@neriros/ralphy 3.10.13 → 3.10.15

package/dist/shell/index.js

@@ -18928,8 +18928,8 @@ import { readFileSync } from "fs";
 import { resolve } from "path";
 function getVersion() {
   try {
-    if ("3.10.13")
-      return "3.10.13";
+    if ("3.10.15")
+      return "3.10.15";
   } catch {}
   const dirsToTry = [];
   try {
@@ -19421,7 +19421,7 @@ var init_fields = __esm(() => {
     spec: yes(),
     when: (answers) => typeof answers["repo.name"] === "string" && answers["repo.name"] !== ""
   };
-  LINEAR_FILTER_DESCRIPTION = "Global filter applied to every Linear ticket fetch, as an 'assignee = <value>' clause. " + "<value> is 'me' (issues assigned to you), 'any' (regardless of assignee), 'unassigned', " + "or a specific Linear user (email or user-id). Blank defaults to 'assignee = me'.";
+  LINEAR_FILTER_DESCRIPTION = "Global filter ANDed into every Linear ticket fetch: a marker list of 'assignee' and " + "'label' clauses (all required). assignee value is 'me' (assigned to you), 'any' " + "(regardless of assignee), 'unassigned', or a specific Linear user (email or user-id). " + "Add 'label' clauses to require the ticket carry those labels. Defaults to assignee = me.";
   LINEAR_ASSIGNEE_CHOICE = {
     id: LINEAR_ASSIGNEE_CHOICE_FIELD_ID,
     label: "Linear assignee filter",
@@ -19674,30 +19674,24 @@ var init_fields = __esm(() => {
       spec: yes()
     },
     {
-      id: "fixCiOnFailure",
-      label: "Let the agent fix CI failures?",
-      description: "After opening a PR, watch its CI (the automated checks GitHub runs) and let the agent push fixes when they fail.",
-      spec: no()
-    },
-    {
-      id: "maxCiFixAttempts",
-      label: "Max CI-fix attempts per task",
-      description: "Stop trying to fix failing CI after this many attempts.",
-      spec: { kind: "number", placeholder: "5" },
-      when: isOn("fixCiOnFailure")
+      id: "prRecovery.enabled",
+      label: "Enable PR recovery (conflicts + CI)?",
+      description: "After a worker opens a PR, keep watching it: advance the ticket to done once the PR is mergeable (CI green, no conflicts), and auto-recover red PRs by re-running the agent \u2014 resolving merge conflicts AND fixing failing CI checks. Turn off to mark the ticket done immediately on PR open and do no watching anywhere. (Fine-grained `fixCi` / `fixConflicts` toggles live in WORKFLOW.md, both on by default.)",
+      spec: yes()
     },
     {
-      id: "ciPollIntervalSeconds",
-      label: "CI status poll interval (seconds)",
-      description: "How often (in seconds) to re-check the PR's CI status while waiting on or fixing it.",
-      spec: { kind: "number", placeholder: "30" },
-      when: isOn("fixCiOnFailure")
+      id: "prRecovery.maxRecoverySessions",
+      label: "Max PR recovery sessions",
+      description: "Give up auto-recovering a red PR after this many recovery sessions, then flag it for a human.",
+      spec: { kind: "number", placeholder: "3" },
+      when: isOn("prRecovery.enabled")
     },
     {
-      id: "ignoreCiChecks",
+      id: "prRecovery.ignoreChecks",
       label: "CI checks to ignore",
       description: "Names of CI checks to ignore when deciding whether a PR is green \u2014 e.g. known-flaky jobs.",
-      spec: { kind: "list", placeholder: "check name" }
+      spec: { kind: "list", placeholder: "check name" },
+      when: isOn("prRecovery.enabled")
     },
     {
       id: "rules",
@@ -19831,26 +19825,6 @@ var init_fields = __esm(() => {
       spec: { kind: "text", placeholder: "ralph:pre-existing-error" },
       when: isOn("preExistingErrorCheck.enabled")
     },
-    {
-      id: "prTracker.enabled",
-      label: "Enable the PR tracker?",
-      description: "Keep watching the PRs Ralphy opened and automatically try to recover any whose merge state goes red (conflicts or failing CI).",
-      spec: yes()
-    },
-    {
-      id: "prTracker.maxRecoveryAttempts",
-      label: "PR tracker max recovery attempts",
-      description: "Give up auto-recovering a red PR after this many attempts, then flag it for a human.",
-      spec: { kind: "number", placeholder: "3" },
-      when: isOn("prTracker.enabled")
-    },
-    {
-      id: "prTracker.advanceMergedToDone",
-      label: "Advance merged PRs to done automatically?",
-      description: "Move an issue to its done state as soon as its PR is merged.",
-      spec: no(),
-      when: isOn("prTracker.enabled")
-    },
     {
       id: "metaPrompt.enabled",
       label: "Enable the meta-prompt addendum?",
@@ -81277,11 +81251,11 @@ function foldLegacyAssignee(v) {
   if (rest2["filter"] === undefined) {
     const raw = typeof assignee === "string" ? assignee.trim() : "";
     const value = raw === "" || raw.toLowerCase() === "unassigned" ? "unassigned" : raw;
-    rest2["filter"] = `assignee = ${value}`;
+    rest2["filter"] = [{ type: "assignee", value }];
   }
   return rest2;
 }
-var CURRENT_WORKFLOW_VERSION = 5, MarkerSchema, SET_INDICATOR_KEYS, GetIndicatorSchema, SetIndicatorSchema, IndicatorsSchema, ProjectSchema, CommandsSchema, DEFAULT_META_ONLY_FILES, BoundariesSchema, WorkflowConfigSchema;
+var CURRENT_WORKFLOW_VERSION = 6, MarkerSchema, FilterMarkerSchema, LinearFilterSchema, SET_INDICATOR_KEYS, GetIndicatorSchema, SetIndicatorSchema, IndicatorsSchema, ProjectSchema, CommandsSchema, DEFAULT_META_ONLY_FILES, BoundariesSchema, WorkflowConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   MarkerSchema = exports_external.discriminatedUnion("type", [
@@ -81295,6 +81269,19 @@ var init_schema = __esm(() => {
     exports_external.object({ type: exports_external.literal("project"), value: exports_external.string().min(1) }).strict(),
     exports_external.object({ type: exports_external.literal("comment"), value: exports_external.string().min(1) }).strict()
   ]);
+  FilterMarkerSchema = exports_external.discriminatedUnion("type", [
+    exports_external.object({ type: exports_external.literal("label"), value: exports_external.string().min(1) }).strict(),
+    exports_external.object({ type: exports_external.literal("assignee"), value: exports_external.string().min(1) }).strict()
+  ]);
+  LinearFilterSchema = exports_external.array(FilterMarkerSchema).superRefine((markers, ctx) => {
+    const assigneeCount = markers.filter((m) => m.type === "assignee").length;
+    if (assigneeCount > 1) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: `linear.filter allows at most one "assignee" clause, found ${assigneeCount}.`
+      });
+    }
+  }).default([{ type: "assignee", value: "me" }]);
   SET_INDICATOR_KEYS = [
     "setInProgress",
     "setDone",
@@ -81412,15 +81399,11 @@ var init_schema = __esm(() => {
     autoMergeStrategy: exports_external.enum(["squash", "merge", "rebase"]).default("squash"),
     manualMergeWhenAutoMergeDisabled: exports_external.boolean().default(true),
     finalizeNoOpAsDone: exports_external.boolean().default(true),
-    fixCiOnFailure: exports_external.boolean().default(false),
-    maxCiFixAttempts: exports_external.number().int().positive().default(5),
-    ciPollIntervalSeconds: exports_external.number().int().positive().default(30),
-    ignoreCiChecks: exports_external.array(exports_external.string()).default([]),
     engine: exports_external.enum(["claude", "codex"]).default("claude"),
     model: exports_external.enum(["haiku", "sonnet", "opus"]).default("opus"),
     linear: exports_external.preprocess(foldLegacyAssignee, exports_external.object({
       team: exports_external.string().optional(),
-      filter: exports_external.string().default("assignee = me"),
+      filter: LinearFilterSchema,
       postComments: exports_external.boolean().default(true),
       updateEveryIterations: exports_external.number().int().nonnegative().default(10),
       mentionTrigger: exports_external.boolean().default(true),
@@ -81442,7 +81425,7 @@ var init_schema = __esm(() => {
       }),
       indicators: IndicatorsSchema.default({})
     }).strict()).default({
-      filter: "assignee = me",
+      filter: [{ type: "assignee", value: "me" }],
       postComments: true,
       updateEveryIterations: 10,
       mentionTrigger: true,
@@ -81476,11 +81459,6 @@ var init_schema = __esm(() => {
       cleanup_on_success: exports_external.boolean().optional(),
       setup_script: exports_external.string().optional()
     }).strict().optional(),
-    ci: exports_external.object({
-      fix_on_failure: exports_external.boolean().optional(),
-      max_attempts: exports_external.number().int().positive().optional(),
-      poll_interval_seconds: exports_external.number().int().positive().optional()
-    }).strict().optional(),
     preExistingErrorCheck: exports_external.object({
       enabled: exports_external.boolean().default(false),
       commands: exports_external.array(exports_external.string()).default([]),
@@ -81494,14 +81472,18 @@ var init_schema = __esm(() => {
       label: "ralph:pre-existing-error",
       outputCharLimit: 4000
     }),
-    prTracker: exports_external.object({
+    prRecovery: exports_external.object({
       enabled: exports_external.boolean().default(true),
-      maxRecoveryAttempts: exports_external.number().int().positive().default(3),
-      advanceMergedToDone: exports_external.boolean().default(false)
+      fixCi: exports_external.boolean().default(true),
+      fixConflicts: exports_external.boolean().default(true),
+      maxRecoverySessions: exports_external.number().int().positive().default(3),
+      ignoreChecks: exports_external.array(exports_external.string()).default([])
     }).strict().default({
       enabled: true,
-      maxRecoveryAttempts: 3,
-      advanceMergedToDone: false
+      fixCi: true,
+      fixConflicts: true,
+      maxRecoverySessions: 3,
+      ignoreChecks: []
     }),
     metaPrompt: exports_external.object({
       enabled: exports_external.boolean().default(true),
@@ -81532,7 +81514,7 @@ var init_schema = __esm(() => {
 var FRONTMATTER_RE, DEFAULT_WORKFLOW_MD = `---
 # WORKFLOW.md schema version \u2014 managed by \`ralphy init\`. When a newer version
 # ships, re-running init migrates this file and fills in the new settings.
-version: 2
+version: 6
 
 project:
   name: ralphy
@@ -81585,9 +81567,12 @@ prBaseBranch: main
 stackPrsOnDependencies: false
 autoMergeStrategy: squash
 
-fixCiOnFailure: false
-maxCiFixAttempts: 5
-ciPollIntervalSeconds: 30
+prRecovery:
+  enabled: true
+  fixCi: true
+  fixConflicts: true
+  maxRecoverySessions: 3
+  ignoreChecks: []
 
 preExistingErrorCheck:
   enabled: false
@@ -81597,7 +81582,18 @@ preExistingErrorCheck:
   outputCharLimit: 4000
 
 linear:
-  filter: assignee = me
+  # Global filter ANDed into every Linear query (and the GitHub PR searches
+  # rooted at those issues). A marker list of \`assignee\` and \`label\` clauses;
+  # all are required. \`assignee\` value is me / any / unassigned / <email> / <id>.
+  # Example with a required label:
+  #   filter:
+  #     - type: assignee
+  #       value: me
+  #     - type: label
+  #       value: ralph
+  filter:
+    - type: assignee
+      value: me
   postComments: true
   updateEveryIterations: 10
   mentionTrigger: true
@@ -81858,7 +81854,8 @@ function withPresets(answers) {
   const values2 = { ...answers.values };
   if (answers.mode === "permissive") {
     values2["createPrOnSuccess"] = true;
-    values2["fixCiOnFailure"] = true;
+    values2["prRecovery.enabled"] = true;
+    values2["prRecovery.fixCi"] = true;
     values2["manualMergeWhenAutoMergeDisabled"] = false;
   }
   return values2;
@@ -82010,6 +82007,88 @@ var init_normalize = __esm(() => {
   };
 });
 
+// packages/workflow/src/migrate/pr-recovery.ts
+function hasLegacyPrRecoveryKey(document2) {
+  if (!import_yaml3.default.isMap(document2.contents))
+    return false;
+  return LEGACY_TOP_LEVEL_KEYS.some((key) => document2.hasIn([key]));
+}
+function hasLegacyLinearFilter(document2) {
+  if (!import_yaml3.default.isMap(document2.contents))
+    return false;
+  if (!document2.hasIn(["linear", "filter"]))
+    return false;
+  return import_yaml3.default.isScalar(document2.getIn(["linear", "filter"], true));
+}
+function scalarFilterToMarkers(raw) {
+  const text = typeof raw === "string" ? raw.trim() : "";
+  let value = "me";
+  if (text !== "") {
+    const equals = text.indexOf("=");
+    const key = equals >= 0 ? text.slice(0, equals).trim().toLowerCase() : "assignee";
+    const candidate = equals >= 0 ? text.slice(equals + 1).trim() : text;
+    if (key === "assignee" && candidate !== "")
+      value = candidate;
+  }
+  const lower = value.toLowerCase();
+  if (lower === "unassigned" || lower === "any" || lower === "me")
+    value = lower;
+  return [{ type: "assignee", value }];
+}
+function migrateWorkflowMarkdown(markdown) {
+  const match = FRONTMATTER_RE.exec(markdown);
+  if (!match)
+    return { markdown, changed: false };
+  const document2 = import_yaml3.default.parseDocument(match[1] ?? "");
+  if (!import_yaml3.default.isMap(document2.contents))
+    return { markdown, changed: false };
+  const prRecoveryLegacy = hasLegacyPrRecoveryKey(document2);
+  const linearFilterLegacy = hasLegacyLinearFilter(document2);
+  if (!prRecoveryLegacy && !linearFilterLegacy)
+    return { markdown, changed: false };
+  const body = match[2] ?? "";
+  if (prRecoveryLegacy) {
+    if (!document2.hasIn(["prRecovery"])) {
+      const trackerEnabled = document2.getIn(["prTracker", "enabled"]);
+      const enabled2 = trackerEnabled !== false;
+      const maxRecovery = document2.getIn(["prTracker", "maxRecoveryAttempts"]);
+      const ignoreChecks = document2.getIn(["ignoreCiChecks"]);
+      document2.setIn(["prRecovery", "enabled"], enabled2);
+      document2.setIn(["prRecovery", "fixCi"], enabled2);
+      document2.setIn(["prRecovery", "fixConflicts"], enabled2);
+      document2.setIn(["prRecovery", "maxRecoverySessions"], typeof maxRecovery === "number" ? maxRecovery : 3);
+      document2.setIn(["prRecovery", "ignoreChecks"], import_yaml3.default.isSeq(ignoreChecks) ? ignoreChecks : []);
+    }
+    for (const key of LEGACY_TOP_LEVEL_KEYS)
+      document2.deleteIn([key]);
+  }
+  if (linearFilterLegacy) {
+    const markers = scalarFilterToMarkers(document2.getIn(["linear", "filter"]));
+    document2.setIn(["linear", "filter"], document2.createNode(markers, { flow: false }));
+    document2.deleteIn(["linear", "assignee"]);
+  }
+  document2.setIn(["version"], CURRENT_WORKFLOW_VERSION);
+  const frontmatter = document2.toString({ flowCollectionPadding: false }).replace(/\n+$/, "");
+  return { markdown: `---
+${frontmatter}
+---
+${body}`, changed: true };
+}
+var import_yaml3, LEGACY_TOP_LEVEL_KEYS;
+var init_pr_recovery = __esm(() => {
+  init_default();
+  init_schema();
+  import_yaml3 = __toESM(require_dist(), 1);
+  LEGACY_TOP_LEVEL_KEYS = [
+    "prTracker",
+    "fixCiOnFailure",
+    "maxCiFixAttempts",
+    "ciPollIntervalSeconds",
+    "ignoreCiChecks",
+    "ci"
+  ];
+});
+
 // packages/workflow/src/confirmation.ts
 function matchesIndicator(indicator, ticket) {
   if (!indicator || indicator.filter.length === 0)
@@ -82081,48 +82160,64 @@ function describeApprovalMarker(indicator) {
 }
 
 // packages/workflow/src/linear-filter.ts
-function parseLinearFilter(filter2) {
-  const trimmed = filter2.trim();
-  if (trimmed === "")
-    return { assignee: "me" };
-  const eq = trimmed.indexOf("=");
-  if (eq < 0) {
-    throw new Error(`Invalid linear.filter "${filter2}": expected "<key> = <value>" (e.g. "assignee = me").`);
-  }
-  const key = trimmed.slice(0, eq).trim().toLowerCase();
-  const value = trimmed.slice(eq + 1).trim();
-  if (!SUPPORTED_KEYS.has(key)) {
-    throw new Error(`Unrecognized linear.filter key "${key}" in "${filter2}". Supported keys: ${[...SUPPORTED_KEYS].join(", ")}.`);
+function resolveLinearFilter(filter2) {
+  const assigneeClauses = filter2.filter((marker) => marker.type === "assignee");
+  if (assigneeClauses.length > 1) {
+    throw new Error(`Invalid linear.filter: at most one "assignee" clause is allowed, found ${assigneeClauses.length}.`);
+  }
+  const requireAllLabels = [];
+  const seenLabels = new Set;
+  for (const marker of filter2) {
+    if (marker.type !== "label")
+      continue;
+    if (seenLabels.has(marker.value))
+      continue;
+    seenLabels.add(marker.value);
+    requireAllLabels.push(marker.value);
   }
+  const assigneeClause = assigneeClauses[0];
+  if (!assigneeClause)
+    return { requireAllLabels };
+  const value = assigneeClause.value.trim();
   const lower = value.toLowerCase();
   if (lower === "any")
-    return { anyAssignee: true };
-  if (lower === "" || lower === "unassigned")
-    return { assignee: "unassigned" };
+    return { anyAssignee: true, requireAllLabels };
+  if (lower === "" || lower === "unassigned") {
+    return { assignee: "unassigned", requireAllLabels };
+  }
   if (lower === "me")
-    return { assignee: "me" };
-  return { assignee: value };
+    return { assignee: "me", requireAllLabels };
+  return { assignee: value, requireAllLabels };
+}
+function applyAssigneeOverride(filter2, assignee) {
+  const trimmed = assignee.trim();
+  if (trimmed === "")
+    return filter2;
+  return [
+    ...filter2.filter((marker) => marker.type !== "assignee"),
+    { type: "assignee", value: trimmed }
+  ];
 }
-var SUPPORTED_KEYS;
-var init_linear_filter = __esm(() => {
-  SUPPORTED_KEYS = new Set(["assignee"]);
-});
 
