@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/runner.js

@@ -0,0 +1,1094 @@
+import { config } from "./config.js";
+import { runtime } from "./runtime-state.js";
+import { log } from "./logger.js";
+import { runPodmanCapture } from "./opencode.js";
+import { getPlatform } from "./platform/index.js";
+import { shq, redact } from "./redact.js";
+import { prepareMcpRun, cleanupMcpRun, projectEnvVars, projectBuilderImage, projectBaseBranches, projectAutoResolveConflicts } from "./mcp/runner-bridge.js";
+import { ensureGitExcludes, PEERS_DIR } from "./mcp/peer-sync.js";
+import { syncCustomRepos, skillsPathsFor, SKILLS_DIR } from "./custom-repos-sync.js";
+import { OUT_DIR, attachmentPromptSection } from "./mcp/volume-files.js";
+import { podman } from "./podman.js";
+import { volumeName, resolveWorkBranch, timeoutFor, volumeExists, ensureVolumeAndWorkspace, pushBranch, forcePushStandalone, pushStandalone, envArgs, runContainerName, logDriverArgs, podmanVolumeName, formatSubmoduleWarning, workItemContainerNames, xdgVolumeName, XDG_HOME_DIR, checkConflicts, conflictResolverPrompt, readRemoteBranchTip, parseResolverResult, volumeSelinuxArgs } from "./git.js";
+import { buildPrompt, formatHistory } from "./prompt.js";
+import { BUILTIN_SUBAGENTS, validateAgentNames } from "./mention.js";
+import { renderBuildWorkflow } from "./build-workflow.js";
+import { pathPolicyEnvArgs } from "./path-sandbox.js";
+import { formatConflictFixNote, formatUnresolvedNote, formatFixOnlyUnresolvedNote, formatNoConflictsNote } from "./conflict-fix.js";
+import { writeRunFilesToVolume, ensurePodmanStore } from "./run-files.js";
+import { startStreamedPhase, endStreamedPhase, appendChunk } from "./run-log.js";
+import { addUsage } from "./run-usage.js";
+import { parseMrContent } from "./mr-content.js";
+import { buildCiFailureSection } from "./ci-failure.js";
+import { recordChangeRequest } from "./change-request-store.js";
+import { createChangeRequestWithAssignee } from "./mr-assignee.js";
+import { decideChangeRequestAction, openChangeRequest } from "./change-request-lifecycle.js";
+import { recordVolume, touchVolume } from "./volume-store.js";
+import { setBaseBranchIfUnset, getBaseBranch } from "./base-branch-store.js";
+import { setWorkBranchIfUnset, getWorkBranch } from "./work-item-branch-store.js";
+import { isWorkItemCancelRequested } from "./queue-store.js";
+import { emitMrEvent } from "./outbound-webhook.js";
+import { resolveStorageDriver, nestedPodmanArgs, devcontainerVolumeArgs, devcontainerEnvArgs, devcontainerPromptSection, devcontainerEnabled, hasFuseDevice, sandboxBaseArgs, } from "./devcontainer.js";
+export const ERROR_REPLY = "⚠️ Something went wrong. Please ask the admin to check the logs.";
+// Decide what a build run does with its branch after the agent succeeds (work
+// item #53). Both steps are opt-in: the resolved auto-push/auto-MR settings
+// enable them globally/per-project, and the /push /mr /force-push tokens force
+// them on per run. `/mr` implies a push (an MR needs a published branch);
+// auto-MR without a push is unreachable by design because the MR step is gated
+// on the push actually being planned.
+// Pure + exported so check-run-outcomes can pin the matrix without a container.
+export function buildOutputPlan(input, autoPush, autoMr) {
+    const push = input.forcePush === true || input.pushRequested === true || input.mrRequested === true || autoPush;
+    const mr = push && (input.mrRequested === true || autoMr);
+    return { push, mr };
+}
+// Decide whether the post-build publish path runs the conflict auto-fix step.
+//   On when the feature resolves on for the work item, or when the mention
+//   explicitly forced it with /fix-conflicts (+ /build) — a deliberate per-run
+//   override, like /push and /mr. Pure + exported so check-run-outcomes can pin
+//   the matrix without a container.
+export function shouldFixConflicts(input, autoResolveConflicts) {
+    return input.fixConflictsRequested === true || autoResolveConflicts;
+}
+// Cancellation checkpoint. /stop (or the WebUI Stop button) sets the durable
+// cancel flag and kills the phase containers; the kill surfaces here as a
+// non-zero podman exit. Returning {kind:"cancelled"} instead of an error keeps
+// the intentional stop quiet — no error reply, no error-log row, no push/MR.
+// `phase` is for logs only. Exported for scripts/check-run-outcomes.ts.
+export function cancelledOutcome(workItemId, phase) {
+    if (!isWorkItemCancelRequested(workItemId))
+        return null;
+    log.info("run cancelled", { workItemId, phase });
+    return { kind: "cancelled", reason: "stopped by user" };
+}
+// Build the opencode CLI flags that select a model and (optionally) a variant.
+// The variant flag is omitted entirely when unset so opencode uses the model's
+// default variant. Pure + exported so runner-helpers can assert the arg shape.
+export function modelArgs(model, variant = "") {
+    return variant ? ["--model", model, "--variant", variant] : ["--model", model];
+}
+// The XDG_* overrides passed to the opencode container as explicit `--env`
+//   pairs (never via the host `env` map — see the XDG_DATA_HOME note in
+//   runOpencodeInContainer: they would leak into the host podman process).
+//   Data + config live on the dedicated per-work-item xdg volume (mounted at
+//   XDG_HOME_DIR, OUTSIDE /workspace) so the session DB, auth, and per-run
+//   opencode.json persist across mentions yet can never be staged by the
+//   agent's `git add -A`. State + cache go to /tmp: when dev containers are
+//   enabled the nested-Podman store is mounted at
+//   /home/devbot/.local/share/containers under --userns=keep-id, which makes
+//   podman create the missing parents /home/devbot/.local{,/share} as root:root
+//   1755 — so opencode's Bun default (~/.local/state) cannot be created
+//   (EACCES). /tmp is always writable and off every volume, so lock/state files
+//   can never enter the target repo's git diff. Pure + exported for tests.
+export function xdgEnvArgs() {
+    return [
+        "--env", `XDG_DATA_HOME=${XDG_HOME_DIR}/data`,
+        "--env", `XDG_CONFIG_HOME=${XDG_HOME_DIR}/config`,
+        "--env", "XDG_STATE_HOME=/tmp/opencode-state",
+        "--env", "XDG_CACHE_HOME=/tmp/opencode-cache",
+    ];
+}
+// Build a redacted failure record carried on a non-ok RunOutcome. The webhook
+// handler persists it once the failure is final (terminal, or transient with
+// retries exhausted) so retries don't create duplicate error-log rows.
+// `model`/`variant` are the exact resolved values for the run (empty for
+// pre-prepare failures, where no model was selected yet).
+function failure(phase, kind, message, logs = "", exitCode = null, model = "", variant = "") {
+    return { phase, kind, exitCode, message, logs: redact(logs), model, variant };
+}
+// Post a non-fatal note when some submodules could not be fetched. The run
+//   proceeds without them (best-effort by design); this just surfaces which
+//   paths are missing so the user/admin can fix access. Never throws. Exported
+//   for scripts/check-run-outcomes.ts.
+export async function postSubmoduleWarnings(projectId, workItemNumber, paths) {
+    const note = formatSubmoduleWarning(paths);
+    if (!note)
+        return;
+    await getPlatform().workItems.postComment(projectId, workItemNumber, note).catch((e) => log.warn("submodule-warning note failed", { projectId, workItemNumber, err: e }));
+}
+// Destroy the per-work-item volumes. Force-stops any in-flight container first
+//   (run/sync/push + the nested-podman init), then removes the workspace volume
+//   and, when present, the paired nested-Podman store volume
+//   (`devbot-wi-<id>-podman`). Idempotent: a missing volume (never created,
+//   already GC'd) is a no-op at debug level. DRY_RUN skips the actual rm and
+//   logs intent. Returns a status string for the caller to post back to the
+//   thread; never throws.
+//   Reset mid-run: the runner's runPodmanCapture sees its container die with a
+//   non-zero exit and posts ERROR_REPLY — intentional, no suppression flag.
