto_commit should return false (pre-commit hook blocks it)
        let result = auto_commit(
            &dir,
            "2",
            "Test title",
            "test",
            1,
            super::super::commit::When::Always,
        )
        .await;
        assert!(!result.unwrap());

        // After commit failure, files should be unstaged — has_changes should
        // still return true because the unstaged file is still there.
        assert!(has_changes(&dir).await);

        // Verify the file is NOT staged (git diff --cached --quiet should succeed)
        let cached = Command::new("git")
            .args(["diff", "--cached", "--quiet"])
            .current_dir(&dir)
            .status()
            .await;
        assert!(
            cached.is_ok_and(|s| s.success()),
            "files should be unstaged after commit failure"
        );

        // Cleanup
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[test]
    fn is_workflow_scope_error_detects_backtick_format() {
        let err = "! [remote rejected] branch -> branch (refusing to allow an OAuth App to create or update workflow `.github/workflows/ci.yml` without `workflow` scope)";
        assert!(is_workflow_scope_error(err));
    }

    #[test]
    fn is_workflow_scope_error_detects_single_quote_format() {
        let err = "refusing to allow an OAuth App to create or update workflow '.github/workflows/ci.yml' without 'workflow' scope";
        assert!(is_workflow_scope_error(err));
    }

    #[test]
    fn is_workflow_scope_error_detects_refusing_to_allow_variant() {
        let err = "remote: refusing to allow a Personal Access Token to create or update workflow `.github/workflows/scan.yml` without `workflow` scope";
        assert!(is_workflow_scope_error(err));
    }

    #[test]
    fn is_workflow_scope_error_rejects_unrelated_errors() {
        assert!(!is_workflow_scope_error("non-fast-forward"));
        assert!(!is_workflow_scope_error("permission denied"));
        assert!(!is_workflow_scope_error("authentication failed"));
        assert!(!is_workflow_scope_error("rejected"));
    }

    #[tokio::test]
    async fn strip_workflow_files_removes_workflow_from_commits() {
        // Create a temp git repo simulating the scenario
        let dir = std::env::temp_dir().join(format!("orch_test_strip_wf_{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();

        // Init repo with initial commit
        let _ = Command::new("git")
            .args(["init"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.email", "test@test.com"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.name", "Test"])
            .current_dir(&dir)
            .output()
            .await;
        std::fs::write(dir.join("init.txt"), "init").unwrap();
        let _ = Command::new("git")
            .args(["add", "."])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["-c", "commit.gpgsign=false", "commit", "-m", "init"])
            .current_dir(&dir)
            .output()
            .await;

        // Create a "remote" by adding the repo as its own origin (for rev-list)
        let _ = Command::new("git")
            .args(["remote", "add", "origin", dir.to_str().unwrap()])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["fetch", "origin"])
            .current_dir(&dir)
            .output()
            .await;

        // Create a branch off main
        let _ = Command::new("git")
            .args(["checkout", "-b", "feature"])
            .current_dir(&dir)
            .output()
            .await;

        // Add both a normal file and a workflow file
        std::fs::write(dir.join("feature.txt"), "feature work").unwrap();
        let wf_dir = dir.join(".github/workflows");
        std::fs::create_dir_all(&wf_dir).unwrap();
        std::fs::write(wf_dir.join("ci.yml"), "name: CI\non: push").unwrap();
        let _ = Command::new("git")
            .args(["add", "."])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args([
                "-c",
                "commit.gpgsign=false",
                "commit",
                "-m",
                "add feature and workflow",
            ])
            .current_dir(&dir)
            .output()
            .await;

        // Get the default branch name
        let branch_out = Command::new("git")
            .args(["rev-parse", "--abbrev-ref", "origin/HEAD"])
            .current_dir(&dir)
            .output()
            .await;
        // Fallback to "main" if origin/HEAD is not set
        let default_branch = branch_out.ok().filter(|o| o.status.success()).map_or_else(
            || "main".to_string(),
            |o| {
                String::from_utf8_lossy(&o.stdout)
                    .trim()
                    .strip_prefix("origin/")
                    .unwrap_or("main")
                    .to_string()
            },
        );