 // packages/workflow/src/workflow.ts
 var exports_workflow = {};
 __export(exports_workflow, {
   workflowPath: () => workflowPath,
+  workflowNeedsUpgrade: () => workflowNeedsUpgrade,
+  resolveLinearFilter: () => resolveLinearFilter,
   resolveBaselineCommands: () => resolveBaselineCommands,
   renderWorkflowPrompt: () => renderWorkflowPrompt,
   renderTemplate: () => renderTemplate,
+  readWorkflowVersion: () => readWorkflowVersion,
   parseWorkflow: () => parseWorkflow,
-  parseLinearFilter: () => parseLinearFilter,
   normalizeWorkflowMarkdown: () => normalizeWorkflowMarkdown,
+  migrateWorkflowMarkdown: () => migrateWorkflowMarkdown,
   matchesIndicator: () => matchesIndicator,
   loadWorkflow: () => loadWorkflow,
   ensureWorkflow: () => ensureWorkflow,
   describeApprovalMarker: () => describeApprovalMarker,
   computeConfirmationFlags: () => computeConfirmationFlags,
+  applyAssigneeOverride: () => applyAssigneeOverride,
   WorkflowConfigSchema: () => WorkflowConfigSchema,
   WORKFLOW_FILE: () => WORKFLOW_FILE,
   FRONTMATTER_RE: () => FRONTMATTER_RE,
@@ -82141,7 +82236,7 @@ function parseWorkflow(text, path = "") {
   const body = m[2] ?? "";
   let raw;
   try {
-    raw = import_yaml3.default.parse(yamlText, { schema: "core" });
+    raw = import_yaml4.default.parse(yamlText, { schema: "core" });
   } catch (err) {
     throw new Error(`WORKFLOW.md frontmatter is not valid YAML.
 ` + (path ? `  File: ${path}
@@ -82219,14 +82314,32 @@ function applyAliases(cfg) {
       cfg.setupScript = cfg.worktree.setup_script;
     }
   }
-  if (cfg.ci) {
-    if (cfg.ci.fix_on_failure !== undefined)
-      cfg.fixCiOnFailure = cfg.ci.fix_on_failure;
-    if (cfg.ci.max_attempts !== undefined)
-      cfg.maxCiFixAttempts = cfg.ci.max_attempts;
-    if (cfg.ci.poll_interval_seconds !== undefined) {
-      cfg.ciPollIntervalSeconds = cfg.ci.poll_interval_seconds;
-    }
+}
+function readWorkflowVersion(text) {
+  const match = FRONTMATTER_RE.exec(text);
+  if (!match)
+    return 0;
+  try {
+    const raw = import_yaml4.default.parse(match[1] ?? "", { schema: "core" });
+    return typeof raw?.version === "number" ? raw.version : 0;
+  } catch {
+    return 0;
+  }
+}
+function workflowNeedsUpgrade(text) {
+  let migrated;
+  try {
+    migrated = migrateWorkflowMarkdown(text);
+  } catch {
+    return true;
+  }
+  if (migrated.changed)
+    return true;
+  try {
+    parseWorkflow(normalizeWorkflowMarkdown(migrated.markdown).markdown);
+    return false;
+  } catch {
+    return true;
   }
 }
 function workflowPath(projectRoot, workflowFile) {
@@ -82240,9 +82353,11 @@ async function loadWorkflow(projectRoot, workflowFile, options = {}) {
     return { config: config2, body: extractDefaultBody(), path };
   }
   const text = await file2.text();
-  const normalized = normalizeWorkflowMarkdown(text);
-  if (normalized.changed && options.persist)
+  const migrated = migrateWorkflowMarkdown(text);
+  const normalized = normalizeWorkflowMarkdown(migrated.markdown);
+  if ((migrated.changed || normalized.changed) && options.persist) {
     await Bun.write(path, normalized.markdown);
+  }
   return parseWorkflow(normalized.markdown, path);
 }
 async function ensureWorkflow(projectRoot, workflowFile) {
@@ -82278,17 +82393,18 @@ function renderWorkflowPrompt(workflow, ctx) {
   };
   return renderTemplate(workflow.body, fullCtx);
 }
-var import_yaml3, WORKFLOW_FILE = "WORKFLOW.md";
+var import_yaml4, WORKFLOW_FILE = "WORKFLOW.md";
 var init_workflow = __esm(() => {
   init_schema();
   init_default();
   init_wizard();
   init_normalize();
+  init_pr_recovery();
   init_schema();
   init_default();
-  init_linear_filter();
   init_normalize();
-  import_yaml3 = __toESM(require_dist(), 1);
+  init_pr_recovery();
+  import_yaml4 = __toESM(require_dist(), 1);
 });
 
 // packages/core/src/repo/index.ts
@@ -83252,8 +83368,11 @@ function buildFromAnswers(mode, answers, build = buildWorkflowMarkdown) {
     } else {
       assignee = assigneeChoice;
     }
+    const existing = Array.isArray(values2["linear.filter"]) ? values2["linear.filter"] : [];
     if (assignee)
-      values2["linear.filter"] = `assignee = ${assignee}`;
+      values2["linear.filter"] = applyAssigneeOverride(existing, assignee);
+    else if (existing.length > 0)
+      values2["linear.filter"] = existing;
   }
   delete values2[LINEAR_ASSIGNEE_CHOICE_FIELD_ID];
   delete values2[LINEAR_ASSIGNEE_VALUE_FIELD_ID];
@@ -83341,8 +83460,8 @@ function computeEditing(field, stored, multilineFallback = "") {
   return {
     draft: textLike && stored !== undefined ? String(stored) : field.spec.kind === "multiline" ? typeof stored === "string" ? stored : multilineFallback : "",
     optionIndex: initialOptionIndex(field, stored),
-    listItems: field.spec.kind === "list" && Array.isArray(stored) ? [...stored] : [],
-    selected: field.spec.kind === "multiselect" && Array.isArray(stored) ? new Set(stored) : new Set
+    listItems: field.spec.kind === "list" && Array.isArray(stored) ? stored.filter((item) => typeof item === "string") : [],
+    selected: field.spec.kind === "multiselect" && Array.isArray(stored) ? new Set(stored.filter((item) => typeof item === "string")) : new Set
   };
 }
 function initialOptionIndex(field, stored) {
@@ -83471,6 +83590,12 @@ function SetupWizard({
     setVisited((prev) => new Set(prev).add(nextFields[index + 1].id));
     goTo(index + 1, source);
   };
+  import_react22.useEffect(() => {
+    if (mode !== null && !building && fields.length === 0) {
+      onComplete(buildFromAnswers(mode, valuesToWrite(answers), buildMarkdown));
+      exit();
+    }
+  }, [mode, building, fields.length]);
   use_input_default((input, key) => {
     if (key.escape) {
       onCancel?.();
@@ -84297,6 +84422,7 @@ var import_react22, jsx_dev_runtime, REPO_ANSWER_IDS, MODE_OPTIONS, INDICATOR_OP
 var init_SetupWizard = __esm(async () => {
   init_version();
   init_wizard();
+  init_workflow();
   init_fields();
   await init_build2();
   import_react22 = __toESM(require_react(), 1);
@@ -84429,9 +84555,6 @@ var init_migrations = __esm(() => {
         "preExistingErrorCheck.commands",
         "preExistingErrorCheck.baseBranch",
         "preExistingErrorCheck.label",
-        "prTracker.enabled",
-        "prTracker.maxRecoveryAttempts",
-        "prTracker.advanceMergedToDone",
         "openspec.reviewPhase.enabled",
         "openspec.reviewPhase.maxRounds",
         "openspec.reviewPhase.reviewerModel",
@@ -84457,6 +84580,11 @@ var init_migrations = __esm(() => {
       version: 5,
       description: "A new `linear.specAttachmentRevisions` setting controls the sealed " + "design attachment: 'replace' (default) overwrites the single canonical " + "attachment in place; 'append' publishes each change as a new " + "'Ralph design #N' attachment. Config-file-only \u2014 set it in WORKFLOW.md " + "if you want the append audit trail.",
       fields: []
+    },
+    {
+      version: 6,
+      description: "PR recovery is unified under one `prRecovery` block (replacing " + "`prTracker`, `fixCiOnFailure`, `maxCiFixAttempts`, `ciPollIntervalSeconds`, " + "and `ignoreCiChecks`). Workers now open the PR and leave the ticket " + "in-review; a single background watcher advances it to done once the PR is " + "mergeable (CI green, no conflicts) and recovers red PRs \u2014 resolving merge " + "conflicts AND fixing failing CI (both `prRecovery.fixConflicts` and " + "`prRecovery.fixCi` default on; tune them in WORKFLOW.md). " + "`prRecovery.enabled: false` turns the watcher off everywhere and marks the " + "ticket done immediately on PR open. Your old values are migrated " + "automatically; review them here or keep them.",
+      fields: ["prRecovery.enabled", "prRecovery.maxRecoverySessions", "prRecovery.ignoreChecks"]
     }
   ];
   LATEST_MIGRATION_VERSION = MIGRATIONS.reduce((max2, migration) => Math.max(max2, migration.version), 0);
@@ -84588,7 +84716,7 @@ var init_project_detect = __esm(() => {
 // apps/init/src/index.ts
 var exports_src = {};
 __export(exports_src, {
-  runSetupWizard: () => runSetupWizard,
+  maybeUpgradeWorkflow: () => maybeUpgradeWorkflow,
   maybeRunSetupWizard: () => maybeRunSetupWizard,
   main: () => main
 });
@@ -84681,6 +84809,22 @@ async function maybeRunSetupWizard(projectRoot, workflowFile) {
     ...Object.keys(detected).length > 0 ? { initialValues: detected } : {}
   });
 }
+async function maybeUpgradeWorkflow(projectRoot, workflowFile) {
+  const root = projectRoot ?? await findProjectRoot();
+  const path = workflowPath(root, workflowFile);
+  const file2 = Bun.file(path);
+  if (!await file2.exists())
+    return false;
+  if (!process.stdin.isTTY || !process.stdout.isTTY)
+    return false;
+  if (!workflowNeedsUpgrade(await file2.text()))
+    return false;
+  process.stdout.write(`WORKFLOW.md needs an upgrade. Starting init\u2026
+`);
+  const initArgv = ["--project-root", root, ...workflowFile ? ["--workflow", workflowFile] : []];
+  await main(initArgv);
+  return true;
+}
 function initialValuesFromConfig(config2) {
   const values2 = {};
   if (config2.project.name)
@@ -84702,13 +84846,16 @@ function initialValuesFromConfig(config2) {
   values2["concurrency"] = config2.concurrency;
   values2["createPrOnSuccess"] = config2.createPrOnSuccess;
   values2["prBaseBranch"] = config2.prBaseBranch;
-  values2["fixCiOnFailure"] = config2.fixCiOnFailure;
+  values2["prRecovery.enabled"] = config2.prRecovery.enabled;
+  values2["prRecovery.fixCi"] = config2.prRecovery.fixCi;
+  values2["prRecovery.maxRecoverySessions"] = config2.prRecovery.maxRecoverySessions;
   values2["useWorktree"] = config2.useWorktree;
   if (config2.linear.team)
     values2["linear.team"] = config2.linear.team;
-  if (config2.linear.filter) {
-    const match = /^assignee\s*=\s*(.+)$/i.exec(config2.linear.filter.trim());
-    const assignee = match ? match[1].trim() : "";
+  if (config2.linear.filter && config2.linear.filter.length > 0) {
+    values2["linear.filter"] = config2.linear.filter;
+    const assigneeMarker = config2.linear.filter.find((marker) => marker.type === "assignee");
+    const assignee = assigneeMarker?.value.trim() ?? "";
     if (assignee === "me" || assignee === "any" || assignee === "unassigned") {
       values2["linear.assigneeChoice"] = assignee;
     } else if (assignee !== "") {
@@ -84766,7 +84913,7 @@ async function promptMigrate(fromVersion) {
   return choice;
 }
 async function editExisting(projectRoot, path, config2, workflowFile, onlyFields) {
-  const existing = await Bun.file(path).text();
+  const { markdown: existing } = migrateWorkflowMarkdown(await Bun.file(path).text());
   const detectedRepo = await detectRepoIdentity(projectRoot);
   const detected = await detectInitialValues(projectRoot);
   const wrote = await runSetupWizard(projectRoot, {
@@ -84823,14 +84970,15 @@ Setup cancelled \u2014 no file written.
 `);
       return 0;
     }
-    if (needsMigration(config2.version)) {
-      const choice2 = await promptMigrate(config2.version);
+    const diskVersion = readWorkflowVersion(await Bun.file(path).text());
+    if (needsMigration(diskVersion)) {
+      const choice2 = await promptMigrate(diskVersion);
       if (choice2 === "exit") {
         process.stdout.write(`Exited \u2014 WORKFLOW.md unchanged.
 `);
         return 0;
       }
-      const onlyFields = choice2 === "diff" ? fieldsAddedSince(config2.version) : undefined;
+      const onlyFields = choice2 === "diff" ? fieldsAddedSince(diskVersion) : undefined;
       return editExisting(projectRoot, path, config2, workflowFile, onlyFields);
     }
     const choice = await promptEditOrExit();
@@ -98288,7 +98436,14 @@ function scrubClaudeEnv(env3 = process.env) {
   }
   return copy;
 }
-var CLAUDE_ENV_KEYS_TO_SCRUB;
+function scrubGithubAppTokenEnv(env3 = process.env) {
+  const copy = { ...env3 };
+  for (const key of GITHUB_APP_TOKEN_KEYS) {
+    delete copy[key];
+  }
+  return copy;
+}
+var CLAUDE_ENV_KEYS_TO_SCRUB, GITHUB_APP_TOKEN_KEYS;
 var init_env = __esm(() => {
   CLAUDE_ENV_KEYS_TO_SCRUB = [
     "CLAUDECODE",
@@ -98297,6 +98452,7 @@ var init_env = __esm(() => {
     "CLAUDE_CODE_ENTRYPOINT",
     "AI_AGENT"
   ];
+  GITHUB_APP_TOKEN_KEYS = ["GITHUB_TOKEN"];
 });
 
 // packages/engine/src/preflight/gh.ts
@@ -98304,6 +98460,7 @@ async function checkGhAuth() {
   try {
     const proc = spawn({
       cmd: ["gh", "auth", "status"],
+      env: scrubGithubAppTokenEnv(),
       stdout: "ignore",
       stderr: "ignore"
     });
@@ -98319,6 +98476,7 @@ async function checkGhAuth() {
 var GH_AUTH_FAIL_MESSAGE = "gh is not authenticated. Run `gh auth login` (or set GH_TOKEN), then restart the agent.";
 var init_gh = __esm(() => {
   init_spawn();
+  init_env();
 });
 
 // packages/engine/src/preflight/claude.ts
@@ -98348,19 +98506,69 @@ var init_claude = __esm(() => {
   NOT_LOGGED_IN_RE = /Not logged in|Please run \/login/;
 });
 
+// packages/engine/src/preflight/repo.ts
+async function checkRepoWriteAccess(cwd2) {
+  let blob = "";
+  try {
+    const proc = spawn({
+      cmd: [
+        "gh",
+        "api",
+        "-X",
+        "POST",
+        "repos/{owner}/{repo}/git/refs",
+        "-f",
+        `ref=${PROBE_REF}`,
+        "-f",
+        `sha=${ZERO_SHA}`
+      ],
+      cwd: cwd2,
+      env: scrubGithubAppTokenEnv(),
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = await new Response(proc.stdout).text();
+    const stderr = await new Response(proc.stderr).text();
+    await proc.exited;
+    blob = `${stdout}
+${stderr}`;
+  } catch {
+    return { ok: true };
+  }
+  if (HAS_WRITE_RE.test(blob))
+    return { ok: true };
+  if (NO_WRITE_RE.test(blob))
+    return { ok: false, tool: "repo", message: REPO_WRITE_FAIL_MESSAGE };
+  return { ok: true };
+}
+var REPO_WRITE_FAIL_MESSAGE, PROBE_REF = "refs/heads/ralphy-preflight-write-probe", ZERO_SHA = "0000000000000000000000000000000000000000", HAS_WRITE_RE, NO_WRITE_RE;
+var init_repo2 = __esm(() => {
+  init_spawn();
+  init_env();
+  REPO_WRITE_FAIL_MESSAGE = "No write access to this repository \u2014 the active credential can read it but cannot " + "push, so every issue would fail at PR creation (and be re-queued). Ralphy uses gh's " + "auth for all GitHub operations: grant push access to `GH_TOKEN` (or `gh auth login`), " + "or, if you rely on a fine-grained PAT, give it Contents: write + Pull requests: write " + "+ Commit statuses: read. Then restart the agent.";
+  HAS_WRITE_RE = /"status":\s*"422"|Object does not exist|Unprocessable/i;
+  NO_WRITE_RE = /"status":\s*"403"|not accessible by personal access token|Write access to repository not granted/i;
+});
+
 // packages/engine/src/preflight/run.ts
-async function runPreflight() {
+async function runPreflight(opts = {}) {
   const gh = await checkGhAuth();
   if (!gh.ok)
     return gh;
   const claude = await checkClaudeAuth();
   if (!claude.ok)
     return claude;
+  if (opts.requireRepoWrite && opts.repoCwd) {
+    const repo = await checkRepoWriteAccess(opts.repoCwd);
+    if (!repo.ok)
+      return repo;
+  }
   return { ok: true };
 }
 var init_run = __esm(() => {
   init_gh();
   init_claude();
+  init_repo2();
 });
 
 // packages/engine/src/preflight/index.ts
@@ -98368,6 +98576,7 @@ var init_preflight = __esm(() => {
   init_env();
   init_gh();
   init_claude();
+  init_repo2();
   init_run();
 });
 
@@ -99485,6 +99694,7 @@ var init_flow_machine = __esm(() => {
           AWAITING_DETECTED: "awaiting",
           CONFLICT_DETECTED: "conflict-fix",
           CI_FAILED_DETECTED: "ci-fix",
+          PR_OPENED: "awaiting-ci",
           WORKER_SUCCEEDED: "done",
           WORKER_FAILED: "error",
           PREEMPT: {
@@ -99504,7 +99714,7 @@ var init_flow_machine = __esm(() => {
       },
       "conflict-fix": {
         on: {
-          WORKER_SUCCEEDED: "working",
+          WORKER_SUCCEEDED: "awaiting-ci",
           WORKER_FAILED: "error",
           PREEMPT: {
             target: "preempting",
@@ -99523,7 +99733,7 @@ var init_flow_machine = __esm(() => {
       },
       "ci-fix": {
         on: {
-          WORKER_SUCCEEDED: "working",
+          WORKER_SUCCEEDED: "awaiting-ci",
           WORKER_FAILED: "error",
           PREEMPT: {
             target: "preempting",
@@ -99551,9 +99761,31 @@ var init_flow_machine = __esm(() => {
           }
         }
       },
+      "awaiting-ci": {
+        on: {
+          PR_PASSED: "done",
+          CONFLICT_DETECTED: "conflict-fix",
+          CI_FAILED_DETECTED: "ci-fix",
+          REVIEW_TRIGGERED: "review",
+          PREEMPT: {
+            target: "preempting",
+            actions: import_xstate_development_cjs.assign({
+              pendingAssignment: ({ event }) => event.newAssignment
+            })
+          },
+          WORKER_SPAWNED: {
+            actions: import_xstate_development_cjs.assign(({ event }) => ({
+              worker: event.worker,
+              teardown: event.teardown ?? undefined,
+              currentAssignment: event.assignment
+            }))
+          }
+        }
+      },
       review: {
         on: {
           WORKER_SUCCEEDED: "done",
+          PR_OPENED: "awaiting-ci",
           WORKER_FAILED: "error",
           WORKER_SPAWNED: {
             actions: import_xstate_development_cjs.assign(({ event }) => ({
@@ -99599,7 +99831,11 @@ var init_flow_machine = __esm(() => {
             target: "ci-fix"
           },
           {
-            guard: ({ context }) => context.pendingAssignment?.flowId === "awaiting-ci" || context.pendingAssignment?.flowId === "confirmation",
+            guard: ({ context }) => context.pendingAssignment?.flowId === "awaiting-ci",
+            target: "awaiting-ci"
+          },
+          {
+            guard: ({ context }) => context.pendingAssignment?.flowId === "confirmation",
             target: "awaiting"
           },
           {
@@ -101030,6 +101266,36 @@ var init_useLoop = __esm(() => {
   import_react57 = __toESM(require_react(), 1);
 });
 
