agent-dealer 1.2.7 → 1.2.8

package/bundle/server/dist/coordinator/admission.test.js

@@ -403,7 +403,10 @@ test("NOT-178: a Muse Code developer without credentials is refused at admission
 });
 // NOT-277: a Muse Code auto-update is re-validated automatically. A version whose developer
 // shell/write check passes is admitted with no manual step; one that lost it is refused with the
-// versions and capability named; one whose check could not complete is refused, never assumed ok.
+// versions and capability named.
+// NOT-308: an inconclusive check never blocks on a confirmed baseline (admitted, retried in
+// the background); a confirmed loss escalates exactly one human action, and acknowledging
+// it lifts the block.
 test("NOT-277: a Muse Code update is admitted when capable, refused by name when not", async () => {
     const { clearAgentHealthCaches, runtimeIssuesUncached } = await import("../adapters/agent-health.js");
     const { setMuseCapabilityProbeForTests, settleMuseCapabilityCheckForTests } = await import("../adapters/muse-capability.js");
@@ -463,11 +466,22 @@ test("NOT-277: a Muse Code update is admitted when capable, refused by name when
         const reason = getQueuedEntryForIssue(issue.id).waitReason;
         assert.match(reason, /developer unhealthy/);
         assert.match(reason, new RegExp(`Muse Code updated ${NEW} → ${BROKEN}: developer sessions no longer get shell/write access`));
+        // NOT-308: the confirmed loss escalates exactly one human action naming the update
+        // and the capability — and acknowledging it lifts the admission block.
+        const { listHumanActionsByRequestId } = await import("../repository/human-actions.js");
+        const { museCapabilityRequestId } = await import("../adapters/muse-capability.js");
+        const { resolveHumanActionAndAdvance } = await import("./commands.js");
+        const escalated = listHumanActionsByRequestId("muse_capability", museCapabilityRequestId(BROKEN, "missing"));
+        assert.equal(escalated.filter((a) => a.status === "open").length, 1);
+        assert.match(escalated[0].reason, new RegExp(`Muse Code updated ${NEW} → ${BROKEN}: developer sessions no longer get shell/write access`));
+        const acknowledged = resolveHumanActionAndAdvance(escalated[0].id, "test", "acknowledge");
+        assert.equal(acknowledged.ok, true);
+        assert.deepEqual(await developerHealth(), { ok: true }, "acknowledge lifts the block");
+        // NOT-308: an inconclusive check (the probe throws) does NOT block on the baseline.
         await museReports("9.9.9-R1");
-        const unverified = await developerHealth();
-        assert.equal(unverified.ok, false);
-        assert.match(unverified.reason, new RegExp(`Could not verify Muse Code developer shell/write access after version change \\(${BROKEN} → 9\\.9\\.9-R1\\)`));
+        assert.deepEqual(await developerHealth(), { ok: true });
         assert.deepEqual(probed, [OLD, NEW, BROKEN, "9.9.9-R1"]);
+        assert.equal(listHumanActionsByRequestId("muse_capability", museCapabilityRequestId("9.9.9-R1", "unverified")).length, 0, "a first inconclusive result escalates nothing");
     }
     finally {
         for (const [key, value] of Object.entries({
@@ -486,6 +500,185 @@ test("NOT-277: a Muse Code update is admitted when capable, refused by name when
         setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
     }
 });
+// NOT-308: real-checker Muse harness — stub `muse --version`, stub gh login, stub the
+// capability probe. Restores every override so later tests keep the unit-test skip.
