@pourkit/cli 0.0.0-next-20260620201514 → 0.0.0-next-20260621045826

package/dist/cli.js

@@ -3673,7 +3673,7 @@ function shellQuote(value) {
 
 // commands/issue-run.ts
 import { existsSync as existsSync12, readFileSync as readFileSync14 } from "fs";
-import { isAbsolute as isAbsolute4, join as join14 } from "path";
+import { isAbsolute as isAbsolute4, join as join15 } from "path";
 
 // pr/templates.ts
 init_common();
@@ -3688,7 +3688,50 @@ function renderTemplate(template, issue) {
 // commands/issue-run.ts
 init_common();
 
-// commands/base-refresh.ts
+// issues/issue-base-refresh.ts
+init_common();
+import { Exit as Exit3 } from "effect";
+
+// failure-resolution/effect-runtime.ts
+import { Effect as Effect4 } from "effect";
+
+// shared/effect-runtime.ts
+import { Effect as Effect3, Exit } from "effect";
+import { UnknownException } from "effect/Cause";
+var initialized = false;
+function initializeEffectRuntime() {
+  if (initialized) return;
+  initialized = true;
+}
+function runEffect(program) {
+  ensureEffectRuntime();
+  return Effect3.runPromiseExit(program);
+}
+function ensureEffectRuntime() {
+  if (!initialized) {
+    initializeEffectRuntime();
+  }
+}
+function unwrapError(error) {
+  if (error instanceof UnknownException && error.error !== void 0) {
+    return error.error;
+  }
+  return error;
+}
+function runEffectAndMapExit(program) {
+  return runEffect(program).then((exit) => {
+    if (Exit.isSuccess(exit)) return exit.value;
+    const cause = exit.cause;
+    if (cause._tag === "Fail") {
+      const error = unwrapError(cause.error);
+      throw error instanceof Error ? error : new Error(String(error));
+    }
+    const defect = cause._tag === "Die" ? cause.defect : cause._tag === "Interrupt" ? "interrupted" : `unhandled cause: ${cause._tag}`;
+    throw defect instanceof Error ? defect : new Error(`Unexpected defect: ${String(defect)}`);
+  });
+}
+
+// issues/base-refresh.ts
 init_common();
 async function isIssueBranchStale(worktreePath, baseBranch, logger) {
   try {
@@ -3768,45 +3811,6 @@ function invalidateAfterBaseRefresh(state) {
   };
 }
 
-// failure-resolution/effect-runtime.ts
-import { Effect as Effect4 } from "effect";
-
-// shared/effect-runtime.ts
-import { Effect as Effect3, Exit } from "effect";
-import { UnknownException } from "effect/Cause";
-var initialized = false;
-function initializeEffectRuntime() {
-  if (initialized) return;
-  initialized = true;
-}
-function runEffect(program) {
-  ensureEffectRuntime();
-  return Effect3.runPromiseExit(program);
-}
-function ensureEffectRuntime() {
-  if (!initialized) {
-    initializeEffectRuntime();
-  }
-}
-function unwrapError(error) {
-  if (error instanceof UnknownException && error.error !== void 0) {
-    return error.error;
-  }
-  return error;
-}
-function runEffectAndMapExit(program) {
-  return runEffect(program).then((exit) => {
-    if (Exit.isSuccess(exit)) return exit.value;
-    const cause = exit.cause;
-    if (cause._tag === "Fail") {
-      const error = unwrapError(cause.error);
-      throw error instanceof Error ? error : new Error(String(error));
-    }
-    const defect = cause._tag === "Die" ? cause.defect : cause._tag === "Interrupt" ? "interrupted" : `unhandled cause: ${cause._tag}`;
-    throw defect instanceof Error ? defect : new Error(`Unexpected defect: ${String(defect)}`);
-  });
-}
-
 // shared/attempt-log.ts
 import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync8 } from "fs";
 import { dirname as dirname4, join as join7 } from "path";
@@ -3958,8 +3962,438 @@ async function hasUnresolvedConflictMarkers(worktreePath, files) {
   return false;
 }
 
