/** * Git push operations with timeout, retry, and recovery *  * WHY this is the largest git module (328 lines): * Push is the most complex git operation we perform: * - Process management (spawn for timeout control) * - Authentication (one-shot auth URL for push) * - Error handling (parse stderr for specific error types) * - Retry logic (pull and push again on rejection) *  * WHY use spawn() instead of simple-git: * simple-git's push() returns a Promise that can't be cancelled. If it hangs, * the process runs forever. spawn() gives us direct process control so we can * SIGKILL on timeout or Ctrl+C interruption. *  * WHY one-shot push URL with token (not origin + http.extraheader): * CI often has `origin` set to `https://***@github.com/...` or a token that no * longer matches GITHUB_TOKEN; git then still asks for a password. Passing *   git -c credential.helper= push https://<token>@github.com/org/repo.git HEAD:branch * embeds the current token in the URL only for this process (not persisted to * .git/config like `remote set-url`). *  * DESIGN: This module is intentionally kept together despite its size because * the push logic is tightly coupled - timeout handling, auth, and retry all * interact with each other. */import type { SimpleGit } from 'simple-git';import { spawn, execFileSync } from 'child_process';import { existsSync, rmSync } from 'fs';import { join } from 'path';import { debug, formatNumber } from '../logger.js';import { cleanupGitState, continueRebase } from './git-merge.js';import { redactUrlCredentials } from './redact-url.js';import {  buildHttpsPushUrlWithToken,  httpsRemoteHasUserinfo,  stripHttpsUserinfo,} from './git-push-auth-url.js'; /** * Result of a git push operation. * Canonical definition; commit.ts re-exports for backward compatibility. */export interface PushResult {  success: boolean;  rejected?: boolean;  error?: string;  /** True when push succeeded but remote already had our commits (nothing to push).   * WHY: Caller skips the post-push bot wait when nothing was pushed to avoid a 300s wait. */  nothingToPush?: boolean;} /** * Push changes to remote with timeout and signal handling. * Canonical implementation; commit.ts re-exports for backward compatibility. *  * WHY spawn instead of simple-git: simple-git's promises can't be cancelled, * and the underlying git process keeps running even after timeout. Using * spawn directly lets us SIGKILL the process on timeout or Ctrl+C. *  * WHY 30s timeout (reduced from 60s): Push should be fast. If it takes longer, * something is wrong (auth prompt, network). 30s is still generous. *  * Returns PushResult instead of throwing for rejected pushes, allowing caller * to handle pull-and-retry logic. */export async function push(git: SimpleGit, branch: string, force = false, githubToken?: string): Promise<PushResult> {  const PUSH_TIMEOUT_MS = 30_000; // 30 seconds (reduced from 60)   // Get the workdir from the git instance  // WHY multiple fallbacks: simple-git internal _baseDir may be undefined in some versions  // Use git rev-parse as the most reliable source  let workdir: string;  try {    // Most reliable: ask git itself for the repo root    workdir = (await git.revparse(['--show-toplevel'])).trim();  } catch {    // Fallback to internal property or cwd    workdir = (git as any)._baseDir || process.cwd();    debug('Using fallback workdir', { workdir, method: (git as any)._baseDir ? '_baseDir' : 'cwd' });  }    let pushArgs: string[] = ['push', 'origin', `HEAD:${branch}`];  if (force) pushArgs.push('--force');  let disableCredentialHelpers = false;   try {    const remoteUrl = execFileSync('git', ['remote', 'get-url', 'origin'], { cwd: workdir, encoding: 'utf8' }).trim();    const hasTokenInUrl = httpsRemoteHasUserinfo(remoteUrl);    const cleanHttps =      remoteUrl.startsWith('https://') ? stripHttpsUserinfo(remoteUrl) : remoteUrl;     if (githubToken && cleanHttps.startsWith('https://')) {      const pushUrl = buildHttpsPushUrlWithToken(cleanHttps, githubToken);      pushArgs = ['push', ...