@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/git.js

@@ -0,0 +1,605 @@
+import { config } from "./config.js";
+import { runtime } from "./runtime-state.js";
+import { log } from "./logger.js";
+import { shq, redact } from "./redact.js";
+import { podman } from "./podman.js";
+import { buildPostCloneScript } from "./devbot-scripts.js";
+import { getPlatform } from "./platform/index.js";
+import { conflictCheckScript, parseConflictCheckResult, publishScript, parsePublishResult, parseBranchTip, resolverPrompt, parseResolverResult } from "./conflict-fix.js";
+// Volume GC lives in src/volume-gc.ts: a startup reconcile + periodic sweep
+//   remove devbot-wi-* volumes inactive for VOLUME_GC_TTL_MS (default 1 week).
+// Build the `--env NAME=VALUE` podman args for a set of per-project env vars.
+// Spread into any podman `run` args array so every container (clone, sync,
+// auth-write, opencode, push) sees the same env. Values are injected as-is —
+// they're already decrypted by the store. podman --env passes them into the
+// container's environment; no shell interpolation occurs.
+export function envArgs(vars) {
+    const out = [];
+    for (const v of vars) {
+        out.push("--env", `${v.name}=${v.value}`);
+    }
+    return out;
+}
+export function volumeName(workItemId) {
+    const prefix = config.INSTANCE_ID ? `${config.INSTANCE_ID}-` : "";
+    return `${prefix}devbot-wi-${workItemId}`;
+}
+// Every container that mounts a work item's named volumes must use the same
+//   SELinux MCS pair. Podman assigns each container a random pair, and `:Z`
+//   relabels the whole volume to the mounting container's pair — so a helper
+//   spawned while the agent is running (attachment download/read, peer sync)
+//   would revoke the agent's access to /workspace and make the files it writes
+//   unreadable to the agent (EACCES). Deriving one pair from the work item id
+//   keeps every container of that work item compatible while still separating
+//   different work items. No-op where SELinux is disabled (InitLabels returns
+//   early), so it is safe to pass unconditionally.
+export function volumeSelinuxLevel(workItemId) {
+    const id = Math.abs(Math.trunc(workItemId));
+    const a = id % 1024;
+    const b = (a + 1 + (id % 1023)) % 1024;
+    return `s0:c${a},c${b}`;
+}
+export function volumeSelinuxArgs(workItemId) {
+    return ["--security-opt", `label=level:${volumeSelinuxLevel(workItemId)}`];
+}
+// Name of the opencode `run` container for a work item. Single-sourced so the
+// runner and the logs route can never drift (see runner.ts and task-log.ts).
+export function runContainerName(workItemId) {
+    return `devbot-wi-${workItemId}-run`;
+}
+// Prefix shared by every phase container for a work item. The live-log viewer
+// discovers the active phase by listing running containers with this prefix.
+export function workItemContainerPrefix(workItemId) {
+    return `devbot-wi-${workItemId}-`;
+}
+// Pin the container log driver so `podman logs` can serve a RUNNING container's
+// output. Some hosts default to the journald driver, which returns nothing for a
+// live container (and may have no journal backend at all); k8s-file writes each
+// container's stdout/stderr to a file that `podman logs` can read/tail
+// immediately. Every phase container launch spreads this in.
+export function logDriverArgs() {
+    return ["--log-driver", "k8s-file"];
+}
+// Name of a concrete phase container for a work item. Single-sourced so stop/
+// reset, the launch sites, and the live-log phase discovery can never drift.
+// `runContainerName` stays separate because it is referenced widely; every other
+// phase goes through here.
+export function workItemContainerName(workItemId, phase) {
+    return `${workItemContainerPrefix(workItemId)}${phase}`;
+}
+// Every phase container for a work item, in one place so stop/reset and the
+// launch sites can never drift. These are the exact `--name`s used when the
+// containers are created (git clone/sync/push, auth/podman-init, peer sync,
+// opencode run). `podman rm -f` tolerates absent names.