+async function withMuseHarness(probe, fn) {
+    const { clearAgentHealthCaches, invalidateMuseHealthCache, runtimeIssuesUncached } = await import("../adapters/agent-health.js");
+    const cap = await import("../adapters/muse-capability.js");
+    cap.resetMuseCapabilityStateForTests();
+    const stubDir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-muse-stub-"));
+    const versionFile = path.join(stubDir, "version");
+    const stub = path.join(stubDir, "muse");
+    fs.writeFileSync(stub, `#!/bin/sh\ncat ${JSON.stringify(versionFile)}\n`);
+    fs.chmodSync(stub, 0o755);
+    const ghStub = path.join(stubDir, "gh");
+    fs.writeFileSync(ghStub, "#!/bin/sh\necho 'Logged in to github.com account dealer-test'\nexit 0\n");
+    fs.chmodSync(ghStub, 0o755);
+    cap.setMuseCapabilityProbeForTests(probe);
+    const saved = {
+        MUSE_CLI: process.env.MUSE_CLI,
+        META_API_KEY: process.env.META_API_KEY,
+        SKIP: process.env.AGENT_DEALER_SKIP_AGENT_HEALTH,
+        PATH: process.env.PATH,
+    };
+    process.env.MUSE_CLI = stub;
+    process.env.PATH = `${stubDir}${path.delimiter}${process.env.PATH ?? ""}`;
+    process.env.META_API_KEY = "k";
+    delete process.env.AGENT_DEALER_SKIP_AGENT_HEALTH;
+    setAdmissionHealthCheckerForTests(null);
+    clearAgentHealthCaches();
+    const writeVersion = (version) => {
+        fs.writeFileSync(versionFile, `Muse Code ${version.split("-")[0]} (${version})\n`);
+    };
+    try {
+        await fn({
+            versionFile,
+            show: writeVersion,
+            report: async (version) => {
+                writeVersion(version);
+                await runtimeIssuesUncached("muse_code");
+                await cap.settleMuseCapabilityCheckForTests();
+            },
+            reportUnsettled: async (version) => {
+                writeVersion(version);
+                // Targeted invalidation only: clearAgentHealthCaches would also reset the
+                // capability state under test.
+                invalidateMuseHealthCache();
+                return runtimeIssuesUncached("muse_code");
+            },
+        });
+    }
+    finally {
+        for (const [key, value] of Object.entries({
+            MUSE_CLI: saved.MUSE_CLI,
+            META_API_KEY: saved.META_API_KEY,
+            AGENT_DEALER_SKIP_AGENT_HEALTH: saved.SKIP,
+            PATH: saved.PATH,
+        })) {
+            if (value === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = value;
+        }
+        cap.setMuseCapabilityProbeForTests(null);
+        clearAgentHealthCaches();
+        setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
+    }
+}
+// NOT-308: while the new version is still being verified, developer admission is allowed
+// on the confirmed baseline — no `runtime_capability` block while the check is in flight.
+test("NOT-308: developer admission is allowed while the new version check is in flight", async () => {
+    const cap = await import("../adapters/muse-capability.js");
+    const OLD = "1.3.0-R3401.1";
+    const NEW = "1.4.0-R4161.1";
+    let release;
+    await withMuseHarness(async (version) => {
+        if (version === NEW) {
+            return new Promise((resolve) => {
+                release = () => resolve({ status: "capable" });
+            });
+        }
+        return { status: "capable" };
+    }, async ({ report, reportUnsettled }) => {
+        await report(OLD);
+        const issues = await reportUnsettled(NEW);
+        assert.deepEqual(issues.filter((i) => i.code === "runtime_capability"), [], "no runtime_capability block while verifying on a baseline");
+        assert.equal(cap.museCapabilityCheckInFlight(), true);
+        // The admission gate agrees: healthy, with the check still running.
+        const issue = readyIssue("muse-inflight", { runtimes: { dev: "muse_code", rev: "codex_local" } });
+        const { invalidateMuseHealthCache } = await import("../adapters/agent-health.js");
+        invalidateMuseHealthCache();
+        assert.deepEqual(await checkRoleAgentHealthy(issue, "developer", { deckOnline: true }), {
+            ok: true,
+        });
+        assert.equal(cap.museCapabilityCheckInFlight(), true);
+        release();
+        await cap.settleMuseCapabilityCheckForTests();
+        invalidateMuseHealthCache();
+        assert.deepEqual(await checkRoleAgentHealthy(issue, "developer", { deckOnline: true }), {
+            ok: true,
+        });
+    });
+});
+// NOT-308: three inconclusive polls escalate exactly one "could not verify" action and stop
+// probing — admission never blocks.