+// packages/ui-shared/src/useHoldToClose.ts
+function useHoldToClose({ finished, hold, onClose }) {
+  const { exit } = use_app_default();
+  const { isRawModeSupported } = use_stdin_default();
+  const [awaitingClose, setAwaitingClose] = import_react58.useState(false);
+  const close = () => {
+    onClose?.();
+    exit();
+  };
+  import_react58.useEffect(() => {
+    if (!finished)
+      return;
+    if (hold && isRawModeSupported) {
+      setAwaitingClose(true);
+      return;
+    }
+    close();
+  }, [finished, hold, isRawModeSupported]);
+  use_input_default((_input, key) => {
+    if (key.return)
+      close();
+  }, { isActive: awaitingClose });
+  return { awaitingClose };
+}
+var import_react58;
+var init_useHoldToClose = __esm(async () => {
+  await init_build2();
+  import_react58 = __toESM(require_react(), 1);
+});
+
 // apps/loop/src/components/TaskLoop.tsx
 function LogLine({ entry, verbose }) {
   switch (entry.kind) {
@@ -101081,10 +101347,10 @@ function handleSteerKeyInput(key, history, currentIndex) {
   return navigateHistory(history, currentIndex, dir);
 }
 function SteerInput({ onSubmit }) {
-  const [inputKey, setInputKey] = import_react58.useState(0);
-  const [defaultValue, setDefaultValue] = import_react58.useState("");
-  const historyRef = import_react58.useRef([]);
-  const historyIndexRef = import_react58.useRef(-1);
+  const [inputKey, setInputKey] = import_react59.useState(0);
+  const [defaultValue, setDefaultValue] = import_react59.useState("");
+  const historyRef = import_react59.useRef([]);
+  const historyIndexRef = import_react59.useRef(-1);
   use_input_default((_input, key) => {
     const result2 = handleSteerKeyInput(key, historyRef.current, historyIndexRef.current);
     if (result2) {
@@ -101113,21 +101379,19 @@ function SteerInput({ onSubmit }) {
   }, undefined, true, undefined, this);
 }
 function TaskLoop({ opts }) {
-  const { exit } = use_app_default();
   const loop = useLoop(opts);
   const { isRawModeSupported } = use_stdin_default();
   const { resizeKey } = useTerminalSize();
-  const bannerItem = import_react58.useRef({ id: "__banner__", kind: "banner" });
-  const [stateDir] = import_react58.useState(() => getLayout().taskStateDir(opts.name));
-  const feedItems = import_react58.useMemo(() => [
+  const bannerItem = import_react59.useRef({ id: "__banner__", kind: "banner" });
+  const [stateDir] = import_react59.useState(() => getLayout().taskStateDir(opts.name));
+  const feedItems = import_react59.useMemo(() => [
     bannerItem.current,
     ...loop.logLines.map((e) => ({ id: e.id, kind: "entry", entry: e }))
   ], [loop.logLines]);
-  import_react58.useEffect(() => {
-    if (!loop.isRunning) {
-      exit();
-    }
-  }, [loop.isRunning, exit]);
+  const { awaitingClose } = useHoldToClose({
+    finished: !loop.isRunning,
+    hold: loop.stopReason !== null && loop.stopReason !== "completed"
+  });
   if (!loop.state)
     return null;
   return /* @__PURE__ */ jsx_dev_runtime8.jsxDEV(Box_default, {
@@ -101188,13 +101452,21 @@ function TaskLoop({ opts }) {
             maxCostUsd: opts.maxCostUsd,
             maxRuntimeMinutes: opts.maxRuntimeMinutes,
             consecutiveFailures: loop.consecutiveFailures
-          }, undefined, false, undefined, this)
+          }, undefined, false, undefined, this),
+          awaitingClose && /* @__PURE__ */ jsx_dev_runtime8.jsxDEV(Text, {
+            color: "cyan",
+            children: [
+              `
+`,
+              "Press Enter to close\u2026"
+            ]
+          }, undefined, true, undefined, this)
         ]
       }, undefined, true, undefined, this)
     ]
   }, resizeKey, true, undefined, this);
 }
-var import_react58, jsx_dev_runtime8;
+var import_react59, jsx_dev_runtime8;
 var init_TaskLoop = __esm(async () => {
   init_useLoop();
   init_useTerminalSize();
@@ -101206,9 +101478,10 @@ var init_TaskLoop = __esm(async () => {
     init_IterationHeader(),
     init_FeedLine(),
     init_StatusBar(),
-    init_StopMessage()
+    init_StopMessage(),
+    init_useHoldToClose()
   ]);
-  import_react58 = __toESM(require_react(), 1);
+  import_react59 = __toESM(require_react(), 1);
   jsx_dev_runtime8 = __toESM(require_jsx_dev_runtime(), 1);
 });
 
@@ -101216,7 +101489,7 @@ var init_TaskLoop = __esm(async () => {
 import { join as join17 } from "path";
 function ExitAfterRender({ children }) {
   const { exit } = use_app_default();
-  import_react59.useEffect(() => {
+  import_react60.useEffect(() => {
     exit();
   }, [exit]);
   return /* @__PURE__ */ jsx_dev_runtime9.jsxDEV(jsx_dev_runtime9.Fragment, {
@@ -101225,7 +101498,7 @@ function ExitAfterRender({ children }) {
 }
 function ErrorMessage({ message }) {
   const { exit } = use_app_default();
-  import_react59.useEffect(() => {
+  import_react60.useEffect(() => {
     process.exitCode = 1;
     exit();
   }, [exit]);
@@ -101304,7 +101577,7 @@ function App2({ args, taskPhase }) {
     }
   }
 }
-var import_react59, jsx_dev_runtime9;
+var import_react60, jsx_dev_runtime9;
 var init_App2 = __esm(async () => {
   init_store();
   init_context();
@@ -101314,7 +101587,7 @@ var init_App2 = __esm(async () => {
     init_TaskStatus(),
     init_TaskLoop()
   ]);
-  import_react59 = __toESM(require_react(), 1);
+  import_react60 = __toESM(require_react(), 1);
   jsx_dev_runtime9 = __toESM(require_jsx_dev_runtime(), 1);
 });
 
@@ -101942,7 +102215,7 @@ async function main2(argv) {
     await ensureRalphGitignore(projectRoot);
   }
   await runWithContext(createDefaultContext({ layout, args }), async () => {
-    const { waitUntilExit } = render_default(import_react60.createElement(App2, { args }));
+    const { waitUntilExit } = render_default(import_react61.createElement(App2, { args }));
     await waitUntilExit();
   });
   return typeof process.exitCode === "number" ? process.exitCode : 0;
@@ -101970,7 +102243,7 @@ async function taskMain(argv) {
   await mkdir6(join20(tasksDir, args.name), { recursive: true });
   await ensureRalphGitignore(projectRoot);
   await runWithContext(createDefaultContext({ layout, args }), async () => {
-    const { waitUntilExit } = render_default(import_react60.createElement(App2, {
+    const { waitUntilExit } = render_default(import_react61.createElement(App2, {
       args,
       taskPhase: args.phase
     }));
@@ -101978,7 +102251,7 @@ async function taskMain(argv) {
   });
   return typeof process.exitCode === "number" ? process.exitCode : 0;
 }
-var import_react60;
+var import_react61;
 var init_src7 = __esm(async () => {
   init_context();
   init_layout();
@@ -101991,7 +102264,7 @@ var init_src7 = __esm(async () => {
     init_build2(),
     init_App2()
   ]);
-  import_react60 = __toESM(require_react(), 1);
+  import_react61 = __toESM(require_react(), 1);
 });
 
 // apps/agent/src/cli.ts
@@ -102045,14 +102318,12 @@ async function parseAgentArgs(argv) {
     ...common2,
     mode: "agent",
     linearTeam: "",
-    linearFilter: "",
     linearAssignee: "",
     pollInterval: 0,
     concurrency: 0,
     worktree: false,
     indicators: {},
     createPr: false,
-    fixCi: false,
     stackPrs: false,
     codeReview: false,
     maxTickets: 0,
@@ -102067,7 +102338,6 @@ async function parseAgentArgs(argv) {
   };
   const state = emptyParseState();
   let expectLinearTeam = false;
-  let expectLinearFilter = false;
   let expectLinearAssignee = false;
   let expectPollInterval = false;
   let expectConcurrency = false;
@@ -102081,11 +102351,6 @@ async function parseAgentArgs(argv) {
       expectLinearTeam = false;
       continue;
     }
-    if (expectLinearFilter) {
-      result2.linearFilter = arg;
-      expectLinearFilter = false;
-      continue;
-    }
     if (expectLinearAssignee) {
       result2.linearAssignee = arg;
       expectLinearAssignee = false;
@@ -102131,9 +102396,6 @@ async function parseAgentArgs(argv) {
       case "--linear-team":
         expectLinearTeam = true;
         break;
-      case "--linear-filter":
-        expectLinearFilter = true;
-        break;
       case "--linear-assignee":
         expectLinearAssignee = true;
         break;
@@ -102158,9 +102420,6 @@ async function parseAgentArgs(argv) {
       case "--create-pr":
         result2.createPr = true;
         break;
-      case "--fix-ci":
-        result2.fixCi = true;
-        break;
       case "--stack-prs":
         result2.stackPrs = true;
         break;
@@ -102194,11 +102453,11 @@ async function parseAgentArgs(argv) {
       case "--no-tmux":
         result2.noTmux = true;
         break;
-      case "--no-pr-tracker":
-        result2.prTrackerEnabled = false;
+      case "--no-pr-recovery":
+        result2.prRecoveryEnabled = false;
         break;
-      case "--pr-tracker":
-        result2.prTrackerEnabled = true;
+      case "--pr-recovery":
+        result2.prRecoveryEnabled = true;
         break;
       default:
         if (VALID_MODES2.has(arg)) {
@@ -102211,9 +102470,6 @@ async function parseAgentArgs(argv) {
   }
   await resolvePromptFile(result2, state);
   resolveWorkflowFile(result2, state);
-  if (result2.fixCi && !result2.createPr) {
-    throw new Error("--fix-ci requires --create-pr");
-  }
   if (result2.stackPrs && !result2.createPr) {
     throw new Error("--stack-prs requires --create-pr");
   }
@@ -102264,8 +102520,7 @@ var init_cli2 = __esm(() => {
     "  --log                   Log raw engine stream",
     "  --verbose               Verbose output",
     "  --linear-team <key>     Linear team key (e.g. ENG)",
-    "  --linear-filter <expr>  Global Linear filter (e.g. 'assignee = me', 'assignee = any')",
-    "  --linear-assignee <id>  [deprecated] Filter by assignee; use --linear-filter instead",
+    "  --linear-assignee <id>  Assignee override (me / any / unassigned / <email> / <id>); overrides linear.filter's assignee clause",
     "  --poll-interval <s>     Seconds between Linear polls (default: 60)",
     "  --concurrency <n>       Max concurrent task loops (default: 1)",
     "  --worktree              Run each task in its own git worktree",
@@ -102277,13 +102532,12 @@ var init_cli2 = __esm(() => {
     "                          --indicator setPrReady:status:In Review (additive ready marker)",
     "                          (attachment upserts a single 'Ralphy' entry; value = subtitle)",
     "  --create-pr             Push the worker branch and open a GitHub PR on success (needs --worktree)",
-    "  --fix-ci                After opening the PR, re-run on CI failures until green (needs --create-pr)",
     "  --stack-prs             Base the PR on a blocker issue's open-PR head branch when present (needs --create-pr)",
     "  --code-review           Watch open tracked PRs for unresolved review comments",
     "  --max-tickets <n>       Stop picking up new issues after N have been started (0 = unlimited)",
     "  --ticket <id>           Restrict issue discovery to specific ticket(s); repeatable or comma-separated (e.g. RLF-208 or 208)",
     "  --no-tmux               Disable tmux session management; run agent in the foreground directly",
-    "  --no-pr-tracker         Disable RLF-173 pr-tracker bail / recovery counter for this run",
+    "  --no-pr-recovery        Disable PR recovery (conflict + CI watcher) for this run; --pr-recovery forces it on",
     "  --json-output           Emit JSONL to stdout instead of the Ink dashboard (for scripting/CI)",
     "                          (auto-enabled when stdin is not a TTY, e.g. pipes / nohup / CI)",
     "  --json-log-file <path>  Mirror JSONL events to a file (works alongside TUI or --json-output)",
@@ -102346,330 +102600,12 @@ class PollContext {
   }
 }
 