-// commands/issue-run.ts
-import { Exit as Exit3 } from "effect";
+// failure-resolution/failure-resolution-agent.ts
+import { readFileSync as readFileSync10 } from "fs";
+import { join as join9 } from "path";
+
+// failure-resolution/recovery-policy.ts
+function isSecuritySensitiveFailure(failure) {
+  return failure instanceof PublishedHistoryRisk || failure instanceof SafetyFailure;
+}
+async function evaluateRecoveryPolicy(params) {
+  if (isSecuritySensitiveFailure(params.failure)) {
+    return {
+      decision: "HANDOFF_TO_HUMAN",
+      reason: "Security-sensitive failure \u2014 AI recovery bypassed"
+    };
+  }
+  if (params.failure instanceof ConfigFailure) {
+    if (params.agentRecommendedDecision !== "FAIL_RUN" && params.agentRecommendedDecision !== "HANDOFF_TO_HUMAN") {
+      return {
+        decision: "HANDOFF_TO_HUMAN",
+        reason: `ConfigFailure \u2014 agent recommended ${params.agentRecommendedDecision} but config errors are not AI-repairable`
+      };
+    }
+  }
+  const budget = recoveryBudgetForFailure(
+    params.worktreePath,
+    params.fingerprint,
+    params.maxAttempts
+  );
+  if (budget.exhausted) {
+    return {
+      decision: "HANDOFF_TO_HUMAN",
+      reason: `Recovery budget exhausted (${budget.used}/${params.maxAttempts})`
+    };
+  }
+  if (!params.allowedDecisions.includes(params.agentRecommendedDecision)) {
+    return {
+      decision: "HANDOFF_TO_HUMAN",
+      reason: `Agent recommended ${params.agentRecommendedDecision} which is not allowed`
+    };
+  }
+  if (params.agentRecommendedDecision === "FAIL_RUN") {
+    return { decision: "FAIL_RUN", reason: "Agent recommended FAIL_RUN" };
+  }
+  return {
+    decision: params.agentRecommendedDecision,
+    reason: "Agent recommendation accepted"
+  };
+}
+
+// failure-resolution/failure-resolution-agent.ts
+function constructFailureResolutionPacket(failure, context) {
+  return {
+    failureType: failure._tag,
+    stageName: context.stageName,
+    attemptNumber: context.attemptNumber,
+    worktreePath: context.worktreePath,
+    branchName: context.branchName,
+    baseBranch: context.baseBranch,
+    conflictedPaths: failure instanceof RebaseConflict ? failure.conflictedPaths : void 0,
+    failureSummary: failure.message,
+    maxAttempts: context.maxAttempts,
+    allowedDecisions: context.allowedDecisions,
+    artifactTarget: context.artifactTarget
+  };
+}
+async function runFailureResolutionAgent(options) {
+  const {
+    executionProvider,
+    config,
+    target,
+    failure,
+    packet,
+    worktreePath,
+    repoRoot: repoRoot2,
+    logger
+  } = options;
+  const frConfig = target.strategy.failureResolution;
+  const artifactPath = packet.artifactTarget;
+  const fullArtifactPath = join9(worktreePath, artifactPath);
+  const fingerprint = computeFailureFingerprint(packet.stageName, failure._tag);
+  const prompt = [
+    `# Failure Resolution: ${packet.failureType}`,
+    "",
+    "## Failure Context",
+    "",
+    "```json",
+    JSON.stringify(packet, null, 2),
+    "```",
+    "",
+    "## Instructions",
+    "",
+    `Write your resolution to: ${artifactPath}`,
+    "Include a ```json block with: recoveryDecision, summary, changedFiles, verificationSummary (optional), verificationCommands (optional), notes (optional).",
+    "",
+    "Allowed decisions: " + packet.allowedDecisions.join(", "),
+    "",
+    `Before handoff, run: pourkit validate-artifact failure-resolution ${artifactPath} ${packet.allowedDecisions.map((decision) => `--allowed-decision ${decision}`).join(" ")}`
+  ].join("\n");
+  const retryResult = await executeWithMissingOrEmptyArtifactRetry({
+    executionProvider,
+    missingOrEmptyRetries: resolveMissingOrEmptyOutputRetries(frConfig),
+    executionOptions: {
+      stage: "failureResolution",
+      agent: frConfig.agent,
+      model: frConfig.model,
+      variant: frConfig.variant,
+      env: frConfig.env,
+      prompt,
+      target,
+      repoRoot: repoRoot2,
+      branchName: packet.branchName,
+      sandbox: config.sandbox,
+      autoApprove: true,
+      worktreePath,
+      artifactPath,
+      artifacts: [],
+      ...options.memory ? { memory: options.memory } : {},
+      logger
+    }
+  });
+  const executionResult = retryResult.executionResult;
+  if (!executionResult.success) {
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      `Agent execution failed: ${executionResult.error}`,
+      void 0,
+      "HANDOFF_TO_HUMAN",
+      packet.stageName
+    );
+    return {
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason: `Agent execution failed: ${executionResult.error}`
+    };
+  }
+  if (retryResult.artifact._tag !== "content") {
+    const reason = retryResult.artifact._tag === "empty" ? "Agent wrote empty artifact" : "Agent did not write artifact";
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      reason,
+      void 0,
+      "HANDOFF_TO_HUMAN",
+      packet.stageName
+    );
+    return {
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason
+    };
+  }
+  let artifact;
+  try {
+    const md = readFileSync10(fullArtifactPath, "utf-8");
+    const validation2 = validateAgentArtifact({
+      kind: "failure-resolution",
+      artifactPath: fullArtifactPath,
+      allowedDecisions: [...packet.allowedDecisions]
+    });
+    if (!validation2.ok) {
+      throw new Error(validation2.reason);
+    }
+    artifact = parseRecoveryArtifact(md, artifactPath);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "Failed to parse artifact";
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      reason,
+      void 0,
+      "HANDOFF_TO_HUMAN",
+      packet.stageName
+    );
+    return { status: "handoff", decision: "HANDOFF_TO_HUMAN", reason };
+  }
+  const validation = validateRecoveryDecision(
+    artifact,
+    packet.allowedDecisions
+  );
+  if (!validation.valid) {
+    await writeRecoveryAttempt(
+      worktreePath,
+      "failure",
+      fingerprint,
+      validation.reason,
+      void 0,
+      "HANDOFF_TO_HUMAN",
+      packet.stageName
+    );
+    return {
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason: validation.reason
+    };
+  }
+  const policyResult = await evaluateRecoveryPolicy({
+    failure,
+    worktreePath,
+    fingerprint,
+    maxAttempts: packet.maxAttempts,
+    agentRecommendedDecision: validation.decision,
+    allowedDecisions: packet.allowedDecisions
+  });
+  await writeRecoveryAttempt(
+    worktreePath,
+    policyResult.decision === "HANDOFF_TO_HUMAN" ? "handoff" : policyResult.decision === "FAIL_RUN" ? "failure" : "success",
+    fingerprint,
+    policyResult.reason,
+    artifactPath,
+    policyResult.decision,
+    packet.stageName
+  );
+  if (policyResult.decision === "HANDOFF_TO_HUMAN") {
+    return {
+      status: "handoff",
+      decision: "HANDOFF_TO_HUMAN",
+      reason: policyResult.reason
+    };
+  }
+  if (policyResult.decision === "FAIL_RUN") {
+    return {
+      status: "fail-run",
+      decision: "FAIL_RUN",
+      reason: policyResult.reason
+    };
+  }
+  return {
+    status: "recovered",
+    decision: policyResult.decision,
+    artifact
+  };
+}
+async function writeRecoveryAttempt(worktreePath, outcome, fingerprint, summary, artifactRef, decision, stageName = "baseRefresh") {
+  writeAttemptLog(worktreePath, {
+    attemptType: "recovery",
+    fingerprint,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    stage: stageName,
+    outcome,
+    artifactRef,
+    decision: decision ?? (outcome === "handoff" ? "HANDOFF_TO_HUMAN" : outcome === "success" ? "RETRY_STAGE" : void 0)
+  });
+}
+
+// issues/issue-base-refresh.ts
+async function runIssueBaseRefresh(options) {
+  const existingPr = await options.prProvider.getPr(options.branchName);
+  const exit = await runBaseRefreshAttempt({
+    worktreePath: options.worktreePath,
+    baseBranch: options.effectiveBaseBranch,
+    localGitBaseRef: options.baseRef,
+    logger: options.logger,
+    prNumber: existingPr?.number,
+    prState: existingPr?.state
+  });
+  if (Exit3.isSuccess(exit)) {
+    const refreshResult = exit.value;
+    if (refreshResult.status === "refreshed") {
+      if (options.worktreeState?.completedStages.builder) {
+        const invalidatedState = invalidateAfterBaseRefresh(
+          options.worktreeState
+        );
+        writeWorktreeRunState(options.worktreePath, invalidatedState);
+      }
+    }
+    return;
+  }
+  const cause = exit.cause;
+  if (cause._tag !== "Fail") {
+    const defectMessage = cause._tag === "Die" ? `Base refresh failed with unexpected error: ${String(cause.defect)}` : `Base refresh failed with unhandled cause: ${cause._tag}`;
+    throw new Error(defectMessage);
+  }
+  const failure = cause.error;
+  if (failure instanceof RebaseConflict) {
+    const frConfig = options.target.strategy.failureResolution;
+    if (frConfig && options.worktreePath) {
+      await handleRebaseConflict(failure, options);
+    } else {
+      writeConflictHandoffState(options, failure);
+      await options.transitionIssueToFailureState(
+        `Base refresh conflicted: ${failure.message}. Worktree preserved at ${options.worktreePath}.`
+      );
+      throw new Error(`Base refresh conflicted: ${failure.message}`);
+    }
+    return;
+  }
+  if (failure instanceof PublishedHistoryRisk) {
+    await handlePublishedHistoryRisk(failure, options);
+    return;
+  }
+  throw new Error(`Base refresh failed: ${failure.message}`);
+}
+async function handleRebaseConflict(failure, options) {
+  const frConfig = options.target.strategy.failureResolution;
+  const maxAttempts = frConfig.failureLimits?.RebaseConflict ?? frConfig.maxAttemptsPerFailure;
+  let attemptNumber = 0;
+  let currentFailure = failure;
+  while (attemptNumber < maxAttempts) {
+    attemptNumber++;
+    const packet = constructFailureResolutionPacket(currentFailure, {
+      stageName: "baseRefresh",
+      attemptNumber,
+      worktreePath: options.worktreePath,
+      branchName: options.branchName,
+      baseBranch: options.effectiveBaseBranch,
+      maxAttempts,
+      allowedDecisions: ["RETRY_STAGE", "HANDOFF_TO_HUMAN", "FAIL_RUN"],
+      artifactTarget: `.pourkit/.tmp/failure-resolution/attempt-${attemptNumber}.md`
+    });
+    const result = await runFailureResolutionAgent({
+      executionProvider: options.executionProvider,
+      config: options.config,
+      target: options.target,
+      failure: currentFailure,
+      packet,
+      worktreePath: options.worktreePath,
+      repoRoot: options.repoRoot,
+      logger: options.logger,
+      ...options.memory ? { memory: options.memory } : {}
+    });
+    if (result.status === "handoff") {
+      writeFailureState(options, result.reason);
+      await options.transitionIssueToFailureState(result.reason);
+      throw new Error(result.reason);
+    }
+    if (result.status === "fail-run") {
+      writeFailureState(options, result.reason);
+      throw new Error(result.reason);
+    }
+    const changedPaths = packet.conflictedPaths ?? currentFailure.conflictedPaths;
+    const markersRemain = await hasUnresolvedConflictMarkers(
+      options.worktreePath,
+      changedPaths
+    );
+    if (markersRemain) {
+      const message2 = "Conflict resolution agent resolved artifact but conflict markers remain in files";
+      writeFailureState(options, message2);
+      await options.transitionIssueToFailureState(message2);
+      throw new Error(message2);
+    }
+    await execCapture("git", ["add", ...changedPaths], {
+      cwd: options.worktreePath,
+      logger: options.logger,
+      label: "git add conflicted paths"
+    });
+    try {
+      await execCapture("git", ["rebase", "--continue"], {
+        cwd: options.worktreePath,
+        env: { ...process.env, GIT_EDITOR: "true" },
+        logger: options.logger,
+        label: "git rebase --continue"
+      });
+      if (options.worktreeState?.completedStages.builder) {
+        const invalidatedState = invalidateAfterBaseRefresh(
+          options.worktreeState
+        );
+        writeWorktreeRunState(options.worktreePath, invalidatedState);
+      }
+      return;
+    } catch {
+      const statusResult = await execCapture("git", ["status", "--porcelain"], {
+        cwd: options.worktreePath,
+        logger: options.logger,
+        label: "git status"
+      });
+      const newConflictedPaths = statusResult.stdout.split("\n").filter((line) => /^(AA|DD|UU|AU|UA|DU|UD)\s/.test(line)).map((line) => line.slice(3).trim()).filter(Boolean);
+      if (newConflictedPaths.length === 0) {
+        const message2 = "git rebase --continue failed with no remaining conflicts";
+        writeFailureState(options, message2);
+        await options.transitionIssueToFailureState(message2);
+        throw new Error(message2);
+      }
+      currentFailure = new RebaseConflict({
+        conflictedPaths: newConflictedPaths,
+        message: `Rebase conflict in: ${newConflictedPaths.join(", ")}`
+      });
+    }
+  }
+  const message = `Base refresh recovery exhausted after ${maxAttempts} attempts`;
+  writeFailureState(options, message);
+  await options.transitionIssueToFailureState(message);
+  throw new Error(message);
+}
+async function handlePublishedHistoryRisk(failure, options) {
+  const message = `Cannot auto-refresh published history: PR #${failure.prNumber} (${failure.prState}) exists for branch ${options.branchName}`;
+  writeFailureState(options, message);
+  await options.transitionIssueToFailureState(message);
+  throw new Error(message);
+}
+function writeConflictHandoffState(options, failure) {
+  const message = `Base refresh conflict detected. Handing off to human: ${failure.message}`;
+  if (options.worktreeState) {
+    updateWorktreeRunState(options.worktreePath, {
+      lastFailure: { stage: "baseRefresh", message }
+    });
+  } else {
+    writeWorktreeRunState(options.worktreePath, {
+      issueNumber: options.issueNumber,
+      targetName: options.target.name,
+      branchName: options.branchName,
+      baseBranch: options.effectiveBaseBranch,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      completedStages: {},
+      review: { lifetimeIterations: 0 },
+      lastFailure: { stage: "baseRefresh", message }
+    });
+  }
+}
+function writeFailureState(options, message) {
+  if (options.worktreeState) {
+    updateWorktreeRunState(options.worktreePath, {
+      lastFailure: { stage: "baseRefresh", message }
+    });
+  } else {
+    writeWorktreeRunState(options.worktreePath, {
+      issueNumber: options.issueNumber,
+      targetName: options.target.name,
+      branchName: options.branchName,
+      baseBranch: options.effectiveBaseBranch,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      completedStages: {},
+      review: { lifetimeIterations: 0 },
+      lastFailure: { stage: "baseRefresh", message }
+    });
+  }
+}
 
