fix(server): Address PR #733 review feedback and fix cross-platform tests

- Extract merge logic from pipeline-orchestrator to merge-service.ts to avoid HTTP self-call
- Make agent-executor error handling provider-agnostic using shared isAuthenticationError utility
- Fix cross-platform path handling in tests using path.normalize/path.resolve helpers
- Add catch handlers in plan-approval-service tests to prevent unhandled promise rejection warnings

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/server/src/services/agent-executor.ts

@@ -4,7 +4,7 @@
 
 import path from 'path';
 import type { ExecuteOptions, ParsedTask } from '@automaker/types';
-import { buildPromptWithImages, createLogger } from '@automaker/utils';
+import { buildPromptWithImages, createLogger, isAuthenticationError } from '@automaker/utils';
 import { getFeatureDir } from '@automaker/platform';
 import * as secureFs from '../lib/secure-fs.js';
 import { TypedEventBus } from './typed-event-bus.js';
@@ -206,14 +206,10 @@ export class AgentExecutor {
                   responseText += '\n\n';
               }
               responseText += newText;
-              if (
-                block.text &&
-                (block.text.includes('Invalid API key') ||
-                  block.text.includes('authentication_failed') ||
-                  block.text.includes('Fix external API key'))
-              )
+              // Check for authentication errors using provider-agnostic utility
+              if (block.text && isAuthenticationError(block.text))
                 throw new Error(
-                  "Authentication failed: Invalid or expired API key. Please check your ANTHROPIC_API_KEY, or run 'claude login' to re-authenticate."
+                  'Authentication failed: Invalid or expired API key. Please check your API key configuration or re-authenticate with your provider.'
                 );
               scheduleWrite();
               const hasExplicitMarker = responseText.includes('[SPEC_GENERATED]'),

apps/server/src/services/merge-service.ts

@@ -0,0 +1,175 @@
+/**
+ * MergeService - Direct merge operations without HTTP
+ *
+ * Extracted from worktree merge route to allow internal service calls.
+ */
+
+import { exec } from 'child_process';
+import { promisify } from 'util';
+import { createLogger } from '@automaker/utils';
+import { spawnProcess } from '@automaker/platform';
+
+const execAsync = promisify(exec);
+const logger = createLogger('MergeService');
+
+export interface MergeOptions {
+  squash?: boolean;
+  message?: string;
+  deleteWorktreeAndBranch?: boolean;
+}
+
+export interface MergeServiceResult {
+  success: boolean;
+  error?: string;
+  hasConflicts?: boolean;
+  mergedBranch?: string;
+  targetBranch?: string;
+  deleted?: {
+    worktreeDeleted: boolean;
+    branchDeleted: boolean;
+  };
+}
+
+/**
+ * Execute git command with array arguments to prevent command injection.
+ */
+async function execGitCommand(args: string[], cwd: string): Promise<string> {
+  const result = await spawnProcess({
+    command: 'git',
+    args,
+    cwd,
+  });
+
+  if (result.exitCode === 0) {
+    return result.stdout;
+  } else {
+    const errorMessage = result.stderr || `Git command failed with code ${result.exitCode}`;
+    throw new Error(errorMessage);
+  }
+}
+
+/**
+ * Validate branch name to prevent command injection.
+ */
+function isValidBranchName(name: string): boolean {
+  return /^[a-zA-Z0-9._\-/]+$/.test(name) && name.length < 250;
+}
+
+/**
+ * Perform a git merge operation directly without HTTP.
+ *
+ * @param projectPath - Path to the git repository
+ * @param branchName - Source branch to merge
+ * @param worktreePath - Path to the worktree (used for deletion if requested)
+ * @param targetBranch - Branch to merge into (defaults to 'main')
+ * @param options - Merge options (squash, message, deleteWorktreeAndBranch)
+ */
+export async function performMerge(
+  projectPath: string,
+  branchName: string,
+  worktreePath: string,
+  targetBranch: string = 'main',
+  options?: MergeOptions
+): Promise<MergeServiceResult> {
+  if (!projectPath || !branchName || !worktreePath) {
+    return {
+      success: false,
+      error: 'projectPath, branchName, and worktreePath are required',
+    };
+  }
+
+  const mergeTo = targetBranch || 'main';
+
+  // Validate source branch exists
+  try {
+    await execAsync(`git rev-parse --verify ${branchName}`, { cwd: projectPath });
+  } catch {
+    return {
+      success: false,
+      error: `Branch "${branchName}" does not exist`,
+    };
+  }
+
+  // Validate target branch exists
+  try {
+    await execAsync(`git rev-parse --verify ${mergeTo}`, { cwd: projectPath });
+  } catch {
+    return {
+      success: false,
+      error: `Target branch "${mergeTo}" does not exist`,
+    };
+  }
+
+  // Merge the feature branch into the target branch
+  const mergeCmd = options?.squash
+    ? `git merge --squash ${branchName}`
+    : `git merge ${branchName} -m "${options?.message || `Merge ${branchName} into ${mergeTo}`}"`;
+
+  try {
+    await execAsync(mergeCmd, { cwd: projectPath });
+  } catch (mergeError: unknown) {
+    // Check if this is a merge conflict
+    const err = mergeError as { stdout?: string; stderr?: string; message?: string };
+    const output = `${err.stdout || ''} ${err.stderr || ''} ${err.message || ''}`;
+    const hasConflicts = output.includes('CONFLICT') || output.includes('Automatic merge failed');
+
+    if (hasConflicts) {
+      return {
+        success: false,
+        error: `Merge CONFLICT: Automatic merge of "${branchName}" into "${mergeTo}" failed. Please resolve conflicts manually.`,
+        hasConflicts: true,
+      };
+    }
+
+    // Re-throw non-conflict errors
+    throw mergeError;
+  }
+
+  // If squash merge, need to commit
+  if (options?.squash) {
+    await execAsync(`git commit -m "${options?.message || `Merge ${branchName} (squash)`}"`, {
+      cwd: projectPath,
+    });
+  }
+
+  // Optionally delete the worktree and branch after merging
+  let worktreeDeleted = false;
+  let branchDeleted = false;
+
+  if (options?.deleteWorktreeAndBranch) {
+    // Remove the worktree
+    try {
+      await execGitCommand(['worktree', 'remove', worktreePath, '--force'], projectPath);
+      worktreeDeleted = true;
+    } catch {
+      // Try with prune if remove fails
+      try {
+        await execGitCommand(['worktree', 'prune'], projectPath);
+        worktreeDeleted = true;
+      } catch {
+        logger.warn(`Failed to remove worktree: ${worktreePath}`);
+      }
+    }
+
+    // Delete the branch (but not main/master)
+    if (branchName !== 'main' && branchName !== 'master') {
+      if (!isValidBranchName(branchName)) {
+        logger.warn(`Invalid branch name detected, skipping deletion: ${branchName}`);
+      } else {
+        try {
+          await execGitCommand(['branch', '-D', branchName], projectPath);
+          branchDeleted = true;
+        } catch {
+          logger.warn(`Failed to delete branch: ${branchName}`);
+        }
+      }
+    }
+  }
+
+  return {
+    success: true,
+    mergedBranch: branchName,
+    targetBranch: mergeTo,
+    deleted: options?.deleteWorktreeAndBranch ? { worktreeDeleted, branchDeleted } : undefined,
+  };
+}

