feat: add /rebase command to cloudflare-docs-bot

[mvvmm]

Summary

Adds a /rebase slash command to the cloudflare-docs-bot (.flue/). The command is codeowner-only and posts status updates at the top of the bot's singleton comment throughout the operation.

/rebase — Rebases the PR branch against production. Stops with an explanation if:

• The PR targets a branch other than production
• The PR is from a fork (can't push)

On a clean rebase (no conflicts), posts a success status and triggers a /full-review automatically since the head SHA changed.

On conflict, attempts AI-assisted resolution:

• Identifies files changed on both sides since the merge base
• Fetches all three versions of each conflicting file (base, PR head, production head)
• Calls Workers AI (kimi-k2.7-code) with the file contents + PR intent to produce resolved versions and a confidence score
• High confidence: applies via Git Data API (blob → tree → commit → force-push), then triggers /full-review
• Medium/low confidence: stops and posts the reason why it couldn't resolve automatically

Other changes:

• postOrUpdateComment extracted from the two workflow files that duplicated it into lib/code-review-render.ts as a shared export
• renderRebaseStatusUpdate() added to the render lib — injects/replaces the rebase status block at the top of the bot comment, preserving existing review content below
• New FlueRebaseWorkflow Durable Object class added (wrangler.jsonc v9 migration)
• Commands table in the bot comment updated to list the new command

Images

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
*	@cloudflare/product-owners
*.ts	@cloudflare/content-engineering, @kodster28

[github-actions]

Nimbus Preview URL: https://nimbus-fea0f6b8.preview.developers.cloudflare.com
Nimbus Preview Branch URL: https://nimbus-feat-flue-rebase-commands.preview.developers.cloudflare.com

[github-actions]

Preview URL: https://fea0f6b8.preview.developers.cloudflare.com
Preview Branch URL: https://feat-flue-rebase-commands.preview.developers.cloudflare.com

[mvvmm]

/full-review

[cloudflare-docs-bot]

Review

✅ No outstanding issues in commit fea0f6b.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

_{No code review issues found.}

Conventions

_{No convention issues found.}

Style Guide Review

_{No style-guide issues found.}

---

Acknowledged by author (1)

Review	File	Issue	Note
Code	.flue/workflows/orchestrate.ts	Missing /rebaseWithConflicts command handler	The author says /rebaseWithConflicts was intentionally removed in this PR and the two-command split collapsed into a single /rebase command, so the current orchestrator behavior is correct.

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. Stops if there are conflicts and reports which files conflict.
/rebaseWithConflicts	Rebases against production and attempts to resolve conflicts automatically using AI. Stops with an explanation if confidence is not high enough.

[mvvmm]

/bonk please review

[ask-bonk]

Review triage

Finding	Verdict	Action
CR-792a12f1f2a0 — SHA length validation in	✅ Agree	Fixed

Fix applied

The tool was allowing abbreviated SHAs ( characters) even though the GitHub endpoint requires a full 40-character SHA. Updated:

• Regex changed to
• Parameter description updated to
• Comment and error message now explicitly state the full-SHA requirement

This prevents unnecessary HTTP 422 errors when the model passes a short SHA.

---

Overall PR assessment: LGTM. The rebase workflow is well-structured with clear guard rails (fork detection, wrong-base detection, file-size caps, production-head-race guards, completeness checks) and good failure transparency.

[ask-bonk]

Review triage

Finding	Verdict	Action
CR-792a12f1f2a0 — SHA length validation in .flue/lib/github-repo-tools.ts	Agree	Fixed

Fix applied

The get_commit_pr tool was allowing abbreviated SHAs (7–40 characters) even though the GitHub commits/{sha}/pulls endpoint requires a full 40-character SHA. Updated:

• Regex changed to /^[0-9a-f]{40}$/i
• Parameter description updated to: "The full 40-character git commit SHA to look up."
• Comment and error message now explicitly state the full-SHA requirement

This prevents unnecessary HTTP 422 errors when the model passes a short SHA.

---

Overall PR assessment: LGTM. The rebase workflow is well-structured with clear guard rails (fork detection, wrong-base detection, file-size caps, production-head-race guards, completeness checks) and good failure transparency.

[ask-bonk]

Done.

Triage:

Finding	Verdict	Action
CR-792a12f1f2a0 — SHA length validation in .flue/lib/github-repo-tools.ts	✅ Agree	Fixed

Fix applied to .flue/lib/github-repo-tools.ts:

• Regex tightened from /^[0-9a-f]{7,40}$/i → /^[0-9a-f]{40}$/i
• Parameter description updated to: "The full 40-character git commit SHA to look up."
• Comment and error message now explicitly state the full-SHA requirement

This prevents the tool from passing abbreviated SHAs to the GitHub commits/{sha}/pulls endpoint, which only accepts 40-character SHAs and would otherwise return HTTP 422.

I also left a review comment on PR #32121 with these details.

github run

[mvvmm]

/rebase

[mvvmm]

CR-0fc9cd37e19c — skipping.

The design is intentional. writePath in the skill inputs is informational context for the agent (so it understands where its output will end up), not an output field. The agent always returns path (the PR-side conflict candidate path), and applyResolution maps that to the correct write destination via conflictWritePathMap. The skill already documents this: "For rename conflicts the system will map this to the correct write destination." No code is mismatched; the two fields serve different purposes.

[mvvmm]

CR-18ed11a65d12 — skipping for now.

Per-file confidence is a legitimate improvement but requires changing the output schema, resolveConflictsWithAI, and applyResolution in a non-trivial way. All-or-nothing is conservative and safe for v1: a medium-confidence file taints the whole batch, which errs on the side of caution rather than silently applying partial resolutions. Worth revisiting if we see cases where one ambiguous file repeatedly blocks otherwise clean resolutions.

[mvvmm]

CR-8513f9f82eee — skipping.

/rebaseWithConflicts was intentionally removed in this PR. There is now a single /rebase command that always attempts AI-assisted conflict resolution — the two-command split was collapsed. The orchestrator, payload, and workflow all reflect this. The reviewer appears to be looking at a stale PR title; the description and code are already correct.