 // serena/baseline.ts
 init_common();
@@ -4220,310 +4654,62 @@ function sidecarOptions(paths, mcpUrl) {
     image: SERENA_IMAGE,
     mcpUrl
   };
-}
-async function canReachMcp(url) {
-  for (let attempt = 0; attempt < 10; attempt += 1) {
-    try {
-      await fetch(url, { method: "GET", signal: AbortSignal.timeout(500) });
-      return true;
-    } catch {
-      if (attempt < 9) {
-        await new Promise((resolve5) => setTimeout(resolve5, 100));
-      }
-    }
-  }
-  return false;
-}
-function formatError(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-async function prepareSerenaForTarget(options) {
-  if (!options.enabled) {
-    return { enabled: false };
-  }
-  try {
-    const paths = await ensureBaselineWorktree({
-      repoRoot: options.repoRoot,
-      dataDir: options.dataDir
-    });
-    await prepareSerenaSidecarConfig({
-      baselineWorktreePath: paths.baselineWorktreePath,
-      dataDir: paths.dataDir
-    });
-    const status = options.autoStart ? await startSerenaSidecar(sidecarOptions(paths, options.mcpUrl)) : await getSerenaSidecarStatus(sidecarOptions(paths, options.mcpUrl));
-    const mcpReachable = await canReachMcp(options.mcpUrl);
-    if (!mcpReachable) {
-      return {
-        enabled: true,
-        available: false,
-        error: status.running ? `Serena MCP is not reachable at ${options.mcpUrl}` : `Serena sidecar is not running for target ${options.targetName}`
-      };
-    }
-    await refreshSerenaBaseline({
-      repoRoot: options.repoRoot,
-      dataDir: options.dataDir,
-      baseBranch: options.baseBranch
-    });
-    return {
-      enabled: true,
-      available: true,
-      mcpUrl: options.mcpUrl
-    };
-  } catch (error) {
-    return {
-      enabled: true,
-      available: false,
-      error: formatError(error)
-    };
-  }
-}
-
-// failure-resolution/failure-resolution-agent.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { join as join9 } from "path";
-
-// failure-resolution/recovery-policy.ts
-function isSecuritySensitiveFailure(failure) {
-  return failure instanceof PublishedHistoryRisk || failure instanceof SafetyFailure;
-}
-async function evaluateRecoveryPolicy(params) {
-  if (isSecuritySensitiveFailure(params.failure)) {
-    return {
-      decision: "HANDOFF_TO_HUMAN",
-      reason: "Security-sensitive failure \u2014 AI recovery bypassed"
-    };
-  }
-  if (params.failure instanceof ConfigFailure) {
-    if (params.agentRecommendedDecision !== "FAIL_RUN" && params.agentRecommendedDecision !== "HANDOFF_TO_HUMAN") {
-      return {
-        decision: "HANDOFF_TO_HUMAN",
-        reason: `ConfigFailure \u2014 agent recommended ${params.agentRecommendedDecision} but config errors are not AI-repairable`
-      };
-    }
-  }
-  const budget = recoveryBudgetForFailure(
-    params.worktreePath,
-    params.fingerprint,
-    params.maxAttempts
-  );
-  if (budget.exhausted) {
-    return {
-      decision: "HANDOFF_TO_HUMAN",
-      reason: `Recovery budget exhausted (${budget.used}/${params.maxAttempts})`
-    };
-  }
-  if (!params.allowedDecisions.includes(params.agentRecommendedDecision)) {
-    return {
-      decision: "HANDOFF_TO_HUMAN",
-      reason: `Agent recommended ${params.agentRecommendedDecision} which is not allowed`
-    };
-  }
-  if (params.agentRecommendedDecision === "FAIL_RUN") {
-    return { decision: "FAIL_RUN", reason: "Agent recommended FAIL_RUN" };
-  }
-  return {
-    decision: params.agentRecommendedDecision,
-    reason: "Agent recommendation accepted"
-  };
-}
-
-// failure-resolution/failure-resolution-agent.ts
-function constructFailureResolutionPacket(failure, context) {
-  return {
-    failureType: failure._tag,
-    stageName: context.stageName,
-    attemptNumber: context.attemptNumber,
-    worktreePath: context.worktreePath,
-    branchName: context.branchName,
-    baseBranch: context.baseBranch,
-    conflictedPaths: failure instanceof RebaseConflict ? failure.conflictedPaths : void 0,
-    failureSummary: failure.message,
-    maxAttempts: context.maxAttempts,
-    allowedDecisions: context.allowedDecisions,
-    artifactTarget: context.artifactTarget
-  };
-}
-async function runFailureResolutionAgent(options) {
-  const {
-    executionProvider,
-    config,
-    target,
-    failure,
-    packet,
-    worktreePath,
-    repoRoot: repoRoot2,
-    logger
-  } = options;
-  const frConfig = target.strategy.failureResolution;
-  const artifactPath = packet.artifactTarget;
-  const fullArtifactPath = join9(worktreePath, artifactPath);
-  const fingerprint = computeFailureFingerprint(packet.stageName, failure._tag);
-  const prompt = [
-    `# Failure Resolution: ${packet.failureType}`,
-    "",
-    "## Failure Context",
-    "",
-    "```json",
-    JSON.stringify(packet, null, 2),
-    "```",
-    "",
-    "## Instructions",
-    "",
-    `Write your resolution to: ${artifactPath}`,
-    "Include a ```json block with: recoveryDecision, summary, changedFiles, verificationSummary (optional), verificationCommands (optional), notes (optional).",
-    "",
-    "Allowed decisions: " + packet.allowedDecisions.join(", "),
-    "",
-    `Before handoff, run: pourkit validate-artifact failure-resolution ${artifactPath} ${packet.allowedDecisions.map((decision) => `--allowed-decision ${decision}`).join(" ")}`
-  ].join("\n");
-  const retryResult = await executeWithMissingOrEmptyArtifactRetry({
-    executionProvider,
-    missingOrEmptyRetries: resolveMissingOrEmptyOutputRetries(frConfig),
-    executionOptions: {
-      stage: "failureResolution",
-      agent: frConfig.agent,
-      model: frConfig.model,
-      variant: frConfig.variant,
-      env: frConfig.env,
-      prompt,
-      target,
-      repoRoot: repoRoot2,
-      branchName: packet.branchName,
-      sandbox: config.sandbox,
-      autoApprove: true,
-      worktreePath,
-      artifactPath,
-      artifacts: [],
-      ...options.memory ? { memory: options.memory } : {},
-      logger
-    }
-  });
-  const executionResult = retryResult.executionResult;
-  if (!executionResult.success) {
-    await writeRecoveryAttempt(
-      worktreePath,
-      "failure",
-      fingerprint,
-      `Agent execution failed: ${executionResult.error}`,
-      void 0,
-      "HANDOFF_TO_HUMAN",
-      packet.stageName
-    );
-    return {
-      status: "handoff",
-      decision: "HANDOFF_TO_HUMAN",
-      reason: `Agent execution failed: ${executionResult.error}`
-    };
-  }
-  if (retryResult.artifact._tag !== "content") {
-    const reason = retryResult.artifact._tag === "empty" ? "Agent wrote empty artifact" : "Agent did not write artifact";
-    await writeRecoveryAttempt(
-      worktreePath,
-      "failure",
-      fingerprint,
-      reason,
-      void 0,
-      "HANDOFF_TO_HUMAN",
-      packet.stageName
-    );
-    return {
-      status: "handoff",
-      decision: "HANDOFF_TO_HUMAN",
-      reason
-    };
-  }
-  let artifact;
-  try {
-    const md = readFileSync10(fullArtifactPath, "utf-8");
-    const validation2 = validateAgentArtifact({
-      kind: "failure-resolution",
-      artifactPath: fullArtifactPath,
-      allowedDecisions: [...packet.allowedDecisions]
-    });
-    if (!validation2.ok) {
-      throw new Error(validation2.reason);
-    }
-    artifact = parseRecoveryArtifact(md, artifactPath);
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : "Failed to parse artifact";
-    await writeRecoveryAttempt(
-      worktreePath,
-      "failure",
-      fingerprint,
-      reason,
-      void 0,
-      "HANDOFF_TO_HUMAN",
-      packet.stageName
-    );
-    return { status: "handoff", decision: "HANDOFF_TO_HUMAN", reason };
-  }
-  const validation = validateRecoveryDecision(
-    artifact,
-    packet.allowedDecisions
-  );
-  if (!validation.valid) {
-    await writeRecoveryAttempt(
-      worktreePath,
-      "failure",
-      fingerprint,
-      validation.reason,
-      void 0,
-      "HANDOFF_TO_HUMAN",
-      packet.stageName
-    );
-    return {
-      status: "handoff",
-      decision: "HANDOFF_TO_HUMAN",
-      reason: validation.reason
-    };
+}
+async function canReachMcp(url) {
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    try {
+      await fetch(url, { method: "GET", signal: AbortSignal.timeout(500) });
+      return true;
+    } catch {
+      if (attempt < 9) {
+        await new Promise((resolve5) => setTimeout(resolve5, 100));
+      }
+    }
   }
-  const policyResult = await evaluateRecoveryPolicy({
-    failure,
-    worktreePath,
-    fingerprint,
-    maxAttempts: packet.maxAttempts,
-    agentRecommendedDecision: validation.decision,
-    allowedDecisions: packet.allowedDecisions
-  });
-  await writeRecoveryAttempt(
-    worktreePath,
-    policyResult.decision === "HANDOFF_TO_HUMAN" ? "handoff" : policyResult.decision === "FAIL_RUN" ? "failure" : "success",
-    fingerprint,
-    policyResult.reason,
-    artifactPath,
-    policyResult.decision,
-    packet.stageName
-  );
-  if (policyResult.decision === "HANDOFF_TO_HUMAN") {
+  return false;
+}
+function formatError(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function prepareSerenaForTarget(options) {
+  if (!options.enabled) {
+    return { enabled: false };
+  }
+  try {
+    const paths = await ensureBaselineWorktree({
+      repoRoot: options.repoRoot,
+      dataDir: options.dataDir
+    });
+    await prepareSerenaSidecarConfig({
+      baselineWorktreePath: paths.baselineWorktreePath,
+      dataDir: paths.dataDir
+    });
+    const status = options.autoStart ? await startSerenaSidecar(sidecarOptions(paths, options.mcpUrl)) : await getSerenaSidecarStatus(sidecarOptions(paths, options.mcpUrl));
+    const mcpReachable = await canReachMcp(options.mcpUrl);
+    if (!mcpReachable) {
+      return {
+        enabled: true,
+        available: false,
+        error: status.running ? `Serena MCP is not reachable at ${options.mcpUrl}` : `Serena sidecar is not running for target ${options.targetName}`
+      };
+    }
+    await refreshSerenaBaseline({
+      repoRoot: options.repoRoot,
+      dataDir: options.dataDir,
+      baseBranch: options.baseBranch
+    });
     return {
-      status: "handoff",
-      decision: "HANDOFF_TO_HUMAN",
-      reason: policyResult.reason
+      enabled: true,
+      available: true,
+      mcpUrl: options.mcpUrl
     };
-  }
-  if (policyResult.decision === "FAIL_RUN") {
+  } catch (error) {
     return {
-      status: "fail-run",
-      decision: "FAIL_RUN",
-      reason: policyResult.reason
+      enabled: true,
+      available: false,
+      error: formatError(error)
     };
   }
-  return {
-    status: "recovered",
-    decision: policyResult.decision,
-    artifact
-  };
-}
-async function writeRecoveryAttempt(worktreePath, outcome, fingerprint, summary, artifactRef, decision, stageName = "baseRefresh") {
-  writeAttemptLog(worktreePath, {
-    attemptType: "recovery",
-    fingerprint,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    stage: stageName,
-    outcome,
-    artifactRef,
-    decision: decision ?? (outcome === "handoff" ? "HANDOFF_TO_HUMAN" : outcome === "success" ? "RETRY_STAGE" : void 0)
-  });
 }
 