+export function workItemContainerNames(workItemId) {
+    return [
+        workItemContainerName(workItemId, "detect"),
+        workItemContainerName(workItemId, "clone"),
+        workItemContainerName(workItemId, "sync"),
+        workItemContainerName(workItemId, "auth"),
+        workItemContainerName(workItemId, "podman-init"),
+        workItemContainerName(workItemId, "peerinit"),
+        workItemContainerName(workItemId, "peersync"),
+        workItemContainerName(workItemId, "gitexclude"),
+        workItemContainerName(workItemId, "attachread"),
+        workItemContainerName(workItemId, "attachdl"),
+        runContainerName(workItemId),
+        workItemContainerName(workItemId, "push"),
+        workItemContainerName(workItemId, "forcepush"),
+        workItemContainerName(workItemId, "conflictcheck"),
+        workItemContainerName(workItemId, "tip"),
+        workItemContainerName(workItemId, "resolve"),
+    ];
+}
+// Human-facing phase labels for the log viewer, keyed by the container-name
+// suffix. A phase with no label falls back to the raw suffix.
+const PHASE_LABELS = {
+    detect: "Detecting workspace",
+    clone: "Cloning repository",
+    sync: "Syncing repository",
+    auth: "Writing run files",
+    "podman-init": "Preparing nested Podman",
+    peerinit: "Preparing peer projects",
+    peersync: "Syncing peer project",
+    gitexclude: "Updating git excludes",
+    attachread: "Reading attachment",
+    attachdl: "Downloading attachment",
+    run: "Running agent",
+    push: "Pushing branch",
+    forcepush: "Force-pushing branch",
+    conflictcheck: "Checking for conflicts",
+    tip: "Reading branch tip",
+    resolve: "Resolving conflicts",
+};
+export function phaseLabel(phase) {
+    return PHASE_LABELS[phase] ?? phase;
+}
+// Private nested-Podman store for a work item. Paired 1:1 with the workspace
+//   volume; created only when DEVCONTAINER_ENABLED, removed alongside it. The
+//   `-podman` suffix is deliberately outside the `(\d+)$` workspace reconciler
+//   regex so the two are never confused.
+export function podmanVolumeName(workItemId) {
+    const prefix = config.INSTANCE_ID ? `${config.INSTANCE_ID}-` : "";
+    return `${prefix}devbot-wi-${workItemId}-podman`;
+}
+// Mount point for the dedicated per-work-item XDG volume. Deliberately outside
+//   /workspace (the cloned target repo's working tree) so opencode's config,
+//   auth, and session data — including the per-run MCP bearer token and the
+//   provider API keys — can never be staged by the agent's `git add -A`.
+export const XDG_HOME_DIR = "/home/devbot/.xdg";
+// Dedicated per-work-item XDG volume: opencode's config + data live OUTSIDE the
+//   work tree. Sibling of the workspace and nested-Podman store volumes; all
+//   three share one ledger row and are reclaimed together by reset/GC. The
+//   `-xdg` suffix is recognized by the volume reconciler (volume-gc.ts).
+export function xdgVolumeName(workItemId) {
+    const prefix = config.INSTANCE_ID ? `${config.INSTANCE_ID}-` : "";
+    return `${prefix}devbot-wi-${workItemId}-xdg`;
+}
+export function branchName(workItemNumber) {
+    return `wi-${workItemNumber}`;
+}
+// Resolve the branch a work item runs on: the stored /branch choice when set,
+//   otherwise the default wi-<number>. Pure so the resolution rule is unit
+//   testable without a DB; the store read happens in runner.ts.
+export function resolveWorkBranch(stored, workItemNumber) {
+    return stored ?? branchName(workItemNumber);
+}
+export function timeoutFor(mode) {
+    return mode === "build" ? runtime().buildTimeoutMs : runtime().planTimeoutMs;
+}
+// Strip trailing slashes from PLATFORM_URL so URL-scoped git config keys stay
+//   well-formed (http.<url>/.extraHeader, not http.<url>//.extraHeader).
+export function normalizeForgeUrl(url) {
+    return url.replace(/\/+$/, "");
+}
+// Hostname (no port) of PLATFORM_URL, for the SSH→HTTPS insteadOf rewrite. Uses
+//   the URL parser so a path on PLATFORM_URL (rare) doesn't leak into the rewrite
+//   key, and strips any HTTPS port so it never contaminates an SSH rewrite. The
+//   SSH host is assumed to equal the PLATFORM_URL hostname.
+export function forgeHostname(url) {
+    return new URL(normalizeForgeUrl(url)).hostname;
+}
+// Git auth for the forge's smart-HTTP endpoint. The driver supplies the header
+//   (URL-scoped to the configured forge host for GitLab, so git only sends the
+//   bot token there — a submodule on an external host is fetched without the
+//   token instead of leaking it). The `-c` config propagates to the child git
+//   processes `submodule update` spawns.
