@pushpalsdev/cli 1.0.50 → 1.0.52

package/dist/pushpals-cli.js

@@ -3048,6 +3048,44 @@ async function cleanupLingeringWorkerpalWarmContainers(opts) {
     removed: containerIds.length
   };
 }
+async function cleanupLocalWorkerpalSandboxImage(opts) {
+  const imageName = String(opts.dockerImage ?? "").trim();
+  if (!imageName) {
+    return {
+      ok: true,
+      detail: "no local WorkerPal sandbox image configured",
+      removed: false,
+      imageName: ""
+    };
+  }
+  const runCommandWithEnvFn = opts.runCommandWithEnvFn ?? runCommandWithEnv;
+  const commandTimeoutMs = typeof opts.commandTimeoutMs === "number" && Number.isFinite(opts.commandTimeoutMs) ? Math.max(1, Math.floor(opts.commandTimeoutMs)) : WORKERPAL_IMAGE_INSPECT_TIMEOUT_MS;
+  const dockerExecutable = resolveConfiguredDockerExecutable(opts.env, opts.platform ?? process.platform);
+  const remove = await runCommandWithEnvFn([dockerExecutable, "image", "rm", "-f", imageName], opts.repoRoot, opts.env, commandTimeoutMs);
+  if (!remove.ok) {
+    const detail = remove.stderr || remove.stdout || `exit ${remove.exitCode}`;
+    if (isMissingDockerImageDetail(detail)) {
+      return {
+        ok: true,
+        detail: `no local WorkerPal sandbox image found for ${imageName}`,
+        removed: false,
+        imageName
+      };
+    }
+    return {
+      ok: false,
+      detail: `failed to remove local WorkerPal sandbox image ${imageName}: ${detail}`,
+      removed: false,
+      imageName
+    };
+  }
+  return {
+    ok: true,
+    detail: `removed local WorkerPal sandbox image ${imageName}`,
+    removed: true,
+    imageName
+  };
+}
 async function cleanupLingeringPushPalsGitWorktrees(opts) {
   const runCommandWithEnvFn = opts.runCommandWithEnvFn ?? runCommandWithEnv;
   const forceDeleteWorktreePathFn = opts.forceDeleteWorktreePathFn ?? forceDeleteWorktreePath;
@@ -3564,6 +3602,36 @@ async function clearPushpalsState(opts) {
   for (const target of missing) {
     console.log(`[pushpals] Nothing to clear for ${target.label}: ${target.path}`);
   }
+  if (opts.config.remotebuddy.workerpalDocker || opts.config.remotebuddy.workerpalRequireDocker) {
+    const dockerEnv = normalizeChildProcessEnv(process.env);
+    const warmCleanup = await cleanupLingeringWorkerpalWarmContainers({
+      repoRoot: opts.repoRoot,
+      env: dockerEnv
+    });
+    if (warmCleanup.ok) {
+      console.log(warmCleanup.removed > 0 ? `[pushpals] Cleared WorkerPal warm containers: ${warmCleanup.detail}` : `[pushpals] Nothing to clear for WorkerPal warm containers: ${warmCleanup.detail}`);
+    } else {
+      failed.push({
+        label: "WorkerPal warm containers",
+        path: opts.repoRoot,
+        detail: warmCleanup.detail
+      });
+    }
+    const imageCleanup = await cleanupLocalWorkerpalSandboxImage({
+      repoRoot: opts.repoRoot,
+      env: dockerEnv,
+      dockerImage: opts.config.remotebuddy.workerpalImage ?? opts.config.workerpals.dockerImage
+    });
+    if (imageCleanup.ok) {
+      console.log(imageCleanup.removed ? `[pushpals] Cleared WorkerPal sandbox image: ${imageCleanup.imageName}` : `[pushpals] Nothing to clear for WorkerPal sandbox image: ${imageCleanup.detail}`);
+    } else {
+      failed.push({
+        label: "WorkerPal sandbox image",
+        path: imageCleanup.imageName || opts.repoRoot,
+        detail: imageCleanup.detail
+      });
+    }
+  }
   for (const failure of failed) {
     console.error(`[pushpals] Failed to clear ${failure.label}: ${failure.path} (${failure.detail})`);
   }
@@ -5276,6 +5344,7 @@ export {
   createSessionEventReplayFilter,
   copyTrackedRepoPath,
   computeEmbeddedServiceRestartBackoffMs,
+  cleanupLocalWorkerpalSandboxImage,
   cleanupLingeringWorkerpalWarmContainers,
   cleanupLingeringPushPalsGitWorktrees,
   bundledMonitoringHubNeedsRefresh,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushpalsdev/cli",
-  "version": "1.0.50",
+  "version": "1.0.52",
   "description": "PushPals terminal CLI for LocalBuddy -> RemoteBuddy orchestration",
   "license": "MIT",
   "repository": {

