@pourkit/cli 0.0.0-next-20260529180337 → 0.0.0-next-20260531183322

package/dist/cli.js

@@ -301,17 +301,17 @@ function parseWorktreeListPorcelain(text2, branch) {
   const entries = text2.trim().split("\n\n");
   for (const entry of entries) {
     const lines = entry.trim().split("\n");
-    let path7 = "";
+    let path9 = "";
     let entryBranch = "";
     for (const line of lines) {
       if (line.startsWith("worktree ")) {
-        path7 = line.slice("worktree ".length);
+        path9 = line.slice("worktree ".length);
       } else if (line.startsWith("branch refs/heads/")) {
         entryBranch = line.slice("branch refs/heads/".length);
       }
     }
-    if (entryBranch === branch && path7) {
-      return path7;
+    if (entryBranch === branch && path9) {
+      return path9;
     }
   }
   return null;
@@ -334,7 +334,7 @@ var init_common = __esm({
 });
 
 // cli.ts
-import path6 from "path";
+import path8 from "path";
 import { realpathSync } from "fs";
 import { pathToFileURL } from "url";
 import { Command, Option, CommanderError } from "commander";
@@ -368,6 +368,13 @@ var VerificationCommandSchema = z.object({
 var QueueConfigSchema = z.object({
   loop: z.boolean().optional()
 }).strict();
+var FailureResolutionConfigSchema = z.object({
+  agent: NonEmptyString,
+  model: NonEmptyString,
+  promptTemplate: NonEmptyString,
+  maxAttemptsPerFailure: z.number().int().positive(),
+  failureLimits: z.record(z.string(), z.number().int().positive()).optional()
+}).strict();
 var ReviewRefactorLoopStrategySchema = z.object({
   type: z.literal("review-refactor-loop"),
   implement: z.object({
@@ -379,6 +386,7 @@ var ReviewRefactorLoopStrategySchema = z.object({
     promptTemplate: NonEmptyString,
     maxAttempts: z.number().int().positive()
   }).strict().optional(),
+  failureResolution: FailureResolutionConfigSchema,
   review: z.object({
     reviewer: ReviewerConfigSchema,
     refactor: StageAgentConfigSchema,
@@ -398,6 +406,10 @@ var ReviewRefactorLoopStrategySchema = z.object({
     maxAttempts: z.number().int().positive()
   }).strict()
 }).strict();
+var TargetSerenaConfigSchema = z.object({
+  enabled: z.boolean().optional(),
+  required: z.boolean().optional()
+}).strict();
 var TargetSchema = z.object({
   name: NonEmptyString,
   baseBranch: z.preprocess(
@@ -414,6 +426,7 @@ var TargetSchema = z.object({
     z.boolean().default(true)
   ),
   queue: QueueConfigSchema.optional(),
+  serena: TargetSerenaConfigSchema.optional(),
   strategy: ReviewRefactorLoopStrategySchema
 }).strict();
 var LabelsSchema = z.object({
@@ -453,12 +466,21 @@ var CleanupConfigSchema = z.object({
   worktreeRetentionDays: z.number().int().positive().default(14),
   logRetentionDays: z.number().int().positive().default(30)
 }).strict();
+var SerenaConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  required: z.boolean().default(false),
+  mcpUrl: NonEmptyString.default("http://localhost:9121/mcp"),
+  sandboxMcpUrl: NonEmptyString.default("http://localhost:9121/mcp"),
+  dataDir: z.string().default(".pourkit/serena/"),
+  autoStart: z.boolean().default(false)
+}).strict();
 var PourkitConfigSchema = z.object({
   targets: z.array(TargetSchema).min(1),
   labels: LabelsSchema,
   sandbox: SandboxSchema,
   checks: ChecksSchema,
-  cleanup: CleanupConfigSchema.optional()
+  cleanup: CleanupConfigSchema.optional(),
+  serena: SerenaConfigSchema.default({})
 }).strict();
 var removedFieldReplacements = {
   "config.implementor": "targets[].strategy.implement.builder",
@@ -523,10 +545,10 @@ function checkRemovedFields(raw) {
     }
   }
 }
-function formatZodPath(path7) {
-  if (path7.length === 0) return "";
+function formatZodPath(path9) {
+  if (path9.length === 0) return "";
   let result = "";
-  for (const segment of path7) {
+  for (const segment of path9) {
     if (typeof segment === "number") {
       result += `[${segment}]`;
     } else {
@@ -537,8 +559,8 @@ function formatZodPath(path7) {
 }
 function formatFirstZodError(err) {
   const issue = err.issues[0];
-  const path7 = formatZodPath(issue.path);
-  if (path7 === "targets" && (issue.code === "too_small" || issue.code === "invalid_type")) {
+  const path9 = formatZodPath(issue.path);
+  if (path9 === "targets" && (issue.code === "too_small" || issue.code === "invalid_type")) {
     return "Config must have at least one target";
   }
   if (issue.path.length >= 3 && issue.path[0] === "targets" && typeof issue.path[1] === "number" && issue.path[2] === "name" && issue.code === z.ZodIssueCode.too_small) {
@@ -547,37 +569,37 @@ function formatFirstZodError(err) {
   switch (issue.code) {
     case z.ZodIssueCode.invalid_type: {
       if (issue.expected === "object") {
-        return path7 ? `${path7} must be an object` : "Config must be an object";
+        return path9 ? `${path9} must be an object` : "Config must be an object";
       }
       if (issue.expected === "integer") {
-        return `${path7} must be an integer`;
+        return `${path9} must be an integer`;
       }
       if (issue.expected === "string") {
-        return `${path7} must be a string`;
+        return `${path9} must be a string`;
       }
       if (issue.expected === "number") {
-        return `${path7} must be a number`;
+        return `${path9} must be a number`;
       }
       return issue.message;
     }
     case z.ZodIssueCode.too_small:
       if (issue.type === "string" && issue.minimum === 1) {
-        return `${path7} must be a non-empty string`;
+        return `${path9} must be a non-empty string`;
       }
       if (issue.type === "array" && issue.minimum === 1) {
-        return `${path7} must not be empty`;
+        return `${path9} must not be empty`;
       }
       if (issue.type === "number") {
-        return `${path7} must be a positive number`;
+        return `${path9} must be a positive number`;
       }
       return issue.message;
     case z.ZodIssueCode.invalid_literal:
-      return `${path7} must be ${issue.expected}`;
+      return `${path9} must be ${issue.expected}`;
     case z.ZodIssueCode.unrecognized_keys:
-      const keyPath = path7 ? `${path7}.${issue.keys[0]}` : issue.keys[0];
+      const keyPath = path9 ? `${path9}.${issue.keys[0]}` : issue.keys[0];
       return `${keyPath} is not supported`;
     case z.ZodIssueCode.custom:
-      return path7 ? `${path7} ${issue.message}` : issue.message;
+      return path9 ? `${path9} ${issue.message}` : issue.message;
     default:
       return issue.message;
   }
@@ -604,9 +626,19 @@ function parseConfig(raw) {
       "setupCommands",
       "autoMerge",
       "queue",
+      "serena",
       "strategy"
     ]);
   }
+  for (let i = 0; i < rawTargets.length; i++) {
+    const t = rawTargets[i];
+    const strategy = t?.strategy;
+    if (strategy && typeof strategy === "object" && "conflictResolution" in strategy) {
+      throw new Error(
+        `targets[${i}].strategy.conflictResolution has been removed; use targets[${i}].strategy.failureResolution`
+      );
+    }
+  }
   if (config.sandbox && typeof config.sandbox === "object") {
     assertKnownKeys(config.sandbox, "sandbox", [
       "provider",
@@ -637,17 +669,17 @@ function parseConfig(raw) {
       setupCommands,
       autoMerge: t.autoMerge,
       queue: t.queue,
+      serena: t.serena,
       strategy: {
         type: "review-refactor-loop",
         implement: { builder: t.strategy.implement.builder },
-        ...t.strategy.conflictResolution ? {
-          conflictResolution: {
-            agent: t.strategy.conflictResolution.agent,
-            model: t.strategy.conflictResolution.model,
-            promptTemplate: t.strategy.conflictResolution.promptTemplate,
-            maxAttempts: t.strategy.conflictResolution.maxAttempts
-          }
-        } : {},
+        failureResolution: {
+          agent: t.strategy.failureResolution.agent,
+          model: t.strategy.failureResolution.model,
+          promptTemplate: t.strategy.failureResolution.promptTemplate,
+          maxAttemptsPerFailure: t.strategy.failureResolution.maxAttemptsPerFailure,
+          failureLimits: t.strategy.failureResolution.failureLimits
+        },
         review: {
           reviewer: t.strategy.review.reviewer,
           refactor: t.strategy.review.refactor,
@@ -662,6 +694,19 @@ function parseConfig(raw) {
       }
     };
   });
+  const serena = {
+    ...data.serena,
+    mcpUrl: process.env.POURKIT_SERENA_MCP_URL ?? data.serena.mcpUrl,
+    sandboxMcpUrl: process.env.POURKIT_SERENA_SANDBOX_MCP_URL ?? data.serena.sandboxMcpUrl
+  };
+  if (serena.mcpUrl.trim() === "") {
+    throw new Error("POURKIT_SERENA_MCP_URL must be a non-empty string");
+  }
+  if (serena.sandboxMcpUrl.trim() === "") {
+    throw new Error(
+      "POURKIT_SERENA_SANDBOX_MCP_URL must be a non-empty string"
+    );
+  }
   return {
     targets,
     labels: data.labels,
@@ -680,6 +725,7 @@ function parseConfig(raw) {
       pollIntervalSeconds: data.checks.pollIntervalSeconds ?? 15,
       issueListLimit: data.checks.issueListLimit ?? 50
     },
+    serena,
     cleanup: {
       enabled: data.cleanup?.enabled ?? true,
       worktreeRetentionDays: data.cleanup?.worktreeRetentionDays ?? 14,
@@ -687,10 +733,10 @@ function parseConfig(raw) {
     }
   };
 }
-function assertKnownKeys(value, path7, knownKeys) {
+function assertKnownKeys(value, path9, knownKeys) {
   for (const key of Object.keys(value)) {
     if (!knownKeys.includes(key)) {
-      throw new Error(`${path7}.${key} is not supported`);
+      throw new Error(`${path9}.${key} is not supported`);
     }
   }
 }
@@ -698,14 +744,14 @@ function getVerificationCommands(target) {
   return target.strategy.verify?.commands ?? [];
 }
 async function loadRepoConfig(repoRoot2, configFileName = "pourkit.config.ts") {
-  const { existsSync: existsSync8 } = await import("fs");
-  const { readFile: readFile4, writeFile: writeFile3, rm } = await import("fs/promises");
+  const { existsSync: existsSync10 } = await import("fs");
+  const { readFile: readFile5, writeFile: writeFile3, rm } = await import("fs/promises");
   const { tmpdir } = await import("os");
   const { join: pjoin, basename } = await import("path");
   const { pathToFileURL: pathToFileURL2 } = await import("url");
   const { build } = await import("esbuild");
   const configPath = pjoin(repoRoot2, configFileName);
-  if (!existsSync8(configPath)) {
+  if (!existsSync10(configPath)) {
     throw new Error(
       `No config file found at ${configPath}. Create a ${configFileName} that exports a default PourkitConfig.`
     );
@@ -836,16 +882,16 @@ function parseWorktreeListPorcelain2(text2) {
   const entries = text2.trim().split("\n\n");
   return entries.map((entry) => {
     const lines = entry.trim().split("\n");
-    let path7 = "";
+    let path9 = "";
     let branch = "";
     for (const line of lines) {
       if (line.startsWith("worktree ")) {
-        path7 = line.slice("worktree ".length);
+        path9 = line.slice("worktree ".length);
       } else if (line.startsWith("branch refs/heads/")) {
         branch = line.slice("branch refs/heads/".length);
       }
     }
-    return { path: path7, branch: branch || void 0 };
+    return { path: path9, branch: branch || void 0 };
   }).filter((e) => e.path);
 }
 async function listCleanupCandidates(repoRoot2, retentionDays) {
@@ -885,7 +931,7 @@ async function removeStaleWorktree(candidate, repoRoot2, logger) {
   }
 }
 async function removeExpiredFiles(dirPath, retentionDays) {
-  const { readdir: readdir2, stat, unlink, access } = await import("fs/promises");
+  const { readdir: readdir2, stat, unlink, access: access2 } = await import("fs/promises");
   let entries;
   try {
     entries = await readdir2(dirPath);
@@ -899,7 +945,7 @@ async function removeExpiredFiles(dirPath, retentionDays) {
     try {
       const stats = await stat(entryPath);
       if (stats.isFile() && now - stats.mtimeMs > retentionMs) {
-        await access(entryPath, 4);
+        await access2(entryPath, 4);
         await unlink(entryPath);
       }
     } catch {
@@ -950,8 +996,8 @@ async function cleanupRepository(options) {
 }
 
 // commands/issue-run.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { join as join10 } from "path";
 
 // pr/templates.ts
 init_common();
@@ -1014,6 +1060,13 @@ var STAGE_SECTIONS = {
     "branch",
     "verification-commands",
     "artifacts"
+  ],
+  failureResolution: [
+    "issue",
+    "comments",
+    "branch",
+    "verification-commands",
+    "artifacts"
   ]
 };
 function buildRunContextArtifact(options) {
@@ -1207,361 +1260,837 @@ function invalidateAfterBaseRefresh(state) {
   };
 }
 
-// commands/conflict-resolution.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
-init_common();
+// failure-resolution/effect-runtime.ts
+import { Effect } from "effect";
 
