Merge pull request 'fix(git-guard): stash-before-commit when dirty tree is also stale vs origin' (#19) from fix-git-guard-stash-before-commit into main

Adds the unmerged-conflict guard flagged in PR review: before the dirty-tree
flow can run, check `git ls-files -u` and refuse to auto-commit if unresolved
merge conflict markers are present (e.g. left behind by a prior run's failed
`git stash pop`). Without this, a re-run's `git add -A` would silently stage
literal <<<<<<< / ======= / >>>>>>> markers into a real commit and push them
to origin/main.

Also expands every failure-path message (stash-push failure, stash-pop
conflict vs. untracked-file-collision, resync failure, true divergence,
manual-abort cases) to include concrete, copy-pasteable remediation command
sequences with multiple options (resolve-in-place vs. abandon-and-reapply vs.
drop-if-unneeded), rather than a single generic hint. The true-divergence
message now also tells the operator to check `git stash list` first, so a
stash created by the new dirty+stale path isn't confused with a second
manually-created one.

No change to the common dirty-but-current or clean-but-stale behavior.

.woodpecker/deploy.yml

@@ -59,6 +59,17 @@ when:
 #   render, hard failure naming any missing value). Migrated stacks call
 #   the script; unmigrated stacks keep legacy case entries until their own
 #   PR. See the "Secrets & Deployment Architecture — Global Direction" note.
+#
+#   2026-09-08 FIX: secrets/ is a tooling/docs folder (secrets-map.yaml +
+#   *.secrets.example), not a stack — but folder-detection treated it as one
+#   the first time a commit touched it (PR #16). deploy survived only because
+#   'secrets' sits in the bootstrap-tier skip list; verify had no guard and
+#   died on `docker stack ps secrets` failing under errexit (assignment from
+#   a failing command substitution aborts the step). Fixed by excluding
+#   secrets/ alongside deploy/ in ALL folder-detection sites, and by
+#   tolerating a failing stack-ps in verify (|| true) so a genuinely missing
+#   stack produces the designed WARNING instead of killing the step. This
+#   hazard was first flagged in July (PR #3, closed unmerged).
 # ─────────────────────────────────────────────────────────────────────────────
 
 steps:
@@ -76,9 +87,9 @@ steps:
         FLAT=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.ya?ml$' || true)
 
         # Folder: any file under a subfolder (e.g. immich/immich.yml).
-        # Exclude dotfolders (.woodpecker, .git, .gitea, etc.) and deploy/
+        # Exclude dotfolders (.woodpecker, .git, .gitea, etc.) and the
-        # (shared tooling, not a stack — see note above).
+        # non-stack tooling folders deploy/ and secrets/ (see notes above).
-        FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
+        FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
 
         [ -z "$FLAT" ] && [ -z "$FOLDERS" ] && echo "No stacks changed" && exit 0
 
@@ -219,14 +230,14 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && echo "No stacks changed, skipping" && exit 0
       - scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@$${SWARM_MANAGER_IP}:/tmp/cs.sh
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
 
         for STACK in $ALL_STACKS; do
@@ -360,7 +371,7 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && echo "No stacks changed" && exit 0
 
@@ -368,6 +379,13 @@ steps:
         rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
           deploy/ root@$${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
 
+        # Sync secrets/ tooling (manifest + examples) alongside deploy/ —
+        # provision-stack.py reads secrets/secrets-map.yaml from the CI
+        # checkout, but the host mirror should stay complete for emergency
+        # manual provisioning runs.
+        rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
+          secrets/ root@$${SWARM_MANAGER_IP}:/volume1/docker/compose-files/secrets/
+
         for STACK in $ALL_STACKS; do
           echo "--- Deploying: $STACK ---"
           # Sync files to host first (always, even for bootstrap stacks)
@@ -414,7 +432,7 @@ steps:
       - |
         CHANGED_FILES=$(echo "${CI_PIPELINE_FILES}" | tr -d '[]"' | tr ',' '\n')
         FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
-        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -v '^deploy$' | sort -u || true)
+        FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/.][^/]*/' | cut -d/ -f1 | grep -vE '^(deploy|secrets)$' | sort -u || true)
         ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
         [ -z "$ALL_STACKS" ] && exit 0
 
