Add pre-flight conflict detection for cross-stack commit and branch moves

When moving a commit or branch to a different stack, speculatively
rebase the moved commits on top of the destination branch's current HEAD
before applying any changes. If any output commit is conflicted, the
move is rejected.

A conflict here means the moved commits depend on context that remains
in the source stack — for example, a commit being moved was built on top
of commits that stay behind. Given GitButler's mutual-exclusivity
invariant (each hunk belongs to at most one stack), this is the only
class of inter-stack conflict that can arise.

Properties of the check:
- Pre-flight: the repository is unchanged on failure.
- Minimal scope: only the moved commits are rebased, not all destination
  commits. Any conflict is logically between the source and the target
  only.
- Inter-stack only: skipped when source and destination stack are the
  same, since intra-stack moves cannot produce this class of conflict.

Author: mtsgrd

crates/but-workspace/src/legacy/mod.rs

@@ -18,7 +18,7 @@ pub use stacks::{
     local_and_remote_commits, stack_branches, stack_details_v3, stack_heads_info, stacks_v3,
 };
 pub use tree_manipulation::{
-    MoveChangesResult,
+    MoveChangesResult, check_for_destination_conflict,
     move_between_commits::move_changes_between_commits,
     remove_changes_from_commit_in_stack::remove_changes_from_commit_in_stack,
     split_branch::{split_branch, split_into_dependent_branch},

crates/but-workspace/src/legacy/tree_manipulation/mod.rs

@@ -38,3 +38,4 @@ pub(super) mod remove_changes_from_commit_in_stack;
 pub(super) mod split_branch;
 pub(super) mod split_commit;
 mod utils;
+pub use utils::check_for_destination_conflict;

crates/but-workspace/src/legacy/tree_manipulation/utils.rs

@@ -2,11 +2,64 @@
 
 use std::collections::HashMap;
 
+use anyhow::{Result, bail};
+use but_ctx::Context;
 use but_rebase::{RebaseOutput, RebaseStep};
+use gix::prelude::ObjectIdExt as _;
 
 // Re-export from non-legacy location for backward compatibility
 pub use crate::tree_manipulation::{ChangesSource, create_tree_without_diff};
 
+/// Speculatively rebase `steps` onto `onto` and bail if any Pick commit lands as conflicted.
+///
+/// A conflict means the moved commit depends on context that remains in the source stack,
+/// which is an inter-stack conflict — the invariant that stack changes are mutually exclusive
+/// guarantees no other conflict cause exists.
+///
+/// This must be called before modifying any stack state so that a failure leaves the
+/// repository unchanged.
+pub fn check_for_destination_conflict(
+    ctx: &Context,
+    steps: Vec<RebaseStep>,
+    onto: gix::ObjectId,
+) -> Result<()> {
+    let commit_ids: Vec<gix::ObjectId> = steps
+        .iter()
+        .filter_map(|s| {
+            if let RebaseStep::Pick { commit_id, .. } = s {
+                Some(*commit_id)
+            } else {
+                None
+            }
+        })
+        .collect();
+    if commit_ids.is_empty() {
+        return Ok(());
+    }
+    let repo = ctx.repo.get()?;
+    let mut rebase = but_rebase::Rebase::new(&repo, Some(onto), None)?;
+    rebase.rebase_noops(false);
+    rebase.steps(steps)?;
+    let output = rebase.rebase(&*ctx.cache.get_cache()?)?;
+
+    for old_id in commit_ids {
+        let new_id = output
+            .commit_mapping
+            .iter()
+            .find(|(_, old, _)| *old == old_id)
+            .map(|(_, _, new)| *new)
+            .unwrap_or(old_id);
+        let commit = but_core::Commit::from_id(new_id.attach(&repo))?;
+        if commit.is_conflicted() {
+            bail!(
+                "This move would cause a conflict: the moved changes depend on commits \
+                 that remain in the source stack."
+            );
+        }
+    }
+    Ok(())
+}
+
 /// Takes a rebase output and returns the commit mapping with any extra
 /// mapping overrides provided.
 ///

crates/gitbutler-branch-actions/src/move_branch.rs

@@ -2,7 +2,7 @@ use anyhow::{Context as _, Result};
 use but_core::ref_metadata::StackId;
 use but_ctx::{Context, access::RepoExclusive};
 use but_rebase::{Rebase, RebaseStep};
-use but_workspace::legacy::stack_ext::StackExt;
+use but_workspace::legacy::{check_for_destination_conflict, stack_ext::StackExt};
 use gitbutler_reference::{LocalRefname, Refname};
 use gitbutler_stack::{StackBranch, VirtualBranchesHandle};
 use gitbutler_workspace::branch_trees::{WorkspaceState, update_uncommitted_changes};
@@ -45,6 +45,20 @@ pub(crate) fn move_branch(
     let destination_stack = vb_state.get_stack_in_workspace(target_stack_id)?;
     let destination_merge_base = destination_stack.merge_base(ctx)?;
 
