@pushpalsdev/cli 1.0.40 → 1.0.42

package/runtime/sandbox/apps/workerpals/src/execute_job.ts

@@ -3,7 +3,7 @@
  * Used by both the host Worker (direct mode) and the Docker job runner.
  */
 
-import { readFileSync, unlinkSync } from "fs";
+import { existsSync, readFileSync, unlinkSync } from "fs";
 import { resolve } from "path";
 import {
   deriveAutonomyComponentArea,
@@ -26,6 +26,7 @@ import {
 export { compactJobOutput, truncate, streamLines } from "./common/execution_utils.js";
 export { extractClarificationQuestionFromOutput } from "./backends/openhands_task_execute.js";
 import { getBackendTaskExecutor } from "./backends/task_execute_registry.js";
+import { extractMergeConflictReviewContext } from "./merge_conflict_job.js";
 
 const DEFAULT_CONFIG = loadPushPalsConfig();
 
@@ -80,6 +81,23 @@ interface CriticReview {
   raw: string;
 }
 
+export interface ReviewFixContext {
+  resolutionType: "review_fix";
+  prHeadRef: string | null;
+  prBaseRef: string | null;
+  previousReviewScore: number | null;
+  reviewThreshold: number | null;
+  previousReviewSummary: string;
+  reviewerFindings: string[];
+}
+
+export interface QualityGatePolicy {
+  mode: "default" | "review_fix";
+  maxAutoRevisions: number;
+  softPassOnExhausted: boolean;
+  criticMinScore: number;
+}
+
 // ─── Utilities ───────────────────────────────────────────────────────────────
 
 export function shouldCommit(
@@ -223,6 +241,102 @@ export function resolveReviewNoChangeCompletionBranch(
   return resolved.overridden ? resolved.branch : null;
 }
 
+function toFiniteReviewScore(value: unknown): number | null {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return null;
+  return Math.max(0, Math.min(10, parsed));
+}
+
+function toNonEmptyReviewStringArray(value: unknown, limit: number = 8): string[] {
+  if (!Array.isArray(value)) return [];
+  return value
+    .map((entry) => String(entry ?? "").trim())
+    .filter(Boolean)
+    .slice(0, limit);
+}
+
+export function extractReviewFixContext(
+  params: Record<string, unknown> | null | undefined,
+): ReviewFixContext | null {
+  if (!params || typeof params !== "object" || Array.isArray(params)) return null;
+  const reviewAgent =
+    params.reviewAgent &&
+    typeof params.reviewAgent === "object" &&
+    !Array.isArray(params.reviewAgent)
+      ? (params.reviewAgent as Record<string, unknown>)
+      : null;
+  if (!reviewAgent) return null;
+  const resolutionType = String(reviewAgent.resolutionType ?? "")
+    .trim()
+    .toLowerCase();
+  if (resolutionType === "merge_conflict") return null;
+  const looksLikeLegacyReviewFix =
+    typeof reviewAgent.prHeadRef === "string" ||
+    typeof reviewAgent.previousReviewSummary === "string" ||
+    Number.isFinite(Number(reviewAgent.previousReviewScore)) ||
+    Array.isArray(reviewAgent.reviewerFindings);
+  if (resolutionType && resolutionType !== "review_fix") return null;
+  if (!resolutionType && !looksLikeLegacyReviewFix) return null;
+  return {
+    resolutionType: "review_fix",
+    prHeadRef: typeof reviewAgent.prHeadRef === "string" ? reviewAgent.prHeadRef.trim() || null : null,
+    prBaseRef: typeof reviewAgent.prBaseRef === "string" ? reviewAgent.prBaseRef.trim() || null : null,
+    previousReviewScore: toFiniteReviewScore(reviewAgent.previousReviewScore),
+    reviewThreshold: toFiniteReviewScore(reviewAgent.reviewThreshold),
+    previousReviewSummary: String(reviewAgent.previousReviewSummary ?? "").trim(),
+    reviewerFindings: toNonEmptyReviewStringArray(reviewAgent.reviewerFindings),
+  };
+}
+
+export function shouldEnqueueNoChangeReviewCompletion(
+  params: Record<string, unknown> | null | undefined,
+): boolean {
+  return extractReviewFixContext(params) == null;
+}
+
+export function deriveQualityGatePolicy(
+  params: Record<string, unknown> | null | undefined,
+  runtimeConfig: WorkerpalsRuntimeConfig = DEFAULT_CONFIG,
+): QualityGatePolicy {
+  const baseMaxAutoRevisions = Math.max(
+    0,
+    Math.min(
+      10,
+      Number.isFinite(Number(runtimeConfig.workerpals.qualityMaxAutoRevisions))
+        ? Math.floor(Number(runtimeConfig.workerpals.qualityMaxAutoRevisions))
+        : 4,
+    ),
+  );
+  const baseSoftPassOnExhausted =
+    typeof runtimeConfig.workerpals.qualitySoftPassOnExhausted === "boolean"
+      ? runtimeConfig.workerpals.qualitySoftPassOnExhausted
+      : true;
+  const baseCriticMinScore = (() => {
+    const value = Number(runtimeConfig.workerpals.qualityCriticMinScore);
+    if (!Number.isFinite(value)) return 8;
+    return Math.max(0, Math.min(10, value));
+  })();
+  const reviewFix = extractReviewFixContext(params);
+  if (!reviewFix) {
+    return {
+      mode: "default",
+      maxAutoRevisions: baseMaxAutoRevisions,
+      softPassOnExhausted: baseSoftPassOnExhausted,
+      criticMinScore: baseCriticMinScore,
+    };
+  }
+  const tightenedCriticMinScore =
+    reviewFix.reviewThreshold != null
+      ? Math.max(baseCriticMinScore, Math.max(0, Math.min(10, reviewFix.reviewThreshold - 0.2)))
+      : baseCriticMinScore;
+  return {
+    mode: "review_fix",
+    maxAutoRevisions: Math.max(baseMaxAutoRevisions, 2),
+    softPassOnExhausted: false,
+    criticMinScore: tightenedCriticMinScore,
+  };
+}
+
 function normalizeChatCompletionsEndpoint(endpoint: string): string {
   const source = endpoint.trim().replace(/\/+$/, "");
   if (!source) return "http://127.0.0.1:1234/v1/chat/completions";
@@ -907,13 +1021,39 @@ async function runTaskCriticReview(
   }
 }
 
