Use sync conflict-handling behavior in restack flow. (#21)

## Description

When the restack workflow hits a rebase conflict, it previously just
aborted and hoped the approve workflow would handle it later. This was
racy and unreliable.

This PR mirrors the sync workflow's conflict-handling approach: accept
the conflict markers, invoke the conflict-resolution agent, push the
result, and add labels/trailers to prevent auto-approval.

Key changes:
- **Shared conflict helpers** (`conflict.py`): extracted
`run_agent_with_manifest()`, `add_conflict_label()`, and
`assign_conflict_reviewer()` so both sync and restack use the same code
paths for conflict handling.
- **Restack conflict path**: on rebase conflict, detects modify/delete
conflicts while paused, accepts markers via `git add -A` + `git rebase
--continue`, runs the conflict-resolution agent on committed markers,
pushes, labels the PR, appends a `Repo-Sync-Conflict: rebase` trailer
(blocking auto-approval), and assigns a reviewer.
- **Sync refactored**: both `_sync_private_to_public` and
`_sync_public_to_private` now call the shared helpers instead of inline
manifest/agent/label/reviewer code.
- **Workflow YAML**: added Docker image build step and optional
`warp_api_key` secret to `restack.yml`, plus `--escalate-to` CLI
passthrough.

## Testing

- All 243 existing tests pass (3 pre-existing failures in
`test_fixup_script.py` are unrelated to this change).
- Verified all imports resolve correctly.
- Manually tested the rebase conflict flow on the warp-external repo to
confirm the `git rebase --onto` + conflict resolution sequence works
end-to-end.

Co-Authored-By: Oz <oz-agent@warp.dev>

Author: vorporeal

.github/workflows/restack.yml

@@ -37,6 +37,9 @@ on:
       app_private_key:
         description: "GitHub App private key."
         required: true
+      warp_api_key:
+        description: "Warp API key for the conflict-resolution agent."
+        required: false
   # workflow_dispatch is used for stuck-stack recovery.
   workflow_dispatch:
     inputs:
@@ -119,6 +122,9 @@ jobs:
       - name: Install repo-sync tools
         run: pip install -e .repo-sync
 
+      - name: Build conflict resolution agent image
+        run: docker build -f .repo-sync/docker/conflict-resolution/Dockerfile -t repo-sync-conflict-resolution .repo-sync
+
       - name: Configure git identity
         run: |
           git config --global user.name "warp-repo-sync[bot]"
@@ -137,4 +143,7 @@ jobs:
             --public-repo "${PUBLIC_REPO}" \
             --private-repo "${PRIVATE_REPO}" \
             --default-branch "${{ github.event.repository.default_branch }}" \
+            --escalate-to "${ESCALATE_TO}" \
             --repo-dir .
+        env:
+          WARP_API_KEY: ${{ secrets.warp_api_key }}

src/repo_sync/stack/git_ops.py

@@ -110,6 +110,27 @@ def rebase_onto(
             ["rebase", "--onto", new_base, old_base, branch], check=False
         )
 
+    def rebase_continue(self) -> CommandResult:
+        """Continue an in-progress rebase after conflicts have been staged.
+
+        Sets GIT_EDITOR=true to prevent an interactive editor from opening
+        in non-interactive environments (CI).  The original commit message
+        is preserved.
+        """
+        env = {**os.environ, **self._env_additions, "GIT_EDITOR": "true"}
+        result = subprocess.run(
+            ["git", "rebase", "--continue"],
+            cwd=self.repo_dir,
+            capture_output=True,
+            text=True,
+            env=env,
+        )
+        return CommandResult(
+            returncode=result.returncode,
+            stdout=result.stdout.strip(),
+            stderr=result.stderr.strip(),
+        )
+
     def rebase_abort(self) -> None:
         """Abort an in-progress rebase."""
         self._run(["rebase", "--abort"], check=False)

src/repo_sync/stack/trailers.py

@@ -137,9 +137,9 @@ def parse_conflict(text: str) -> bool:
     return False
 
 
-def format_conflict_trailer() -> str:
+def format_conflict_trailer(conflict_type: str = "cherry-pick") -> str:
     """Format a Repo-Sync-Conflict trailer line."""
-    return f"{_CONFLICT_PREFIX} cherry-pick"
+    return f"{_CONFLICT_PREFIX} {conflict_type}"
 
 
 def format_assigned_trailer(username: str, timestamp: datetime) -> str:

src/repo_sync/workflows/cli.py

@@ -218,6 +218,7 @@ def cmd_restack_pr(args: argparse.Namespace) -> None:
             public_repo=args.public_repo,
             private_repo=args.private_repo,
             default_branch=args.default_branch,
+            escalate_to=args.escalate_to,
         )
     except RestackError as e:
         logging.error("%s", e)
@@ -396,6 +397,7 @@ def main() -> None:
     p.add_argument("--private-repo", required=True)
     p.add_argument("--default-branch", required=True)
     p.add_argument("--repo-dir", required=True)
+    p.add_argument("--escalate-to", default="@oncall-client-primary")
     p.set_defaults(func=cmd_restack_pr)
 