+test("NOT-308: three inconclusive polls escalate once, then stop probing, never blocking", async () => {
+    const cap = await import("../adapters/muse-capability.js");
+    const { invalidateMuseHealthCache } = await import("../adapters/agent-health.js");
+    const { listHumanActionsByRequestId } = await import("../repository/human-actions.js");
+    const OLD = "1.3.0-R3401.1";
+    const NEW = "1.4.0-R4161.1";
+    const probed = [];
+    await withMuseHarness(async (version) => {
+        probed.push(version);
+        if (version === NEW)
+            return { status: "error", detail: "probe session timed out" };
+        return { status: "capable" };
+    }, async ({ report, show }) => {
+        await report(OLD);
+        show(NEW);
+        const issue = readyIssue("muse-unverified", {
+            runtimes: { dev: "muse_code", rev: "codex_local" },
+        });
+        const poll = async () => {
+            // Targeted invalidation only: clearAgentHealthCaches would also reset the
+            // capability attempts under test.
+            invalidateMuseHealthCache();
+            const health = await checkRoleAgentHealthy(issue, "developer", { deckOnline: true });
+            await cap.settleMuseCapabilityCheckForTests();
+            return health;
+        };
+        const { ageMuseCapabilityCheckForTests } = await import("../adapters/muse-capability.js");
+        assert.deepEqual(await poll(), { ok: true }, "attempt 1: allowed");
+        ageMuseCapabilityCheckForTests(61_000);
+        assert.deepEqual(await poll(), { ok: true }, "attempt 2: allowed");
+        ageMuseCapabilityCheckForTests(122_000);
+        assert.deepEqual(await poll(), { ok: true }, "attempt 3: allowed");
+        assert.deepEqual(probed, [OLD, NEW, NEW, NEW]);
+        // The third poll settles exhausted, so the next polls escalate — exactly once.
+        assert.deepEqual(await poll(), { ok: true }, "exhausted: still allowed");
+        assert.deepEqual(await poll(), { ok: true }, "second post-exhaustion poll: still allowed");
+        const actions = listHumanActionsByRequestId("muse_capability", cap.museCapabilityRequestId(NEW, "unverified"));
+        assert.equal(actions.filter((a) => a.status === "open").length, 1);
+        assert.match(actions[0].reason, /Could not verify Muse Code developer shell\/write access/);
+        assert.match(actions[0].reason, new RegExp(`for ${NEW} after 3 inconclusive checks`));
+        // No fourth probe ever, however long the wait.
+        ageMuseCapabilityCheckForTests(10 * 60_000);
+        invalidateMuseHealthCache();
+        assert.deepEqual(await checkRoleAgentHealthy(issue, "developer", { deckOnline: true }), {
+            ok: true,
+        });
+        assert.deepEqual(probed, [OLD, NEW, NEW, NEW], "no further probes after exhaustion");
+    });
+});
+// NOT-308: with no confirmed baseline ever (fresh install), the unknown still fails
+// closed — in flight and errored alike.
+test("NOT-308: with no confirmed baseline, admission stays blocked while unconfirmed", async () => {
+    const cap = await import("../adapters/muse-capability.js");
+    const NEW = "1.4.0-R4161.1";
+    let release;
+    let calls = 0;
+    await withMuseHarness(async () => {
+        calls += 1;
+        return new Promise((resolve) => {
+            release = () => resolve({ status: "error", detail: "timed out" });
+        });
+    }, async ({ reportUnsettled }) => {
+        const issue = readyIssue("muse-fresh", { runtimes: { dev: "muse_code", rev: "codex_local" } });
+        const health = (i) => checkRoleAgentHealthy(i, "developer", { deckOnline: true });
+        await reportUnsettled(NEW);
+        assert.equal(cap.museCapabilityCheckInFlight(), true);
+        const blocked = await health(issue);
+        assert.equal(blocked.ok, false);
+        assert.match(blocked.reason, /verifying developer shell\/write access/);
+        release();
+        await cap.settleMuseCapabilityCheckForTests();
+        const errored = await health(issue);
+        assert.equal(errored.ok, false);
+        assert.match(errored.reason, /Could not verify Muse Code/);
+        assert.equal(calls, 1);
+    });
+});
 // NOT-178: Muse Code is developer-only, so it is never a healthy reviewer — even with the
 // unit-test health skip on, and without probing the CLI.