-function buildQualityRevisionHint(
+export function buildQualityRevisionHint(
   issues: string[],
   critic: CriticReview | null,
   planning: TaskExecutePlanning,
+  reviewFixContext?: ReviewFixContext | null,
 ): string {
   const lines: string[] = [];
   lines.push("Quality revision required before completion.");
+  if (reviewFixContext) {
+    lines.push("Rejected PR retry requirements:");
+    if (reviewFixContext.previousReviewScore != null) {
+      lines.push(
+        `Previous ReviewAgent score: ${reviewFixContext.previousReviewScore.toFixed(1)} / 10`,
+      );
+    }
+    if (reviewFixContext.reviewThreshold != null) {
+      lines.push(
+        `Required approval threshold: ${reviewFixContext.reviewThreshold.toFixed(1)} / 10`,
+      );
+    }
+    if (reviewFixContext.previousReviewSummary) {
+      lines.push(
+        `Previous reviewer summary: ${toSingleLine(reviewFixContext.previousReviewSummary, 220)}`,
+      );
+    }
+    if (reviewFixContext.reviewerFindings.length > 0) {
+      lines.push("Previous reviewer must-fix items:");
+      for (const finding of reviewFixContext.reviewerFindings.slice(0, 5)) {
+        lines.push(`- ${finding}`);
+      }
+    }
+    lines.push("Raise the score above the approval threshold without reopening already accepted behavior.");
+  }
   if (issues.length > 0) {
     lines.push("Deterministic quality issues:");
     for (const issue of issues) lines.push(`- ${issue}`);
@@ -1200,6 +1340,9 @@ export async function createJobCommit(
     defaultPublicBranchName,
   );
   const publicBranchName = resolvedPublicBranch.branch;
+  if (extractMergeConflictReviewContext(job.params ?? null)) {
+    return createMergeConflictJobCommit(repo, workerId, job, publicBranchName, runtimeConfig);
+  }
   const requirePush = runtimeConfig.workerpals.requirePush || resolvedPublicBranch.overridden;
   const pushAgentBranch =
     requirePush || runtimeConfig.workerpals.pushAgentBranch || resolvedPublicBranch.overridden;
@@ -1865,6 +2008,220 @@ async function currentRefSha(repo: string, ref: string): Promise<string | null>
   return result.stdout.trim() || null;
 }
 