        // Strip workflow files
        let stripped = strip_workflow_files(&dir, &default_branch).await.unwrap();
        assert!(stripped, "should have stripped workflow files");

        // Verify workflow file is no longer in the committed tree
        let ls_output = Command::new("git")
            .args(["ls-tree", "-r", "--name-only", "HEAD"])
            .current_dir(&dir)
            .output()
            .await
            .unwrap();
        let files = String::from_utf8_lossy(&ls_output.stdout);
        assert!(
            !files.contains(".github/workflows/ci.yml"),
            "workflow file should be removed from commits"
        );
        assert!(
            files.contains("feature.txt"),
            "non-workflow files should be preserved"
        );

        // Cleanup
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[tokio::test]
    async fn strip_workflow_files_returns_false_when_no_workflows() {
        let dir =
            std::env::temp_dir().join(format!("orch_test_strip_wf_none_{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&dir);
        std::fs::create_dir_all(&dir).unwrap();

        // Init repo
        let _ = Command::new("git")
            .args(["init"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.email", "test@test.com"])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["config", "user.name", "Test"])
            .current_dir(&dir)
            .output()
            .await;
        std::fs::write(dir.join("init.txt"), "init").unwrap();
        let _ = Command::new("git")
            .args(["add", "."])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["-c", "commit.gpgsign=false", "commit", "-m", "init"])
            .current_dir(&dir)
            .output()
            .await;

        let _ = Command::new("git")
            .args(["remote", "add", "origin", dir.to_str().unwrap()])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args(["fetch", "origin"])
            .current_dir(&dir)
            .output()
            .await;

        let _ = Command::new("git")
            .args(["checkout", "-b", "feature2"])
            .current_dir(&dir)
            .output()
            .await;

        // Only non-workflow files
        std::fs::write(dir.join("feature.txt"), "feature").unwrap();
        let _ = Command::new("git")
            .args(["add", "."])
            .current_dir(&dir)
            .output()
            .await;
        let _ = Command::new("git")
            .args([
                "-c",
                "commit.gpgsign=false",
                "commit",
                "-m",
                "add feature only",
            ])
            .current_dir(&dir)
            .output()
            .await;

        let stripped = strip_workflow_files(&dir, "main").await.unwrap();
        assert!(!stripped, "should not strip when no workflow files exist");

        // Cleanup
        let _ = std::fs::remove_dir_all(&dir);
    }

    #[test]
    fn is_invalid_base_error_detects_base_invalid() {
        assert!(is_invalid_base_error(
            "GitHub API POST https://api.github.com/repos/foo/bar/pulls failed (422): {\"errors\":[{\"resource\":\"PullRequest\",\"field\":\"base\",\"code\":\"invalid\"}]}"
        ));
        assert!(is_invalid_base_error(
            "GitHub API POST .../pulls failed (422): Base field is invalid"
        ));
    }

    #[test]
    fn is_invalid_base_error_rejects_non_base_errors() {
        // No-commits error should NOT match
        assert!(!is_invalid_base_error(
            "GitHub API POST .../pulls failed (422): No commits between main and branch"
        ));
        // Head invalid should NOT match
        assert!(!is_invalid_base_error(
            "GitHub API POST .../pulls failed (422): head is not a valid ref"
        ));
        // Transient 5xx should NOT match
        assert!(!is_invalid_base_error(
            "GitHub API POST .../pulls failed (502): Bad Gateway"
        ));
        // 404 should NOT match
        assert!(!is_invalid_base_error(
            "GitHub API POST .../pulls failed (404): Not Found"
        ));
    }

    fn pr_summary(body: &str) -> &str {
        let rest = body
            .strip_prefix("## Summary\n\n")
            .expect("PR body starts with ## Summary");
        rest.split("\n\n").next().unwrap()
    }

    fn assert_no_push_or_pr_creation(body: &str) {
        let lower = body.to_ascii_lowercase();
        for needle in [
            "git push",
            "gh pr create",
            "did not push",
            "couldn't push",
            "could not push",
            "push was denied",
            "push was blocked",
            "push permission",
            "nothing is on the remote",
            "open the pr",
        ] {
            assert!(
                !lower.contains(needle),
                "PR body still contains {needle:?}:\n{body}"
            );
        }
    }