(force ? ['--force'] : []), pushUrl, `HEAD:${branch}`];      disableCredentialHelpers = true;      debug('Pre-push check', { hasTokenInUrl, usingOneShotPushUrlWithToken: true });    } else if (githubToken && !cleanHttps.startsWith('https://')) {      debug('Remote URL is SSH — token injection skipped; push will use SSH credentials.');    } else if (!hasTokenInUrl && !githubToken) {      debug('WARNING: Remote URL does not contain token and no token provided - push may fail');    } else if (hasTokenInUrl && !githubToken) {      pushArgs = ['push', 'origin', `HEAD:${branch}`];      if (force) pushArgs.push('--force');      disableCredentialHelpers = true;      debug('Pre-push check', { hasTokenInUrl, usingOriginUrlToken: true });    } else {      debug('Pre-push check', { hasTokenInUrl });    }     if (disableCredentialHelpers) {      pushArgs = [        '-c',        'credential.helper=',        '-c',        'credential.https://github.com.helper=',        ...pushArgs,      ];    }  } catch (e) {    debug('Could not check remote URL', { error: redactUrlCredentials(String(e)) });  }   const fullCommand = `git ${pushArgs.join(' ')}`;  debug('Starting git push', { command: redactUrlCredentials(fullCommand), workdir });   const spawnEnv = { ...process.env };  if (disableCredentialHelpers) {    spawnEnv.GIT_TERMINAL_PROMPT = '0';  }   return new Promise((resolve) => {    const gitProcess = spawn('git', pushArgs, {      cwd: workdir,      stdio: ['ignore', 'pipe', 'pipe'],      env: spawnEnv,    });        let stdout = '';    let stderr = '';    let killed = false;    let settled = false;    const settle = (result: { success: boolean; nothingToPush?: boolean; rejected?: boolean; error?: string }) => {      if (settled) return;      settled = true;      resolve(result);    };        // Log output as it comes in (git push progress goes to stderr)    gitProcess.stdout?.on('data', (data) => {       stdout += data.toString();       debug('git push stdout', redactUrlCredentials(data.toString().trim()));    });    gitProcess.stderr?.on('data', (data) => {       stderr += data.toString();      // Show progress (git push writes progress to stderr)      const line = redactUrlCredentials(data.toString().trim());      if (line && !line.includes('Username') && !line.includes('Password')) {        debug('git push progress', line);      }    });        // Timeout - kill the process    const timeout = setTimeout(() => {      killed = true;      gitProcess.kill('SIGKILL');      const errMsg = [        `Push timed out after 30 seconds.`,        `Command: ${redactUrlCredentials(fullCommand)}`,        `Workdir: ${workdir}`,        `This usually means:`,        `  - Network issue (check connectivity)`,        `  - Auth issue (token missing/expired)`,        `  - Git waiting for interactive input`,        stderr ? `stderr: ${redactUrlCredentials(stderr)}` : '',      ].filter(Boolean).join('\n');      settle({ success: false, error: errMsg });    }, PUSH_TIMEOUT_MS);        // Handle Ctrl+C - kill the git process and settle so callers don't hang    const sigintHandler = () => {      if (killed) return;      killed = true;      gitProcess.kill('SIGKILL');      clearTimeout(timeout);      process.removeListener('SIGINT', sigintHandler);      settle({ success: false, error: 'Push cancelled by user (SIGINT)' });    };    process.on('SIGINT', sigintHandler);        gitProcess.on('close', (code) => {      clearTimeout(timeout);      process.removeListener('SIGINT', sigintHandler);            if (killed) {        // Timeout or SIGINT already settled the promise        return;      }            if (code === 0) {        const nothingToPush = /everything up-to-date/i.test(stderr) || /everything up-to-date/i.test(stdout);        debug('Git push completed', { branch, nothingToPush });        settle({ success: true, nothingToPush: nothingToPush || undefined });      } else {        const isRejected = stderr.includes('rejected') &&           (stderr.includes('fetch first') || stderr.includes('non-fast-forward'));                if (isRejected) {          debug('Push rejected - remote has newer commits', { stderr: redactUrlCredentials(stderr) });          settle({             success: false,             rejected: true,            error: 'Push rejected: remote has newer commits. Need to pull first.',          });        } else {          // WHY: output.log audit babylon#1213 — push failed with "refusing to allow a Personal Access Token to create or update workflow … without `workflow` scope". Surface a clear hint.          const workflowScopeDenied = /refusing to allow.*(?:create or update workflow|workflow.*without.*workflow.*scope)/i.test(stderr) || /without\s*[`']workflow[`']\s*scope/i.test(stderr);          const baseError = `Git push failed with code ${code}\nCommand: ${redactUrlCredentials(fullCommand)}\nWorkdir: ${workdir}\nstderr: ${redactUrlCredentials(stderr)}`;          const error = workflowScopeDenied            ? `${baseError}\n\nHint: GitHub rejected the push because your token does not have the 'workflow' scope. To modify .github/workflows files, add the workflow scope to your Personal Access Token, or fix workflow files manually.