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/openai_codex_executor.py

@@ -77,11 +77,16 @@ _CODEX_WORKAROUND_NEGATION_HINTS = (
 _REJECTED_EXEC_COMMAND_PATTERN = re.compile(r"exec_command failed for `([^`]+)`", re.IGNORECASE)
 _DISALLOWED_SHELL_WRAPPER_PREFIXES = (
     "/bin/bash -lc ",
+    "/bin/bash -c ",
     "bash -lc ",
+    "bash -c ",
     "sh -lc ",
+    "sh -c ",
     "cmd /c ",
     "powershell -command ",
+    "powershell.exe -command ",
     "pwsh -command ",
+    "pwsh.exe -command ",
 )
 
 _VALID_APPROVAL_POLICIES = {"untrusted", "on-failure", "on-request", "never"}
@@ -89,6 +94,12 @@ _VALID_SANDBOX_POLICIES = {"read-only", "workspace-write", "danger-full-access"}
 _VALID_COLORS = {"always", "never", "auto"}
 _VALID_AUTH_MODES = {"auto", "api_key", "chatgpt"}
 _VALID_REASONING_EFFORTS = {"low", "medium", "high", "xhigh"}
+_DIRECT_COMMAND_POLICY_GUIDANCE = (
+    "Command-router policy: use direct commands only. Do not invoke `/bin/bash -lc`, `bash -c`, "
+    "`sh -lc`, `cmd /c`, `powershell -Command`, or `pwsh -Command`. Run the direct command "
+    "instead, such as `pwd`, `git status --porcelain`, `git diff -- path`, `ls dir`, "
+    "`cat file`, `sed -n '1,160p' file`, or `bun test <path>`."
+)
 
 
 def _model_supports_xhigh_reasoning(model: str) -> bool:
@@ -981,6 +992,81 @@ def _collect_disallowed_shell_wrapper_rejections(*texts: str) -> List[str]:
     return rejected
 