+export function gitExtraHeader() {
+    return getPlatform().gitAuth.gitExtraHeader();
+}
+// Same-host SSH→HTTPS URL rewriting for submodules. A submodule whose
+//   .gitmodules URL is `git@<forge-host>:…` or `ssh://git@<forge-host>/…`
+//   would otherwise try SSH (no key in the container) and fail. Rewriting it to
+//   the forge HTTPS base lets it inherit the scoped http extraHeader above.
+//   External SSH submodules are deliberately NOT rewritten.
+//   git's `insteadOf` is a literal PREFIX match, so a URL with an explicit SSH
+//   port (`ssh://git@host:2222/…`) only matches a key that carries that same
+//   `:2222`. The port can't be derived from the HTTPS PLATFORM_URL, so it comes
+//   from PLATFORM_SSH_PORT; when set, an extra port-bearing ssh:// key is emitted.
+//   Only the ssh:// form has a port suffix — the scp-like `git@host:path` form
+//   has no port slot, so a single scp key suffices.
+export function submoduleGitConfig(extraHeader, sshPort = config.PLATFORM_SSH_PORT) {
+    const base = normalizeForgeUrl(config.PLATFORM_URL);
+    const host = forgeHostname(config.PLATFORM_URL);
+    const scp = `url.${base}/.insteadOf=${shq(`git@${host}:`)}`;
+    const ssh = `url.${base}/.insteadOf=${shq(`ssh://git@${host}/`)}`;
+    const parts = [extraHeader, `-c ${scp}`, `-c ${ssh}`];
+    if (sshPort) {
+        parts.push(`-c url.${base}/.insteadOf=${shq(`ssh://git@${host}:${sshPort}/`)}`);
+    }
+    return parts.join(" ");
+}
+// Marker printed (one per path) when a submodule can't be initialized. The
+//   group always exits 0 so the submodule step stays best-effort and can never
+//   mask an earlier clone/fetch failure.
+export const SUBMODULE_FAILED_MARKER = "DEVBOT_SUBMODULE_FAILED";
+// Max submodule paths named in the warning note; the rest are summarized.
+export const SUBMODULE_WARNING_CAP = 10;
+// Compose the submodule init/update step. Recursive, best-effort, and grouped
+//   in braces so its `||` applies to the submodule command alone (a bare
+//   `a && b || c` would mask an earlier clone/fetch failure). On failure,
+//   `git submodule status --recursive` lists the uninitialized paths (leading
+//   '-' in column 1) — the failing one plus any never reached.
+export function buildSubmoduleStep(submoduleCfg, enabled = true) {
+    if (!enabled || !submoduleCfg)
+        return "";
+    const update = `${submoduleCfg} submodule update --init --recursive`;
+    const report = `git submodule status --recursive | awk 'substr($1,1,1)=="-" {print "${SUBMODULE_FAILED_MARKER}:" $2}'`;
+    return `{ ${update} || ${report}; }`;
+}
+// Extract the failing submodule paths from a submodule-step stdout. Each failed
+//   path is emitted on its own marker line; order is preserved.
+export function parseSubmoduleFailures(stdout) {
+    const out = [];
+    const re = new RegExp(`^${SUBMODULE_FAILED_MARKER}:(.+)$`, "gm");
+    let m;
+    while ((m = re.exec(stdout)) !== null) {
+        const path = m[1]?.trim();
+        if (path)
+            out.push(path);
+    }
+    return out;
+}
+// Build the informational note for submodule fetch failures. Returns null when
+//   there's nothing to report. Paths are repo-controlled: strip newlines/CR and
+//   backticks before wrapping in an inline-code span (a stray backtick would
+//   break the Markdown and could inject a mention). The list is capped.
+export function formatSubmoduleWarning(paths) {
+    if (paths.length === 0)
+        return null;
+    const sanitize = (p) => p.replace(/[`\r\n]/g, "").trim();
+    const shown = paths.slice(0, SUBMODULE_WARNING_CAP).map((p) => `\`${sanitize(p)}\``);
+    const overflow = paths.length - shown.length;
+    const list = shown.join(", ") + (overflow > 0 ? ` and ${overflow} more` : "");
+    return `ℹ️ Some git submodules could not be fetched: ${list}. Continuing without them.`;
+}
+export async function volumeExists(vol) {
+    const r = await podman(["volume", "inspect", vol]);
+    return r.code === 0;
+}
+// Best-effort removal of the legacy in-repo XDG dirs written by DevBot before
+//   the xdg volume existed. They now live on /home/devbot/.xdg, but a volume
+//   created by an older release still contains /workspace/.xdg-data and
+//   /workspace/.xdg-config with a stale MCP token and provider API keys — which
+//   the agent's `git add -A` could commit into a target repo that doesn't
+//   ignore them. `|| true` so a permissions hiccup can never block a sync.