@@ -425,6 +443,10 @@ steps:
         # "nothing found in stack" output on ordinary deploys (e.g. vaultwarden,
         # 2026-08-25). Retry with backoff instead of a single fixed sleep, and
         # only warn (don't fail the pipeline) if tasks never show up.
+        # 2026-09-08: `|| true` inside the command substitution is REQUIRED —
+        # this step runs under errexit, and an assignment from a failing
+        # command substitution (e.g. `docker stack ps` on a stack that doesn't
+        # exist) kills the whole step before the WARNING path can run.
         ATTEMPTS=6
         DELAY=5
         for STACK in $ALL_STACKS; do
@@ -433,7 +455,7 @@ steps:
           while [ "$i" -le "$ATTEMPTS" ]; do
             OUTPUT=$(ssh -o StrictHostKeyChecking=no root@$${SWARM_MANAGER_IP} \
               "docker stack ps $STACK --filter desired-state=running \
-              --format '  {{.Name}} {{.CurrentState}}'" 2>/dev/null)
+              --format '  {{.Name}} {{.CurrentState}}'" 2>/dev/null || true)
             if [ -n "$OUTPUT" ]; then
               echo "$OUTPUT"
               break

ai/ai.yaml

@@ -141,6 +141,7 @@ services:
     - /volume1/docker/mcpo/data:/mcpo_data
     - /volume1/docker/cronicle/ssh_keys:/app/ssh_keys:ro
     - /volume1/docker/mcpo/uv-cache:/app/uv-cache
+    - /volume1/docker/mcpo/flowagent-auth:/app/flowagent-auth
     secrets:
     - source: flowagent_azure_client_id
       target: flowagent_azure_client_id

deploy/git-guard.sh

@@ -5,10 +5,20 @@
 # Behavior:
 #   - Clean + up to date        -> pass silently
 #   - Clean + behind (ff-only)  -> auto `git pull --ff-only`, then pass
-#   - Ahead only (unpushed)     -> interactive: offer to push; non-interactive: BLOCK
+#   - Clean + ahead only        -> interactive: offer to push; non-interactive: BLOCK
-#   - Dirty tracked changes     -> offer to commit + push right now
+#     (unpushed)
-#                                   (auto in non-interactive/CI runs, after a
+#   - Unresolved merge conflict -> REFUSE immediately. Never auto-commits over
+#     markers present               conflict markers. Prints remediation options.
+#   - Dirty + local in sync     -> offer to commit + push right now
+#     with origin                 (auto in non-interactive/CI runs, after a
 #                                   secret-pattern scan of the staged diff)
+#   - Dirty + local STALE/      -> NEVER commit on top of a stale base. Stash
+#     diverged vs origin           the dirty changes first, resync main with
+#                                   origin using the same behind/ahead/diverged
+#                                   rules as the clean-tree case, then reapply
+#                                   the stash and re-run. On any failure the
+#                                   stash is preserved and remediation options
+#                                   (with exact commands) are printed.
 #   - Diverged (local AND       -> REFUSE. Never auto-resolves. Prints the
 #     remote both moved)           backup/stash/reset recovery steps and exits.
 #
@@ -36,12 +46,246 @@ git status --porcelain | grep -q . && DIRTY=1
 
 SECRET_PATTERN='(-----BEGIN [A-Z]+ PRIVATE KEY-----|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9a-zA-Z-]+|password[[:space:]]*[:=][[:space:]]*[^$ ]|api[_-]?key[[:space:]]*[:=][[:space:]]*[^$ ])'
 