+    // Pre-flight (inter-stack only): check that cherry-picking the branch commits onto the
+    // destination won't conflict. A conflict means the branch depends on context that stays in
+    // the source stack.
+    // Must run before any state is modified so a failure leaves the repo unchanged.
+    if source_stack_id != target_stack_id {
+        let (subject_branch_steps, _) =
+            extract_branch_steps(ctx, &repo, &source_stack, subject_branch_name)?;
+        check_for_destination_conflict(
+            ctx,
+            subject_branch_steps,
+            destination_stack.head_oid(ctx)?,
+        )?;
+    }
+
     let (subject_branch_steps, deleted_stacks) = extract_and_rebase_source_branch(
         ctx,
         source_stack_id,

crates/gitbutler-branch-actions/src/move_commits.rs

@@ -1,7 +1,7 @@
 use anyhow::{Context as _, Result, anyhow, bail};
 use but_ctx::{Context, access::RepoExclusive};
 use but_rebase::RebaseStep;
-use but_workspace::legacy::stack_ext::StackExt;
+use but_workspace::legacy::{check_for_destination_conflict, stack_ext::StackExt};
 use gitbutler_stack::{StackId, VirtualBranchesHandle};
 use gitbutler_workspace::branch_trees::{WorkspaceState, update_uncommitted_changes};
 use serde::Serialize;
@@ -41,8 +41,22 @@ pub(crate) fn move_commit(
     repo.find_commit(subject_commit_oid)
         .with_context(|| format!("commit {subject_commit_oid} to be moved could not be found"))?;
 
-    take_commit_from_source_stack(ctx, &mut source_stack, subject_commit_oid)?;
+    // Pre-flight (inter-stack only): check that cherry-picking the commit onto the destination
+    // won't conflict.
+    // A conflict means the commit depends on context that stays in the source stack.
+    // Must run before any state is modified so a failure leaves the repo unchanged.
+    if source_stack_id != target_stack_id {
+        check_for_destination_conflict(
+            ctx,
+            vec![RebaseStep::Pick {
+                commit_id: subject_commit_oid,
+                new_message: None,
+            }],
+            destination_stack.head_oid(ctx)?,
+        )?;
+    }
 
+    take_commit_from_source_stack(ctx, &mut source_stack, subject_commit_oid)?;
     move_commit_to_destination_stack(&mut vb_state, ctx, destination_stack, subject_commit_oid)?;
 
     let new_workspace = WorkspaceState::create(ctx, perm.read_permission())?;

crates/gitbutler-branch-actions/tests/branch-actions/virtual_branches/mod.rs

@@ -73,6 +73,8 @@ mod create_virtual_branch_from_branch;
 mod init;
 mod list;
 mod list_details;
+mod move_branch;
+mod move_changes;
 mod move_commit_to_vbranch;
 mod oplog;
 mod save_and_unapply_virtual_branch;

crates/gitbutler-branch-actions/tests/branch-actions/virtual_branches/move_branch.rs

