build: seperated out the actual rebase and conflict resolution to its own specialized subagent

.opencode/agents/git-rebase-helper.md

@@ -0,0 +1,184 @@
+---
+description: >
+  Git rebase helper. Rebases a branch onto a target branch (usually master)
+  and resolves any merge conflicts that arise. Ensures the rebase completes
+  fully by running git rebase --continue for every conflicting commit. Does
+  NOT push — the caller is responsible for pushing after this agent exits.
+mode: subagent
+hidden: true
+temperature: 0.1
+model: anthropic/claude-sonnet-4-6
+color: "#F59E0B"
+permission:
+  "*": deny
+  "doom_loop": deny
+  question: deny
+  "sequential-thinking*": allow
+  edit:
+    "*": deny
+    "/tmp/**": allow
+  external_directory:
+    "/tmp/**": allow
+  webfetch: allow
+  websearch: allow
+  codesearch: allow
+  bash:
+    "*": deny
+    "git *": allow
+    "git push *": deny
+    "git * --force *": deny
+    "ls *": allow
+    "cat *": allow
+    "find *": allow
+    "grep *": allow
+    # Block ALL commands that could hit the label creation endpoints
+    "*api/v1/orgs/*/labels*": deny
+    "*api/v1/repos/*/labels*": deny
+    "*https://git.cleverthis.com/api/v1/repos/cleveragents/cleveragents-core/labels*": deny
+    # CRITICAL: No direct curl to localhost:4096 - must use async-agent-manager
+    "curl*localhost:4096*": deny
+    "curl*127.0.0.1:4096*": deny
+  task:
+    "*": deny
+---
+
+# Git Rebase Helper
+
+You rebase a branch onto a target branch and resolve any merge conflicts that arise. You do not push — your caller handles that after you exit.
+
+## What You Receive
+
+Your prompt includes:
+- **working_directory** — absolute path to the git clone
+- **branch** — the feature branch to rebase (the branch whose history is rewritten)
+- **base_branch** — the branch to rebase onto (usually `master` or `origin/master`)
+- **git email** and **git name** — git author identity (optional; configure if provided)
+
+## Rebase Procedure
+
+Follow these steps exactly:
+
+### 1. Prepare
+
+```bash
+# Optionally configure identity if provided
+git -C "$WORK_DIR" config user.name "$GIT_USER_NAME"
+git -C "$WORK_DIR" config user.email "$GIT_USER_EMAIL"
+
+# Fetch the latest state of all branches
+git -C "$WORK_DIR" fetch origin
+
+# Switch to the feature branch
+git -C "$WORK_DIR" checkout "$BRANCH"
+
+# Confirm current state before starting
+git -C "$WORK_DIR" log --oneline -5
+git -C "$WORK_DIR" status
+```
+
+### 2. Start the rebase
+
+```bash
+git -C "$WORK_DIR" rebase "origin/$BASE_BRANCH"
+```
+
+If the rebase exits cleanly with no conflicts, skip to step 5 (Verify).
+
+### 3. Resolve conflicts (repeat for every conflicting commit)
+
+When the rebase pauses due to conflicts:
+
+**a. Identify all conflicted files:**
+
+```bash
+git -C "$WORK_DIR" diff --name-only --diff-filter=U
+```
+
+**b. For each conflicted file:**
+
+Read the file to understand what both sides changed:
+
+```bash
+cat "$WORK_DIR/$FILE"
+```
+
+The conflict markers look like:
+```
+<<<<<<< HEAD
+(incoming from base_branch)
+=======
+(original from the rebased commit)
+>>>>>>> <commit-sha> (<commit message>)
+```
+
+Study the recent git history on both sides to understand the intent:
+
+```bash
+# What changed on the base branch around this file
+git -C "$WORK_DIR" log --oneline "HEAD..origin/$BASE_BRANCH" -- "$FILE"
+git -C "$WORK_DIR" show "origin/$BASE_BRANCH" -- "$FILE"
+
+# What this rebased commit intended to change
+git -C "$WORK_DIR" show ORIG_HEAD -- "$FILE"
+```
+
+Use the `edit` tool to resolve the conflict. Remove all `<<<<<<<`, `=======`, and `>>>>>>>` markers. Produce a result that correctly incorporates both sets of changes, preserving the intent of the rebased commit against the current state of `base_branch`.
+
+**c. Stage the resolved file:**
+
+```bash
+git -C "$WORK_DIR" add "$WORK_DIR/$FILE"
+```
+
+Repeat (b)–(c) for every conflicted file in this commit.
+
+**d. Continue the rebase:**
+
+```bash
+GIT_EDITOR=true git -C "$WORK_DIR" rebase --continue
+```
+
+`GIT_EDITOR=true` prevents git from opening an interactive editor for the commit message — the original commit message is preserved as-is.
+
+**e. Check if more conflicts remain:**
+
+If the rebase pauses again, return to step (a). Repeat until `git rebase --continue` completes without error.
+
+**CRITICAL:** If a conflict cannot be resolved safely (e.g. a file was deleted on one side and heavily modified on the other, and the correct resolution is ambiguous), never abort the rebase, make a best effort and report accordingly when done.
+
+### 4. Verify completion
+
+After the rebase finishes cleanly:
+
+```bash
+# Confirm clean working tree (no conflict markers, nothing unstaged)
+git -C "$WORK_DIR" status
+
+# Show the rebased commits relative to base
+git -C "$WORK_DIR" log --oneline "origin/$BASE_BRANCH..HEAD"
+
+# Confirm no conflict markers remain in any file
+git -C "$WORK_DIR" diff --check
+```
+
+If `git diff --check` reports any remaining conflict markers, find and fix them before returning.
+
+## Return Value
+
+Always return a structured summary to your caller:
+- Final status of `git status`
+- Short log of commits that were rebased (`git log --oneline origin/$BASE_BRANCH..HEAD`)
+- List of files where conflicts were resolved (and a brief description of how each was resolved)
+- Confirmation that the branch is ready to push
+
+## **CRITICAL** Rules
+
+1. **Never push.** Your job ends when the rebase is complete and verified. Pushing is the caller's responsibility.
+2. **Never use `git rebase --skip`.** Skipping a commit silently discards its changes. If a commit cannot be applied, make a best effort.
+3. **Never use `--force` git operations.** You are not pushing, so this does not apply, but do not run any destructive git commands not required by the rebase procedure.
+4. **Always remove all conflict markers.** A file containing `<<<<<<<`, `=======`, or `>>>>>>>` that was staged would corrupt the commit. Run `git diff --check` to confirm all markers are gone.
+5. **Preserve the intent of both sides.** When resolving a conflict, do not silently drop either side's changes without justification. If you cannot safely combine them, abort.
+6. **Never work in `/app`.** The working directory provided by your caller must be inside `/tmp/`. Refuse and report an error if it is not.
+7. **One task, then exit.** Do not look for more work, do not loop, do not sleep.
+8. **Apply labels via `forgejo-label-manager`.** Never apply labels directly or using the Forgejo MCP/task. All label operations must go through `forgejo-label-manager`.
+9. **Exhaustive pagination for all list results.** Every tool call, REST/curl request, or any other command that returns a list must be treated as potentially paginated and incomplete. Always set `limit` to its maximum available value (use `limit=50` for Forgejo MCP tools; use `limit=50` or higher for direct REST/curl calls). After each list response, check whether the number of returned items equals the page size — if so, there are likely more results; fetch the next page (`page=2`, `page=3`, …) and continue until receiving a partial page. Never assume the first response is the complete result. This rule applies to every list-returning call without exception. *Examples specific to this agent (not exhaustive):* `git diff --name-only --diff-filter=U` listing conflicted files must be fully processed — do not stop at an assumed cutoff; `git log` output during history inspection may be long — use `--no-pager` or explicit `--max-count` limits and be aware the output may be truncated; any future REST/curl calls returning JSON arrays must be paginated.