+# resync_with_origin <local_sha> <remote_sha> <base_sha>
+#
+# Handles the behind/ahead/diverged cases against a CLEAN working tree.
+# Shared by both the "tree was already clean" path and the new
+# "dirty tree turned out to be stale, so we stashed first" path, so the
+# two paths can never drift out of sync with each other.
+#
+# Returns 0 if it's now safe to deploy, 1 if it could not safely resolve
+# (guidance already printed to stdout in that case).
+resync_with_origin() {
+  local local_sha="$1" remote_sha="$2" base_sha="$3"
+
+  # ---- Case: fully in sync ----
+  if [ "$local_sha" = "$remote_sha" ]; then
+    echo "==> In sync with origin/main ($local_sha). OK to deploy."
+    return 0
+  fi
+
+  # ---- Case: behind only (fast-forwardable) ----
+  if [ "$local_sha" = "$base_sha" ]; then
+    echo "!! Local main is behind origin/main."
+    if [ "$INTERACTIVE" -eq 1 ]; then
+      read -rp "Fast-forward pull now? [y/N] " ans
+    else
+      ans="y"
+      echo "(non-interactive session — auto fast-forwarding)"
+    fi
+    if [[ "$ans" =~ ^[Yy]$ ]]; then
+      git pull --ff-only origin main
+      echo "==> Fast-forwarded to $(git rev-parse --short main). OK to deploy."
+      return 0
+    else
+      echo "Aborting - pull manually, then retry:"
+      echo "  cd $DIR && git pull --ff-only origin main"
+      return 1
+    fi
+  fi
+
+  # ---- Case: ahead only (local commits not yet pushed) ----
+  if [ "$remote_sha" = "$base_sha" ]; then
+    echo "!! Local main is AHEAD of origin/main (unpushed commits):"
+    git log --oneline "origin/main..main"
+    echo
+    if [ "$INTERACTIVE" -eq 1 ]; then
+      read -rp "Push local commits to origin/main now? [y/N] " ans
+    else
+      ans="n"
+      echo "(non-interactive session — will NOT auto-push ahead commits; needs human review)"
+    fi
+    if [[ "$ans" =~ ^[Yy]$ ]]; then
+      git push origin main
+      echo "==> Pushed. OK to deploy."
+      return 0
+    else
+      echo "Aborting. Review with:"
+      echo "  cd $DIR && git log origin/main..main"
+      echo "Then push manually when ready:"
+      echo "  git push origin main"
+      return 1
+    fi
+  fi
+
+  # ---- Case: true divergence (both ahead and behind) — NEVER auto-fix ----
+  echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+  echo "!! DIVERGED: local main and origin/main have both moved independently."
+  echo "!!"
+  echo "!!   Local-only commits:"
+  git log --oneline "$base_sha..main" | sed 's/^/!!     /'
+  echo "!!"
+  echo "!!   Remote-only commits:"
+  git log --oneline "$base_sha..origin/main" | sed 's/^/!!     /'
+  echo "!!"
+  echo "!! This requires a human decision - git-guard will NOT auto-resolve this."
+  echo "!!"
+  echo "!! Before stashing anything new, check whether a git-guard safety stash"
+  echo "!! ALREADY exists from this same run (avoids confusing duplicate stashes):"
+  echo "!!   git stash list"
+  echo "!!"
+  echo "!! Recommended recovery:"