+async function currentBranchName(repo: string): Promise<string | null> {
+  const result = await git(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]);
+  if (!result.ok) return null;
+  return result.stdout.trim() || null;
+}
+
+async function gitDirPath(repo: string): Promise<string | null> {
+  const result = await git(repo, ["rev-parse", "--git-dir"]);
+  if (!result.ok) return null;
+  const gitDir = result.stdout.trim();
+  if (!gitDir) return null;
+  return resolve(repo, gitDir);
+}
+
+async function activeGitOperation(repo: string): Promise<"rebase" | "merge" | "cherry-pick" | null> {
+  const gitDir = await gitDirPath(repo);
+  if (!gitDir) return null;
+  if (existsSync(resolve(gitDir, "rebase-merge")) || existsSync(resolve(gitDir, "rebase-apply"))) {
+    return "rebase";
+  }
+  if (existsSync(resolve(gitDir, "MERGE_HEAD"))) return "merge";
+  if (existsSync(resolve(gitDir, "CHERRY_PICK_HEAD"))) return "cherry-pick";
+  return null;
+}
+
+async function isAncestorRef(repo: string, ancestor: string, descendant: string): Promise<boolean> {
+  const result = await git(repo, ["merge-base", "--is-ancestor", ancestor, descendant]);
+  return result.ok;
+}
+
+async function refreshMergeConflictTrackingRefs(
+  repo: string,
+  publicBranchName: string,
+  baseBranchName: string,
+): Promise<{ ok: true } | { ok: false; error: string }> {
+  const refspecs = [
+    `+refs/heads/${publicBranchName}:refs/remotes/origin/${publicBranchName}`,
+    `+refs/heads/${baseBranchName}:refs/remotes/origin/${baseBranchName}`,
+  ];
+  const fetch = await git(repo, ["fetch", "--quiet", "origin", ...new Set(refspecs)]);
+  if (!fetch.ok) {
+    return {
+      ok: false,
+      error: `Failed to refresh merge-conflict refs for ${publicBranchName}: ${redactSensitiveText(fetch.stderr || fetch.stdout)}`,
+    };
+  }
+  return { ok: true };
+}
+
+async function createMergeConflictJobCommit(
+  repo: string,
+  workerId: string,
+  job: {
+    id: string;
+    taskId: string;
+    kind: string;
+    params?: Record<string, unknown>;
+  },
+  publicBranchName: string,
+  runtimeConfig: WorkerpalsRuntimeConfig,
+): Promise<{ ok: boolean; branch?: string; sha?: string; error?: string }> {
+  const mergeConflictContext = extractMergeConflictReviewContext(job.params ?? null);
+  if (!mergeConflictContext) {
+    return { ok: false, error: "Merge-conflict context is missing required branch metadata." };
+  }
+
+  const sequencer = await activeGitOperation(repo);
+  if (sequencer) {
+    return {
+      ok: false,
+      error: `Merge-conflict job ${job.id} left a git ${sequencer} in progress. Finish the ${sequencer} before returning control to WorkerPals.`,
+    };
+  }
+
+  const refreshed = await refreshMergeConflictTrackingRefs(
+    repo,
+    publicBranchName,
+    mergeConflictContext.baseBranch,
+  );
+  if (!refreshed.ok) return refreshed;
+
+  const currentBranch = await currentBranchName(repo);
+  if (!currentBranch) {
+    return {
+      ok: false,
+      error: `Merge-conflict job ${job.id} must finish on a local branch inside the isolated sandbox, but HEAD is detached.`,
+    };
+  }
+
+  const remoteHeadSha = await currentRefSha(repo, `refs/remotes/origin/${publicBranchName}`);
+  if (
+    mergeConflictContext.expectedHeadSha &&
+    remoteHeadSha &&
+    remoteHeadSha !== mergeConflictContext.expectedHeadSha
+  ) {
+    return {
+      ok: false,
+      error:
+        `origin/${publicBranchName} moved from expected ${mergeConflictContext.expectedHeadSha.slice(0, 8)} ` +
+        `to ${remoteHeadSha.slice(0, 8)} while the job was running. Requeue on the newer branch head instead of overwriting it.`,
+    };
+  }
+
+  let result: { ok: boolean; stdout: string; stderr: string };
+  const stageArgs = buildStageCommand(job.kind, job.params);
+  if (!stageArgs) {
+    return {
+      ok: false,
+      error: `Unable to determine files to stage for merge-conflict job kind: ${job.kind}`,
+    };
+  }
+  result = await git(repo, stageArgs);
+  if (!result.ok) {
+    const stageErr = result.stderr || result.stdout;
+    if (
+      /pathspec .* did not match any files/i.test(stageErr) ||
+      /invalid path/i.test(stageErr) ||
+      /outside repository/i.test(stageErr)
+    ) {
+      console.warn(
+        `[WorkerPals] Stage target invalid/missing for merge-conflict job ${job.id}; retrying with fallback "git add -A".`,
+      );
+      result = await git(repo, [
+        "add",
+        "-A",
+        "--",
+        ".",
+        ":(exclude)workspace/**",
+        ":(exclude)outputs/**",