+export async function destroyWorkItemVolume(workItemId) {
+    const vol = volumeName(workItemId);
+    const podVol = podmanVolumeName(workItemId);
+    const xdgVol = xdgVolumeName(workItemId);
+    if (config.DRY_RUN) {
+        log.debug("DRY_RUN — would reset volume", { vol, podVol, xdgVol });
+        return { ok: true, message: `🧪 DRY_RUN — would reset volume ${vol}` };
+    }
+    // Force-stop any in-flight containers for this work item. Best-effort:
+    // missing containers produce a non-zero exit, logged at debug. One podman
+    // call with all names (one process, lazier than per-name killContainerByName).
+    const names = workItemContainerNames(workItemId);
+    const stop = await podman(["rm", "-f", ...names]);
+    if (stop.code !== 0) {
+        log.debug("container stop on reset (likely already gone)", { vol, code: stop.code });
+    }
+    // Remove the workspace, nested-Podman store, and xdg volumes independently:
+    // any may be absent (never created, already GC'd, or created before the
+    // feature landed), and a failure on one must not skip the others. The store
+    // volume is only present when DEVCONTAINER_ENABLED created it; the xdg
+    // volume only after the first writeRunFilesToVolume.
+    const results = await Promise.all([vol, podVol, xdgVol].map(async (v) => {
+        if (!(await volumeExists(v))) {
+            log.debug("volume absent on reset, nothing to remove", { vol: v });
+            return { vol: v, existed: false, removed: false };
+        }
+        const r = await podman(["volume", "rm", v]);
+        if (r.code === 0) {
+            log.info("reset: removed volume", { vol: v });
+            return { vol: v, existed: true, removed: true };
+        }
+        log.warn("reset: failed to remove volume", { vol: v, code: r.code, stderr: redact(r.stderr) });
+        return { vol: v, existed: true, removed: false };
+    }));
+    const workspace = results[0];
+    if (!workspace.existed) {
+        return { ok: true, message: `ℹ️ Nothing to reset (volume ${vol} was already gone)` };
+    }
+    if (!workspace.removed) {
+        return { ok: false, message: `⚠️ Reset failed (see logs)` };
+    }
+    // Workspace removed. The sibling volumes are best-effort: a failure there
+    // leaves it for the GC ledger, but the reset itself succeeded.
+    const stuck = results.slice(1).filter((r) => r.existed && !r.removed).map((r) => r.vol);
+    return {
+        ok: true,
+        message: stuck.length === 0
+            ? `✅ Reset: removed volume ${vol}`
+            : `✅ Reset: removed volume ${vol} (⚠️ sibling volume(s) ${stuck.join(", ")} could not be removed)`,
+    };
+}
+// The agent run container must share the work item's SELinux level with the
+// mid-run helper containers (attachment read/write, peer sync). Nested-Podman
+// build runs already disable SELinux separation, where a level is moot.
+export function runSelinuxArgs(workItemId, devcontainerArgs) {
+    return devcontainerArgs.includes("label=disable") ? [] : volumeSelinuxArgs(workItemId);
+}
+async function runOpencodeInContainer(input, mode, prompt, envVars = [], model, variant = "", devcontainerArgs = [], builderImage = config.BUILDER_IMAGE, opts = {}) {
+    const vol = volumeName(input.workItemId);
+    // ponytail: XDG_DATA_HOME=/home/devbot/.xdg/data redirects BOTH opencode's
+    //   session DB AND its auth file onto the per-work-item xdg volume (mounted
+    //   outside /workspace). The default ~/.local/share/opencode/ doesn't exist in
+    //   the image and home is mode 700, so opencode can't create it; the volume is
+    //   writable by devbot. opencode 1.18.5 ignores OPENCODE_AUTH_FILE and always
+    //   reads $XDG_DATA_HOME/opencode/auth.json. The auth.json is written INTO the
+    //   volume by writeRunFilesToVolume, NOT bind-mounted.
+    // ponytail: XDG_STATE_HOME/XDG_CACHE_HOME are redirected to /tmp (see
+    //   xdgEnvArgs). Their defaults sit under ~/.local, which nested-Podman's
+    //   keep-id store mount turns root-owned (EACCES) — and /tmp keeps lock/cache
+    //   files off the volume so they can't reach the git diff.
+    // ponytail: XDG_DATA_HOME (and the other XDG_* overrides) are deliberately
+    //   NOT in `env`. `env` is merged into the host podman process via
+    //   runPodmanCapture -> spawn; XDG_DATA_HOME doubles as podman's own runtime
+    //   storage dir, so a host-visible xdg path would make podman try to mkdir it
+    //   (permission denied) and fail with exit 125 before the container starts.
+    //   Pass them to the container via explicit --env NAME=VALUE below, never via
+    //   host env.
+    const env = {};
+    const args = [
+        "run", "--rm", ...logDriverArgs(), "--name", opts.containerName ?? runContainerName(input.workItemId),
+        // --add-host lets the container reach the host's MCP server at
+        // host.containers.internal:<MCP_PORT> without --network host.
+        "--add-host", "host.containers.internal:host-gateway",
+        "-v", `${vol}:/workspace:Z`,
+        // Dedicated xdg volume, mounted OUTSIDE the work tree. opencode reads its
+        // config + writes its session DB / auth here via $XDG_CONFIG_HOME and
+        // $XDG_DATA_HOME (see xdgEnvArgs), so credentials never sit inside the
+        // cloned repo where `git add -A` could stage them.
+        "-v", `${xdgVolumeName(input.workItemId)}:${XDG_HOME_DIR}:Z`,
+        // ponytail: the opencode.json, path-guard plugin, custom agent files, and
+        // auth all live in the xdg volume (written per-run by run-files.ts and
+        // custom-repos-sync.ts) and are read via $XDG_CONFIG_HOME/$XDG_DATA_HOME
+        // below — no bind mount. The old read-only agents/plugins bind mounts to
+        // ~/.config/opencode were dead once XDG_CONFIG_HOME moved (work item #39)
+        // and were removed in #63.
+        "-w", "/workspace",
+        ...xdgEnvArgs(),
+        // Path-scope policy for the in-container guard plugin (work item #46).
+        //   Explicit --env for the same reason as the XDG_* overrides: never leak
+        //   into the host podman process. See src/path-sandbox.ts.
+        ...pathPolicyEnvArgs(),
+        ...envArgs(envVars),
+        // CAP_SETUID/CAP_SETGID so docker/devbot-shell can drop commands to the
+        // unprivileged `agent` UID in every mode.
+        ...sandboxBaseArgs(),
+        // One SELinux level for this work item so mid-run MCP helpers (which mount
+        // the same volume with :Z) can read/write it without revoking our access.
+        ...runSelinuxArgs(input.workItemId, devcontainerArgs),
+        // Nested rootless Podman flags + the private store mount (build mode,
+        // DEVCONTAINER_ENABLED only). Empty otherwise.
+        ...devcontainerArgs,
+    ];
+    args.push(builderImage);
+    args.push(
+    // devbot-opencode sets umask 002 so files opencode writes into /workspace
+    // stay group-writable for the `agent` UID (bash tool / commits).
+    "/usr/local/bin/devbot-opencode", "run", "--format", "json", 
+    // --continue resumes the last session for /workspace. opencode
+    // fingerprints projects by dir, so this reliably targets this work
+    // item's session. On a fresh volume (no prior session) opencode creates
+    // a new one rather than erroring. Replaces the old `--session issue-<id>`
+    // which always failed: opencode owns its `ses_...` IDs and won't adopt
+    // a caller-chosen one.
+    ...(opts.resume === false ? [] : ["--continue"]), "--dir", "/workspace", "--auto", "--agent", mode, // "plan" or "build"
+    ...modelArgs(model, variant), shq(prompt));
+    // Per-run log sink (work item #61): emit the phase delimiter, then stream
+    // chunks to disk as they arrive so a long run is not buffered in memory.
+    // opencode spawns podman directly (not via podman()), so this is the only
+    // capture point for the agent-run container.
+    const streamedName = opts.containerName ?? runContainerName(input.workItemId);
+    startStreamedPhase(streamedName);
+    const result = await runPodmanCapture({
+        args,
+        timeoutMs: timeoutFor(mode),
+        // Inactivity watchdog (#96): bound a silent wedge/loop well before the total
+        // phase timeout. RUN_STALL_TIMEOUT_MS=0 disables it.