+  echo "!!   1. tar backup:      tar czf /volume1/docker/compose-files-backup-\$(date +%Y%m%d-%H%M%S).tar.gz -C /volume1/docker compose-files"
+  echo "!!   2. name the branch: git branch backup/pre-reset-\$(date +%Y%m%d)"
+  echo "!!   3. stash any NEW uncommitted state only if 'git stash list' above"
+  echo "!!      didn't already show one for this run:"
+  echo "!!        git stash push -u -m 'pre-reset-snapshot'"
+  echo "!!   4. reset to origin: git reset --hard origin/main"
+  echo "!!   5. selectively restore needed files from the stash/backup branch:"
+  echo "!!        git stash list"
+  echo "!!        git stash show -p stash@{N}"
+  echo "!!        git stash apply stash@{N}   # 'apply' keeps the stash as a backup; use 'pop' to also drop it"
+  echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+  return 1
+}
+
+# ---- Case: unresolved merge conflict already present ----
+# Can happen if a PRIOR git-guard run's `git stash pop` conflicted and the
+# resulting conflict markers were never resolved before the next deploy
+# attempt. Must be checked BEFORE the dirty-tree commit flow below, because
+# an unmerged path shows up as "dirty" too, and `git add -A` would silently
+# stage the literal <<<<<<< / ======= / >>>>>>> markers into a real commit.
+if git ls-files -u | grep -q .; then
+  echo "ERROR: unresolved merge conflict markers present in the working tree."
+  echo "Refusing to auto-commit over a conflict — this would push literal"
+  echo "<<<<<<< / ======= / >>>>>>> markers to origin/main."
+  echo
+  echo "Conflicted paths:"
+  git diff --name-only --diff-filter=U | sed 's/^/  /'
+  echo
+  echo "Remediation options:"
+  echo "  A) Resolve the conflict by hand, then commit and push:"
+  echo "       cd $DIR"
+  echo "       git status                       # see conflicted paths"
+  echo "       git diff                          # inspect the conflict markers"
+  echo "       \$EDITOR <conflicted-file>          # remove markers, keep correct content"
+  echo "       git add <conflicted-file>"
+  echo "       git commit -m 'resolve git-guard stash-pop conflict'"
+  echo "       git push origin main"
+  echo "  B) Discard the conflicted merge attempt entirely and start clean from"
+  echo "     origin/main, then decide separately whether to re-apply anything"
+  echo "     from a prior safety stash:"
+  echo "       cd $DIR"
+  echo "       git checkout -- ."
+  echo "       git reset --hard origin/main"
+  echo "       git stash list                    # look for a git-guard-safety-stash-* entry"
+  echo "       git stash show -p stash@{N}         # inspect before deciding"
+  echo "  C) Once resolved (via A or B) and no longer needed, clean up the stash:"
+  echo "       git stash drop stash@{N}"
+  exit 1
+fi
+
 # ---- Case: dirty tracked changes ----
 if [ "$DIRTY" -eq 1 ]; then
   echo "!! WORKING TREE DIRTY — uncommitted changes detected:"
   git status --short
   echo
 