-// conflicts/conflict-resolution-artifact.ts
-var ConflictResolutionArtifactProtocolError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ConflictResolutionArtifactProtocolError";
+// failure-resolution/types.ts
+var RebaseConflict = class extends Error {
+  _tag = "RebaseConflict";
+  conflictedPaths;
+  message;
+  constructor(args) {
+    super(args.message);
+    this.name = "RebaseConflict";
+    this.conflictedPaths = args.conflictedPaths;
+    this.message = args.message;
   }
 };
-var VALID_STATUSES = [
-  "resolved",
-  "ambiguous"
-];
-var SECTION_HEADING_PATTERN = /^## (Status|Summary|Files|Verification)\s*$/gm;
-function extractSections(output) {
-  const sections = [];
-  let match;
-  const re = new RegExp(SECTION_HEADING_PATTERN);
-  while ((match = re.exec(output)) !== null) {
-    const heading = match[1];
-    sections.push({
-      heading,
-      startIndex: match.index,
-      endIndex: match.index + match[0].length
+var PublishedHistoryRisk = class extends Error {
+  _tag = "PublishedHistoryRisk";
+  prNumber;
+  prState;
+  constructor(args) {
+    super(`Published PR #${args.prNumber} is ${args.prState}`);
+    this.name = "PublishedHistoryRisk";
+    this.prNumber = args.prNumber;
+    this.prState = args.prState;
+  }
+};
+var RecoveryArtifactInvalid = class extends Error {
+  _tag = "RecoveryArtifactInvalid";
+  reason;
+  constructor(args) {
+    super(args.reason);
+    this.name = "RecoveryArtifactInvalid";
+    this.reason = args.reason;
+  }
+};
+var SUPPORTED_DECISIONS = /* @__PURE__ */ new Set([
+  "RETRY_STAGE",
+  "HANDOFF_TO_HUMAN",
+  "FAIL_RUN"
+]);
+function isSupportedRecoveryDecision(decision) {
+  return SUPPORTED_DECISIONS.has(decision);
+}
+var JSON_BLOCK_RE = /```json\n([\s\S]*?)```/;
+function parseRecoveryArtifact(markdown, artifactPath) {
+  const match = JSON_BLOCK_RE.exec(markdown);
+  if (!match) {
+    throw new RecoveryArtifactInvalid({
+      reason: `No JSON code block found in artifact at ${artifactPath}`
     });
   }
-  return sections;
-}
-function contentAfter(output, sections, section) {
-  const index = sections.indexOf(section);
-  const nextSection = sections[index + 1];
-  const start = section.endIndex;
-  const end = nextSection?.startIndex ?? output.length;
-  return output.slice(start, end).trim();
-}
-function extractMarker(output) {
-  const matches = output.matchAll(
-    /<conflict-resolution>\s*(resolved|ambiguous)\s*<\/conflict-resolution>/g
-  );
-  const results = Array.from(matches);
-  if (results.length > 1) {
-    throw new ConflictResolutionArtifactProtocolError(
-      "Duplicate <conflict-resolution>...</conflict-resolution> markers"
-    );
+  let parsed;
+  try {
+    parsed = JSON.parse(match[1]);
+  } catch {
+    throw new RecoveryArtifactInvalid({
+      reason: `Malformed JSON in artifact at ${artifactPath}`
+    });
   }
-  return results.length === 1 ? results[0][1] : null;
-}
-function parseFileList(filesContent) {
-  return filesContent.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("- ")).map((line) => {
-    const rest = line.slice(2).trim();
-    const codeMatch = rest.match(/^`([^`]+)`/);
-    return codeMatch ? codeMatch[1] : rest;
-  });
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new RecoveryArtifactInvalid({
+      reason: `Expected a JSON object in artifact at ${artifactPath}`
+    });
+  }
+  const json = parsed;
+  if (typeof json.recoveryDecision !== "string" || json.recoveryDecision === "") {
+    throw new RecoveryArtifactInvalid({
+      reason: `Missing or empty recoveryDecision in artifact at ${artifactPath}`
+    });
+  }
+  if (typeof json.summary !== "string" || json.summary === "") {
+    throw new RecoveryArtifactInvalid({
+      reason: `Missing or empty summary in artifact at ${artifactPath}`
+    });
+  }
+  const changedFiles = json.changedFiles;
+  if (!Array.isArray(changedFiles)) {
+    throw new RecoveryArtifactInvalid({
+      reason: `changedFiles must be an array in artifact at ${artifactPath}`
+    });
+  }
+  if (!changedFiles.every((f) => typeof f === "string")) {
+    throw new RecoveryArtifactInvalid({
+      reason: `changedFiles must be an array of strings in artifact at ${artifactPath}`
+    });
+  }
+  if (json.verificationSummary !== void 0 && typeof json.verificationSummary !== "string") {
+    throw new RecoveryArtifactInvalid({
+      reason: `verificationSummary must be a string in artifact at ${artifactPath}`
+    });
+  }
+  if (json.notes !== void 0 && typeof json.notes !== "string") {
+    throw new RecoveryArtifactInvalid({
+      reason: `notes must be a string in artifact at ${artifactPath}`
+    });
+  }
+  if (json.verificationCommands !== void 0) {
+    if (!Array.isArray(json.verificationCommands)) {
+      throw new RecoveryArtifactInvalid({
+        reason: `verificationCommands must be an array in artifact at ${artifactPath}`
+      });
+    }
+    if (!json.verificationCommands.every((c) => typeof c === "string")) {
+      throw new RecoveryArtifactInvalid({
+        reason: `verificationCommands must be an array of strings in artifact at ${artifactPath}`
+      });
+    }
+  }
+  return {
+    raw: markdown,
+    json: {
+      recoveryDecision: json.recoveryDecision,
+      summary: json.summary,
+      changedFiles,
+      verificationSummary: json.verificationSummary,
+      verificationCommands: json.verificationCommands,
+      notes: json.notes
+    },
+    path: artifactPath
+  };
 }
-function parseVerificationTable(content) {
-  const lines = content.split("\n").map((l) => l.trim()).filter(Boolean);
-  const tableLines = lines.filter((l) => l.startsWith("|") && l.endsWith("|"));
-  const dataRows = tableLines.slice(2);
-  return dataRows.map((row) => {
-    const cells = row.split("|").slice(1, -1).map((c) => c.trim());
+function validateRecoveryDecision(artifact, allowedDecisions) {
+  const decision = artifact.json.recoveryDecision;
+  if (!allowedDecisions.includes(decision)) {
     return {
-      command: cells[0] ?? "",
-      result: cells[1] ?? "",
-      notes: cells[2] ?? ""
+      valid: false,
+      reason: `Decision "${decision}" is not in allowed list: ${allowedDecisions.join(", ")}`
     };
-  });
-}
-function parseConflictResolutionArtifact(output) {
-  if (!output.trim()) {
-    throw new ConflictResolutionArtifactProtocolError(
-      "Empty conflict resolution artifact output"
-    );
   }
-  const sections = extractSections(output);
-  const statusSections = sections.filter((s) => s.heading === "Status");
-  const summarySections = sections.filter((s) => s.heading === "Summary");
-  const filesSections = sections.filter((s) => s.heading === "Files");
-  if (statusSections.length > 1) {
-    throw new ConflictResolutionArtifactProtocolError(
-      'Duplicate "## Status" sections'
-    );
+  if (!isSupportedRecoveryDecision(decision)) {
+    return {
+      valid: false,
+      reason: `Decision "${decision}" is not supported in this slice`
+    };
   }
-  if (summarySections.length > 1) {
-    throw new ConflictResolutionArtifactProtocolError(
-      'Duplicate "## Summary" sections'
-    );
+  return { valid: true, decision };
+}
+
+// shared/attempt-log.ts
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, join as join4 } from "path";
+var ATTEMPT_LOG_PATH = ".pourkit/attempt-log.jsonl";
+function writeAttemptLog(worktreePath, entry) {
+  const logPath = join4(worktreePath, ATTEMPT_LOG_PATH);
+  mkdirSync3(dirname2(logPath), { recursive: true });
+  appendFileSync(logPath, JSON.stringify(entry) + "\n", "utf-8");
+}
+function readAttemptLog(worktreePath) {
+  const logPath = join4(worktreePath, ATTEMPT_LOG_PATH);
+  if (!existsSync2(logPath)) {
+    return [];
   }
-  if (filesSections.length > 1) {
-    throw new ConflictResolutionArtifactProtocolError(
-      'Duplicate "## Files" sections'
-    );
+  const raw = readFileSync2(logPath, "utf-8");
+  const lines = raw.split("\n").filter((l) => l.length > 0);
+  const entries = [];
+  for (const line of lines) {
+    try {
+      const parsed = JSON.parse(line);
+      if (isValidAttemptLogEntry(parsed)) {
+        entries.push(parsed);
+      }
+    } catch {
+    }
   }
-  const verificationSections = sections.filter(
-    (s) => s.heading === "Verification"
+  return entries;
+}
+function isValidAttemptLogEntry(raw) {
+  if (typeof raw !== "object" || raw === null) return false;
+  const obj = raw;
+  if (obj.attemptType !== "stage" && obj.attemptType !== "recovery")
+    return false;
+  if (typeof obj.fingerprint !== "string") return false;
+  if (typeof obj.timestamp !== "string") return false;
+  if (typeof obj.stage !== "string") return false;
+  if (obj.outcome !== "success" && obj.outcome !== "failure" && obj.outcome !== "handoff")
+    return false;
+  return true;
+}
+function recoveryBudgetForFailure(worktreePath, fingerprint, maxAttempts) {
+  const entries = readAttemptLog(worktreePath);
+  const used = entries.filter(
+    (e) => e.attemptType === "recovery" && e.fingerprint === fingerprint
+  ).length;
+  const remaining = Math.max(0, maxAttempts - used);
+  return {
+    used,
+    remaining,
+    exhausted: used >= maxAttempts
+  };
+}
+function computeFailureFingerprint(stage, failureType) {
+  return `${stage.toLowerCase()}:${failureType}`;
+}
+
+// failure-resolution/stage-attempt.ts
+function createStageAttemptId() {
+  return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function recordStageAttempt(worktreePath, record) {
+  writeAttemptLog(worktreePath, {
+    attemptType: "stage",
+    fingerprint: record.failureFingerprint ?? `${record.stage}:success`,
+    timestamp: record.completedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    stage: record.stage,
+    outcome: record.outcome === "handoff" ? "handoff" : record.outcome === "success" ? "success" : "failure"
+  });
+}
+
+// failure-resolution/effect-runtime.ts
+function baseRefreshEffect(options) {
+  return Effect.promise(() => refreshStaleIssueBranch(options)).pipe(
+    Effect.flatMap(
+      (result) => {
+        switch (result.status) {
+          case "refreshed":
+            return Effect.succeed({ status: "refreshed" });
+          case "skipped-current":
+            return Effect.succeed({ status: "skipped-current" });
+          case "conflicted":
+            return Effect.fail(
+              new RebaseConflict({
+                conflictedPaths: result.conflictedPaths,
+                message: result.message
+              })
+            );
+          case "refused-published-history":
+            return Effect.fail(
+              new PublishedHistoryRisk({
+                prNumber: result.prNumber,
+                prState: result.prState
+              })
+            );
+        }
+      }
+    )
   );
-  const statusSection = statusSections[0];
-  const summarySection = summarySections[0];
-  const filesSection = filesSections[0];
-  if (!statusSection) {
-    throw new ConflictResolutionArtifactProtocolError(
-      'Missing required section "## Status"'
-    );
+}
+async function runBaseRefreshAttempt(options) {
+  const attemptId = createStageAttemptId();
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const program = baseRefreshEffect(options).pipe(
+    Effect.tapBoth({
+      onSuccess: (success) => Effect.sync(() => {
+        recordStageAttempt(options.worktreePath, {
+          id: attemptId,
+          stage: "baseRefresh",
+          startedAt,
+          completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          outcome: "success"
+        });
+      }),
+      onFailure: (failure) => Effect.sync(() => {
+        recordStageAttempt(options.worktreePath, {
+          id: attemptId,
+          stage: "baseRefresh",
+          startedAt,
+          completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          outcome: "failure",
+          failureFingerprint: computeFailureFingerprint(
+            "baseRefresh",
+            failure._tag
+          ),
+          failureType: failure._tag
+        });
+      })
+    })
+  );
+  return Effect.runPromiseExit(program);
+}
+
+// commands/conflict-resolution.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
+init_common();
+var CONFLICT_MARKER_PATTERN = /<<<<<<<|=======|>>>>>>>/m;
+async function hasUnresolvedConflictMarkers(worktreePath, files) {
+  for (const file of files) {
+    const filePath = join5(worktreePath, file);
+    try {
+      const content = readFileSync3(filePath, "utf-8");
+      if (CONFLICT_MARKER_PATTERN.test(content)) {
+        return true;
+      }
+    } catch {
+    }
   }
-  if (!summarySection) {
-    throw new ConflictResolutionArtifactProtocolError(
-      'Missing required section "## Summary"'
-    );
+  return false;
+}
+
+// commands/issue-run.ts
+import { Exit as Exit2 } from "effect";
+
+// serena/baseline.ts
+init_common();
+import path3 from "path";
+import { access, mkdir as mkdir2 } from "fs/promises";
+function resolveSerenaPaths(repoRoot2, dataDir = ".pourkit/serena/") {
+  const rootDir = path3.isAbsolute(dataDir) ? path3.normalize(dataDir) : path3.resolve(repoRoot2, dataDir);
+  return {
+    rootDir,
+    baselineWorktreePath: path3.join(rootDir, "baseline", "active-repo"),
+    dataDir: path3.join(rootDir, "data")
+  };
+}
+async function pathExists(dirPath) {
+  try {
+    await access(dirPath);
+    return true;
+  } catch {
+    return false;
   }
-  if (!filesSection) {
-    throw new ConflictResolutionArtifactProtocolError(
-      'Missing required section "## Files"'
-    );
+}
+async function isGitRepoRoot(repoPath) {
+  try {
+    const result = await execCapture("git", ["rev-parse", "--show-toplevel"], {
+      cwd: repoPath,
+      label: "git rev-parse --show-toplevel"
+    });
+    return path3.resolve(result.stdout.trim()) === path3.resolve(repoPath);
+  } catch {
+    return false;
   }
-  const statusRaw = contentAfter(output, sections, statusSection);
-  const summary = contentAfter(output, sections, summarySection);
-  const filesContent = contentAfter(output, sections, filesSection);
-  if (!statusRaw) {
-    throw new ConflictResolutionArtifactProtocolError(
-      '"## Status" section is empty'
+}
+async function ensureBaselineWorktree(options) {
+  const paths = resolveSerenaPaths(options.repoRoot, options.dataDir);
+  await mkdir2(paths.rootDir, { recursive: true });
+  await mkdir2(paths.dataDir, { recursive: true });
+  if (!await pathExists(paths.baselineWorktreePath)) {
+    await mkdir2(path3.dirname(paths.baselineWorktreePath), { recursive: true });
+    await execCapture(
+      "git",
+      ["clone", options.repoRoot, paths.baselineWorktreePath],
+      {
+        cwd: options.repoRoot,
+        label: "git clone baseline worktree"
+      }
     );
+    return paths;
   }
-  if (!summary) {
-    throw new ConflictResolutionArtifactProtocolError(
-      '"## Summary" section is empty'
+  if (!await isGitRepoRoot(paths.baselineWorktreePath)) {
+    throw new Error(
+      `Serena baseline worktree exists but is not a git repo: ${paths.baselineWorktreePath}`
     );
   }
-  if (!VALID_STATUSES.includes(statusRaw)) {
-    throw new ConflictResolutionArtifactProtocolError(
-      `Unsupported status "${statusRaw}". Allowed statuses: ${VALID_STATUSES.join(", ")}`
-    );
+  return paths;
+}
+async function getSerenaBaselineStatus(options) {
+  const remoteName = options.remoteName ?? "origin";
+  const paths = resolveSerenaPaths(options.repoRoot, options.dataDir);
+  const expectedRef = `${remoteName}/${options.baseBranch}`;
+  if (!await pathExists(paths.baselineWorktreePath)) {
+    return {
+      exists: false,
+      baselineWorktreePath: paths.baselineWorktreePath,
+      expectedRef,
+      fresh: false
+    };
   }
-  const markerStatus = extractMarker(output);
-  if (!markerStatus) {
-    throw new ConflictResolutionArtifactProtocolError(
-      "Missing <conflict-resolution>...</conflict-resolution> marker"
-    );
+  if (!await isGitRepoRoot(paths.baselineWorktreePath)) {
+    return {
+      exists: false,
+      baselineWorktreePath: paths.baselineWorktreePath,
+      expectedRef,
+      fresh: false
+    };
   }
-  if (markerStatus !== statusRaw) {
-    throw new ConflictResolutionArtifactProtocolError(
-      `Conflict resolution status "${statusRaw}" does not match marker "${markerStatus}"`
-    );
+  let currentCommit;
+  try {
+    const currentResult = await execCapture("git", ["rev-parse", "HEAD"], {
+      cwd: paths.baselineWorktreePath,
+      label: "git rev-parse HEAD"
+    });
+    currentCommit = currentResult.stdout.trim() || void 0;
+  } catch {
+    return {
+      exists: true,
+      baselineWorktreePath: paths.baselineWorktreePath,
+      expectedRef,
+      fresh: false
+    };
   }
-  let verification;
-  if (verificationSections.length > 0) {
-    const verificationContent = contentAfter(
-      output,
-      sections,
-      verificationSections[0]
+  let expectedCommit;
+  try {
+    const expectedResult = await execCapture(
+      "git",
+      ["rev-parse", expectedRef],
+      {
+        cwd: paths.baselineWorktreePath,
+        label: `git rev-parse ${expectedRef}`
+      }
     );
-    verification = parseVerificationTable(verificationContent);
+    expectedCommit = expectedResult.stdout.trim() || void 0;
+  } catch {
+    return {
+      exists: true,
+      baselineWorktreePath: paths.baselineWorktreePath,
+      currentCommit,
+      expectedRef,
+      fresh: false
+    };
   }
   return {
-    status: statusRaw,
-    summary,
-    files: parseFileList(filesContent),
-    verification,
-    raw: output
+    exists: true,
+    baselineWorktreePath: paths.baselineWorktreePath,
+    currentCommit,
+    expectedRef,
+    fresh: currentCommit === expectedCommit
   };
 }
+async function refreshSerenaBaseline(options) {
+  const remoteName = options.remoteName ?? "origin";
+  const paths = await ensureBaselineWorktree(options);
+  await execCapture("git", ["fetch", remoteName, options.baseBranch], {
+    cwd: paths.baselineWorktreePath,
+    label: "git fetch baseline branch"
+  });
+  await execCapture(
+    "git",
+    ["checkout", "--detach", `${remoteName}/${options.baseBranch}`],
+    {
+      cwd: paths.baselineWorktreePath,
+      label: "git checkout detached baseline branch"
+    }
+  );
+  return getSerenaBaselineStatus(options);
+}
 
