From f28a5e696a6fcda5c0f3d5a08f531626d40d932f Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Thu, 24 Sep 2026 23:27:23 -0700
Subject: [PATCH] fix(pulls): report stack merge API permission errors

Assisted-by: Codet:GPT-5-Codex
---
 modules/task/pull_stack.go      |  8 +++++++-
 modules/task/pull_stack_test.go | 14 ++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/modules/task/pull_stack.go b/modules/task/pull_stack.go
index 2f50b289..6b20e2c8 100644
--- a/modules/task/pull_stack.go
+++ b/modules/task/pull_stack.go
@@ -120,7 +120,7 @@ func AddPullStackEntry(ctx stdctx.Context, login *config.Login, owner, repo stri
 	return &s, nil
 }
 
-// RestackPullStack queues a restack of every entry above the merged pull request in the stack.
+// RestackPullStack queues a restack starting at the stack's base branch.
 func RestackPullStack(ctx stdctx.Context, login *config.Login, owner, repo string, id int64) error {
 	client := api.NewClient(login)
 	resp, err := client.DoContext(ctx, http.MethodPost, fmt.Sprintf("/repos/%s/%s/stacks/%d/restack", owner, repo, id), nil, nil)
@@ -156,12 +156,18 @@ func MergePullStack(ctx stdctx.Context, login *config.Login, owner, repo string,
 	if resp.StatusCode == http.StatusAccepted {
 		return nil, true, nil
 	}
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusConflict {
+		return nil, false, stackAPIError(resp)
+	}
 
 	var body stack.MergeResult
 	if decodeErr := json.NewDecoder(resp.Body).Decode(&body); decodeErr != nil {
 		return nil, false, fmt.Errorf("%s: failed to decode response: %w", resp.Status, decodeErr)
 	}
 	if resp.StatusCode != http.StatusOK {
+		if body.Error == "" {
+			return &body, false, fmt.Errorf("%s", resp.Status)
+		}
 		return &body, false, fmt.Errorf("%s", body.Error)
 	}
 	return &body, false, nil
diff --git a/modules/task/pull_stack_test.go b/modules/task/pull_stack_test.go
index bd8906d8..1a5e9849 100644
--- a/modules/task/pull_stack_test.go
+++ b/modules/task/pull_stack_test.go
@@ -227,3 +227,17 @@ func TestMergePullStackPartialFailure(t *testing.T) {
 	require.NotNil(t, result)
 	assert.Equal(t, int64(1), result.Merged)
 }
+
+func TestMergePullStackPermissionDenied(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+		_, _ = w.Write([]byte(`{"message":"merge not permitted"}`))
+	}))
+	defer server.Close()
+	result, queued, err := MergePullStack(t.Context(), &config.Login{
+		Name: "test", URL: server.URL, Token: "secret-token",
+	}, "owner", "repo", 6, "merge", false)
+	require.ErrorContains(t, err, "merge not permitted")
+	assert.False(t, queued)
+	assert.Nil(t, result)
+}