 // commands/pr-description-agent.ts
@@ -5759,59 +5945,188 @@ async function runIssueFinalReviewAgent(options) {
       verificationPassed: parsed.verification?.passed === true
     };
   }
-  if (verdict === "needs_human_review") {
-    return {
-      verdict: "needs_human_review",
-      artifactPath,
-      needsHumanReason: parsed.needsHumanReason,
-      selfRetouched: parsed.selfRetouched === true,
-      changedPaths: extractChangedPaths(parsed)
-    };
+  if (verdict === "needs_human_review") {
+    return {
+      verdict: "needs_human_review",
+      artifactPath,
+      needsHumanReason: parsed.needsHumanReason,
+      selfRetouched: parsed.selfRetouched === true,
+      changedPaths: extractChangedPaths(parsed)
+    };
+  }
+  throw new Error(
+    `Unknown Issue Final Review verdict: ${JSON.stringify(verdict)}`
+  );
+}
+function extractChangedPaths(parsed) {
+  return Array.isArray(parsed.changedFiles) ? parsed.changedFiles.map(
+    (file) => file && typeof file === "object" ? file.path : void 0
+  ).filter((path9) => typeof path9 === "string") : [];
+}
+function loadIssueFinalReviewPrompt(options) {
+  const { repoRoot: repoRoot2, promptTemplate, validationCommand } = options;
+  const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
+  const promptBody = existsSync11(promptPath) ? readFileSync13(promptPath, "utf-8") : promptTemplate;
+  return appendProtectedWorkGuidance(`${promptBody}
+
+## Shared Run Context
+
+Read the selected issue requirements, planning context (including plan and PRD content when present), comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
+
+## Initial Verification Pass
+
+- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
+- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
+- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
+- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
+- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
+- If no verification commands are configured, note that and proceed with normal review.
+
+## Changed Files Audit
+
+- Read the Branch section of ${RUN_CONTEXT_PATH_IN_WORKTREE} and use its Canonical Base Ref for the changed-file inventory.
+- Before writing \`changedFiles\`, run \`git diff-index --name-only <canonical-base-ref> --\` from the Worktree to enumerate tracked files changed by the Issue.
+- Also run \`git ls-files --others --exclude-standard\` from the Worktree to enumerate untracked files changed by the Issue.
+- Treat the union of those command outputs, excluding only \`.pourkit/.tmp/**\`, \`.pourkit/logs/**\`, and \`.pourkit/state.json\`, as the required \`changedFiles\` inventory.
+- Include every file from that inventory in \`changedFiles\`, including generated files, managed operating assets, docs, prompts, schema files, and large batches.
+- If any file from the inventory is out-of-scope, mark it \`out-of-scope\` and either self-retouch it away or return \`needs_human_review\`; do not omit it.
+- Do not return \`pass\` until \`changedFiles\` covers the full inventory.
+
+## Required Artifact Validation
+
+- Before handoff, run exactly: \`${validationCommand}\`
+- This validation checks both the artifact shape and \`changedFiles\` coverage against the canonical Git diff.
+- If validation fails, fix the artifact or safely retouch the worktree as needed, then rerun the same command.
+- Do not finish until the validation command passes.`);
+}
+
+// issues/issue-worktree-resolution.ts
+init_common();
+import { join as join14 } from "path";
+async function resolveIssueWorktree(root, branchName, baseBranch, logger) {
+  const worktreeList = await execCapture(
+    "git",
+    ["worktree", "list", "--porcelain"],
+    {
+      cwd: root,
+      logger,
+      label: "git worktree list"
+    }
+  );
+  const existingWorktreePath = resolveRegisteredIssueWorktreePath(
+    worktreeList.stdout,
+    root,
+    branchName
+  );
+  if (existingWorktreePath) {
+    const baseRef2 = await syncTargetBranch(root, baseBranch, logger);
+    return {
+      mode: "existing-worktree",
+      branchName,
+      baseRef: baseRef2,
+      worktreePath: existingWorktreePath
+    };
+  }
+  let branchExists = false;
+  try {
+    await execCapture(
+      "git",
+      ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
+      {
+        cwd: root,
+        logger,
+        label: "git branch exists"
+      }
+    );
+    branchExists = true;
+  } catch {
+  }
+  if (branchExists) {
+    const worktreePath = issueWorktreePath(root, branchName);
+    await execCapture("git", ["worktree", "add", worktreePath, branchName], {
+      cwd: root,
+      logger,
+      label: "git worktree add"
+    });
+    const baseRef2 = await syncTargetBranch(root, baseBranch, logger);
+    return {
+      mode: "existing-branch",
+      branchName,
+      baseRef: baseRef2,
+      worktreePath
+    };
+  }
+  const baseRef = await syncTargetBranch(root, baseBranch, logger);
+  return { mode: "new", branchName, baseRef };
+}
+function issueWorktreePath(root, branchName) {
+  return join14(root, ".sandcastle", "worktrees", branchName.replace(/\//g, "-"));
+}
+function resolveRegisteredIssueWorktreePath(worktreeListPorcelain, root, branchName) {
+  const branchWorktreePath = parseWorktreeListPorcelain(
+    worktreeListPorcelain,
+    branchName
+  );
+  if (branchWorktreePath) return branchWorktreePath;
+  const expectedWorktreePath = issueWorktreePath(root, branchName);
+  const entries = worktreeListPorcelain.trim().split("\n\n");
+  for (const entry of entries) {
+    if (entry.trim().split("\n").some((line) => line === `worktree ${expectedWorktreePath}`)) {
+      return expectedWorktreePath;
+    }
+  }
+  return null;
+}
+async function syncTargetBranch(root, baseBranch, logger) {
+  logger.step("git", `syncing target branch: ${baseBranch}`);
+  await execCapture("git", ["fetch", "origin", baseBranch], {
+    cwd: root,
+    logger,
+    label: "git fetch target"
+  });
+  return `origin/${baseBranch}`;
+}
+async function resetIssueWorktree(root, branchName, logger) {
+  const worktreeList = await execCapture(
+    "git",
+    ["worktree", "list", "--porcelain"],
+    { cwd: root, logger, label: "git worktree list" }
+  );
+  const existingWorktreePath = resolveRegisteredIssueWorktreePath(
+    worktreeList.stdout,
+    root,
+    branchName
+  );
+  if (existingWorktreePath) {
+    logger.step("git", `removing existing worktree: ${existingWorktreePath}`);
+    await execCapture(
+      "git",
+      ["worktree", "remove", "--force", existingWorktreePath],
+      {
+        cwd: root,
+        logger,
+        label: "git worktree remove"
+      }
+    );
+  }
+  let branchExists = false;
+  try {
+    await execCapture(
+      "git",
+      ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
+      { cwd: root, logger, label: "git branch exists" }
+    );
+    branchExists = true;
+  } catch {
+  }
+  if (branchExists) {
+    logger.step("git", `deleting local branch: ${branchName}`);
+    await execCapture("git", ["branch", "-D", branchName], {
+      cwd: root,
+      logger,
+      label: "git branch -D"
+    });
   }
-  throw new Error(
-    `Unknown Issue Final Review verdict: ${JSON.stringify(verdict)}`
-  );
-}
-function extractChangedPaths(parsed) {
-  return Array.isArray(parsed.changedFiles) ? parsed.changedFiles.map(
-    (file) => file && typeof file === "object" ? file.path : void 0
-  ).filter((path9) => typeof path9 === "string") : [];
-}
-function loadIssueFinalReviewPrompt(options) {
-  const { repoRoot: repoRoot2, promptTemplate, validationCommand } = options;
-  const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
-  const promptBody = existsSync11(promptPath) ? readFileSync13(promptPath, "utf-8") : promptTemplate;
-  return appendProtectedWorkGuidance(`${promptBody}
-
-## Shared Run Context
-
-Read the selected issue requirements, planning context (including plan and PRD content when present), comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}
-
-## Initial Verification Pass
-
-- First read ${RUN_CONTEXT_PATH_IN_WORKTREE} only far enough to identify the configured verification commands.
-- Before reviewing code, diffs, artifacts, or prior findings, run each configured verification command yourself from the Worktree.
-- Run the commands exactly as configured. Do not substitute narrower commands unless the configured command cannot run.
-- If a configured command fails, keep reviewing after recording the failure details; use the failure output as review evidence.
-- If a command cannot run because the environment is missing required setup, dependencies, or scripts outside agent control, treat it as a human handoff blocker.
-- If no verification commands are configured, note that and proceed with normal review.
-
-## Changed Files Audit
-
-- Read the Branch section of ${RUN_CONTEXT_PATH_IN_WORKTREE} and use its Canonical Base Ref for the changed-file inventory.
-- Before writing \`changedFiles\`, run \`git diff-index --name-only <canonical-base-ref> --\` from the Worktree to enumerate tracked files changed by the Issue.
-- Also run \`git ls-files --others --exclude-standard\` from the Worktree to enumerate untracked files changed by the Issue.
-- Treat the union of those command outputs, excluding only \`.pourkit/.tmp/**\`, \`.pourkit/logs/**\`, and \`.pourkit/state.json\`, as the required \`changedFiles\` inventory.
-- Include every file from that inventory in \`changedFiles\`, including generated files, managed operating assets, docs, prompts, schema files, and large batches.
-- If any file from the inventory is out-of-scope, mark it \`out-of-scope\` and either self-retouch it away or return \`needs_human_review\`; do not omit it.
-- Do not return \`pass\` until \`changedFiles\` covers the full inventory.
-
-## Required Artifact Validation
-
-- Before handoff, run exactly: \`${validationCommand}\`
-- This validation checks both the artifact shape and \`changedFiles\` coverage against the canonical Git diff.
-- If validation fails, fix the artifact or safely retouch the worktree as needed, then rerun the same command.
-- Do not finish until the validation command passes.`);
 }
 
