Bug 2051452: Add the uplift merge-conflict resolver agent

agents/uplift/Dockerfile

@@ -0,0 +1,54 @@
+FROM python:3.12 AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+
+ENV UV_PROJECT_ENVIRONMENT=/opt/venv
+
+WORKDIR /app
+
+# Install external deps without building workspace members.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
+    --mount=type=bind,source=uv.lock,target=uv.lock \
+    --mount=type=bind,source=VERSION,target=VERSION \
+    uv sync --frozen --no-dev --no-install-workspace --package hackbot-agent-uplift
+
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,target=/app,rw \
+    uv sync --locked --no-dev --no-editable --package hackbot-agent-uplift
+
+FROM python:3.12 AS base
+
+COPY --from=builder /opt/venv /opt/venv
+WORKDIR /app
+
+ENV PYTHONUNBUFFERED=1
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PATH="/opt/venv/bin:$PATH"
+
+FROM base AS agent
+
+# No ffmpeg: the other agents carry it for the codecs a Firefox they build or
+# run needs, and this agent does neither.
+
+# hackbot.toml lives at the agent root (not inside the package), so copy it into
+# the working dir; the runtime discovers it there (cwd) at startup.
+COPY agents/uplift/hackbot.toml /app/hackbot.toml
+
+RUN useradd --create-home --shell /bin/bash agent \
+    && mkdir -p /workspace \
+    && chown agent:agent /workspace
+
+USER agent
+
+CMD ["python", "-m", "hackbot_agents.uplift_merge_conflict_resolver"]
+
+FROM base AS broker
+
+RUN useradd --create-home --shell /bin/bash broker
+
+USER broker
+
+EXPOSE 8765
+
+CMD ["python", "-m", "hackbot_agents.uplift_merge_conflict_resolver.broker"]

agents/uplift/README.md

@@ -0,0 +1,67 @@
+# Uplift Agents
+
+Home for the backport/uplift sub-agents that help land patches on Firefox's
+stable branches (release/beta/esr). One Cloud Run image
+(`hackbot-agent-uplift`); each sub-agent is a module under `hackbot_agents/`
+with its own entrypoint, job and registry entry. Module names are prefixed
+`uplift_` because the runtime traces under the directory holding `__main__.py`,
+which has to match the registry name.
+
+## Merge-conflict resolver
+
+`hackbot_agents/uplift_merge_conflict_resolver/` — the first sub-agent. It
+reproduces a failed uplift cherry-pick on the target branch, resolves the
+conflicts, and returns the patch with a confidence level for review. It never
+pushes or lands anything, and it does not build Firefox.
+
+### Input
+
+Set per run (see `UpliftInputs` in hackbot-api for the full schema):
+
+- `TARGET_BRANCH` — branch to uplift onto, e.g. `beta`, `esr128`.
+- `TARGET_COMMIT` — optional commit on that branch, for reproducing a specific
+  failed uplift. Branch names move; without one the tip is used.
+- `SOURCES` — JSON list, applied in order; a stack is several entries. Each is
+  `{"kind": "git", "commit": "<sha>"}` or
+  `{"kind": "phabricator", "revision_id": 12345, "diff_id": 67890}`, where
+  `diff_id` is optional and defaults to the revision's latest.
+- `BUG_ID` — optional Bugzilla bug for context.
+
+`BUGBUG_MCP_URL` and `BROKER_URL` are deploy-time constants: the bugbug MCP
+server, and the sidecar holding the Conduit key the agent fetches diffs through.
+
+### Output
+
+- `changes/changes.patch` — the resolved uplift, as an mbox preserving each
+  commit's message and author. This is what a caller consumes.
+- `report.json` — `resolved`, `confidence`, `conflicts`, `unresolved`,
+  `verification_failures`. `resolved` is not taken on trust: the run checks the
+  checkout for conflicted paths, an unfinished cherry-pick, uncommitted work
+  and whether the commits would collect to a patch at all, and overrules the
+  claim if they disagree. Confidence stays the agent's own judgment.
+- `report.unverified.json` — the same report as the agent wrote it, before
+  those checks. For debugging; read `report.json`.
+- `summary.md` — what conflicted and how it was resolved, for a reviewer.
+
+The run summary also records `base_commit` (what the patches were applied onto)
+and `requested_sources` (what was asked for and what each source resolved to).
+
+### Run locally
+
+With `ANTHROPIC_API_KEY`, `BUGZILLA_API_KEY` and `PHABRICATOR_API_KEY` in a
+repo-root `.env`, from the repo root:
+
+```sh
+TARGET_BRANCH=beta \
+SOURCES='[{"kind":"git","commit":"<sha>"}]' \
+  docker compose up uplift-merge-conflict-resolver --build
+```
+
+Artifacts land in `~/hackbot/artifacts/<run_id>`; apply the patch with
+`git am changes/changes.patch`.
+
+### Tests
+
+```sh
+uv run --package hackbot-agent-uplift --extra test pytest agents/uplift/tests
+```