+  # If local is ALSO stale/diverged from origin, committing right now would
+  # create a doomed commit on top of a base that's about to be rejected on
+  # push (this is exactly what caused a real incident: a stray on-disk edit
+  # sat on a checkout that was 4 commits behind, git-guard auto-committed
+  # anyway, then the push bounced). Stash first, resync safely using the
+  # same rules as the clean-tree path, then reapply.
+  if [ "$LOCAL" != "$REMOTE" ]; then
+    echo "!! Local main is ALSO stale/diverged from origin/main."
+    echo "   Refusing to commit on top of a stale base — stashing the dirty"
+    echo "   changes safely first, then resyncing with origin."
+    echo
+
+    STASH_MSG="git-guard-safety-stash-$(date -u +%Y%m%dT%H%M%SZ)"
+    if ! git stash push -u -m "$STASH_MSG"; then
+      echo "ERROR: 'git stash push' itself failed (disk full, permissions, or"
+      echo "       some other git error). Your changes are still on disk,"
+      echo "       uncommitted — nothing has been lost, but git-guard cannot"
+      echo "       proceed safely until this is resolved."
+      echo
+      echo "Remediation options:"
+      echo "  A) Check disk space and permissions, then retry the deploy:"
+      echo "       df -h $DIR"
+      echo "       ls -la $DIR"
+      echo "  B) Identify and manually move aside whatever is blocking the stash,"
+      echo "     then retry:"
+      echo "       cd $DIR"
+      echo "       git status --short              # find the offending path(s)"
+      echo "       mv <path> <path>.bak-\$(date +%s)"
+      echo "  C) Inspect the raw git error above for specifics before proceeding."
+      exit 1
+    fi
+    echo "==> Stashed as: $STASH_MSG"
+
+    if resync_with_origin "$LOCAL" "$REMOTE" "$BASE"; then
+      echo "==> Resync succeeded. Reapplying stashed changes..."
+      if git stash pop; then
+        echo "==> Stash reapplied cleanly. Re-checking sync state..."
+        exec "$0" "$@"
+      else
+        echo "ERROR: 'git stash pop' did not complete successfully."
+        echo
+        if git ls-files -u | grep -q .; then
+          echo "This is a MERGE CONFLICT — your stashed changes were partially"
+          echo "applied and conflict markers (<<<<<<< / ======= / >>>>>>>) are now"
+          echo "in the working tree. The stash itself is still preserved as a backup."
+          echo
+          echo "Remediation options:"
+          echo "  A) Resolve the conflict by hand, then commit and push:"
+          echo "       cd $DIR"
+          echo "       git status                       # see conflicted paths"
+          echo "       git diff                          # inspect the markers"
+          echo "       \$EDITOR <conflicted-file>          # remove markers, keep correct content"
+          echo "       git add <conflicted-file>"
+          echo "       git commit -m 'resolve git-guard stash-pop conflict'"
+          echo "       git push origin main"
+          echo "       git stash list                    # confirm which entry is: $STASH_MSG"
+          echo "       git stash drop stash@{N}           # once confirmed no longer needed"
+          echo "  B) Abandon this merge attempt and fall back to a clean, resynced"
+          echo "     tree, then re-apply the change manually with full visibility:"
+          echo "       cd $DIR"
+          echo "       git checkout -- ."
+          echo "       git reset --hard origin/main      # now matches origin, no conflict"
+          echo "       git stash list                    # find: $STASH_MSG"
+          echo "       git stash show -p stash@{N}         # review the content"
+          echo "       git stash apply stash@{N}          # 'apply' keeps the backup; use 'pop' to also drop it"
+        else
+          echo "This looks like an UNTRACKED-FILE COLLISION, not a merge conflict"
+          echo "(a file added upstream shares a path with an untracked file in your"
+          echo "stash). No conflict markers were written; the stash was NOT applied"
+          echo "and remains fully intact."
+          echo
+          echo "Remediation options:"
+          echo "  A) Move the colliding upstream file aside, pop, then reconcile:"
+          echo "       cd $DIR"
+          echo "       git status --short                         # identify the colliding path"
+          echo "       mv <path> <path>.upstream-\$(date +%s)"
+          echo "       git stash pop"
+          echo "       diff <path> <path>.upstream-*               # reconcile manually, then remove the .upstream-* backup"
+          echo "  B) Inspect the stash without applying, and hand-merge the needed"
+          echo "     pieces instead:"
+          echo "       git stash list                              # find N"
+          echo "       git stash show -p stash@{N}"
+        fi
+        echo
+        echo "Your stash reference for this run: $STASH_MSG"
+        exit 1
+      fi
+    else
+      echo "ERROR: could not safely resync with origin/main."
+      echo "Your uncommitted changes are preserved in the stash: $STASH_MSG"
+      echo
+      echo "Remediation options:"
+      echo "  A) Follow the manual recovery steps printed above (from the"
+      echo "     behind/ahead/diverged case), THEN reapply your change:"
+      echo "       cd $DIR"
+      echo "       git stash list                 # find: $STASH_MSG"
+      echo "       git stash apply stash@{N}      # or 'pop' to also drop it once resynced"
+      echo "  B) If the stashed change is no longer needed (e.g. it's already"
+      echo "     represented in a since-merged PR), verify then drop it:"
+      echo "       git stash show -p stash@{N}"
+      echo "       git stash drop stash@{N}"
+      exit 1
+    fi
+  fi
+
   if [ "$INTERACTIVE" -eq 1 ]; then
     read -rp "Commit and push these changes to origin/main now? [y/N] " ans
   else
@@ -54,7 +298,8 @@ if [ "$DIRTY" -eq 1 ]; then
 
