@profoundlogic/coderflow-server 0.2.1

package/dist/base-image/Dockerfile

@@ -0,0 +1,184 @@
+# CoderFlow Base Image
+# Minimal image with Node.js, Python, and Git for AI agent execution
+
+FROM node:24-slim
+
+# Set timezone to Eastern Time to match idev
+ENV TZ=America/New_York
+
+# Build arguments for user UID/GID (auto-detected from host, defaults to 1000)
+ARG USER_UID=1000
+ARG USER_GID=1000
+
+# Install essential tools for development and troubleshooting
+# Includes Playwright/Chromium dependencies for browser automation
+RUN apt-get update && \
+    apt-get install -y \
+        expect \
+        tzdata \
+        git \
+        jq \
+        procps \
+        curl \
+        wget \
+        netcat-openbsd \
+        dnsutils \
+        iputils-ping \
+        telnet \
+        vim \
+        nano \
+        openssh-client \
+        make \
+        uuid-runtime \
+        lsof \
+        python3 \
+        python3-pip \
+        python3-venv \
+        ripgrep \
+        # Document handling tools
+        unzip \
+        poppler-utils \
+        # Playwright/Chromium dependencies (prebaked to avoid needing sudo at runtime)
+        libasound2 \
+        libatk-bridge2.0-0 \
+        libatk1.0-0 \
+        libatspi2.0-0 \
+        libcairo2 \
+        libcups2 \
+        libdbus-1-3 \
+        libdrm2 \
+        libgbm1 \
+        libglib2.0-0 \
+        libnspr4 \
+        libnss3 \
+        libpango-1.0-0 \
+        libx11-6 \
+        libxcb1 \
+        libxcomposite1 \
+        libxdamage1 \
+        libxext6 \
+        libxfixes3 \
+        libxkbcommon0 \
+        libxrandr2 \
+        xvfb && \
+    ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime && \
+    echo "America/New_York" > /etc/timezone && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    ln -s /usr/bin/python3 /usr/bin/python
+
+# Install Python libraries for document handling (docx, pdf)
+RUN pip install --break-system-packages python-docx pypdf pdfplumber
+
+# Remove the default 'node' user that comes with node:24-slim (typically UID 1000)
+# This prevents conflicts when we create our own user with specified UID
+RUN userdel -r node 2>/dev/null || true
+
+# Create 'coder' user and group with UID/GID from build args
+# This matches the host user's UID/GID, eliminating permission issues
+RUN groupadd -g ${USER_GID} coder && \
+    useradd -m -u ${USER_UID} -g ${USER_GID} -s /bin/bash coder && \
+    mkdir -p /home/coder/.ssh /home/coder/.claude /home/coder/.codex \
+             /home/coder/.config/google-generative-ai /home/coder/.gemini && \
+    chown -R coder:coder /home/coder
+
+# Configure git for root user (used during docker builds with BuildKit secrets)
+RUN git config --global credential.helper store && \
+    git config --global --add safe.directory '*' && \
+    git config --global core.autocrlf false
+
+# Configure git for coder user (used at runtime in containers)
+# Credential helper chain: our custom helper first, then store as fallback
+# Our helper only responds for managed repos (in CODER_MANAGED_REPOS); others fall through to store
+# useHttpPath ensures Git sends the full repo path to credential helpers (needed for per-repo matching)
+RUN su - coder -c "git config --global credential.helper '/usr/local/bin/coder-git-credential-helper' && \
+    git config --global --add credential.helper store && \
+    git config --global credential.useHttpPath true && \
+    git config --global --add safe.directory '*' && \
+    git config --global core.autocrlf false"
+
+# Pre-populate SSH known_hosts with GitHub host keys at build time
+# This eliminates the need for ssh-keyscan at runtime, preventing connection storms
+# when multiple containers start simultaneously
+RUN mkdir -p /etc/ssh && \
+    ssh-keyscan github.com >> /etc/ssh/ssh_known_hosts 2>/dev/null && \
+    chmod 644 /etc/ssh/ssh_known_hosts
+
+# Configure SSH connection multiplexing for GitHub
+# This enables connection reuse across multiple git operations, reducing overhead
+COPY ssh_config_template /etc/ssh/ssh_config.d/10-github-multiplexing.conf
+RUN chmod 644 /etc/ssh/ssh_config.d/10-github-multiplexing.conf