agents/uplift/compose.yml

@@ -0,0 +1,60 @@
+services:
+  # The bugbug MCP server, run as a sidecar so the agent reaches the originating
+  # bug and Phabricator revision over HTTP. It holds the Bugzilla/Phabricator
+  # credentials; the agent container binds none. In production the agent points
+  # at the deployed bugbug MCP instead via BUGBUG_MCP_URL.
+  uplift-bugbug-mcp:
+    build:
+      context: ../..
+      dockerfile: services/mcp/Dockerfile
+      target: base
+    environment:
+      PORT: "8080"
+      BUGZILLA_API_KEY: ${BUGZILLA_API_KEY:-}
+      BUGZILLA_URL: ${BUGZILLA_URL:-https://bugzilla.mozilla.org}
+      PHABRICATOR_API_KEY: ${PHABRICATOR_API_KEY:-}
+      PHABRICATOR_URL: ${PHABRICATOR_URL:-https://phabricator.services.mozilla.com}
+    expose:
+      - "8080"
+
+  # Holds the Phabricator key so the agent can fetch each source's raw diff
+  # over the read-only Conduit proxy without binding a credential itself.
+  uplift-broker:
+    build:
+      context: ../..
+      dockerfile: agents/uplift/Dockerfile
+      target: broker
+    environment:
+      PHABRICATOR_URL: ${PHABRICATOR_URL:-https://phabricator.services.mozilla.com}
+      PHABRICATOR_API_KEY: ${PHABRICATOR_API_KEY:-}
+    expose:
+      - "8765"
+
+  uplift-merge-conflict-resolver:
+    build:
+      context: ../..
+      dockerfile: agents/uplift/Dockerfile
+      target: agent
+    environment:
+      - RUN_ID
+      - TARGET_BRANCH=${TARGET_BRANCH:-}
+      - SOURCES=${SOURCES:-}
+      - BUG_ID=${BUG_ID:-}
+      - BUGBUG_MCP_URL=http://uplift-bugbug-mcp:8080/mcp
+      - BROKER_URL=http://uplift-broker:8765
+      - SOURCE_REPO=/workspace/firefox
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:?error}
+      # No uploader locally: summary/logs/artifacts are written under
+      # /artifacts/<run_id>, bind-mounted to the host's ~/hackbot/artifacts.
+      - ARTIFACTS_DIR=/artifacts
+    volumes:
+      - workspace:/workspace
+      - ${HOME}/hackbot/artifacts:/artifacts
+    depends_on:
+      uplift-bugbug-mcp:
+        condition: service_started
+      uplift-broker:
+        condition: service_started
+
+volumes:
+  workspace:

agents/uplift/hackbot.toml

@@ -0,0 +1,8 @@
+[source]
+repo_url = "https://github.com/mozilla-firefox/firefox.git"
+checkout_path = "/workspace/firefox"
+# The checkout is pinned per-run to the target uplift branch (from
+# `target_branch`); the agent fetches and cherry-picks the sources onto it.
+
+# No [firefox] table: the agent resolves conflicts at the source level and
+# never builds Firefox, so the build toolchain is not prepared.

agents/uplift/hackbot_agents/uplift_merge_conflict_resolver/__main__.py

@@ -0,0 +1,77 @@
+import logging
+
+from hackbot_runtime import HackbotContext, run_async
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+from .agent import UpliftResult, run_uplift
+from .config import UpliftSource
+
+logger = logging.getLogger(__name__)
+
+
+class AgentInputs(BaseSettings):
+    """The per-run inputs, read from the environment the platform sets.
+
+    Mirrors `UpliftInputs` in hackbot-api, which upper-cases each field name
+    and JSON-encodes lists. Deploy-time constants arrive the same way, from the
+    Job's static env rather than the caller.
+    """
+
+    # The stable branch ref to uplift onto, e.g. `release`, `beta`, `esr128`.
+    target_branch: str
+
+    # The exact commit to uplift onto. A branch name moves, so a caller
+    # reproducing a specific uplift should pin it; otherwise the tip is used.
+    target_commit: str | None = None
+
+    # The patches to apply onto the branch, in this order; a stack is several.
+    sources: list[UpliftSource]
+
+    # The bugbug MCP, serving the bug, revision and fx-docs tools.
+    bugbug_mcp_url: str
+
+    # The broker sidecar, whose Conduit proxy diffs are fetched through.
+    broker_url: str
+
+    # The originating bug, for context when a conflict's intent is unclear.
+    bug_id: int | None = None
+
+    # Overrides; `None` leaves the SDK's or the API's own default in place.
+    model: str | None = None
+    max_turns: int | None = None
+    effort: str | None = None
+
+    # Compose passes unset inputs as empty strings (``${BUG_ID:-}``).
+    model_config = SettingsConfigDict(extra="ignore", env_ignore_empty=True)
+
+
+async def main(ctx: HackbotContext) -> UpliftResult:
+    inputs = AgentInputs()
+
+    # Pin the checkout before anything else reads the tree.
+    ref = inputs.target_commit or inputs.target_branch
+    logger.debug("Preparing the source checkout at %s.", ref)
+    source_repo = await ctx.prepare_repo(ref=ref)
+
+    return await run_uplift(
+        bugbug_mcp_server={
+            "type": "http",
+            "url": inputs.bugbug_mcp_url,
+        },
+        broker_url=inputs.broker_url,
+        source_repo=source_repo,
+        target_branch=inputs.target_branch,
+        target_commit=inputs.target_commit,
+        sources=inputs.sources,
+        bug_id=inputs.bug_id,
+        model=inputs.model,
+        max_turns=inputs.max_turns,
+        effort=inputs.effort,
+        log=ctx.log_path,
+        verbose=True,
+        publish_file=ctx.publish_file,
+    )
+
+
+if __name__ == "__main__":
+    run_async(main)