     if git diff --cached | grep -Eiq "$SECRET_PATTERN"; then
       echo "ERROR: possible secret detected in staged changes. Refusing to auto-commit."
-      echo "Review manually: git diff --cached"
+      echo "Review manually:"
+      echo "  cd $DIR && git diff --cached"
       git reset
       exit 1
     fi
@@ -66,77 +311,22 @@ if [ "$DIRTY" -eq 1 ]; then
       exec "$0" "$@"
     else
       echo "ERROR: push failed (likely diverged from origin). Aborting deploy."
-      echo "Run: cd $DIR && git status"
+      echo "Run:"
+      echo "  cd $DIR && git status"
       exit 1
     fi
   else
-    echo "Aborting deploy - commit or stash changes manually, then retry."
+    echo "Aborting deploy - commit or stash changes manually, then retry:"
+    echo "  cd $DIR"
+    echo "  git add -A && git commit -m 'your message' && git push origin main"
+    echo "  # or: git stash push -u -m 'manual-stash'"
     exit 1
   fi
 fi
 
-# ---- Case: fully in sync ----
+# ---- Clean tree: resync with origin using the shared logic above ----
-if [ "$LOCAL" = "$REMOTE" ]; then
+if resync_with_origin "$LOCAL" "$REMOTE" "$BASE"; then
-  echo "==> In sync with origin/main ($LOCAL). OK to deploy."
   exit 0
+else
+  exit 1
 fi
-
-# ---- Case: behind only (fast-forwardable) ----
-if [ "$LOCAL" = "$BASE" ]; then
-  echo "!! Local main is behind origin/main."
-  if [ "$INTERACTIVE" -eq 1 ]; then
-    read -rp "Fast-forward pull now? [y/N] " ans
-  else
-    ans="y"
-    echo "(non-interactive session — auto fast-forwarding)"
-  fi
-  if [[ "$ans" =~ ^[Yy]$ ]]; then
-    git pull --ff-only origin main
-    echo "==> Fast-forwarded to $(git rev-parse --short main). OK to deploy."
-    exit 0
-  else
-    echo "Aborting deploy - pull manually, then retry."
-    exit 1
-  fi
-fi
-
-# ---- Case: ahead only (local commits not yet pushed) ----
-if [ "$REMOTE" = "$BASE" ]; then
-  echo "!! Local main is AHEAD of origin/main (unpushed commits):"
-  git log --oneline "origin/main..main"
-  echo
-  if [ "$INTERACTIVE" -eq 1 ]; then
-    read -rp "Push local commits to origin/main now? [y/N] " ans
-  else
-    ans="n"
-    echo "(non-interactive session — will NOT auto-push ahead commits; needs human review)"
-  fi
-  if [[ "$ans" =~ ^[Yy]$ ]]; then
-    git push origin main
-    echo "==> Pushed. OK to deploy."
-    exit 0
-  else
-    echo "Aborting deploy. Review with: git log origin/main..main"
-    exit 1
-  fi
-fi
-
-# ---- Case: true divergence (both ahead and behind) — NEVER auto-fix ----
-echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-echo "!! DIVERGED: local main and origin/main have both moved independently."
-echo "!!"
-echo "!!   Local-only commits:"
-git log --oneline "$BASE..main" | sed 's/^/!!     /'
-echo "!!"
-echo "!!   Remote-only commits:"
-git log --oneline "$BASE..origin/main" | sed 's/^/!!     /'
-echo "!!"
-echo "!! This requires a human decision - git-guard will NOT auto-resolve this."
-echo "!! Recommended recovery:"
-echo "!!   1. tar backup:      tar czf /volume1/docker/compose-files-backup-\$(date +%Y%m%d-%H%M%S).tar.gz -C /volume1/docker compose-files"
-echo "!!   2. name the branch: git branch backup/pre-reset-\$(date +%Y%m%d)"
-echo "!!   3. stash all state: git stash push -u -m 'pre-reset-snapshot'"
-echo "!!   4. reset to origin: git reset --hard origin/main"
-echo "!!   5. selectively restore needed files from the stash/backup branch"
-echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
-exit 1