fix: clear stale error when dequeuing work tasks

When a task is retried (dequeued again after failure), the previous
error message was persisting in the work_queue table. This caused the
API to return confusing responses with status="running" but also
containing an error message from the previous attempt.

Now clears error and completed_at when claiming a task, matching the
fix already applied to build_audit.UpdateStatus.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/adapter/postgres/build_audit.go

@@ -84,12 +84,27 @@ func (r *BuildAuditRepository) Update(ctx context.Context, taskID string, result
 }
 
 // UpdateStatus updates the status and worker assignment when a task is claimed.
+// When status is "running" (task claimed for execution/retry), this also clears
+// any stale result and completed_at from previous failed attempts.
 func (r *BuildAuditRepository) UpdateStatus(ctx context.Context, taskID string, status domain.BuildStatus, workerID string) error {
-	res, err := r.db.ExecContext(ctx, `
+	// When a task transitions to running (claimed for execution or retry),
+	// clear stale result data from any previous failed attempts.
+	var query string
+	if status == domain.BuildStatusRunning {
+		query = `
+			UPDATE build_audit
+			SET status = $2, worker_id = $3, result = NULL, completed_at = NULL, started_at = NOW()
+			WHERE task_id = $1
+		`
+	} else {
+		query = `
 			UPDATE build_audit
 			SET status = $2, worker_id = $3
 			WHERE task_id = $1
-	`, taskID, status, nullString(workerID))
+		`
+	}
+
+	res, err := r.db.ExecContext(ctx, query, taskID, status, nullString(workerID))
 	if err != nil {
 		return fmt.Errorf("update build audit status: %w", err)
 	}

internal/adapter/postgres/work_queue.go

@@ -60,9 +60,11 @@ func (r *WorkQueueRepository) Dequeue(ctx context.Context, workerID string) (*do
 	var resultJSON []byte
 	var errorMsg sql.NullString
 
+	// Clear stale error/completed_at when claiming for execution or retry.
+	// This prevents the API from returning confusing "running" status with stale error messages.
 	err := r.db.QueryRowContext(ctx, `
 		UPDATE work_queue
-		SET status = 'running', worker_id = $1, started_at = NOW()
+		SET status = 'running', worker_id = $1, started_at = NOW(), error = NULL, completed_at = NULL
 		WHERE id = (
 			SELECT id FROM work_queue
 			WHERE status = 'pending'

internal/worker/pod_git_operations.go

@@ -94,10 +94,17 @@ func (g *PodGitOperations) CloneRepo(ctx context.Context, podName, workDir, clon
 		// Verify the remote URL matches the expected clone URL
 		currentRemote, err := g.runGitInPodOutput(ctx, podName, workDir, "config", "--get", "remote.origin.url")
 		currentRemote = strings.TrimSpace(currentRemote)
+
+		// Strip token from currentRemote for comparison, since clone stores the authenticated URL
+		// Format: https://token:TOKEN@host/path -> https://host/path
+		normalizedRemote := currentRemote
+		if idx := strings.Index(currentRemote, "@"); idx != -1 && strings.HasPrefix(currentRemote, "https://") {
+			normalizedRemote = "https://" + currentRemote[idx+1:]
+		}
 		expectedURL := cloneURL
 
-		// Normalize URLs for comparison (both should be HTTPS)
+		// Normalize URLs for comparison (both should be HTTPS without credentials)
-		if err == nil && currentRemote == expectedURL {
+		if err == nil && normalizedRemote == expectedURL {
 			log.Info("workspace is already a git repo with correct remote, pulling latest",
 				logging.FieldPodName, podName,
 				"workDir", workDir,