Add pre-flight conflict detection for cross-stack commit and branch moves

When moving a commit or branch to a different stack, speculatively
simulate the impact on both sides before applying any changes:

Source check: rebase the remaining source commits without the moved
commit(s). If any would conflict, the move is rejected — those commits
depend on the changes being moved away.

Destination check: rebase the moved commit(s) onto the destination
insertion point. If any would conflict, the move is rejected — the
moved changes do not apply cleanly in the target context.

Pre-existing conflicts in the source stack are exempted: if a commit
was already conflicted before the move, it is not counted as a new
conflict caused by the move.

Moves that are now prevented:
- Moving a commit whose removal would leave dependent commits in the
  source stack that can no longer rebase cleanly.
- Moving a commit onto a destination stack that already modified the
  same content, causing a conflict at the insertion point.
- Moving a branch whose removal would strand dependent branches in
  the source stack.
- Moving a branch onto a destination that has already modified the
  same content.

Moves that are not affected:
- Intra-stack moves (source == destination); these cannot produce
  inter-stack conflicts and skip the check entirely.
- Cross-stack moves where source and destination are truly independent
  (disjoint file changes).
- Moves where the source stack has pre-existing conflicts unrelated to
  the commit being moved.

The check is a pure read: no refs, no snapshot, no worktree state is
modified on rejection. It is invoked before create_snapshot so a
failure leaves the repository completely unchanged.

Author: mtsgrd

crates/but-workspace/src/legacy/mod.rs

@@ -18,7 +18,7 @@ pub use stacks::{
     local_and_remote_commits, stack_branches, stack_details_v3, stack_heads_info, stacks_v3,
 };
 pub use tree_manipulation::{
-    MoveChangesResult,
+    MoveChangesResult, check_rebase_for_conflicts,
     move_between_commits::move_changes_between_commits,
     remove_changes_from_commit_in_stack::remove_changes_from_commit_in_stack,
     split_branch::{split_branch, split_into_dependent_branch},

crates/but-workspace/src/legacy/tree_manipulation/mod.rs

@@ -38,3 +38,4 @@ pub(super) mod remove_changes_from_commit_in_stack;
 pub(super) mod split_branch;
 pub(super) mod split_commit;
 mod utils;
+pub use utils::check_rebase_for_conflicts;

crates/but-workspace/src/legacy/tree_manipulation/utils.rs

@@ -1,12 +1,78 @@
 //! Utility types related to discarding changes in the worktree.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 
+use anyhow::{Result, bail};
+use but_ctx::Context;
 use but_rebase::{RebaseOutput, RebaseStep};
+use gix::prelude::ObjectIdExt as _;
 
 // Re-export from non-legacy location for backward compatibility
 pub use crate::tree_manipulation::{ChangesSource, create_tree_without_diff};
 
+/// Speculatively rebase `steps` onto `onto` and bail with `error_message` if any
+/// Pick commit lands as conflicted.
+///
+/// This is the shared building block for cross-stack move pre-flight checks.
+/// It must be called before modifying any stack state so that a failure leaves
+/// the repository unchanged.
+pub fn check_rebase_for_conflicts(
+    ctx: &Context,
+    steps: Vec<RebaseStep>,
+    onto: gix::ObjectId,
+    error_message: &str,
+) -> Result<()> {
+    let commit_ids: Vec<gix::ObjectId> = steps
+        .iter()
+        .filter_map(|s| {
+            if let RebaseStep::Pick { commit_id, .. } = s {
+                Some(*commit_id)
+            } else {
+                None
+            }
+        })
+        .collect();
+    if commit_ids.is_empty() {
+        return Ok(());
+    }
+    let repo = ctx.repo.get()?;
+
+    // Commits already conflicted before our speculative rebase must not block
+    // the move — they were conflicted for unrelated reasons.
+    let already_conflicted: HashSet<gix::ObjectId> = commit_ids
+        .iter()
+        .filter(|&&id| {
+            but_core::Commit::from_id(id.attach(&repo))
+                .map(|c| c.is_conflicted())
+                .unwrap_or(false)
+        })
+        .copied()
+        .collect();
+
+    let mut rebase = but_rebase::Rebase::new(&repo, Some(onto), None)?;
+    rebase.rebase_noops(false);
+    rebase.steps(steps)?;
+    let output = rebase.rebase(&*ctx.cache.get_cache()?)?;
+
+    let old_to_new: HashMap<gix::ObjectId, gix::ObjectId> = output
+        .commit_mapping
+        .iter()
+        .map(|(_, old, new)| (*old, *new))
+        .collect();
+
+    for old_id in commit_ids {
+        if already_conflicted.contains(&old_id) {
+            continue;
+        }
+        let new_id = old_to_new.get(&old_id).copied().unwrap_or(old_id);
+        let commit = but_core::Commit::from_id(new_id.attach(&repo))?;
+        if commit.is_conflicted() {
+            bail!("{error_message}");
+        }
+    }
+    Ok(())
+}
+
 /// Takes a rebase output and returns the commit mapping with any extra
 /// mapping overrides provided.
 ///