+export function legacyXdgCleanup() {
+    return "rm -rf /workspace/.xdg-data /workspace/.xdg-config || true";
+}
+// Compose the host-side sync script for an existing volume. It MUST fetch
+//   origin before every run so the agent sees the latest remote refs — the
+//   orchestrator runs this before spawning opencode. Branch checkout is
+//   host-side and deterministic in both modes: relying on the agent to checkout
+//   left HEAD on the clone target (e.g. dev) whenever the LLM skipped the step,
+//   which the HEAD guard then had to refuse. Rebase onto origin/<branch> stays
+//   agent-owned in build mode (it is in the prompt); only branch selection is
+//   enforced here. Exported as a pure helper so scripts/check-git-sync.ts can
+//   pin the fetch guarantee. submoduleStep (when non-empty) runs last, after
+//   fetch/checkout, best-effort.
+//   Checkout chain (first match wins):
+//     1. local branch exists          → git checkout <branch>
+//     2. remote branch exists         → git checkout -b <branch> origin/<branch>
+//     3. neither (fresh work item)    → git checkout -B <branch>  (off clone target HEAD)
+//   `mode` is kept in the signature for shape stability (caller + tests); the
+//   mode split was dropped when branch selection became orchestrator-owned.
+export function syncScript(branch, extraHeader, _mode, submoduleStep = "") {
+    const b = shq(branch);
+    const checkout = `git checkout ${b} 2>/dev/null` +
+        ` || git checkout -b ${b} origin/${b} 2>/dev/null` +
+        ` || git checkout -B ${b}`;
+    // umask 002 + group-writable tree: the bash tool runs as the unprivileged
+    // `agent` UID (gid devbot) and must be able to edit/commit alongside opencode
+    // (devbot). chmod -R keeps pre-existing files (from older volumes) editable.
+    // Braced so its `|| true` applies to the chmod alone: a fetch/checkout failure
+    // must still abort the sync, while a chmod EPERM is harmless. After the UID
+    // split (#81) `/workspace` can hold files devbot doesn't own — the `agent` UID
+    // (1001) and nested-Podman inner-root (subuid) — and chmod then fails
+    // "Operation not permitted" (#91). A bare chmod here turned that into a fatal
+    // sync failure misreported as a rebase conflict, blocking every re-run.
+    const lines = ["umask 002", "cd /workspace", legacyXdgCleanup(), `${extraHeader} fetch origin`, checkout];
+    if (submoduleStep)
+        lines.push(submoduleStep);
+    lines.push("{ chmod -R g+rwX /workspace 2>/dev/null || true; }");
+    lines.push(`echo "TIP:$(git rev-parse origin/${b} 2>/dev/null || true)"`);
+    return lines.join(" && ");
+}
+export async function ensureVolumeAndWorkspace(input, mode, envVars = [], branches = [], builderImage = config.BUILDER_IMAGE) {
+    const vol = volumeName(input.workItemId);
+    const exists = await volumeExists(vol);
+    if (!exists) {
+        const create = await podman(["volume", "create", vol]);
+        if (create.code !== 0) {
+            return { ok: false, reason: `volume create failed: ${redact(create.stderr.slice(-256))}`, isFirstRun: true, logs: redact(create.stderr) };
+        }
+    }
+    const cloneUrl = input.repoHttpUrl;
+    const branch = resolveWorkBranch(input.workBranch ?? null, input.workItemNumber);
+    const extraHeader = gitExtraHeader();
+    // Submodule init/update runs on first clone and every sync (picks up new
+    //   submodules + updated gitlinks). Best-effort and never fails the run; the
+    //   scoped header + same-host SSH rewrite apply because the `-c` config
+    //   propagates to the child git processes.
+    const submoduleStep = buildSubmoduleStep(submoduleGitConfig(extraHeader), runtime().gitSubmodulesEnabled);
+    // Detect whether the workspace already has a git repo.
+    const detect = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-detect`,
+        "-v", `${vol}:/workspace:Z`,
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c", "cd /workspace 2>/dev/null && git rev-parse --is-inside-work-tree 2>/dev/null && echo OK || echo EMPTY",
+    ], { timeoutMs: timeoutFor(mode) });
+    const isInit = detect.stdout.includes("OK");
+    if (!isInit) {
+        // First run: clone with a fallback chain.