+        stallMs: config.RUN_STALL_TIMEOUT_MS,
+        env,
+        context: { workItemId: input.workItemId, workItemNumber: input.workItemNumber, projectId: input.projectId, mode: input.mode },
+        onChunk: (_stream, chunk) => appendChunk(input.workItemId, chunk),
+    });
+    endStreamedPhase(streamedName, result.exitCode);
+    addUsage(input.workItemId, result.usage);
+    return result;
+}
+// Standalone `/force-push` (no /build): force-push the work item's existing
+//   local branch to origin with --force-with-lease. No opencode run, no clone,
+//   no commit — a recovery action that re-publishes a WIP branch whose normal
+//   push was refused (e.g. the branch history was rewritten). Queued through the
+//   normal per-work-item FIFO so it can never race an in-flight build's push.
+//   Uses the same error-log/retry machinery as run().
+export async function runForcePushOnly(input) {
+    const branch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
+    log.info("force-push (standalone) start", {
+        projectId: input.projectId,
+        workItemNumber: input.workItemNumber,
+        workItemId: input.workItemId,
+    });
+    if (config.DRY_RUN) {
+        log.info("DRY_RUN — would force-push branch", { branch });
+        await getPlatform().workItems
+            .postComment(input.projectId, input.workItemNumber, `🧪 DRY_RUN — would force-push \`${branch}\``)
+            .catch((e) => log.warn("dry-run force-push note failed", e));
+        return { kind: "ok" };
+    }
+    const pushed = await forcePushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId));
+    if (!pushed.ok) {
+        log.error("standalone force-push failed", { workItemId: input.workItemId, reason: pushed.reason });
+        const reply = pushed.missingVolume
+            ? `⚠️ Nothing to force-push — no workspace exists for this work item yet. Run a \`/build\` first, then \`/force-push\`.`
+            : pushed.missingBranch
+                ? `⚠️ Nothing to force-push — no local branch \`${branch}\` for this work item.`
+                : `⚠️ force-push failed: ${pushed.reason}`;
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, reply).catch((e) => log.warn("force-push-failure note failed", e));
+        // Missing workspace/branch are terminal (a re-run hits the same state);
+        // a push failure may be a network blip or a lease rejection the retry's
+        // fresh fetch resolves — transient.
+        const failureDetail = failure("push", pushed.missingVolume || pushed.missingBranch ? "force-push-no-target" : "force-push-failed", pushed.reason, pushed.logs);
+        return pushed.missingVolume || pushed.missingBranch
+            ? { kind: "terminal", reason: pushed.reason, failure: failureDetail }
+            : { kind: "transient", reason: pushed.reason, failure: failureDetail };
+    }
+    await getPlatform().workItems
+        .postComment(input.projectId, input.workItemNumber, `✅ Force-pushed \`${branch}\`.`)
+        .catch((e) => log.warn("force-push-success note failed", e));
+    return { kind: "ok" };
+}
+// Standalone `/push` (no /build): publish the work item's existing local branch
+//   to origin with a plain fast-forward push. No opencode run, no clone, no
+//   commit — a recovery action for a branch a prior run left unpublished (e.g.
+//   auto-push was off). Queued through the normal per-work-item FIFO so it can
+//   never race an in-flight build's push. Same error-log/retry machinery.
+export async function runPushOnly(input) {
+    const branch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
+    log.info("push (standalone) start", {
+        projectId: input.projectId,
+        workItemNumber: input.workItemNumber,
+        workItemId: input.workItemId,
+    });
+    if (config.DRY_RUN) {
+        log.info("DRY_RUN — would push branch", { branch });
+        await getPlatform().workItems
+            .postComment(input.projectId, input.workItemNumber, `🧪 DRY_RUN — would push \`${branch}\``)
+            .catch((e) => log.warn("dry-run push note failed", e));
+        return { kind: "ok" };
+    }
+    const pushed = await pushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId));
+    if (!pushed.ok) {
+        log.error("standalone push failed", { workItemId: input.workItemId, reason: pushed.reason });
+        const reply = pushed.missingVolume
+            ? `⚠️ Nothing to push — no workspace exists for this work item yet. Run a \`/build\` first, then \`/push\`.`
+            : pushed.missingBranch
+                ? `⚠️ Nothing to push — no local branch \`${branch}\` for this work item.`
+                : `⚠️ push failed: ${pushed.reason}`;
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, reply).catch((e) => log.warn("push-failure note failed", e));
+        // Missing workspace/branch are terminal (a re-run hits the same state); a
+        // push failure may be a network blip — transient.
+        const failureDetail = failure("push", pushed.missingVolume || pushed.missingBranch ? "push-no-target" : "push-failed", pushed.reason, pushed.logs);
+        return pushed.missingVolume || pushed.missingBranch
+            ? { kind: "terminal", reason: pushed.reason, failure: failureDetail }
+            : { kind: "transient", reason: pushed.reason, failure: failureDetail };
+    }
+    await getPlatform().workItems
+        .postComment(input.projectId, input.workItemNumber, pushed.pushed ? `✅ Pushed \`${branch}\`.` : `ℹ️ Nothing to push — \`${branch}\` is already up to date.`)
+        .catch((e) => log.warn("push-success note failed", e));
+    return { kind: "ok" };
+}
+// Standalone `/mr` (no /build): publish the work item's existing local branch
+//   (plain push; --force-with-lease when /force-push was combined) then create
+//   or update its merge request against the resolved target branch. No opencode
+//   run and no agent-authored description, so the historical fallback content
+//   (`Resolve #<n>` / `Generated by devbot.`) is used. An already-published
+//   branch skips straight to the MR step.
+export async function runMrOnly(input) {
+    const branch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
+    log.info("mr (standalone) start", {
+        projectId: input.projectId,
+        workItemNumber: input.workItemNumber,
+        workItemId: input.workItemId,
+        forcePush: input.forcePush === true,
+    });
+    if (config.DRY_RUN) {
+        log.info("DRY_RUN — would push + open MR", { branch });
+        await getPlatform().workItems
+            .postComment(input.projectId, input.workItemNumber, `🧪 DRY_RUN — would push \`${branch}\` and open/update its MR`)
+            .catch((e) => log.warn("dry-run mr note failed", e));
+        return { kind: "ok" };
+    }
+    // Publish first. A missing workspace/branch is terminal and actionable.
+    const pushed = input.forcePush
+        ? await forcePushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId))
+        : await pushStandalone({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, projectEnvVars(input.projectId), projectBuilderImage(input.projectId));
+    if (!pushed.ok) {
+        log.error("standalone /mr push failed", { workItemId: input.workItemId, reason: pushed.reason });
+        const reply = pushed.missingVolume
+            ? `⚠️ Nothing to publish — no workspace exists for this work item yet. Run a \`/build\` first, then \`/mr\`.`
+            : pushed.missingBranch
+                ? `⚠️ Nothing to publish — no local branch \`${branch}\` for this work item.`
+                : `⚠️ push failed: ${pushed.reason}`;
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, reply).catch((e) => log.warn("mr-push-failure note failed", e));
+        const failureDetail = failure("push", pushed.missingVolume || pushed.missingBranch ? "mr-no-target" : "mr-push-failed", pushed.reason, pushed.logs);
+        return pushed.missingVolume || pushed.missingBranch
+            ? { kind: "terminal", reason: pushed.reason, failure: failureDetail }
+            : { kind: "transient", reason: pushed.reason, failure: failureDetail };
+    }
+    const mrResolved = await resolveMrTarget(input.projectId, input.workItemId, projectBaseBranches(input.projectId), "", "");
+    if (!mrResolved.ok) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, mrResolved.note).catch((e) => log.warn("mrTarget note failed", e));
+        return mrResolved.outcome;
+    }
+    // Conflict auto-fix for the standalone /mr path (work item #56): same
+    //   guarantee as the post-build path. Conflicts are checked here; only when
+    //   the check actually runs do we mint an MCP context (a fresh bearer token +
+    //   current providers) so the resolver build run has working forge tools.