 // commands/issue-run.ts
@@ -5891,7 +6206,7 @@ async function advanceIssueFinalReview(options) {
         "Issue Final Review state is incomplete: missing artifactPath"
       );
     }
-    const artifactPath = isAbsolute4(ifrFromState.artifactPath) ? ifrFromState.artifactPath : join14(worktreePath, ifrFromState.artifactPath);
+    const artifactPath = isAbsolute4(ifrFromState.artifactPath) ? ifrFromState.artifactPath : join15(worktreePath, ifrFromState.artifactPath);
     const validation = validateAgentArtifact({
       kind: "issue-final-review",
       artifactPath,
@@ -6014,7 +6329,7 @@ async function startIssueRun(options) {
         `Cannot reset worktree: open PR #${existingPr.number} exists for branch ${branchName}. Close the PR first or omit --reset-worktree.`
       );
     }
-    await resetLocalBranchState(ROOT, branchName, logger);
+    await resetIssueWorktree(ROOT, branchName, logger);
     await syncTargetBranch(ROOT, effectiveBaseBranch, logger);
   }
   const prompt = loadBuilderPrompt(
@@ -6027,98 +6342,32 @@ async function startIssueRun(options) {
     effectiveBaseBranch,
     logger
   );
-  const worktreeState = resolution.worktreePath ? readWorktreeRunState(resolution.worktreePath) : null;
+  let worktreeState = resolution.worktreePath ? readWorktreeRunState(resolution.worktreePath) : null;
   if (resolution.mode !== "new") {
-    const existingPr = await prProvider.getPr(branchName);
-    const exit = await runBaseRefreshAttempt({
+    await runIssueBaseRefresh({
       worktreePath: resolution.worktreePath,
-      baseBranch: effectiveBaseBranch,
-      localGitBaseRef: resolution.baseRef,
+      branchName,
+      baseRef: resolution.baseRef,
+      effectiveBaseBranch,
+      target: effectiveTarget,
+      config,
+      issueNumber,
+      prProvider,
+      issueProvider,
+      executionProvider,
+      repoRoot: ROOT,
+      worktreeState,
       logger,
-      prNumber: existingPr?.number,
-      prState: existingPr?.state
+      memory: memoryExecutionContext,
+      transitionIssueToFailureState: (reason) => transitionIssueToFailureState(
+        issueProvider,
+        issueNumber,
+        config,
+        reason,
+        logger
+      )
     });
-    if (Exit3.isSuccess(exit)) {
-      const refreshResult = exit.value;
-      if (refreshResult.status === "refreshed") {
-        if (worktreeState?.completedStages.builder) {
-          const invalidatedState = invalidateAfterBaseRefresh(worktreeState);
-          writeWorktreeRunState(resolution.worktreePath, invalidatedState);
-        }
-      }
-    } else {
-      const cause = exit.cause;
-      if (cause._tag === "Fail") {
-        const failure = cause.error;
-        if (failure instanceof RebaseConflict) {
-          if (strategy.failureResolution && resolution.worktreePath) {
-            await handleRebaseConflict(failure, {
-              worktreePath: resolution.worktreePath,
-              branchName,
-              target,
-              config,
-              issueNumber,
-              issueProvider,
-              executionProvider,
-              repoRoot: ROOT,
-              worktreeState,
-              logger,
-              memory: memoryExecutionContext
-            });
-          } else {
-            if (resolution.worktreePath) {
-              if (worktreeState) {
-                updateWorktreeRunState(resolution.worktreePath, {
-                  lastFailure: {
-                    stage: "baseRefresh",
-                    message: `Base refresh conflict detected. Handing off to human: ${failure.message}`
-                  }
-                });
-              } else {
-                writeWorktreeRunState(resolution.worktreePath, {
-                  issueNumber,
-                  targetName: target.name,
-                  branchName,
-                  baseBranch: effectiveBaseBranch,
-                  createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-                  updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                  completedStages: {},
-                  review: { lifetimeIterations: 0 },
-                  lastFailure: {
-                    stage: "baseRefresh",
-                    message: `Base refresh conflict detected. Handing off to human: ${failure.message}`
-                  }
-                });
-              }
-            }
-            await transitionIssueToFailureState(
-              issueProvider,
-              issueNumber,
-              config,
-              `Base refresh conflicted: ${failure.message}. Worktree preserved at ${resolution.worktreePath}.`,
-              logger
-            );
-            throw new Error(`Base refresh conflicted: ${failure.message}`);
-          }
-        } else if (failure instanceof PublishedHistoryRisk) {
-          await handlePublishedHistoryRisk(failure, {
-            worktreePath: resolution.worktreePath,
-            branchName,
-            target,
-            config,
-            issueNumber,
-            issueProvider,
-            worktreeState,
-            logger
-          });
-        } else {
-          throw new Error(`Base refresh failed: ${failure.message}`);
-        }
-      } else {
-        const defectMessage = cause._tag === "Die" ? `Base refresh failed with unexpected error: ${cause.defect}` : `Base refresh failed with unhandled cause: ${cause._tag}`;
-        throw new Error(defectMessage);
-      }
-    }
+    worktreeState = resolution.worktreePath ? readWorktreeRunState(resolution.worktreePath) : null;
   }
   const runContextArtifact = buildRunContextArtifact({
     issue,
@@ -6611,181 +6860,56 @@ function makeIssueTransitions2(provider, config) {
 }
 async function transitionIssueToFailureState(provider, issueNumber, config, errorMessage, logger) {
   const transitions = makeIssueTransitions2(provider, config);
-  await transitions.moveToReadyForHuman(issueNumber);
-  logger.step(
-    "error",
-    `Issue ${issueNumber} transitioned to ${config.labels.readyForHuman}: ${errorMessage}`
-  );
-}
-async function hasWorktreeChanges(worktreePath, baseRef, logger) {
-  const diffResult = await execCapture(
-    "git",
-    ["diff", "--name-only", baseRef, "--"],
-    {
-      cwd: worktreePath,
-      logger,
-      label: "git diff --name-only"
-    }
-  );
-  if (diffResult.stdout.trim().length > 0) {
-    return true;
-  }
-  const statusResult = await execCapture(
-    "git",
-    ["status", "--porcelain", "--untracked-files=all"],
-    {
-      cwd: worktreePath,
-      logger,
-      label: "git status --porcelain"
-    }
-  );
-  return statusResult.stdout.trim().length > 0;
-}
-async function closeNoOpIssue(provider, issueNumber, config, logger) {
-  const transitions = makeIssueTransitions2(provider, config);
-  let closeSucceeded = false;
-  try {
-    await transitions.closeCompleted(issueNumber);
-    closeSucceeded = true;
-    logger.step("info", `Issue #${issueNumber} closed (no changes required)`);
-  } catch (error) {
-    logger.step(
-      "warn",
-      `Issue #${issueNumber} could not be closed: ${error instanceof Error ? error.message : String(error)}`
-    );
-    logger.step(
-      "info",
-      `Issue #${issueNumber} completed with no changes required`
-    );
-  }
-  if (closeSucceeded) {
-    await maybeCloseParentAfterChildCompletion(provider, issueNumber, logger);
-  }
-}
-async function resetLocalBranchState(root, branchName, logger) {
-  const worktreeList = await execCapture(
-    "git",
-    ["worktree", "list", "--porcelain"],
-    { cwd: root, logger, label: "git worktree list" }
-  );
-  const existingWorktreePath = resolveRegisteredIssueWorktreePath(
-    worktreeList.stdout,
-    root,
-    branchName
-  );
-  if (existingWorktreePath) {
-    logger.step("git", `removing existing worktree: ${existingWorktreePath}`);
-    await execCapture(
-      "git",
-      ["worktree", "remove", "--force", existingWorktreePath],
-      {
-        cwd: root,
-        logger,
-        label: "git worktree remove"
-      }
-    );
-  }
-  let branchExists = false;
-  try {
-    await execCapture(
-      "git",
-      ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
-      { cwd: root, logger, label: "git branch exists" }
-    );
-    branchExists = true;
-  } catch {
-  }
-  if (branchExists) {
-    logger.step("git", `deleting local branch: ${branchName}`);
-    await execCapture("git", ["branch", "-D", branchName], {
-      cwd: root,
-      logger,
-      label: "git branch -D"
-    });
-  }
-}
-async function resolveIssueWorktree(root, branchName, baseBranch, logger) {
-  const worktreeList = await execCapture(
-    "git",
-    ["worktree", "list", "--porcelain"],
-    {
-      cwd: root,
-      logger,
-      label: "git worktree list"
-    }
-  );
-  const existingWorktreePath = resolveRegisteredIssueWorktreePath(
-    worktreeList.stdout,
-    root,
-    branchName
-  );
-  if (existingWorktreePath) {
-    const baseRef2 = await syncTargetBranch(root, baseBranch, logger);
-    return {
-      mode: "existing-worktree",
-      branchName,
-      baseRef: baseRef2,
-      worktreePath: existingWorktreePath
-    };
-  }
-  let branchExists = false;
-  try {
-    await execCapture(
-      "git",
-      ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`],
-      {
-        cwd: root,
-        logger,
-        label: "git branch exists"
-      }
-    );
-    branchExists = true;
-  } catch {
-  }
-  if (branchExists) {
-    const worktreePath = issueWorktreePath(root, branchName);
-    await execCapture("git", ["worktree", "add", worktreePath, branchName], {
-      cwd: root,
-      logger,
-      label: "git worktree add"
-    });
-    const baseRef2 = await syncTargetBranch(root, baseBranch, logger);
-    return {
-      mode: "existing-branch",
-      branchName,
-      baseRef: baseRef2,
-      worktreePath
-    };
-  }
-  const baseRef = await syncTargetBranch(root, baseBranch, logger);
-  return { mode: "new", branchName, baseRef };
-}
-function issueWorktreePath(root, branchName) {
-  return join14(root, ".sandcastle", "worktrees", branchName.replace(/\//g, "-"));
-}
-function resolveRegisteredIssueWorktreePath(worktreeListPorcelain, root, branchName) {
-  const branchWorktreePath = parseWorktreeListPorcelain(
-    worktreeListPorcelain,
-    branchName
+  await transitions.moveToReadyForHuman(issueNumber);
+  logger.step(
+    "error",
+    `Issue ${issueNumber} transitioned to ${config.labels.readyForHuman}: ${errorMessage}`
   );
-  if (branchWorktreePath) return branchWorktreePath;
-  const expectedWorktreePath = issueWorktreePath(root, branchName);
-  const entries = worktreeListPorcelain.trim().split("\n\n");
-  for (const entry of entries) {
-    if (entry.trim().split("\n").some((line) => line === `worktree ${expectedWorktreePath}`)) {
-      return expectedWorktreePath;
+}
+async function hasWorktreeChanges(worktreePath, baseRef, logger) {
+  const diffResult = await execCapture(
+    "git",
+    ["diff", "--name-only", baseRef, "--"],
+    {
+      cwd: worktreePath,
+      logger,
+      label: "git diff --name-only"
     }
+  );
+  if (diffResult.stdout.trim().length > 0) {
+    return true;
   }
-  return null;
+  const statusResult = await execCapture(
+    "git",
+    ["status", "--porcelain", "--untracked-files=all"],
+    {
+      cwd: worktreePath,
+      logger,
+      label: "git status --porcelain"
+    }
+  );
+  return statusResult.stdout.trim().length > 0;
 }
-async function syncTargetBranch(root, baseBranch, logger) {
-  logger.step("git", `syncing target branch: ${baseBranch}`);
-  await execCapture("git", ["fetch", "origin", baseBranch], {
-    cwd: root,
-    logger,
-    label: "git fetch target"
-  });
-  return `origin/${baseBranch}`;
+async function closeNoOpIssue(provider, issueNumber, config, logger) {
+  const transitions = makeIssueTransitions2(provider, config);
+  let closeSucceeded = false;
+  try {
+    await transitions.closeCompleted(issueNumber);
+    closeSucceeded = true;
+    logger.step("info", `Issue #${issueNumber} closed (no changes required)`);
+  } catch (error) {
+    logger.step(
+      "warn",
+      `Issue #${issueNumber} could not be closed: ${error instanceof Error ? error.message : String(error)}`
+    );
+    logger.step(
+      "info",
+      `Issue #${issueNumber} completed with no changes required`
+    );
+  }
+  if (closeSucceeded) {
+    await maybeCloseParentAfterChildCompletion(provider, issueNumber, logger);
+  }
 }
 function loadBuilderPrompt(repoRoot2, promptTemplate) {
   const promptPath = resolvePromptTemplatePath(repoRoot2, promptTemplate);
@@ -6796,398 +6920,172 @@ function loadBuilderPrompt(repoRoot2, promptTemplate) {
 