    #[test]
    fn build_pr_body_strips_push_and_pr_creation_statements() {
        let examples = [
            (
                concat!(
                    "Added the lesson list page. ",
                    "I did not push or open the PR, because the push was blocked on a permission prompt. ",
                    "Run `git push -u origin HEAD`, then `gh pr create`.",
                ),
                "Added the lesson list page.",
            ),
            (
                "It is committed locally ... The push was denied, so nothing is on the remote yet.",
                "It is committed locally",
            ),
            (
                concat!(
                    "Fixed the quiz scoring. ",
                    "I couldn't push it because the push permission was denied.",
                ),
                "Fixed the quiz scoring.",
            ),
        ];
        for (summary, work) in examples {
            let body = build_pr_body(
                "Fix the widget",
                summary,
                &[
                    "Wrote the lesson list".into(),
                    "Could not push because the push permission was denied".into(),
                ],
                &["Run `git push -u origin HEAD`".into()],
                &[],
                "16",
                "claude",
                None,
            );
            assert_eq!(pr_summary(&body), work);
            assert!(body.contains("Wrote the lesson list"));
            assert!(!body.contains("### Remaining"));
            assert_no_push_or_pr_creation(&body);
        }
    }

    #[test]
    fn build_pr_body_keeps_summary_without_push_text() {
        let summary = "Added retry logic for GitHub 5xx errors.";
        let accomplished = vec!["Extracted the PR body builder".into()];
        let remaining = vec!["Watch CI after merge".into()];
        let body = build_pr_body(
            "Fix the widget",
            summary,
            &accomplished,
            &remaining,
            &["src/engine/runner/git_ops.rs".into()],
            "16",
            "claude",
            Some("sonnet"),
        );
        assert_eq!(pr_summary(&body), summary);
        assert!(body.contains("### What was done\n\n- Extracted the PR body builder\n"));
        assert!(body.contains("### Remaining\n\n- Watch CI after merge\n"));
        assert!(body.contains("- `src/engine/runner/git_ops.rs`"));
        assert!(body.contains(" using `sonnet`"));
    }

    fn sh_git(dir: &std::path::Path, args: &[&str]) {
        let out = std::process::Command::new("git")
            .args([
                "-c",
                "commit.gpgsign=false",
                "-c",
                "user.name=T",
                "-c",
                "user.email=t@t",
            ])
            .args(args)
            .current_dir(dir)
            .output()
            .unwrap();
        assert!(
            out.status.success(),
            "git {args:?}: {}",
            String::from_utf8_lossy(&out.stderr)
        );
    }

    fn commit_file(dir: &std::path::Path, name: &str) {
        std::fs::write(dir.join(name), name).unwrap();
        sh_git(dir, &["add", name]);
        sh_git(dir, &["commit", "-m", name]);
    }

    /**
     * The review rebases its branch on main and force-pushes with lease. When GitHub's
     * "Update branch" moved the remote branch after the last fetch, the lease is stale and
     * the push was rejected, which blocked approved work (#3783)
     **/
    #[tokio::test]
    async fn push_branch_recovers_from_stale_lease_after_remote_moved() {
        let temp = tempfile::TempDir::new().unwrap();
        let bare = temp.path().join("origin.git");
        let a = temp.path().join("a");
        let b = temp.path().join("b");
        std::fs::create_dir_all(&bare).unwrap();
        sh_git(&bare, &["init", "--bare", "-b", "main"]);
        sh_git(temp.path(), &["clone", bare.to_str().unwrap(), "a"]);
        // push_branch's own rebase commits, and CI runners have no global identity
        sh_git(&a, &["config", "user.name", "T"]);
        sh_git(&a, &["config", "user.email", "t@t"]);
        commit_file(&a, "base.txt");
        sh_git(&a, &["push", "origin", "main"]);
        sh_git(&a, &["checkout", "-b", "feat"]);
        commit_file(&a, "feature.txt");
        sh_git(&a, &["push", "-u", "origin", "feat"]);