-// apps/agent/src/shared/capabilities/types.ts
-var NO_RETRY;
-var init_types4 = __esm(() => {
-  NO_RETRY = {
-    maxAttempts: 1,
-    isRetryable: () => false,
-    delayMs: () => 0
-  };
-});
-
-// apps/agent/src/shared/capabilities/format-error.ts
-function formatError2(err) {
-  if (err instanceof Error)
-    return err.message;
-  try {
-    return String(err);
-  } catch {
-    return "unknown error";
-  }
-}
-
-// apps/agent/src/shared/capabilities/fs-change.ts
-import { join as join21, dirname as dirname8 } from "path";
-import { mkdir as mkdir7 } from "fs/promises";
-var scaffold, prependTask, appendSteering, fsChange;
-var init_fs_change = __esm(() => {
-  init_tasks_md();
-  init_types4();
-  scaffold = {
-    name: "fs.change.scaffold",
-    required: false,
-    retryPolicy: NO_RETRY,
-    errorFormatter: formatError2,
-    run: async (args) => {
-      await mkdir7(args.changeDir, { recursive: true });
-      await mkdir7(join21(args.changeDir, "specs"), { recursive: true });
-      await mkdir7(args.stateDir, { recursive: true });
-      await Bun.write(join21(args.changeDir, "proposal.md"), args.proposal);
-      await Bun.write(join21(args.changeDir, "tasks.md"), args.tasks);
-      await Bun.write(join21(args.changeDir, "design.md"), args.design);
-    }
-  };
-  prependTask = {
-    name: "fs.change.task.prepend",
-    required: false,
-    retryPolicy: NO_RETRY,
-    errorFormatter: formatError2,
-    run: async (args) => {
-      await prependFixTask(args.tasksPath, args.heading, args.failureOutput);
-    }
-  };
-  appendSteering = {
-    name: "fs.change.steering.append",
-    required: false,
-    retryPolicy: NO_RETRY,
-    errorFormatter: formatError2,
-    run: async (args) => {
-      const path = join21(args.changeDir, "steering.md");
-      const f2 = Bun.file(path);
-      const existing = await f2.exists() ? await f2.text() : null;
-      const updated = existing ? `${args.message}
-
-${existing.trimStart()}` : `${args.message}
-`;
-      await mkdir7(dirname8(path), { recursive: true });
-      await Bun.write(path, updated);
-    }
-  };
-  fsChange = { scaffold, prependTask, appendSteering };
-});
-
-// apps/agent/src/agent/worktree.ts
-import { basename as basename2, join as join22 } from "path";
-import { homedir as homedir5 } from "os";
-import { exists as exists3 } from "fs/promises";
-function worktreesDir2(projectRoot) {
-  return join22(homedir5(), ".ralph", basename2(projectRoot), "worktrees");
-}
-function branchForChange(changeName) {
-  return `ralph/${changeName}`;
-}
-function worktreeDirNameForIssue(issue2) {
-  return issue2.identifier.toLowerCase();
-}
-function withRepoLock(projectRoot, fn) {
-  const prev = repoWorktreeLocks.get(projectRoot) ?? Promise.resolve();
-  const result2 = prev.then(fn, fn);
-  repoWorktreeLocks.set(projectRoot, result2.then(() => {}, () => {}));
-  return result2;
-}
-function createWorktree(projectRoot, changeName, baseBranch, runner) {
-  return withRepoLock(projectRoot, () => provisionWorktree(projectRoot, changeName, baseBranch, runner));
-}
-async function provisionWorktree(projectRoot, changeName, baseBranch, runner) {
-  const dir = worktreesDir2(projectRoot);
-  const cwd2 = join22(dir, changeName);
-  const branch = branchForChange(changeName);
-  const list = await runner.run(["worktree", "list", "--porcelain"], projectRoot);
-  if (list.stdout.includes(`worktree ${cwd2}
-`)) {
-    await installPrePushHook(cwd2, runner);
-    return { cwd: cwd2, branch };
-  }
-  let branchExists = true;
-  try {
-    await runner.run(["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], projectRoot);
-  } catch {
-    branchExists = false;
-  }
-  if (branchExists) {
-    await runner.run(["worktree", "add", cwd2, branch], projectRoot);
-    await installPrePushHook(cwd2, runner);
-    return { cwd: cwd2, branch };
-  }
-  await runner.run(["fetch", "origin", baseBranch], projectRoot);
-  await runner.run(["worktree", "add", "-b", branch, cwd2, `origin/${baseBranch}`], projectRoot);
-  await installPrePushHook(cwd2, runner);
-  return { cwd: cwd2, branch };
-}
-async function installPrePushHook(cwd2, runner) {
-  const hookPath = join22(cwd2, ".ralph-hooks", "pre-push");
-  await Bun.write(hookPath, PRE_PUSH_HOOK_SCRIPT);
-  const chmod = Bun.spawn(["chmod", "+x", hookPath]);
-  await chmod.exited;
-  await runner.run(["config", "core.hooksPath", ".ralph-hooks"], cwd2);
-}
-async function removeWorktree(projectRoot, cwd2, runner) {
-  await runner.run(["worktree", "remove", "--force", cwd2], projectRoot);
-}
-async function isWorktreeSafeToRemove(cwd2, base2, runner) {
-  const status = await runner.run(["status", "--porcelain"], cwd2);
-  const dirty = status.stdout.trim();
-  let unpushedCommits = "";
-  try {
-    const log3 = await runner.run(["log", "--oneline", `${base2}..HEAD`, "--no-merges"], cwd2);
-    unpushedCommits = log3.stdout.trim();
-  } catch {
-    unpushedCommits = "<unknown: failed to compare against base>";
-  }
-  if (dirty && unpushedCommits) {
-    return {
-      safe: false,
-      reason: "uncommitted changes AND unpushed commits present",
-      dirty,
-      unpushedCommits
-    };
-  }
-  if (dirty) {
-    return {
-      safe: false,
-      reason: "uncommitted or untracked files present",
-      dirty,
-      unpushedCommits
-    };
-  }
-  if (unpushedCommits) {
-    return {
-      safe: false,
-      reason: `commits ahead of ${base2} were not pushed/PR'd`,
-      dirty,
-      unpushedCommits
-    };
-  }
-  return { safe: true, dirty, unpushedCommits };
-}
-async function seedWorktreeMcpConfig(projectRoot, worktreeCwd) {
-  const dst = join22(worktreeCwd, ".mcp.json");
-  const src = join22(projectRoot, ".mcp.json");
-  const source = await exists3(dst) ? dst : await exists3(src) ? src : null;
-  if (!source)
-    return;
-  let parsed;
-  try {
-    parsed = await Bun.file(source).json();
-  } catch {
-    return;
-  }
-  const servers = parsed.mcpServers;
-  if (servers && typeof servers === "object") {
-    for (const cfg of Object.values(servers)) {
-      if (Array.isArray(cfg.args)) {
-        cfg.args = cfg.args.map((a) => typeof a === "string" && a.startsWith(".ralph/") ? join22(projectRoot, a) : a);
-      }
-    }
-  }
-  await Bun.write(dst, JSON.stringify(parsed, null, 2) + `
-`);
-}
-var repoWorktreeLocks, PRE_PUSH_HOOK_SCRIPT = `#!/usr/bin/env bash
-# Installed by ralphy createWorktree (RLF-107).
-# Rejects any push whose remote ref is not refs/heads/ralph/*,
-# and rejects force pushes unless RALPH_ALLOW_FORCE_PUSH=1.
-set -euo pipefail
-ZERO="0000000000000000000000000000000000000000"
-while read local_ref local_sha remote_ref remote_sha; do
-  case "$remote_ref" in
-    refs/heads/ralph/*) ;;
-    *) echo "ralph: refusing push to $remote_ref (only refs/heads/ralph/* allowed)" >&2; exit 1 ;;
-  esac
-  if [ "$remote_sha" != "$ZERO" ] && [ "\${RALPH_ALLOW_FORCE_PUSH:-0}" != "1" ]; then
-    if ! git merge-base --is-ancestor "$remote_sha" "$local_sha" 2>/dev/null; then
-      echo "ralph: refusing force-push to $remote_ref (set RALPH_ALLOW_FORCE_PUSH=1 to override)" >&2
-      exit 1
-    fi
-  fi
-done
-exit 0
-`;
-var init_worktree = __esm(() => {
-  repoWorktreeLocks = new Map;
-});
-
-// apps/agent/src/shared/capabilities/git.ts
-var createWorktree2, removeWorktree2, seedWorktreeMcpConfig2, git;
-var init_git2 = __esm(() => {
-  init_types4();
-  init_worktree();
-  createWorktree2 = {
-    name: "git.worktree.create",
-    required: true,
-    retryPolicy: NO_RETRY,
-    errorFormatter: formatError2,
-    run: (args) => createWorktree(args.projectRoot, args.changeName, args.baseBranch, args.runner)
-  };
-  removeWorktree2 = {
-    name: "git.worktree.remove",
-    required: false,
-    retryPolicy: NO_RETRY,
-    errorFormatter: formatError2,
-    run: (args) => removeWorktree(args.projectRoot, args.cwd, args.runner)
-  };
-  seedWorktreeMcpConfig2 = {
-    name: "git.worktree.seedMcpConfig",
-    required: false,
-    retryPolicy: NO_RETRY,
-    errorFormatter: formatError2,
-    run: (args) => seedWorktreeMcpConfig(args.projectRoot, args.worktreeCwd)
-  };
-  git = { createWorktree: createWorktree2, removeWorktree: removeWorktree2, seedWorktreeMcpConfig: seedWorktreeMcpConfig2 };
-});
-
-// apps/agent/src/shared/capabilities/run-capability.ts
-function emit2(bus, ev) {
-  if (!bus)
-    return;
-  bus.emit(ev);
-}
-async function runCapability(cap, args, ctx = {}) {
-  const { bus } = ctx;
-  emit2(bus, { type: `${cap.name}.started` });
-  let lastError;
-  for (let attempt2 = 1;attempt2 <= cap.retryPolicy.maxAttempts; attempt2++) {
-    try {
-      const raw = await cap.run(args);
-      const result2 = cap.adopt ? cap.adopt(raw) : raw;
-      emit2(bus, { type: `${cap.name}.fetched` });
-      return result2;
-    } catch (err) {
-      lastError = err;
-      const canRetry = attempt2 < cap.retryPolicy.maxAttempts && cap.retryPolicy.isRetryable(err);
-      if (!canRetry)
-        break;
-      const delay2 = Math.max(0, cap.retryPolicy.delayMs(attempt2, err));
-      if (delay2 > 0)
-        await sleepMs(delay2);
-    }
-  }
-  const message = cap.errorFormatter(lastError);
-  emit2(bus, { type: `${cap.name}.failed`, error: message });
-  if (cap.required) {
-    throw lastError;
-  }
-  throw lastError;
-}
-function sleepMs(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
-}
-
-// packages/workflow/src/boundaries.ts
-function globToRegex(pattern) {
-  let re = "^";
-  for (let i = 0;i < pattern.length; i++) {
-    const c = pattern[i];
-    if (c === "*") {
-      if (pattern[i + 1] === "*") {
-        re += ".*";
-        i++;
-        if (pattern[i + 1] === "/")
-          i++;
-      } else {
-        re += "[^/]*";
-      }
-    } else if (c === "?") {
-      re += "[^/]";
-    } else if (/[.+^${}()|[\]\\]/.test(c)) {
-      re += "\\" + c;
-    } else {
-      re += c;
-    }
-  }
-  re += "$";
-  return new RegExp(re);
-}
-function findBoundaryViolations(changedFiles, patterns) {
-  if (patterns.length === 0 || changedFiles.length === 0)
-    return [];
-  const compiled = patterns.map((p) => ({ pattern: p, re: globToRegex(p) }));
-  const out = [];
-  for (const file2 of changedFiles) {
-    const norm = file2.replace(/\\/g, "/");
-    for (const { pattern, re } of compiled) {
-      if (re.test(norm)) {
-        out.push({ file: norm, pattern });
-        break;
-      }
-    }
-  }
-  return out;
-}
-
 // apps/agent/src/shared/utils/ralph-comment.ts
 function isRalphComment(body) {
   const trimmed = body.trimStart();
-  return /^(\uD83E\uDD16|\uD83D\uDD04|\u2705|\u2717|\u274C|\u26A0|\uD83D\uDD01|\uD83D\uDCCB|\u23F0)\s*Ralphy?\b/.test(trimmed);
+  if (/^(\uD83E\uDD16|\uD83D\uDD04|\u2705|\u2717|\u274C|\u26A0|\uD83D\uDD01|\uD83D\uDCCB|\u23F0)\s*Ralphy?\b/.test(trimmed))
+    return true;
+  return /^\uD83D\uDC40\s*(Got it\b|Acknowledged\b)/.test(trimmed);
 }
 
 // apps/agent/src/shared/capabilities/linear-client.ts
@@ -102700,6 +102636,7 @@ __export(exports_linear_client, {
   fetchIssueLabels: () => fetchIssueLabels,
   fetchIssueComments: () => fetchIssueComments,
   fetchIssueAttachments: () => fetchIssueAttachments,
+  fetchBlockedByForIssues: () => fetchBlockedByForIssues,
   fetchAttachmentsForIssues: () => fetchAttachmentsForIssues,
   deleteIssueComment: () => deleteIssueComment,
   deleteAttachment: () => deleteAttachment,
@@ -102787,6 +102724,19 @@ function partition2(markers) {
   }
   return { statuses, labels, attachmentSubtitles, projects };
 }
+function applyRequiredLabels(where, requireAllLabels) {
+  if (!requireAllLabels || requireAllLabels.length === 0)
+    return;
+  const and2 = where.and ?? [];
+  if (where.labels !== undefined) {
+    and2.push({ labels: where.labels });
+    delete where.labels;
+  }
+  for (const label of requireAllLabels) {
+    and2.push({ labels: { some: { name: { eq: label } } } });
+  }
+  where.and = and2;
+}
 function buildIssueFilter(spec) {
   const where = {};
   if (spec.team)
@@ -102885,6 +102835,7 @@ function buildIssueFilter(spec) {
       }
     }
   }
+  applyRequiredLabels(where, spec.requireAllLabels);
   return where;
 }
 function clauseFromMarkers(markers) {
@@ -102965,6 +102916,7 @@ async function fetchMentionScanIssues(apiKey, spec) {
   if (spec.numbers && spec.numbers.length > 0) {
     where.number = { in: spec.numbers };
   }
+  applyRequiredLabels(where, spec.requireAllLabels);
   const query = `query MentionScanIssues($filter: IssueFilter) {
     issues(filter: $filter, first: 50) {
       nodes {
@@ -103114,11 +103066,21 @@ function formatLinearError(err) {
 async function linearRequest(apiKey, query, variables) {
   let lastHttpError;
   for (let attempt2 = 1;attempt2 <= MAX_LINEAR_ATTEMPTS; attempt2++) {
-    const res = await fetch(LINEAR_API, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: apiKey },
-      body: JSON.stringify({ query, variables })
-    });
+    let res;
+    try {
+      res = await fetch(LINEAR_API, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: apiKey },
+        body: JSON.stringify({ query, variables })
+      });
+    } catch (netErr) {
+      lastHttpError = netErr;
+      if (attempt2 < MAX_LINEAR_ATTEMPTS) {
+        await linearRequestInternals.sleep(Math.min(backoffMs(attempt2), MAX_RETRY_AFTER_MS));
+        continue;
+      }
+      throw netErr;
+    }
     if (!res.ok) {
       const err = new Error("Linear API request failed");
       err.status = res.status;
@@ -103346,6 +103308,28 @@ async function fetchAttachmentsForIssues(apiKey, issueIds) {
   }
   return out;
 }
+async function fetchBlockedByForIssues(apiKey, issueIds) {
+  const out = new Map;
+  if (issueIds.length === 0)
+    return out;
+  const query = `query IssuesBlockedBy($ids: [ID!]!) {
+    issues(filter: { id: { in: $ids } }, first: 250) {
+      nodes {
+        id
+        relations(first: 50) {
+          nodes { type relatedIssue { id identifier state { type } } }
+        }
+      }
+    }
+  }`;
+  const data = await linearRequest(apiKey, query, { ids: issueIds });
+  const DONE_STATE_TYPES = new Set(["completed", "cancelled"]);
+  for (const node2 of data.issues.nodes) {
+    const blockers = (node2.relations?.nodes ?? []).filter((r) => r.type === "blocked_by" && !DONE_STATE_TYPES.has(r.relatedIssue.state.type)).map((r) => ({ id: r.relatedIssue.id, identifier: r.relatedIssue.identifier }));
+    out.set(node2.id, blockers);
+  }
+  return out;
+}
 async function findIssueAttachmentByTitle(apiKey, issueId, title) {
   const query = `query IssueAttachmentByTitle($id: String!) {
     issue(id: $id) {
@@ -103566,6 +103550,326 @@ var init_linear_client = __esm(() => {
   };
 });
 
+// apps/agent/src/shared/capabilities/types.ts
+var NO_RETRY;
+var init_types4 = __esm(() => {
+  NO_RETRY = {
+    maxAttempts: 1,
+    isRetryable: () => false,
+    delayMs: () => 0
+  };
+});
+
+// apps/agent/src/shared/capabilities/format-error.ts
+function formatError2(err) {
+  if (err instanceof Error)
+    return err.message;
+  try {
+    return String(err);
+  } catch {
+    return "unknown error";
+  }
+}
+
+// apps/agent/src/shared/capabilities/fs-change.ts
+import { join as join21, dirname as dirname8 } from "path";
+import { mkdir as mkdir7 } from "fs/promises";
+var scaffold, prependTask, appendSteering, fsChange;
+var init_fs_change = __esm(() => {
+  init_tasks_md();
+  init_types4();
+  scaffold = {
+    name: "fs.change.scaffold",
+    required: false,
+    retryPolicy: NO_RETRY,
+    errorFormatter: formatError2,
+    run: async (args) => {
+      await mkdir7(args.changeDir, { recursive: true });
+      await mkdir7(join21(args.changeDir, "specs"), { recursive: true });
+      await mkdir7(args.stateDir, { recursive: true });
+      await Bun.write(join21(args.changeDir, "proposal.md"), args.proposal);
+      await Bun.write(join21(args.changeDir, "tasks.md"), args.tasks);
+      await Bun.write(join21(args.changeDir, "design.md"), args.design);
+    }
+  };
+  prependTask = {
+    name: "fs.change.task.prepend",
+    required: false,
+    retryPolicy: NO_RETRY,
+    errorFormatter: formatError2,
+    run: async (args) => {
+      await prependFixTask(args.tasksPath, args.heading, args.failureOutput);
+    }
+  };
+  appendSteering = {
+    name: "fs.change.steering.append",
+    required: false,
+    retryPolicy: NO_RETRY,
+    errorFormatter: formatError2,
+    run: async (args) => {
+      const path = join21(args.changeDir, "steering.md");
+      const f2 = Bun.file(path);
+      const existing = await f2.exists() ? await f2.text() : null;
+      const updated = existing ? `${args.message}
+
+${existing.trimStart()}` : `${args.message}
+`;
+      await mkdir7(dirname8(path), { recursive: true });
+      await Bun.write(path, updated);
+    }
+  };
+  fsChange = { scaffold, prependTask, appendSteering };
+});
+
+// apps/agent/src/agent/worktree.ts
+import { basename as basename2, join as join22 } from "path";
+import { homedir as homedir5 } from "os";
+import { exists as exists3 } from "fs/promises";
+function worktreesDir2(projectRoot) {
+  return join22(homedir5(), ".ralph", basename2(projectRoot), "worktrees");
+}
+function branchForChange(changeName) {
+  return `ralph/${changeName}`;
+}
+function worktreeDirNameForIssue(issue2) {
+  return issue2.identifier.toLowerCase();
+}
+function withRepoLock(projectRoot, fn) {
+  const prev = repoWorktreeLocks.get(projectRoot) ?? Promise.resolve();
+  const result2 = prev.then(fn, fn);
+  repoWorktreeLocks.set(projectRoot, result2.then(() => {}, () => {}));
+  return result2;
+}
+function createWorktree(projectRoot, changeName, baseBranch, runner) {
+  return withRepoLock(projectRoot, () => provisionWorktree(projectRoot, changeName, baseBranch, runner));
+}
+async function provisionWorktree(projectRoot, changeName, baseBranch, runner) {
+  const dir = worktreesDir2(projectRoot);
+  const cwd2 = join22(dir, changeName);
+  const branch = branchForChange(changeName);
+  const list = await runner.run(["worktree", "list", "--porcelain"], projectRoot);
+  if (list.stdout.includes(`worktree ${cwd2}
+`)) {
+    await installPrePushHook(cwd2, runner);
+    return { cwd: cwd2, branch };
+  }
+  let branchExists = true;
+  try {
+    await runner.run(["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`], projectRoot);
+  } catch {
+    branchExists = false;
+  }
+  if (branchExists) {
+    await runner.run(["worktree", "add", cwd2, branch], projectRoot);
+    await installPrePushHook(cwd2, runner);
+    return { cwd: cwd2, branch };
+  }
+  await runner.run(["fetch", "origin", baseBranch], projectRoot);
+  await runner.run(["worktree", "add", "-b", branch, cwd2, `origin/${baseBranch}`], projectRoot);
+  await installPrePushHook(cwd2, runner);
+  return { cwd: cwd2, branch };
+}
+async function installPrePushHook(cwd2, runner) {
+  const hookPath = join22(cwd2, ".ralph-hooks", "pre-push");
+  await Bun.write(hookPath, PRE_PUSH_HOOK_SCRIPT);
+  const chmod = Bun.spawn(["chmod", "+x", hookPath]);
+  await chmod.exited;
+  await runner.run(["config", "core.hooksPath", ".ralph-hooks"], cwd2);
+}
+async function removeWorktree(projectRoot, cwd2, runner) {
+  await runner.run(["worktree", "remove", "--force", cwd2], projectRoot);
+}
+async function isWorktreeSafeToRemove(cwd2, base2, runner) {
+  const status = await runner.run(["status", "--porcelain"], cwd2);
+  const dirty = status.stdout.trim();
+  let unpushedCommits = "";
+  try {
+    const log3 = await runner.run(["log", "--oneline", `${base2}..HEAD`, "--no-merges"], cwd2);
+    unpushedCommits = log3.stdout.trim();
+  } catch {
+    unpushedCommits = "<unknown: failed to compare against base>";
+  }
+  if (dirty && unpushedCommits) {
+    return {
+      safe: false,
+      reason: "uncommitted changes AND unpushed commits present",
+      dirty,
+      unpushedCommits
+    };
+  }
+  if (dirty) {
+    return {
+      safe: false,
+      reason: "uncommitted or untracked files present",
+      dirty,
+      unpushedCommits
+    };
+  }
+  if (unpushedCommits) {
+    return {
+      safe: false,
+      reason: `commits ahead of ${base2} were not pushed/PR'd`,
+      dirty,
+      unpushedCommits
+    };
+  }
+  return { safe: true, dirty, unpushedCommits };
+}
+async function seedWorktreeMcpConfig(projectRoot, worktreeCwd) {
+  const dst = join22(worktreeCwd, ".mcp.json");
+  const src = join22(projectRoot, ".mcp.json");
+  const source = await exists3(dst) ? dst : await exists3(src) ? src : null;
+  if (!source)
+    return;
+  let parsed;
+  try {
+    parsed = await Bun.file(source).json();
+  } catch {
+    return;
+  }
+  const servers = parsed.mcpServers;
+  if (servers && typeof servers === "object") {
+    for (const cfg of Object.values(servers)) {
+      if (Array.isArray(cfg.args)) {
+        cfg.args = cfg.args.map((a) => typeof a === "string" && a.startsWith(".ralph/") ? join22(projectRoot, a) : a);
+      }
+    }
+  }
+  await Bun.write(dst, JSON.stringify(parsed, null, 2) + `
+`);
+}
+var repoWorktreeLocks, PRE_PUSH_HOOK_SCRIPT = `#!/usr/bin/env bash
+# Installed by ralphy createWorktree (RLF-107).
+# Rejects any push whose remote ref is not refs/heads/ralph/*,
+# and rejects force pushes unless RALPH_ALLOW_FORCE_PUSH=1.
+set -euo pipefail
+ZERO="0000000000000000000000000000000000000000"
+while read local_ref local_sha remote_ref remote_sha; do
+  case "$remote_ref" in
+    refs/heads/ralph/*) ;;
+    *) echo "ralph: refusing push to $remote_ref (only refs/heads/ralph/* allowed)" >&2; exit 1 ;;
+  esac
+  if [ "$remote_sha" != "$ZERO" ] && [ "\${RALPH_ALLOW_FORCE_PUSH:-0}" != "1" ]; then
+    if ! git merge-base --is-ancestor "$remote_sha" "$local_sha" 2>/dev/null; then
+      echo "ralph: refusing force-push to $remote_ref (set RALPH_ALLOW_FORCE_PUSH=1 to override)" >&2
+      exit 1
+    fi
+  fi
+done
+exit 0
+`;
+var init_worktree = __esm(() => {
+  repoWorktreeLocks = new Map;
+});
+
+// apps/agent/src/shared/capabilities/git.ts
+var createWorktree2, removeWorktree2, seedWorktreeMcpConfig2, git;
+var init_git2 = __esm(() => {
+  init_types4();
+  init_worktree();
+  createWorktree2 = {
+    name: "git.worktree.create",
+    required: true,
+    retryPolicy: NO_RETRY,
+    errorFormatter: formatError2,
+    run: (args) => createWorktree(args.projectRoot, args.changeName, args.baseBranch, args.runner)
+  };
+  removeWorktree2 = {
+    name: "git.worktree.remove",
+    required: false,
+    retryPolicy: NO_RETRY,
+    errorFormatter: formatError2,
+    run: (args) => removeWorktree(args.projectRoot, args.cwd, args.runner)
+  };
+  seedWorktreeMcpConfig2 = {
+    name: "git.worktree.seedMcpConfig",
+    required: false,
+    retryPolicy: NO_RETRY,
+    errorFormatter: formatError2,
+    run: (args) => seedWorktreeMcpConfig(args.projectRoot, args.worktreeCwd)
+  };
+  git = { createWorktree: createWorktree2, removeWorktree: removeWorktree2, seedWorktreeMcpConfig: seedWorktreeMcpConfig2 };
+});
+
+// apps/agent/src/shared/capabilities/run-capability.ts
+function emit2(bus, ev) {
+  if (!bus)
+    return;
+  bus.emit(ev);
+}
+async function runCapability(cap, args, ctx = {}) {
+  const { bus } = ctx;
+  emit2(bus, { type: `${cap.name}.started` });
+  let lastError;
+  for (let attempt2 = 1;attempt2 <= cap.retryPolicy.maxAttempts; attempt2++) {
+    try {
+      const raw = await cap.run(args);
+      const result2 = cap.adopt ? cap.adopt(raw) : raw;
+      emit2(bus, { type: `${cap.name}.fetched` });
+      return result2;
+    } catch (err) {
+      lastError = err;
+      const canRetry = attempt2 < cap.retryPolicy.maxAttempts && cap.retryPolicy.isRetryable(err);
+      if (!canRetry)
+        break;
+      const delay2 = Math.max(0, cap.retryPolicy.delayMs(attempt2, err));
+      if (delay2 > 0)
+        await sleepMs(delay2);
+    }
+  }
+  const message = cap.errorFormatter(lastError);
+  emit2(bus, { type: `${cap.name}.failed`, error: message });
+  if (cap.required) {
+    throw lastError;
+  }
+  throw lastError;
+}
+function sleepMs(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+
+// packages/workflow/src/boundaries.ts
+function globToRegex(pattern) {
+  let re = "^";
+  for (let i = 0;i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === "*") {
+      if (pattern[i + 1] === "*") {
+        re += ".*";
+        i++;
+        if (pattern[i + 1] === "/")
+          i++;
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else if (/[.+^${}()|[\]\\]/.test(c)) {
+      re += "\\" + c;
+    } else {
+      re += c;
+    }
+  }
+  re += "$";
+  return new RegExp(re);
+}
+function findBoundaryViolations(changedFiles, patterns) {
+  if (patterns.length === 0 || changedFiles.length === 0)
+    return [];
+  const compiled = patterns.map((p) => ({ pattern: p, re: globToRegex(p) }));
+  const out = [];
+  for (const file2 of changedFiles) {
+    const norm = file2.replace(/\\/g, "/");
+    for (const { pattern, re } of compiled) {
+      if (re.test(norm)) {
+        out.push({ file: norm, pattern });
+        break;
+      }
+    }
+  }
+  return out;
+}
+
 // apps/agent/src/agent/linear.ts
 var init_linear = __esm(() => {
   init_linear_client();
@@ -103760,131 +104064,14 @@ function classifyGhBucket(bucket) {
     return "pending";
   return "pass";
 }
-var TRANSIENT_GH_RE, NO_CHECKS_RE, GH_RETRY_DELAYS;
+var TRANSIENT_GH_RE, NO_CHECKS_RE, PARTIAL_ACCESS_RE, GH_RETRY_DELAYS;
 var init_ci_classify = __esm(() => {
   TRANSIENT_GH_RE = /HTTP 5\d\d|Gateway Timeout|Bad Gateway|Service Unavailable|connection reset|ECONNRESET|ETIMEDOUT|getaddrinfo|EAI_AGAIN|could not resolve host/i;
   NO_CHECKS_RE = /no checks reported/i;
+  PARTIAL_ACCESS_RE = /Resource not accessible by personal access token/i;
   GH_RETRY_DELAYS = [5000, 15000, 45000];
 });
 