+    if (projectAutoResolveConflicts(input.projectId, input.workItemId)) {
+        const envVars = projectEnvVars(input.projectId);
+        const builderImage = projectBuilderImage(input.projectId);
+        const cancelledPreCheck = cancelledOutcome(input.workItemId, "pre-conflict-check");
+        if (cancelledPreCheck)
+            return cancelledPreCheck;
+        const checked = await checkConflicts({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, target: mrResolved.branch }, envVars, builderImage);
+        if (checked === null) {
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ Could not check for merge conflicts with \`${mrResolved.branch}\`; skipping the merge request. Re-run when the forge is reachable.`)
+                .catch((e) => log.warn("conflict-check-fault note failed", e));
+            return { kind: "transient", reason: "conflict check failed", failure: failure("conflict", "check-failed", "checkConflicts returned null") };
+        }
+        if (!checked.conflictFree) {
+            let mcpCtx;
+            try {
+                mcpCtx = await prepareMcpRun(input.projectId, input.workItemId, input.workItemNumber, timeoutFor("build") + 5 * 60_000);
+                await writeRunFilesToVolume(input.workItemId, mcpCtx.mcpToken, mcpCtx.mcpServers, mcpCtx.mcpAuthJson, envVars, mcpCtx.plugins, mcpCtx.providers, builderImage, skillsPathsFor(mcpCtx.customRepos.skills), mcpCtx.lspServers);
+                const runModel = mcpCtx.models.build;
+                if (!runModel.model) {
+                    await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ Conflict auto-fix is enabled but no build model is configured. Set a build model in the WebUI, then re-run \`/mr\`.`)
+                        .catch((e) => log.warn("conflict-missing-model note failed", e));
+                    return { kind: "terminal", reason: "conflict auto-fix requires a build model", failure: failure("conflict", "no-model", "no build model configured") };
+                }
+                const preFixTip = await readRemoteBranchTip({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, envVars, builderImage);
+                const cancelledPreResolve = cancelledOutcome(input.workItemId, "pre-conflict-resolve");
+                if (cancelledPreResolve)
+                    return cancelledPreResolve;
+                const resolved = await runOpencodeInContainer(input, "build", conflictResolverPrompt(branch, mrResolved.branch), envVars, runModel.model, runModel.variant, [], builderImage, { resume: false, containerName: `devbot-wi-${input.workItemId}-resolve` });
+                const cancelledPostResolve = cancelledOutcome(input.workItemId, "post-conflict-resolve");
+                if (cancelledPostResolve)
+                    return cancelledPostResolve;
+                const outcome = resolved.error ? { resolved: false, strategy: "", files: [] } : parseResolverResult(resolved.text);
+                const rechecked = outcome.resolved
+                    ? await checkConflicts({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, target: mrResolved.branch }, envVars, builderImage)
+                    : null;
+                if (rechecked && rechecked.conflictFree) {
+                    const repushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, ...(preFixTip ? { preRunTip: preFixTip } : {}) }, envVars, builderImage);
+                    if (!repushed.ok) {
+                        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatUnresolvedNote(mrResolved.branch, checked.files))
+                            .catch((e) => log.warn("conflict-repush-failure note failed", e));
+                        return { kind: "terminal", reason: `conflict-fix re-push failed: ${repushed.reason}`, failure: failure("conflict", "repush-failed", repushed.reason, repushed.logs, null, runModel.model, runModel.variant) };
+                    }
+                    await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatConflictFixNote(mrResolved.branch, outcome.strategy))
+                        .catch((e) => log.warn("conflict-fixed note failed", e));
+                }
+                else {
+                    const files = checked.files.length > 0 ? checked.files : outcome.files;
+                    await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatUnresolvedNote(mrResolved.branch, files))
+                        .catch((e) => log.warn("conflict-unresolved note failed", e));
+                    return { kind: "terminal", reason: "merge conflicts could not be auto-resolved", failure: failure("conflict", "unresolved", files.join(", "), "", null, runModel.model, runModel.variant) };
+                }
+            }
+            finally {
+                if (mcpCtx)
+                    cleanupMcpRun(mcpCtx.mcpToken);
+            }
+        }
+    }
+    const mrContent = { title: `Resolve #${input.workItemNumber}`, description: "Generated by devbot." };
+    // No agent ran on the standalone /mr path, so no model/variant is recorded.
+    const mrInput = {
+        projectId: input.projectId,
+        workItemId: input.workItemId,
+        workItemNumber: input.workItemNumber,
+        mode: "build",
+        model: "",
+        variant: "",
+    };
+    try {
+        const mrs = await getPlatform().changeRequests.list(input.projectId, { sourceBranch: branch, state: "all" });
+        const action = decideChangeRequestAction(mrs);
+        if (action.kind === "update") {
+            const existing = await getPlatform().changeRequests.update(input.projectId, action.number, mrContent);
+            log.info("MR updated (standalone)", { url: existing.webUrl });
+            emitMrEvent(mrInput, { number: existing.number, webUrl: existing.webUrl }, false);
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `✅ Merge request updated: ${existing.webUrl}`).catch((e) => log.warn("mr-updated note failed", e));
+        }
+        else {
+            if (action.priorState)
+                log.info("associated MR not open; creating a fresh one (standalone)", { priorState: action.priorState });
+            const { mr, note } = await createChangeRequestWithAssignee(input.projectId, {
+                sourceBranch: branch,
+                targetBranch: mrResolved.branch,
+                title: mrContent.title,
+                description: mrContent.description,
+            });
+            log.info("MR created (standalone)", { url: mr.webUrl });
+            emitMrEvent(mrInput, { number: mr.number, webUrl: mr.webUrl }, true);
+            recordChangeRequest({
+                projectId: input.projectId,
+                sourceBranch: branch,
+                crNumber: mr.number,
+                workItemId: input.workItemId,
+                workItemNumber: input.workItemNumber,
+            });
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, note).catch((e) => log.warn("mr-created note failed", e));
+        }
+    }
+    catch (e) {
+        log.error("standalone MR create/lookup failed", e);
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, ERROR_REPLY).catch((e) => log.warn("mr-failure note failed", e));
+        return { kind: "terminal", reason: "MR create/lookup failed", failure: failure("mr", "mr-failed", e instanceof Error ? e.message : String(e)) };
+    }
+    return { kind: "ok" };
+}
+// Standalone `/fix-conflicts` (no /build): fix-only. Re-run the #56 conflict
+//   resolver on the work item's existing branch against the target branch of
+//   its open merge request — falling back to the /base-resolved target when no
+//   open MR exists — then re-push the resolved branch with the rewrite-aware
+//   lease. No publish-first and no MR create/update: a successful re-push
+//   updates the existing MR on the forge. The manual trigger bypasses the
+//   autoResolveConflicts setting and a contextual /auto-resolve-conflicts off.
+export async function runFixConflictsOnly(input) {
+    const branch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
+    log.info("fix-conflicts (standalone) start", {
+        projectId: input.projectId,
+        workItemNumber: input.workItemNumber,
+        workItemId: input.workItemId,
+    });
+    if (config.DRY_RUN) {
+        log.info("DRY_RUN — would fix merge conflicts", { branch });
+        await getPlatform().workItems
+            .postComment(input.projectId, input.workItemNumber, `🧪 DRY_RUN — would check and fix merge conflicts on \`${branch}\``)
+            .catch((e) => log.warn("dry-run fix-conflicts note failed", e));
+        return { kind: "ok" };
+    }
+    // A fix needs the work item's workspace (local branch). Fail with an
+    //   actionable note instead of letting podman auto-create an empty volume.
+    if (!(await volumeExists(volumeName(input.workItemId)))) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ Nothing to fix — no workspace exists for this work item yet. Run a \`/build\` first, then \`/fix-conflicts\`.`)
+            .catch((e) => log.warn("fix-conflicts-missing-workspace note failed", e));
+        return { kind: "terminal", reason: "no workspace for fix-conflicts", failure: failure("conflict", "no-workspace", "volume not found") };
+    }
+    // Target: the open MR's current target branch (this is what makes a
+    //   retargeted MR work); fall back to the /base-resolved target when there is
+    //   no open MR or the driver omits targetBranch.