 test("NOT-178: a Muse Code reviewer is refused regardless of CLI health", async () => {

package/bundle/server/dist/coordinator/auto-merge.integration.test.js

@@ -17,6 +17,8 @@ const { startWorkflow, applyCompletion } = await import("./commands.js");
 const { ReviewerResult } = await import("./reviewer-result.js");
 const { setMergePrForTests, clearFinalizeInflightForTests } = await import("./auto-merge.js");
 const { managedRepoPath } = await import("../adapters/managed-repo.js");
+const { buildDeveloperPrompt } = await import("./prompts.js");
+const { defaultSyncGitExec, setConflictSyncGithubForTests, setConflictSyncGitExecForTests, } = await import("./merge-conflict-sync.js");
 /** Real local checkout so resolveAutoMergeCwd accepts the default legacy repo. */
 let fixtureRepo = "";
 function initFixtureRepo() {
@@ -48,10 +50,14 @@ beforeEach(() => {
   `);
     clearFinalizeInflightForTests();
     setMergePrForTests(async () => ({ ok: true }));
+    setConflictSyncGitExecForTests(null);
+    setConflictSyncGithubForTests(null);
 });
 afterEach(() => {
     setMergePrForTests(null);
     clearFinalizeInflightForTests();
+    setConflictSyncGitExecForTests(null);
+    setConflictSyncGithubForTests(null);
 });
 function newIssue(opts = {}) {
     return createIssue({
@@ -388,6 +394,276 @@ test("success txn dismisses stale needs_human policy_escalation from a racing fa
     const resolved = listHumanActionsForIssue(issueId).find((a) => a.actionType === "policy_escalation" && a.status === "resolved");
     assert.ok(resolved, "expected the racing escalation to be marked resolved");
 });
+/** NOT-310: origin + local clone where branch `issue-1` (commit B) is behind a moved
+ * base (commit C). With `conflict`, C edits the same line of shared.txt that B
+ * touched; otherwise C adds an unrelated file and merges cleanly. With
+ * `upToDate`, C lands before the branch is cut, so the branch already contains
+ * the base tip (a "not mergeable" failure there is a policy block, not
+ * staleness) — the conflict flag is then meaningless and must be false. */
+function initNot310Repos(opts) {
+    assert.equal(opts.upToDate === true && opts.conflict === true, false, "upToDate fixtures cannot also conflict");
+    const origin = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not310-origin-"));
+    execFileSync("git", ["init", "-b", "main"], { cwd: origin });
+    execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: origin });
+    execFileSync("git", ["config", "user.name", "Test"], { cwd: origin });
+    fs.writeFileSync(path.join(origin, "base.txt"), "v1\n");
+    fs.writeFileSync(path.join(origin, "shared.txt"), "line1\nline2\n");
+    execFileSync("git", ["add", "."], { cwd: origin });
+    execFileSync("git", ["commit", "-m", "A base"], { cwd: origin });
+    const commitC = () => {
+        if (opts.conflict) {
+            fs.writeFileSync(path.join(origin, "shared.txt"), "line1\nbase change\n");
+        }
+        else {
+            fs.writeFileSync(path.join(origin, "other.txt"), "c\n");
+        }
+        execFileSync("git", ["add", "."], { cwd: origin });
+        execFileSync("git", ["commit", "-m", "C base moved"], { cwd: origin });
+    };
+    if (opts.upToDate)
+        commitC();
+    const local = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-not310-local-"));
+    fs.rmSync(local, { recursive: true, force: true });
+    execFileSync("git", ["clone", origin, local]);
+    execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: local });
+    execFileSync("git", ["config", "user.name", "Test"], { cwd: local });
+    execFileSync("git", ["checkout", "-b", "issue-1"], { cwd: local });
+    fs.writeFileSync(path.join(local, "shared.txt"), "line1\nfeature change\n");
+    execFileSync("git", ["add", "."], { cwd: local });
+    execFileSync("git", ["commit", "-m", "B feature"], { cwd: local });
+    execFileSync("git", ["push", "-u", "origin", "issue-1"], { cwd: local });
+    // Like a production managed clone, the main checkout rests on the base — the
+    // issue branch must not be checked out anywhere for the sync to proceed.