+
+# Configure shell to source ~/.bash_env for environment variables
+# This allows setup.sh to write env vars that persist in all shells (login and non-login)
+RUN sed -i '/^# If not running interactively/i # Source environment variables from setup.sh\nif [ -f ~/.bash_env ]; then\n    . ~/.bash_env\nfi\n' /home/coder/.bashrc && \
+    printf '\n# Source environment variables from setup.sh\nif [ -f ~/.bash_env ]; then\n    . ~/.bash_env\nfi\n' >> /home/coder/.profile
+
+# Install Claude Code, Codex, and Gemini CLI globally
+RUN npm install -g @openai/codex @google/gemini-cli && \
+    su - coder -c "curl -fsSL https://claude.ai/install.sh | bash"
+
+# Pre-install Playwright browser binaries (not the skill itself)
+# This caches ~165MB of Chromium so skills that need browser automation don't have to download at runtime
+# System dependencies are already installed above (libasound2, libatk*, etc.)
+RUN su - coder -c "npx playwright install chromium"
+
+# Install code-server for web-based VS Code
+RUN curl -fsSL https://code-server.dev/install.sh | sh && \
+    mkdir -p /home/coder/.local/share/code-server && \
+    mkdir -p /home/coder/.config/code-server && \
+    chown -R coder:coder /home/coder/.local /home/coder/.config
+
+# Pre-install VS Code extensions from configurable list
+COPY vscode-extensions.txt /tmp/vscode-extensions.txt
+RUN while IFS= read -r extension || [ -n "$extension" ]; do \
+      # Skip comments and empty lines
+      case "$extension" in \
+        \#*|'') continue ;; \
+      esac; \
+      echo "Installing extension: $extension"; \
+      su - coder -c "code-server --install-extension $extension" || echo "Failed to install $extension"; \
+    done < /tmp/vscode-extensions.txt && \
+    rm /tmp/vscode-extensions.txt
+
+# Configure default VS Code settings for minimal layout
+COPY vscode-settings.json /tmp/vscode-settings.json
+RUN mkdir -p /home/coder/.local/share/code-server/User && \
+    cp /tmp/vscode-settings.json /home/coder/.local/share/code-server/User/settings.json && \
+    rm /tmp/vscode-settings.json && \
+    chown -R coder:coder /home/coder/.local
+
+# Disable built-in chat/AI extensions that may show unwanted panels
+RUN if [ -d "/usr/lib/code-server/lib/vscode/extensions/mermaid-chat-features" ]; then \
+      mv /usr/lib/code-server/lib/vscode/extensions/mermaid-chat-features \
+         /usr/lib/code-server/lib/vscode/extensions/mermaid-chat-features.disabled || true; \
+    fi
+
+# Create workspace directory for repositories
+RUN mkdir -p /workspace && \
+    chown coder:coder /workspace
+
+# Create task-output directory for results
+RUN mkdir -p /task-output && \
+    chown coder:coder /task-output
+
+# Set working directory
+WORKDIR /workspace
+
+# Copy entrypoint script and AI agent wrapper
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+COPY sync-repos.sh /usr/local/bin/sync-repos.sh
+COPY agent-wrapper.sh /usr/local/bin/agent-wrapper.sh
+COPY start-code-server.sh /usr/local/bin/start-code-server.sh
+COPY apply-local-state.sh /usr/local/bin/apply-local-state.sh
+COPY coder-git-credential-helper /usr/local/bin/coder-git-credential-helper
+RUN chmod +x /usr/local/bin/entrypoint.sh /usr/local/bin/sync-repos.sh /usr/local/bin/agent-wrapper.sh /usr/local/bin/start-code-server.sh /usr/local/bin/apply-local-state.sh /usr/local/bin/coder-git-credential-helper
+
+# Expose code-server port
+EXPOSE 8080
+
+# Set entrypoint
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+
+# Default command: none (entrypoint will run default task)
+CMD []

package/dist/base-image/agent-wrapper.sh

@@ -0,0 +1,143 @@
+#!/bin/bash
+# Wrapper script to run AI agents (Claude/Codex/Gemini) and output JSON statistics
+#
+# Model selection via environment variables:
+#   CLAUDE_MODEL - Model for Claude (e.g., opus, sonnet, haiku)
+#   OPENAI_MODEL - Model for Codex/OpenAI (e.g., gpt-5.2-codex)
+#   GEMINI_MODEL - Model for Gemini (e.g., gemini-2.5-pro)
+#   CODEX_REASONING_LEVEL - Reasoning level for Codex (low, medium, high, xhigh)
+#
+# If model env vars are not set, agents use their default models.
