fix: migrate to pi-sidecar and improve AI cherry-pick conflict resolution

.gitignore

@@ -164,3 +164,5 @@ find_unused_code.py
 .claude-flow/
 .swarm/
 CRUSH.md
+sidecar-helper/node_modules/
+sidecar-helper/dist/

CLAUDE.md

@@ -684,6 +684,36 @@ AI-powered enhancements controlled by `ai-features` config (global or per-repo).
 
 **Sub-features:** `conventional-title`, `resolve-cherry-pick-conflicts-with-ai`
 
-**On AI CLI failure:** Error is logged, flow continues without suggestion
+**On AI call failure:** Error is logged, flow continues without suggestion
 
-**Module:** `webhook_server/libs/ai_cli.py` - shared AI CLI wrapper
+**Module:** `webhook_server/libs/ai_cli.py` - shared AI wrapper (pi-sidecar)
+
+**Post-resolution verification:** After AI resolves cherry-pick conflicts, `_verify_cherry_pick_scope()` compares `git diff --stat` of the original commit vs the cherry-picked commit. Logs a warning if the cherry-picked commit has fewer file changes (possible dropped changes). Informational only — never fails the cherry-pick.
+
+**Required environment variables for pi-sidecar:**
+- `ACPX_AGENTS=cursor` — enables cursor model discovery
+- `VERTEX_CLAUDE_1M=true` — enables Claude 1M context window models via Vertex AI
+- `GOOGLE_APPLICATION_CREDENTIALS` — already set for Vertex AI access
+
+### Sidecar Architecture
+
+**`sidecar-helper/`** — Node.js pi-sidecar bridge that provides AI provider integration (cherry-pick conflict resolution, conventional title suggestions). Contains a minimal TypeScript wrapper that imports and starts the `@myk-org/pi-sidecar` server.
+
+**Container startup (`entrypoint.sh`):**
+1. Starts the sidecar as a background process (`node sidecar-helper/dist/server.js &`)
+2. Registers cleanup trap — kills sidecar when main process exits
+3. Spawns monitor subshell — if sidecar dies unexpectedly, kills PID 1 to crash the container
+4. Waits for sidecar readiness — polls `/health` endpoint (up to 15s)
+5. Runs `exec uv run entrypoint.py` as the main process
+
+**`SIDECAR_PORT`** env var controls the sidecar listen port (default: `9100`).
+
+**Tool server:** Standalone aiohttp server on port `5001` (`webhook_server/web/tool_server.py`). Runs in a dedicated thread with its own event loop, isolated from the main webhook server. Uses a `TOOL_REGISTRY` pattern — adding a new tool is one `ToolDef` entry. Callers select which tools the AI sees per session via `_build_custom_tools()`. Currently registers `git_diff`, `git_log`, `git_show`, `git_status`. Localhost-only (`127.0.0.1`). Started by `entrypoint.py` before uvicorn.
+
+**Dual healthcheck:** Dockerfile `HEALTHCHECK` verifies both the webhook server (`:5000/webhook_server/healthcheck`) and the sidecar (`:${SIDECAR_PORT}/health`). Container is unhealthy if either fails.
+
+**Docker build:** Multi-stage — `sidecar-builder` stage (node:22-slim) runs `npm ci`, `npx tsc`, `npm prune --omit=dev`. Final stage copies only `dist/`, `node_modules/` (production), and `package.json`.
+
+**Security note:** The AI conflict resolution prompt includes commit messages from the PR
+(user-controlled text). Prompt injection risk is mitigated by restricting the AI to read-only
+tools plus file edit/write — no bash access. The AI cannot execute arbitrary commands.

Dockerfile

@@ -1,6 +1,17 @@
+# Sidecar build stage
+FROM node:22-slim AS sidecar-builder
+WORKDIR /sidecar
+COPY sidecar-helper/package.json sidecar-helper/package-lock.json* ./
+RUN npm ci
+COPY sidecar-helper/ .
+RUN npx tsc
+RUN npm prune --omit=dev
+
 FROM quay.io/podman/stable:v5
 
 EXPOSE 5000
+EXPOSE 5001
+EXPOSE 9100
 
 ENV USERNAME="podman"
 ENV HOME_DIR="/home/$USERNAME"
@@ -80,11 +91,18 @@ COPY --chown=$USERNAME:$USERNAME pyproject.toml uv.lock README.md $APP_DIR/
 WORKDIR $APP_DIR
 RUN uv sync
 