+        //   1. wi-<iid>        — prior WIP branch for this work item, if it exists remotely
+        //   2. targetBranch    — /base <branch> if given, else the first existing branch
+        //                        from BASE_BRANCHES (tried top-to-bottom, e.g. default
+        //                        "dev,master" tries dev then master); the MR target.
+        // Every mode force-checks-out wi-<iid> after the clone, so the local work
+        // branch exists even after a fallback clone. Plan mode creates it as a local
+        // ref alongside the target; build mode makes it HEAD before the agent runs.
+        // /base is a hard per-work-item override that bypasses the env list entirely.
+        // If neither /base nor any BASE_BRANCHES branch exists remotely, this is an
+        // explicit error (no bare-clone fall-through) — the runner posts an
+        // actionable note. targetBranch is always a verified-existing branch by the
+        // time the clone runs, so the chain is 2 links (no repo-default bare clone
+        // slot).
+        log.info("first-run clone", { workItemId: input.workItemId, repo: input.repoHttpUrl, mode, baseBranch: input.baseBranch });
+        let targetBranch;
+        if (input.baseBranch) {
+            targetBranch = input.baseBranch;
+        }
+        else {
+            let hit;
+            try {
+                hit = await getPlatform().repository.firstExistingBranch(input.projectId, branches);
+            }
+            catch (e) {
+                return { ok: false, reason: `base branch existence check failed: ${e instanceof Error ? e.message : String(e)}`, isFirstRun: true };
+            }
+            if (!hit) {
+                return { ok: false, reason: `no base branch found (tried: ${branches.join(", ")})`, isFirstRun: true };
+            }
+            targetBranch = hit;
+        }
+        const gitConfig = `git config user.name ${shq(config.BOT_GIT_NAME)} && git config user.email ${shq(config.BOT_GIT_EMAIL)}`;
+        const cloneChain = [
+            `${extraHeader} clone --branch ${shq(branch)} ${shq(cloneUrl)} /workspace`,
+            `${extraHeader} clone --branch ${shq(targetBranch)} ${shq(cloneUrl)} /workspace`,
+        ].join(" || ");
+        const checkoutBranch = ` && git checkout -B ${shq(branch)}`;
+        // Run .devbot/init.sh if present (after clone, before opencode). Env vars
+        //   are already exported into this container via --env flags. Non-zero exit
+        //   aborts with exit 8 + DEVBOT_INIT_FAILED marker for an actionable error.
+        const postClone = buildPostCloneScript();
+        // Submodule init/update runs after clone + checkout + git config, before
+        //   .devbot/init.sh (so init.sh sees populated submodules). The step is
+        //   best-effort: its brace group exits 0 even on failure, then we surface
+        //   the affected paths as a non-fatal warning below.
+        const submoduleSegment = submoduleStep ? ` && ${submoduleStep}` : "";
+        // umask 002 + a final group-writable pass: the bash tool runs as the
+        // unprivileged `agent` UID (gid devbot) and must edit/commit the tree.
+        const cloneCmd = `umask 002 && ${cloneChain} && cd /workspace && ${gitConfig}${checkoutBranch}${submoduleSegment} && ${postClone} && ${legacyXdgCleanup()} && chmod -R g+rwX /workspace && echo "TIP:$(git rev-parse origin/${shq(branch)} 2>/dev/null || true)"`;
+        const r = await podman([
+            "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-clone`,
+            "-v", `${vol}:/workspace:Z`,
+            ...envArgs(envVars),
+            builderImage,
+            "sh", "-c", cloneCmd,
+        ], { timeoutMs: timeoutFor(mode) });
+        if (r.code !== 0) {
+            // init.sh failure (exit 8) → actionable, developer-fixable error.
+            if (r.code === 8 && r.stdout.includes("DEVBOT_INIT_FAILED")) {
+                const exitCode = r.stdout.split("DEVBOT_INIT_FAILED:")[1]?.split("\n")[0]?.trim() ?? "unknown";
+                return { ok: false, reason: `.devbot/init.sh failed (exit ${exitCode}) — check the script`, isFirstRun: true, logs: redact(r.stdout + r.stderr) };
+            }
+            return { ok: false, reason: `clone failed: ${redact(r.stderr.slice(-512))}`, isFirstRun: true, logs: redact(r.stdout + r.stderr) };
+        }
+        return { ok: true, isFirstRun: true, submoduleWarnings: parseSubmoduleFailures(r.stdout), branchTip: parseBranchTip(r.stdout) };
+    }
+    // Existing volume: fetch + checkout. The branch transition is host-side and
+    //   deterministic (see syncScript); the agent's build-mode prompt still owns
+    //   the rebase step. Plan and build modes now share the same checkout chain —
+    //   a plan-mode run no longer leaves HEAD on the clone target.