-// commands/conflict-resolution.ts
-function loadConflictResolutionPrompt(repoRoot2, promptTemplate, artifactPath) {
-  const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync2(promptPath) ? readFileSync2(promptPath, "utf-8") : promptTemplate;
-  return `${promptBody}
-
-## Shared Run Context
+// serena/container.ts
+init_common();
+import { mkdir as mkdir3 } from "fs/promises";
+import path4 from "path";
+var DEFAULT_CONTAINER_NAME = "pourkit-serena-sidecar";
+var MCP_CONTAINER_PORT = 9121;
+var DASHBOARD_CONTAINER_PORT = 24282;
+var SERENA_DATA_MOUNT = "/workspaces/serena-data";
+function resolveSidecarUrls(options) {
+  return {
+    containerName: options.containerName ?? DEFAULT_CONTAINER_NAME,
+    mcpUrl: options.mcpUrl ?? `http://localhost:${options.mcpPort}/mcp`,
+    dashboardUrl: `http://localhost:${options.dashboardPort}`
+  };
+}
+async function inspectSidecarContainer(containerName) {
+  try {
+    const result = await execCapture("docker", ["inspect", containerName]);
+    const parsed = JSON.parse(result.stdout);
+    return {
+      exists: true,
+      running: Boolean(parsed[0]?.State?.Running)
+    };
+  } catch {
+    return {
+      exists: false,
+      running: false
+    };
+  }
+}
+async function readSidecarStatus(options) {
+  const { containerName, mcpUrl, dashboardUrl } = resolveSidecarUrls(options);
+  const container = await inspectSidecarContainer(containerName);
+  return {
+    running: container.running,
+    mcpUrl,
+    dashboardUrl,
+    containerName
+  };
+}
+function buildStartArgs(options, containerName) {
+  return [
+    "run",
+    "-d",
+    "--name",
+    containerName,
+    "--restart",
+    "unless-stopped",
+    "-p",
+    `${options.mcpPort}:${MCP_CONTAINER_PORT}`,
+    "-p",
+    `${options.dashboardPort}:${DASHBOARD_CONTAINER_PORT}`,
+    "-v",
+    `${options.baselineWorktreePath}:/workspaces/pourkit`,
+    "-v",
+    `${options.dataDir}:${SERENA_DATA_MOUNT}`,
+    "-e",
+    `SERENA_HOME=${SERENA_DATA_MOUNT}/config`,
+    options.image,
+    "serena",
+    "start-mcp-server",
+    "--transport",
+    "streamable-http",
+    "--port",
+    String(MCP_CONTAINER_PORT),
+    "--host",
+    "0.0.0.0"
+  ];
+}
+async function getSerenaSidecarStatus(options) {
+  return readSidecarStatus(options);
+}
+async function startSerenaSidecar(options) {
+  const { containerName } = resolveSidecarUrls(options);
+  const container = await inspectSidecarContainer(containerName);
+  if (container.exists) {
+    if (!container.running) {
+      await execCapture("docker", ["start", containerName]);
+    }
+    return readSidecarStatus(options);
+  }
+  await execCapture("docker", buildStartArgs(options, containerName));
+  return readSidecarStatus(options);
+}
+async function indexSerenaProject(options) {
+  const { containerName } = resolveSidecarUrls(options);
+  await execCapture("docker", [
+    "exec",
+    containerName,
+    "serena",
+    "project",
+    "create",
+    "--language",
+    "typescript",
+    "--index",
+    "/workspaces/pourkit"
+  ]);
+}
+async function stopSerenaSidecar(options) {
+  const { containerName } = resolveSidecarUrls(options);
+  try {
+    await execCapture("docker", ["stop", containerName]);
+  } catch {
+  }
+  return readSidecarStatus(options);
+}
+async function prepareSerenaSidecarConfig(options) {
+  const configDir = path4.join(options.dataDir, "config");
+  await mkdir3(configDir, { recursive: true });
+}
 
-Read the selected issue requirements, comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
+// serena/preflight.ts
+var SERENA_MCP_PORT = 9121;
+var SERENA_DASHBOARD_PORT = 24282;
+var SERENA_IMAGE = "ghcr.io/oraios/serena:latest";
+function sidecarOptions(paths, mcpUrl) {
+  return {
+    baselineWorktreePath: paths.baselineWorktreePath,
+    dataDir: paths.dataDir,
+    mcpPort: SERENA_MCP_PORT,
+    dashboardPort: SERENA_DASHBOARD_PORT,
+    image: SERENA_IMAGE,
+    mcpUrl
+  };
+}
+async function canReachMcp(url) {
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    try {
+      await fetch(url, { method: "GET", signal: AbortSignal.timeout(500) });
+      return true;
+    } catch {
+      if (attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 100));
+      }
+    }
+  }
+  return false;
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function prepareSerenaForTarget(options) {
+  if (!options.enabled) {
+    return { enabled: false };
+  }
+  try {
+    const paths = await ensureBaselineWorktree({
+      repoRoot: options.repoRoot,
+      dataDir: options.dataDir
+    });
+    await prepareSerenaSidecarConfig({
+      baselineWorktreePath: paths.baselineWorktreePath,
+      dataDir: paths.dataDir
+    });
+    const status = options.autoStart ? await startSerenaSidecar(sidecarOptions(paths, options.mcpUrl)) : await getSerenaSidecarStatus(sidecarOptions(paths, options.mcpUrl));
+    const mcpReachable = await canReachMcp(options.mcpUrl);
+    if (!mcpReachable) {
+      return {
+        enabled: true,
+        available: false,
+        error: status.running ? `Serena MCP is not reachable at ${options.mcpUrl}` : `Serena sidecar is not running for target ${options.targetName}`
+      };
+    }
+    await refreshSerenaBaseline({
+      repoRoot: options.repoRoot,
+      dataDir: options.dataDir,
+      baseBranch: options.baseBranch
+    });
+    return {
+      enabled: true,
+      available: true,
+      mcpUrl: options.mcpUrl
+    };
+  } catch (error) {
+    return {
+      enabled: true,
+      available: false,
+      error: formatError(error)
+    };
+  }
+}
 
-## Output
+// failure-resolution/failure-resolution-agent.ts
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
+import { join as join6 } from "path";
 
-Write your resolution to: ${artifactPath}
+// failure-resolution/recovery-policy.ts
+function isSecuritySensitiveFailure(failure) {
+  return failure instanceof PublishedHistoryRisk;
+}
+async function evaluateRecoveryPolicy(params) {
+  if (isSecuritySensitiveFailure(params.failure)) {
+    return {
+      decision: "HANDOFF_TO_HUMAN",
+      reason: "Security-sensitive failure \u2014 AI recovery bypassed"
+    };
+  }
+  const budget = recoveryBudgetForFailure(
+    params.worktreePath,
+    params.fingerprint,
+    params.maxAttempts
+  );
+  if (budget.exhausted) {
+    return {
+      decision: "HANDOFF_TO_HUMAN",
+      reason: `Recovery budget exhausted (${budget.used}/${params.maxAttempts})`
+    };
+  }
+  if (!params.allowedDecisions.includes(params.agentRecommendedDecision)) {
+    return {
+      decision: "HANDOFF_TO_HUMAN",
+      reason: `Agent recommended ${params.agentRecommendedDecision} which is not allowed`
+    };
+  }
+  if (params.agentRecommendedDecision === "FAIL_RUN") {
+    return { decision: "FAIL_RUN", reason: "Agent recommended FAIL_RUN" };
+  }
+  return {
+    decision: params.agentRecommendedDecision,
+    reason: "Agent recommendation accepted"
+  };
+}
 
-Do not provide a separate chat response. The runner only reads the file above.`;
+// failure-resolution/failure-resolution-agent.ts
+function constructFailureResolutionPacket(failure, context) {
+  return {
+    failureType: "RebaseConflict",
+    stageName: context.stageName,
+    attemptNumber: context.attemptNumber,
+    worktreePath: context.worktreePath,
+    branchName: context.branchName,
+    baseBranch: context.baseBranch,
+    conflictedPaths: failure.conflictedPaths,
+    failureSummary: failure.message,
+    maxAttempts: context.maxAttempts,
+    allowedDecisions: context.allowedDecisions,
+    artifactTarget: context.artifactTarget
+  };
 }
-async function runConflictResolutionOnce(options) {
+async function runFailureResolutionAgent(options) {
   const {
     executionProvider,
     config,
     target,
-    issue,
-    branchName,
+    failure,
+    packet,
     worktreePath,
     repoRoot: repoRoot2,
-    conflictedPaths,
-    attempt,
     logger
   } = options;
-  const strategyCr = target.strategy.conflictResolution;
-  if (!strategyCr) {
-    return { status: "failed", message: "No conflictResolution configured" };
-  }
-  const artifactPath = `.pourkit/.tmp/conflict-resolution/attempt-${attempt}.md`;
-  const prompt = loadConflictResolutionPrompt(
-    repoRoot2,
-    strategyCr.promptTemplate,
-    artifactPath
+  const frConfig = target.strategy.failureResolution;
+  const artifactPath = packet.artifactTarget;
+  const fullArtifactPath = join6(worktreePath, artifactPath);
+  const fingerprint = computeFailureFingerprint(
+    "baseRefresh",
+    "RebaseConflict"
   );
-  const runContextArtifact = buildRunContextArtifact({
-    issue,
-    target,
-    branchName,
-    sections: STAGE_SECTIONS.conflictResolution
-  });
+  const prompt = [
+    `# Failure Resolution: ${packet.failureType}`,
+    "",
+    "## Failure Context",
+    "",
+    "```json",
+    JSON.stringify(packet, null, 2),
+    "```",
+    "",
+    "## Instructions",
+    "",
+    `Write your resolution to: ${artifactPath}`,
+    "Include a ```json block with: recoveryDecision, summary, changedFiles, verificationSummary (optional), verificationCommands (optional), notes (optional).",
+    "",
+    "Allowed decisions: " + packet.allowedDecisions.join(", ")
+  ].join("\n");
   const executionResult = await executionProvider.execute({
-    stage: "conflictResolution",
-    agent: strategyCr.agent,
-    model: strategyCr.model,
+    stage: "failureResolution",
+    agent: frConfig.agent,
+    model: frConfig.model,
     prompt,
     target,
     repoRoot: repoRoot2,
-    branchName,
+    branchName: packet.branchName,
     sandbox: config.sandbox,
     autoApprove: true,
     worktreePath,
     artifactPath,
-    artifacts: [runContextArtifact],
+    artifacts: [],
     logger
   });
   if (!executionResult.success) {
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      `Agent execution failed: ${executionResult.error}`,
+      void 0,
+      "HANDOFF_TO_HUMAN"
+    );
     return {
-      status: "failed",
-      message: executionResult.error ?? "Conflict resolution agent execution failed"
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason: `Agent execution failed: ${executionResult.error}`
     };
   }
-  const fullArtifactPath = join4(worktreePath, artifactPath);
-  if (!existsSync2(fullArtifactPath)) {
+  if (!existsSync4(fullArtifactPath)) {
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      "Agent did not write artifact",
+      void 0,
+      "HANDOFF_TO_HUMAN"
+    );
     return {
-      status: "failed",
-      artifactPath,
-      message: "Conflict resolution agent completed but did not write artifact"
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason: "Agent did not write artifact"
     };
   }
-  let artifactContent;
+  let artifact;
   try {
-    artifactContent = readFileSync2(fullArtifactPath, "utf-8");
+    const md = readFileSync4(fullArtifactPath, "utf-8");
+    artifact = parseRecoveryArtifact(md, artifactPath);
   } catch (error) {
+    const reason = error instanceof Error ? error.message : "Failed to parse artifact";
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      reason,
+      void 0,
+      "HANDOFF_TO_HUMAN"
+    );
+    return { status: "handoff", decision: "HANDOFF_TO_HUMAN", reason };
+  }
+  const validation = validateRecoveryDecision(
+    artifact,
+    packet.allowedDecisions
+  );
+  if (!validation.valid) {
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      validation.reason,
+      void 0,
+      "HANDOFF_TO_HUMAN"
+    );
     return {
-      status: "failed",
-      artifactPath,
-      message: `Failed to read conflict resolution artifact: ${error instanceof Error ? error.message : String(error)}`
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason: validation.reason
     };
   }
-  let parsed;
-  try {
-    parsed = parseConflictResolutionArtifact(artifactContent);
-  } catch (error) {
-    if (error instanceof ConflictResolutionArtifactProtocolError) {
-      return {
-        status: "failed",
-        artifactPath,
-        message: `Invalid conflict resolution artifact: ${error.message}`
-      };
-    }
-    throw error;
+  const policyResult = await evaluateRecoveryPolicy({
+    failure,
+    worktreePath,
+    fingerprint,
+    maxAttempts: packet.maxAttempts,
+    agentRecommendedDecision: validation.decision,
+    allowedDecisions: packet.allowedDecisions
+  });
+  await writeRecoveryAttempt(
+    worktreePath,
+    policyResult.decision === "HANDOFF_TO_HUMAN" ? "handoff" : policyResult.decision === "FAIL_RUN" ? "failure" : "success",
+    fingerprint,
+    policyResult.reason,
+    artifactPath,
+    policyResult.decision
+  );
+  if (policyResult.decision === "HANDOFF_TO_HUMAN") {
+    return {
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason: policyResult.reason
+    };
   }
-  if (parsed.status === "ambiguous") {
+  if (policyResult.decision === "FAIL_RUN") {
     return {
-      status: "ambiguous",
-      artifactPath,
-      message: parsed.summary
+      status: "fail-run",
+      decision: "FAIL_RUN",
+      reason: policyResult.reason
     };
   }
   return {
-    status: "resolved",
-    artifactPath,
-    files: parsed.files
+    status: "recovered",
+    decision: policyResult.decision,
+    artifact
   };
 }
-var CONFLICT_MARKER_PATTERN = /<<<<<<<|=======|>>>>>>>/m;
-async function hasUnresolvedConflictMarkers(worktreePath, files) {
-  for (const file of files) {
-    const filePath = join4(worktreePath, file);
-    try {
-      const content = readFileSync2(filePath, "utf-8");
-      if (CONFLICT_MARKER_PATTERN.test(content)) {
-        return true;
-      }
-    } catch {
-    }
-  }
-  return false;
-}
-async function runConflictResolutionLoop(options) {
-  const { worktreePath, maxAttempts, logger, initialConflictedPaths } = options;
-  let attempt = 0;
-  let conflictedPaths = initialConflictedPaths;
-  while (attempt < maxAttempts && conflictedPaths.length > 0) {
-    attempt++;
-    const crResult = await runConflictResolutionOnce({
-      ...options,
-      conflictedPaths,
-      attempt
-    });
-    if (crResult.status !== "resolved") {
-      const message = crResult.status === "ambiguous" ? crResult.message : crResult.message ?? "Conflict resolution agent execution failed";
-      return { status: crResult.status, attempts: attempt, message };
-    }
-    const markersRemain = await hasUnresolvedConflictMarkers(
-      worktreePath,
-      conflictedPaths
-    );
-    if (markersRemain) {
-      return {
-        status: "ambiguous",
-        attempts: attempt,
-        message: "Conflict resolution agent resolved artifact but conflict markers remain in files"
-      };
-    }
-    await execCapture("git", ["add", ...conflictedPaths], {
-      cwd: worktreePath,
-      logger,
-      label: "git add conflicted paths"
-    });
-    try {
-      await execCapture("git", ["rebase", "--continue"], {
-        cwd: worktreePath,
-        logger,
-        label: "git rebase --continue"
-      });
-      conflictedPaths = [];
-    } catch (error) {
-      const statusResult = await execCapture("git", ["status", "--porcelain"], {
-        cwd: worktreePath,
-        logger,
-        label: "git status"
-      });
-      conflictedPaths = statusResult.stdout.split("\n").filter((line) => /^(AA|DD|UU|AU|UA|DU|UD)\s/.test(line)).map((line) => line.slice(3).trim()).filter(Boolean);
-      if (conflictedPaths.length === 0) {
-        const rebaseErrorMessage = error instanceof Error ? error.message : String(error);
-        return {
-          status: "failed",
-          attempts: attempt,
-          message: `git rebase --continue failed with no remaining conflicts: ${rebaseErrorMessage}`
-        };
-      }
-    }
-  }
-  if (conflictedPaths.length > 0) {
-    return {
-      status: "exhausted",
-      attempts: attempt,
-      message: `Conflict resolution maxAttempts (${maxAttempts}) exhausted with remaining conflicts`
-    };
-  }
-  return { status: "completed", attempts: attempt };
+async function writeRecoveryAttempt(worktreePath, outcome, fingerprint, summary, artifactRef, decision) {
+  writeAttemptLog(worktreePath, {
+    attemptType: "recovery",
+    fingerprint,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    stage: "baseRefresh",
+    outcome,
+    artifactRef,
+    decision: decision ?? (outcome === "handoff" ? "HANDOFF_TO_HUMAN" : outcome === "success" ? "RETRY_STAGE" : void 0)
+  });
 }
 
 // commands/pr-description-agent.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, join as join6 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join8 } from "path";
 