+    let target;
+    try {
+        const mrs = await getPlatform().changeRequests.list(input.projectId, { sourceBranch: branch, state: "all" });
+        const open = openChangeRequest(mrs);
+        if (open?.targetBranch) {
+            target = open.targetBranch;
+        }
+        else {
+            const resolvedTarget = await resolveMrTarget(input.projectId, input.workItemId, projectBaseBranches(input.projectId), "", "");
+            if (!resolvedTarget.ok) {
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, resolvedTarget.note).catch((e) => log.warn("fix-conflicts-target note failed", e));
+                return resolvedTarget.outcome;
+            }
+            target = resolvedTarget.branch;
+        }
+    }
+    catch (e) {
+        log.warn("fix-conflicts MR lookup failed", { workItemId: input.workItemId, err: e });
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ Could not look up the merge request for \`${branch}\`; please retry.`)
+            .catch((err) => log.warn("fix-conflicts-lookup note failed", err));
+        return { kind: "transient", reason: "MR lookup failed", failure: failure("conflict", "mr-lookup-failed", e instanceof Error ? e.message : String(e)) };
+    }
+    const envVars = projectEnvVars(input.projectId);
+    const builderImage = projectBuilderImage(input.projectId);
+    const cancelledPreCheck = cancelledOutcome(input.workItemId, "pre-conflict-check");
+    if (cancelledPreCheck)
+        return cancelledPreCheck;
+    const checked = await checkConflicts({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, target }, envVars, builderImage);
+    if (checked === null) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ Could not check for merge conflicts with \`${target}\`. Re-run when the forge is reachable.`)
+            .catch((e) => log.warn("fix-conflicts-check-fault note failed", e));
+        return { kind: "transient", reason: "conflict check failed", failure: failure("conflict", "check-failed", "checkConflicts returned null") };
+    }
+    if (checked.conflictFree) {
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatNoConflictsNote(target))
+            .catch((e) => log.warn("fix-conflicts-clean note failed", e));
+        return { kind: "ok" };
+    }
+    let mcpCtx;
+    try {
+        mcpCtx = await prepareMcpRun(input.projectId, input.workItemId, input.workItemNumber, timeoutFor("build") + 5 * 60_000);
+        await writeRunFilesToVolume(input.workItemId, mcpCtx.mcpToken, mcpCtx.mcpServers, mcpCtx.mcpAuthJson, envVars, mcpCtx.plugins, mcpCtx.providers, builderImage, skillsPathsFor(mcpCtx.customRepos.skills), mcpCtx.lspServers);
+        const runModel = mcpCtx.models.build;
+        if (!runModel.model) {
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ Fixing merge conflicts requires a build model. Set a build model in the WebUI, then re-run \`/fix-conflicts\`.`)
+                .catch((e) => log.warn("fix-conflicts-missing-model note failed", e));
+            return { kind: "terminal", reason: "conflict fix requires a build model", failure: failure("conflict", "no-model", "no build model configured") };
+        }
+        const preFixTip = await readRemoteBranchTip({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch }, envVars, builderImage);
+        const cancelledPreResolve = cancelledOutcome(input.workItemId, "pre-conflict-resolve");
+        if (cancelledPreResolve)
+            return cancelledPreResolve;
+        const resolved = await runOpencodeInContainer(input, "build", conflictResolverPrompt(branch, target), envVars, runModel.model, runModel.variant, [], builderImage, { resume: false, containerName: `devbot-wi-${input.workItemId}-resolve` });
+        const cancelledPostResolve = cancelledOutcome(input.workItemId, "post-conflict-resolve");
+        if (cancelledPostResolve)
+            return cancelledPostResolve;
+        const outcome = resolved.error ? { resolved: false, strategy: "", files: [] } : parseResolverResult(resolved.text);
+        // The re-check is mandatory: checkConflicts aborts a half-finished
+        //   rebase/merge first, so a killed resolver cannot leave the branch wedged.
+        const rechecked = outcome.resolved
+            ? await checkConflicts({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, target }, envVars, builderImage)
+            : null;
+        if (rechecked && rechecked.conflictFree) {
+            const repushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch: branch, ...(preFixTip ? { preRunTip: preFixTip } : {}) }, envVars, builderImage);
+            if (!repushed.ok) {
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatFixOnlyUnresolvedNote(target, checked.files))
+                    .catch((e) => log.warn("fix-conflicts-repush-failure note failed", e));
+                return { kind: "terminal", reason: `conflict-fix re-push failed: ${repushed.reason}`, failure: failure("conflict", "repush-failed", repushed.reason, repushed.logs, null, runModel.model, runModel.variant) };
+            }
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatConflictFixNote(target, outcome.strategy))
+                .catch((e) => log.warn("fix-conflicts-fixed note failed", e));
+            log.info("conflicts fixed (standalone /fix-conflicts)", { workItemId: input.workItemId, strategy: outcome.strategy });
+            return { kind: "ok" };
+        }
+        const files = checked.files.length > 0 ? checked.files : outcome.files;
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatFixOnlyUnresolvedNote(target, files))
+            .catch((e) => log.warn("fix-conflicts-unresolved note failed", e));
+        return { kind: "terminal", reason: "merge conflicts could not be resolved", failure: failure("conflict", "unresolved", files.join(", "), "", null, runModel.model, runModel.variant) };
+    }
+    finally {
+        if (mcpCtx)
+            cleanupMcpRun(mcpCtx.mcpToken);
+    }
+}
+// Resolve the MR target branch for a work item. Chain (top wins):
+//   1. Per-work-item /base store value (set on first run, first-write-wins)
+//      — a second mention without /base keeps the chosen target.
+//   2. The configured base-branch list tried top-to-bottom (default "dev,master"
+//      → tries dev then master); first branch existing remotely wins.
+//   3. Failure — none exist (or the forge lookup errored) → an actionable note
+//      and a RunOutcome. Shared by the build run (whose prompt needs mrTarget
+//      before the agent runs) and the standalone /mr task.
+async function resolveMrTarget(projectId, workItemId, branches, model, variant) {
+    const stored = getBaseBranch(workItemId);
+    if (stored)
+        return { ok: true, branch: stored };
+    let hit = null;
+    try {
+        hit = await getPlatform().repository.firstExistingBranch(projectId, branches);
+    }
+    catch (e) {
+        // Forge API blip — transient, the note asks the user to re-mention.
+        return {
+            ok: false,
+            note: `⚠️ Could not verify base branches (\`${branches.join(", ")}\`); please retry.`,
+            outcome: { kind: "transient", reason: "base branch existence check failed", failure: failure("prepare", "base-lookup-failed", e instanceof Error ? e.message : String(e), "", null, model, variant) },
+        };
+    }
+    if (!hit) {
+        // Config problem — terminal until an admin fixes the base branches.
+        return {
+            ok: false,
+            note: `⚠️ No base branch found for this project. Tried: \`${branches.join(", ")}\`. Set base branches in the WebUI global settings or create one of the configured branches, then re-mention.`,
+            outcome: { kind: "terminal", reason: "no base branch found", failure: failure("prepare", "no-base-branch", `tried: ${branches.join(", ")}`, "", null, model, variant) },
+        };
+    }
+    return { ok: true, branch: hit };
+}
+export async function run(input) {
+    log.info("run start", {
+        projectId: input.projectId,
+        workItemNumber: input.workItemNumber,
+        workItemId: input.workItemId,
+        mode: input.mode,
+        prompt: input.prompt,
+    });
+    if (config.DRY_RUN) {
+        // In DRY_RUN we never create volumes, so existence check is meaningless.
+        // Always treat as first run to exercise the full-context prompt path.
+        const prompt = buildPrompt(input, true);
+        log.info("DRY_RUN — would run opencode", { mode: input.mode, prompt, isFirstRun: true });
+        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `🧪 DRY_RUN — mode=${input.mode}\n\n\`\`\`\n${prompt}\n\`\`\``)
+            .catch((e) => log.warn("dry-run note failed", e));
+        return { kind: "ok" };
+    }
+    // Cancellation checkpoint: a /stop that landed while the task waited in the
+    //   queue should abort before any MCP prep or volume/container work.
+    const cancelledAtStart = cancelledOutcome(input.workItemId, "pre-prepare");
+    if (cancelledAtStart)
+        return cancelledAtStart;
+    // Prepare MCP context: mint a per-thread bearer token, load project server
+    // configs, and build the mcp-auth.json. All MCP store access is encapsulated
+    // in the bridge — runner.ts never imports a store directly.
+    let mcpCtx;
+    try {
+        mcpCtx = await prepareMcpRun(input.projectId, input.workItemId, input.workItemNumber, timeoutFor(input.mode) + 5 * 60_000);
+        // Exact model+variant resolved for this run. Captured once so an error-log
+        // row records the model the run actually used, even if an admin edits the
+        // settings while the run is in flight. Used by the post-prepare failures.
+        const runModel = mcpCtx.models[input.mode];
+        // Persist the /base choice BEFORE the clone so a crash mid-clone still
+        //   leaves the value stored — the next run reads the correct mrTarget.
+        //   First-write-wins: a subsequent /base mention does NOT overwrite (the
+        //   ignored-note gate below surfaces that to the user). Cleared by /reset
+        //   and work-item close so a post-reset re-mention sets a fresh value.