 
+def _unwrap_shell_wrapper_command(command: str) -> str:
+    normalized = _normalize_command_text(command)
+    if not normalized:
+        return ""
+    try:
+        parts = shlex.split(normalized, posix=True)
+    except ValueError:
+        return ""
+    if len(parts) < 3:
+        return ""
+    executable = str(parts[0] or "").strip().lower()
+    flag = str(parts[1] or "").strip().lower()
+    if executable in {"/bin/bash", "bash", "sh"} and flag in {"-lc", "-c"}:
+        return _normalize_command_text(" ".join(parts[2:]))
+    if executable == "cmd" and flag == "/c":
+        return _normalize_command_text(" ".join(parts[2:]))
+    if executable in {"powershell", "powershell.exe", "pwsh", "pwsh.exe"} and flag == "-command":
+        return _normalize_command_text(" ".join(parts[2:]))
+    return ""
+
+
+def _build_wrapper_recovery_guidance(rejected_commands: List[str]) -> str:
+    direct_equivalents: List[str] = []
+    seen: set[str] = set()
+    for command in rejected_commands:
+        direct = _unwrap_shell_wrapper_command(command)
+        lowered = direct.lower()
+        if not direct or lowered in seen:
+            continue
+        seen.add(lowered)
+        direct_equivalents.append(f"- `{command}` -> `{direct}`")
+    guidance_lines = [
+        "Command-router recovery: the previous attempt retried disallowed shell wrappers.",
+        "Retry once using direct commands only. Do not use `/bin/bash -lc`, `bash -c`, `sh -lc`, `cmd /c`, `powershell -Command`, `pwsh -Command`, pipelines, or chained shell snippets.",
+        "If you need to inspect files or git state, run the direct command itself (for example `git diff --name-only`, `git status --porcelain`, `ls path`, `cat file`, or `sed -n '1,120p' file`).",
+    ]
+    if direct_equivalents:
+        guidance_lines.append("Use these direct replacements for the rejected commands:")
+        guidance_lines.extend(direct_equivalents[:6])
+    return "\n".join(guidance_lines)
+
+
+def _merge_usage_records(first: Any, second: Any) -> Dict[str, Any]:
+    first_record = first if isinstance(first, dict) else {}
+    second_record = second if isinstance(second, dict) else {}
+    if not first_record:
+        return dict(second_record)
+    if not second_record:
+        return dict(first_record)
+    prompt_tokens = to_int(first_record.get("promptTokens"), 0) + to_int(
+        second_record.get("promptTokens"), 0
+    )
+    completion_tokens = to_int(first_record.get("completionTokens"), 0) + to_int(
+        second_record.get("completionTokens"), 0
+    )
+    merged = dict(second_record)
+    merged["promptTokens"] = prompt_tokens
+    merged["completionTokens"] = completion_tokens
+    merged["totalTokens"] = prompt_tokens + completion_tokens
+    merged["estimated"] = bool(first_record.get("estimated")) or bool(second_record.get("estimated"))
+    if not merged.get("backend"):
+        merged["backend"] = first_record.get("backend")
+    if not merged.get("modelId"):
+        merged["modelId"] = first_record.get("modelId")
+    return merged
+
+
+def _augment_supplemental_guidance(supplemental_guidance: List[str]) -> List[str]:
+    normalized = [str(item or "").strip() for item in supplemental_guidance if str(item or "").strip()]
+    joined = "\n".join(normalized).lower()
+    if "direct commands only" in joined or "shell-wrapper" in joined or "/bin/bash -lc" in joined:
+        return normalized
+    return [_DIRECT_COMMAND_POLICY_GUIDANCE, *normalized]
+
+
 def _read_text_if_exists(path: Path) -> str:
     try:
         if not path.exists():
@@ -1008,6 +1094,9 @@ def _run_codex_task(
     repo: str,
     instruction: str,
     supplemental_guidance: List[str],
+    *,
+    wrapper_recovery_attempt: int = 0,
+    baseline_changes: Optional[List[str]] = None,
 ) -> Dict[str, Any]:
     global _ACTIVE_CHILD, _INTERRUPTED_SIGNAL
     _INTERRUPTED_SIGNAL = None
@@ -1064,8 +1153,9 @@ def _run_codex_task(
     use_json = runtime_config.json_output
     reasoning_effort = _resolve_reasoning_effort(runtime_config, model)
     communicate_timeout_s = _resolve_communicate_timeout_seconds(runtime_config)
-    prompt = _build_instruction(instruction, supplemental_guidance)
-    baseline_changes = summarize_git_changes(repo)
+    effective_supplemental_guidance = _augment_supplemental_guidance(supplemental_guidance)
+    prompt = _build_instruction(instruction, effective_supplemental_guidance)
+    baseline_snapshot = list(baseline_changes) if baseline_changes is not None else summarize_git_changes(repo)
 
     with tempfile.TemporaryDirectory(prefix="pushpals-codex-") as tmp_dir:
         last_message_path = Path(tmp_dir) / "codex-last-message.txt"
@@ -1376,6 +1466,37 @@ def _run_codex_task(
         log_git_status(repo, log)
 
         if command_policy_rejection_loop:
+            if wrapper_recovery_attempt < 1:
+                recovery_guidance = _build_wrapper_recovery_guidance(rejected_shell_wrappers)
+                if recovery_guidance:
+                    log.warning(
+                        "Codex hit a shell-wrapper rejection loop; retrying once with direct-command recovery guidance."
+                    )
+                    retry_result = _run_codex_task(
+                        repo,
+                        instruction,
+                        [*effective_supplemental_guidance, recovery_guidance],
+                        wrapper_recovery_attempt=wrapper_recovery_attempt + 1,
+                        baseline_changes=baseline_snapshot,
+                    )
+                    retry_result["usage"] = _merge_usage_records(usage, retry_result.get("usage"))
+                    if retry_result.get("ok"):
+                        recovered_stdout = str(retry_result.get("stdout") or "").strip()
+                        retry_result["stdout"] = _truncate(
+                            (
+                                "Recovered after the first Codex attempt hit command-router shell-wrapper rejections.\n\n"
+                                f"{recovered_stdout}"
+                            ).strip()
+                        )
+                    else:
+                        retry_stderr = str(retry_result.get("stderr") or "").strip()
+                        retry_result["stderr"] = _truncate(
+                            (
+                                "The first Codex attempt hit command-router shell-wrapper rejections and was retried once with direct-command recovery guidance.\n\n"
+                                f"{retry_stderr}"
+                            ).strip()
+                        )
+                    return retry_result
             command_lines = (
                 "\n".join(f"- {command}" for command in rejected_shell_wrappers[:6])
                 if rejected_shell_wrappers
@@ -1460,7 +1581,7 @@ def _run_codex_task(
             }
 