 Read the selected issue requirements, planning context (including plan and PRD content when present), comments, branch context, verification commands, and artifact paths from: ${RUN_CONTEXT_PATH_IN_WORKTREE}`);
 }
-async function handleRebaseConflict(failure, context) {
-  const frConfig = context.target.strategy.failureResolution;
-  if (!frConfig) {
-    await transitionIssueToFailureState(
-      context.issueProvider,
-      context.issueNumber,
-      context.config,
-      "No failureResolution configured",
-      context.logger
-    );
-    throw new Error("Base refresh conflicted: no failureResolution configured");
-  }
-  const maxAttempts = frConfig.failureLimits?.RebaseConflict ?? frConfig.maxAttemptsPerFailure;
-  let attemptNumber = 0;
-  let currentFailure = failure;
-  while (attemptNumber < maxAttempts) {
-    attemptNumber++;
-    const packet = constructFailureResolutionPacket(currentFailure, {
-      stageName: "baseRefresh",
-      attemptNumber,
-      worktreePath: context.worktreePath,
-      branchName: context.branchName,
-      baseBranch: context.target.baseBranch,
-      maxAttempts,
-      allowedDecisions: ["RETRY_STAGE", "HANDOFF_TO_HUMAN", "FAIL_RUN"],
-      artifactTarget: `.pourkit/.tmp/failure-resolution/attempt-${attemptNumber}.md`
-    });
-    const result = await runFailureResolutionAgent({
-      executionProvider: context.executionProvider,
-      config: context.config,
-      target: context.target,
-      failure: currentFailure,
-      packet,
-      worktreePath: context.worktreePath,
-      repoRoot: context.repoRoot,
-      logger: context.logger,
-      ...context.memory ? { memory: context.memory } : {}
-    });
-    if (result.status === "handoff") {
-      if (context.worktreeState) {
-        updateWorktreeRunState(context.worktreePath, {
-          lastFailure: { stage: "baseRefresh", message: result.reason }
-        });
-      } else {
-        writeWorktreeRunState(context.worktreePath, {
-          issueNumber: context.issueNumber,
-          targetName: context.target.name,
-          branchName: context.branchName,
-          baseBranch: context.target.baseBranch,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          completedStages: {},
-          review: { lifetimeIterations: 0 },
-          lastFailure: { stage: "baseRefresh", message: result.reason }
-        });
-      }
-      await transitionIssueToFailureState(
-        context.issueProvider,
-        context.issueNumber,
-        context.config,
-        result.reason,
-        context.logger
-      );
-      throw new Error(result.reason);
-    }
-    if (result.status === "fail-run") {
-      if (context.worktreeState) {
-        updateWorktreeRunState(context.worktreePath, {
-          lastFailure: { stage: "baseRefresh", message: result.reason }
-        });
-      } else {
-        writeWorktreeRunState(context.worktreePath, {
-          issueNumber: context.issueNumber,
-          targetName: context.target.name,
-          branchName: context.branchName,
-          baseBranch: context.target.baseBranch,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          completedStages: {},
-          review: { lifetimeIterations: 0 },
-          lastFailure: { stage: "baseRefresh", message: result.reason }
-        });
-      }
-      throw new Error(result.reason);
-    }
-    const changedPaths = packet.conflictedPaths ?? currentFailure.conflictedPaths;
-    const markersRemain = await hasUnresolvedConflictMarkers(
-      context.worktreePath,
-      changedPaths
-    );
-    if (markersRemain) {
-      const message = "Conflict resolution agent resolved artifact but conflict markers remain in files";
-      if (context.worktreeState) {
-        updateWorktreeRunState(context.worktreePath, {
-          lastFailure: { stage: "baseRefresh", message }
-        });
-      } else {
-        writeWorktreeRunState(context.worktreePath, {
-          issueNumber: context.issueNumber,
-          targetName: context.target.name,
-          branchName: context.branchName,
-          baseBranch: context.target.baseBranch,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          completedStages: {},
-          review: { lifetimeIterations: 0 },
-          lastFailure: { stage: "baseRefresh", message }
-        });
-      }
-      await transitionIssueToFailureState(
-        context.issueProvider,
-        context.issueNumber,
-        context.config,
-        message,
-        context.logger
-      );
-      throw new Error(message);
-    }
-    await execCapture("git", ["add", ...changedPaths], {
-      cwd: context.worktreePath,
-      logger: context.logger,
-      label: "git add conflicted paths"
-    });
-    try {
-      await execCapture("git", ["rebase", "--continue"], {
-        cwd: context.worktreePath,
-        env: { ...process.env, GIT_EDITOR: "true" },
-        logger: context.logger,
-        label: "git rebase --continue"
-      });
-      if (context.worktreeState?.completedStages.builder) {
-        const invalidatedState = invalidateAfterBaseRefresh(
-          context.worktreeState
-        );
-        writeWorktreeRunState(context.worktreePath, invalidatedState);
-      }
-      return;
-    } catch {
-      const statusResult = await execCapture("git", ["status", "--porcelain"], {
-        cwd: context.worktreePath,
-        logger: context.logger,
-        label: "git status"
-      });
-      const newConflictedPaths = statusResult.stdout.split("\n").filter((line) => /^(AA|DD|UU|AU|UA|DU|UD)\s/.test(line)).map((line) => line.slice(3).trim()).filter(Boolean);
-      if (newConflictedPaths.length === 0) {
-        const message = "git rebase --continue failed with no remaining conflicts";
-        if (context.worktreeState) {
-          updateWorktreeRunState(context.worktreePath, {
-            lastFailure: { stage: "baseRefresh", message }
-          });
-        } else {
-          writeWorktreeRunState(context.worktreePath, {
-            issueNumber: context.issueNumber,
-            targetName: context.target.name,
-            branchName: context.branchName,
-            baseBranch: context.target.baseBranch,
-            createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-            updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            completedStages: {},
-            review: { lifetimeIterations: 0 },
-            lastFailure: { stage: "baseRefresh", message }
-          });
-        }
-        await transitionIssueToFailureState(
-          context.issueProvider,
-          context.issueNumber,
-          context.config,
-          message,
-          context.logger
-        );
-        throw new Error(message);
-      }
-      currentFailure = new RebaseConflict({
-        conflictedPaths: newConflictedPaths,
-        message: `Rebase conflict in: ${newConflictedPaths.join(", ")}`
-      });
-    }
-  }
-  if (context.worktreeState) {
-    updateWorktreeRunState(context.worktreePath, {
-      lastFailure: {
-        stage: "baseRefresh",
-        message: `Base refresh recovery exhausted after ${maxAttempts} attempts`
-      }
-    });
-  } else {
-    writeWorktreeRunState(context.worktreePath, {
-      issueNumber: context.issueNumber,
-      targetName: context.target.name,
-      branchName: context.branchName,
-      baseBranch: context.target.baseBranch,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      completedStages: {},
-      review: { lifetimeIterations: 0 },
-      lastFailure: {
-        stage: "baseRefresh",
-        message: `Base refresh recovery exhausted after ${maxAttempts} attempts`
-      }
-    });
-  }
-  await transitionIssueToFailureState(
-    context.issueProvider,
-    context.issueNumber,
-    context.config,
-    `Base refresh recovery exhausted after ${maxAttempts} attempts`,
-    context.logger
-  );
-  throw new Error(
-    `Base refresh recovery exhausted after ${maxAttempts} attempts`
-  );
-}
-async function handlePublishedHistoryRisk(failure, context) {
-  const message = `Cannot auto-refresh published history: PR #${failure.prNumber} (${failure.prState}) exists for branch ${context.branchName}`;
-  if (context.worktreeState) {
-    updateWorktreeRunState(context.worktreePath, {
-      lastFailure: { stage: "baseRefresh", message }
-    });
-  } else {
-    writeWorktreeRunState(context.worktreePath, {
-      issueNumber: context.issueNumber,
-      targetName: context.target.name,
-      branchName: context.branchName,
-      baseBranch: context.target.baseBranch,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      completedStages: {},
-      review: { lifetimeIterations: 0 },
-      lastFailure: { stage: "baseRefresh", message }
-    });
-  }
-  await transitionIssueToFailureState(
-    context.issueProvider,
-    context.issueNumber,
-    context.config,
-    message,
-    context.logger
-  );
-  throw new Error(message);
-}
 