+        if (input.baseBranch) {
+            setBaseBranchIfUnset(input.workItemId, input.baseBranch);
+        }
+        // Persist the /branch choice on the FIRST naming only, measured by the
+        //   store (not volume existence): the row survives /reset and close, so a
+        //   post-reset re-run reuses the same remote branch instead of colliding
+        //   with the branch we already pushed. A later, different /branch is ignored
+        //   with a note; the stored value stays authoritative.
+        const storedWorkBranch = getWorkBranch(input.workItemId);
+        if (input.workBranch && !storedWorkBranch) {
+            setWorkBranchIfUnset(input.workItemId, input.workBranch);
+        }
+        else if (input.workBranch && storedWorkBranch && input.workBranch !== storedWorkBranch) {
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ /branch '${input.workBranch}' ignored — this work item already uses branch '${storedWorkBranch}'.`)
+                .catch((e) => log.warn("branch-ignored note failed", e));
+        }
+        // Re-read after the possible write so the first-naming value is picked up
+        //   (storedWorkBranch is null on that run, so resolving it directly would
+        //   wrongly fall back to wi-<number>).
+        const workBranch = resolveWorkBranch(getWorkBranch(input.workItemId), input.workItemNumber);
+        const prepared = await ensureVolumeAndWorkspace({ ...input, workBranch }, input.mode, mcpCtx.envVars, mcpCtx.baseBranches, mcpCtx.builderImage);
+        // Cancellation checkpoint: a stop during clone/sync kills that container;
+        // treat the resulting prepare failure as an intentional stop, not an error.
+        const cancelledAfterPrep = cancelledOutcome(input.workItemId, "post-prepare");
+        if (cancelledAfterPrep)
+            return cancelledAfterPrep;
+        if (!prepared.ok) {
+            log.error("prep failed", { workItemId: input.workItemId, reason: prepared.reason, isFirstRun: prepared.isFirstRun });
+            // ponytail: missing-branch and no-base-branch are developer-actionable
+            //   (recreate the work item / set BASE_BRANCHES or create a branch); clone
+            //   and workspace-sync failures are infra (token/perms/network/forge 5xx)
+            //   — generic reply, retryable.
+            const actionable = prepared.reason.startsWith("work item branch")
+                || prepared.reason.startsWith("no base branch found")
+                || prepared.reason.startsWith("base branch existence check failed");
+            const reply = actionable ? `⚠️ ${prepared.reason}` : ERROR_REPLY;
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, reply).catch((e) => log.warn("prep-failure note failed", e));
+            // Clone/network/sync failures are transient (re-run may succeed);
+            // missing branch is terminal (re-run hits the same state).
+            const isTransient = prepared.reason.startsWith("clone failed")
+                || prepared.reason.startsWith("volume create failed")
+                || prepared.reason.startsWith("workspace sync failed");
+            const fail = failure("prepare", "prep-failed", prepared.reason, prepared.logs, null, runModel.model, runModel.variant);
+            return isTransient
+                ? { kind: "transient", reason: prepared.reason, failure: fail }
+                : { kind: "terminal", reason: prepared.reason, failure: fail };
+        }
+        // Record the volume in the GC ledger so the TTL sweep can later purge it.
+        //   recordVolume upserts: on first run it sets created_at + last_run_at;
+        //   on subsequent runs it preserves created_at and refreshes last_run_at
+        //   (overwriting a reconciled orphan's 0/0 with the real ids, so a future
+        //   purge can post a note). Cheaper than a separate touch call here.
+        recordVolume(input.workItemId, input.projectId, input.workItemNumber);
+        // Submodules are best-effort: a fetch failure is reported but never blocks
+        //   the run. Post the affected paths (if any) before the agent starts.
+        if (prepared.submoduleWarnings.length > 0) {
+            log.info("submodule fetch warnings", { workItemId: input.workItemId, paths: prepared.submoduleWarnings });
+            await postSubmoduleWarnings(input.projectId, input.workItemNumber, prepared.submoduleWarnings);
+        }
+        // /base on a subsequent run (volume exists) is inert for the clone — the
+        //   base was already chosen on first run. Surface this to the user so a
+        //   stale /base isn't silently dropped. The store value (first-write-wins)
+        //   is unaffected; mrTarget below still reads the original choice.
+        if (!prepared.isFirstRun && input.baseBranch) {
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ /base '${input.baseBranch}' ignored — work item already initialized.`)
+                .catch((e) => log.warn("base-ignored note failed", e));
+        }
+        // Sync admin-registered skills/subagent repos (work item #63) after clone and
+        // before writing the run files, so skills.paths can reference the synced
+        // skills dirs. Best-effort per repo: a failure logs and the run proceeds.
+        const skillsSync = await syncCustomRepos({
+            workItemId: input.workItemId,
+            kind: "skills",
+            repos: mcpCtx.customRepos.skills,
+            envVars: mcpCtx.envVars,
+            builderImage: mcpCtx.builderImage,
+        }).catch((e) => {
+            log.warn("skills sync failed", { workItemId: input.workItemId, err: e });
+            return { synced: [], failed: [], agents: [] };
+        });
+        const agentsSync = await syncCustomRepos({
+            workItemId: input.workItemId,
+            kind: "agents",
+            repos: mcpCtx.customRepos.agents,
+            envVars: mcpCtx.envVars,
+            builderImage: mcpCtx.builderImage,
+        }).catch((e) => {
+            log.warn("agents sync failed", { workItemId: input.workItemId, err: e });
+            return { synced: [], failed: [], agents: [] };
+        });
+        // Unknown-agent check moved here from the webhook (work item #63): the
+        // installed agent set is only known after syncing configured repos. Names
+        // requested by the mention are validated against built-ins + synced agents;
+        // a miss posts the same actionable note the webhook used to.
+        if (input.agentNames && input.agentNames.length > 0) {
+            const availableAgents = [...BUILTIN_SUBAGENTS, ...agentsSync.agents];
+            const agentError = validateAgentNames(input.agentNames, availableAgents);
+            if (agentError) {
+                await getPlatform().workItems
+                    .postErrorReply(input.projectId, input.workItemNumber, input.triggeringNoteId, agentError)
+                    .catch((e) => log.warn("unknown-agent reply failed", e));
+                return { kind: "terminal", reason: agentError };
+            }
+        }
+        const skillsPaths = skillsPathsFor(skillsSync.synced.map((name) => ({ name })));
+        // Write auth.json + per-run opencode.json (carrying the MCP bearer token)
+        // + mcp-auth.json (pasted OAuth tokens) into the volume (after clone,
+        // before opencode). See writeRunFilesToVolume for why we don't bind-mount.
+        await writeRunFilesToVolume(input.workItemId, mcpCtx.mcpToken, mcpCtx.mcpServers, mcpCtx.mcpAuthJson, mcpCtx.envVars, mcpCtx.plugins, mcpCtx.providers, mcpCtx.builderImage, skillsPaths, mcpCtx.lspServers);
+        const cancelledAfterFiles = cancelledOutcome(input.workItemId, "post-run-files");
+        if (cancelledAfterFiles)
+            return cancelledAfterFiles;
+        // Pre-write the .git/info/exclude entries so agent scratch output is
+        //   git-invisible from the start: `.devbot-out/` (outbound attachment staging,
+        //   always) and `.devbot-peers/` (only when this run has granted targets).
+        //   Best-effort; the upload + sync_project tools re-assert the exclude before
+        //   writing anything anyway.
+        const excludeDirs = [`${OUT_DIR}/`, `${SKILLS_DIR}/`, ...(mcpCtx.peerProjects.length > 0 ? [`${PEERS_DIR}/`] : [])];
+        await ensureGitExcludes(input.workItemId, excludeDirs, mcpCtx.envVars, undefined, mcpCtx.builderImage).catch((e) => log.warn("git exclude init failed", { workItemId: input.workItemId, err: e }));
+        // Nested rootless Podman for build-mode test workloads (work item #17).
+        //   Resolve the storage driver (auto probes /dev/fuse), create the private
+        //   per-work-item store volume + inner storage.conf, and collect the extra
+        //   outer-run args. Empty when disabled or plan mode, so the launch stays
+        //   byte-identical to the default unprivileged one. A missing /dev/fuse is
+        //   not an error — it selects the portable vfs driver.