        sh_git(temp.path(), &["clone", bare.to_str().unwrap(), "b"]);
        commit_file(&b, "main-change.txt");
        sh_git(&b, &["push", "origin", "main"]);
        sh_git(&b, &["checkout", "feat"]);
        commit_file(&b, "update-branch.txt");
        sh_git(&b, &["push", "origin", "feat"]);

        // A only fetches main, so its view of origin/feat is stale when it rewrites feat
        sh_git(&a, &["fetch", "origin", "main"]);
        sh_git(&a, &["rebase", "origin/main"]);

        assert!(push_branch(&a, "feat", "main").await.unwrap());

        sh_git(&b, &["fetch", "origin", "feat"]);
        sh_git(&b, &["checkout", "origin/feat"]);
        for name in [
            "base.txt",
            "feature.txt",
            "main-change.txt",
            "update-branch.txt",
        ] {
            assert!(b.join(name).exists(), "remote feat lost {name}");
        }
    }

    #[test]
    fn stale_lease_error_matches_git_messages() {
        assert!(is_stale_lease_error(
            "! [rejected] feat -> feat (stale info)"
        ));
        assert!(is_stale_lease_error(
            "! [rejected] feat -> feat (remote ref updated since checkout)"
        ));
        assert!(!is_stale_lease_error(
            "! [rejected] feat -> feat (fetch first)"
        ));
    }

    fn git_ok(dir: &std::path::Path, args: &[&str]) {
        let out = std::process::Command::new("git")
            .args(args)
            .current_dir(dir)
            .output()
            .unwrap();
        assert!(
            out.status.success(),
            "git {} failed: {}",
            args.join(" "),
            String::from_utf8_lossy(&out.stderr)
        );
    }

    fn git_sha(dir: &std::path::Path, rev: &str) -> String {
        let out = std::process::Command::new("git")
            .args(["rev-parse", rev])
            .current_dir(dir)
            .output()
            .unwrap();
        assert!(out.status.success(), "git rev-parse {rev} failed");
        String::from_utf8_lossy(&out.stdout).trim().to_string()
    }

    fn init_identity(dir: &std::path::Path) {
        git_ok(dir, &["config", "user.email", "test@example.com"]);
        git_ok(dir, &["config", "user.name", "Test"]);
        git_ok(dir, &["config", "commit.gpgsign", "false"]);
    }

    fn write_commit(dir: &std::path::Path, file: &str, body: &str, msg: &str) {
        std::fs::write(dir.join(file), body).unwrap();
        git_ok(dir, &["add", file]);
        git_ok(dir, &["commit", "-m", msg]);
    }

    /// A bare origin with `main` and a pushed `feature`, and a clone `a` on `feature`
    fn publish_feature(root: &std::path::Path) -> (std::path::PathBuf, std::path::PathBuf) {
        let bare = root.join("bare.git");
        let a = root.join("a");
        git_ok(root, &["init", "-b", "main", a.to_str().unwrap()]);
        init_identity(&a);
        write_commit(&a, "README.md", "base\n", "base");
        git_ok(
            root,
            &["init", "--bare", "-b", "main", bare.to_str().unwrap()],
        );
        git_ok(&a, &["remote", "add", "origin", bare.to_str().unwrap()]);
        git_ok(&a, &["push", "-u", "origin", "main"]);
        git_ok(&a, &["checkout", "-b", "feature"]);
        write_commit(&a, "feature.txt", "feature\n", "feature");
        git_ok(&a, &["push", "-u", "origin", "feature"]);
        (bare, a)
    }