         changed_paths = summarize_git_changes(repo)
-        delta = [p for p in changed_paths if p not in baseline_changes]
+        delta = [p for p in changed_paths if p not in baseline_snapshot]
         effective = delta if delta else changed_paths
         stdout_parts: List[str] = []
         if last_message:

package/runtime/sandbox/apps/workerpals/src/backends/openai_codex/test_openai_codex_runtime_config.py

@@ -1,4 +1,5 @@
 import os
+import re
 import sys
 import unittest
 import tempfile
@@ -10,9 +11,16 @@ for path in (_HERE, _SHARED):
     if str(path) not in sys.path:
         sys.path.insert(0, str(path))
 
-from executor_base import SettingsResolver, config_dir_for_runtime_config, runtime_config
+from executor_base import (
+    LOGGER_STANDARD_METHODS,
+    Logger,
+    SettingsResolver,
+    config_dir_for_runtime_config,
+    runtime_config,
+)
 from openai_codex_executor import (
     OpenAICodexRuntimeConfig,
+    _augment_supplemental_guidance,
     _resolve_reasoning_effort,
     _build_instruction,
     _collect_disallowed_shell_wrapper_rejections,
@@ -20,6 +28,7 @@ from openai_codex_executor import (
     _extract_usage_counts,
     _load_prompt_template,
     _repo_root_for_prompt_loading,
+    _unwrap_shell_wrapper_command,
     _usage_from_trace_or_estimate,
 )
 
@@ -200,10 +209,66 @@ class OpenAICodexRuntimeConfigTests(unittest.TestCase):
     def test_collects_disallowed_shell_wrapper_rejections(self) -> None:
         commands = _collect_disallowed_shell_wrapper_rejections(
             "error=exec_command failed for `/bin/bash -lc pwd`: CreateProcess { message: \"Rejected\" }",
+            "error=exec_command failed for `/bin/bash -c \"git status --porcelain\"`: Rejected",
             "error=exec_command failed for `sh -lc \"git diff\"`: Rejected",
             "error=exec_command failed for `pwd`: Rejected",
         )
-        self.assertEqual(commands, ["/bin/bash -lc pwd", 'sh -lc "git diff"'])
+        self.assertEqual(
+            commands,
+            ["/bin/bash -lc pwd", '/bin/bash -c "git status --porcelain"', 'sh -lc "git diff"'],
+        )
+
+    def test_unwraps_disallowed_shell_wrapper_commands_to_direct_commands(self) -> None:
+        self.assertEqual(
+            _unwrap_shell_wrapper_command("/bin/bash -lc 'git diff --name-only'"),
+            "git diff --name-only",
+        )
+        self.assertEqual(
+            _unwrap_shell_wrapper_command('cmd /c dir /b'),
+            "dir /b",
+        )
+        self.assertEqual(
+            _unwrap_shell_wrapper_command('pwsh -Command "Get-ChildItem src"'),
+            "Get-ChildItem src",
+        )
+
+    def test_logger_supports_warning_alias_used_by_recovery_paths(self) -> None:
+        logger = Logger("[test]")
+        self.assertTrue(callable(getattr(logger, "warn", None)))
+        self.assertTrue(callable(getattr(logger, "warning", None)))
+
+    def test_logger_supports_standard_backend_method_surface(self) -> None:
+        logger = Logger("[test]")
+        for method_name in LOGGER_STANDARD_METHODS:
+            self.assertTrue(
+                callable(getattr(logger, method_name, None)),
+                f"Logger is missing required method: {method_name}",
+            )
+
+    def test_backend_log_method_usage_matches_shared_logger_contract(self) -> None:
+        backend_root = _HERE.parent
+        method_pattern = re.compile(r"\blog\.(\w+)\(")
+        used_methods = set()
+        for path in backend_root.rglob("*.py"):
+            if path.name.startswith("test_"):
+                continue
+            text = path.read_text(encoding="utf-8")
+            used_methods.update(method_pattern.findall(text))
+
+        self.assertTrue(used_methods, "Expected to discover backend logger usage")
+        unsupported = sorted(method for method in used_methods if method not in LOGGER_STANDARD_METHODS)
+        self.assertEqual(
+            unsupported,
+            [],
+            f"Backend code uses logger method(s) not covered by executor_base.Logger: {unsupported}",
+        )
+
+    def test_augments_guidance_with_direct_command_policy_once(self) -> None:
+        guidance = _augment_supplemental_guidance(["Run bun test tests/example.test.ts"])
+        self.assertGreaterEqual(len(guidance), 2)
+        self.assertIn("direct commands only", guidance[0].lower())
+        guidance_again = _augment_supplemental_guidance(guidance)
+        self.assertEqual(guidance_again, guidance)
 