 // pr/pr-description.ts
 var CONVENTIONAL_TITLE_PATTERN = /^(feat|fix|perf|refactor|docs|test|chore|ci|build)(\([^)]+\))?!?:\s+\S/;
@@ -1571,11 +2100,11 @@ var PrDescriptionProtocolError = class extends Error {
     this.name = "PrDescriptionProtocolError";
   }
 };
-var SECTION_HEADING_PATTERN2 = /^## (PR Title|PR Body)\s*$/gm;
-function extractSections2(output) {
+var SECTION_HEADING_PATTERN = /^## (PR Title|PR Body)\s*$/gm;
+function extractSections(output) {
   const sections = [];
   let match;
-  const re = new RegExp(SECTION_HEADING_PATTERN2);
+  const re = new RegExp(SECTION_HEADING_PATTERN);
   while ((match = re.exec(output)) !== null) {
     const heading = match[1];
     sections.push({
@@ -1586,7 +2115,7 @@ function extractSections2(output) {
   }
   return sections;
 }
-function contentAfter2(output, sections, section) {
+function contentAfter(output, sections, section) {
   const index = sections.indexOf(section);
   const nextSection = sections[index + 1];
   const start = section.endIndex;
@@ -1594,7 +2123,7 @@ function contentAfter2(output, sections, section) {
   return output.slice(start, end).trim();
 }
 function parsePrDescription(output) {
-  const sections = extractSections2(output);
+  const sections = extractSections(output);
   const titleSections = sections.filter((s) => s.heading === "PR Title");
   const bodySections = sections.filter((s) => s.heading === "PR Body");
   if (titleSections.length === 0) {
@@ -1617,8 +2146,8 @@ function parsePrDescription(output) {
       `Duplicate "## PR Body" sections found (${bodySections.length})`
     );
   }
-  const title = contentAfter2(output, sections, titleSections[0]);
-  const body = contentAfter2(output, sections, bodySections[0]);
+  const title = contentAfter(output, sections, titleSections[0]);
+  const body = contentAfter(output, sections, bodySections[0]);
   if (title.length === 0) {
     throw new PrDescriptionProtocolError('"## PR Title" section is empty');
   }
@@ -1649,7 +2178,7 @@ function inferConventionalType(commitSummaries) {
 
 // pr/pr-description-context.ts
 init_common();
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 import { readFile } from "fs/promises";
 async function collectFinalizerContext(options) {
   const { targetBase, branchName, worktreePath, reviewArtifactPath, logger } = options;
@@ -1710,7 +2239,7 @@ async function readReviewArtifact(artifactPath) {
   return content;
 }
 function buildFinalizerPrompt(context, promptTemplate) {
-  const artifactPathInWorktree = join5(
+  const artifactPathInWorktree = join7(
     ".pourkit",
     ".tmp",
     "finalizer",
@@ -1788,13 +2317,13 @@ async function runFinalizerAgent(options) {
     finalizer.promptTemplate
   );
   const prompt = buildFinalizerPrompt(context, resolvedPrompt);
-  const artifactPathInWorktree = join6(
+  const artifactPathInWorktree = join8(
     ".pourkit",
     ".tmp",
     "finalizer",
     "agent-output.md"
   );
-  const artifactPath = join6(worktreePath, artifactPathInWorktree);
+  const artifactPath = join8(worktreePath, artifactPathInWorktree);
   prepareArtifactPath(artifactPath);
   let output = "";
   let parsed;
@@ -1859,24 +2388,24 @@ async function runFinalizerAgent(options) {
 }
 function loadFinalizerPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  if (existsSync3(promptPath)) {
-    return readFileSync3(promptPath, "utf-8");
+  if (existsSync5(promptPath)) {
+    return readFileSync5(promptPath, "utf-8");
   }
   return promptTemplate;
 }
 function prepareArtifactPath(artifactPath) {
-  mkdirSync3(dirname2(artifactPath), { recursive: true });
-  if (existsSync3(artifactPath)) {
+  mkdirSync4(dirname3(artifactPath), { recursive: true });
+  if (existsSync5(artifactPath)) {
     rmSync(artifactPath);
   }
 }
 function readAgentOutput(artifactPath) {
-  if (!existsSync3(artifactPath)) {
+  if (!existsSync5(artifactPath)) {
     throw new Error(
       `Finalizer agent did not produce output at ${artifactPath}`
     );
   }
-  const output = readFileSync3(artifactPath, "utf-8");
+  const output = readFileSync5(artifactPath, "utf-8");
   if (!output.trim()) {
     throw new Error(`Finalizer agent produced empty output at ${artifactPath}`);
   }
@@ -1884,9 +2413,9 @@ function readAgentOutput(artifactPath) {
 }
 async function persistGeneratedArtifact(worktreePath, output) {
   try {
-    const dir = join6(worktreePath, ".pourkit", ".tmp", "finalizer");
-    mkdirSync3(dir, { recursive: true });
-    writeFileSync2(join6(dir, "generated.md"), output, "utf-8");
+    const dir = join8(worktreePath, ".pourkit", ".tmp", "finalizer");
+    mkdirSync4(dir, { recursive: true });
+    writeFileSync2(join8(dir, "generated.md"), output, "utf-8");
   } catch {
   }
 }
@@ -2124,14 +2653,14 @@ async function runMergeCoordinator(options) {
 
 // commands/review.ts
 import {
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync4,
+  existsSync as existsSync6,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync6,
   readdirSync,
   rmSync as rmSync2,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname3, join as join7 } from "path";
+import { dirname as dirname4, join as join9 } from "path";
 