+# Copy sidecar from build stage
+COPY --chown=$USERNAME:$USERNAME --from=sidecar-builder /sidecar/dist $APP_DIR/sidecar-helper/dist
+COPY --chown=$USERNAME:$USERNAME --from=sidecar-builder /sidecar/node_modules $APP_DIR/sidecar-helper/node_modules
+COPY --chown=$USERNAME:$USERNAME --from=sidecar-builder /sidecar/package.json $APP_DIR/sidecar-helper/package.json
+
 # Copy application code after dependency install
 COPY --chown=$USERNAME:$USERNAME entrypoint.py $APP_DIR/
+COPY --chown=$USERNAME:$USERNAME entrypoint.sh $APP_DIR/
+RUN chmod +x $APP_DIR/entrypoint.sh
 COPY --chown=$USERNAME:$USERNAME webhook_server $APP_DIR/webhook_server/
 COPY --chown=$USERNAME:$USERNAME scripts $APP_DIR/scripts/
 
-HEALTHCHECK CMD curl --fail http://127.0.0.1:5000/webhook_server/healthcheck || exit 1
+HEALTHCHECK CMD curl --fail http://127.0.0.1:5000/webhook_server/healthcheck && curl --fail http://127.0.0.1:${SIDECAR_PORT:-9100}/health || exit 1
 
-ENTRYPOINT ["tini", "--", "uv", "run", "entrypoint.py"]
+ENTRYPOINT ["tini", "--", "/bin/bash", "entrypoint.sh"]

entrypoint.py

@@ -9,6 +9,7 @@
 
 from webhook_server.libs.config import Config
 from webhook_server.utils.github_repository_and_webhook_settings import repository_and_webhook_settings
+from webhook_server.web.tool_server import TOOL_SERVER_PORT, start_tool_server
 
 _config = Config()
 _root_config = _config.root_data
@@ -64,4 +65,8 @@ def run_podman_cleanup() -> None:
     if not _dev_mode:
         uvicorn_kwargs["workers"] = int(_max_workers)
 
+    # Start tool server on separate event loop (avoids contention with CI checks)
+    start_tool_server()
+    print(f"\u2705 Tool server starting on 127.0.0.1:{TOOL_SERVER_PORT}")
+
     uvicorn.run("webhook_server.app:FASTAPI_APP", **uvicorn_kwargs)

entrypoint.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+set -euo pipefail
+
+# Start Pi SDK sidecar in background with lifecycle coupling
+if [ -f "$APP_DIR/sidecar-helper/dist/server.js" ]; then
+    export SIDECAR_PORT="${SIDECAR_PORT:-9100}"
+    export SIDECAR_ACPX_EXTENSION_PATH="$APP_DIR/sidecar-helper/node_modules/@myk-org/pi-sidecar/node_modules/pi-orchestrator-config/extensions/acpx-provider/index.ts"
+    node "$APP_DIR/sidecar-helper/dist/server.js" &
+    SIDECAR_PID=$!
+    echo "[sidecar] Started Pi SDK sidecar (PID $SIDECAR_PID) on port $SIDECAR_PORT"
+
+    # Kill sidecar when main process exits
+    trap 'kill $SIDECAR_PID 2>/dev/null; wait $SIDECAR_PID 2>/dev/null' EXIT
+
+    # Monitor sidecar — if it dies, kill the main process too
+    # TERM trap prevents misleading "died" message on normal shutdown
+    (trap 'exit 0' TERM; while kill -0 $SIDECAR_PID 2>/dev/null; do sleep 5; done; echo "[sidecar] Sidecar died, shutting down container"; kill 1 2>/dev/null) &
+
+    # Wait for sidecar to be ready (up to 15s)
+    for i in $(seq 1 30); do
+        if curl -sf http://127.0.0.1:$SIDECAR_PORT/health > /dev/null 2>&1; then
+            echo "[sidecar] Health check passed"
+            break
+        fi
+        sleep 0.5
+    done
+
+    if ! curl -sf http://127.0.0.1:$SIDECAR_PORT/health > /dev/null 2>&1; then
+        echo "[sidecar] ERROR: sidecar failed to become healthy within 15s — AI features will not work" >&2
+    fi
+else
+    echo "[sidecar] WARNING: sidecar-helper/dist/server.js not found, AI features will not be available"
+fi
+
+# Execute the main application
+exec uv run entrypoint.py

pyproject.toml

@@ -76,7 +76,8 @@ dependencies = [
   "pydantic>=2.8.0",
   "psutil>=7.0.0",
   "fastapi-mcp>=0.4.0",
-  "ai-cli-runner>=0.1.0",
+  "pi-sidecar-client>=1.1.0",
+  "aiohttp>=3.9.0",
 ]
 
 [[project.authors]]