+
+# First argument is the agent command, rest are passed to the agent
+AGENT_CMD="$1"
+shift
+
+echo "[$(date +'%Y-%m-%d %H:%M:%S')] Starting agent: $AGENT_CMD" >&2
+
+# Log model configuration if set
+if [[ -n "$CLAUDE_MODEL" ]] || [[ -n "$OPENAI_MODEL" ]] || [[ -n "$GEMINI_MODEL" ]]; then
+  echo "[$(date +'%Y-%m-%d %H:%M:%S')] Model configuration: CLAUDE_MODEL=${CLAUDE_MODEL:-default} OPENAI_MODEL=${OPENAI_MODEL:-default} GEMINI_MODEL=${GEMINI_MODEL:-default}" >&2
+fi
+
+START_TIME=$(date +%s%3N)
+
+# Save stdin to temp file
+TEMP_INPUT=$(mktemp)
+cat > "$TEMP_INPUT"
+
+mkdir -p /task-output
+
+# UNIFIED APPROACH FOR ALL AGENTS:
+# - Run agent once, stream output to debug-stream.jsonl
+# - Capture exit code
+# - Generate a simple success/failure result
+# - Let the UI parse debug-stream.jsonl for detailed activity
+
+# Codex requires exec subcommand for non-interactive use (or resume for continuing)
+# Claude accepts stdin directly with --print --output-format stream-json
+# Gemini uses -p flag for prompt with --yolo for auto-approval and --resume for continuing
+if [[ "$AGENT_CMD" == *"codex"* ]]; then
+    INSTRUCTION=$(cat "$TEMP_INPUT")
+
+    # Build model argument if OPENAI_MODEL is set
+    MODEL_ARG=""
+    if [[ -n "$OPENAI_MODEL" ]]; then
+        MODEL_ARG="-m $OPENAI_MODEL"
+    fi
+
+    # Build reasoning level argument if CODEX_REASONING_LEVEL is set
+    REASONING_ARG=""
+    if [[ -n "$CODEX_REASONING_LEVEL" ]]; then
+        echo "[$(date +'%Y-%m-%d %H:%M:%S')] Codex reasoning level: $CODEX_REASONING_LEVEL" >&2
+        REASONING_ARG="-c model_reasoning_effort=$CODEX_REASONING_LEVEL"
+    fi
+
+    # Check if this is a resume operation (first arg is 'exec', second is 'resume')
+    if [[ "$1" == "exec" ]] && [[ "$2" == "resume" ]]; then
+        shift 2  # Remove 'exec' and 'resume' from $@
+        echo "$INSTRUCTION" | "$AGENT_CMD" $MODEL_ARG $REASONING_ARG -a never -s danger-full-access -c approval_policy=never -c sandbox_mode=danger-full-access exec --skip-git-repo-check --json resume "$@" >> /task-output/debug-stream.jsonl 2>&1
+        EXIT_CODE=$?
+    else
+        "$AGENT_CMD" $MODEL_ARG $REASONING_ARG -a never -s danger-full-access exec --skip-git-repo-check --json "$@" "$INSTRUCTION" >> /task-output/debug-stream.jsonl 2>&1
+        EXIT_CODE=$?