-// apps/agent/src/agent/ci.ts
-async function getPrChecksStatus(prRef, runner, cwd2, onTransientRetry, ignoreCiChecks = []) {
-  let out;
-  try {
-    out = await runGhWithRetry(["gh", "pr", "checks", prRef, "--json", PR_CHECKS_FIELDS], runner, cwd2, onTransientRetry);
-  } catch (err) {
-    const e = err;
-    const blob = `${e.message}
-${e.stderr ?? ""}
-${e.stdout ?? ""}`;
-    if (NO_CHECKS_RE.test(blob))
-      return { bucket: "pass", failedRunIds: [], failedCheckNames: [] };
-    throw err;
-  }
-  const ignoredLower = ignoreCiChecks.map((n) => n.toLowerCase());
-  const checks3 = JSON.parse(out.stdout || "[]").filter((c) => !ignoredLower.includes(c.name.toLowerCase())).filter((c) => classifyGhBucket(c.bucket) !== "skip");
-  if (checks3.some((c) => classifyGhBucket(c.bucket) === "pending")) {
-    return { bucket: "pending", failedRunIds: [], failedCheckNames: [] };
-  }
-  const failed = checks3.filter((c) => classifyGhBucket(c.bucket) === "fail");
-  if (failed.length === 0)
-    return { bucket: "pass", failedRunIds: [], failedCheckNames: [] };
-  const ids = new Set;
-  for (const c of failed) {
-    const m = c.link?.match(/\/actions\/runs\/(\d+)/);
-    if (m)
-      ids.add(m[1]);
-  }
-  return { bucket: "fail", failedRunIds: [...ids], failedCheckNames: failed.map((c) => c.name) };
-}
-async function fetchFailedRunLogs(runIds, runner, cwd2, maxCharsPerRun = 4000) {
-  const chunks = [];
-  for (const id of runIds) {
-    try {
-      const r = await runner.run(["gh", "run", "view", id, "--log-failed"], cwd2);
-      const text = r.stdout.trim();
-      const truncated = text.length > maxCharsPerRun ? text.slice(0, maxCharsPerRun) + `
-\u2026[truncated ${text.length - maxCharsPerRun} chars]` : text;
-      chunks.push(`--- run ${id} ---
-${truncated}`);
-    } catch (err) {
-      chunks.push(`--- run ${id} ---
-(failed to fetch logs: ${err.message})`);
-    }
-  }
-  return chunks.join(`
-
-`);
-}
-async function safeSha(getHeadSha) {
-  try {
-    const sha = (await getHeadSha()).trim();
-    return sha || null;
-  } catch {
-    return null;
-  }
-}
-async function fixCiUntilGreen(deps, opts) {
-  for (let attempt2 = 1;attempt2 <= opts.maxAttempts; attempt2++) {
-    let pollN = 0;
-    while (true) {
-      if (deps.cancelled?.())
-        return { success: false, attempts: attempt2 - 1, reason: "cancelled" };
-      pollN += 1;
-      deps.onPhase?.("ci-poll", `attempt ${attempt2}/${opts.maxAttempts} \xB7 poll ${pollN}`);
-      let s;
-      try {
-        s = await deps.getStatus();
-      } catch (err) {
-        deps.log(`! gh pr checks failed permanently: ${err.message} \u2014 giving up CI watch`, "red");
-        return { success: false, attempts: attempt2 - 1, reason: "gh-failed" };
-      }
-      if (s.bucket === "pass") {
-        deps.log(`\u2713 CI green for PR (after ${attempt2 - 1} fix attempts)`, "green");
-        return { success: true, attempts: attempt2 - 1 };
-      }
-      if (s.bucket === "fail") {
-        deps.log(`\u2717 CI failing (attempt ${attempt2}/${opts.maxAttempts}) \u2014 fetching logs and re-running task`, "yellow");
-        deps.onPhase?.("ci-fix", `attempt ${attempt2}/${opts.maxAttempts} \xB7 fetching logs`);
-        const logs = await deps.getFailedLogs(s.failedRunIds);
-        deps.onPhase?.("ci-fix", `attempt ${attempt2}/${opts.maxAttempts} \xB7 re-running worker`);
-        const steering = `CI is failing on this PR. Investigate and fix:
-
-\`\`\`
-${logs}
-\`\`\``;
-        const shaBefore = deps.getHeadSha ? await safeSha(deps.getHeadSha) : null;
-        const code = await deps.runTaskWithSteering(steering);
-        if (code !== 0) {
-          deps.log(`! task loop exited code ${code} during CI fix attempt ${attempt2}`, "red");
-        }
-        if (shaBefore !== null) {
-          const shaAfter = await safeSha(deps.getHeadSha);
-          if (shaAfter !== null && shaAfter === shaBefore) {
-            deps.log(`! worker produced no new commits on CI fix attempt ${attempt2} \u2014 failure looks external (e.g. rate-limited deploy). Giving up CI watch.`, "yellow");
-            return { success: false, attempts: attempt2, reason: "no-progress" };
-          }
-        }
-        try {
-          deps.onPhase?.("ci-fix", `attempt ${attempt2}/${opts.maxAttempts} \xB7 pushing fix`);
-          await deps.pushBranch();
-        } catch (err) {
-          deps.log(`! push failed during CI fix: ${err.message}`, "red");
-          return { success: false, attempts: attempt2, reason: "push-failed" };
-        }
-        break;
-      }
-      deps.onPhase?.("ci-poll", `attempt ${attempt2}/${opts.maxAttempts} \xB7 pending, waiting`);
-      await deps.sleep(opts.pollIntervalSeconds * 1000);
-    }
-  }
-  return { success: false, attempts: opts.maxAttempts, reason: "max-attempts" };
-}
-var PR_CHECKS_FIELDS = "name,bucket,link,workflow,event";
-var init_ci = __esm(() => {
-  init_ci_classify();
-});
-
 // apps/agent/src/pr-status.ts
 function bucketChecks(rollup, prState, ignoreCiChecks = []) {
   if (rollup === null || rollup === undefined) {
@@ -104488,33 +104675,9 @@ async function runWorkerWithFixTask(ctx, heading, body) {
   }
   return code;
 }
-async function pushBranchSafely(ctx) {
-  try {
-    ctx.emit("pushing", "after conflict resolution");
-    await ctx.cmd.run(["git", "push", "origin", ctx.branch], ctx.cwd);
-    return true;
-  } catch (pushErr) {
-    const pe = pushErr;
-    const blob = `${pe.message}
-${pe.stderr ?? ""}`;
-    if (!/non-fast-forward|Updates were rejected/i.test(blob)) {
-      ctx.log(`! push after conflict fix failed: ${pe.message}`, "red");
-      return false;
-    }
-    try {
-      await ctx.cmd.run(["git", "fetch", "origin", ctx.branch], ctx.cwd);
-      await ctx.cmd.run(["git", "merge", "--no-edit", `origin/${ctx.branch}`], ctx.cwd);
-      await ctx.cmd.run(["git", "push", "origin", ctx.branch], ctx.cwd);
-      return true;
-    } catch (retryErr) {
-      ctx.log(`! push after merging origin/${ctx.branch} failed: ${retryErr.message}`, "red");
-      return false;
-    }
-  }
-}
 async function createPrWithRetry(ctx, issue2) {
   const base2 = ctx.base;
-  const maxAttempts = ctx.cfg.maxCiFixAttempts;
+  const maxAttempts = MAX_PR_CREATE_ATTEMPTS;
   let hookFixAttempt = 0;
   let nonFfRebaseAttempted = false;
   let pr = null;
@@ -104627,86 +104790,6 @@ ${reBlob.trim()}`);
     }
   }
 }
-async function fixConflictsAndCiLoop(ctx, prUrl, wantFixCi, checkPrConflict) {
-  const wantConflictLoop = !!checkPrConflict;
-  const maxOuterAttempts = ctx.cfg.maxCiFixAttempts;
-  let outerAttempt = 0;
-  let ciConfirmedGreen = false;
-  while (outerAttempt < maxOuterAttempts) {
-    if (wantConflictLoop) {
-      ctx.emit("conflict-check");
-      let conflicting = false;
-      try {
-        conflicting = await checkPrConflict(prUrl);
-      } catch (err) {
-        ctx.log(`! conflict check failed: ${err.message}`, "yellow");
-      }
-      if (!conflicting && ciConfirmedGreen)
-        return 0;
-      if (conflicting) {
-        outerAttempt++;
-        ciConfirmedGreen = false;
-        ctx.emit("conflict-fix-inner", `attempt ${outerAttempt}/${maxOuterAttempts}`);
-        ctx.log(`  merge conflicts on PR (attempt ${outerAttempt}/${maxOuterAttempts}) \u2014 spawning resolution task`, "yellow");
-        const conflictCode = await runWorkerWithFixTask(ctx, "Resolve PR merge conflicts", [
-          `The PR ${prUrl} has merge conflicts with \`${ctx.base}\`.`,
-          "",
-          "Steps:",
-          `1. \`git fetch origin ${ctx.base}\` then merge \`${ctx.base}\` into the current branch (\`git merge origin/${ctx.base}\`). Do NOT rebase and do NOT amend existing commits.`,
-          "2. Resolve conflicts in the files git lists.",
-          "3. Stage and commit the resolution as a new merge commit."
-        ].join(`
-`));
-        if (conflictCode !== 0) {
-          ctx.log(`! conflict resolution worker exited code ${conflictCode} \u2014 giving up`, "red");
-          return PR_FAILED_EXIT;
-        }
-        const pushed = await pushBranchSafely(ctx);
-        if (!pushed)
-          return PR_FAILED_EXIT;
-        continue;
-      }
-    }
-    if (!wantFixCi)
-      break;
-    if (!ciConfirmedGreen) {
-      ctx.log(`  watching CI for ${prUrl} (max ${ctx.cfg.maxCiFixAttempts} fix attempts)`, "gray");
-      ctx.emit("ci-poll", "starting");
-      const result2 = await fixCiUntilGreen({
-        onPhase: (p, d) => ctx.emit(p, d),
-        getStatus: () => getPrChecksStatus(prUrl, ctx.cmd, ctx.cwd, (n, ms, why) => ctx.log(`  gh transient (try ${n}) \u2014 retry in ${Math.round(ms / 1000)}s \xB7 ${why}`, "yellow"), ctx.cfg.ignoreCiChecks),
-        getFailedLogs: (ids) => fetchFailedRunLogs(ids, ctx.cmd, ctx.cwd),
-        runTaskWithSteering: (steering) => runWorkerWithFixTask(ctx, "Fix failing CI checks", steering),
-        pushBranch: async () => {
-          await ctx.cmd.run(["git", "push", "origin", ctx.branch], ctx.cwd);
-        },
-        getHeadSha: async () => {
-          const r = await ctx.cmd.run(["git", "rev-parse", "HEAD"], ctx.cwd);
-          return r.stdout.trim();
-        },
-        log: ctx.log,
-        sleep: (ms) => new Promise((r) => setTimeout(r, ms))
-      }, {
-        maxAttempts: ctx.cfg.maxCiFixAttempts,
-        pollIntervalSeconds: ctx.cfg.ciPollIntervalSeconds
-      });
-      if (!result2.success) {
-        ctx.log(`! CI fix loop gave up after ${result2.attempts} attempts (${result2.reason ?? "unknown"}) \u2014 withholding done-status until CI passes`, "red");
-        return CI_FAILED_EXIT;
-      }
-      ciConfirmedGreen = true;
-    }
-    if (wantConflictLoop) {
-      continue;
-    }
-    return 0;
-  }
-  if (outerAttempt >= maxOuterAttempts) {
-    ctx.log(`! outer fix loop exhausted ${maxOuterAttempts} attempts \u2014 giving up`, "red");
-    return CI_FAILED_EXIT;
-  }
-  return 0;
-}
 async function findNeverTouchViolations(cmd, cwd2, base2, neverTouch) {
   if (neverTouch.length === 0)
     return [];
@@ -104727,27 +104810,8 @@ async function findNeverTouchViolations(cmd, cwd2, base2, neverTouch) {
   return findBoundaryViolations(files, neverTouch);
 }
 async function runPrPhase(input, deps) {
-  const {
-    changeName,
-    cwd: cwd2,
-    branch,
-    changeDir,
-    stateFilePath,
-    issue: issue2,
-    wantFixCi,
-    wantAutoMerge,
-    cfg
-  } = input;
-  const {
-    cmd,
-    log: log3,
-    emit: emit3,
-    respawnWorker,
-    registerPr,
-    onPrReady,
-    checkPrConflict,
-    resolveDependencyBaseBranch
-  } = deps;
+  const { changeName, cwd: cwd2, branch, changeDir, stateFilePath, issue: issue2, wantAutoMerge, cfg } = input;
+  const { cmd, log: log3, emit: emit3, respawnWorker, registerPr, onPrReady, resolveDependencyBaseBranch } = deps;
   if (!branch || !issue2) {
     log3(`! createPr requested but no worktree branch is tracked for ${changeName} (use --worktree)`, "yellow");
     return PR_FAILED_EXIT;
@@ -104814,7 +104878,7 @@ ${indented}${suffix}`, "yellow");
     }
     return PR_FAILED_EXIT;
   }
-  const maxOuterAttempts = cfg.maxCiFixAttempts;
+  const maxOuterAttempts = MAX_PR_CREATE_ATTEMPTS;
   let onlyMetaAttempts = 0;
   let pr = null;
   const finalizeNoOpAsDone = cfg.finalizeNoOpAsDone !== false;
@@ -104889,36 +104953,8 @@ ${indented}${suffix}`, "yellow");
   }
   log3(`  ${pr.created ? "opened" : "found existing"} PR: ${prUrl}`, "green");
   registerPr?.(changeName, prUrl);
-  let manualMergePending = false;
-  const prReadyNeeded = cfg.prDraft === true;
-  if (!prReadyNeeded && wantAutoMerge) {
-    const fallbackEnabled = cfg.manualMergeWhenAutoMergeDisabled !== false;
-    const repoAllowsAutoMerge = await detectRepoAutoMergeAllowed(prUrl, cmd, cwd2, log3);
-    if (repoAllowsAutoMerge === false && fallbackEnabled) {
-      log3(`  repo has auto-merge disabled \u2014 will poll ${prUrl} and merge via gh pr merge once checks pass`, "yellow");
-      manualMergePending = true;
-    } else {
-      try {
-        await cmd.run(["gh", "pr", "merge", prUrl, "--auto", `--${cfg.autoMergeStrategy}`], cwd2);
-        log3(`  enabled auto-merge (${cfg.autoMergeStrategy}) on ${prUrl}`, "green");
-        emit3("auto-merge-enabled", cfg.autoMergeStrategy);
-      } catch (err) {
-        const e = err;
-        const detail = e.stderr?.trim() || e.message;
-        log3(`! failed to enable auto-merge on ${prUrl}: ${detail}`, "yellow");
-        if (fallbackEnabled && /auto[- ]merge/i.test(detail)) {
-          log3(`  falling back to manual merge after CI passes for ${prUrl}`, "yellow");
-          manualMergePending = true;
-        }
-      }
-    }
-  } else if (prReadyNeeded && wantAutoMerge) {
-    manualMergePending = true;
-  }
-  const ciResult = await fixConflictsAndCiLoop(ctx, prUrl, wantFixCi, checkPrConflict);
-  if (ciResult !== 0)
-    return ciResult;
-  if (prReadyNeeded) {
+  let readyOk = true;
+  if (cfg.prDraft === true) {
     emit3("pr-ready");
     try {
       await cmd.run(["gh", "pr", "ready", prUrl], cwd2);
@@ -104926,22 +104962,25 @@ ${indented}${suffix}`, "yellow");
     } catch (err) {
       const e = err;
       log3(`! gh pr ready failed for ${prUrl}: ${e.stderr?.trim() || e.message}`, "yellow");
-      manualMergePending = false;
+      readyOk = false;
     }
   }
-  if (manualMergePending) {
-    try {
-      await cmd.run(["gh", "pr", "merge", prUrl, `--${cfg.autoMergeStrategy}`], cwd2);
-      log3(`  manually merged (${cfg.autoMergeStrategy}) ${prUrl}`, "green");
-      emit3("auto-merge-enabled", `manual:${cfg.autoMergeStrategy}`);
-    } catch (err) {
-      const e = err;
-      log3(`! manual merge failed for ${prUrl}: ${e.stderr?.trim() || e.message}`, "yellow");
+  if (wantAutoMerge && readyOk) {
+    const repoAllowsAutoMerge = await detectRepoAutoMergeAllowed(prUrl, cmd, cwd2, log3);
+    if (repoAllowsAutoMerge === false) {
+      log3(cfg.manualMergeWhenAutoMergeDisabled !== false ? `  repo has auto-merge disabled \u2014 leaving ${prUrl} open for manual merge once checks pass` : `  repo has auto-merge disabled (manual-merge fallback off) \u2014 ${prUrl} will not auto-merge`, "yellow");
+    } else {
+      try {
+        await cmd.run(["gh", "pr", "merge", prUrl, "--auto", `--${cfg.autoMergeStrategy}`], cwd2);
+        log3(`  enabled auto-merge (${cfg.autoMergeStrategy}) on ${prUrl}`, "green");
+        emit3("auto-merge-enabled", cfg.autoMergeStrategy);
+      } catch (err) {
+        const e = err;
+        log3(`! failed to enable auto-merge on ${prUrl}: ${e.stderr?.trim() || e.message}`, "yellow");
+      }
     }
   }
-  if (!(wantAutoMerge && !prReadyNeeded)) {
-    await onPrReady?.(prUrl);
-  }
+  await onPrReady?.(prUrl);
   return 0;
 }
 async function runWorktreeCleanupPhase(input, deps) {
@@ -105048,7 +105087,6 @@ async function runPostTask(input, deps) {
     exitCode,
     useWorktree,
     wantPr,
-    wantFixCi,
     wantAutoMerge,
     wantValidateOnly,
     cfg,
@@ -105138,7 +105176,6 @@ async function runPostTask(input, deps) {
       changeDir,
       stateFilePath,
       issue: issue2,
-      wantFixCi,
       wantAutoMerge,
       cfg
     }, {
@@ -105148,7 +105185,6 @@ async function runPostTask(input, deps) {
       respawnWorker,
       ...deps.registerPr !== undefined ? { registerPr: deps.registerPr } : {},
       ...deps.onPrReady !== undefined ? { onPrReady: deps.onPrReady } : {},
-      ...deps.checkPrConflict !== undefined ? { checkPrConflict: deps.checkPrConflict } : {},
       ...deps.resolveDependencyBaseBranch !== undefined ? { resolveDependencyBaseBranch: deps.resolveDependencyBaseBranch } : {}
     });
   }
@@ -105169,7 +105205,7 @@ async function runPostTask(input, deps) {
   await runTeardownPhase({ cwd: cwd2, teardownScript: cfg.teardownScript }, { runScript, log: log3, emit: emit3 });
   return effectiveCode;
 }
-var CI_FAILED_EXIT = 70, PR_FAILED_EXIT = 71, NO_CHANGES_EXIT = 72, repoAutoMergeCache, defaultRunCommand = async (cmd, cwd2) => {
+var PR_FAILED_EXIT = 71, MAX_PR_CREATE_ATTEMPTS = 5, NO_CHANGES_EXIT = 72, repoAutoMergeCache, defaultRunCommand = async (cmd, cwd2) => {
   const proc = Bun.spawnSync({
     cmd: ["sh", "-c", cmd],
     cwd: cwd2,
@@ -105188,7 +105224,6 @@ var init_post_task = __esm(() => {
   init_git2();
   init_linear();
   init_pr();
-  init_ci();
   init_pr_status();
   init_wait_for_mergeability();
   init_worktree();
@@ -105593,10 +105628,12 @@ class AgentCoordinator {
         continue;
       if (!this.dependenciesResolved(issue2))
         continue;
-      if (await this.maybePromoteFinishedConflicted(issue2))
-        continue;
       const changeDir = this.deps.getChangeDir?.(issue2) ?? undefined;
       const actor = await this.flowStore.getActor(issue2.id, changeDir);
+      if (actor.getSnapshot().value === "awaiting-ci")
+        continue;
+      if (await this.maybePromoteFinishedConflicted(issue2))
+        continue;
       actor.send({ type: "RESUME_DETECTED" });
       if (changeDir) {
         await this.flowStore.persistActor(issue2.id, changeDir).catch(() => {});
@@ -105741,6 +105778,12 @@ class AgentCoordinator {
       return false;
     if (pr.status !== "conflicted" && pr.status !== "ci_failed")
       return false;
+    if (!this.opts.prRecovery?.enabled)
+      return false;
+    if (pr.status === "conflicted" && !this.opts.prRecovery.fixConflicts)
+      return false;
+    if (pr.status === "ci_failed" && !this.opts.prRecovery.fixCi)
+      return false;
     const stateLabel = pr.status === "conflicted" ? "conflicting with main" : "failing CI";
     if (this.conflictPromoted.has(issue2.id))
       return true;
@@ -105878,6 +105921,8 @@ class AgentCoordinator {
   }
   async scanPrMergeStates() {
     const counts = emptyPrStatus();
+    if (!this.opts.prRecovery?.enabled)
+      return counts;
     let candidates = [];
     try {
       candidates = await this.deps.fetchDoneCandidates();
@@ -105922,7 +105967,26 @@ class AgentCoordinator {
           this.deps.onLog(`! pr-tracker clear failed for ${issue2.identifier}: ${err.message}`, "yellow");
         }
       }
+      if (pr.status === "mergeable") {
+        const changeDir = this.deps.getChangeDir?.(issue2) ?? undefined;
+        const actor = await this.flowStore.getActor(issue2.id, changeDir);
+        if (actor.getSnapshot().value === "awaiting-ci") {
+          if (this.issueInSetDoneState(issue2)) {
+            actor.send({ type: "PR_PASSED" });
+            if (changeDir)
+              await this.flowStore.persistActor(issue2.id, changeDir).catch(() => {});
+            if (actor.getSnapshot().value === "done") {
+              this.flowStore.disposeActor(issue2.id);
+            }
+          } else {
+            await this.advancePrToDone(issue2, pr.url, actor, changeDir);
+          }
+        }
+        continue;
+      }
       if (pr.status === "conflicted") {
+        if (!this.opts.prRecovery?.fixConflicts)
+          continue;
         if (tracker?.isBailed(issue2.identifier)) {
           counts.quarantined += 1;
           continue;
@@ -105956,6 +106020,8 @@ class AgentCoordinator {
         continue;
       }
       if (pr.status === "ci_failed") {
+        if (!this.opts.prRecovery?.fixCi)
+          continue;
         if (tracker?.isBailed(issue2.identifier)) {
           counts.quarantined += 1;
           continue;
@@ -106002,6 +106068,49 @@ class AgentCoordinator {
     }
     return counts;
   }
+  issueInSetDoneState(issue2) {
+    const sd = this.opts.setDone;
+    if (!sd)
+      return false;
+    return issueMatchesGetIndicator(issue2, { filter: markersOf(sd) });
+  }
+  async advancePrToDone(issue2, prUrl, actor, changeDir) {
+    this.deps.onLog(`  ${issue2.identifier}: PR ${prUrl} mergeable \u2014 moving to done`, "green");
+    if (this.opts.setDone) {
+      try {
+        await this.deps.applyIndicator(issue2, this.opts.setDone);
+        this.deps.onLog(`  ${issue2.identifier}: setDone applied`, "gray");
+      } catch (err) {
+        this.deps.onLog(`! Linear setDone failed for ${issue2.identifier}: ${err.message}`, "red");
+        emitCapture(this.bus, "agent_indicator_failed", {
+          indicator: "setDone",
+          issue_identifier: issue2.identifier,
+          error: err.message
+        });
+        return;
+      }
+      if (this.opts.setInProgress) {
+        try {
+          await this.deps.removeIndicator(issue2, this.opts.setInProgress);
+          this.deps.onLog(`  ${issue2.identifier}: clearInProgress applied`, "gray");
+        } catch {}
+      }
+    }
+    actor.send({ type: "PR_PASSED" });
+    if (changeDir) {
+      await this.flowStore.persistActor(issue2.id, changeDir).catch(() => {});
+    }
+    if (actor.getSnapshot().value === "done") {
+      this.flowStore.disposeActor(issue2.id);
+    }
+    if (this.opts.postComments !== false) {
+      try {
+        await this.deps.postComment(issue2, `\u2705 Ralph verified this PR (${prUrl}) is mergeable (CI green, no conflicts) \u2014 moving to done`);
+      } catch (err) {
+        this.deps.onLog(`! Linear done comment failed for ${issue2.identifier}: ${err.message}`, "yellow");
+      }
+    }
+  }
   errorMarkerCleared(issue2) {
     const se = this.opts.setError;
     if (!se)
@@ -106310,9 +106419,12 @@ class AgentCoordinator {
   async notifyExited(issue2, changeName, code, trigger, workerCwd) {
     const noChanges = code === NO_CHANGES_EXIT;
     const ok = code === 0 || noChanges;
+    const isRecoveryTrigger = trigger === "conflict-fix" || trigger === "ci-fix";
+    const prOpened = this.deps.hasPrForChange?.(changeName) ?? false;
+    const deferDone = ok && !isRecoveryTrigger && !!this.opts.createsPrs && prOpened && !!this.opts.prRecovery?.enabled;
     const changeDir = this.deps.getChangeDir?.(issue2) ?? undefined;
     const exitActor = await this.flowStore.getActor(issue2.id, changeDir);
-    exitActor.send({ type: ok ? "WORKER_SUCCEEDED" : "WORKER_FAILED" });
+    exitActor.send({ type: !ok ? "WORKER_FAILED" : deferDone ? "PR_OPENED" : "WORKER_SUCCEEDED" });
     if (changeDir) {
       await this.flowStore.persistActor(issue2.id, changeDir).catch(() => {});
     }
@@ -106365,6 +106477,8 @@ class AgentCoordinator {
       } else if (trigger === "ci-fix") {
         this.ciFailedNotified.delete(issue2.id);
         this.conflictPromoted.delete(issue2.id);
+      } else if (deferDone) {
+        this.deps.onLog(`  ${issue2.identifier}: PR open \u2014 deferring setDone to the PR-recovery watcher`, "gray");
       } else if (this.opts.setDone) {
         try {
           await this.deps.applyIndicator(issue2, this.opts.setDone);
@@ -106446,6 +106560,7 @@ var emptyPrStatus = () => ({
 });
 var init_coordinator = __esm(() => {
   init_types2();
+  init_linear_client();
   init_post_task();
   init_queue_order();
   init_src();
@@ -106983,7 +107098,7 @@ function issueInAwaitingStatus(issue2, indicators) {
 async function releaseAwaitingMarker(issue2, statePath, deps) {
   const { stateObj, confirmation } = await readConfirmationState(statePath);
   if (!confirmation.awaitingMarkerAppliedAt && !issueInAwaitingStatus(issue2, deps.indicators)) {
-    return;
+    return false;
   }
   if (deps.indicators.clearAwaitingConfirmation) {
     try {
@@ -107005,6 +107120,7 @@ async function releaseAwaitingMarker(issue2, statePath, deps) {
   } catch (err) {
     deps.onLog(`! persist cleared awaitingMarkerAppliedAt for ${issue2.identifier}: ${err.message}`, "yellow");
   }
+  return true;
 }
 function confirmationUsesCommentIndicator(cfg) {
   const { getApproved, getAutoApprove, getConfirmGate } = cfg.linear.indicators;
@@ -107066,13 +107182,15 @@ async function processAwaitingForIssue(issue2, deps) {
       persistedConfirmation: confirmation
     });
     if (!active) {
-      deps.awaitingChangeSet.delete(changeName);
-      await releaseAwaitingMarker(issue2, statePath, {
+      const wasTracked = deps.awaitingChangeSet.delete(changeName);
+      const released = await releaseAwaitingMarker(issue2, statePath, {
         indicators,
         applyIndicator: deps.applyIndicator,
         onLog: deps.onLog
       });
-      deps.onLog(`  ${issue2.identifier}: confirmation detect released \u2014 gate-cleared`);
+      if (wasTracked || released) {
+        deps.onLog(`  ${issue2.identifier}: confirmation detect released \u2014 gate-cleared`);
+      }
       return false;
     }
     if (!hasUnchecked(tasks2 ?? "")) {
@@ -107216,8 +107334,28 @@ function parsePrNumber(url2) {
   const m = PR_NUMBER_RE.exec(url2);
   return m ? Number(m[1]) : null;
 }
+function pickDependencyTip(candidates, blockedByOfCandidate) {
+  const candidateIds = new Set(candidates.map((c) => c.blockerId));
+  const upstream = new Set;
+  for (const c of candidates) {
+    const blockers = blockedByOfCandidate.get(c.blockerId) ?? new Set;
+    for (const otherId of blockers) {
+      if (otherId !== c.blockerId && candidateIds.has(otherId))
+        upstream.add(otherId);
+    }
+  }
+  const tips = candidates.filter((c) => !upstream.has(c.blockerId));
+  return tips.length === 1 ? tips[0] : null;
+}
 async function resolveDependencyBaseBranchImpl(issue2, runner, runnerCwd, deps) {
-  const blockerIds = issue2.blockedByIds;
+  let blockerIds;
+  try {
+    const live = await fetchBlockedByForIssues(deps.apiKey, [issue2.id]);
+    blockerIds = (live.get(issue2.id) ?? []).map((b) => b.id);
+  } catch (err) {
+    deps.onLog(`! could not refresh blockers for ${issue2.identifier}: ${err.message}`, "yellow");
+    blockerIds = issue2.blockedByIds;
+  }
   if (blockerIds.length === 0)
     return null;
   let attachmentsByBlocker;
@@ -107251,17 +107389,30 @@ async function resolveDependencyBaseBranchImpl(issue2, runner, runnerCwd, deps)
       }
     }
     if (openPrs.length === 1) {
-      candidates.push(openPrs[0]);
+      candidates.push({ blockerId, base: openPrs[0] });
     } else if (openPrs.length > 1) {
       deps.onLog(`  ${issue2.identifier}: blocker ${blockerId} has ${openPrs.length} open PRs \u2014 skipping dependency base resolution`, "gray");
     }
   }
   if (candidates.length === 1)
-    return candidates[0];
-  if (candidates.length > 1) {
-    deps.onLog(`  ${issue2.identifier}: ${candidates.length} blockers have open PRs \u2014 falling back to default base`, "gray");
+    return candidates[0].base;
+  if (candidates.length === 0)
+    return null;
+  let blockedByOfCandidate;
+  try {
+    const map3 = await fetchBlockedByForIssues(deps.apiKey, candidates.map((c) => c.blockerId));
+    blockedByOfCandidate = new Map([...map3.entries()].map(([id, refs]) => [id, new Set(refs.map((r) => r.id))]));
+  } catch (err) {
+    deps.onLog(`! could not resolve dependency order for ${issue2.identifier}: ${err.message}`, "yellow");
+    return null;
   }
-  return null;
+  const tip = pickDependencyTip(candidates, blockedByOfCandidate);
+  if (!tip) {
+    deps.onLog(`  ${issue2.identifier}: ${candidates.length} blockers have open PRs with no single dependency tip \u2014 falling back to default base`, "gray");
+    return null;
+  }
+  deps.onLog(`  ${issue2.identifier}: ${candidates.length} blockers have open PRs \u2014 stacking onto tip ${tip.base.blockerIdentifier ?? tip.blockerId}`, "gray");
+  return tip.base;
 }
 function createOpenDraftPr(deps) {
   const create3 = deps.createPr ?? createPullRequest;
@@ -107305,11 +107456,18 @@ function traceCmdRunner(base2, onStart, onEnd) {
     }
   };
 }
-var bunGitRunner, bunCmdRunner;
+var ghAuthEnv = () => scrubGithubAppTokenEnv(), bunGitRunner, bunCmdRunner;
 var init_runners = __esm(() => {
+  init_preflight();
   bunGitRunner = {
     run: async (args, cwd2) => {
-      const proc = Bun.spawn({ cmd: ["git", ...args], cwd: cwd2, stdout: "pipe", stderr: "pipe" });
+      const proc = Bun.spawn({
+        cmd: ["git", ...args],
+        cwd: cwd2,
+        env: ghAuthEnv(),
+        stdout: "pipe",
+        stderr: "pipe"
+      });
       const stdout = await new Response(proc.stdout).text();
       const stderr = await new Response(proc.stderr).text();
       const code = await proc.exited;
@@ -107327,7 +107485,7 @@ var init_runners = __esm(() => {
   };
   bunCmdRunner = {
     run: async (cmd, cwd2) => {
-      const proc = Bun.spawn({ cmd, cwd: cwd2, stdout: "pipe", stderr: "pipe" });
+      const proc = Bun.spawn({ cmd, cwd: cwd2, env: ghAuthEnv(), stdout: "pipe", stderr: "pipe" });
       const stdout = await new Response(proc.stdout).text();
       const stderr = await new Response(proc.stderr).text();
       const code = await proc.exited;
@@ -107392,7 +107550,7 @@ var init_indicators = __esm(() => {
 