     def test_usage_falls_back_to_estimate_when_trace_has_no_usage(self) -> None:
         usage = _usage_from_trace_or_estimate({}, "abc" * 30, "done", model="gpt-5.4")

package/runtime/sandbox/apps/workerpals/src/backends/shared/executor_base.py

@@ -14,6 +14,7 @@ import os
 import re
 import subprocess
 import sys
+import traceback
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Mapping, Optional, Sequence, Set, Tuple
@@ -50,6 +51,15 @@ KNOWN_LITELLM_PROVIDER_PREFIXES: Set[str] = {
 }
 
 DEFAULT_TOOLCALL_RETRY_MAX = 1
+LOGGER_STANDARD_METHODS: Tuple[str, ...] = (
+    "debug",
+    "info",
+    "warn",
+    "warning",
+    "error",
+    "exception",
+    "critical",
+)
 
 # Superset of signals from both executors indicating the model failed to
 # emit tool calls / tool actions.
@@ -100,12 +110,43 @@ class Logger:
     def __init__(self, prefix: str) -> None:
         self.prefix = prefix
 
-    def info(self, message: str) -> None:
-        executor_log(f"{self.prefix} {message}")
+    def _coerce_message(self, message: Any, args: Tuple[Any, ...]) -> str:
+        text = str(message)
+        if not args:
+            return text
+        try:
+            return text % args
+        except Exception:
+            pieces = [text, *(str(arg) for arg in args)]
+            return " ".join(piece for piece in pieces if piece)
+
+    def _emit(self, _level: str, message: Any, *args: Any) -> None:
+        executor_log(f"{self.prefix} {self._coerce_message(message, args)}")
 
-    def debug(self, message: str) -> None:
+    def info(self, message: Any, *args: Any) -> None:
+        self._emit("info", message, *args)
+
+    def debug(self, message: Any, *args: Any) -> None:
         if _debug_enabled():
-            executor_log(f"{self.prefix} {message}")
+            self._emit("debug", message, *args)
+
+    def warn(self, message: Any, *args: Any) -> None:
+        self._emit("warn", message, *args)
+
+    def warning(self, message: Any, *args: Any) -> None:
+        self.warn(message, *args)
+
+    def error(self, message: Any, *args: Any) -> None:
+        self._emit("error", message, *args)
+
+    def critical(self, message: Any, *args: Any) -> None:
+        self._emit("critical", message, *args)
+
+    def exception(self, message: Any, *args: Any, exc_info: Any = True) -> None:
+        detail = self._coerce_message(message, args)
+        if exc_info:
+            detail = f"{detail}\n{traceback.format_exc().strip()}"
+        self._emit("exception", detail)
 
 
 def fail(summary: str, stderr: Optional[str] = None, exit_code: int = 1) -> int:

package/runtime/sandbox/apps/workerpals/src/execute_job.ts

@@ -2042,6 +2042,126 @@ async function activeGitOperation(repo: string): Promise<"rebase" | "merge" | "c
   return null;
 }
 