+        let devcontainerArgs = [];
+        if (devcontainerEnabled(runtime().devcontainerEnabled, input.mode)) {
+            const driver = resolveStorageDriver(runtime().devcontainerStorageDriver, hasFuseDevice());
+            await ensurePodmanStore(input.workItemId, driver, mcpCtx.builderImage);
+            devcontainerArgs = [
+                ...nestedPodmanArgs(driver),
+                ...devcontainerVolumeArgs(podmanVolumeName(input.workItemId)),
+                ...devcontainerEnvArgs(),
+            ];
+            log.info("dev containers enabled", { workItemId: input.workItemId, driver });
+        }
+        // First run (or volume-lost recovery — destroyWorkItemVolume on close
+        //   makes this the common path across close/reopen cycles): reseed the
+        //   session from the forge's note history minus the bot's own prior replies
+        //   and the triggering mention (already the final `---` segment). One
+        //   cheap API call; subsequent runs carry context via opencode --continue.
+        let history = "";
+        if (prepared.isFirstRun) {
+            try {
+                const notes = await getPlatform().workItems.listComments(input.projectId, input.workItemNumber);
+                // Attachments are no longer inlined host-side: note bodies reach the
+                // prompt with their markdown links intact, and the agent downloads the
+                // ones it needs with `download_work_item_attachment`.
+                history = formatHistory(notes, config.BOT_USER_ID, input.triggeringNoteId);
+            }
+            catch (e) {
+                // ponytail: history fetch is best-effort — a forge blip shouldn't
+                //   abort the run. Log + fall back to the no-history prompt shape.
+                log.warn("history fetch failed", { workItemId: input.workItemId, err: e instanceof Error ? e.message : String(e) });
+            }
+        }
+        // Build mode: append a commit instruction. The agent authors the real
+        //   commit (Conventional Commits, #<iid> in the subject); devbot only
+        //   pushes after, with a fallback commit if the agent forgot (see
+        //   pushBranch). Plan mode stays byte-identical to buildPrompt output.
+        // mrTarget: the MR target branch. Resolution order (top wins):
+        //   1. Per-work-item /base store value (set on first run, first-write-wins)
+        //      — a second mention without /base keeps the chosen target.
+        //   2. BASE_BRANCHES list tried top-to-bottom (default "dev,master" →
+        //      tries dev then master); first branch existing remotely wins.
+        //   3. Error — none of the configured branches exist → actionable note, no
+        //      MR. (The clone already resolved targetBranch via the same walk in
+        //      git.ts and would have errored there on first run; this path covers
+        //      the rare case where the store is empty on a subsequent run after a
+        //      base branch was deleted upstream between runs.)
+        const mrResolved = await resolveMrTarget(input.projectId, input.workItemId, mcpCtx.baseBranches, runModel.model, runModel.variant);
+        if (!mrResolved.ok) {
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, mrResolved.note).catch((e) => log.warn("mrTarget note failed", e));
+            return mrResolved.outcome;
+        }
+        const mrTarget = mrResolved.branch;
+        const basePrompt = buildPrompt(input, prepared.isFirstRun, history);
+        // Attachment guidance is always appended: the upload tool is available in
+        //   both modes, and the staging dir is git-excluded for every run. Placed
+        //   before the git workflow block so commit/MR instructions stay last.
+        const attachmentSection = `\n\n---\n\n${attachmentPromptSection()}`;
+        // CI-failure auto report (work item #57): when this run was started by a
+        //   failed pipeline, fetch the failing job logs (tails) and inject them as
+        //   read-only context. A forge failure degrades to a note in the section,
+        //   never aborting the run.
+        let ciSection = "";
+        if (input.ciFailure) {
+            const ci = await buildCiFailureSection(input.projectId, input.ciFailure).catch((e) => {
+                log.warn("ci-failure section failed", { workItemId: input.workItemId, err: e });
+                return null;
+            });
+            if (ci)
+                ciSection = `\n\n---\n\n${ci.section}`;
+        }
+        // Dev-container guidance is appended only when the runtime is actually
+        //   available (build mode + enabled), placed before the git workflow block so
+        //   the commit/MR instructions stay last.
+        const devSection = devcontainerEnabled(runtime().devcontainerEnabled, input.mode) ? `\n\n---\n\n${devcontainerPromptSection()}` : "";
+        const prompt = input.mode === "build"
+            ? `${basePrompt}${attachmentSection}${devSection}\n\n---\n\n` +
+                renderBuildWorkflow({
+                    workItemNumber: input.workItemNumber,
+                    branch: workBranch,
+                    mrTarget,
+                    workflow: mcpCtx.buildWorkflow,
+                    mrDescription: mcpCtx.mrDescription,
+                })
+            : `${basePrompt}${attachmentSection}`;
+        const promptWithCi = `${prompt}${ciSection}`;
+        const result = await runOpencodeInContainer(input, input.mode, promptWithCi, mcpCtx.envVars, runModel.model, runModel.variant, devcontainerArgs, mcpCtx.builderImage);
+        // Cancellation checkpoint: a stop killed the run container. Skip the
+        // reply, the error branch, push, and MR — unwind as an intentional stop.
+        const cancelledAfterRun = cancelledOutcome(input.workItemId, "post-run");
+        if (cancelledAfterRun)
+            return cancelledAfterRun;
+        // Build mode: parse the agent's MR content block (```mr ... ```) from the
+        //   reply, strip it from the note text. Plan mode: no parsing, post raw.
+        const parsed = input.mode === "build" && !result.error
+            ? parseMrContent(result.text, input.workItemNumber)
+            : null;
+        const noteText = parsed ? parsed.reply : result.text;
+        // ponytail: timeout is user-actionable (split task / simplify / re-run);
+        //   spawn + non-zero exit are infra/internal — generic reply, detail in logs.
+        if (result.error && result.kind !== "timeout") {
+            log.warn("opencode error", { workItemId: input.workItemId, kind: result.kind, text: result.text });
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, ERROR_REPLY).catch((e) => {
+                log.error("postNote failed", e);
+            });
+            // spawn failure (podman couldn't start) is transient — re-run may succeed.
+            // exit (non-zero) is terminal — the agent/opencode had a real error.
+            if (result.kind === "spawn") {
+                return { kind: "transient", reason: `podman spawn failed: ${result.text.slice(0, 200)}`, failure: failure("run", "spawn", result.text, `${result.rawOutput}\n${result.stderrTail}`, result.exitCode, runModel.model, runModel.variant) };
+            }
+            return { kind: "terminal", reason: `opencode exited (${result.exitCode})`, failure: failure("run", "exit", result.text, `${result.rawOutput}\n${result.stderrTail}`, result.exitCode, runModel.model, runModel.variant) };
+        }
+        else {
+            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, noteText).catch((e) => {
+                log.error("postNote failed", e);
+            });
+            // Timed-out runs are terminal for the queue (the container was killed);
+            // record them as an error so they surface in the WebUI error log.
+            if (result.error && result.kind === "timeout") {
+                return { kind: "terminal", reason: "opencode timed out", failure: failure("run", "timeout", result.text, `${result.rawOutput}\n${result.stderrTail}`, result.exitCode, runModel.model, runModel.variant) };
+            }
+        }
+        // Build mode only: push branch + create MR. Plan mode: no git side-effects.
+        // Both steps are opt-in (work item #53): a run pushes only when the
+        // resolved auto-push setting is on or the user asked per-run with /push
+        // (or /force-push); it opens/updates an MR only when auto-MR is on or /mr
+        // was given — and only if the branch was actually pushed. auto-MR without a
+        // push is unreachable by design (an MR needs a published branch).
+        if (input.mode === "build" && !result.error) {
+            const { push: shouldPush, mr: shouldMr } = buildOutputPlan(input, mcpCtx.autoPush, mcpCtx.autoMr);
+            if (!shouldPush) {
+                log.info("auto-push disabled, skipping push/MR", { workItemId: input.workItemId });
+                return { kind: "ok" };
+            }
+            const cancelledBeforePush = cancelledOutcome(input.workItemId, "pre-push");
+            if (cancelledBeforePush)
+                return cancelledBeforePush;
+            const pushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch, ...(input.forcePush ? { forcePush: true } : {}), ...(prepared.branchTip ? { preRunTip: prepared.branchTip } : {}) }, mcpCtx.envVars, mcpCtx.builderImage);
+            if (pushed.ok && pushed.fallbackCommitted) {
+                log.warn("agent forgot to commit; devbot authored fallback commit", {
+                    workItemId: input.workItemId,
+                    workItemNumber: input.workItemNumber,
+                });
+            }
+            if (!pushed.ok) {
+                log.error("push failed", { workItemId: input.workItemId, stderr: pushed.reason });
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ push failed: ${pushed.reason}`)
+                    .catch((e) => log.warn("push-failure note failed", e));
+                return { kind: "terminal", reason: `push failed: ${pushed.reason}`, failure: failure("push", "push-failed", pushed.reason, pushed.logs, null, runModel.model, runModel.variant) };
+            }
+            if (!pushed.pushed) {
+                log.info("no new commits, skipping MR", { workItemId: input.workItemId });
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, "ℹ️ No changes to merge.")