+    log.info("existing volume, syncing", { workItemId: input.workItemId, mode });
+    const syncCmd = syncScript(branch, extraHeader, mode, submoduleStep);
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-sync`,
+        "-v", `${vol}:/workspace:Z`,
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c", syncCmd,
+    ], { timeoutMs: timeoutFor(mode) });
+    if (r.code !== 0) {
+        // fix #4: do not discard local work via fallback. Report and abort.
+        // The sync chain ends in an unconditional `checkout -B`, so a non-zero
+        // exit is a fetch/upstream failure or a pathological ref state — infra,
+        // not a rebase conflict (the rebase is agent-owned and never runs here).
+        // The stderr check distinguishes a missing work-item branch (plan mode,
+        // developer-actionable) from a fetch/upstream error.
+        const stderr = redact(r.stderr.slice(-512));
+        const missing = /pathspec|is not a commit/.test(stderr);
+        const reason = missing
+            ? `work item branch '${branch}' not found locally or on origin (merged/deleted upstream?)`
+            : `workspace sync failed: ${stderr}`;
+        return { ok: false, reason, isFirstRun: false, logs: redact(r.stdout + r.stderr) };
+    }
+    return { ok: true, isFirstRun: false, submoduleWarnings: parseSubmoduleFailures(r.stdout), branchTip: parseBranchTip(r.stdout) };
+}
+// Push the work item branch. The agent has already committed its own work
+//   (Conventional Commits, #<iid> in subject — see the build-mode prompt suffix
+//   in run()), so this pushes directly. Push is always host-side — the
+//   container has no token; the extraHeader injects Basic auth for this one
+//   git call only.
+//   The host-side sync (syncScript) now places HEAD on the work branch
+//   deterministically before the agent runs; this function still carries a
+//   HEAD guard as the last-resort check: if HEAD is somehow elsewhere (agent
+//   ran git checkout itself, devcontainer init raced, etc.), abort the push
+//   and post an actionable note. This is the one check the agent cannot skip —
+//   it runs host-side before the push touches the remote. Exit 7 distinguishes
+//   a wrong-HEAD from a push failure.
+// Compose the host-side publish script for a work item branch. Thin delegate to
+//   publishScript (src/conflict-fix.ts), kept for scripts/check-push-fallback.ts
+//   and any other pure-shape callers. Rewrite-aware: see publishScript.
+export function pushScript(workItemNumber, branch, extraHeader, force = false) {
+    return publishScript(workItemNumber, branch, extraHeader, "", force);
+}
+// Compose the host-side script for a standalone `/force-push` (no /build, no
+//   agent run): force-push the work item's existing local branch to origin
+//   using --force-with-lease. Unlike pushScript there is no HEAD guard (the
+//   named ref is pushed, not HEAD) and no fallback commit (we are pushing, not
+//   committing). Exported as a pure helper for scripts/check-push-fallback.ts.
+//   Order is load-bearing:
+//     1. branch guard — abort if the local wi-<iid> branch doesn't exist (exit 6,
+//                       NO_BRANCH); there is nothing to push.
+//     2. fetch        — refresh origin/<branch> so the lease compares against
+//                       the latest remote, not a stale tracking ref.
+//     3. force-push   — overwrite the remote branch iff it hasn't moved since
+//                       the fetch (--force-with-lease, never plain --force).
+export function forcePushStandaloneScript(branch, extraHeader) {
+    return [
+        "cd /workspace",
+        `git rev-parse --verify --quiet refs/heads/${shq(branch)} >/dev/null || { echo "NO_BRANCH:${branch}"; exit 6; }`,
+        `${extraHeader} fetch origin`,
+        `${extraHeader} push origin ${shq(branch)} --force-with-lease && echo PUSHED`,
+    ].join(" && ");
+}
+// Compose the host-side script for a standalone `/push` (no /build, no agent
+//   run): publish the work item's existing local branch to origin without
+//   force. Never emits git's raw fast-forward hint: a branch whose remote is not
+//   an ancestor of HEAD (diverged, e.g. after a rebase) reports REWRITTEN and
+//   exits 9 so the caller can tell the user to use `/force-push`. Order:
+//     1. branch guard — abort if the local branch doesn't exist (exit 6,
+//                       NO_BRANCH).