+    execFileSync("git", ["checkout", "-q", "main"], { cwd: local });
+    if (!opts.upToDate)
+        commitC();
+    const baseMovedSha = execFileSync("git", ["rev-parse", "HEAD"], { cwd: origin, encoding: "utf8" }).trim();
+    return { origin, local, baseMovedSha };
+}
+function branchContains(repo, sha, branch) {
+    try {
+        execFileSync("git", ["merge-base", "--is-ancestor", sha, branch], { cwd: repo });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const NOT_MERGEABLE = "Pull request #42 is not mergeable: the merge commit cannot be cleanly created";
+test("NOT-310: cleanly-mergeable base syncs, pushes without force, polls checks, merges untouched", async () => {
+    const { origin, local, baseMovedSha } = initNot310Repos({ conflict: false });
+    const gitArgs = [];
+    setConflictSyncGitExecForTests(async (args, opts) => {
+        gitArgs.push(args);
+        return defaultSyncGitExec(args, opts);
+    });
+    let checksPolls = 0;
+    setConflictSyncGithubForTests({
+        checksSnapshot: async () => {
+            checksPolls += 1;
+            return "success";
+        },
+    });
+    const mergeCalls = [];
+    let merges = 0;
+    setMergePrForTests(async (opts) => {
+        mergeCalls.push(opts);
+        merges += 1;
+        return merges === 1 ? { ok: false, reason: NOT_MERGEABLE } : { ok: true };
+    });
+    const issueId = newIssue({ autoMerge: true, repo: local });
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    await complete(issueId, { kind: "verdict", result: okReview("approved") });
+    assert.equal(merges, 2, "one failing merge plus one post-sync retry");
+    assert.deepEqual(mergeCalls, [
+        { cwd: local, number: 42 },
+        { cwd: local, number: 42 },
+    ]);
+    assert.equal(getIssue(issueId).status, "done");
+    assert.equal(getActiveWorkflowInstance(issueId), null);
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0, "no human action when the sync resolves the staleness");
+    assert.ok(checksPolls >= 1, "expected the checks poll to run after the sync push");
+    // The sync merged the moved base and pushed it: origin's branch contains C.
+    assert.equal(branchContains(origin, baseMovedSha, "issue-1"), true);
+    // No force-push anywhere in the new path.
+    const pushes = gitArgs.filter((a) => a[0] === "push");
+    assert.ok(pushes.length >= 1, "expected at least one push");
+    for (const args of pushes) {
+        assert.ok(args.every((a) => !/^(-f|--force)/.test(a)), `push must never force: ${args.join(" ")}`);
+    }
+    assert.ok(gitArgs.some((a) => a.includes("merge") && a.includes("origin/main")), "expected a merge of the fetched base");
+    const root = path.join(local, ".agent-dealer-worktrees");
+    const leftovers = fs.existsSync(root) ? fs.readdirSync(root).filter((e) => e.startsWith("merge-sync-")) : [];
+    assert.deepEqual(leftovers, []);
+});
+test("NOT-310: retry_merge runs the same conflict sync (commands.ts retry path)", async () => {
+    const { resolveHumanActionAndAdvanceAsync } = await import("./commands.js");
+    const { cancelWorkItem } = await import("../repository/work-items.js");
+    const { createHumanAction } = await import("../repository/human-actions.js");
+    const { transitionIssue } = await import("../repository/issues.js");
+    const { origin, local, baseMovedSha } = initNot310Repos({ conflict: false });
+    setConflictSyncGithubForTests({ checksSnapshot: async () => "success" });
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return merges === 1 ? { ok: false, reason: NOT_MERGEABLE } : { ok: true };
+    });
+    const issueId = newIssue({ autoMerge: true, repo: local });
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    // Park like a merge failure did: drop the pending reviewer round, go
+    // needs_human with a merge-failure action offering retry_merge.