    fn clone_on(
        root: &std::path::Path,
        bare: &std::path::Path,
        name: &str,
        branch: &str,
    ) -> std::path::PathBuf {
        let dir = root.join(name);
        git_ok(
            root,
            &["clone", bare.to_str().unwrap(), dir.to_str().unwrap()],
        );
        init_identity(&dir);
        if branch != "main" {
            git_ok(
                &dir,
                &["checkout", "-b", branch, &format!("origin/{branch}")],
            );
        }

        dir
    }

    #[tokio::test]
    async fn leased_force_push_does_not_replace_a_newer_remote_tip() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        let b = clone_on(root.path(), &bare, "b", "feature");
        record_push_lease(&b, "feature", "main").await;
        let leased = git_sha(&b, "refs/remotes/origin/feature");

        write_commit(&a, "feature.txt", "from a\n", "from a");
        git_ok(&a, &["push", "origin", "feature"]);
        let newer = git_sha(&a, "HEAD");

        git_ok(&b, &["fetch", "origin"]);
        write_commit(&b, "feature.txt", "from b\n", "from b");
        let pushed = push_branch(&b, "feature", "main").await;
        assert!(
            pushed.is_err(),
            "force push should be rejected, got {pushed:?}"
        );
        assert_eq!(git_sha(&bare, "refs/heads/feature"), newer);

        // A retry sees the fetched tip, which HEAD does not contain, so the lease stays
        record_push_lease(&b, "feature", "main").await;
        assert_eq!(read_push_lease(&b, "feature").await, Some(leased));
        let again = push_branch(&b, "feature", "main").await;
        assert!(
            again.is_err(),
            "second force push should stay rejected, got {again:?}"
        );
        assert_eq!(git_sha(&bare, "refs/heads/feature"), newer);
    }

    #[tokio::test]
    async fn leased_force_push_allows_rewrite_of_the_recorded_tip() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        std::fs::write(a.join("feature.txt"), "rewritten\n").unwrap();
        git_ok(&a, &["commit", "-am", "--amend", "-m", "feature rewritten"]);

        let pushed = push_branch(&a, "feature", "main").await;
        assert!(
            pushed.is_ok(),
            "rewrite of the leased tip should push, got {pushed:?}"
        );
        assert_eq!(git_sha(&bare, "refs/heads/feature"), git_sha(&a, "HEAD"));
        assert_eq!(
            read_push_lease(&a, "feature").await,
            Some(git_sha(&a, "HEAD"))
        );
    }

    #[tokio::test]
    async fn push_after_update_branch_merge_force_pushes_the_rebased_branch() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;

        // GitHub's "Update branch": main moves, then main is merged into feature on the remote
        let c = clone_on(root.path(), &bare, "c", "main");
        write_commit(&c, "main.txt", "main\n", "main moves");
        git_ok(&c, &["push", "origin", "main"]);
        git_ok(&c, &["checkout", "-b", "feature", "origin/feature"]);
        git_ok(
            &c,
            &[
                "merge",
                "--no-ff",
                "-m",
                "Merge main into feature",
                "origin/main",
            ],
        );
        git_ok(&c, &["push", "origin", "feature"]);

        rebase_on_default(&a, "main").await;
        write_commit(&a, "feature.txt", "review fix\n", "review fix");
        let pushed = push_branch(&a, "feature", "main").await;
        assert!(
            pushed.is_ok(),
            "push after update-branch should succeed, got {pushed:?}"
        );
        assert_eq!(git_sha(&bare, "refs/heads/feature"), git_sha(&a, "HEAD"));
    }

    #[tokio::test]
    async fn agent_push_moves_the_lease_to_a_tip_head_contains() {
        let root = tempfile::tempdir().unwrap();
        let (_bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;

        write_commit(&a, "feature.txt", "agent step\n", "agent step");
        git_ok(&a, &["push", "origin", "feature"]);
        record_push_lease(&a, "feature", "main").await;
        assert_eq!(
            read_push_lease(&a, "feature").await,
            Some(git_sha(&a, "HEAD"))
        );
    }