+//     2. fetch        — refresh origin/<branch> for the ancestor/ahead tests.
+//     3. unborn       → plain push.
+//        ancestor     → ahead ? plain push : NO_COMMITS.
+//        not ancestor → REWRITTEN, exit 9 (no clobber; use /force-push).
+//   Exported as a pure helper for scripts/check-push-fallback.ts.
+export function pushStandaloneScript(branch, extraHeader) {
+    const b = shq(branch);
+    return [
+        "cd /workspace",
+        `git rev-parse --verify --quiet refs/heads/${b} >/dev/null || { echo "NO_BRANCH:${branch}"; exit 6; }`,
+        `${extraHeader} fetch origin`,
+        `if ! git rev-parse --verify --quiet origin/${b} >/dev/null; then ${extraHeader} push origin ${b} && echo PUSHED;`,
+        `elif git merge-base --is-ancestor origin/${b} HEAD; then if test -n "$(git log --format=%H origin/${b}..HEAD)"; then ${extraHeader} push origin ${b} && echo PUSHED; else echo NO_COMMITS; fi;`,
+        `else echo "REWRITTEN:${branch}"; exit 9; fi`,
+    ].join(" && ");
+}
+export async function forcePushStandalone(input, envVars = [], builderImage = config.BUILDER_IMAGE) {
+    const vol = volumeName(input.workItemId);
+    // Precondition: the workspace must already exist. A standalone force-push
+    //   has nothing to do without it (no clone, no local commits) — fail with an
+    //   actionable reason instead of letting podman create an empty volume and
+    //   the script hit NO_BRANCH.
+    if (!(await volumeExists(vol))) {
+        return { ok: false, reason: `no workspace for this work item (volume ${vol} not found)`, missingVolume: true };
+    }
+    const branch = resolveWorkBranch(input.workBranch ?? null, input.workItemNumber);
+    const extraHeader = gitExtraHeader();
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", workItemContainerName(input.workItemId, "forcepush"),
+        "-v", `${vol}:/workspace:Z`,
+        "-w", "/workspace",
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c",
+        forcePushStandaloneScript(branch, extraHeader),
+    ], { timeoutMs: runtime().buildTimeoutMs });
+    if (r.code !== 0) {
+        // exit 6 + NO_BRANCH = the work item never produced a local branch.
+        if (r.code === 6 && r.stdout.includes("NO_BRANCH")) {
+            return { ok: false, reason: `no local branch '${branch}' to force-push`, logs: redact(r.stdout + r.stderr), missingBranch: true };
+        }
+        return { ok: false, reason: redact(r.stderr.slice(-256)), logs: redact(r.stdout + r.stderr) };
+    }
+    return { ok: true, pushed: r.stdout.includes("PUSHED") };
+}
+// Publish-the-existing-branch counterpart of forcePushStandalone for a
+//   standalone `/push`. Same preconditions and error taxonomy; the push itself
+//   is a plain fast-forward (pushStandaloneScript). `pushed` is false when the
+//   remote already has the branch at HEAD (NO_COMMITS) — an idempotent no-op.