crates/gitbutler-branch-actions/src/actions.rs

@@ -386,6 +386,7 @@ pub fn move_commit(
     ctx.verify(guard.write_permission())?;
     ensure_open_workspace_mode(ctx, guard.read_permission())
         .context("Moving a commit requires open workspace mode")?;
+    move_commits::preflight_check(ctx, target_stack_id, commit_oid, source_stack_id)?;
     let _ = ctx.create_snapshot(
         SnapshotDetails::new(OperationKind::MoveCommit),
         guard.write_permission(),
@@ -410,6 +411,13 @@ pub fn move_branch(
     ctx.verify(guard.write_permission())?;
     ensure_open_workspace_mode(ctx, guard.read_permission())
         .context("Moving a branch requires open workspace mode")?;
+    crate::move_branch::preflight_check(
+        ctx,
+        target_stack_id,
+        target_branch_name,
+        source_stack_id,
+        subject_branch_name,
+    )?;
     let _ = ctx.create_snapshot(
         SnapshotDetails::new(OperationKind::MoveBranch),
         guard.write_permission(),

crates/gitbutler-branch-actions/src/move_branch.rs

@@ -2,7 +2,7 @@ use anyhow::{Context as _, Result};
 use but_core::ref_metadata::StackId;
 use but_ctx::{Context, access::RepoExclusive};
 use but_rebase::{Rebase, RebaseStep};
-use but_workspace::legacy::stack_ext::StackExt;
+use but_workspace::legacy::{check_rebase_for_conflicts, stack_ext::StackExt};
 use gitbutler_reference::{LocalRefname, Refname};
 use gitbutler_stack::{StackBranch, VirtualBranchesHandle};
 use gitbutler_workspace::branch_trees::{WorkspaceState, update_uncommitted_changes};
@@ -21,6 +21,57 @@ pub struct MoveBranchResult {
     pub unapplied_stacks: Vec<StackId>,
 }
 
+/// Pre-flight check for cross-stack branch moves.
+///
+/// Checks both sides of the move:
+/// 1. **Source**: rebases remaining source commits without the moved branch —
+///    bails if any would conflict (they depend on the branch being moved away).
+/// 2. **Destination**: rebases the moved branch commits onto the target branch head —
+///    bails if any would conflict at the insertion point.
+///
+/// Must be called before `create_snapshot` so a rejection leaves no side-effects.
+pub(crate) fn preflight_check(
+    ctx: &Context,
+    target_stack_id: StackId,
+    target_branch_name: &str,
+    source_stack_id: StackId,
+    subject_branch_name: &str,
+) -> Result<()> {
+    if source_stack_id == target_stack_id {
+        return Ok(());
+    }
+    let repo = ctx.repo.get()?;
+    let vb_state = VirtualBranchesHandle::new(ctx.project_data_dir());
+    let source_stack = vb_state.get_stack_in_workspace(source_stack_id)?;
+    let (subject_branch_steps, remaining_steps) =
+        extract_branch_steps(ctx, &repo, &source_stack, subject_branch_name)?;
+
+    // Source side: remaining commits must rebase cleanly without the moved branch.
+    check_rebase_for_conflicts(
+        ctx,
+        remaining_steps,
+        source_stack.merge_base(ctx)?,
+        "This move would cause a conflict in the source stack: \
+         other commits depend on the changes being moved.",
+    )?;
+
+    // Destination side: the moved branch commits must apply cleanly at the insertion point.
+    let destination_stack = vb_state.get_stack_in_workspace(target_stack_id)?;
+    let target_branch_oid = destination_stack
+        .branches()
+        .into_iter()
+        .find(|b| b.name == target_branch_name)
+        .context("Target branch not found in destination stack")?
+        .head_oid(&repo)?;
+    check_rebase_for_conflicts(
+        ctx,
+        subject_branch_steps,
+        target_branch_oid,
+        "This move would cause a conflict in the destination stack: \
+         the branch does not apply cleanly at the target location.",
+    )
+}
+
 pub(crate) fn move_branch(
     ctx: &Context,
     target_stack_id: StackId,