     # approve-pr.

src/repo_sync/workflows/conflict.py

@@ -0,0 +1,145 @@
+"""Shared conflict handling helpers for sync and restack workflows.
+
+Provides the common logic that both the sync PR creation and restack
+workflows use when a cherry-pick or rebase produces conflicts:
+
+- Writing the modify/delete manifest and invoking the conflict-resolution
+  agent (``run_agent_with_manifest``).
+- Adding the ``repo-sync:conflict`` label (``add_conflict_label``).
+- Determining and assigning a reviewer with the ``Repo-Sync-Assigned``
+  trailer (``assign_conflict_reviewer``).
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+from datetime import datetime, timezone
+
+from repo_sync.stack.gh_ops import GhOps
+from repo_sync.stack.git_ops import GitOps
+from repo_sync.stack.trailers import (
+    append_trailer,
+    format_assigned_trailer,
+)
+from repo_sync.workflows.sync import determine_sync_reviewer
+
+logger = logging.getLogger(__name__)
+
+
+def run_agent_with_manifest(
+    git: GitOps,
+    md_conflicts: list[dict[str, str]],
+    manifest_context: str,
+    agent_context: str,
+) -> bool:
+    """Write the modify/delete manifest, invoke the agent, and clean up.
+
+    The manifest (``.repo-sync-conflicts.json``) is a transient file
+    consumed by the conflict-resolution agent.  It is never committed.
+
+    Must be called *after* the conflict markers have been committed (so
+    the agent sees committed markers, not a paused git operation).
+
+    Returns True if the agent resolved the conflicts, False otherwise.
+    """
+    manifest_path = os.path.join(git.repo_dir, ".repo-sync-conflicts.json")
+
+    if md_conflicts:
+        logger.info(
+            "Detected %d modify/delete conflict(s): %s",
+            len(md_conflicts),
+            [c["path"] for c in md_conflicts],
+        )
+        manifest = {
+            "context": manifest_context,
+            "modify_delete_conflicts": md_conflicts,
+        }
+        with open(manifest_path, "w") as f:
+            json.dump(manifest, f, indent=2)
+            f.write("\n")
+
+    from repo_sync.workflows.agent import run_conflict_resolution_agent
+
+    agent_succeeded = run_conflict_resolution_agent(
+        repo_dir=git.repo_dir,
+        context=agent_context,
+    )
+
+    # Clean up the manifest if the agent left it behind.
+    if os.path.exists(manifest_path):
+        os.remove(manifest_path)
+
+    if agent_succeeded:
+        logger.info("Conflict-resolution agent succeeded.")
+    else:
+        logger.warning(
+            "Conflict-resolution agent did not resolve conflicts. "
+            "PR will contain raw conflict markers."
+        )
+
+    return agent_succeeded
+
+
+def add_conflict_label(gh: GhOps, pr_number: int) -> None:
+    """Create (if needed) and apply the ``repo-sync:conflict`` label."""
+    gh._run(
+        ["label", "create", "repo-sync:conflict",
+         "--color", "D93F0B",
+         "--description", "Sync PR has merge conflicts",
+         "--repo", gh.repo],
+        check=False,
+    )
+    gh._run(
+        ["pr", "edit", str(pr_number), "--repo", gh.repo,
+         "--add-label", "repo-sync:conflict"],
+    )
+
+
+def assign_conflict_reviewer(
+    gh: GhOps,
+    pr_number: int,
+    source_repo: str | None,
+    source_sha: str | None,
+    escalate_to: str,
+) -> str:
+    """Determine a reviewer, assign them, and append the Assigned trailer.
+
+    Looks up the original commit author via ``determine_sync_reviewer``
+    when *source_repo* and *source_sha* are provided; falls back to
+    *escalate_to* otherwise.
+
+    Returns the reviewer login or team slug.
+    """
+    if source_repo and source_sha:
+        source_gh = GhOps(source_repo, token=os.environ.get("GH_TOKEN"))
+        reviewer = determine_sync_reviewer(
+            source_gh=source_gh,
+            source_sha=source_sha,
+            fallback_team=escalate_to,
+        )
+    else:
+        reviewer = escalate_to
+
+    # Request review.
+    gh._run(
+        ["pr", "edit", str(pr_number), "--repo", gh.repo,
+         "--add-reviewer", reviewer],
+        check=False,
+    )
+
+    # Append Repo-Sync-Assigned trailer to the PR body.
+    assigned_trailer = format_assigned_trailer(
+        reviewer, datetime.now(timezone.utc),
+    )
+    current_body = gh._run(
+        ["pr", "view", str(pr_number), "--repo", gh.repo,
+         "--json", "body", "--jq", ".body"],
+        check=False,
+    ) or ""
+    updated_body = append_trailer(current_body, assigned_trailer)
+    gh.update_pr_body(pr_number, updated_body)
+
+    logger.info("Assigned reviewer %s on PR #%d.", reviewer, pr_number)
+    return reviewer