+    fi
+
+elif [[ "$AGENT_CMD" == *"gemini"* ]]; then
+    INSTRUCTION=$(cat "$TEMP_INPUT")
+
+    # Use GEMINI_MODEL if set, otherwise default to "pro"
+    GEMINI_MODEL_TO_USE="${GEMINI_MODEL:-pro}"
+
+    # Check if this is a resume operation (--resume flag in args)
+    if [[ "$*" == *"--resume"* ]]; then
+        "$AGENT_CMD" --model "$GEMINI_MODEL_TO_USE" --resume latest -p "$INSTRUCTION" --yolo --include-directories /task-output --output-format stream-json >> /task-output/debug-stream.jsonl 2>&1
+        EXIT_CODE=$?
+    else
+        "$AGENT_CMD" --model "$GEMINI_MODEL_TO_USE" -p "$INSTRUCTION" --yolo --include-directories /task-output --output-format stream-json "$@" >> /task-output/debug-stream.jsonl 2>&1
+        EXIT_CODE=$?
+    fi
+
+else
+    # Claude - uses CLAUDE_MODEL env var if set (claude-code reads it automatically)
+    # The claude-code CLI respects the CLAUDE_MODEL environment variable
+    cat "$TEMP_INPUT" | "$AGENT_CMD" --print --output-format stream-json --verbose "$@" >> /task-output/debug-stream.jsonl 2>&1
+    EXIT_CODE=$?
+fi
+
+# Clean up temp file
+rm -f "$TEMP_INPUT"
+
+END_TIME=$(date +%s%3N)
+DURATION=$((END_TIME - START_TIME))
+
+# Extract final response from stream for activity feed
+# This ensures the conversation shows the agent's reply
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.%3NZ")
+
+if [ -f /task-output/debug-stream.jsonl ] && [ $EXIT_CODE -eq 0 ]; then
+    # Try to extract final response based on agent type
+    if [[ "$AGENT_CMD" == *"claude"* ]]; then
+        # Claude: Look for last text block in assistant message
+        RESPONSE=$(grep -a '"type":"assistant"' /task-output/debug-stream.jsonl | tail -1 | jq -r '.message.content[] | select(.type=="text") | .text' 2>/dev/null | head -20 || echo "")
+    elif [[ "$AGENT_CMD" == *"gemini"* ]]; then
+        # Gemini: Extract last assistant message content (the actual response)
+        # Gemini format: {"type":"message","role":"assistant","content":"...","delta":true}
+        RESPONSE=$(grep -a '"type":"message"' /task-output/debug-stream.jsonl | grep -a '"role":"assistant"' | tail -1 | jq -r '.content' 2>/dev/null || echo "")
+    elif [[ "$AGENT_CMD" == *"codex"* ]]; then
+        # Codex: Look for last agent_message or reasoning item
+        RESPONSE=$(grep -a '"type":"item.completed"' /task-output/debug-stream.jsonl | tail -1 | jq -r 'select(.item.type=="agent_message") | .item.text' 2>/dev/null || \
+                   grep -a '"type":"item.completed"' /task-output/debug-stream.jsonl | tail -1 | jq -r 'select(.item.type=="reasoning") | .item.text' 2>/dev/null | head -20 || echo "")
+    fi
+
+    # Clean up response (limit length for summary)
+    if [ -n "$RESPONSE" ] && [ "$RESPONSE" != "null" ]; then
+        RESULT_TEXT="$RESPONSE"
+    else
+        RESULT_TEXT="Task completed successfully"
+    fi
+else
+    RESULT_TEXT="Task failed with exit code $EXIT_CODE"
+fi
+
+# Estimate tokens from debug stream size
+if [ -f /task-output/debug-stream.jsonl ]; then
+    TOKEN_EST=$(wc -c < /task-output/debug-stream.jsonl | awk '{print int($1/4)}')
+else
+    TOKEN_EST=0
+fi
+
+# Escape result text for JSON
+ESCAPED_RESULT=$(echo "$RESULT_TEXT" | jq -Rs . 2>/dev/null || echo '"Task completed"')
+
+# Output result JSON with actual agent response