crates/gitbutler-branch-actions/src/move_commits.rs

@@ -1,13 +1,72 @@
 use anyhow::{Context as _, Result, anyhow, bail};
 use but_ctx::{Context, access::RepoExclusive};
 use but_rebase::RebaseStep;
-use but_workspace::legacy::stack_ext::StackExt;
+use but_workspace::legacy::{check_rebase_for_conflicts, stack_ext::StackExt};
 use gitbutler_stack::{StackId, VirtualBranchesHandle};
 use gitbutler_workspace::branch_trees::{WorkspaceState, update_uncommitted_changes};
 use serde::Serialize;
 
 use crate::VirtualBranchesExt;
 
+/// Pre-flight check for cross-stack commit moves.
+///
+/// Checks both sides of the move:
+/// 1. **Source**: rebases remaining source commits without the moved commit —
+///    bails if any would conflict (they depend on the commit being moved away).
+/// 2. **Destination**: rebases the moved commit onto the destination stack head —
+///    bails if it would conflict at the insertion point.
+///
+/// Must be called before `create_snapshot` so a rejection leaves no side-effects.
+pub(crate) fn preflight_check(
+    ctx: &Context,
+    target_stack_id: StackId,
+    subject_commit_oid: gix::ObjectId,
+    source_stack_id: StackId,
+) -> Result<()> {
+    let repo = ctx.repo.get()?;
+    repo.find_commit(subject_commit_oid)
+        .with_context(|| format!("commit {subject_commit_oid} to be moved could not be found"))?;
+    if source_stack_id == target_stack_id {
+        return Ok(());
+    }
+    let vb_state = ctx.virtual_branches();
+
+    // Source side: remaining commits must rebase cleanly without the moved commit.
+    let source_stack = vb_state
+        .try_stack(source_stack_id)?
+        .ok_or(anyhow!("Source stack not found"))?;
+    let remaining_steps: Vec<RebaseStep> = source_stack
+        .as_rebase_steps(ctx)?
+        .into_iter()
+        .filter(|s| match s {
+            RebaseStep::Pick { commit_id, .. } => *commit_id != subject_commit_oid,
+            _ => true,
+        })
+        .collect();
+    check_rebase_for_conflicts(
+        ctx,
+        remaining_steps,
+        source_stack.merge_base(ctx)?,
+        "This move would cause a conflict in the source stack: \
+         other commits depend on the changes being moved.",
+    )?;
+
+    // Destination side: the moved commit must apply cleanly at the insertion point.
+    let destination_stack = vb_state
+        .try_stack(target_stack_id)?
+        .ok_or(anyhow!("Destination branch not found"))?;
+    check_rebase_for_conflicts(
+        ctx,
+        vec![RebaseStep::Pick {
+            commit_id: subject_commit_oid,
+            new_message: None,
+        }],
+        destination_stack.head_oid(ctx)?,
+        "This move would cause a conflict in the destination stack: \
+         the commit does not apply cleanly at the target location.",
+    )
+}
+
 /// move a commit from one stack to another
 ///
 /// commit will end up at the top of the destination stack
@@ -20,8 +79,6 @@ pub(crate) fn move_commit(
 ) -> Result<Option<MoveCommitIllegalAction>> {
     let old_workspace = WorkspaceState::create(ctx, perm.read_permission())?;
     let mut vb_state = ctx.virtual_branches();
-    let repo = ctx.repo.get()?;
-
     let applied_stacks = vb_state
         .list_stacks_in_workspace()
         .context("failed to read virtual branches")?;
@@ -38,11 +95,7 @@ pub(crate) fn move_commit(
         .try_stack(target_stack_id)?
         .ok_or(anyhow!("Destination branch not found"))?;
 