 // pr/review-verdict.ts
 var ReviewVerdictProtocolError = class extends Error {
@@ -2213,12 +2742,12 @@ function extractLatestFindingIds(reviewOutput, iteration) {
   return ids;
 }
 function validateRefactorArtifact(artifactPath, findingIds) {
-  if (!existsSync4(artifactPath)) {
+  if (!existsSync6(artifactPath)) {
     throw new RefactorArtifactValidationError(
       `Refactor artifact missing at ${artifactPath}`
     );
   }
-  const content = readFileSync4(artifactPath, "utf-8");
+  const content = readFileSync6(artifactPath, "utf-8");
   if (!content.trim()) {
     throw new RefactorArtifactValidationError("Refactor artifact is empty");
   }
@@ -2363,13 +2892,13 @@ async function runReviewCommand(options) {
   if (!reviewer) {
     throw new Error("No reviewer config found");
   }
-  const artifactPathInWorktree = join7(
+  const artifactPathInWorktree = join9(
     ".pourkit",
     ".tmp",
     "reviewers",
     `iteration-${iteration ?? 1}.md`
   );
-  const artifactPath = join7(worktreePath, artifactPathInWorktree);
+  const artifactPath = join9(worktreePath, artifactPathInWorktree);
   prepareReviewArtifactPath(artifactPath);
   const prompt = buildReviewerPrompt(
     repoRoot2,
@@ -2476,8 +3005,8 @@ ${entry.trimEnd()}`).join("\n\n")}
 `;
 }
 function renderPriorRefactorArtifacts(worktreePath, currentIteration) {
-  const refactorsDir = join7(worktreePath, ".pourkit", ".tmp", "refactors");
-  if (!existsSync4(refactorsDir)) {
+  const refactorsDir = join9(worktreePath, ".pourkit", ".tmp", "refactors");
+  if (!existsSync6(refactorsDir)) {
     return "";
   }
   const files = readdirSync(refactorsDir);
@@ -2487,9 +3016,9 @@ function renderPriorRefactorArtifacts(worktreePath, currentIteration) {
     if (match) {
       const num = parseInt(match[1], 10);
       if (num < currentIteration) {
-        const filePath = join7(refactorsDir, file);
+        const filePath = join9(refactorsDir, file);
         try {
-          const content = readFileSync4(filePath, "utf-8");
+          const content = readFileSync6(filePath, "utf-8");
           if (content.trim()) {
             iterationFiles.push({ num, content });
           }
@@ -2514,8 +3043,8 @@ ${iterationsBlocks}
 `;
 }
 function renderPriorReviewerArtifacts(worktreePath, currentIteration) {
-  const reviewersDir = join7(worktreePath, ".pourkit", ".tmp", "reviewers");
-  if (!existsSync4(reviewersDir)) {
+  const reviewersDir = join9(worktreePath, ".pourkit", ".tmp", "reviewers");
+  if (!existsSync6(reviewersDir)) {
     return "";
   }
   const files = readdirSync(reviewersDir);
@@ -2525,9 +3054,9 @@ function renderPriorReviewerArtifacts(worktreePath, currentIteration) {
     if (match) {
       const num = parseInt(match[1], 10);
       if (num < currentIteration) {
-        const filePath = join7(reviewersDir, file);
+        const filePath = join9(reviewersDir, file);
         try {
-          const content = readFileSync4(filePath, "utf-8");
+          const content = readFileSync6(filePath, "utf-8");
           if (content.trim()) {
             iterationFiles.push({ num, content });
           }
@@ -2556,7 +3085,7 @@ function loadReviewerPromptTemplate(repoRoot2, promptTemplate, criteriaBlock) {
     repoRoot2,
     promptTemplate
   );
-  const promptBody = existsSync4(promptTemplatePath) ? readFileSync4(promptTemplatePath, "utf-8") : promptTemplate;
+  const promptBody = existsSync6(promptTemplatePath) ? readFileSync6(promptTemplatePath, "utf-8") : promptTemplate;
   const hasCriteriaPlaceholder = promptBody.includes("{{REVIEW_CRITERIA}}");
   return {
     content: promptBody.replace(/\{\{REVIEW_CRITERIA\}\}/g, criteriaBlock),
@@ -2565,29 +3094,29 @@ function loadReviewerPromptTemplate(repoRoot2, promptTemplate, criteriaBlock) {
 }
 function renderReviewCriteria(repoRoot2, criteria) {
   return criteria.map((criterion) => {
-    const snippetPath = join7(
+    const snippetPath = join9(
       repoRoot2,
       ".pourkit",
       "prompts",
       `reviewer-${criterion}.snippet.md`
     );
-    if (existsSync4(snippetPath)) {
-      return readFileSync4(snippetPath, "utf-8").trimEnd();
+    if (existsSync6(snippetPath)) {
+      return readFileSync6(snippetPath, "utf-8").trimEnd();
     }
     return `- ${criterion}`;
   }).join("\n\n");
 }
 function prepareReviewArtifactPath(artifactPath) {
-  mkdirSync4(dirname3(artifactPath), { recursive: true });
-  if (existsSync4(artifactPath)) {
+  mkdirSync5(dirname4(artifactPath), { recursive: true });
+  if (existsSync6(artifactPath)) {
     rmSync2(artifactPath);
   }
 }
 function recoverReviewOutputFromLog(logPath) {
-  if (!existsSync4(logPath)) {
+  if (!existsSync6(logPath)) {
     return null;
   }
-  const logContent = readFileSync4(logPath, "utf-8");
+  const logContent = readFileSync6(logPath, "utf-8");
   const startIndex = logContent.indexOf("## Findings");
   if (startIndex === -1) {
     return null;
@@ -2602,8 +3131,8 @@ function recoverReviewOutputFromLog(logPath) {
   return recoveredOutput.length > 0 ? recoveredOutput : null;
 }
 function readReviewArtifact2(artifactPath, logPath) {
-  if (existsSync4(artifactPath)) {
-    const output = readFileSync4(artifactPath, "utf-8");
+  if (existsSync6(artifactPath)) {
+    const output = readFileSync6(artifactPath, "utf-8");
     if (output.trim()) {
       return output;
     }
@@ -2613,7 +3142,7 @@ function readReviewArtifact2(artifactPath, logPath) {
     writeFileSync3(artifactPath, recoveredOutput, "utf-8");
     return recoveredOutput;
   }
-  if (!existsSync4(artifactPath)) {
+  if (!existsSync6(artifactPath)) {
     throw new Error(`Reviewer did not produce output at ${artifactPath}`);
   }
   throw new Error(`Reviewer produced empty output at ${artifactPath}`);
@@ -2629,7 +3158,8 @@ async function runReviewWithRefactorLoop(options) {
     repoRoot: repoRoot2,
     logger,
     startingLifetimeIteration = 0,
-    humanHandoffResolved
+    humanHandoffResolved,
+    serena
   } = options;
   const strategy = target.strategy;
   const reviewer = strategy.review.reviewer;
@@ -2644,7 +3174,7 @@ async function runReviewWithRefactorLoop(options) {
   const passWithNotesRefactorAttempts = strategy.review.passWithNotesRefactorAttempts;
   let resolvedStartingIteration = startingLifetimeIteration;
   {
-    const reviewersDir = join7(worktreePath, ".pourkit", ".tmp", "reviewers");
+    const reviewersDir = join9(worktreePath, ".pourkit", ".tmp", "reviewers");
     try {
       const files = readdirSync(reviewersDir);
       let maxExistingIteration = 0;
@@ -2752,7 +3282,7 @@ async function runReviewWithRefactorLoop(options) {
     }
     if (reviewResult.verdict === "NEEDS_REFACTOR" || reviewResult.verdict === "PASS_WITH_NOTES" || reviewResult.verdict === "FAIL") {
       logger.step("info", "Running refactor agent");
-      const refactorArtifactPathInWorktree = join7(
+      const refactorArtifactPathInWorktree = join9(
         ".pourkit",
         ".tmp",
         "refactors",
@@ -2786,6 +3316,7 @@ async function runReviewWithRefactorLoop(options) {
             sections: STAGE_SECTIONS.refactor
           })
         ],
+        ...serena ? { serena } : {},
         logger
       });
       if (!refactorResult.success) {
@@ -2808,7 +3339,7 @@ async function runReviewWithRefactorLoop(options) {
         reviewResult.output,
         lifetimeIteration
       );
-      const refactorArtifactPath = join7(
+      const refactorArtifactPath = join9(
         worktreePath,
         refactorArtifactPathInWorktree
       );
@@ -2858,9 +3389,9 @@ async function runReviewWithRefactorLoop(options) {
 }
 async function writeArtifact(worktreePath, filename, output) {
   try {
-    const dir = join7(worktreePath, ".pourkit", ".tmp", "reviewers");
-    mkdirSync4(dir, { recursive: true });
-    writeFileSync3(join7(dir, filename), output, "utf-8");
+    const dir = join9(worktreePath, ".pourkit", ".tmp", "reviewers");
+    mkdirSync5(dir, { recursive: true });
+    writeFileSync3(join9(dir, filename), output, "utf-8");
   } catch {
   }
 }
@@ -2872,7 +3403,7 @@ function buildRefactorPrompt(repoRoot2, promptTemplate, latestReview, artifactPa
     repoRoot2,
     promptTemplate
   );
-  const promptBody = existsSync4(promptTemplatePath) ? readFileSync4(promptTemplatePath, "utf-8") : promptTemplate;
+  const promptBody = existsSync6(promptTemplatePath) ? readFileSync6(promptTemplatePath, "utf-8") : promptTemplate;
   return appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
@@ -3050,6 +3581,16 @@ function checkIssueGates(issue, config, force) {
   }
   return { allowed: true, gates };
 }
+function resolveSerenaRuntimeConfig(config, target) {
+  return {
+    enabled: target.serena?.enabled ?? config.serena.enabled,
+    required: target.serena?.required ?? config.serena.required,
+    autoStart: config.serena.autoStart,
+    dataDir: config.serena.dataDir,
+    mcpUrl: config.serena.mcpUrl,
+    sandboxMcpUrl: config.serena.sandboxMcpUrl
+  };
+}
 async function startIssueRun(options) {
   const {
     issueNumber,
@@ -3070,6 +3611,35 @@ async function startIssueRun(options) {
   const target = resolveTarget(config, targetName);
   const branchName = renderBranchName(target.branchTemplate, issue);
   const strategy = target.strategy;
+  const serenaRuntimeConfig = resolveSerenaRuntimeConfig(config, target);
+  const shouldPrepareSerena = serenaRuntimeConfig.enabled || serenaRuntimeConfig.required;
+  let serenaExecutionContext;
+  if (shouldPrepareSerena) {
+    const serenaPreflight = await prepareSerenaForTarget({
+      repoRoot: ROOT,
+      targetName: target.name,
+      baseBranch: target.baseBranch,
+      dataDir: serenaRuntimeConfig.dataDir,
+      mcpUrl: serenaRuntimeConfig.mcpUrl,
+      enabled: shouldPrepareSerena,
+      required: serenaRuntimeConfig.required,
+      autoStart: serenaRuntimeConfig.autoStart,
+      logger
+    });
+    if (serenaPreflight.enabled && serenaPreflight.available) {
+      serenaExecutionContext = {
+        available: true,
+        sandboxMcpUrl: serenaRuntimeConfig.sandboxMcpUrl
+      };
+    }
+    if (serenaPreflight.enabled && !serenaPreflight.available) {
+      const message = `Serena preflight unavailable for target ${target.name}: ${serenaPreflight.error}`;
+      if (serenaRuntimeConfig.required) {
+        throw new Error(message);
+      }
+      logger.step("warn", message);
+    }
+  }
   if (options.resetWorktree) {
     const existingPr = await prProvider.getPr(branchName);
     if (existingPr && existingPr.state === "OPEN") {
@@ -3093,7 +3663,7 @@ async function startIssueRun(options) {
   const worktreeState = resolution.worktreePath ? readWorktreeRunState(resolution.worktreePath) : null;
   if (resolution.mode !== "new") {
     const existingPr = await prProvider.getPr(branchName);
-    const refreshResult = await refreshStaleIssueBranch({
+    const exit = await runBaseRefreshAttempt({
       worktreePath: resolution.worktreePath,
       baseBranch: target.baseBranch,
       localGitBaseRef: resolution.baseRef,
@@ -3101,113 +3671,85 @@ async function startIssueRun(options) {
       prNumber: existingPr?.number,
       prState: existingPr?.state
     });
-    if (refreshResult.status === "refreshed") {
-      if (worktreeState?.completedStages.builder) {
-        const invalidatedState = invalidateAfterBaseRefresh(worktreeState);
-        writeWorktreeRunState(resolution.worktreePath, invalidatedState);
-      }
-    } else if (refreshResult.status === "conflicted") {
-      if (strategy.conflictResolution && resolution.worktreePath) {
-        const crLoopResult = await runConflictResolutionLoop({
-          executionProvider,
-          config,
-          target,
-          issue,
-          branchName,
-          worktreePath: resolution.worktreePath,
-          repoRoot: ROOT,
-          initialConflictedPaths: refreshResult.conflictedPaths,
-          maxAttempts: strategy.conflictResolution.maxAttempts,
-          logger
-        });
-        if (crLoopResult.status === "completed") {
-          if (strategy.verify?.commands) {
-            for (const cmd of strategy.verify.commands) {
-              await execCapture("bash", ["-lc", cmd.command], {
-                cwd: resolution.worktreePath,
-                logger,
-                label: `verify ${cmd.label}`
-              });
-            }
-          }
-          if (worktreeState?.completedStages.builder) {
-            const invalidatedState = invalidateAfterBaseRefresh(worktreeState);
-            writeWorktreeRunState(resolution.worktreePath, invalidatedState);
-          }
-        } else {
-          const failureMessage = crLoopResult.status === "ambiguous" ? `Conflict resolution ambiguous: ${crLoopResult.message}` : crLoopResult.status === "exhausted" ? `Conflict resolution maxAttempts (${strategy.conflictResolution.maxAttempts}) exhausted: ${crLoopResult.message}` : `Conflict resolution failed: ${crLoopResult.message}`;
-          const failureStage = "conflictResolution";
-          if (worktreeState) {
-            updateWorktreeRunState(resolution.worktreePath, {
-              lastFailure: {
-                stage: failureStage,
-                message: failureMessage
-              }
+    if (Exit2.isSuccess(exit)) {
+      const refreshResult = exit.value;
+      if (refreshResult.status === "refreshed") {
+        if (worktreeState?.completedStages.builder) {
+          const invalidatedState = invalidateAfterBaseRefresh(worktreeState);
+          writeWorktreeRunState(resolution.worktreePath, invalidatedState);
+        }
+      }
+    } else {
+      const cause = exit.cause;
+      if (cause._tag === "Fail") {
+        const failure = cause.error;
+        if (failure instanceof RebaseConflict) {
+          if (strategy.failureResolution && resolution.worktreePath) {
+            await handleRebaseConflict(failure, {
+              worktreePath: resolution.worktreePath,
+              branchName,
+              target,
+              config,
+              issueNumber,
+              issueProvider,
+              executionProvider,
+              repoRoot: ROOT,
+              worktreeState,
+              logger
             });
           } else {
-            writeWorktreeRunState(resolution.worktreePath, {
-              issueNumber,
-              targetName: target.name,
-              branchName,
-              baseBranch: target.baseBranch,
-              createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-              updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-              completedStages: {},
-              review: { lifetimeIterations: 0 },
-              lastFailure: {
-                stage: failureStage,
-                message: failureMessage
+            if (resolution.worktreePath) {
+              if (worktreeState) {
+                updateWorktreeRunState(resolution.worktreePath, {
+                  lastFailure: {
+                    stage: "baseRefresh",
+                    message: `Base refresh conflict detected. Handing off to human: ${failure.message}`
+                  }
+                });
+              } else {
+                writeWorktreeRunState(resolution.worktreePath, {
+                  issueNumber,
+                  targetName: target.name,
+                  branchName,
+                  baseBranch: target.baseBranch,
+                  createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  completedStages: {},
+                  review: { lifetimeIterations: 0 },
+                  lastFailure: {
+                    stage: "baseRefresh",
+                    message: `Base refresh conflict detected. Handing off to human: ${failure.message}`
+                  }
+                });
               }
-            });
+            }
+            await transitionIssueToFailureState(
+              issueProvider,
+              issueNumber,
+              config,
+              `Base refresh conflicted: ${failure.message}. Worktree preserved at ${resolution.worktreePath}.`,
+              logger
+            );
+            throw new Error(`Base refresh conflicted: ${failure.message}`);
           }
-          await transitionIssueToFailureState(
-            issueProvider,
-            issueNumber,
+        } else if (failure instanceof PublishedHistoryRisk) {
+          await handlePublishedHistoryRisk(failure, {
+            worktreePath: resolution.worktreePath,
+            branchName,
+            target,
             config,
-            failureMessage,
+            issueNumber,
+            issueProvider,
+            worktreeState,
             logger
-          );
-          throw new Error(failureMessage);
+          });
+        } else {
+          throw new Error(`Base refresh failed: ${failure.message}`);
         }
       } else {
-        if (resolution.worktreePath) {
-          if (worktreeState) {
-            updateWorktreeRunState(resolution.worktreePath, {
-              lastFailure: {
-                stage: "baseRefresh",
-                message: `Base refresh conflict detected. Handing off to human: ${refreshResult.message}`
-              }
-            });
-          } else {
-            writeWorktreeRunState(resolution.worktreePath, {
-              issueNumber,
-              targetName: target.name,
-              branchName,
-              baseBranch: target.baseBranch,
-              createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-              updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-              completedStages: {},
-              review: { lifetimeIterations: 0 },
-              lastFailure: {
-                stage: "baseRefresh",
-                message: `Base refresh conflict detected. Handing off to human: ${refreshResult.message}`
-              }
-            });
-          }
-        }
-        await transitionIssueToFailureState(
-          issueProvider,
-          issueNumber,
-          config,
-          `Base refresh conflicted: ${refreshResult.message}. Worktree preserved at ${resolution.worktreePath}.`,
-          logger
-        );
-        throw new Error(`Base refresh conflicted: ${refreshResult.message}`);
+        const defectMessage = cause._tag === "Die" ? `Base refresh failed with unexpected error: ${cause.defect}` : `Base refresh failed with unhandled cause: ${cause._tag}`;
+        throw new Error(defectMessage);
       }
-    } else if (refreshResult.status === "refused-published-history") {
-      throw new Error(
-        `Cannot auto-refresh published history: PR #${refreshResult.prNumber} (${refreshResult.prState}) exists for branch ${branchName}`
-      );
     }
   }
   const runContextArtifact = buildRunContextArtifact({
@@ -3232,6 +3774,7 @@ async function startIssueRun(options) {
       branchName,
       ...resolution.mode === "new" ? { baseRef: resolution.baseRef } : {},
       sandbox: config.sandbox,
+      ...serenaExecutionContext ? { serena: serenaExecutionContext } : {},
       autoApprove: true,
       timeoutMs: EXECUTION_TIMEOUT_MS,
       ...resolution.worktreePath ? { worktreePath: resolution.worktreePath } : {},
@@ -3274,7 +3817,8 @@ async function startIssueRun(options) {
     target,
     branchName,
     worktreeState: finalWorktreeState,
-    executionResult
+    executionResult,
+    ...serenaExecutionContext ? { serena: serenaExecutionContext } : {}
   };
 }
 async function advanceIssueRunReview(options) {
@@ -3353,12 +3897,12 @@ async function completeIssueRun(options) {
         prTitle = finalizerFromState.title;
         prBody = finalizerFromState.body;
       } else if (finalizerFromState.artifactPath) {
-        if (!existsSync5(finalizerFromState.artifactPath)) {
+        if (!existsSync7(finalizerFromState.artifactPath)) {
           throw new Error(
             `Finalizer artifact missing at ${finalizerFromState.artifactPath}`
           );
         }
-        const artifactContent = readFileSync5(
+        const artifactContent = readFileSync7(
           finalizerFromState.artifactPath,
           "utf-8"
         );
@@ -3445,6 +3989,13 @@ async function completeIssueRun(options) {
       if (prFromState && prFromState.state === "OPEN") {
         pr = prFromState;
       } else {
+        await guardFinalPublishContent({
+          worktreePath: executionResult.worktreePath,
+          baseRef: `origin/${target.baseBranch}`,
+          title: prTitle,
+          body: finalBody,
+          logger
+        });
         await execCapture("git", ["push", "-u", "origin", branchName], {
           cwd: executionResult.worktreePath,
           logger,
@@ -3644,12 +4195,106 @@ async function finalizeWorktreeCommit(options) {
     logger,
     label: "git add"
   });
+  await guardFinalCommitContent({
+    worktreePath,
+    title,
+    body,
+    logger
+  });
   await execCapture("git", ["commit", "--no-verify", "-m", title, "-m", body], {
     cwd: worktreePath,
     logger,
     label: "git commit"
   });
 }
+async function guardFinalCommitContent(options) {
+  const { worktreePath, title, body, logger } = options;
+  const stagedDiff = await execCapture("git", ["diff", "--cached"], {
+    cwd: worktreePath,
+    logger,
+    label: "git diff --cached secret guard"
+  });
+  assertNoSecretLikeContent([
+    { source: "staged diff", content: stagedDiff.stdout },
+    { source: "commit title", content: title },
+    { source: "commit body", content: body }
+  ]);
+}
+async function guardFinalPublishContent(options) {
+  const { worktreePath, baseRef, title, body, logger } = options;
+  const finalDiff = await execCapture("git", ["diff", `${baseRef}...HEAD`], {
+    cwd: worktreePath,
+    logger,
+    label: "git diff final secret guard"
+  });
+  assertNoSecretLikeContent([
+    { source: "final diff", content: finalDiff.stdout },
+    { source: "PR title", content: title },
+    { source: "PR body", content: body }
+  ]);
+}
+function assertNoSecretLikeContent(inputs) {
+  const findings = inputs.flatMap(
+    ({ source, content }) => findSecretLikeContent(source, content ?? "")
+  );
+  if (findings.length === 0) {
+    return;
+  }
+  const summary = findings.slice(0, 5).map((finding) => `${finding.source}: ${finding.kind}`).join("; ");
+  throw new Error(
+    `Secret-like content detected before finalization (${summary}). Redact it before committing, pushing, or creating a PR.`
+  );
+}
+function findSecretLikeContent(source, content) {
+  const findings = [];
+  const patterns = [
+    {
+      kind: "private key block",
+      regex: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/gi
+    },
+    {
+      kind: "GitHub token",
+      regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/g
+    },
+    {
+      kind: "GitHub fine-grained token",
+      regex: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g
+    },
+    { kind: "npm token", regex: /\bnpm_[A-Za-z0-9]{20,}\b/g },
+    { kind: "OpenAI key", regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g },
+    { kind: "AWS access key", regex: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+    {
+      kind: "authorization bearer token",
+      regex: /\bAuthorization\s*:\s*Bearer\s+[^\s`'\"]{12,}/gi
+    },
+    {
+      kind: "secret assignment",
+      regex: /\b[A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PRIVATE[_-]?KEY|CLIENT[_-]?SECRET|DATABASE[_-]?URL)[A-Z0-9_]*\s*[:=]\s*["']?[^\s"'`]{8,}/gi
+    }
+  ];
+  for (const { kind, regex } of patterns) {
+    for (const match of content.matchAll(regex)) {
+      if (isAllowedSecretPlaceholder(match[0])) {
+        continue;
+      }
+      findings.push({ source, kind });
+      break;
+    }
+  }
+  return findings;
+}
+function isAllowedSecretPlaceholder(value) {
+  const normalized = value.toLowerCase();
+  return [
+    "<redacted>",
+    "<example",
+    "example-",
+    "dummy-",
+    "test-",
+    "placeholder",
+    "xxxxx"
+  ].some((allowed) => normalized.includes(allowed));
+}
 async function syncRemoteBaseRef(worktreePath, baseRef, logger) {
   const remoteBase = parseRemoteBaseRef(baseRef);
   if (!remoteBase) {
@@ -3865,7 +4510,7 @@ async function resolveIssueWorktree(root, branchName, baseBranch, logger) {
   return { mode: "new", branchName, baseRef };
 }
 function issueWorktreePath(root, branchName) {
-  return join8(root, ".sandcastle", "worktrees", branchName.replace(/\//g, "-"));
+  return join10(root, ".sandcastle", "worktrees", branchName.replace(/\//g, "-"));
 }
 function resolveRegisteredIssueWorktreePath(worktreeListPorcelain, root, branchName) {
   const branchWorktreePath = parseWorktreeListPorcelain(
@@ -3893,12 +4538,251 @@ async function syncTargetBranch(root, baseBranch, logger) {
 }
 function loadBuilderPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync5(promptPath) ? readFileSync5(promptPath, "utf-8") : promptTemplate;
+  const promptBody = existsSync7(promptPath) ? readFileSync7(promptPath, "utf-8") : promptTemplate;
   return appendProtectedWorkGuidance(`${promptBody}
 