apps/server/src/services/pipeline-orchestrator.ts

@@ -27,6 +27,7 @@ import type { SettingsService } from './settings-service.js';
 import type { ConcurrencyManager } from './concurrency-manager.js';
 import { pipelineService } from './pipeline-service.js';
 import type { TestRunnerService, TestRunStatus } from './test-runner-service.js';
+import { performMerge } from './merge-service.js';
 import type {
   PipelineContext,
   PipelineStatusInfo,
@@ -65,8 +66,7 @@ export class PipelineOrchestrator {
     private loadContextFilesFn: typeof loadContextFiles,
     private buildFeaturePromptFn: BuildFeaturePromptFn,
     private executeFeatureFn: ExecuteFeatureFn,
-    private runAgentFn: RunAgentFn,
-    private serverPort = 3008
+    private runAgentFn: RunAgentFn
   ) {}
 
   async executePipeline(ctx: PipelineContext): Promise<void> {
@@ -483,37 +483,19 @@ export class PipelineOrchestrator {
 
     logger.info(`Attempting auto-merge for feature ${featureId} (branch: ${branchName})`);
     try {
-      const response = await fetch(`http://localhost:${this.serverPort}/api/worktree/merge`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          projectPath,
-          branchName,
-          worktreePath,
-          targetBranch: 'main',
-          options: { deleteWorktreeAndBranch: false },
-        }),
-      });
+      // Call merge service directly instead of HTTP fetch
+      const result = await performMerge(
+        projectPath,
+        branchName,
+        worktreePath || projectPath,
+        'main',
+        {
+          deleteWorktreeAndBranch: false,
+        }
+      );
 
-      if (!response) {
-        return { success: false, error: 'No response from merge endpoint' };
-      }
-
-      // Defensively parse JSON response
-      let data: { success: boolean; hasConflicts?: boolean; error?: string };
-      try {
-        data = (await response.json()) as {
-          success: boolean;
-          hasConflicts?: boolean;
-          error?: string;
-        };
-      } catch (parseError) {
-        logger.error(`Failed to parse merge response:`, parseError);
-        return { success: false, error: 'Invalid response from merge endpoint' };
-      }
-
-      if (!response.ok) {
-        if (data.hasConflicts) {
+      if (!result.success) {
+        if (result.hasConflicts) {
           await this.updateFeatureStatusFn(projectPath, featureId, 'merge_conflict');
           this.eventBus.emitAutoModeEvent('pipeline_merge_conflict', {
             featureId,
@@ -522,7 +504,7 @@ export class PipelineOrchestrator {
           });
           return { success: false, hasConflicts: true, needsAgentResolution: true };
         }
-        return { success: false, error: data.error };
+        return { success: false, error: result.error };
       }
 
       logger.info(`Auto-merge successful for feature ${featureId}`);