[bb-slop-cop]

🚨 SLOP COP 🚨 · new-issue-autopilot

Human comments

What was wrong

Detached checkout of a short Git branch name triggers Git's implicit local-branch creation when the branch exists only under origin after cloning. Git rejects that combination before BB reads the marketplace manifest. Reproduced on trusted main in two clean checkouts: https://get-bb.github.io/reports/issues/5373.html.

What changed

• Resolve the requested ref to a verified commit, with an origin remote-tracking fallback, then detach at that commit.
• Add real-Git regression coverage for a non-default branch, origin-qualified ref, annotated tag, commit hash, and branch refresh.
• Keep the existing clone strategy and public interfaces unchanged; no dependency, protocol, schema, migration, or stored-data change.
• Changed-line count against origin/main: 82 (75 additions + 7 deletions), across 2 files in the existing plugin-catalog subsystem.

How you verified

• Before the fix, the focused regression fails for the short branch with Git exit 128; the other three cases pass. Repeated on a second clean checkout of the same trusted main commit.
• After the fix, all four focused cases pass. Eight relevant catalog suites pass: 149 tests, including existing default-branch lifecycle coverage.
• pnpm exec turbo run test --filter=@bb/server -- test/services/plugin-catalog/third-party-marketplaces.test.ts -t 'reads the selected catalog commit'
• Relevant suites run through Turbo with the eight test file paths under test/services/plugin-catalog, excluding the unrelated official generator suite.
• pnpm exec turbo run typecheck --filter=@bb/server, focused oxfmt --check, and git diff --check pass; no binary changes.
• A broader catalog-directory run has one pre-existing official-generator timestamp expectation failure: Git emits +00:00 rather than Z. The same failure occurs on unchanged trusted main; it does not exercise the modified materializer and is not changed here.

Fixes #5373

AGENT GENERATED