+      ]);
+    }
+    if (!result.ok) {
+      return { ok: false, error: `Failed to stage merge-conflict changes: ${result.stderr || result.stdout}` };
+    }
+  }
+
+  const cachedDiffQuiet = await git(repo, ["diff", "--cached", "--quiet"]);
+  let headSha = await currentRefSha(repo, "HEAD");
+  if (!headSha) {
+    return { ok: false, error: `Failed to resolve HEAD SHA for merge-conflict job ${job.id}.` };
+  }
+
+  if (!cachedDiffQuiet.ok) {
+    const cachedDiff = await git(repo, ["diff", "--cached"]);
+    const diff = cachedDiff.ok ? cachedDiff.stdout : "";
+    const cachedNameOnly = await git(repo, ["diff", "--cached", "--name-only"]);
+    const changedPaths = cachedNameOnly.ok
+      ? parseChangedPathsFromNameOnlyOutput(cachedNameOnly.stdout)
+      : [];
+    const jobPlanning = job.params?.planning as Record<string, unknown> | undefined;
+    const jobValidationSteps = toNonEmptyStringArray(
+      jobPlanning?.validationSteps ?? job.params?.validationSteps,
+    );
+    const llmCommitMsg = await generateCommitMessageFromDiff(
+      diff,
+      {
+        instruction: String(job.params?.instruction ?? ""),
+        type: normalizeCommitType(job.kind, job.params),
+        area: inferCommitArea(job.kind, job.params, changedPaths),
+        validationSteps: jobValidationSteps,
+      },
+      repo,
+      runtimeConfig,
+    ).catch(() => null);
+    if (!llmCommitMsg) {
+      console.warn(
+        `[WorkerPals] Commit message generator unavailable for merge-conflict job ${job.id}; using deterministic fallback.`,
+      );
+    }
+    const commitMsg = llmCommitMsg ?? buildWorkerCommitMessage(workerId, job, changedPaths);
+    const commit = await git(repo, ["commit", "-m", commitMsg]);
+    if (!commit.ok) {
+      return { ok: false, error: `Failed to commit merge-conflict resolution: ${commit.stderr}` };
+    }
+    headSha = await currentRefSha(repo, "HEAD");
+    if (!headSha) {
+      return { ok: false, error: `Failed to resolve committed HEAD SHA for merge-conflict job ${job.id}.` };
+    }
+  }
+
+  const baseRemoteRef = `refs/remotes/origin/${mergeConflictContext.baseBranch}`;
+  const rebasedOntoBase = await isAncestorRef(repo, baseRemoteRef, "HEAD");
+  if (!rebasedOntoBase) {
+    return {
+      ok: false,
+      error:
+        `Merge-conflict job ${job.id} did not finish rebased onto origin/${mergeConflictContext.baseBranch}. ` +
+        `Current branch ${currentBranch} must be a descendant of ${baseRemoteRef} before WorkerPals will push it.`,
+    };
+  }
+
+  if (remoteHeadSha && remoteHeadSha === headSha) {
+    return { ok: true, branch: publicBranchName, sha: headSha };
+  }
+
+  const pushArgs = [
+    "push",
+    mergeConflictContext.expectedHeadSha
+      ? `--force-with-lease=refs/heads/${publicBranchName}:${mergeConflictContext.expectedHeadSha}`
+      : "--force-with-lease",
+    "origin",
+    `HEAD:refs/heads/${publicBranchName}`,
+  ];
+  const push = await git(repo, pushArgs);
+  if (!push.ok) {
+    return {
+      ok: false,
+      error: `Failed to push rebased merge-conflict branch ${publicBranchName}: ${redactSensitiveText(push.stderr || push.stdout)}`,
+    };
+  }
+
+  return { ok: true, branch: publicBranchName, sha: headSha };
+}
+
 async function autoResolveRebaseConflicts(
   repo: string,
   maxPasses = 8,
@@ -2983,29 +3340,30 @@ export async function executeJob(
   };
   const executionBudgetMs = Number(planning.executionBudgetMs);
   const finalizationBudgetMs = Number(planning.finalizationBudgetMs);
-  const qualityMaxAutoRevisions = Math.max(
-    0,
-    Math.min(
-      10,
-      Number.isFinite(Number(runtimeConfig.workerpals.qualityMaxAutoRevisions))
-        ? Math.floor(Number(runtimeConfig.workerpals.qualityMaxAutoRevisions))
-        : 4,
-    ),
-  );
-  const qualitySoftPassOnExhausted =
-    typeof runtimeConfig.workerpals.qualitySoftPassOnExhausted === "boolean"
-      ? runtimeConfig.workerpals.qualitySoftPassOnExhausted
-      : true;
-  const qualityCriticMinScore = (() => {
-    const value = Number(runtimeConfig.workerpals.qualityCriticMinScore);
-    if (!Number.isFinite(value)) return 8;
-    return Math.max(0, Math.min(10, value));
-  })();
+  const reviewFixContext = extractReviewFixContext(normalizedParams);
+  const qualityGatePolicy = deriveQualityGatePolicy(normalizedParams, runtimeConfig);
+  const qualityMaxAutoRevisions = qualityGatePolicy.maxAutoRevisions;
+  const qualitySoftPassOnExhausted = qualityGatePolicy.softPassOnExhausted;
+  const qualityCriticMinScore = qualityGatePolicy.criticMinScore;
 