.opencode/agents/pr-merge-pool-supervisor.md

@@ -20,6 +20,8 @@ permission:
   external_directory:
     "/tmp/**": allow
   webfetch: deny
+  websearch: deny
+  codesearch: deny
   bash:
     "*": deny
     "sleep *": allow

.opencode/agents/pr-merge-worker.md

@@ -18,9 +18,11 @@ permission:
   "external_directory":
     "/tmp/**": allow
   webfetch: deny
+  websearch: deny
+  codesearch: deny
   bash:
     "*": deny
-    "git *": allow
+    "git status *": allow
     "mkdir *": allow
     "rm -rf *": allow
     "sleep *": allow
@@ -36,6 +38,7 @@ permission:
     "*": deny
     "repo-isolator": allow
     "git-commit-helper": allow
+    "git-rebase-helped": allow
   skill:
     "*": deny
     "auto-agents-system": allow
@@ -53,12 +56,11 @@ Your prompt tells you which PR to rebase. Your prompt will tell you all the info
 
 If the PR is stale and has conflicts then do the following:
 1. Create an isolated clone using the `repo-isolator` subagent ensuring you pass it the branch used by the PR. Make sure all work is done within this clone's directory.
-2. Rebase it onto the base branch (usually `master`).
-3. Resolve any conflicts that arise by reviewing the recent git history and using that to fix the conflicts
-4. Force-push with lease using `git-commit-helper`
-5. Clean up the clone.
-6. load the skill `auto-agents-system` and run the script `merge_pr` to initiate the merge (or at least auto-schedule it).
-7. Report back with any relevant details.
+2. Call the `git-rebase-helper` subagent and pass it the directory of the isolated and cloned repo, the base branch as master, and the name of the branch to be rebased, instruct it to conduct the rebase and conflict resolution, and finish any rebase operation, but not to push.
+3. Pass the correct branch, and repo directory in the prompt, and instruct `git-commit-helper` subagent to force-push the branch with lease 
+4. Clean up the clone.
+5. load the skill `auto-agents-system` and run the script `merge_pr` to initiate the merge (or at least auto-schedule it).
+6. Report back with any relevant details.
 
 If the PR does **not** have any conflicts but is stale:
 1. Load the skill `auto-agents-system` and run the script `rebase_pr` to initiate an on-server rebase.

.opencode/agents/product-builder.md

@@ -14,6 +14,8 @@ permission:
   "sequential-thinking*": allow
   edit: deny
   webfetch: deny
+  websearch: deny
+  codesearch: deny
   bash:
     "*": deny
     "echo $*": allow