-    repo.find_commit(subject_commit_oid)
-        .with_context(|| format!("commit {subject_commit_oid} to be moved could not be found"))?;
-
     take_commit_from_source_stack(ctx, &mut source_stack, subject_commit_oid)?;
-
     move_commit_to_destination_stack(&mut vb_state, ctx, destination_stack, subject_commit_oid)?;
 
     let new_workspace = WorkspaceState::create(ctx, perm.read_permission())?;

crates/gitbutler-branch-actions/tests/branch-actions/virtual_branches/mod.rs

@@ -73,6 +73,7 @@ mod create_virtual_branch_from_branch;
 mod init;
 mod list;
 mod list_details;
+mod move_branch;
 mod move_commit_to_vbranch;
 mod oplog;
 mod save_and_unapply_virtual_branch;
@@ -82,6 +83,60 @@ mod undo_commit;
 mod update_commit_message;
 mod workspace_migration;
 
+/// Create a raw git commit parented to `parent` that sets `filename` to `content`,
+/// bypassing GitButler's stack API. Used in tests to construct competitor commits
+/// or to inject a known tree state without going through the worktree.
+pub fn create_raw_commit(
+    repo: &gix::Repository,
+    parent: gix::ObjectId,
+    filename: &str,
+    content: &[u8],
+) -> anyhow::Result<gix::ObjectId> {
+    let blob_id = repo.write_blob(content)?.detach();
+    let parent_commit = repo.find_commit(parent)?;
+    let mut editor = parent_commit.tree()?.edit()?;
+    editor.upsert(filename, gix::object::tree::EntryKind::Blob, blob_id)?;
+    let tree_id = editor.write()?.detach();
+    Ok(repo
+        .write_object(gix::objs::Commit {
+            tree: tree_id,
+            parents: [parent].into(),
+            message: "raw test commit".into(),
+            ..parent_commit.decode()?.to_owned()?
+        })?
+        .detach())
+}
+
+/// Cherry-pick `competing_oid` (which shares an ancestor with `onto_oid` and modifies the
+/// same content) onto `onto_oid` to produce a conflicted commit, then update the source
+/// stack head to that conflicted commit. Returns the conflicted commit's OID.
+///
+/// The conflicted commit is parented to `onto_oid`, so after this call the source stack
+/// history is: merge_base → onto_oid → conflicted.
+pub fn push_conflicted_commit(
+    ctx: &but_ctx::Context,
+    stack_id: gitbutler_stack::StackId,
+    onto_oid: gix::ObjectId,
+    competing_oid: gix::ObjectId,
+) -> anyhow::Result<gix::ObjectId> {
+    let repo = ctx.repo.get()?;
+    let conflicted_oid = but_rebase::cherry_pick_one(
+        &repo,
+        onto_oid,
+        competing_oid,
+        but_rebase::cherry_pick::PickMode::Unconditionally,
+        but_rebase::cherry_pick::EmptyCommit::Keep,
+    )?;
+    assert!(
+        but_core::Commit::from_id(repo.find_commit(conflicted_oid)?.id())?.is_conflicted(),
+        "cherry_pick_one must have produced a conflicted commit for the test to be meaningful"
+    );
+    let mut vb_state = gitbutler_stack::VirtualBranchesHandle::new(ctx.project_data_dir());
+    let mut stack = vb_state.get_stack_in_workspace(stack_id)?;
+    stack.set_stack_head(&mut vb_state, &repo, conflicted_oid)?;
+    Ok(conflicted_oid)
+}
+
 pub fn list_commit_files(
     ctx: &Context,
     commit_id: gix::ObjectId,