   onLog?.(
     "stdout",
     `[QualityGate] Policy: max_auto_revisions=${qualityMaxAutoRevisions}, soft_pass_on_exhausted=${qualitySoftPassOnExhausted ? "true" : "false"}, critic_min_score=${qualityCriticMinScore}`,
   );
+  if (qualityGatePolicy.mode === "review_fix") {
+    const priorScore =
+      reviewFixContext?.previousReviewScore != null
+        ? reviewFixContext.previousReviewScore.toFixed(1)
+        : "unknown";
+    const threshold =
+      reviewFixContext?.reviewThreshold != null
+        ? reviewFixContext.reviewThreshold.toFixed(1)
+        : qualityCriticMinScore.toFixed(1);
+    onLog?.(
+      "stdout",
+      `[QualityGate] review_fix override active: prior_score=${priorScore}, target_threshold=${threshold}, soft_pass_on_exhausted=false.`,
+    );
+  }
 
   let revisionAttempt = 0;
   let revisionHint = "";
@@ -3102,7 +3460,7 @@ export async function executeJob(
     }
 
     revisionAttempt += 1;
-    revisionHint = buildQualityRevisionHint(issues, critic, planning);
+    revisionHint = buildQualityRevisionHint(issues, critic, planning, reviewFixContext);
     onLog?.(
       "stderr",
       `[QualityGate] Quality gate requested revision ${revisionAttempt}/${qualityMaxAutoRevisions}: ${toSingleLine(

package/runtime/sandbox/apps/workerpals/src/job_runner.ts

@@ -18,6 +18,11 @@
 import { executeJob, shouldCommit, createJobCommit } from "./execute_job.js";
 import { loadPushPalsConfig } from "shared";
 import { writeFileSync } from "fs";
+import {
+  applyMergeConflictExecutionHints,
+  isMergeConflictResolutionParams,
+  prepareMergeConflictTaskRepo,
+} from "./merge_conflict_job.js";
 
 const CONFIG = loadPushPalsConfig();
 