 // apps/agent/src/agent/wire/linear-resolvers.ts
 function createLinearResolvers(input) {
-  const { apiKey, team, assignee, anyAssignee, diag } = input;
+  const { apiKey, team, assignee, anyAssignee, requireAllLabels, diag } = input;
   const ticketNumbers = input.ticketNumbers ?? [];
   const stateCache = new Map;
   const labelCache = new Map;
@@ -107509,6 +107667,7 @@ function createLinearResolvers(input) {
       team,
       assignee,
       anyAssignee,
+      requireAllLabels,
       include,
       exclude: excl,
       ...ticketNumbers.length > 0 ? { numbers: ticketNumbers } : {}
@@ -107531,7 +107690,18 @@ function createLinearResolvers(input) {
     resolveLabelIdForTeam
   };
 }
-async function fetchDoneCandidatesWith(apiKey, team, _assignee, indicators, ticketNumbers) {
+function doneCandidateSpec(team, assignee, anyAssignee, requireAllLabels, include, ticketNumbers) {
+  return {
+    team,
+    assignee,
+    anyAssignee,
+    requireAllLabels,
+    include,
+    exclude: [],
+    ...ticketNumbers && ticketNumbers.length > 0 ? { numbers: ticketNumbers } : {}
+  };
+}
+async function fetchDoneCandidatesWith(apiKey, team, assignee, anyAssignee, requireAllLabels, indicators, ticketNumbers) {
   const getIndicators = [
     indicators.getTodo,
     indicators.getInProgress,
@@ -107550,13 +107720,7 @@ async function fetchDoneCandidatesWith(apiKey, team, _assignee, indicators, tick
     const include = ind.filter ?? [];
     if (include.length === 0)
       return;
-    const issues = await fetchOpenIssues(apiKey, {
-      team,
-      anyAssignee: true,
-      include,
-      exclude: [],
-      ...ticketNumbers && ticketNumbers.length > 0 ? { numbers: ticketNumbers } : {}
-    });
+    const issues = await fetchOpenIssues(apiKey, doneCandidateSpec(team, assignee, anyAssignee, requireAllLabels, include, ticketNumbers));
     for (const issue2 of issues) {
       if (!seen.has(issue2.id)) {
         seen.add(issue2.id);
@@ -107593,6 +107757,7 @@ function createPrepareHelpers(input) {
     maps,
     scriptRunner
   } = input;
+  const worktreeProvider = input.worktreeProvider ?? defaultWorktreeProvider;
   async function runScript(label, cmd, cwd2) {
     diag("script", `  ${label}: ${cmd}`, "gray");
     const code = await scriptRunner(cmd, cwd2);
@@ -107611,7 +107776,7 @@ function createPrepareHelpers(input) {
     const baseBranch = baseBranchFromLabels(issue2.labels) ?? cfg.prBaseBranch;
     let wt;
     try {
-      wt = await runCapability(git.createWorktree, {
+      wt = await worktreeProvider.create({
         projectRoot,
         changeName: probeName,
         baseBranch,
@@ -107628,7 +107793,7 @@ function createPrepareHelpers(input) {
     scaffoldStatesDir = wtLayout.statesDir;
     diag("worktree", `  ${issue2.identifier} worktree: ${wt.cwd} (${wt.branch})`, "gray");
     try {
-      await runCapability(git.seedWorktreeMcpConfig, {
+      await worktreeProvider.seedMcpConfig({
         projectRoot,
         worktreeCwd: wt.cwd
       });
@@ -107824,6 +107989,7 @@ PR: ${ciPrUrl}` : ""
   }
   return { prepare, prepareTaskForTrigger, runScript, reactivateState: reactivateState2 };
 }
+var defaultWorktreeProvider;
 var init_prepare = __esm(() => {
   init_layout();
   init_tasks_md();
@@ -107834,6 +108000,10 @@ var init_prepare = __esm(() => {
   init_scaffold();
   init_worktree();
   init_task_bodies();
+  defaultWorktreeProvider = {
+    create: (args) => runCapability(git.createWorktree, args),
+    seedMcpConfig: (args) => runCapability(git.seedWorktreeMcpConfig, args)
+  };
 });
 