-// commands/issue.ts
-var HumanHandoffStop = class extends Error {
+// issues/issue-run-lifecycle.ts
+var IssueRunHumanHandoffStop = class extends Error {
   constructor(message) {
     super(message);
     this.name = "HumanHandoffStop";
   }
 };
-async function runIssueCommand(options) {
-  const {
-    issueNumber,
-    config,
-    issueProvider,
-    prProvider,
-    executionProvider,
-    logger
-  } = options;
-  const ROOT = options.repoRoot;
-  let executionSession;
+async function runIssueLifecycle(options) {
   try {
-    executionSession = await executionProvider.createSession?.();
-    const runOptions = executionSession ? { ...options, executionProvider: executionSession } : options;
-    const startResult = await startIssueRun(runOptions);
-    const {
-      issue,
-      parentPrdIssue,
-      target,
-      effectiveTarget,
-      branchName,
-      worktreeState,
-      executionResult
-    } = startResult;
+    const startResult = await options.deps.startIssueRun(options.runOptions);
+    const reviewAlreadyPassed = startResult.worktreeState?.review.lastVerdict && !startResult.worktreeState.review.exhaustedPreviousRun && (startResult.worktreeState.review.lastVerdict === "PASS" || startResult.worktreeState.review.lastVerdict === "PASS_WITH_NOTES");
     let reviewArtifactPath;
-    const reviewAlreadyPassed = worktreeState?.review.lastVerdict && ["PASS", "PASS_WITH_NOTES"].includes(worktreeState.review.lastVerdict) && !worktreeState.review.exhaustedPreviousRun;
     if (reviewAlreadyPassed) {
-      reviewArtifactPath = worktreeState.review.lastArtifactPath;
+      reviewArtifactPath = startResult.worktreeState.review.lastArtifactPath;
     } else {
-      const lifetimeIterationsFromState = worktreeState?.review.lifetimeIterations ?? 0;
-      const humanHandoffResolved = worktreeState?.review.lastVerdict === "NEEDS_HUMAN";
-      const reviewResult = await advanceIssueRunReview({
-        executionProvider: runOptions.executionProvider,
-        config,
-        target: effectiveTarget,
-        issue,
-        parentPrdIssue,
-        builderBranch: branchName,
-        worktreePath: executionResult.worktreePath,
-        repoRoot: ROOT,
-        logger,
-        startingLifetimeIteration: lifetimeIterationsFromState,
-        humanHandoffResolved,
+      const reviewResult = await options.deps.advanceIssueRunReview({
+        executionProvider: options.runOptions.executionProvider,
+        config: options.config,
+        target: startResult.effectiveTarget,
+        issue: startResult.issue,
+        parentPrdIssue: startResult.parentPrdIssue,
+        builderBranch: startResult.branchName,
+        worktreePath: startResult.executionResult.worktreePath,
+        repoRoot: options.repoRoot,
+        logger: options.logger,
+        startingLifetimeIteration: startResult.worktreeState?.review.lifetimeIterations ?? 0,
+        humanHandoffResolved: startResult.worktreeState?.review.lastVerdict === "NEEDS_HUMAN",
         serena: startResult.serena,
         memory: startResult.memory
       });
       if (reviewResult.exhaustedMaxIterations) {
         throw new Error(
-          `Max review iterations (${reviewResult.iterations}) exhausted`
+          "Review loop exhausted maximum iterations without passing"
         );
       }
       if (reviewResult.verdict === "FAIL") {
-        throw new Error(`Review failed with FAIL verdict`);
+        const summary = reviewResult.output?.trim() || "no summary provided";
+        throw new Error(`Review loop failed: ${summary}`);
       }
       if (reviewResult.verdict === "NEEDS_HUMAN") {
-        await transitionIssueToHumanHandoff({
-          issueProvider,
-          issueNumber,
-          config,
-          logger,
+        await options.deps.transitionReviewNeedsHumanToHandoff({
+          issueProvider: options.issueProvider,
+          issueNumber: options.issueNumber,
+          config: options.config,
+          logger: options.logger,
           reviewResult
         });
-        throw new HumanHandoffStop(
-          `Review requires human handoff: NEEDS_HUMAN verdict`
+        throw new IssueRunHumanHandoffStop(
+          "Review requires human handoff: NEEDS_HUMAN verdict"
         );
       }
       reviewArtifactPath = reviewResult.artifactPath;
     }
-    const finalReviewResult = await advanceIssueFinalReview({
-      executionProvider: runOptions.executionProvider,
-      config,
-      target: effectiveTarget,
-      issue,
-      parentPrdIssue,
-      builderBranch: branchName,
-      worktreePath: executionResult.worktreePath,
-      repoRoot: ROOT,
-      logger,
+    const finalReviewResult = await options.deps.advanceIssueFinalReview({
+      executionProvider: options.runOptions.executionProvider,
+      config: options.config,
+      target: startResult.effectiveTarget,
+      issue: startResult.issue,
+      parentPrdIssue: startResult.parentPrdIssue,
+      builderBranch: startResult.branchName,
+      worktreePath: startResult.executionResult.worktreePath,
+      repoRoot: options.repoRoot,
+      logger: options.logger,
       reviewArtifactPath,
-      worktreeState,
+      worktreeState: startResult.worktreeState,
       memory: startResult.memory
     });
     if (finalReviewResult.verdict === "needs_human_review") {
-      const transitions = createIssueTransitions(
-        {
-          fetchIssue: issueProvider.fetchIssue.bind(issueProvider),
-          addLabels: issueProvider.addLabels.bind(issueProvider),
-          removeLabel: issueProvider.removeLabel.bind(issueProvider),
-          closeIssue: issueProvider.closeIssue.bind(issueProvider)
-        },
-        {
-          blocked: config.labels.blocked,
-          readyForAgent: config.labels.readyForAgent,
-          needsTriage: config.labels.needsTriage,
-          agentInProgress: config.labels.agentInProgress,
-          readyForHuman: config.labels.readyForHuman,
-          prOpenAwaitingMerge: config.labels.prOpenAwaitingMerge
-        }
-      );
-      await transitions.moveToReadyForHuman(issueNumber);
-      const comment = [
-        "Pourkit stopped the Issue Final Review because human review is needed.",
-        "",
-        finalReviewResult.needsHumanReason,
-        "",
-        "Artifacts:",
-        `- Issue Final Review: ${finalReviewResult.artifactPath}`
-      ].join("\n");
-      await issueProvider.commentIssue(issueNumber, comment);
-      logger.step(
-        "info",
-        `Issue Final Review requires human handoff for issue ${issueNumber}`
-      );
-      throw new HumanHandoffStop(
+      await options.deps.transitionIssueFinalReviewNeedsHumanToHandoff({
+        issueNumber: options.issueNumber,
+        finalReviewResult
+      });
+      throw new IssueRunHumanHandoffStop(
         `Issue Final Review requires human handoff: ${finalReviewResult.needsHumanReason}`
       );
     }
-    return await completeIssueRun({
-      ...runOptions,
+    return await options.deps.completeIssueRun({
+      ...options.runOptions,
       startResult,
       reviewArtifactPath
     });
   } catch (error) {
-    if (error instanceof HumanHandoffStop) {
+    if (error instanceof IssueRunHumanHandoffStop) {
       throw error;
     }
     if (error instanceof Error && "_tag" in error) {
-      await failIssueRun({
-        issueProvider,
-        issueNumber,
-        config,
-        logger,
+      await options.deps.failIssueRun({
+        issueProvider: options.issueProvider,
+        issueNumber: options.issueNumber,
+        config: options.config,
+        logger: options.logger,
         error: `[${error._tag}] ${error.message}`
       });
     } else {
-      await failIssueRun({
-        issueProvider,
-        issueNumber,
-        config,
-        logger,
+      await options.deps.failIssueRun({
+        issueProvider: options.issueProvider,
+        issueNumber: options.issueNumber,
+        config: options.config,
+        logger: options.logger,
         error: error instanceof Error ? error : String(error)
       });
     }
     throw error;
+  }
+}
+
+// commands/issue.ts
+async function runIssueCommand(options) {
+  const { issueNumber, config, issueProvider, executionProvider, logger } = options;
+  const ROOT = options.repoRoot;
+  let executionSession;
+  try {
+    executionSession = await executionProvider.createSession?.();
+    const runOptions = executionSession ? { ...options, executionProvider: executionSession } : options;
+    return await runIssueLifecycle({
+      issueNumber,
+      config,
+      issueProvider,
+      logger,
+      repoRoot: ROOT,
+      runOptions,
+      deps: {
+        startIssueRun,
+        advanceIssueRunReview,
+        advanceIssueFinalReview,
+        completeIssueRun,
+        failIssueRun,
+        transitionReviewNeedsHumanToHandoff: transitionIssueToHumanHandoff,
+        transitionIssueFinalReviewNeedsHumanToHandoff: async ({
+          issueNumber: issueNumber2,
+          finalReviewResult
+        }) => {
+          const transitions = createIssueTransitions(
+            {
+              fetchIssue: issueProvider.fetchIssue.bind(issueProvider),
+              addLabels: issueProvider.addLabels.bind(issueProvider),
+              removeLabel: issueProvider.removeLabel.bind(issueProvider),
+              closeIssue: issueProvider.closeIssue.bind(issueProvider)
+            },
+            {
+              blocked: config.labels.blocked,
+              readyForAgent: config.labels.readyForAgent,
+              needsTriage: config.labels.needsTriage,
+              agentInProgress: config.labels.agentInProgress,
+              readyForHuman: config.labels.readyForHuman,
+              prOpenAwaitingMerge: config.labels.prOpenAwaitingMerge
+            }
+          );
+          await transitions.moveToReadyForHuman(issueNumber2);
+          const comment = [
+            "Pourkit stopped the Issue Final Review because human review is needed.",
+            "",
+            finalReviewResult.needsHumanReason,
+            "",
+            "Artifacts:",
+            `- Issue Final Review: ${finalReviewResult.artifactPath}`
+          ].join("\n");
+          await issueProvider.commentIssue(issueNumber2, comment);
+          logger.step(
+            "info",
+            `Issue Final Review requires human handoff for issue ${issueNumber2}`
+          );
+        }
+      }
+    });
   } finally {
     await executionSession?.close();
   }
@@ -7284,7 +7182,7 @@ async function runIssueCreateCommand(args, issueProvider, logger) {
 