+# The server and UI will also read debug-stream.jsonl for detailed events
+cat <<EOF
+{"type":"result","result":$ESCAPED_RESULT,"duration_ms":${DURATION},"num_turns":1,"usage":{"output_tokens":${TOKEN_EST},"cache_read_input_tokens":0},"timestamp":"${TIMESTAMP}","exit_code":${EXIT_CODE}}
+EOF
+
+# Write exit code and finished time marker files for server monitoring
+echo "$EXIT_CODE" > /task-output/.exit_code
+date -Iseconds > /task-output/.finished_at
+
+exit $EXIT_CODE

package/dist/base-image/apply-local-state.sh

@@ -0,0 +1,357 @@
+#!/bin/bash
+# Apply Local Repository State
+# Applies captured git state including local branches, staged/unstaged changes, untracked files
+
+set -o pipefail
+
+STATE_FILE="${LOCAL_STATE_FILE:-/task-output/local-state.json}"
+WORKSPACE_DIR="${WORKSPACE_DIR:-/workspace}"
+
+# Track warnings and errors
+HAS_WARNINGS=false
+WARNING_MESSAGES=()
+
+# Logging functions
+log() {
+    echo "[$(date +'%Y-%m-%d %H:%M:%S')] $*" >&2
+}
+
+log_error() {
+    echo "[$(date +'%Y-%m-%d %H:%M:%S')] ERROR: $*" >&2
+    HAS_WARNINGS=true
+    WARNING_MESSAGES+=("ERROR: $*")
+}
+
+log_warning() {
+    echo "[$(date +'%Y-%m-%d %H:%M:%S')] WARNING: $*" >&2
+    HAS_WARNINGS=true
+    WARNING_MESSAGES+=("WARNING: $*")
+}
+
+log_success() {
+    echo "[$(date +'%Y-%m-%d %H:%M:%S')] SUCCESS: $*" >&2
+}
+
+# Check if state file exists
+if [ ! -f "$STATE_FILE" ]; then
+    log "No local state file found at $STATE_FILE, skipping state application"
+    exit 0
+fi
+
+log "════════════════════════════════════════════════════════════════"
+log "  Applying Local Repository State"
+log "════════════════════════════════════════════════════════════════"
+log ""
+
+# Validate JSON
+if ! jq empty "$STATE_FILE" 2>/dev/null; then
+    log_error "Invalid JSON in state file: $STATE_FILE"
+    exit 1
+fi
+
+# Show capture info
+CAPTURED_AT=$(jq -r '.captured_at' "$STATE_FILE")
+REPOS_FOUND=$(jq -r '.repos_found | join(", ")' "$STATE_FILE")
+REPOS_MISSING=$(jq -r '.repos_missing | join(", ")' "$STATE_FILE")
+
+log "📋 State Information:"
+log "   Captured at: $CAPTURED_AT"
+log "   Repositories: $REPOS_FOUND"
+if [ -n "$REPOS_MISSING" ] && [ "$REPOS_MISSING" != "" ]; then
+    log "   Missing (will use defaults): $REPOS_MISSING"
+fi
+log ""
+
+# Process each repository
+jq -r '.repositories | keys[]' "$STATE_FILE" | while read -r repo_name; do
+    # Look up the path for this repo from REPOS_CONFIG
+    repo_path_from_json=""
+    if [ -n "$REPOS_CONFIG" ]; then
+        repo_path_from_json=$(echo "$REPOS_CONFIG" | jq -r --arg name "$repo_name" '.[] | select(.name == $name) | .path')
+    fi
+
+    # Use path field from JSON if available, otherwise default to repo_name
+    if [ -n "$repo_path_from_json" ] && [ "$repo_path_from_json" != "null" ] && [ "$repo_path_from_json" != "" ]; then
+        REPO_PATH="$WORKSPACE_DIR/$repo_path_from_json"
+    else
+        REPO_PATH="$WORKSPACE_DIR/$repo_name"
+    fi
+
+    log "────────────────────────────────────────────────────────────────"
+    log "📁 Repository: $repo_name"
+    log "   Path: $REPO_PATH"
+    log "────────────────────────────────────────────────────────────────"
+
+    # Check if repo exists in workspace
+    if [ ! -d "$REPO_PATH" ]; then
+        log_error "Repository not found in workspace: $REPO_PATH"
+        log "   Skipping..."