    #[tokio::test]
    async fn record_push_lease_skips_the_default_branch() {
        let root = tempfile::tempdir().unwrap();
        let (_bare, a) = publish_feature(root.path());
        git_ok(&a, &["checkout", "main"]);
        record_push_lease(&a, "main", "main").await;
        assert_eq!(read_push_lease(&a, "main").await, None);
    }

    /// GitHub's "Update branch" by merge: main moves, then main is merged into feature
    fn github_update_by_merge(root: &std::path::Path, bare: &std::path::Path, name: &str) {
        let c = clone_on(root, bare, name, "main");
        write_commit(&c, "main.txt", "main\n", "main moves");
        git_ok(&c, &["push", "origin", "main"]);
        git_ok(&c, &["checkout", "-b", "feature", "origin/feature"]);
        git_ok(
            &c,
            &[
                "merge",
                "--no-ff",
                "-m",
                "Merge main into feature",
                "origin/main",
            ],
        );
        git_ok(&c, &["push", "origin", "feature"]);
    }

    /// GitHub's "Update branch" by rebase: main moves, then feature is replayed on it
    fn github_update_by_rebase(
        root: &std::path::Path,
        bare: &std::path::Path,
        name: &str,
    ) -> std::path::PathBuf {
        let c = clone_on(root, bare, name, "main");
        write_commit(&c, "main.txt", "main\n", "main moves");
        git_ok(&c, &["push", "origin", "main"]);
        git_ok(&c, &["checkout", "-b", "feature", "origin/feature"]);
        git_ok(&c, &["rebase", "origin/main"]);
        git_ok(&c, &["push", "--force", "origin", "feature"]);
        c
    }

    fn remote_has(root: &std::path::Path, bare: &std::path::Path, file: &str) -> bool {
        let check = root.join("check");
        if !check.exists() {
            git_ok(
                root,
                &["clone", bare.to_str().unwrap(), check.to_str().unwrap()],
            );
        }

        git_ok(&check, &["fetch", "origin"]);
        git_ok(&check, &["checkout", "--detach", "origin/feature"]);
        check.join(file).exists()
    }

    #[tokio::test]
    async fn push_after_update_branch_rebase_force_pushes_the_rebased_branch() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        github_update_by_rebase(root.path(), &bare, "c");

        rebase_on_default(&a, "main").await;
        write_commit(&a, "fix.txt", "review fix\n", "review fix");
        let pushed = push_branch(&a, "feature", "main").await;
        assert!(
            pushed.is_ok(),
            "push after a rebase update should succeed, got {pushed:?}"
        );
        assert_eq!(git_sha(&bare, "refs/heads/feature"), git_sha(&a, "HEAD"));
    }

    #[tokio::test]
    async fn rebase_update_with_a_foreign_commit_keeps_the_foreign_commit() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        let c = github_update_by_rebase(root.path(), &bare, "c");
        write_commit(&c, "other.txt", "other machine\n", "other machine");
        git_ok(&c, &["push", "origin", "feature"]);

        rebase_on_default(&a, "main").await;
        write_commit(&a, "fix.txt", "review fix\n", "review fix");
        let _ = push_branch(&a, "feature", "main").await;
        assert!(
            remote_has(root.path(), &bare, "other.txt"),
            "the other machine's commit was dropped"
        );
    }

    #[tokio::test]
    async fn merge_of_a_non_default_branch_is_not_a_github_update() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        let c = clone_on(root.path(), &bare, "c", "feature");
        git_ok(&c, &["checkout", "-b", "side", "origin/main"]);
        write_commit(&c, "side.txt", "side\n", "side work");
        git_ok(&c, &["checkout", "feature"]);
        git_ok(&c, &["merge", "--no-ff", "-m", "Merge side", "side"]);
        git_ok(&c, &["push", "origin", "feature"]);

        rebase_on_default(&a, "main").await;
        write_commit(&a, "fix.txt", "review fix\n", "review fix");
        let _ = push_branch(&a, "feature", "main").await;
        assert!(
            remote_has(root.path(), &bare, "side.txt"),
            "the merged side branch was dropped"
        );
    }