+    for (const item of listWorkItemsForIssue(issueId)) {
+        if (item.status === "pending" || item.status === "leased")
+            cancelWorkItem(item.id);
+    }
+    transitionIssue(issueId, "needs_human", {
+        currentOwner: "human",
+        currentIntent: `Auto-merge failed: ${NOT_MERGEABLE}`,
+    });
+    const action = createHumanAction({
+        issueId,
+        workflowInstanceId: getActiveWorkflowInstance(issueId).id,
+        actionType: "policy_escalation",
+        reason: `Auto-merge failed: ${NOT_MERGEABLE}`,
+        question: `Auto-merge failed: ${NOT_MERGEABLE} Retry the merge, queue another repair round, or close the issue?`,
+        evidence: { mergeFailure: true },
+        responseOptions: [
+            { choice: "retry_merge", label: "Retry merge" },
+            { choice: "repair", label: "Another repair round" },
+            { choice: "close", label: "Close" },
+        ],
+    });
+    const resolved = await resolveHumanActionAndAdvanceAsync(action.id, "op", "retry_merge");
+    assert.equal(resolved.ok, true);
+    assert.equal(merges, 2, "retry_merge must sync + retry, not just re-run gh");
+    assert.equal(getIssue(issueId).status, "done");
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0);
+    assert.equal(branchContains(origin, baseMovedSha, "issue-1"), true);
+});
+test("NOT-310: up-to-date branch that stays not mergeable escalates directly, no repair round", async () => {
+    const { local, baseMovedSha } = initNot310Repos({ conflict: false, upToDate: true });
+    setConflictSyncGithubForTests({ checksSnapshot: async () => "success" });
+    const policyReason = "Pull request #42 is not mergeable: base branch policy prohibits the merge";
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return { ok: false, reason: policyReason };
+    });
+    const issueId = newIssue({ autoMerge: true, repo: local });
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    await complete(issueId, { kind: "verdict", result: okReview("approved") });
+    assert.equal(merges, 2, "failing merge plus one post-sync retry");
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.status === "pending").length, 0, "a policy block must not spend a conflict-repair round");
+    const open = listHumanActionsForIssue(issueId).filter((a) => a.status === "open");
+    assert.equal(open.length, 1);
+    assert.equal(open[0].actionType, "policy_escalation");
+    assert.match(open[0].reason, /base branch policy prohibits the merge/);
+    assert.match(open[0].reason, /already contains main .* — not a staleness conflict/);
+    const evidence = JSON.parse(open[0].evidenceJson);
+    assert.equal(evidence.mergeFailure, true);
+    assert.ok(!("conflictingFiles" in evidence), "no file list when nothing conflicted");
+    assert.equal(branchContains(local, baseMovedSha, "issue-1"), true);
+});
+test("NOT-310: base advancing during the checks poll still earns the repair round", async () => {
+    const { origin, local } = initNot310Repos({ conflict: false });
+    // D lands on origin/main while the sync poll runs — a genuine new conflict.