+                    .catch((e) => log.warn("no-changes note failed", e));
+                return { kind: "ok" };
+            }
+            if (!shouldMr) {
+                log.info("auto-MR disabled, branch pushed", { workItemId: input.workItemId, branch: workBranch });
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `✅ Pushed \`${workBranch}\`.`)
+                    .catch((e) => log.warn("pushed note failed", e));
+                return { kind: "ok" };
+            }
+            const branch = workBranch;
+            // Conflict auto-fix (work item #56): before creating/updating the MR,
+            //   check whether the just-pushed branch merges cleanly into its target.
+            //   When off (default) this block is skipped entirely. When conflicts are
+            //   found, a direct build run resolves them, then the branch is re-pushed
+            //   (rewrite-aware lease) before the MR. On failure the branch stays
+            //   published, the MR is skipped, and an actionable note is posted.
+            if (shouldFixConflicts(input, mcpCtx.autoResolveConflicts)) {
+                const cancelledPreCheck = cancelledOutcome(input.workItemId, "pre-conflict-check");
+                if (cancelledPreCheck)
+                    return cancelledPreCheck;
+                const checked = await checkConflicts({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch, target: mrTarget }, mcpCtx.envVars, mcpCtx.builderImage);
+                if (checked === null) {
+                    await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, `⚠️ Could not check for merge conflicts with \`${mrTarget}\`; skipping the merge request. Re-run when the forge is reachable.`)
+                        .catch((e) => log.warn("conflict-check-fault note failed", e));
+                    return { kind: "transient", reason: "conflict check failed", failure: failure("conflict", "check-failed", "checkConflicts returned null", "", null, runModel.model, runModel.variant) };
+                }
+                if (!checked.conflictFree) {
+                    // Pin the lease to the tip the resolver is about to rewrite.
+                    const preFixTip = await readRemoteBranchTip({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch }, mcpCtx.envVars, mcpCtx.builderImage);
+                    const cancelledPreResolve = cancelledOutcome(input.workItemId, "pre-conflict-resolve");
+                    if (cancelledPreResolve)
+                        return cancelledPreResolve;
+                    const resolved = await runOpencodeInContainer(input, "build", conflictResolverPrompt(branch, mrTarget), mcpCtx.envVars, runModel.model, runModel.variant, [], mcpCtx.builderImage, { resume: false, containerName: `devbot-wi-${input.workItemId}-resolve` });
+                    const cancelledPostResolve = cancelledOutcome(input.workItemId, "post-conflict-resolve");
+                    if (cancelledPostResolve)
+                        return cancelledPostResolve;
+                    const outcome = resolved.error ? { resolved: false, strategy: "", files: [] } : parseResolverResult(resolved.text);
+                    // Re-check is mandatory: `checkConflicts` aborts a half-finished
+                    //   rebase/merge first, so a killed resolver cannot leave the branch
+                    //   wedged or commit conflict markers.
+                    const rechecked = outcome.resolved
+                        ? await checkConflicts({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch, target: mrTarget }, mcpCtx.envVars, mcpCtx.builderImage)
+                        : null;
+                    if (rechecked && rechecked.conflictFree) {
+                        const repushed = await pushBranch({ workItemId: input.workItemId, workItemNumber: input.workItemNumber, workBranch, ...(preFixTip ? { preRunTip: preFixTip } : {}) }, mcpCtx.envVars, mcpCtx.builderImage);
+                        if (!repushed.ok) {
+                            log.error("conflict-fix re-push failed", { workItemId: input.workItemId, reason: repushed.reason });
+                            await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatUnresolvedNote(mrTarget, checked.files))
+                                .catch((e) => log.warn("conflict-repush-failure note failed", e));
+                            return { kind: "terminal", reason: `conflict-fix re-push failed: ${repushed.reason}`, failure: failure("conflict", "repush-failed", repushed.reason, repushed.logs, null, runModel.model, runModel.variant) };
+                        }
+                        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatConflictFixNote(mrTarget, outcome.strategy))
+                            .catch((e) => log.warn("conflict-fixed note failed", e));
+                        log.info("conflicts auto-resolved", { workItemId: input.workItemId, strategy: outcome.strategy });
+                    }
+                    else {
+                        // Unresolved (or the re-check failed): the branch is already
+                        //   published from the pre-fix push, so skip the MR and hand the
+                        //   conflicts back to the user.
+                        const files = checked.files.length > 0 ? checked.files : outcome.files;
+                        log.warn("conflicts not auto-resolved", { workItemId: input.workItemId, files });
+                        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, formatUnresolvedNote(mrTarget, files))
+                            .catch((e) => log.warn("conflict-unresolved note failed", e));
+                        return { kind: "terminal", reason: "merge conflicts could not be auto-resolved", failure: failure("conflict", "unresolved", files.join(", "), "", null, runModel.model, runModel.variant) };
+                    }
+                }
+            }
+            const mrContent = parsed?.mr ?? { title: `Resolve #${input.workItemNumber}`, description: "Generated by devbot." };
+            // Cancellation checkpoint: the branch was just pushed, so skip creating or
+            // mutating the MR — a stopped run must not open a merge request.
+            const cancelledBeforeMr = cancelledOutcome(input.workItemId, "pre-mr");
+            if (cancelledBeforeMr)
+                return cancelledBeforeMr;
+            try {
+                const mrs = await getPlatform().changeRequests.list(input.projectId, { sourceBranch: branch, state: "all" });
+                const action = decideChangeRequestAction(mrs);
+                const mrInput = {
+                    projectId: input.projectId,
+                    workItemId: input.workItemId,
+                    workItemNumber: input.workItemNumber,
+                    mode: input.mode,
+                    model: runModel.model,
+                    variant: runModel.variant,
+                };
+                if (action.kind === "update") {
+                    const existing = await getPlatform().changeRequests.update(input.projectId, action.number, mrContent);
+                    log.info("MR updated", { url: existing.webUrl });
+                    emitMrEvent(mrInput, { number: existing.number, webUrl: existing.webUrl }, false);
+                }
+                else {
+                    if (action.priorState)
+                        log.info("associated MR not open; creating a fresh one", { priorState: action.priorState });
+                    const { mr, note, warning } = await createChangeRequestWithAssignee(input.projectId, {
+                        sourceBranch: branch,
+                        targetBranch: mrTarget,
+                        title: mrContent.title,
+                        description: mrContent.description,
+                    });
+                    log.info("MR created", { url: mr.webUrl });
+                    emitMrEvent(mrInput, { number: mr.number, webUrl: mr.webUrl }, true);
+                    recordChangeRequest({
+                        projectId: input.projectId,
+                        sourceBranch: branch,
+                        crNumber: mr.number,
+                        workItemId: input.workItemId,
+                        workItemNumber: input.workItemNumber,
+                    });
+                    // The auto-MR path historically posts no created note. Only surface one
+                    // when it carries the D5 assignee warning.
+                    if (warning) {
+                        await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, note).catch((e) => log.warn("mr-created note failed", e));
+                    }
+                }
+            }
+            catch (e) {
+                log.error("MR create/lookup failed", e);
+                await getPlatform().workItems.postComment(input.projectId, input.workItemNumber, ERROR_REPLY).catch((e) => log.warn("mr-failure note failed", e));
+                // The run itself succeeded (opencode produced output); only the MR step
+                // failed. Terminal so we don't retry the whole run just for MR plumbing.
+                return { kind: "terminal", reason: "MR create/lookup failed", failure: failure("mr", "mr-failed", e instanceof Error ? e.message : String(e), "", null, runModel.model, runModel.variant) };
+            }
+        }
+        // Default: run completed successfully (plan mode, or build mode with push+MR ok).
+        return { kind: "ok" };
+    }
+    finally {
+        if (mcpCtx)
+            cleanupMcpRun(mcpCtx.mcpToken);
+        // Refresh last_run_at so the GC sweep's inactivity clock resets on every
+        //   run termination (success or failure). The finally fires on every exit
+        //   path including early returns.
+        touchVolume(input.workItemId);
+        log.info("run end", { workItemId: input.workItemId, mode: input.mode });
+    }
+}
+//# sourceMappingURL=runner.js.map