+        log ""
+        continue
+    fi
+
+    if [ ! -d "$REPO_PATH/.git" ]; then
+        log_error "Not a git repository: $REPO_PATH"
+        log "   Skipping..."
+        log ""
+        continue
+    fi
+
+    cd "$REPO_PATH" || {
+        log_error "Failed to cd into $REPO_PATH"
+        continue
+    }
+
+    # Extract repo state from JSON
+    CURRENT_BRANCH=$(jq -r ".repositories.\"$repo_name\".current_branch" "$STATE_FILE")
+    IS_REMOTE_TRACKING=$(jq -r ".repositories.\"$repo_name\".is_remote_tracking" "$STATE_FILE")
+    BASE_BRANCH=$(jq -r ".repositories.\"$repo_name\".base_branch" "$STATE_FILE")
+    COMMITS_AHEAD=$(jq -r ".repositories.\"$repo_name\".commits_ahead" "$STATE_FILE")
+
+    log "   Current branch in container: $(git rev-parse --abbrev-ref HEAD)"
+    log "   Target branch: $CURRENT_BRANCH"
+    log "   Remote tracking: $IS_REMOTE_TRACKING"
+
+    # Step 1: Handle branch setup
+    if [ "$IS_REMOTE_TRACKING" = "true" ]; then
+        # Branch exists on remote, checkout first
+        log "   Checking out remote-tracking branch: $CURRENT_BRANCH"
+
+        if git rev-parse --verify "origin/$CURRENT_BRANCH" >/dev/null 2>&1; then
+            git checkout "$CURRENT_BRANCH" 2>&1 | sed 's/^/   /' || {
+                log_error "Failed to checkout branch $CURRENT_BRANCH"
+                continue
+            }
+        else
+            log_error "Remote branch origin/$CURRENT_BRANCH not found"
+            log "   Attempting to checkout local branch..."
+            git checkout "$CURRENT_BRANCH" 2>&1 | sed 's/^/   /' || {
+                log_error "Failed to checkout branch $CURRENT_BRANCH"
+                continue
+            }
+        fi
+
+        # Check for unpushed commits on remote-tracking branch
+        if [ -n "$COMMITS_AHEAD" ] && [ "$COMMITS_AHEAD" != "null" ] && [ "$COMMITS_AHEAD" -gt 0 ]; then
+            log "   📤 Unpushed commits detected: $COMMITS_AHEAD commit(s)"
+            COMMIT_PATCH=$(jq -r ".repositories.\"$repo_name\".commit_patch" "$STATE_FILE")
+
+            if [ -n "$COMMIT_PATCH" ] && [ "$COMMIT_PATCH" != "null" ]; then
+                log "   Applying unpushed commits..."
+
+                # Save patch to temp file
+                TEMP_PATCH=$(mktemp)
+                echo "$COMMIT_PATCH" > "$TEMP_PATCH"
+
+                # Apply patches using git am
+                if git am --3way < "$TEMP_PATCH" 2>&1 | sed 's/^/   /'; then
+                    log_success "Successfully applied unpushed commits"
+                else
+                    log_error "Failed to apply commit patches, trying format-patch method..."