+    let advanced = false;
+    setConflictSyncGithubForTests({
+        checksSnapshot: async () => {
+            if (!advanced) {
+                advanced = true;
+                fs.writeFileSync(path.join(origin, "shared.txt"), "line1\nbase change\n");
+                execFileSync("git", ["add", "."], { cwd: origin });
+                execFileSync("git", ["commit", "-m", "D base moved again"], { cwd: origin });
+            }
+            return "success";
+        },
+    });
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return { ok: false, reason: NOT_MERGEABLE };
+    });
+    const issueId = newIssue({ autoMerge: true, repo: local });
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    await complete(issueId, { kind: "verdict", result: okReview("approved") });
+    assert.equal(merges, 2);
+    assert.equal(getIssue(issueId).status, "repairing");
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0);
+    const pending = listWorkItemsForIssue(issueId).filter((i) => i.status === "pending");
+    assert.equal(pending.length, 1);
+    const payload = JSON.parse(pending[0].payloadJson);
+    assert.deepEqual(payload.conflictRepair, { baseBranch: "main", branch: "issue-1", files: [] });
+});
+test("NOT-310: textual conflict aborts the sync and queues a conflict-repair round, no human action yet", async () => {
+    const { local, baseMovedSha } = initNot310Repos({ conflict: true });
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return { ok: false, reason: NOT_MERGEABLE };
+    });
+    const issueId = newIssue({ autoMerge: true, repo: local });
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    await complete(issueId, { kind: "verdict", result: okReview("approved") });
+    assert.equal(merges, 1);
+    assert.equal(getIssue(issueId).status, "repairing");
+    assert.equal(listHumanActionsForIssue(issueId).filter((a) => a.status === "open").length, 0, "no human action is opened before the conflict-repair round runs");
+    const pending = listWorkItemsForIssue(issueId).filter((i) => i.status === "pending");
+    assert.equal(pending.length, 1);
+    assert.equal(pending[0].kind, "developer");
+    const payload = JSON.parse(pending[0].payloadJson);
+    assert.deepEqual(payload.conflictRepair, { baseBranch: "main", branch: "issue-1", files: ["shared.txt"] });
+    const prompt = buildDeveloperPrompt({
+        taskSnapshot: { title: "t", description: "d", acceptanceCriteria: "a", repo: local, baseBranch: "main" },
+        round: pending[0].round,
+        conflictRepair: payload.conflictRepair,
+    });
+    assert.ok(prompt.includes("main"), "repair prompt names the base branch");
+    assert.ok(prompt.includes("shared.txt"), "repair prompt names the conflicting files");
+    // The worktree merge was aborted: the branch still lacks the moved base ...
+    assert.equal(branchContains(local, baseMovedSha, "issue-1"), false);
+    // ... and no merge-sync checkout is left behind.
+    const root = path.join(local, ".agent-dealer-worktrees");
+    const leftovers = fs.existsSync(root) ? fs.readdirSync(root).filter((e) => e.startsWith("merge-sync-")) : [];
+    assert.deepEqual(leftovers, []);
+});
+test("NOT-310: still conflicting after the conflict-repair round escalates once, listing files", async () => {
+    const { local } = initNot310Repos({ conflict: true });
+    let merges = 0;
+    setMergePrForTests(async () => {
+        merges += 1;
+        return { ok: false, reason: NOT_MERGEABLE };
+    });
+    const issueId = newIssue({ autoMerge: true, repo: local });
+    startWorkflow(issueId);
+    await complete(issueId, cleanHandoff);
+    await complete(issueId, { kind: "verdict", result: okReview("approved") });
+    assert.equal(getIssue(issueId).status, "repairing");
+    // The conflict-repair round runs and hands off; the reviewer approves again.