+export async function pushStandalone(input, envVars = [], builderImage = config.BUILDER_IMAGE) {
+    const vol = volumeName(input.workItemId);
+    if (!(await volumeExists(vol))) {
+        return { ok: false, reason: `no workspace for this work item (volume ${vol} not found)`, missingVolume: true };
+    }
+    const branch = resolveWorkBranch(input.workBranch ?? null, input.workItemNumber);
+    const extraHeader = gitExtraHeader();
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", workItemContainerName(input.workItemId, "push"),
+        "-v", `${vol}:/workspace:Z`,
+        "-w", "/workspace",
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c",
+        pushStandaloneScript(branch, extraHeader),
+    ], { timeoutMs: runtime().buildTimeoutMs });
+    if (r.code !== 0) {
+        if (r.code === 6 && r.stdout.includes("NO_BRANCH")) {
+            return { ok: false, reason: `no local branch '${branch}' to push`, logs: redact(r.stdout + r.stderr), missingBranch: true };
+        }
+        if (r.code === 9 && r.stdout.includes("REWRITTEN")) {
+            return { ok: false, rewritten: true, reason: `branch '${branch}' has a rewritten history; use \`/force-push\` to publish it`, logs: redact(r.stdout + r.stderr) };
+        }
+        return { ok: false, reason: redact(r.stderr.slice(-256)), logs: redact(r.stdout + r.stderr) };
+    }
+    return { ok: true, pushed: r.stdout.includes("PUSHED") };
+}
+export async function pushBranch(input, envVars = [], builderImage = config.BUILDER_IMAGE) {
+    const vol = volumeName(input.workItemId);
+    const branch = resolveWorkBranch(input.workBranch ?? null, input.workItemNumber);
+    const extraHeader = gitExtraHeader();
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-push`,
+        "-v", `${vol}:/workspace:Z`,
+        "-w", "/workspace",
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c",
+        publishScript(input.workItemNumber, branch, extraHeader, input.preRunTip ?? "", input.forcePush),
+    ], { timeoutMs: runtime().buildTimeoutMs });
+    const parsed = parsePublishResult(r.stdout);
+    if (r.code === 7 && r.stdout.includes("WRONG_HEAD")) {
+        const onBranch = r.stdout.split("WRONG_HEAD:")[1]?.split("\n")[0]?.trim() ?? "unknown";
+        return { ok: false, reason: `agent left HEAD on '${onBranch}'; push skipped to avoid corrupting the MR`, logs: redact(r.stdout + r.stderr) };
+    }
+    if (r.code === 10 && r.stdout.includes("CONFLICT_MARKERS")) {
+        return { ok: false, reason: "the work tree still contains conflict markers; refusing to commit them", logs: redact(r.stdout + r.stderr) };
+    }
+    if (r.code === 9 && parsed.remoteMoved) {
+        return { ok: false, remoteMoved: true, reason: "the remote branch moved during the run; re-run to fetch and retry", logs: redact(r.stdout + r.stderr) };
+    }
+    if (r.code !== 0) {
+        return { ok: false, reason: redact(r.stderr.slice(-256)), logs: redact(r.stdout + r.stderr) };
+    }
+    return { ok: true, pushed: parsed.pushed, fallbackCommitted: parsed.fallbackCommitted, forced: parsed.forced, noCommits: parsed.noCommits };
+}
+// Run the conflict check in the builder container. Returns null on an infra
+//   failure (missing target, fetch error) so the caller can fail closed.
+export async function checkConflicts(input, envVars = [], builderImage = config.BUILDER_IMAGE) {
+    const vol = volumeName(input.workItemId);
+    const branch = resolveWorkBranch(input.workBranch ?? null, input.workItemNumber);
+    const extraHeader = gitExtraHeader();
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-conflictcheck`,
+        "-v", `${vol}:/workspace:Z`,
+        "-w", "/workspace",
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c",
+        conflictCheckScript(input.target, branch, extraHeader),
+    ], { timeoutMs: runtime().buildTimeoutMs });
+    const parsed = parseConflictCheckResult(r.code, r.stdout);
+    if (!parsed) {
+        log.warn("conflict check failed", { workItemId: input.workItemId, code: r.code, stderr: redact(r.stderr.slice(-256)) });
+    }
+    return parsed;
+}
+// Read the remote-tracking tip of the work branch (`origin/<branch>`) without
+//   fetching — used to pin the force-with-lease after the resolver rewrites
+//   history. The conflict check that runs just before this already fetched, so
+//   the tracking ref is current and no auth is needed here (a bare `fetch` in a
+//   private repo would fail without the token). Returns null when absent.
+export async function readRemoteBranchTip(input, envVars = [], builderImage = config.BUILDER_IMAGE) {
+    const vol = volumeName(input.workItemId);
+    const branch = resolveWorkBranch(input.workBranch ?? null, input.workItemNumber);
+    const r = await podman([
+        "run", "--rm", ...logDriverArgs(), "--name", `devbot-wi-${input.workItemId}-tip`,
+        "-v", `${vol}:/workspace:Z`,
+        "-w", "/workspace",
+        ...envArgs(envVars),
+        builderImage,
+        "sh", "-c",
+        `cd /workspace && git rev-parse origin/${shq(branch)} 2>/dev/null || true`,
+    ], { timeoutMs: runtime().buildTimeoutMs });
+    const sha = r.stdout.trim();
+    return /^[0-9a-f]{7,40}$/.test(sha) ? sha : null;
+}
+// The resolver prompt for the direct build run that resolves conflicts.
+export function conflictResolverPrompt(branch, target) {
+    return resolverPrompt(branch, target);
+}
+export { parseResolverResult };
+//# sourceMappingURL=git.js.map