 // commands/prd-run.ts
 import { lstatSync, realpathSync } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 
 // prd-run/state.ts
 import {
@@ -7294,7 +7192,7 @@ import {
   readdirSync as readdirSync3,
   writeFileSync as writeFileSync4
 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { z } from "zod";
 var PRD_RUN_STATE_DIR = ".pourkit/prd-runs";
 var PrdRunRecordSchema = z.object({
@@ -7409,7 +7307,7 @@ function readPrdRun(repoRoot2, prdRef) {
   }
 }
 function listPrdRuns(repoRoot2) {
-  const stateDir = join15(repoRoot2, PRD_RUN_STATE_DIR);
+  const stateDir = join16(repoRoot2, PRD_RUN_STATE_DIR);
   if (!existsSync13(stateDir)) {
     return { records: [], diagnostics: [] };
   }
@@ -7419,7 +7317,7 @@ function listPrdRuns(repoRoot2) {
     (left, right) => left.name.localeCompare(right.name)
   )) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const recordPath = join15(stateDir, entry.name);
+    const recordPath = join16(stateDir, entry.name);
     try {
       const record = PrdRunRecordSchema.parse(
         JSON.parse(readFileSync15(recordPath, "utf-8"))
@@ -7435,7 +7333,7 @@ function listPrdRuns(repoRoot2) {
 }
 function writePrdRunRecord(repoRoot2, record) {
   const normalized = normalizePrdRunRef(record.prdRef);
-  const stateDir = join15(repoRoot2, PRD_RUN_STATE_DIR);
+  const stateDir = join16(repoRoot2, PRD_RUN_STATE_DIR);
   const recordPath = getRecordPath(repoRoot2, normalized);
   mkdirSync7(stateDir, { recursive: true });
   writeFileSync4(
@@ -7445,7 +7343,7 @@ function writePrdRunRecord(repoRoot2, record) {
   );
 }
 function getRecordPath(repoRoot2, prdRef) {
-  return join15(
+  return join16(
     repoRoot2,
     PRD_RUN_STATE_DIR,
     `${normalizePrdRunRef(prdRef)}.json`
@@ -12207,10 +12105,10 @@ Init applied: ${result.applied} operations applied, ${result.skipped} skipped.`
 
 // commands/memory-init.ts
 import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync17, writeFileSync as writeFileSync5 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 async function runMemoryInitCommand(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = join17(cwd, ".pourkit", "config.json");
+  const configPath = join18(cwd, ".pourkit", "config.json");
   if (!existsSync16(configPath)) {
     return {
       ok: false,
@@ -12242,8 +12140,8 @@ async function runMemoryInitCommand(options) {
     const next = { ...raw, memory };
     writeFileSync5(configPath, JSON.stringify(next, null, 2) + "\n");
   }
-  mkdirSync8(join17(cwd, ".pourkit", "icm"), { recursive: true });
-  const gitignorePath = join17(cwd, ".gitignore");
+  mkdirSync8(join18(cwd, ".pourkit", "icm"), { recursive: true });
+  const gitignorePath = join18(cwd, ".gitignore");
   updateManagedBlockSync(gitignorePath, generateGitignoreBlock());
   const managed = await generateManagedAgentInstructions({
     sourceRoot: cwd,
@@ -12251,14 +12149,14 @@ async function runMemoryInitCommand(options) {
   });
   let updatedAgentFile = false;
   for (const fileName of ["AGENTS.md", "CLAUDE.md"]) {
-    const agentPath = join17(cwd, fileName);
+    const agentPath = join18(cwd, fileName);
     if (existsSync16(agentPath)) {
       updateManagedBlockSync(agentPath, managed);
       updatedAgentFile = true;
     }
   }
   if (!updatedAgentFile) {
-    updateManagedBlockSync(join17(cwd, "AGENTS.md"), managed);
+    updateManagedBlockSync(join18(cwd, "AGENTS.md"), managed);
   }
   return {
     ok: true,
@@ -14255,7 +14153,7 @@ init_common();
 
 // execution/sandcastle-execution.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync9, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 import { createWorktree, opencode } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
 
@@ -14264,10 +14162,10 @@ init_common();
 import { mkdtempSync } from "fs";
 import { writeFile as writeFile4 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname7, join as join18 } from "path";
+import { dirname as dirname7, join as join19 } from "path";
 async function writeExecutionArtifacts(worktreePath, artifacts) {
   for (const artifact of artifacts) {
-    const filePath = join18(worktreePath, artifact.path);
+    const filePath = join19(worktreePath, artifact.path);
     await ensureDir(dirname7(filePath));
     await writeFile4(filePath, artifact.content, "utf-8");
   }
@@ -14329,7 +14227,7 @@ async function createSandboxFromExistingWorktree(options) {
 }
 
 // execution/sandbox-options.ts
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 var POURKIT_ICM_CONTAINER_DIR = "/home/agent/.pourkit/icm";
 function buildSandboxOptions(repoRoot2, sandbox, memory) {
   const mounts = [];
@@ -14338,12 +14236,12 @@ function buildSandboxOptions(repoRoot2, sandbox, memory) {
   }
   if (memory?.available) {
     mounts.push({
-      hostPath: join19(repoRoot2, ".pourkit", "icm"),
+      hostPath: join20(repoRoot2, ".pourkit", "icm"),
       sandboxPath: POURKIT_ICM_CONTAINER_DIR,
       readonly: false
     });
     mounts.push({
-      hostPath: join19(repoRoot2, ".pourkit", "icm", "cache"),
+      hostPath: join20(repoRoot2, ".pourkit", "icm", "cache"),
       sandboxPath: "/home/agent/.cache/icm",
       readonly: false
     });
@@ -14477,13 +14375,13 @@ var SandcastleExecutionSession = class {
             "Memory enabled but memory context is invalid. Run `pourkit memory init` or install ICM for host planning use."
           );
         }
-        const hostMemoryDir = join20(repoRoot2, ".pourkit", "icm");
+        const hostMemoryDir = join21(repoRoot2, ".pourkit", "icm");
         if (!existsSync20(hostMemoryDir) || !statSync2(hostMemoryDir).isDirectory()) {
           throw new MissingHostMemoryDirError(
             "Memory enabled but host .pourkit/icm/ directory is missing. Run `pourkit memory init` to create the repo-scoped memory store."
           );
         }
-        mkdirSync9(join20(hostMemoryDir, "cache"), { recursive: true });
+        mkdirSync9(join21(hostMemoryDir, "cache"), { recursive: true });
       }
       const sandboxOptions = buildSandboxOptions(
         repoRoot2,
@@ -14642,7 +14540,7 @@ function sanitizeBranch(branchName) {
 }
 function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
   return paths.filter((relativePath) => {
-    const source = join20(repoRoot2, relativePath);
+    const source = join21(repoRoot2, relativePath);
     if (!existsSync20(source)) {
       return true;
     }
@@ -14653,7 +14551,7 @@ function safeCopyToWorktreePaths(paths, repoRoot2, worktreePath) {
     } catch {
       return true;
     }
-    const destination = join20(worktreePath, relativePath);
+    const destination = join21(worktreePath, relativePath);
     return !existsSync20(destination);
   });
 }
@@ -14718,12 +14616,12 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function savePromptToFile(repoRoot2, stage, iteration, prompt) {
-  const promptsDir = join20(repoRoot2, ".pourkit", ".tmp", "prompts");
+  const promptsDir = join21(repoRoot2, ".pourkit", ".tmp", "prompts");
   mkdirSync9(promptsDir, { recursive: true });
   const timestamp2 = Date.now();
   const iterationSuffix = iteration !== void 0 ? `-iteration-${iteration}` : "";
   const filename = `${stage}${iterationSuffix}-${timestamp2}.md`;
-  const filePath = join20(promptsDir, filename);
+  const filePath = join21(promptsDir, filename);
   writeFileSync6(filePath, prompt, "utf-8");
 }
 
@@ -15444,11 +15342,11 @@ function createCliProgram(version) {
   return program;
 }
 async function resolveCliVersion() {
-  if (isPackageVersion("0.0.0-next-20260620201514")) {
-    return "0.0.0-next-20260620201514";
+  if (isPackageVersion("0.0.0-next-20260621045826")) {
+    return "0.0.0-next-20260621045826";
   }
-  if (isReleaseVersion("0.0.0-next-20260620201514")) {
-    return "0.0.0-next-20260620201514";
+  if (isReleaseVersion("0.0.0-next-20260621045826")) {
+    return "0.0.0-next-20260621045826";
   }
   try {
     const root = repoRoot();