+                    git am --abort 2>/dev/null || true
+
+                    # Fallback: try applying as a single diff
+                    if git apply < "$TEMP_PATCH" 2>&1 | sed 's/^/   /'; then
+                        log_success "Applied changes as diff (commits not preserved)"
+                    else
+                        log_error "Failed to apply commit patches"
+                    fi
+                fi
+
+                rm -f "$TEMP_PATCH"
+            fi
+        fi
+    else
+        # Local-only branch, need to recreate it
+        log "   ⚠️  Local-only branch detected: $CURRENT_BRANCH"
+
+        if [ -n "$BASE_BRANCH" ] && [ "$BASE_BRANCH" != "null" ]; then
+            log "   Base branch: $BASE_BRANCH"
+            log "   Commits ahead: $COMMITS_AHEAD"
+
+            # Checkout base branch first
+            if git rev-parse --verify "$BASE_BRANCH" >/dev/null 2>&1; then
+                log "   Checking out base branch: $BASE_BRANCH"
+                git checkout "$BASE_BRANCH" 2>&1 | sed 's/^/   /' || {
+                    log_error "Failed to checkout base branch $BASE_BRANCH"
+                    continue
+                }
+            else
+                log_error "Base branch $BASE_BRANCH not found"
+                continue
+            fi
+
+            # Create new branch
+            log "   Creating local branch: $CURRENT_BRANCH"
+            git checkout -b "$CURRENT_BRANCH" 2>&1 | sed 's/^/   /' || {
+                # Branch might already exist
+                git checkout "$CURRENT_BRANCH" 2>&1 | sed 's/^/   /' || {
+                    log_error "Failed to create/checkout branch $CURRENT_BRANCH"
+                    continue
+                }
+            }
+
+            # Apply commit patches if available
+            if [ "$COMMITS_AHEAD" != "null" ] && [ "$COMMITS_AHEAD" -gt 0 ]; then
+                COMMIT_PATCH=$(jq -r ".repositories.\"$repo_name\".commit_patch" "$STATE_FILE")
+
+                if [ -n "$COMMIT_PATCH" ] && [ "$COMMIT_PATCH" != "null" ]; then
+                    log "   Applying $COMMITS_AHEAD commit(s)..."
+
+                    # Save patch to temp file
+                    TEMP_PATCH=$(mktemp)
+                    echo "$COMMIT_PATCH" > "$TEMP_PATCH"
+
+                    # Apply patches using git am
+                    if git am --3way < "$TEMP_PATCH" 2>&1 | sed 's/^/   /'; then
+                        log_success "Successfully applied commit patches"
+                    else
+                        log_error "Failed to apply commit patches, trying format-patch method..."
+                        git am --abort 2>/dev/null || true
+
+                        # Fallback: try applying as a single diff
+                        if git apply < "$TEMP_PATCH" 2>&1 | sed 's/^/   /'; then
+                            log_success "Applied changes as diff (commits not preserved)"
+                        else
+                            log_error "Failed to apply commit patches"
+                        fi
+                    fi
+
+                    rm -f "$TEMP_PATCH"
+                fi
+            fi
+        else
+            log "   No base branch info, checking out branch as-is..."
+            git checkout "$CURRENT_BRANCH" 2>&1 | sed 's/^/   /' || {
+                log_error "Failed to checkout branch $CURRENT_BRANCH"
+                continue
+            }
+        fi
+    fi
+
+    log_success "Branch setup complete"
+
+    # Step 2: Apply unstaged changes (working directory changes)
+    UNSTAGED=$(jq -r ".repositories.\"$repo_name\".unstaged" "$STATE_FILE")
+    if [ -n "$UNSTAGED" ] && [ "$UNSTAGED" != "null" ] && [ "$UNSTAGED" != "" ]; then
+        UNSTAGED_FILE_COUNT=$(echo "$UNSTAGED" | grep -c '^diff --git' || echo "0")
+        log "   Applying unstaged changes ($UNSTAGED_FILE_COUNT files)..."
+
+        TEMP_DIFF=$(mktemp)
+        echo "$UNSTAGED" > "$TEMP_DIFF"
+
+        if git apply --verbose < "$TEMP_DIFF" 2>&1 | sed 's/^/   /'; then
+            log_success "Unstaged changes applied"
+        else
+            log_error "Failed to apply unstaged changes for $repo_name"
+            log_warning "$repo_name: Unstaged changes had conflicts - check git status in container"
+            log "   Attempting with --reject to show conflicts..."