@@ -125,69 +130,91 @@ async function main(): Promise<void> {
   // Setup git credentials for pushing
   setupGitCredentials();
   // Execute inside the mounted job worktree (docker -w), not the baked image copy.
-  const jobRepo = process.cwd();
-  const result = await executeJob(
-    spec.kind,
-    spec.params,
-    jobRepo,
-    (stream, line) => {
-      log(stream, line);
-    },
-    CONFIG,
-  );
-  // Build result object
-  const jobResult: JobResult = {
-    ok: result.ok,
-    summary: result.summary,
-    stdout: result.stdout,
-    stderr: result.stderr,
-    exitCode: result.exitCode,
-  };
-  // Create commit for file-modifying jobs
-  if (result.ok && shouldCommit(spec.kind, CONFIG)) {
-    log("stdout", `[JobRunner] Job modified files, creating commit...`);
-    const commitResult = await createJobCommit(
+  const mountedJobRepo = process.cwd();
+  let jobRepo = mountedJobRepo;
+  let cleanupJobRepo: (() => void) | null = null;
+  let effectiveParams = spec.params;
+  try {
+    if (isMergeConflictResolutionParams(spec.params)) {
+      const prepared = await prepareMergeConflictTaskRepo(
+        mountedJobRepo,
+        spec.jobId,
+        spec.params,
+        log,
+      );
+      jobRepo = prepared.repoPath;
+      cleanupJobRepo = prepared.cleanup;
+      effectiveParams = applyMergeConflictExecutionHints(spec.params, prepared);
+      log(
+        "stdout",
+        `[JobRunner] Merge-conflict job ${spec.jobId} is running in isolated sandbox repo ${jobRepo}`,
+      );
+    }
+    const result = await executeJob(
+      spec.kind,
+      effectiveParams,
       jobRepo,
-      spec.workerId,
-      {
-        id: spec.jobId,
-        taskId: spec.taskId,
-        kind: spec.kind,
-        params: spec.params,
-        context: "docker",
+      (stream, line) => {
+        log(stream, line);
       },
       CONFIG,
     );
-
-    if (commitResult.ok && commitResult.sha && commitResult.branch) {
-      jobResult.commit = {
-        branch: commitResult.branch!,
-        sha: commitResult.sha,
-      };
-      if (commitResult.sha === "no-changes") {
-        log("stdout", `[JobRunner] No changes to commit for ${spec.jobId}`);
+    // Build result object
+    const jobResult: JobResult = {
+      ok: result.ok,
+      summary: result.summary,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      exitCode: result.exitCode,
+    };
+    // Create commit for file-modifying jobs
+    if (result.ok && shouldCommit(spec.kind, CONFIG)) {
+      log("stdout", `[JobRunner] Job modified files, creating commit...`);
+      const commitResult = await createJobCommit(
+        jobRepo,
+        spec.workerId,
+        {
+          id: spec.jobId,
+          taskId: spec.taskId,
+          kind: spec.kind,
+          params: effectiveParams,
+          context: "docker",
+        },
+        CONFIG,
+      );
+
+      if (commitResult.ok && commitResult.sha && commitResult.branch) {
+        jobResult.commit = {
+          branch: commitResult.branch!,
+          sha: commitResult.sha,
+        };
+        if (commitResult.sha === "no-changes") {
+          log("stdout", `[JobRunner] No changes to commit for ${spec.jobId}`);
+        } else {
+          log("stdout", `[JobRunner] Created commit ${commitResult.sha} on ${commitResult.branch}`);
+        }
       } else {
-        log("stdout", `[JobRunner] Created commit ${commitResult.sha} on ${commitResult.branch}`);
+        const commitError =
+          commitResult.error ??
+          `Commit metadata missing for ${spec.kind} (${spec.jobId}) while running in Docker mode`;
+        jobResult.ok = false;
+        jobResult.summary = `Failed to create commit for ${spec.kind}`;
+        jobResult.stderr = [jobResult.stderr, commitError].filter(Boolean).join("\n");
+        jobResult.exitCode = jobResult.exitCode && jobResult.exitCode !== 0 ? jobResult.exitCode : 1;
+        log("stderr", `[JobRunner] Failed to create commit: ${commitError}`);
       }
-    } else {
-      const commitError =
-        commitResult.error ??
-        `Commit metadata missing for ${spec.kind} (${spec.jobId}) while running in Docker mode`;
-      jobResult.ok = false;
-      jobResult.summary = `Failed to create commit for ${spec.kind}`;
-      jobResult.stderr = [jobResult.stderr, commitError].filter(Boolean).join("\n");
-      jobResult.exitCode = jobResult.exitCode && jobResult.exitCode !== 0 ? jobResult.exitCode : 1;
-      log("stderr", `[JobRunner] Failed to create commit: ${commitError}`);
     }
-  }
 
-  // Output result with sentinel
-  const resultJson = JSON.stringify(jobResult);
-  // eslint-disable-next-line no-console
-  console.log(`___RESULT___ ${resultJson}`);
+    // Output result with sentinel
+    const resultJson = JSON.stringify(jobResult);
+    // eslint-disable-next-line no-console
+    console.log(`___RESULT___ ${resultJson}`);
 
-  // Exit with appropriate code
-  process.exit(jobResult.exitCode ?? (jobResult.ok ? 0 : 1));
+    // Exit with appropriate code
+    process.exit(jobResult.exitCode ?? (jobResult.ok ? 0 : 1));
+  } finally {
+    cleanupJobRepo?.();
+  }
 }
 
 main().catch((err) => {