 ## Shared Run Context
 
-Read the selected issue requirements, comments, branch context, validation commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}`);
+Read the selected issue requirements, comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}`);
+}
+async function handleRebaseConflict(failure, context) {
+  const frConfig = context.target.strategy.failureResolution;
+  if (!frConfig) {
+    await transitionIssueToFailureState(
+      context.issueProvider,
+      context.issueNumber,
+      context.config,
+      "No failureResolution configured",
+      context.logger
+    );
+    throw new Error("Base refresh conflicted: no failureResolution configured");
+  }
+  const maxAttempts = frConfig.failureLimits?.RebaseConflict ?? frConfig.maxAttemptsPerFailure;
+  let attemptNumber = 0;
+  let currentFailure = failure;
+  while (attemptNumber < maxAttempts) {
+    attemptNumber++;
+    const packet = constructFailureResolutionPacket(currentFailure, {
+      stageName: "baseRefresh",
+      attemptNumber,
+      worktreePath: context.worktreePath,
+      branchName: context.branchName,
+      baseBranch: context.target.baseBranch,
+      maxAttempts,
+      allowedDecisions: ["RETRY_STAGE", "HANDOFF_TO_HUMAN", "FAIL_RUN"],
+      artifactTarget: `.pourkit/.tmp/failure-resolution/attempt-${attemptNumber}.md`
+    });
+    const result = await runFailureResolutionAgent({
+      executionProvider: context.executionProvider,
+      config: context.config,
+      target: context.target,
+      failure: currentFailure,
+      packet,
+      worktreePath: context.worktreePath,
+      repoRoot: context.repoRoot,
+      logger: context.logger
+    });
+    if (result.status === "handoff") {
+      if (context.worktreeState) {
+        updateWorktreeRunState(context.worktreePath, {
+          lastFailure: { stage: "baseRefresh", message: result.reason }
+        });
+      } else {
+        writeWorktreeRunState(context.worktreePath, {
+          issueNumber: context.issueNumber,
+          targetName: context.target.name,
+          branchName: context.branchName,
+          baseBranch: context.target.baseBranch,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          completedStages: {},
+          review: { lifetimeIterations: 0 },
+          lastFailure: { stage: "baseRefresh", message: result.reason }
+        });
+      }
+      await transitionIssueToFailureState(
+        context.issueProvider,
+        context.issueNumber,
+        context.config,
+        result.reason,
+        context.logger
+      );
+      throw new Error(result.reason);
+    }
+    if (result.status === "fail-run") {
+      if (context.worktreeState) {
+        updateWorktreeRunState(context.worktreePath, {
+          lastFailure: { stage: "baseRefresh", message: result.reason }
+        });
+      } else {
+        writeWorktreeRunState(context.worktreePath, {
+          issueNumber: context.issueNumber,
+          targetName: context.target.name,
+          branchName: context.branchName,
+          baseBranch: context.target.baseBranch,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          completedStages: {},
+          review: { lifetimeIterations: 0 },
+          lastFailure: { stage: "baseRefresh", message: result.reason }
+        });
+      }
+      throw new Error(result.reason);
+    }
+    const changedPaths = packet.conflictedPaths ?? currentFailure.conflictedPaths;
+    const markersRemain = await hasUnresolvedConflictMarkers(
+      context.worktreePath,
+      changedPaths
+    );
+    if (markersRemain) {
+      const message = "Conflict resolution agent resolved artifact but conflict markers remain in files";
+      if (context.worktreeState) {
+        updateWorktreeRunState(context.worktreePath, {
+          lastFailure: { stage: "baseRefresh", message }
+        });
+      } else {
+        writeWorktreeRunState(context.worktreePath, {
+          issueNumber: context.issueNumber,
+          targetName: context.target.name,
+          branchName: context.branchName,
+          baseBranch: context.target.baseBranch,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          completedStages: {},
+          review: { lifetimeIterations: 0 },
+          lastFailure: { stage: "baseRefresh", message }
+        });
+      }
+      await transitionIssueToFailureState(
+        context.issueProvider,
+        context.issueNumber,
+        context.config,
+        message,
+        context.logger
+      );
+      throw new Error(message);
+    }
+    await execCapture("git", ["add", ...changedPaths], {
+      cwd: context.worktreePath,
+      logger: context.logger,
+      label: "git add conflicted paths"
+    });
+    try {
+      await execCapture("git", ["rebase", "--continue"], {
+        cwd: context.worktreePath,
+        env: { ...process.env, GIT_EDITOR: "true" },
+        logger: context.logger,
+        label: "git rebase --continue"
+      });
+      if (context.worktreeState?.completedStages.builder) {
+        const invalidatedState = invalidateAfterBaseRefresh(
+          context.worktreeState
+        );
+        writeWorktreeRunState(context.worktreePath, invalidatedState);
+      }
+      return;
+    } catch {
+      const statusResult = await execCapture("git", ["status", "--porcelain"], {
+        cwd: context.worktreePath,
+        logger: context.logger,
+        label: "git status"
+      });
+      const newConflictedPaths = statusResult.stdout.split("\n").filter((line) => /^(AA|DD|UU|AU|UA|DU|UD)\s/.test(line)).map((line) => line.slice(3).trim()).filter(Boolean);
+      if (newConflictedPaths.length === 0) {
+        const message = "git rebase --continue failed with no remaining conflicts";
+        if (context.worktreeState) {
+          updateWorktreeRunState(context.worktreePath, {
+            lastFailure: { stage: "baseRefresh", message }
+          });
+        } else {
+          writeWorktreeRunState(context.worktreePath, {
+            issueNumber: context.issueNumber,
+            targetName: context.target.name,
+            branchName: context.branchName,
+            baseBranch: context.target.baseBranch,
+            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            completedStages: {},
+            review: { lifetimeIterations: 0 },
+            lastFailure: { stage: "baseRefresh", message }
+          });
+        }
+        await transitionIssueToFailureState(
+          context.issueProvider,
+          context.issueNumber,
+          context.config,
+          message,
+          context.logger
+        );
+        throw new Error(message);
+      }
+      currentFailure = new RebaseConflict({
+        conflictedPaths: newConflictedPaths,
+        message: `Rebase conflict in: ${newConflictedPaths.join(", ")}`
+      });
+    }
+  }
+  if (context.worktreeState) {
+    updateWorktreeRunState(context.worktreePath, {
+      lastFailure: {
+        stage: "baseRefresh",
+        message: `Base refresh recovery exhausted after ${maxAttempts} attempts`
+      }
+    });
+  } else {
+    writeWorktreeRunState(context.worktreePath, {
+      issueNumber: context.issueNumber,
+      targetName: context.target.name,
+      branchName: context.branchName,
+      baseBranch: context.target.baseBranch,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      completedStages: {},
+      review: { lifetimeIterations: 0 },
+      lastFailure: {
+        stage: "baseRefresh",
+        message: `Base refresh recovery exhausted after ${maxAttempts} attempts`
+      }
+    });
+  }
+  await transitionIssueToFailureState(
+    context.issueProvider,
+    context.issueNumber,
+    context.config,
+    `Base refresh recovery exhausted after ${maxAttempts} attempts`,
+    context.logger
+  );
+  throw new Error(
+    `Base refresh recovery exhausted after ${maxAttempts} attempts`
+  );
+}
+async function handlePublishedHistoryRisk(failure, context) {
+  const message = `Cannot auto-refresh published history: PR #${failure.prNumber} (${failure.prState}) exists for branch ${context.branchName}`;
+  if (context.worktreeState) {
+    updateWorktreeRunState(context.worktreePath, {
+      lastFailure: { stage: "baseRefresh", message }
+    });
+  } else {
+    writeWorktreeRunState(context.worktreePath, {
+      issueNumber: context.issueNumber,
+      targetName: context.target.name,
+      branchName: context.branchName,
+      baseBranch: context.target.baseBranch,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      completedStages: {},
+      review: { lifetimeIterations: 0 },
+      lastFailure: { stage: "baseRefresh", message }
+    });
+  }
+  await transitionIssueToFailureState(
+    context.issueProvider,
+    context.issueNumber,
+    context.config,
+    message,
+    context.logger
+  );
+  throw new Error(message);
 }
 
 // commands/issue.ts
@@ -3941,7 +4825,8 @@ async function runIssueCommand(options) {
         repoRoot: ROOT,
         logger,
         startingLifetimeIteration: lifetimeIterationsFromState,
-        humanHandoffResolved
+        humanHandoffResolved,
+        serena: startResult.serena
       });
       if (reviewResult.exhaustedMaxIterations) {
         throw new Error(
@@ -3986,6 +4871,95 @@ async function runIssueCommand(options) {
   }
 }
 
+// commands/issue-create.ts
+import { readFile as readFile3 } from "fs/promises";
+function isFlag(value) {
+  return value.startsWith("--");
+}
+function requireFlagValue(flag, value) {
+  if (!value || isFlag(value)) {
+    throw new Error(`${flag} requires a value`);
+  }
+  return value;
+}
+function parseIssueCreateArgs(args) {
+  let title;
+  let body;
+  let bodyFile;
+  const labels = [];
+  const assignees = [];
+  const remaining = [];
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (arg === "--title") {
+      title = requireFlagValue("--title", args[i + 1]);
+      i += 2;
+    } else if (arg === "--body") {
+      body = requireFlagValue("--body", args[i + 1]);
+      i += 2;
+    } else if (arg === "--body-file") {
+      bodyFile = requireFlagValue("--body-file", args[i + 1]);
+      i += 2;
+    } else if (arg === "--label") {
+      const label = requireFlagValue("--label", args[i + 1]);
+      labels.push(label);
+      i += 2;
+    } else if (arg === "--assignee") {
+      const assignee = requireFlagValue("--assignee", args[i + 1]);
+      assignees.push(assignee);
+      i += 2;
+    } else {
+      remaining.push(arg);
+      i++;
+    }
+  }
+  return {
+    options: {
+      title,
+      body,
+      bodyFile,
+      labels,
+      assignees
+    },
+    remaining
+  };
+}
+function validateIssueCreateOptions(options) {
+  const errors = [];
+  if (!options.title) {
+    errors.push("--title is required");
+  }
+  if (options.body && options.bodyFile) {
+    errors.push("--body and --body-file cannot be used together");
+  }
+  if (errors.length > 0) {
+    throw new Error(errors.join("; "));
+  }
+}
+async function runIssueCreateCommand(args, issueProvider, logger) {
+  const { options, remaining } = parseIssueCreateArgs(args);
+  if (remaining.length > 0) {
+    throw new Error(`Unsupported arguments: ${remaining.join(" ")}`);
+  }
+  validateIssueCreateOptions(options);
+  const renderedBody = options.bodyFile ? await readFile3(options.bodyFile, "utf-8") : options.body ?? "";
+  const createOptions = {
+    title: options.title,
+    body: renderedBody,
+    labels: options.labels.length > 0 ? options.labels : void 0,
+    assignees: options.assignees.length > 0 ? options.assignees : void 0
+  };
+  const created = await issueProvider.createIssue(createOptions);
+  return {
+    options,
+    renderedBody,
+    issueNumber: created.number,
+    issueUrl: created.url,
+    issueTitle: created.title
+  };
+}
+
 // commands/queue.ts
 init_common();
 
@@ -4423,11 +5397,11 @@ async function runPrWorkflow(options) {
 }
 
 // commands/pr-create.ts
-function isFlag(value) {
+function isFlag2(value) {
   return value.startsWith("--");
 }
-function requireFlagValue(flag, value) {
-  if (!value || isFlag(value)) {
+function requireFlagValue2(flag, value) {
+  if (!value || isFlag2(value)) {
     throw new Error(`${flag} requires a value`);
   }
   return value;
@@ -4445,25 +5419,25 @@ function parsePrCreateArgs(args) {
   while (i < args.length) {
     const arg = args[i];
     if (arg === "--target") {
-      target = requireFlagValue("--target", args[i + 1]);
+      target = requireFlagValue2("--target", args[i + 1]);
       i += 2;
     } else if (arg === "--title") {
-      title = requireFlagValue("--title", args[i + 1]);
+      title = requireFlagValue2("--title", args[i + 1]);
       i += 2;
     } else if (arg === "--base") {
-      base = requireFlagValue("--base", args[i + 1]);
+      base = requireFlagValue2("--base", args[i + 1]);
       i += 2;
     } else if (arg === "--head") {
-      head = requireFlagValue("--head", args[i + 1]);
+      head = requireFlagValue2("--head", args[i + 1]);
       i += 2;
     } else if (arg === "--body") {
-      body = requireFlagValue("--body", args[i + 1]);
+      body = requireFlagValue2("--body", args[i + 1]);
       i += 2;
     } else if (arg === "--body-file") {
-      bodyFile = requireFlagValue("--body-file", args[i + 1]);
+      bodyFile = requireFlagValue2("--body-file", args[i + 1]);
       i += 2;
     } else if (arg === "--issue") {
-      const raw = requireFlagValue("--issue", args[i + 1]);
+      const raw = requireFlagValue2("--issue", args[i + 1]);
       if (!/^\d+$/.test(raw)) {
         throw new Error(`Invalid issue number: ${raw}`);
       }
@@ -4561,17 +5535,17 @@ async function runPrCreateCommand(args, logger, prProvider, config, repoRoot2) {
 
 // commands/pr-merge.ts
 init_common();
-function isFlag2(value) {
+function isFlag3(value) {
   return value.startsWith("--");
 }
-function requireFlagValue2(flag, value) {
-  if (!value || isFlag2(value)) {
+function requireFlagValue3(flag, value) {
+  if (!value || isFlag3(value)) {
     throw new Error(`${flag} requires a value`);
   }
   return value;
 }
 function parsePrNumber(raw) {
-  if (!raw || isFlag2(raw) || !/^\d+$/.test(raw)) {
+  if (!raw || isFlag3(raw) || !/^\d+$/.test(raw)) {
     throw new Error("PR number is required");
   }
   const prNumber = parseInt(raw, 10);
@@ -4591,10 +5565,10 @@ function parsePrMergeArgs(args) {
   while (i < args.length) {
     const arg = args[i];
     if (arg === "--target") {
-      target = requireFlagValue2("--target", args[i + 1]);
+      target = requireFlagValue3("--target", args[i + 1]);
       i += 2;
     } else if (arg === "--method") {
-      const raw = requireFlagValue2("--method", args[i + 1]);
+      const raw = requireFlagValue3("--method", args[i + 1]);
       if (raw !== "merge" && raw !== "squash" && raw !== "rebase") {
         throw new Error(`Invalid merge method: ${raw}`);
       }
@@ -4707,17 +5681,17 @@ async function runPrMergeCommand(args, logger, prProvider, config) {
 }
 
 // commands/init.ts
-import { existsSync as existsSync6, statSync } from "fs";
+import { existsSync as existsSync8, statSync } from "fs";
 import {
   copyFile,
-  mkdir as mkdir2,
-  readFile as readFile3,
+  mkdir as mkdir4,
+  readFile as readFile4,
   readdir,
   rename,
   writeFile
 } from "fs/promises";
 import { createHash, randomUUID } from "crypto";
-import path3 from "path";
+import path5 from "path";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 import { confirm, isCancel, log, select, text } from "@clack/prompts";
@@ -4942,7 +5916,7 @@ function generateConfigTemplate(options) {
     labels: maybeLabels
   } = options;
   const labels = maybeLabels ?? DEFAULT_RUNNER_LABELS;
-  const relPath = path3.relative(targetRoot, sourceRoot).replace(/\\/g, "/");
+  const relPath = path5.relative(targetRoot, sourceRoot).replace(/\\/g, "/");
   const importPath = relPath || ".";
   const setupCommand = `${packageManager} install`;
   let setupSection;
@@ -5190,9 +6164,9 @@ _Avoid_: Alternative terms
 `;
 }
 async function generateManagedAgentInstructions(options) {
-  const sourcePath = path3.join(options.sourceRoot, "AGENTS.md");
+  const sourcePath = path5.join(options.sourceRoot, "AGENTS.md");
   try {
-    return await readFile3(sourcePath, "utf-8");
+    return await readFile4(sourcePath, "utf-8");
   } catch {
     return `## Agent Skills
 