@@ -0,0 +1,199 @@
+use bstr::ByteSlice;
+use but_testsupport::legacy::stack_details;
+use gitbutler_branch::BranchCreateRequest;
+use gitbutler_stack::VirtualBranchesHandle;
+
+use super::{Test, create_commit};
+
+/// Move a branch that has no dependencies on commits remaining in the source
+/// stack. The source stack is left empty and deleted; the destination gains
+/// the branch. No conflicts should arise.
+#[test]
+fn move_branch_non_overlapping() {
+    let Test { repo, ctx, .. } = &mut Test::default();
+
+    std::fs::write(repo.path().join("base.txt"), "base\n").unwrap();
+    repo.commit_all("M");
+    repo.push();
+
+    let mut guard = ctx.exclusive_worktree_access();
+    gitbutler_branch_actions::set_base_branch(
+        ctx,
+        &"refs/remotes/origin/master".parse().unwrap(),
+        guard.write_permission(),
+    )
+    .unwrap();
+    drop(guard);
+
+    // Source stack: one branch, edits file-a.
+    std::fs::write(repo.path().join("file-a.txt"), "source content\n").unwrap();
+    let mut guard = ctx.exclusive_worktree_access();
+    let source_entry = gitbutler_branch_actions::create_virtual_branch(
+        ctx,
+        &BranchCreateRequest {
+            name: Some("source-stack".into()),
+            ..Default::default()
+        },
+        guard.write_permission(),
+    )
+    .unwrap();
+    drop(guard);
+    let source_id = source_entry.id;
+    create_commit(ctx, source_id, "source: add file-a").unwrap();
+
+    let details = stack_details(ctx);
+    let (_, source_sd) = details.iter().find(|(id, _)| *id == source_id).unwrap();
+    let source_branch_name = source_sd.branch_details[0].name.to_str_lossy().to_string();
+
+    // Destination stack: one branch, edits file-b.
+    std::fs::write(repo.path().join("file-b.txt"), "dest content\n").unwrap();
+    let mut guard = ctx.exclusive_worktree_access();
+    let dest_entry = gitbutler_branch_actions::create_virtual_branch(
+        ctx,
+        &BranchCreateRequest {
+            name: Some("dest-stack".into()),
+            ..Default::default()
+        },
+        guard.write_permission(),
+    )
+    .unwrap();
+    drop(guard);
+    let dest_id = dest_entry.id;
+    create_commit(ctx, dest_id, "dest: add file-b").unwrap();
+
+    let details = stack_details(ctx);
+    let (_, dest_sd) = details.iter().find(|(id, _)| *id == dest_id).unwrap();
+    let dest_branch_name = dest_sd.branch_details[0].name.to_str_lossy().to_string();
+
+    let result = gitbutler_branch_actions::move_branch(
+        ctx,
+        dest_id,
+        &dest_branch_name,
+        source_id,
+        &source_branch_name,
+    );
+    assert!(result.is_ok(), "move_branch should succeed: {result:?}");
+
+    let details = stack_details(ctx);
+
+    // Source stack was the only branch — it should be deleted.
+    let result = result.unwrap();
+    assert!(
+        result.deleted_stacks.contains(&source_id),
+        "source stack should be deleted after its only branch was moved"
+    );
+
+    // Destination should now have 2 branches, no conflicts.
+    let (_, dest_sd) = details
+        .iter()
+        .find(|(id, _)| *id == dest_id)
+        .expect("dest stack should exist");
+    assert_eq!(
+        dest_sd.branch_details.len(),
+        2,
+        "dest should have 2 branches"
+    );
+    for bd in &dest_sd.branch_details {
+        assert!(
+            bd.commits.iter().all(|c| !c.has_conflicts),
+            "no conflicts expected"
+        );
+    }
+}
+
+/// A branch whose commits depend on commits remaining in the source stack
+/// cannot be moved: cherry-picking onto the destination would conflict.
+#[test]
+fn move_branch_with_dependency_rejected() {
+    let Test { repo, ctx, .. } = &mut Test::default();
+
+    std::fs::write(repo.path().join("base.txt"), "base\n").unwrap();
+    repo.commit_all("M");
+    repo.push();
+
+    let mut guard = ctx.exclusive_worktree_access();
+    gitbutler_branch_actions::set_base_branch(
+        ctx,
+        &"refs/remotes/origin/master".parse().unwrap(),
+        guard.write_permission(),
+    )
+    .unwrap();
+    drop(guard);
+
+    // Source stack: bottom branch creates shared.txt; top branch modifies it.
+    std::fs::write(repo.path().join("shared.txt"), "alpha\nbravo\ncharlie\n").unwrap();
+    let mut guard = ctx.exclusive_worktree_access();
+    let source_entry = gitbutler_branch_actions::create_virtual_branch(
+        ctx,
+        &BranchCreateRequest {
+            name: Some("source-stack".into()),
+            ..Default::default()
+        },
+        guard.write_permission(),
+    )
+    .unwrap();
+    drop(guard);
+    let source_id = source_entry.id;
+    create_commit(ctx, source_id, "bottom: create shared.txt").unwrap();
+
+    {
+        let vb_state = VirtualBranchesHandle::new(ctx.project_data_dir());
+        let mut stack = vb_state.get_stack_in_workspace(source_id).unwrap();
+        stack
+            .add_series_top_of_stack(ctx, "source-top".to_string())
+            .unwrap();
+    }
+
+    std::fs::write(
+        repo.path().join("shared.txt"),
+        "alpha\nbravo_modified\ncharlie\n",
+    )
+    .unwrap();
+    let mut guard = ctx.exclusive_worktree_access();
+    but_workspace::legacy::commit_engine::create_commit_simple(
+        ctx,
+        source_id,
+        None,
+        vec![but_core::DiffSpec {
+            previous_path: None,
+            path: "shared.txt".into(),
+            hunk_headers: vec![],
+        }],
+        "top: modify shared.txt".to_string(),
+        "source-top".to_string(),
+        guard.write_permission(),
+    )
+    .unwrap();
+    drop(guard);
+
+    // Destination stack: empty.
+    let mut guard = ctx.exclusive_worktree_access();
+    let dest_entry = gitbutler_branch_actions::create_virtual_branch(
+        ctx,
+        &BranchCreateRequest {
+            name: Some("dest-stack".into()),
+            ..Default::default()
+        },
+        guard.write_permission(),
+    )
+    .unwrap();
+    drop(guard);
+    let dest_id = dest_entry.id;
+
+    let details = stack_details(ctx);
+    let (_, dest_sd) = details.iter().find(|(id, _)| *id == dest_id).unwrap();
+    let dest_branch_name = dest_sd.branch_details[0].name.to_str_lossy().to_string();
+
+    // Moving the dependent top branch must fail.
+    let result = gitbutler_branch_actions::move_branch(
+        ctx,
+        dest_id,
+        &dest_branch_name,
+        source_id,
+        "source-top",
+    );
+    assert!(
+        result.is_err(),
+        "move_branch should be rejected: top branch depends on bottom branch that stays in source"
+    );
+}