`            : baseError;          settle({ success: false, error });        }      }    });        gitProcess.on('error', (err) => {      clearTimeout(timeout);      process.removeListener('SIGINT', sigintHandler);      settle({         success: false,        error: `Git push failed: ${err.message}\nCommand: ${redactUrlCredentials(fullCommand)}\nWorkdir: ${workdir}`,      });    });  });} /** * Result of pushWithRetry when push succeeds. */export interface PushWithRetryResult {  success: boolean;  error?: string;  conflictedFiles?: string[];  // Files with conflicts if rebase failed  /** True when remote already had our commits (nothing to push). Skip bot wait. */  nothingToPush?: boolean;  /** True when nothingToPush occurred after a rebase (e.g. remote already had commits from a previous run). Callers can show a more specific message. */  nothingToPushAfterRebase?: boolean;} /** * Push with auto-retry on rejection. * If push is rejected because remote has newer commits, fetches and rebases, then retries. *  * WHY: Common scenario when CodeRabbit or another user pushes while prr is working. * Auto-retry makes the workflow smoother without manual intervention. *  * WHY rebase instead of merge: Keeps history clean. Our fix commits go on top. *  * NEW: onConflict callback allows caller to resolve conflicts (e.g., with LLM). * If provided and conflicts occur, calls callback. If callback returns true (resolved), * continues the rebase and retries push. * * On rebase failure we run rebase --abort only (no cleanupGitState, to preserve caller's commits). * WHY: Abort preserves commits; full cleanup is for stale/corrupt state so the next run * doesn't hit "rebase-merge directory already exists". */async function removeStuckRebaseDirs(git: SimpleGit): Promise<void> {  try {    const wd = (await git.revparse(['--show-toplevel'])).trim();    const gitDir = join(wd, '.git');    for (const name of ['rebase-merge', 'rebase-apply']) {      const p = join(gitDir, name);      if (existsSync(p)) {        rmSync(p, { recursive: true });        debug('Removed stuck rebase dir so next run can proceed', { path: name });      }    }  } catch {    // best-effort  }} export async function pushWithRetry(  git: SimpleGit,   branch: string,   options?: {     force?: boolean;     onPullNeeded?: () => void;     githubToken?: string;    onConflict?: (conflictedFiles: string[]) => Promise<boolean>;  // Returns true if conflicts resolved    maxRetries?: number;  // Max push retries (default 3)  }): Promise<PushWithRetryResult> {  const requestedRetries = options?.maxRetries ?? 3;  const maxRetries = (Number.isInteger(requestedRetries) && requestedRetries >= 0)    ? requestedRetries    : 0;  if (maxRetries !== requestedRetries) {    debug('pushWithRetry: invalid maxRetries, using 0 (one attempt)', { requestedRetries });  }  const maxAttempts = maxRetries + 1;  let attempts = 0;   while (attempts < maxAttempts) {    attempts++;    const result = await push(git, branch, options?.force, options?.githubToken);     if (result.success) {      if (result.nothingToPush && attempts > 1) {        debug('Push after rebase resulted in nothing-to-push — remote already has these commits (likely from a previous run)');      }      return {        success: true,        nothingToPush: result.nothingToPush,        nothingToPushAfterRebase: result.nothingToPush && attempts > 1,      };    }        if (!result.rejected) {      // Non-rejected failure (auth, network, etc.) - don't retry      throw new Error(result.error || 'Push failed');    }    if (attempts >= maxAttempts) {      break;    }        // Push was rejected - remote has newer commits    debug(`Push rejected (attempt ${attempts}/${maxAttempts}), attempting fetch + rebase + retry`);    options?.onPullNeeded?.();     const ref = `origin/${branch}`;    try {      await git.raw(['rev-parse', '--verify', ref]);      debug('Rebase target verified', { ref });    } catch {      // Ref may be missing when repo was cloned with --single-branch (refspec doesn't include this branch).      // Add refspec and fetch so rebase has a valid upstream (same pattern as git-clone-core additionalBranches).      debug('Rebase target missing locally, adding refspec and fetching', { ref });      try {        await git.raw(['remote', 'set-branches', '--add', 'origin', branch]);        await git.fetch('origin', branch);      } catch (fetchErr) {        const msg = fetchErr instanceof Error ? fetchErr.message : String(fetchErr);        throw new Error(          `Branch ${branch} does not exist on remote (fetch failed). If using a single-branch clone, create the branch on the remote first. ${msg}`        );      }    }     // Fetch and rebase to handle divergent branches    try {      await git.fetch('origin', branch);      debug('Fetch successful');       await git.raw(['rev-parse', '--verify', ref]);      debug('Rebase target verified before rebase', { ref });       // Then rebase our commits on top of remote      await git.rebase([ref]);      debug('Rebase successful, retrying push');      // Loop continues to retry push    } catch (syncError) {      const syncMsg = syncError instanceof Error ? syncError.message : String(syncError);      debug('Rebase failed', { error: redactUrlCredentials(syncMsg), attempt: attempts });            // Check if it's a conflict      if (syncMsg.includes('CONFLICT') || syncMsg.includes('conflict')) {        // Get conflicted files        const status = await git.status();        const conflictedFiles = status.conflicted || [];                // If we have a conflict handler, try to use it        if (options?.onConflict && conflictedFiles.length > 0) {          debug('Calling onConflict handler', { files: conflictedFiles });                    try {            const resolved = await options.onConflict(conflictedFiles);                        if (resolved) {              // Conflicts resolved - stage files and continue rebase              debug('Conflicts resolved by handler, continuing rebase');              await git.add('.');              try {                await continueRebase(git);                debug('Rebase continued successfully');                // Loop continues to retry push                continue;              } catch (continueError) {                // Rebase continue failed - check if more conflicts or done                const continueMsg = continueError instanceof Error ? continueError.message : String(continueError);                if (continueMsg.includes('No changes') || continueMsg.includes('nothing to commit')) {                  // Rebase is actually done                  debug('Rebase complete (no more changes)');                  continue;                }                // More conflicts - could loop but for now bail                debug('Rebase continue failed', { error: redactUrlCredentials(continueMsg) });              }            }          } catch (handlerError) {            const handlerMsg = handlerError instanceof Error ? handlerError.message : String(handlerError);            debug('onConflict handler failed', { error: redactUrlCredentials(handlerMsg) });          }        }         if (conflictedFiles.length > 0) {          const handlerNote = options?.onConflict            ? 'onConflict did not finish the rebase (or returned false). '            : 'No onConflict handler was provided. ';          console.warn(            `${handlerNote}Rebase conflicts in ${formatNumber(conflictedFiles.length)} file(s): ${conflictedFiles.join(', ')}`,          );        }         // WHY only abort, not cleanupGitState: cleanupGitState does reset --hard + clean -fd and        // destroys the caller's commits (e.g. split-exec's cherry-picks). Abort preserves commits.        try {          await git.rebase(['--abort']);        } catch (abortErr) {          debug('rebase --abort failed (rebase state may be stale); not running cleanup to preserve local commits', { err: String(abortErr) });          await removeStuckRebaseDirs(git);        }        let workdirMsg = '';        try {          const workdir = (await git.revparse(['--show-toplevel'])).trim();          const fileList = conflictedFiles.join(' ');          const allWorkflow = conflictedFiles.every((f) => f.startsWith('.github/workflows/'));          const resolveCmd = allWorkflow            ? `git checkout --theirs -- ${fileList} && git add ${fileList} && git rebase --continue`            : `git add ${fileList} && git rebase --continue`;          workdirMsg = `\nWorkdir: ${workdir}\nResolve then continue: cd ${workdir} && ${resolveCmd}`;        } catch {          // best-effort        }        throw new Error(`Push rejected and rebase has conflicts in: ${conflictedFiles.join(', ')}. Manual resolution needed.${workdirMsg}\nOriginal: ${result.error}`);      }       // Non-conflict rebase failure (e.g. invalid upstream when ref wasn't fetched). Abort only; do not cleanup.      try {        await git.rebase(['--abort']);      } catch (abortErr) {        debug('rebase --abort failed; not running cleanup to preserve local commits', { err: String(abortErr) });        await removeStuckRebaseDirs(git);      }      const refHint = /invalid upstream|ref.*not found/i.test(syncMsg)        ? ' If using a --single-branch clone, ensure the branch ref was fetched (e.g. additionalBranches or git remote set-branches --add origin <branch>).'        : '';      throw new Error(`Push rejected and sync failed: ${syncMsg}${refHint}\nOriginal: ${result.error}`);    }  }    // Exhausted retries  throw new Error(`Push failed after ${maxAttempts} attempts. Remote may be receiving concurrent pushes.`);}