@@ -5220,7 +6194,7 @@ async function walkDir(dir) {
   const files = [];
   const entries = await readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const full = path3.join(dir, entry.name);
+    const full = path5.join(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...await walkDir(full));
     } else {
@@ -5230,11 +6204,11 @@ async function walkDir(dir) {
   return files;
 }
 async function computeFileChecksum(filePath) {
-  const content = await readFile3(filePath);
+  const content = await readFile4(filePath);
   return createHash("sha256").update(content).digest("hex");
 }
 function lockfileExists(root, name) {
-  return existsSync6(path3.join(root, name));
+  return existsSync8(path5.join(root, name));
 }
 function detectPackageManager(root) {
   if (lockfileExists(root, "pnpm-lock.yaml")) return "pnpm";
@@ -5277,8 +6251,8 @@ async function discoverLocalSource(sourcePath) {
 }
 async function discoverReadme(root) {
   for (const name of ["README.md", "readme.md"]) {
-    const p = path3.join(root, name);
-    if (existsSync6(p)) {
+    const p = path5.join(root, name);
+    if (existsSync8(p)) {
       return p;
     }
   }
@@ -5287,25 +6261,25 @@ async function discoverReadme(root) {
 async function discoverAgentFiles(root) {
   const files = [];
   for (const name of ["AGENTS.md", "CLAUDE.md"]) {
-    const p = path3.join(root, name);
-    if (existsSync6(p)) {
+    const p = path5.join(root, name);
+    if (existsSync8(p)) {
       files.push(p);
     }
   }
   return files;
 }
 async function discoverMerlleState(root) {
-  const p = path3.join(root, ".pourkit", "state.json");
-  return existsSync6(p) ? p : null;
+  const p = path5.join(root, ".pourkit", "state.json");
+  return existsSync8(p) ? p : null;
 }
 async function discoverAgentSkills(root) {
   const dirs = [
-    path3.join(root, ".agents", "skills"),
-    path3.join(root, ".opencode", "skills")
+    path5.join(root, ".agents", "skills"),
+    path5.join(root, ".opencode", "skills")
   ];
   const found = [];
   for (const d of dirs) {
-    if (existsSync6(d)) {
+    if (existsSync8(d)) {
       found.push(d);
     }
   }
@@ -5314,17 +6288,17 @@ async function discoverAgentSkills(root) {
 async function discoverRootDomainDocs(root) {
   const docs = [];
   for (const name of ["CONTEXT.md", "CONTEXT-MAP.md"]) {
-    const p = path3.join(root, name);
-    if (existsSync6(p)) {
+    const p = path5.join(root, name);
+    if (existsSync8(p)) {
       docs.push(p);
     }
   }
-  const adrDir = path3.join(root, "docs", "adr");
-  if (existsSync6(adrDir)) {
+  const adrDir = path5.join(root, "docs", "adr");
+  if (existsSync8(adrDir)) {
     const entries = await readdir(adrDir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isFile() && entry.name.endsWith(".md")) {
-        docs.push(path3.join(adrDir, entry.name));
+        docs.push(path5.join(adrDir, entry.name));
       }
     }
   }
@@ -5412,7 +6386,7 @@ async function planInit(options) {
     for (const f of agentFiles) {
       if (sourceRoot) {
         const agentFileMode = options.conflictPolicy?.agentFile ?? "both";
-        const basename = path3.basename(f);
+        const basename = path5.basename(f);
         if (agentFileMode === "skip" || agentFileMode === "agents" && basename !== "AGENTS.md" || agentFileMode === "claude" && basename !== "CLAUDE.md") {
           operations.push({
             kind: "skip",
@@ -5438,7 +6412,7 @@ async function planInit(options) {
           kind: "skip",
           path: f,
           ownership: "project-owned",
-          reason: `Existing agent file: ${path3.basename(f)}`,
+          reason: `Existing agent file: ${path5.basename(f)}`,
           requiresConfirmation: false,
           destructive: false
         });
@@ -5461,15 +6435,15 @@ async function planInit(options) {
     if (s.includes(".opencode") && options.legacySkills) {
       const skillFiles = await walkDir(s);
       for (const file of skillFiles) {
-        const relPath = path3.relative(s, file);
-        const destPath = path3.join(targetRoot, ".agents", "skills", relPath);
-        if (!existsSync6(destPath)) {
+        const relPath = path5.relative(s, file);
+        const destPath = path5.join(targetRoot, ".agents", "skills", relPath);
+        if (!existsSync8(destPath)) {
           operations.push({
             kind: "copy",
             sourcePath: file,
             path: destPath,
             ownership: "project-owned",
-            reason: `Migrate legacy skill: ${path3.join(".opencode/skills", relPath)}`,
+            reason: `Migrate legacy skill: ${path5.join(".opencode/skills", relPath)}`,
             requiresConfirmation: false,
             destructive: false
           });
@@ -5526,7 +6500,7 @@ async function planInit(options) {
     });
   }
   if (sourceRoot) {
-    if (!existsSync6(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
+    if (!existsSync8(sourceRoot) || !statSync(sourceRoot).isDirectory()) {
       warnings.push(
         `--from-local path does not exist or is not a directory: ${sourceRoot}`
       );
@@ -5587,17 +6561,17 @@ async function planInit(options) {
           continue;
         }
         const targetDirName = ".agents/skills";
-        const targetPath = path3.join(targetRoot, targetDirName);
+        const targetPath = path5.join(targetRoot, targetDirName);
         const skillFiles = await walkDir(s);
         for (const file of skillFiles) {
-          const relPath = path3.relative(s, file);
-          const destPath = path3.join(targetPath, relPath);
+          const relPath = path5.relative(s, file);
+          const destPath = path5.join(targetPath, relPath);
           if (plannedSkillDests.has(destPath)) {
             operations.push({
               kind: "skip",
               path: destPath,
               ownership: "project-owned",
-              reason: `Skill destination conflict, skipping source copy: ${path3.join(targetDirName, relPath)}`,
+              reason: `Skill destination conflict, skipping source copy: ${path5.join(targetDirName, relPath)}`,
               requiresConfirmation: false,
               destructive: false,
               conflict: "destination already planned"
@@ -5610,7 +6584,7 @@ async function planInit(options) {
             sourcePath: file,
             path: destPath,
             ownership: "copied-customizable",
-            reason: `Copy skill: ${path3.join(targetDirName, relPath)}`,
+            reason: `Copy skill: ${path5.join(targetDirName, relPath)}`,
             requiresConfirmation: false,
             destructive: false,
             checksum
@@ -5622,7 +6596,7 @@ async function planInit(options) {
         operations.push({
           kind: "copy",
           sourcePath: srcReadme,
-          path: path3.join(targetRoot, "README.md"),
+          path: path5.join(targetRoot, "README.md"),
           ownership: "project-owned",
           reason: "Copy README.md from source",
           requiresConfirmation: false,
@@ -5633,8 +6607,8 @@ async function planInit(options) {
       const rootDocs = await discoverRootDomainDocs(targetRoot);
       const merleDestPaths = /* @__PURE__ */ new Set();
       for (const docPath of rootDocs) {
-        const relPath = path3.relative(targetRoot, docPath);
-        const destPath = path3.join(targetRoot, ".pourkit", relPath);
+        const relPath = path5.relative(targetRoot, docPath);
+        const destPath = path5.join(targetRoot, ".pourkit", relPath);
         merleDestPaths.add(destPath);
         if (docsMigration === "skip") {
           operations.push({
@@ -5645,7 +6619,7 @@ async function planInit(options) {
             requiresConfirmation: false,
             destructive: false
           });
-        } else if (existsSync6(destPath)) {
+        } else if (existsSync8(destPath)) {
           operations.push({
             kind: "skip",
             path: destPath,
@@ -5680,8 +6654,8 @@ async function planInit(options) {
       let packageScripts = {};
       let hasPackageJson = true;
       try {
-        const pkgContent = await readFile3(
-          path3.join(targetRoot, "package.json"),
+        const pkgContent = await readFile4(
+          path5.join(targetRoot, "package.json"),
           "utf-8"
         );
         const pkg = JSON.parse(pkgContent);
@@ -5702,8 +6676,8 @@ async function planInit(options) {
         } catch {
         }
       }
-      const contextPath = path3.join(targetRoot, ".pourkit", "CONTEXT.md");
-      if (!existsSync6(contextPath) && !merleDestPaths.has(contextPath)) {
+      const contextPath = path5.join(targetRoot, ".pourkit", "CONTEXT.md");
+      if (!existsSync8(contextPath) && !merleDestPaths.has(contextPath)) {
         operations.push({
           kind: "create",
           path: contextPath,
@@ -5714,14 +6688,14 @@ async function planInit(options) {
           content: generateContextScaffold()
         });
       }
-      const adrGitkeep = path3.join(
+      const adrGitkeep = path5.join(
         targetRoot,
         ".pourkit",
         "docs",
         "adr",
         ".gitkeep"
       );
-      if (!existsSync6(adrGitkeep)) {
+      if (!existsSync8(adrGitkeep)) {
         operations.push({
           kind: "create",
           path: adrGitkeep,
@@ -5731,16 +6705,16 @@ async function planInit(options) {
           destructive: false
         });
       }
-      const srcDocAgents = path3.join(sourceRoot, ".pourkit", "docs", "agents");
-      const tgtDocAgents = path3.join(targetRoot, ".pourkit", "docs", "agents");
-      if (existsSync6(srcDocAgents) && !existsSync6(tgtDocAgents)) {
+      const srcDocAgents = path5.join(sourceRoot, ".pourkit", "docs", "agents");
+      const tgtDocAgents = path5.join(targetRoot, ".pourkit", "docs", "agents");
+      if (existsSync8(srcDocAgents) && !existsSync8(tgtDocAgents)) {
         const docFiles = await walkDir(srcDocAgents);
         for (const file of docFiles) {
-          const relPath = path3.relative(srcDocAgents, file);
+          const relPath = path5.relative(srcDocAgents, file);
           if (relPath === "triage-labels.md") {
             operations.push({
               kind: "create",
-              path: path3.join(tgtDocAgents, relPath),
+              path: path5.join(tgtDocAgents, relPath),
               ownership: "managed",
               reason: "Init triage labels doc",
               requiresConfirmation: false,
@@ -5755,7 +6729,7 @@ async function planInit(options) {
           operations.push({
             kind: "copy",
             sourcePath: file,
-            path: path3.join(tgtDocAgents, relPath),
+            path: path5.join(tgtDocAgents, relPath),
             ownership: "managed",
             reason: `Copy agent doc: ${relPath}`,
             requiresConfirmation: false,
@@ -5764,17 +6738,17 @@ async function planInit(options) {
           });
         }
       }
-      const srcPrompts = path3.join(sourceRoot, ".pourkit", "prompts");
-      const tgtPrompts = path3.join(targetRoot, ".pourkit", "prompts");
-      if (existsSync6(srcPrompts) && !existsSync6(tgtPrompts)) {
+      const srcPrompts = path5.join(sourceRoot, ".pourkit", "prompts");
+      const tgtPrompts = path5.join(targetRoot, ".pourkit", "prompts");
+      if (existsSync8(srcPrompts) && !existsSync8(tgtPrompts)) {
         const promptFiles = await walkDir(srcPrompts);
         for (const file of promptFiles) {
-          const relPath = path3.relative(srcPrompts, file);
+          const relPath = path5.relative(srcPrompts, file);
           const checksum = await computeFileChecksum(file);
           operations.push({
             kind: "copy",
             sourcePath: file,
-            path: path3.join(tgtPrompts, relPath),
+            path: path5.join(tgtPrompts, relPath),
             ownership: "managed",
             reason: `Copy prompt: ${relPath}`,
             requiresConfirmation: false,
@@ -5783,17 +6757,17 @@ async function planInit(options) {
           });
         }
       }
-      const srcSandboxDockerfile = path3.join(
+      const srcSandboxDockerfile = path5.join(
         sourceRoot,
         ".sandcastle",
         "Dockerfile"
       );
-      const tgtSandboxDockerfile = path3.join(
+      const tgtSandboxDockerfile = path5.join(
         targetRoot,
         ".sandcastle",
         "Dockerfile"
       );
-      if (existsSync6(tgtSandboxDockerfile)) {
+      if (existsSync8(tgtSandboxDockerfile)) {
         operations.push({
           kind: "skip",
           path: tgtSandboxDockerfile,
@@ -5802,7 +6776,7 @@ async function planInit(options) {
           requiresConfirmation: false,
           destructive: false
         });
-      } else if (existsSync6(srcSandboxDockerfile)) {
+      } else if (existsSync8(srcSandboxDockerfile)) {
         const checksum = await computeFileChecksum(srcSandboxDockerfile);
         operations.push({
           kind: "copy",
@@ -5815,8 +6789,8 @@ async function planInit(options) {
           checksum
         });
       }
-      const configTsPath = path3.join(targetRoot, "pourkit.config.ts");
-      if (!existsSync6(configTsPath)) {
+      const configTsPath = path5.join(targetRoot, "pourkit.config.ts");
+      if (!existsSync8(configTsPath)) {
         const verifyCommands = inferVerificationCommands(
           packageScripts,
           pm || "npm"
@@ -5853,10 +6827,10 @@ async function planInit(options) {
       const hasExistingAgents = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("AGENTS.md")
       );
-      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync6(path3.join(targetRoot, "AGENTS.md"))) {
+      if ((agentFileMode === "agents" || agentFileMode === "both") && !hasExistingAgents && !existsSync8(path5.join(targetRoot, "AGENTS.md"))) {
         operations.push({
           kind: "create",
-          path: path3.join(targetRoot, "AGENTS.md"),
+          path: path5.join(targetRoot, "AGENTS.md"),
           ownership: "managed",
           reason: "Init AGENTS.md with Pourkit managed block",
           requiresConfirmation: false,
@@ -5869,10 +6843,10 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
       const hasExistingClaude = operations.some(
         (op) => (op.kind === "skip" || op.kind === "update") && op.path?.endsWith("CLAUDE.md")
       );
-      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync6(path3.join(targetRoot, "CLAUDE.md"))) {
+      if ((agentFileMode === "claude" || agentFileMode === "both") && !hasExistingClaude && !existsSync8(path5.join(targetRoot, "CLAUDE.md"))) {
         operations.push({
           kind: "create",
-          path: path3.join(targetRoot, "CLAUDE.md"),
+          path: path5.join(targetRoot, "CLAUDE.md"),
           ownership: "managed",
           reason: "Init CLAUDE.md with Pourkit managed block",
           requiresConfirmation: false,
@@ -5882,9 +6856,9 @@ ${managedAgentContent}${MANAGED_BLOCK_END}
 `
         });
       }
-      const gitignoreTarget = path3.join(targetRoot, ".gitignore");
+      const gitignoreTarget = path5.join(targetRoot, ".gitignore");
       const gitignoreContent = generateGitignoreBlock();
-      if (!existsSync6(gitignoreTarget)) {
+      if (!existsSync8(gitignoreTarget)) {
         operations.push({
           kind: "create",
           path: gitignoreTarget,
@@ -5907,8 +6881,8 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
           content: gitignoreContent
         });
       }
-      const openCodePath = path3.join(targetRoot, "opencode.json");
-      if (!existsSync6(openCodePath)) {
+      const openCodePath = path5.join(targetRoot, "opencode.json");
+      if (!existsSync8(openCodePath)) {
         operations.push({
           kind: "create",
           path: openCodePath,
@@ -5920,7 +6894,7 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
         });
       } else {
         try {
-          const existingContent = await readFile3(openCodePath, "utf-8");
+          const existingContent = await readFile4(openCodePath, "utf-8");
           const existingConfig = JSON.parse(existingContent);
           if (typeof existingConfig !== "object" || existingConfig === null || Array.isArray(existingConfig)) {
             warnings.push(
@@ -5964,8 +6938,8 @@ ${gitignoreContent}${MANAGED_BLOCK_END}
           });
         }
       }
-      const manifestPath = path3.join(targetRoot, ".pourkit", "manifest.json");
-      if (existsSync6(manifestPath)) {
+      const manifestPath = path5.join(targetRoot, ".pourkit", "manifest.json");
+      if (existsSync8(manifestPath)) {
         operations.push({
           kind: "skip",
           path: manifestPath,
@@ -6284,13 +7258,13 @@ async function updateManagedBlock(filePath, content) {
   const blockContent = `${MANAGED_BLOCK_BEGIN}
 ${content}${MANAGED_BLOCK_END}
 `;
-  if (!existsSync6(filePath)) {
-    const dir = path3.dirname(filePath);
-    await mkdir2(dir, { recursive: true });
+  if (!existsSync8(filePath)) {
+    const dir = path5.dirname(filePath);
+    await mkdir4(dir, { recursive: true });
     await writeFileAtomic(filePath, blockContent);
     return;
   }
-  const existing = await readFile3(filePath, "utf-8");
+  const existing = await readFile4(filePath, "utf-8");
   const beginIdx = existing.indexOf(MANAGED_BLOCK_BEGIN);
   const endIdx = existing.indexOf(MANAGED_BLOCK_END);
   if (beginIdx !== -1 && endIdx !== -1 && endIdx > beginIdx) {
@@ -6303,17 +7277,17 @@ ${content}${MANAGED_BLOCK_END}
   }
 }
 async function writeManifest(plan, sourceMeta, agentFiles, packageManager) {
-  const manifestDir = path3.join(plan.targetRoot, ".pourkit");
-  const manifestPath = path3.join(manifestDir, "manifest.json");
+  const manifestDir = path5.join(plan.targetRoot, ".pourkit");
+  const manifestPath = path5.join(manifestDir, "manifest.json");
   const assets = {};
   for (const op of plan.operations) {
     if (!op.path) continue;
     if (op.kind !== "create" && op.kind !== "copy" && op.kind !== "update" && op.kind !== "move")
       continue;
     if (op.requiresConfirmation) continue;
-    const relPath = path3.relative(plan.targetRoot, op.path);
+    const relPath = path5.relative(plan.targetRoot, op.path);
     if (relPath === ".pourkit/manifest.json") continue;
-    if (existsSync6(op.path)) {
+    if (existsSync8(op.path)) {
       const sha256 = await computeFileChecksum(op.path);
       assets[relPath] = {
         ownership: op.ownership || "managed",
@@ -6337,7 +7311,7 @@ async function writeManifest(plan, sourceMeta, agentFiles, packageManager) {
     packageManager,
     assets
   };
-  await mkdir2(manifestDir, { recursive: true });
+  await mkdir4(manifestDir, { recursive: true });
   await writeFileAtomic(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
   return manifest;
 }
@@ -6358,12 +7332,12 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync6(op.path) && !op.destructive) {
+          if (existsSync8(op.path) && !op.destructive) {
             skipped++;
             continue;
           }
-          const dir = path3.dirname(op.path);
-          await mkdir2(dir, { recursive: true });
+          const dir = path5.dirname(op.path);
+          await mkdir4(dir, { recursive: true });
           await writeFileAtomic(op.path, op.content ?? "");
           applied++;
           break;
@@ -6373,7 +7347,7 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync6(op.path)) {
+          if (existsSync8(op.path)) {
             skipped++;
             continue;
           }
@@ -6381,8 +7355,8 @@ async function applyInitPlan(plan, options) {
           if (srcStat.isDirectory()) {
             skipped++;
           } else {
-            const dir = path3.dirname(op.path);
-            await mkdir2(dir, { recursive: true });
+            const dir = path5.dirname(op.path);
+            await mkdir4(dir, { recursive: true });
             await copyFile(op.sourcePath, op.path);
             applied++;
           }
@@ -6402,12 +7376,12 @@ async function applyInitPlan(plan, options) {
             skipped++;
             continue;
           }
-          if (existsSync6(op.path)) {
+          if (existsSync8(op.path)) {
             skipped++;
             continue;
           }
-          const dir = path3.dirname(op.path);
-          await mkdir2(dir, { recursive: true });
+          const dir = path5.dirname(op.path);
+          await mkdir4(dir, { recursive: true });
           await rename(op.sourcePath, op.path);
           applied++;
           break;
@@ -6537,13 +7511,13 @@ async function applyInitFromSource(options) {
   let manifestWritten = false;
   if (result.errors.length === 0) {
     const manifestSkipped = plan.operations.some(
-      (op) => op.kind === "skip" && op.path === path3.join(targetRoot, ".pourkit", "manifest.json")
+      (op) => op.kind === "skip" && op.path === path5.join(targetRoot, ".pourkit", "manifest.json")
     );
     if (!manifestSkipped) {
       const agentFiles = [];
       for (const name of ["AGENTS.md", "CLAUDE.md"]) {
-        if (existsSync6(path3.join(targetRoot, name))) {
-          agentFiles.push(path3.join(targetRoot, name));
+        if (existsSync8(path5.join(targetRoot, name))) {
+          agentFiles.push(path5.join(targetRoot, name));
         }
       }
       const pm = detectPackageManager(targetRoot);
@@ -6718,6 +7692,121 @@ Init applied: ${result.applied} operations applied, ${result.skipped} skipped.`
   }
 }
 