    #[tokio::test]
    async fn update_merge_on_top_of_a_foreign_push_keeps_the_foreign_commit() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        let c = clone_on(root.path(), &bare, "c", "feature");
        write_commit(&c, "other.txt", "other machine\n", "other machine");
        git_ok(&c, &["push", "origin", "feature"]);
        github_update_by_merge(root.path(), &bare, "d");

        rebase_on_default(&a, "main").await;
        write_commit(&a, "fix.txt", "review fix\n", "review fix");
        let _ = push_branch(&a, "feature", "main").await;
        assert!(
            remote_has(root.path(), &bare, "other.txt"),
            "the other machine's commit was dropped"
        );
    }

    #[tokio::test]
    async fn force_push_leased_accepts_github_updates() {
        for by_rebase in [false, true] {
            let root = tempfile::tempdir().unwrap();
            let (bare, a) = publish_feature(root.path());
            record_push_lease(&a, "feature", "main").await;
            if by_rebase {
                github_update_by_rebase(root.path(), &bare, "c");
            } else {
                github_update_by_merge(root.path(), &bare, "c");
            }

            git_ok(&a, &["fetch", "origin"]);
            git_ok(&a, &["rebase", "origin/main"]);
            let pushed = force_push_leased(&a, "feature", "main").await;
            assert!(pushed.is_ok(), "by_rebase={by_rebase}: {pushed:?}");
            assert_eq!(git_sha(&bare, "refs/heads/feature"), git_sha(&a, "HEAD"));
        }
    }

    #[tokio::test]
    async fn force_push_leased_accepts_a_branch_recreated_at_the_default_head() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        let c = clone_on(root.path(), &bare, "c", "main");
        write_commit(&c, "feature.txt", "main version\n", "main moves");
        git_ok(&c, &["push", "origin", "main"]);
        git_ok(
            &c,
            &["push", "origin", "main:refs/heads/feature", "--force"],
        );

        git_ok(&a, &["fetch", "origin"]);
        record_push_lease(&a, "feature", "main").await;
        std::fs::write(a.join("feature.txt"), "feature rewritten\n").unwrap();
        git_ok(&a, &["commit", "-am", "rewrite"]);
        let pushed = force_push_leased(&a, "feature", "main").await;
        assert!(pushed.is_ok(), "{pushed:?}");
        assert_eq!(git_sha(&bare, "refs/heads/feature"), git_sha(&a, "HEAD"));
    }

    #[tokio::test]
    async fn clear_push_lease_drops_the_recorded_lease() {
        let root = tempfile::tempdir().unwrap();
        let (_bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        assert!(read_push_lease(&a, "feature").await.is_some());
        clear_push_lease(&a, "feature").await;
        assert_eq!(read_push_lease(&a, "feature").await, None);
    }

    #[tokio::test]
    async fn force_push_leased_refuses_a_foreign_push() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        let c = clone_on(root.path(), &bare, "c", "feature");
        write_commit(&c, "other.txt", "other machine\n", "other machine");
        git_ok(&c, &["push", "origin", "feature"]);
        let foreign = git_sha(&c, "HEAD");

        git_ok(&a, &["fetch", "origin"]);
        record_push_lease(&a, "feature", "main").await;
        std::fs::write(a.join("feature.txt"), "rewritten\n").unwrap();
        git_ok(&a, &["commit", "-am", "--amend", "-m", "rewritten"]);
        assert!(force_push_leased(&a, "feature", "main").await.is_err());
        assert_eq!(git_sha(&bare, "refs/heads/feature"), foreign);
    }