 // apps/agent/src/agent/pr-url/index.ts
@@ -107893,9 +108063,65 @@ var init_pr_url = __esm(() => {
   init_task_bodies();
 });
 
+// apps/agent/src/agent/ci.ts
+function parseChecks(stdout) {
+  try {
+    const parsed = JSON.parse(stdout || "[]");
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+async function getPrChecksStatus(prRef, runner, cwd2, onTransientRetry, ignoreCiChecks = []) {
+  let out;
+  try {
+    out = await runGhWithRetry(["gh", "pr", "checks", prRef, "--json", PR_CHECKS_FIELDS], runner, cwd2, onTransientRetry);
+  } catch (err) {
+    const e = err;
+    const blob = `${e.message}
+${e.stderr ?? ""}
+${e.stdout ?? ""}`;
+    if (NO_CHECKS_RE.test(blob))
+      return { bucket: "pass", failedRunIds: [], failedCheckNames: [] };
+    if (PARTIAL_ACCESS_RE.test(blob) && parseChecks(e.stdout).length > 0) {
+      out = { stdout: e.stdout, stderr: e.stderr ?? "" };
+    } else {
+      throw err;
+    }
+  }
+  const ignoredLower = ignoreCiChecks.map((n) => n.toLowerCase());
+  const checks3 = parseChecks(out.stdout).filter((c) => !ignoredLower.includes(c.name.toLowerCase())).filter((c) => classifyGhBucket(c.bucket) !== "skip");
+  if (checks3.some((c) => classifyGhBucket(c.bucket) === "pending")) {
+    return { bucket: "pending", failedRunIds: [], failedCheckNames: [] };
+  }
+  const failed = checks3.filter((c) => classifyGhBucket(c.bucket) === "fail");
+  if (failed.length === 0)
+    return { bucket: "pass", failedRunIds: [], failedCheckNames: [] };
+  const ids = new Set;
+  for (const c of failed) {
+    const m = c.link?.match(/\/actions\/runs\/(\d+)/);
+    if (m)
+      ids.add(m[1]);
+  }
+  return { bucket: "fail", failedRunIds: [...ids], failedCheckNames: failed.map((c) => c.name) };
+}
+var PR_CHECKS_FIELDS = "name,bucket,link,workflow,event";
+var init_ci = __esm(() => {
+  init_ci_classify();
+});
+
 // apps/agent/src/agent/wire/pr-discovery.ts
 function createPrDiscovery(input) {
-  const { apiKey, projectRoot, cmdRunner, onLog, diag, prByChange, getPollContext } = input;
+  const {
+    apiKey,
+    projectRoot,
+    cmdRunner,
+    onLog,
+    diag,
+    prByChange,
+    getPollContext,
+    ignoreCiChecks
+  } = input;
   const prUnavailable = new Map;
   const prUrlByIssue = createPrUrlCache(5 * 60 * 1000);
   function isPrUnavailable(changeName) {
@@ -107967,9 +108193,11 @@ function createPrDiscovery(input) {
     if (outcome.kind === "conflicting")
       return { url: prUrl, status: "conflicted" };
     try {
-      const ci = await getPrChecksStatus(prUrl, cmdRunner, projectRoot);
+      const ci = await getPrChecksStatus(prUrl, cmdRunner, projectRoot, undefined, ignoreCiChecks);
       if (ci.bucket === "fail")
         return { url: prUrl, status: "ci_failed" };
+      if (ci.bucket === "pending")
+        return { url: prUrl, status: "unknown" };
     } catch (err) {
       diag("ci", `! gh pr checks ${prUrl} failed (PR scan): ${err.message}`, "yellow");
     }
@@ -108250,6 +108478,7 @@ function createMentionScanner(input) {
     team,
     assignee,
     anyAssignee,
+    requireAllLabels,
     indicators,
     projectRoot,
     useWorktree,
@@ -108274,6 +108503,7 @@ function createMentionScanner(input) {
         team,
         assignee,
         anyAssignee,
+        ...requireAllLabels && requireAllLabels.length > 0 ? { requireAllLabels } : {},
         ...ticketNumbers && ticketNumbers.length > 0 ? { numbers: ticketNumbers } : {},
         indicators: {
           ...indicators.getTodo !== undefined ? { getTodo: indicators.getTodo } : {},
@@ -108430,6 +108660,31 @@ var init_mention_scan = __esm(() => {
   init_task_bodies();
 });
 
+// packages/core/src/main-checkout-sentinel/index.ts
+function isEmptySentinel(s) {
+  return s.head === "" && s.entries.length === 0;
+}
+async function snapshotCheckout(root, runner) {
+  try {
+    const head3 = await runner.run(["rev-parse", "HEAD"], root);
+    const status = await runner.run(["status", "--porcelain"], root);
+    const entries = status.stdout.split(`
+`).map((line) => line.trim()).filter((line) => line.length > 0).sort();
+    return { head: head3.stdout.trim(), entries };
+  } catch {
+    return { head: "", entries: [] };
+  }
+}
+function detectCheckoutLeak(before2, after2) {
+  if (isEmptySentinel(before2) || isEmptySentinel(after2)) {
+    return { leaked: false, headMoved: false, newEntries: [] };
+  }
+  const beforeSet = new Set(before2.entries);
+  const newEntries = after2.entries.filter((e) => !beforeSet.has(e));
+  const headMoved = before2.head !== "" && after2.head !== "" && before2.head !== after2.head;
+  return { leaked: newEntries.length > 0 || headMoved, headMoved, newEntries };
+}
+
 // apps/agent/src/agent/wire/spawn/default.ts
 import { join as join30 } from "path";
 function defaultSpawn(changeName, cmd, cwd2, logsDir, onWorkerOutput, note) {
@@ -108517,7 +108772,7 @@ function dispositionFromExitCode(code) {
       return "done";
     case NO_CHANGES_EXIT2:
       return "no-changes";
-    case CI_FAILED_EXIT2:
+    case CI_FAILED_EXIT:
       return "ci-failed";
     case PR_FAILED_EXIT2:
       return "pr-failed";
@@ -108525,7 +108780,7 @@ function dispositionFromExitCode(code) {
       return "error";
   }
 }
-var CI_FAILED_EXIT2 = 70, PR_FAILED_EXIT2 = 71, NO_CHANGES_EXIT2 = 72;
+var CI_FAILED_EXIT = 70, PR_FAILED_EXIT2 = 71, NO_CHANGES_EXIT2 = 72;
 
 // packages/retro/src/paths.ts
 import { homedir as homedir7 } from "os";
@@ -108752,17 +109007,13 @@ function buildPostTaskInput(input) {
     exitCode: input.exitCode,
     useWorktree: input.useWorktree,
     wantPr: input.wantPr,
-    wantFixCi: input.wantFixCi,
     wantAutoMerge: input.wantAutoMerge,
     wantValidateOnly: input.wantValidateOnly,
     cfg: {
       teardownScript: cfg.teardownScript ?? null,
       prBaseBranch: cfg.prBaseBranch,
       autoMergeStrategy: cfg.autoMergeStrategy,
-      maxCiFixAttempts: cfg.maxCiFixAttempts,
-      ciPollIntervalSeconds: cfg.ciPollIntervalSeconds,
       cleanupWorktreeOnSuccess: cfg.cleanupWorktreeOnSuccess,
-      ignoreCiChecks: cfg.ignoreCiChecks,
       stackPrsOnDependencies: args.stackPrs || cfg.stackPrsOnDependencies,
       neverTouch: cfg.boundaries.never_touch,
       metaOnlyFiles: cfg.boundaries.meta_only_files,
@@ -108858,6 +109109,8 @@ function createSpawnWorker(input) {
       const f2 = Bun.file(missionTasksPath);
       return await f2.exists() ? await f2.text() : "";
     })();
+    const guardOn = useWorktree && cwd2 !== projectRoot;
+    const beforeSnapshotPromise = guardOn ? snapshotCheckout(projectRoot, gitRunner) : Promise.resolve(null);
     let logFilePath;
     let handle;
     if (injected) {
@@ -108878,10 +109131,29 @@ function createSpawnWorker(input) {
     onWorkerPhase?.(changeName, "working");
     const tracedCmd = onWorkerCmd ? traceCmdRunner(cmdRunner, (cmd) => onWorkerCmd(changeName, cmd, "start"), (cmd, ms, ok) => onWorkerCmd(changeName, cmd, "end", ms, ok)) : cmdRunner;
     const wantPrBase = args.createPr || cfg.createPrOnSuccess;
-    const wantFixCi = args.fixCi || cfg.fixCiOnFailure;
     const issueForChange = issueByChange.get(changeName);
     const wantAutoMerge = issueForChange ? issueMatchesGetIndicator(issueForChange, indicators.getAutoMerge) : false;
     const wrapped = handle.exited.then(async (code) => {
+      const before2 = await beforeSnapshotPromise;
+      if (before2) {
+        const after2 = await snapshotCheckout(projectRoot, gitRunner);
+        const leak = detectCheckoutLeak(before2, after2);
+        if (leak.leaked) {
+          const detail = [
+            leak.headMoved ? "HEAD moved" : null,
+            leak.newEntries.length > 0 ? leak.newEntries.join(", ") : null
+          ].filter(Boolean).join("; ");
+          const msg = `main checkout leak in ${projectRoot}: ${detail}`;
+          onLog(msg, "red");
+          diag("sentinel", msg, "red");
+          emitCapture(bus, "agent_main_checkout_leak", {
+            change_name: changeName,
+            head_moved: leak.headMoved,
+            leaked_paths: leak.newEntries,
+            ...issueForChange ? { issue_identifier: issueForChange.identifier } : {}
+          });
+        }
+      }
       const workerLayout = projectLayout(cwd2);
       const validateSpecPath = join33(workerLayout.changeDir(changeName), "specs", "validate.md");
       const hasValidateSpec = await Bun.file(validateSpecPath).exists();
@@ -108943,7 +109215,6 @@ function createSpawnWorker(input) {
         exitCode: code,
         useWorktree,
         wantPr,
-        wantFixCi,
         wantAutoMerge,
         wantValidateOnly,
         ...trigger ? { trigger } : {},
@@ -108976,16 +109247,6 @@ function createSpawnWorker(input) {
         ...onWorkerPhase && {
           onPhase: (phase2, detail) => onWorkerPhase(changeName, phase2, detail)
         },
-        checkPrConflict: async (prUrl) => {
-          const outcome = await waitForMergeability({
-            bailOnError: true,
-            probe: async () => {
-              const res = await tracedCmd.run(["gh", "pr", "view", prUrl, "--json", "state,mergeable,mergeStateStatus"], cwd2);
-              return JSON.parse(res.stdout || "{}");
-            }
-          });
-          return outcome.kind === "conflicting";
-        },
         resolveDependencyBaseBranch: (issue2) => resolveDependencyBaseBranchImpl(issue2, tracedCmd, cwd2, { apiKey, onLog })
       });
       releaseWorkerMaps({ cwdByChange, statesDirByChange, branchByChange, issueByChange }, changeName);
@@ -109003,7 +109264,6 @@ var init_worker = __esm(() => {
   init_default2();
   init_runners();
   init_pr_helpers();
-  init_wait_for_mergeability();
   init_agent_run_state();
   init_retro();
   init_engine();
@@ -261431,6 +261691,7 @@ function renderListItem(doc2, item, indent, marker) {
   const tokens = item.tokens ?? [];
   let inlineRun = [];
   let placedInline = false;
+  let renderedBlock = false;
   const placeInline = () => {
     if (inlineRun.length === 0)
       return;
@@ -261454,10 +261715,13 @@ function renderListItem(doc2, item, indent, marker) {
       continue;
     }
     placeInline();
+    if (!placedInline && !renderedBlock)
+      doc2.y = startY;
     renderBlock(doc2, tok, indent + LIST_INDENT);
+    renderedBlock = true;
   }
   placeInline();
-  if (!placedInline) {
+  if (!placedInline && !renderedBlock) {
     doc2.y = startY;
     doc2.text(" ", bodyX, startY, { width: bodyWidth });
   }
@@ -262432,8 +262696,7 @@ function buildAgentCoordinator(input) {
   const pollInterval = args.pollInterval || cfg.pollIntervalSeconds;
   const indicators = mergeIndicators(cfg.linear.indicators, args.indicators);
   const team = args.linearTeam || cfg.linear.team;
-  const effectiveFilter = args.linearFilter || (args.linearAssignee ? `assignee = ${args.linearAssignee}` : "") || cfg.linear.filter;
-  const { assignee, anyAssignee } = parseLinearFilter(effectiveFilter);
+  const { assignee, anyAssignee, requireAllLabels } = resolveLinearFilter(applyAssigneeOverride(cfg.linear.filter, args.linearAssignee));
   const ticketNumbers = resolveTicketNumbers(args.ticketTokens, team);
   const excludeFromTodo = unionMarkers(indicators.setDone, indicators.setError);
   const gitRunner = input.runners?.git ?? bunGitRunner;
@@ -262475,6 +262738,7 @@ function buildAgentCoordinator(input) {
     team,
     assignee,
     anyAssignee,
+    requireAllLabels,
     diag,
     ...ticketNumbers.length > 0 ? { ticketNumbers } : {}
   });
@@ -262491,7 +262755,8 @@ function buildAgentCoordinator(input) {
     onLog,
     diag,
     prByChange,
-    getPollContext: () => pollContext
+    getPollContext: () => pollContext,
+    ignoreCiChecks: cfg.prRecovery.ignoreChecks
   });
   const prep = createPrepareHelpers({
     args,
@@ -262504,7 +262769,8 @@ function buildAgentCoordinator(input) {
     gitRunner,
     diag,
     maps: { cwdByChange, statesDirByChange, issueByChange, branchByChange, prByChange },
-    scriptRunner
+    scriptRunner,
+    ...input.runners?.worktree ? { worktreeProvider: input.runners.worktree } : {}
   });
   const fetchMentions = createMentionScanner({
     apiKey,
@@ -262513,6 +262779,7 @@ function buildAgentCoordinator(input) {
     team,
     assignee,
     anyAssignee,
+    requireAllLabels,
     indicators,
     projectRoot,
     useWorktree,
@@ -262606,10 +262873,10 @@ function buildAgentCoordinator(input) {
       now: () => new Date
     };
   }
-  const prTrackerEnabled = args.prTrackerEnabled === undefined ? cfg.prTracker.enabled : args.prTrackerEnabled;
-  const prTracker = prTrackerEnabled ? new PrTracker({
+  const prRecoveryEnabled = args.prRecoveryEnabled === undefined ? cfg.prRecovery.enabled : args.prRecoveryEnabled;
+  const prTracker = prRecoveryEnabled ? new PrTracker({
     projectRoot,
-    maxRecoveryAttempts: cfg.prTracker.maxRecoveryAttempts
+    maxRecoveryAttempts: cfg.prRecovery.maxRecoverySessions
   }) : null;
   const commentSync = createCommentSyncHooks({
     apiKey,
@@ -262627,7 +262894,7 @@ function buildAgentCoordinator(input) {
     fetchTodo: () => resolvers.fetchByGet(indicators.getTodo, excludeFromTodo),
     fetchInProgress: () => resolvers.fetchByGet(indicators.getInProgress, unionMarkers(indicators.setError)),
     fetchMentions,
-    fetchDoneCandidates: () => fetchDoneCandidatesWith(apiKey, team, assignee, indicators, ticketNumbers.length > 0 ? ticketNumbers : undefined),
+    fetchDoneCandidates: () => fetchDoneCandidatesWith(apiKey, team, assignee, anyAssignee, requireAllLabels, indicators, ticketNumbers.length > 0 ? ticketNumbers : undefined),
     prepare: prep.prepare,
     prepareTaskForTrigger: prep.prepareTaskForTrigger,
     spawnWorker,
@@ -262639,6 +262906,7 @@ function buildAgentCoordinator(input) {
       return c.map((x2) => ({ body: x2.body }));
     },
     checkPrStatus: prDiscovery.checkPrStatus,
+    hasPrForChange: (changeName) => prByChange.has(changeName),
     isChangeArchivedForIssue: (issue2) => isChangeArchivedForIssue(issue2, cwdByChange, projectRoot),
     onLog,
     ...onFileLog ? { onFileLog } : {},
@@ -262675,7 +262943,13 @@ function buildAgentCoordinator(input) {
     postComments: cfg.linear.postComments,
     commentEveryIterations: cfg.linear.updateEveryIterations,
     ...args.maxTickets > 0 ? { maxTickets: args.maxTickets } : {},
-    ...prTracker ? { prTracker } : {}
+    createsPrs: args.createPr || cfg.createPrOnSuccess,
+    ...prTracker ? { prTracker } : {},
+    prRecovery: {
+      enabled: prRecoveryEnabled,
+      fixCi: cfg.prRecovery.fixCi,
+      fixConflicts: cfg.prRecovery.fixConflicts
+    }
   });
   coordRef.current = coord;
   const filterDesc = describeIndicators(indicators, team, assignee, anyAssignee);
@@ -262836,23 +263110,23 @@ function SteeringField({
   initialFocused = false,
   onStateChange
 }) {
-  const [state, dispatch] = import_react61.useReducer(reducer2, { initialBuffer, initialCursor, initialFocused }, (init2) => ({
+  const [state, dispatch] = import_react62.useReducer(reducer2, { initialBuffer, initialCursor, initialFocused }, (init2) => ({
     buffer: init2.initialBuffer,
     cursor: init2.initialCursor ?? init2.initialBuffer.length,
     focused: init2.initialFocused,
     status: "idle"
   }));
   const { buffer, cursor: cursor4, focused, status } = state;
-  const stateRef = import_react61.useRef(state);
+  const stateRef = import_react62.useRef(state);
   stateRef.current = state;
-  const hintTimerRef = import_react61.useRef(null);
-  import_react61.useEffect(() => {
+  const hintTimerRef = import_react62.useRef(null);
+  import_react62.useEffect(() => {
     onFocusChange?.(focused);
   }, [focused, onFocusChange]);
-  import_react61.useEffect(() => {
+  import_react62.useEffect(() => {
     onStateChange?.({ buffer, cursor: cursor4, focused });
   }, [buffer, cursor4, focused, onStateChange]);
-  import_react61.useEffect(() => {
+  import_react62.useEffect(() => {
     return () => {
       if (hintTimerRef.current)
         clearTimeout(hintTimerRef.current);
@@ -262961,10 +263235,10 @@ function SteeringField({
     ]
   }, undefined, true, undefined, this);
 }
-var import_react61, jsx_dev_runtime10, STATUS_HINT_MS = 2000, PLACEHOLDER_IDLE = "CTRL+S to steer", PLACEHOLDER_SENT = "steered \u2192 next iteration", PLACEHOLDER_FAILED = "send failed";
+var import_react62, jsx_dev_runtime10, STATUS_HINT_MS = 2000, PLACEHOLDER_IDLE = "CTRL+S to steer", PLACEHOLDER_SENT = "steered \u2192 next iteration", PLACEHOLDER_FAILED = "send failed";
 var init_SteeringField = __esm(async () => {
   await init_build2();
-  import_react61 = __toESM(require_react(), 1);
+  import_react62 = __toESM(require_react(), 1);
   jsx_dev_runtime10 = __toESM(require_jsx_dev_runtime(), 1);
 });
 