+// commands/serena.ts
+init_common();
+var SERENA_MCP_PORT2 = 9121;
+var SERENA_DASHBOARD_PORT2 = 24282;
+var SERENA_IMAGE2 = "ghcr.io/oraios/serena:latest";
+async function resolveSerenaCommandContext(options) {
+  const repoRootPath = options.cwd ? repoRoot(options.cwd) : repoRoot();
+  const config = await loadRepoConfig(repoRootPath);
+  const target = resolveTarget(config, options.target);
+  return {
+    repoRootPath,
+    config,
+    target
+  };
+}
+async function resolveSerenaLifecycleContext(options) {
+  const repoRootPath = options.cwd ? repoRoot(options.cwd) : repoRoot();
+  const config = await loadRepoConfig(repoRootPath);
+  return {
+    repoRootPath,
+    config,
+    paths: resolveSerenaPaths(repoRootPath, config.serena.dataDir)
+  };
+}
+function buildSerenaSidecarOptions(paths, mcpUrl) {
+  return {
+    baselineWorktreePath: paths.baselineWorktreePath,
+    dataDir: paths.dataDir,
+    mcpPort: SERENA_MCP_PORT2,
+    dashboardPort: SERENA_DASHBOARD_PORT2,
+    image: SERENA_IMAGE2,
+    mcpUrl
+  };
+}
+function logSerenaSidecarStatus(heading, status, baselineFreshness) {
+  console.log(`${heading}:`);
+  console.log(`  running: ${status.running ? "yes" : "no"}`);
+  console.log(`  mcpUrl: ${status.mcpUrl}`);
+  console.log(`  dashboardUrl: ${status.dashboardUrl}`);
+  console.log(`  containerName: ${status.containerName}`);
+  if (baselineFreshness) {
+    console.log(`  Baseline freshness: ${baselineFreshness}`);
+  }
+}
+async function runSerenaInitCommand(options) {
+  const { repoRootPath, config, target } = await resolveSerenaCommandContext(options);
+  const paths = await ensureBaselineWorktree({
+    repoRoot: repoRootPath,
+    dataDir: config.serena.dataDir
+  });
+  await refreshSerenaBaseline({
+    repoRoot: repoRootPath,
+    dataDir: config.serena.dataDir,
+    baseBranch: target.baseBranch
+  });
+  await prepareSerenaSidecarConfig({
+    baselineWorktreePath: paths.baselineWorktreePath,
+    dataDir: paths.dataDir
+  });
+  const sidecarOptions2 = buildSerenaSidecarOptions(paths, config.serena.mcpUrl);
+  await startSerenaSidecar(sidecarOptions2);
+  await indexSerenaProject(sidecarOptions2);
+}
+async function runSerenaRefreshCommand(options) {
+  const { repoRootPath, config, target } = await resolveSerenaCommandContext(options);
+  await refreshSerenaBaseline({
+    repoRoot: repoRootPath,
+    dataDir: config.serena.dataDir,
+    baseBranch: target.baseBranch
+  });
+}
+async function runSerenaStartCommand(options) {
+  const { repoRootPath, config } = await resolveSerenaLifecycleContext(options);
+  const ensuredPaths = await ensureBaselineWorktree({
+    repoRoot: repoRootPath,
+    dataDir: config.serena.dataDir
+  });
+  await prepareSerenaSidecarConfig({
+    baselineWorktreePath: ensuredPaths.baselineWorktreePath,
+    dataDir: ensuredPaths.dataDir
+  });
+  const status = await startSerenaSidecar(
+    buildSerenaSidecarOptions(ensuredPaths, config.serena.mcpUrl)
+  );
+  logSerenaSidecarStatus("Serena sidecar started", status);
+}
+async function runSerenaStopCommand(options) {
+  const { config, paths } = await resolveSerenaLifecycleContext(options);
+  const status = await stopSerenaSidecar(
+    buildSerenaSidecarOptions(paths, config.serena.mcpUrl)
+  );
+  logSerenaSidecarStatus("Serena sidecar stopped", status);
+}
+async function runSerenaStatusCommand(options) {
+  const { repoRootPath, config, paths } = await resolveSerenaLifecycleContext(options);
+  const status = await getSerenaSidecarStatus(
+    buildSerenaSidecarOptions(paths, config.serena.mcpUrl)
+  );
+  if (options.target) {
+    const target = resolveTarget(config, options.target);
+    const baseline = await getSerenaBaselineStatus({
+      repoRoot: repoRootPath,
+      dataDir: config.serena.dataDir,
+      baseBranch: target.baseBranch
+    });
+    logSerenaSidecarStatus(
+      "Serena sidecar status",
+      status,
+      baseline.fresh ? "fresh" : "stale"
+    );
+    return;
+  }
+  logSerenaSidecarStatus("Serena sidecar status", status);
+}
+
 // providers/github-provider.ts
 var GitHubIssueProvider = class {
   client;
@@ -6730,6 +7819,17 @@ var GitHubIssueProvider = class {
     this.blockedLabel = options?.blockedLabel ?? "blocked";
     this.issueListLimit = options?.issueListLimit ?? 50;
   }
+  async createIssue(options) {
+    const { data } = await this.client.octokit.rest.issues.create({
+      owner: this.client.owner,
+      repo: this.client.repo,
+      title: options.title,
+      body: options.body ?? "",
+      labels: options.labels,
+      assignees: options.assignees
+    });
+    return { number: data.number, url: data.html_url, title: data.title };
+  }
   async fetchIssue(number) {
     const { data } = await this.client.octokit.rest.issues.get({
       owner: this.client.owner,
@@ -7234,47 +8334,47 @@ function formatChecks2(checks) {
 init_common();
 
 // execution/sandcastle-execution.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join12 } from "path";
 import { createWorktree, opencode } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
 
 // execution/execution-provider.ts
 init_common();
 import { writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname4, join as join9 } from "path";
+import { dirname as dirname5, join as join11 } from "path";
 async function writeExecutionArtifacts(worktreePath, artifacts) {
   for (const artifact of artifacts) {
-    const filePath = join9(worktreePath, artifact.path);
-    await ensureDir(dirname4(filePath));
+    const filePath = join11(worktreePath, artifact.path);
+    await ensureDir(dirname5(filePath));
     await writeFile2(filePath, artifact.content, "utf-8");
   }
 }
 
 // execution/sandbox-image-build.ts
 init_common();
-import path5 from "path";
+import path7 from "path";
 
 // execution/sandbox-image.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
-import path4 from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import path6 from "path";
 function sandboxImageName(repoRoot2) {
-  const dirName = path4.basename(repoRoot2.replace(/[\\/]+$/, "")) || "local";
+  const dirName = path6.basename(repoRoot2.replace(/[\\/]+$/, "")) || "local";
   const sanitized = dirName.toLowerCase().replace(/[^a-z0-9_.-]/g, "-");
   const baseName = sanitized || "local";
-  const dockerfilePath = path4.join(repoRoot2, ".sandcastle", "Dockerfile");
-  if (!existsSync7(dockerfilePath)) {
+  const dockerfilePath = path6.join(repoRoot2, ".sandcastle", "Dockerfile");
+  if (!existsSync9(dockerfilePath)) {
     return `sandcastle:${baseName}`;
   }
-  const fingerprint = createHash2("sha256").update(readFileSync6(dockerfilePath)).digest("hex").slice(0, 8);
+  const fingerprint = createHash2("sha256").update(readFileSync8(dockerfilePath)).digest("hex").slice(0, 8);
   return `sandcastle:${baseName}-${fingerprint}`;
 }
 
 // execution/sandbox-image-build.ts
 async function ensureSandboxImageBuilt(repoRoot2, options) {
   const imageName = sandboxImageName(repoRoot2);
-  const dockerfilePath = path5.join(repoRoot2, ".sandcastle", "Dockerfile");
+  const dockerfilePath = path7.join(repoRoot2, ".sandcastle", "Dockerfile");
   if (!options?.force) {
     try {
       await execCapture("docker", ["image", "inspect", imageName]);
@@ -7312,6 +8412,25 @@ function buildSandboxOptions(repoRoot2, sandbox) {
   };
 }
 
+// execution/opencode-config.ts
+function isSerenaEligibleStage(stage) {
+  return stage === "builder" || stage === "refactor";
+}
+function buildSerenaOpenCodeConfig(stage, serena) {
+  if (!serena?.available || !isSerenaEligibleStage(stage)) {
+    return void 0;
+  }
+  return {
+    mcp: {
+      serena: {
+        type: "remote",
+        url: serena.sandboxMcpUrl,
+        enabled: true
+      }
+    }
+  };
+}
+
 // execution/sandcastle-execution.ts
 var SandcastleExecutionProvider = class {
   async createSession() {
@@ -7364,6 +8483,10 @@ var SandcastleExecutionSession = class {
       if (autoApprove) {
         env.OPENCODE_AUTO_APPROVE = "true";
       }
+      const serenaConfig = buildSerenaOpenCodeConfig(stage, options.serena);
+      if (serenaConfig) {
+        env.OPENCODE_CONFIG_CONTENT = JSON.stringify(serenaConfig);
+      }
       const logPath = `${repoRoot2}/.pourkit/logs/${sanitizeBranch(branchName)}-${Date.now()}.log`;
       await ensureSandboxImageBuilt(repoRoot2, { force: sandbox.forceRebuild });
       try {
@@ -7482,12 +8605,12 @@ function sanitizeBranch(branchName) {
   return branchName.replace(/[^A-Za-z0-9._-]/g, "-");
 }
 function savePromptToFile(repoRoot2, stage, iteration, prompt) {
-  const promptsDir = join10(repoRoot2, ".pourkit", ".tmp", "prompts");
-  mkdirSync5(promptsDir, { recursive: true });
+  const promptsDir = join12(repoRoot2, ".pourkit", ".tmp", "prompts");
+  mkdirSync6(promptsDir, { recursive: true });
   const timestamp2 = Date.now();
   const iterationSuffix = iteration !== void 0 ? `-iteration-${iteration}` : "";
   const filename = `${stage}${iterationSuffix}-${timestamp2}.md`;
-  const filePath = join10(promptsDir, filename);
+  const filePath = join12(promptsDir, filename);
   writeFileSync4(filePath, prompt, "utf-8");
 }
 
@@ -7553,19 +8676,91 @@ async function handleError(logger, error) {
 function createCliProgram(version) {
   const program = new Command();
   program.name("pourkit").version(version).exitOverride().description("AI-driven issue-to-PR workflow for GitHub repositories.");
-  program.command("issue").argument("<number>", "issue number").requiredOption("--target <name>", "target name").option("--force", "bypass issue gates").option(
+  const issueCommand = program.command("issue");
+  issueCommand.command("create").description("Create a new GitHub issue").requiredOption("--title <title>", "issue title").option("--body <body>", "issue body text").option("--body-file <path>", "file to read issue body from").option(
+    "--label <label>",
+    "label to apply (repeatable)",
+    (value, previous) => {
+      previous.push(value);
+      return previous;
+    },
+    []
+  ).option(
+    "--assignee <login>",
+    "assignee login (repeatable)",
+    (value, previous) => {
+      previous.push(value);
+      return previous;
+    },
+    []
+  ).option("--cwd <path>", "target repository directory").action(
+    async (options) => {
+      const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
+      const logPath = path8.join(
+        targetRepoRoot,
+        ".pourkit",
+        "logs",
+        "issue-create.log"
+      );
+      const logger = createLogger("pourkit", logPath);
+      const client = await requireGitHubClient({ cwd: targetRepoRoot });
+      const issueProvider = new GitHubIssueProvider(client);
+      try {
+        const args = ["--title", options.title];
+        if (options.body) {
+          args.push("--body", options.body);
+        }
+        if (options.bodyFile) {
+          const bodyFileArg = options.cwd && !path8.isAbsolute(options.bodyFile) ? path8.resolve(options.cwd, options.bodyFile) : options.bodyFile;
+          args.push("--body-file", bodyFileArg);
+        }
+        for (const label of options.label) {
+          args.push("--label", label);
+        }
+        for (const assignee of options.assignee) {
+          args.push("--assignee", assignee);
+        }
+        const result = await runIssueCreateCommand(
+          args,
+          issueProvider,
+          logger
+        );
+        logger.raw("Issue created successfully:");
+        logger.raw(`  Issue Number: #${result.issueNumber}`);
+        logger.raw(`  Issue Title: ${result.issueTitle}`);
+        logger.raw(`  Issue URL: ${result.issueUrl}`);
+        await logger.close();
+      } catch (error) {
+        await handleError(logger, error);
+      }
+    }
+  );
+  issueCommand.argument("[value]", "issue number or subcommand").option("--target <name>", "target name").option("--force", "bypass issue gates").option(
     "--reset-worktree",
     "delete local issue worktree and branch before starting"
   ).option("--cwd <path>", "target repository directory").action(
-    async (issueNumberRaw, options) => {
+    async (value, options) => {
+      if (!value) {
+        console.error(
+          "Invalid command. Use 'issue <number>' or 'issue create --title ...'"
+        );
+        process.exit(1);
+      }
+      const issueNumberRaw = value;
       const issueNumber = Number.parseInt(issueNumberRaw, 10);
       if (Number.isNaN(issueNumber)) {
         console.error(`Invalid issue number: ${issueNumberRaw}`);
         process.exit(1);
       }
+      if (!options.target) {
+        console.error(
+          "error: required option '--target <name>' not specified"
+        );
+        process.exit(1);
+      }
       const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
       const config = await loadRepoConfig(targetRepoRoot);
-      const logPath = path6.join(
+      const logPath = path8.join(
         targetRepoRoot,
         ".pourkit",
         "logs",
@@ -7624,7 +8819,7 @@ function createCliProgram(version) {
       const prdRef = options.prd ? normalizePrdRef(options.prd) : void 0;
       const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
       const config = await loadRepoConfig(targetRepoRoot);
-      const logPath = path6.join(
+      const logPath = path8.join(
         targetRepoRoot,
         ".pourkit",
         "logs",
@@ -7721,6 +8916,35 @@ function createCliProgram(version) {
       await runInitCommand(initOptions);
     }
   );
+  const serena = program.command("serena").description("Serena baseline and sidecar commands");
+  serena.command("init").requiredOption("--target <name>", "target name").option("--cwd <path>", "target repository directory").action(async (options) => {
+    await runSerenaInitCommand({
+      target: options.target,
+      cwd: options.cwd
+    });
+  });
+  serena.command("refresh").requiredOption("--target <name>", "target name").option("--cwd <path>", "target repository directory").action(async (options) => {
+    await runSerenaRefreshCommand({
+      target: options.target,
+      cwd: options.cwd
+    });
+  });
+  serena.command("start").option("--cwd <path>", "target repository directory").action(async (options) => {
+    await runSerenaStartCommand({
+      cwd: options.cwd
+    });
+  });
+  serena.command("stop").option("--cwd <path>", "target repository directory").action(async (options) => {
+    await runSerenaStopCommand({
+      cwd: options.cwd
+    });
+  });
+  serena.command("status").option("--target <name>", "target name").option("--cwd <path>", "target repository directory").action(async (options) => {
+    await runSerenaStatusCommand({
+      target: options.target,
+      cwd: options.cwd
+    });
+  });
   const pr = program.command("pr").description("Pull request commands");
   pr.command("create").requiredOption("--target <name>", "target name").requiredOption("--title <title>", "PR title").option("--base <base>", "base branch").option("--head <branch>", "head branch").option("--body <body>", "PR body").option("--body-file <path>", "file to read PR body from").option(
     "--issue <number>",
@@ -7734,7 +8958,7 @@ function createCliProgram(version) {
     async (options) => {
       const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
       const config = await loadRepoConfig(targetRepoRoot);
-      const logPath = path6.join(
+      const logPath = path8.join(
         targetRepoRoot,
         ".pourkit",
         "logs",
@@ -7780,7 +9004,7 @@ function createCliProgram(version) {
     async (prNumber, options) => {
       const targetRepoRoot = options.cwd ? repoRoot(options.cwd) : repoRoot();
       const config = await loadRepoConfig(targetRepoRoot);
-      const logPath = path6.join(
+      const logPath = path8.join(
         targetRepoRoot,
         ".pourkit",
         "logs",
@@ -7817,11 +9041,11 @@ function createCliProgram(version) {
   return program;
 }
 async function resolveCliVersion() {
-  if (isPackageVersion("0.0.0-next-20260529180337")) {
-    return "0.0.0-next-20260529180337";
+  if (isPackageVersion("0.0.0-next-20260531183322")) {
+    return "0.0.0-next-20260531183322";
   }
-  if (isReleaseVersion("0.0.0-next-20260529180337")) {
-    return "0.0.0-next-20260529180337";
+  if (isReleaseVersion("0.0.0-next-20260531183322")) {
+    return "0.0.0-next-20260531183322";
   }
   try {
     const root = repoRoot();