+    await complete(issueId, cleanHandoff);
+    await complete(issueId, { kind: "verdict", result: okReview("approved") });
+    assert.equal(merges, 2);
+    assert.equal(getIssue(issueId).status, "needs_human");
+    assert.equal(listWorkItemsForIssue(issueId).filter((i) => i.status === "pending").length, 0);
+    const open = listHumanActionsForIssue(issueId).filter((a) => a.status === "open");
+    assert.equal(open.length, 1, "exactly one policy_escalation exists");
+    assert.equal(open[0].actionType, "policy_escalation");
+    assert.match(open[0].reason, /shared\.txt/);
+    assert.deepEqual(JSON.parse(open[0].responseOptionsJson), [
+        { choice: "retry_merge", label: "Retry merge" },
+        { choice: "repair", label: "Another repair round" },
+        { choice: "close", label: "Close" },
+    ]);
+    const evidence = JSON.parse(open[0].evidenceJson);
+    assert.equal(evidence.mergeFailure, true);
+    assert.deepEqual(evidence.conflictingFiles, ["shared.txt"]);
+});
 test("escalate txn no-ops when a racing success already marked the issue done", async () => {
     const { finalizeAutoMerge } = await import("./auto-merge.js");
     const { transitionIssue } = await import("../repository/issues.js");

package/bundle/server/dist/coordinator/auto-merge.js

@@ -29,6 +29,7 @@ import { getIssue, listIssues, transitionIssue } from "../repository/issues.js";
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, } from "../repository/workflow-events.js";
 import { createHumanAction, findOpenHumanAction, resolveHumanAction, } from "../repository/human-actions.js";
 import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS } from "./human-resolution.js";
+import { isMergeConflictFailure, runMergeConflictSync } from "./merge-conflict-sync.js";
 const run = promisify(execFile);
 /** Bound each `gh` shell-out so a hang cannot freeze the coordinator process. */
 export const GH_MERGE_TIMEOUT_MS = 20_000;
@@ -187,7 +188,42 @@ async function finalizeAutoMergeOnce(issueId) {
     if (!resolvedCwd.ok) {
         return escalateMergeFailure(issue, instance.id, `Auto-merge failed: ${resolvedCwd.reason}`);
     }
-    const merge = await mergePrImpl({ cwd: resolvedCwd.cwd, number: issue.prNumber });
+    let merge = await mergePrImpl({ cwd: resolvedCwd.cwd, number: issue.prNumber });
+    // NOT-310: a not-mergeable failure is staleness Dealer can resolve itself —
+    // sync the base, re-verify, retry — instead of escalating with no way forward.
+    // Anything the sync refuses or cannot fix degrades to today's escalation.
+    // retry_merge parks into this same finalize, so it is covered automatically.
+    if (!merge.ok && isMergeConflictFailure(merge.reason) && issue.branch) {
+        const sync = await runMergeConflictSync({
+            issueId: issue.id,
+            instanceId: instance.id,
+            repo: issue.repo,
+            branch: issue.branch,
+            baseBranch: issue.baseBranch,
+            prNumber: issue.prNumber,
+            mergeReason: merge.reason,
+            mergePr: mergePrImpl,
+        });
+        if (sync.outcome === "merged") {
+            merge = { ok: true };
+        }
+        else if (sync.outcome === "repair_queued") {
+            return {
+                applied: true,
+                issueStatus: "repairing",
+                nextWorkItemId: sync.workItemId,
+                humanActionId: null,
+                instanceCompleted: false,
+                triggerReflect: false,
+            };
+        }
+        else if (sync.outcome === "escalate") {
+            return escalateMergeFailure(issue, instance.id, sync.reason, sync.evidence);
+        }
+        else {
+            return escalateMergeFailure(issue, instance.id, `Auto-merge failed: ${merge.reason}`);
+        }
+    }
     if (!merge.ok) {
         return escalateMergeFailure(issue, instance.id, `Auto-merge failed: ${merge.reason}`);
     }
@@ -251,7 +287,7 @@ async function finalizeAutoMergeOnce(issueId) {
         };
     })();
 }
-function escalateMergeFailure(issue, workflowInstanceId, reason) {
+function escalateMergeFailure(issue, workflowInstanceId, reason, evidence = { [MERGE_FAILURE_EVIDENCE_KEY]: true }) {
     return getDb().transaction(() => {
         const current = getIssue(issue.id);
         // Concurrent success already completed — never open a dangling escalation on done.
@@ -304,7 +340,7 @@ function escalateMergeFailure(issue, workflowInstanceId, reason) {
             actionType: "policy_escalation",
             reason,
             question: `${reason} Retry the merge, queue another repair round, or close the issue?`,
-            evidence: { [MERGE_FAILURE_EVIDENCE_KEY]: true },
+            evidence,
             responseOptions: [...MERGE_FAILURE_RESPONSE_OPTIONS],
         });
         appendWorkflowEvent({