+            git apply --reject < "$TEMP_DIFF" 2>&1 | sed 's/^/   /' || true
+        fi
+
+        rm -f "$TEMP_DIFF"
+    fi
+
+    # Step 3: Apply staged changes (index)
+    STAGED=$(jq -r ".repositories.\"$repo_name\".staged" "$STATE_FILE")
+    if [ -n "$STAGED" ] && [ "$STAGED" != "null" ] && [ "$STAGED" != "" ]; then
+        STAGED_FILE_COUNT=$(echo "$STAGED" | grep -c '^diff --git' || echo "0")
+        log "   Applying staged changes ($STAGED_FILE_COUNT files)..."
+
+        TEMP_STAGED=$(mktemp)
+        echo "$STAGED" > "$TEMP_STAGED"
+
+        if git apply --cached --verbose < "$TEMP_STAGED" 2>&1 | sed 's/^/   /'; then
+            log_success "Staged changes applied"
+        else
+            log_error "Failed to apply staged changes for $repo_name"
+            log_warning "$repo_name: Staged changes had conflicts - check git status in container"
+            log "   Attempting with --reject to show conflicts..."
+            git apply --cached --reject < "$TEMP_STAGED" 2>&1 | sed 's/^/   /' || true
+        fi
+
+        rm -f "$TEMP_STAGED"
+    fi
+
+    # Step 4: Create untracked files
+    UNTRACKED_FILES=$(jq -r ".repositories.\"$repo_name\".untracked_files | keys[]" "$STATE_FILE" 2>/dev/null)
+    if [ -n "$UNTRACKED_FILES" ]; then
+        UNTRACKED_COUNT=$(echo "$UNTRACKED_FILES" | wc -l)
+        log "   Creating $UNTRACKED_COUNT untracked file(s)..."
+
+        echo "$UNTRACKED_FILES" | while read -r file_path; do
+            if [ -z "$file_path" ]; then
+                continue
+            fi
+
+            # Get file content from JSON (properly escaped)
+            FILE_CONTENT=$(jq -r ".repositories.\"$repo_name\".untracked_files.\"$file_path\"" "$STATE_FILE")
+
+            if [ -n "$FILE_CONTENT" ] && [ "$FILE_CONTENT" != "null" ]; then
+                # Create parent directories if needed
+                mkdir -p "$(dirname "$file_path")"
+
+                # Write content to file
+                echo "$FILE_CONTENT" > "$file_path"
+                log "      + $file_path"
+            fi
+        done
+
+        log_success "Untracked files created"
+    fi
+
+    # Step 5: Show final git status
+    log ""
+    log "   📊 Final repository state:"
+    git status --short 2>&1 | sed 's/^/      /' || true
+    log "   Current branch: $(git rev-parse --abbrev-ref HEAD)"
+    log ""
+    log_success "State application complete for $repo_name"
+    log ""
+done
+
+log "════════════════════════════════════════════════════════════════"
+log_success "Local state application complete!"
+log "════════════════════════════════════════════════════════════════"
+log ""
+
+# Write summary for CLI to check
+SUMMARY_FILE="/task-output/.local-state-summary"
+
+if [ "$HAS_WARNINGS" = "true" ]; then
+  # Build warnings JSON array
+  WARNINGS_JSON="["
+  first=true
+  for msg in "${WARNING_MESSAGES[@]}"; do
+    if [ "$first" = "true" ]; then
+      first=false
+    else
+      WARNINGS_JSON+=","
+    fi
+    # Escape quotes in message
+    escaped_msg=$(echo "$msg" | sed 's/"/\\"/g')
+    WARNINGS_JSON+="\"$escaped_msg\""
+  done
+  WARNINGS_JSON+="]"
+
+  cat > "$SUMMARY_FILE" <<EOF
+{
+  "status": "completed_with_warnings",
+  "applied_at": "$(date -Iseconds)",
+  "has_warnings": true,
+  "warnings": $WARNINGS_JSON,
+  "message": "Local state applied with ${#WARNING_MESSAGES[@]} warning(s) - check git status in container"
+}
+EOF
+else
+  cat > "$SUMMARY_FILE" <<EOF
+{
+  "status": "success",
+  "applied_at": "$(date -Iseconds)",
+  "has_warnings": false,
+  "message": "Local state applied successfully"
+}
+EOF
+fi
+
+exit 0