    #[tokio::test]
    async fn force_push_leased_refuses_a_branch_created_after_an_absent_lease() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        git_ok(&a, &["checkout", "-b", "fresh", "main"]);
        record_push_lease(&a, "fresh", "main").await;
        assert_eq!(
            read_push_lease(&a, "fresh").await.as_deref(),
            Some(LEASE_ABSENT)
        );

        let c = clone_on(root.path(), &bare, "c", "main");
        git_ok(&c, &["checkout", "-b", "fresh"]);
        write_commit(&c, "other.txt", "other machine\n", "other machine");
        git_ok(&c, &["push", "origin", "fresh"]);
        let foreign = git_sha(&c, "HEAD");

        git_ok(&a, &["fetch", "origin"]);
        write_commit(&a, "mine.txt", "mine\n", "mine");
        assert!(force_push_leased(&a, "fresh", "main").await.is_err());
        assert_eq!(git_sha(&bare, "refs/heads/fresh"), foreign);
    }

    #[tokio::test]
    async fn first_push_records_the_pushed_head_as_the_lease() {
        let root = tempfile::tempdir().unwrap();
        let (_bare, a) = publish_feature(root.path());
        git_ok(&a, &["checkout", "-b", "fresh", "main"]);
        write_commit(&a, "mine.txt", "mine\n", "mine");
        assert!(push_branch(&a, "fresh", "main").await.unwrap());
        assert_eq!(
            read_push_lease(&a, "fresh").await,
            Some(git_sha(&a, "HEAD"))
        );
    }

    #[tokio::test]
    async fn missing_lease_falls_back_to_the_fetched_tip_and_counts_it() {
        let root = tempfile::tempdir().unwrap();
        let (_bare, a) = publish_feature(root.path());
        let before = LEASE_FALLBACKS.load(Ordering::Relaxed);
        let expected = expected_force_sha(&a, "feature", "main").await.unwrap();
        assert_eq!(expected, git_sha(&a, "refs/remotes/origin/feature"));
        assert!(LEASE_FALLBACKS.load(Ordering::Relaxed) > before);
    }

    #[tokio::test]
    async fn agent_push_then_foreign_push_keeps_the_agent_tip_as_lease() {
        let root = tempfile::tempdir().unwrap();
        let (bare, a) = publish_feature(root.path());
        record_push_lease(&a, "feature", "main").await;
        write_commit(&a, "step.txt", "agent step\n", "agent step");
        git_ok(&a, &["push", "origin", "feature"]);
        let agent_tip = git_sha(&a, "HEAD");

        let c = clone_on(root.path(), &bare, "c", "feature");
        write_commit(&c, "other.txt", "other machine\n", "other machine");
        git_ok(&c, &["push", "origin", "feature"]);

        // Callers record before they fetch, so the lease moves to the agent's push and no further
        record_push_lease(&a, "feature", "main").await;
        git_ok(&a, &["fetch", "origin"]);
        record_push_lease(&a, "feature", "main").await;
        assert_eq!(read_push_lease(&a, "feature").await, Some(agent_tip));
        let foreign = git_sha(&bare, "refs/heads/feature");
        git_ok(&a, &["commit", "--amend", "-m", "agent step rewritten"]);
        assert!(force_push_leased(&a, "feature", "main").await.is_err());
        assert_eq!(git_sha(&bare, "refs/heads/feature"), foreign);
    }

    #[tokio::test]
    async fn branch_without_remote_and_head_without_twins_are_not_github_updates() {
        let root = tempfile::tempdir().unwrap();
        let (_bare, a) = publish_feature(root.path());
        let lease = git_sha(&a, "HEAD");
        let main = git_sha(&a, "origin/main");
        // A tip equal to main has nothing in base..tip, which must not count as a rebase update
        assert!(!is_github_branch_update(&a, &main, &lease, "main").await);
        assert!(
            !is_github_branch_update(
                &a,
                "0000000000000000000000000000000000000000",
                &lease,
                "main"
            )
            .await
        );
    }
}