+export async function resumePreparedMergeConflictRebase(
+  repo: string,
+  kind: string,
+  params?: Record<string, unknown>,
+  onLog?: (stream: "stdout" | "stderr", line: string) => void,
+): Promise<
+  | { ok: true; resumed: boolean; sequencer: "rebase" | "merge" | "cherry-pick" | null; detail?: string }
+  | { ok: false; error: string }
+> {
+  const sequencer = await activeGitOperation(repo);
+  if (sequencer !== "rebase") {
+    return { ok: true, resumed: false, sequencer };
+  }
+
+  const unresolved = await git(repo, ["diff", "--name-only", "--diff-filter=U"]);
+  if (!unresolved.ok) {
+    return {
+      ok: false,
+      error: `Failed to inspect unresolved merge-conflict paths: ${combinedGitOutput(unresolved)}`,
+    };
+  }
+  const unresolvedPaths = parseChangedPathsFromNameOnlyOutput(unresolved.stdout);
+  if (unresolvedPaths.length > 0) {
+    const stillMarked = unresolvedPaths.filter((relativePath) => {
+      try {
+        const contents = readFileSync(resolve(repo, relativePath), "utf8");
+        return /^(<{7}|={7}|>{7})( .*)?$/m.test(contents);
+      } catch {
+        return true;
+      }
+    });
+    if (stillMarked.length > 0) {
+      return {
+        ok: true,
+        resumed: false,
+        sequencer,
+        detail: `rebase still has ${stillMarked.length} unresolved conflict marker file(s)`,
+      };
+    }
+    onLog?.(
+      "stdout",
+      `[MergeConflict] Found ${unresolvedPaths.length} resolved-but-unstaged conflict file(s); staging them before continuing the rebase.`,
+    );
+  }
+
+  let stageResult: { ok: boolean; stdout: string; stderr: string };
+  const stageArgs = buildStageCommand(kind, params);
+  if (stageArgs) {
+    stageResult = await git(repo, stageArgs);
+    if (!stageResult.ok) {
+      const stageErr = stageResult.stderr || stageResult.stdout;
+      if (
+        /pathspec .* did not match any files/i.test(stageErr) ||
+        /invalid path/i.test(stageErr) ||
+        /outside repository/i.test(stageErr)
+      ) {
+        onLog?.(
+          "stdout",
+          `[MergeConflict] Stage target invalid/missing for ${kind}; retrying with fallback "git add -A".`,
+        );
+        stageResult = await git(repo, [
+          "add",
+          "-A",
+          "--",
+          ".",
+          ":(exclude)workspace/**",
+          ":(exclude)outputs/**",
+        ]);
+      }
+    }
+  } else {
+    stageResult = await git(repo, [
+      "add",
+      "-A",
+      "--",
+      ".",
+      ":(exclude)workspace/**",
+      ":(exclude)outputs/**",
+    ]);
+  }
+  if (!stageResult.ok) {
+    return {
+      ok: false,
+      error:
+        "Failed to stage resolved merge-conflict changes before continuing rebase: " +
+        combinedGitOutput(stageResult),
+    };
+  }
+
+  let rebaseContinue = await git(repo, ["-c", "core.editor=true", "rebase", "--continue"]);
+  let continueOutput = combinedGitOutput(rebaseContinue);
+  if (!rebaseContinue.ok && isRebaseEditorPromptOutput(continueOutput)) {
+    rebaseContinue = await git(repo, ["-c", "core.editor=true", "rebase", "--continue"]);
+    continueOutput = combinedGitOutput(rebaseContinue);
+  }
+  if (!rebaseContinue.ok) {
+    return {
+      ok: false,
+      error: `Failed to continue prepared merge-conflict rebase: ${continueOutput}`,
+    };
+  }
+
+  const remainingSequencer = await activeGitOperation(repo);
+  if (!remainingSequencer) {
+    onLog?.(
+      "stdout",
+      "[MergeConflict] Auto-continued the prepared rebase after the executor returned with no unresolved conflicts.",
+    );
+  }
+  return {
+    ok: true,
+    resumed: true,
+    sequencer: remainingSequencer,
+    detail:
+      remainingSequencer === "rebase"
+        ? "rebase advanced but another continuation step is still required"
+        : undefined,
+  };
+}
+
 async function isAncestorRef(repo: string, ancestor: string, descendant: string): Promise<boolean> {
   const result = await git(repo, ["merge-base", "--is-ancestor", ancestor, descendant]);
   return result.ok;
@@ -3409,7 +3529,18 @@ export async function executeJob(
     );
     if (!result.ok) return result;
     if (mergeConflictContext) {
-      const sequencer = await activeGitOperation(repo);
+      const resume = await resumePreparedMergeConflictRebase(repo, kind, attemptParams, onLog);
+      if (!resume.ok) {
+        onLog?.("stderr", `[MergeConflict] ${resume.error}`);
+        return {
+          ok: false,
+          summary: "Merge-conflict rebase continuation failed",
+          stdout: result.stdout,
+          stderr: [result.stderr ?? "", resume.error].filter(Boolean).join("\n"),
+          exitCode: 4,
+        };
+      }
+      const sequencer = resume.sequencer;
       if (sequencer) {
         const detail =
           `Merge-conflict job returned with git ${sequencer} still in progress. ` +