@@ -263333,21 +263607,35 @@ function AgentMode({
   const { exit } = use_app_default();
   const { isRawModeSupported } = use_stdin_default();
   const { columns, rows, resizeKey } = useTerminalSize();
-  const [logs, setLogs] = import_react62.useState([]);
-  const [preflightError, setPreflightError] = import_react62.useState(null);
-  const [, setTick] = import_react62.useState(0);
-  const [clock, setClock] = import_react62.useState(0);
-  const [focusedIdx, setFocusedIdx] = import_react62.useState(0);
-  const [showPendingTasks, setShowPendingTasks] = import_react62.useState(false);
-  const [showAllSubtasks, setShowAllSubtasks] = import_react62.useState(false);
-  const [gaveUpCount, setGaveUpCount] = import_react62.useState(0);
-  const coordRef = import_react62.useRef(null);
-  const workerMetaRef = import_react62.useRef(new Map);
-  const gatedTicketsRef = import_react62.useRef(new Map);
-  const nextPollAtRef = import_react62.useRef(0);
-  const cfgRef = import_react62.useRef(null);
-  const [effective, setEffective] = import_react62.useState(null);
-  const [pollStatus, setPollStatus] = import_react62.useState({
+  const [logs, setLogs] = import_react63.useState([]);
+  const [preflightError, setPreflightError] = import_react63.useState(null);
+  const [fatalExit, setFatalExit] = import_react63.useState(null);
+  const heldRef = import_react63.useRef(false);
+  const { awaitingClose } = useHoldToClose({
+    finished: fatalExit !== null,
+    hold: true,
+    onClose: () => {
+      const code = heldRef.current ? 0 : fatalExit ?? 0;
+      setTimeout(() => process.exit(code), 200);
+    }
+  });
+  import_react63.useEffect(() => {
+    if (awaitingClose)
+      heldRef.current = true;
+  }, [awaitingClose]);
+  const [, setTick] = import_react63.useState(0);
+  const [clock, setClock] = import_react63.useState(0);
+  const [focusedIdx, setFocusedIdx] = import_react63.useState(0);
+  const [showPendingTasks, setShowPendingTasks] = import_react63.useState(false);
+  const [showAllSubtasks, setShowAllSubtasks] = import_react63.useState(false);
+  const [gaveUpCount, setGaveUpCount] = import_react63.useState(0);
+  const coordRef = import_react63.useRef(null);
+  const workerMetaRef = import_react63.useRef(new Map);
+  const gatedTicketsRef = import_react63.useRef(new Map);
+  const nextPollAtRef = import_react63.useRef(0);
+  const cfgRef = import_react63.useRef(null);
+  const [effective, setEffective] = import_react63.useState(null);
+  const [pollStatus, setPollStatus] = import_react63.useState({
     state: "idle",
     lastFound: null,
     lastAdded: null,
@@ -263360,14 +263648,14 @@ function AgentMode({
     setLogs((prev) => [...prev, { id: nextId(), text, color }]);
     logCoord(text, workerLogFile);
   }
-  const fileSinkRef = import_react62.useRef(null);
+  const fileSinkRef = import_react63.useRef(null);
   if (fileSinkRef.current === null) {
     fileSinkRef.current = createJsonLogFileSink(args.jsonLogFile);
   }
   const fileEmit = (event) => {
     fileSinkRef.current?.emit(event);
   };
-  import_react62.useEffect(() => {
+  import_react63.useEffect(() => {
     let pollTimer = null;
     let cancelled = false;
     async function init2() {
@@ -263380,15 +263668,14 @@ function AgentMode({
       if (!apiKey) {
         throw new Error("LINEAR_API_KEY not set \u2014 cannot poll Linear");
       }
-      const pf = await runPreflight2();
+      const pf = await runPreflight2({
+        requireRepoWrite: args.createPr || cfg2.createPrOnSuccess,
+        repoCwd: projectRoot
+      });
       if (!pf.ok) {
         fileEmit({ type: "error", code: "auth_failure", tool: pf.tool, text: pf.message });
         setPreflightError({ tool: pf.tool, message: pf.message });
-        process.exitCode = 2;
-        setTimeout(() => {
-          exit();
-          setTimeout(() => process.exit(2), 200);
-        }, 100);
+        setFatalExit(2);
         return;
       }
       const { coord: coord2, filterDesc, concurrency, pollInterval, runBaselineGate: runBaselineGate2, getGaveUpTotal } = buildCoordinator({
@@ -263564,10 +263851,7 @@ function AgentMode({
       const message = err instanceof Error ? err.message : String(err);
       fileEmit({ type: "error", code: "init_failure", text: message });
       appendLog(`! ${message}`, "red");
-      setTimeout(() => {
-        exit();
-        setTimeout(() => process.exit(1), 200);
-      }, 100);
+      setFatalExit(1);
     });
     let shuttingDown = false;
     const onSig = () => {
@@ -263610,8 +263894,8 @@ function AgentMode({
       process.off("SIGTERM", onSig);
     };
   }, []);
-  const lastPauseRef = import_react62.useRef(null);
-  import_react62.useEffect(() => {
+  const lastPauseRef = import_react63.useRef(null);
+  import_react63.useEffect(() => {
     let cancelled = false;
     const interval = setInterval(() => {
       if (cancelled)
@@ -263675,10 +263959,10 @@ function AgentMode({
   const termWidth = columns - 2;
   const termHeight = rows;
   const safeFocusedIdx = activeCount > 0 ? Math.min(focusedIdx, activeCount - 1) : 0;
-  const steeringFocusedRef = import_react62.useRef(false);
-  const steeringBufferRef = import_react62.useRef("");
-  const steeringCursorRef = import_react62.useRef(0);
-  const steeringFocusedInitRef = import_react62.useRef(false);
+  const steeringFocusedRef = import_react63.useRef(false);
+  const steeringBufferRef = import_react63.useRef("");
+  const steeringCursorRef = import_react63.useRef(0);
+  const steeringFocusedInitRef = import_react63.useRef(false);
   use_input_default((input, key) => {
     if (steeringFocusedRef.current)
       return;
@@ -263730,7 +264014,15 @@ function AgentMode({
         /* @__PURE__ */ jsx_dev_runtime11.jsxDEV(Text, {
           color: "red",
           children: preflightError.message
-        }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        awaitingClose && /* @__PURE__ */ jsx_dev_runtime11.jsxDEV(Text, {
+          color: "cyan",
+          children: [
+            `
+`,
+            "Press Enter to close\u2026"
+          ]
+        }, undefined, true, undefined, this)
       ]
     }, undefined, true, undefined, this);
   }
@@ -263847,10 +264139,13 @@ function AgentMode({
                         color: "green",
                         children: " \u25CF PR"
                       }, undefined, false, undefined, this),
-                      cfg.fixCiOnFailure && /* @__PURE__ */ jsx_dev_runtime11.jsxDEV(Text, {
+                      cfg.prRecovery.enabled && /* @__PURE__ */ jsx_dev_runtime11.jsxDEV(Text, {
                         color: "green",
-                        children: " \u25CF fixCI"
-                      }, undefined, false, undefined, this),
+                        children: [
+                          " \u25CF recover",
+                          cfg.prRecovery.fixCi ? "+CI" : ""
+                        ]
+                      }, undefined, true, undefined, this),
                       cfg.useWorktree && /* @__PURE__ */ jsx_dev_runtime11.jsxDEV(Text, {
                         color: "green",
                         children: " \u25CF worktree"
@@ -264750,11 +265045,15 @@ function AgentMode({
             }, w2.changeName, true, undefined, this);
           })
         ]
-      }, undefined, true, undefined, this)
+      }, undefined, true, undefined, this),
+      awaitingClose && /* @__PURE__ */ jsx_dev_runtime11.jsxDEV(Text, {
+        color: "cyan",
+        children: "Stopped \u2014 press Enter to close\u2026"
+      }, undefined, false, undefined, this)
     ]
   }, resizeKey, true, undefined, this);
 }
-var import_react62, jsx_dev_runtime11, lineCounter = 0, TAIL_BUFFER_SIZE = 30, CMD_DISPLAY_MAX = 80, MAX_PENDING_DISPLAY = 15, SPINNER_FRAMES, HYPERLINKS_SUPPORTED, SESSION_START;
+var import_react63, jsx_dev_runtime11, lineCounter = 0, TAIL_BUFFER_SIZE = 30, CMD_DISPLAY_MAX = 80, MAX_PENDING_DISPLAY = 15, SPINNER_FRAMES, HYPERLINKS_SUPPORTED, SESSION_START;
 var init_AgentMode = __esm(async () => {
   init_cli2();
   init_config();
@@ -264770,9 +265069,10 @@ var init_AgentMode = __esm(async () => {
   init_worker_state_poll();
   await __promiseAll([
     init_build2(),
+    init_useHoldToClose(),
     init_SteeringField()
   ]);
-  import_react62 = __toESM(require_react(), 1);
+  import_react63 = __toESM(require_react(), 1);
   jsx_dev_runtime11 = __toESM(require_jsx_dev_runtime(), 1);
   SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
   HYPERLINKS_SUPPORTED = !process.env["TMUX"];
@@ -264834,7 +265134,7 @@ function createSession(name, command, env3) {
     envArgs.push("-e", `${key}=${value}`);
   }
   const quoted = command.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
-  const shellCmd = `${quoted}; printf '\\n[ralphy exited \u2014 press Enter to close]\\n'; read`;
+  const shellCmd = `${quoted}; code=$?; ` + `if [ "$code" -ne 0 ]; then ` + `printf '\\n[ralphy crashed (exit %s) \u2014 press Enter to close]\\n' "$code"; read _; fi`;
   const result2 = Bun.spawnSync({
     cmd: ["tmux", "new-session", "-d", "-s", name, ...envArgs, "sh", "-c", shellCmd],
     stderr: "pipe"
@@ -265075,23 +265375,20 @@ function buildBuckets(indicators) {
     { label: "auto-merge", indicator: indicators.getAutoMerge, exclude: [] }
   ];
 }
-async function fetchBucketIssues(apiKey, bucket, team, assignee, anyAssignee, ticketNumbers) {
+async function fetchBucketIssues(apiKey, bucket, team, assignee, anyAssignee, requireAllLabels, ticketNumbers) {
   if (!bucket.indicator || bucket.indicator.filter.length === 0)
     return [];
   const spec = {
     team,
     assignee,
     anyAssignee,
+    requireAllLabels,
     include: bucket.indicator.filter,
     exclude: bucket.exclude,
     ...ticketNumbers.length > 0 ? { numbers: ticketNumbers } : {}
   };
   return fetchOpenIssues(apiKey, spec);
 }
-function resolveLinearFilter(filterOverride, assigneeOverride, configFilter) {
-  const effective = filterOverride || (assigneeOverride ? `assignee = ${assigneeOverride}` : "") || configFilter;
-  return parseLinearFilter(effective);
-}
 function formatReviewCell(prUrl, count) {
   if (!prUrl)
     return "-";
@@ -265138,13 +265435,13 @@ function backlogRankByIssueId(issues) {
   ordered.forEach((o, i) => rankById.set(o.id, i));
   return rankById;
 }
-async function fetchAndPrintLinear(apiKey, buckets, team, assignee, anyAssignee, cwd2, runner, ignoreCiChecks = [], checks3 = false, review = false, ticketNumbers = []) {
+async function fetchAndPrintLinear(apiKey, buckets, team, assignee, anyAssignee, requireAllLabels, cwd2, runner, ignoreCiChecks = [], checks3 = false, review = false, ticketNumbers = []) {
   const bucketResults = await Promise.all(buckets.map(async (bucket) => {
     if (!bucket.indicator || bucket.indicator.filter.length === 0) {
       return { bucket, issues: [], error: null };
     }
     try {
-      const issues = await fetchBucketIssues(apiKey, bucket, team, assignee, anyAssignee, ticketNumbers);
+      const issues = await fetchBucketIssues(apiKey, bucket, team, assignee, anyAssignee, requireAllLabels, ticketNumbers);
       return { bucket, issues, error: null };
     } catch (err) {
       return {
@@ -265270,7 +265567,6 @@ async function runList(input) {
       identifier: name,
       projectRoot,
       linearTeamOverride: input.linearTeamOverride,
-      linearFilterOverride: input.linearFilterOverride,
       linearAssigneeOverride: input.linearAssigneeOverride
     });
     return;
@@ -265281,7 +265577,7 @@ async function runList(input) {
   const apiKey = process.env["LINEAR_API_KEY"];
   const indicators = cfg.linear.indicators;
   const team = input.linearTeamOverride || cfg.linear.team;
-  const { assignee, anyAssignee } = resolveLinearFilter(input.linearFilterOverride, input.linearAssigneeOverride, cfg.linear.filter);
+  const { assignee, anyAssignee, requireAllLabels } = resolveLinearFilter(applyAssigneeOverride(cfg.linear.filter, input.linearAssigneeOverride));
   const buckets = buildBuckets(indicators);
   const anyConfigured = buckets.some((b2) => b2.indicator && b2.indicator.filter.length > 0);
   if (!anyConfigured) {
@@ -265321,7 +265617,7 @@ team: ${team}
   if (ticketNumbers.length > 0)
     process.stdout.write(`ticket: ${ticketNumbers.join(", ")}
 `);
-  await fetchAndPrintLinear(apiKey, buckets, team, assignee, anyAssignee, projectRoot, localCmdRunner, cfg.ignoreCiChecks, input.checks, input.review, ticketNumbers);
+  await fetchAndPrintLinear(apiKey, buckets, team, assignee, anyAssignee, requireAllLabels, projectRoot, localCmdRunner, cfg.prRecovery.ignoreChecks, input.checks, input.review, ticketNumbers);
 }
 function normalizeIdentifier(input) {
   let parsed;
@@ -265404,7 +265700,7 @@ async function runListDebug(input) {
   const cfg = await loadRalphyConfig(projectRoot, getArgs().workflowFile);
   const indicators = cfg.linear.indicators;
   const team = input.linearTeamOverride || cfg.linear.team;
-  const { assignee, anyAssignee } = resolveLinearFilter(input.linearFilterOverride, input.linearAssigneeOverride, cfg.linear.filter);
+  const { assignee, anyAssignee, requireAllLabels } = resolveLinearFilter(applyAssigneeOverride(cfg.linear.filter, input.linearAssigneeOverride));
   const assigneeLabel = anyAssignee ? "any" : assignee ?? "*";
   const normalized = normalizeIdentifier(identifier);
   if (!normalized) {
@@ -265448,6 +265744,13 @@ Per-bucket diagnostics:
     if (!assigneeMatches(issue2, assignee, anyAssignee)) {
       reasons.push(`assignee mismatch: issue=${issue2.assignee ? issue2.assignee.email ?? issue2.assignee.id : "unassigned"}, config=${assigneeLabel}`);
     }
+    if (requireAllLabels && requireAllLabels.length > 0) {
+      const issueLabels = new Set(issue2.labels.nodes.map((l3) => l3.name));
+      const missing = requireAllLabels.filter((label) => !issueLabels.has(label));
+      if (missing.length > 0) {
+        reasons.push(`missing required linear.filter label(s): ${missing.join(", ")}`);
+      }
+    }
     const includeMatches = bucket.indicator.filter.some((m2) => markerMatches(issue2, m2));
     if (!includeMatches) {
       const want = bucket.indicator.filter.map((m2) => `${m2.type}:${m2.value}`).join(" OR ");
@@ -265555,7 +265858,10 @@ async function runAgentJson({
     process.exitCode = 1;
     return;
   }
-  const pf = await runPreflight2();
+  const pf = await runPreflight2({
+    requireRepoWrite: args.createPr || cfg.createPrOnSuccess,
+    repoCwd: projectRoot
+  });
   if (!pf.ok) {
     emit3({ type: "error", code: "auth_failure", tool: pf.tool, text: pf.message });
     process.exitCode = 2;
@@ -265776,7 +266082,6 @@ async function main3(argv) {
     await runWithContext(createDefaultContext({ layout, args }), async () => {
       await runList2({
         linearTeamOverride: args.linearTeam,
-        linearFilterOverride: args.linearFilter,
         linearAssigneeOverride: args.linearAssignee,
         debug: args.debug,
         name: args.name,
@@ -265852,12 +266157,12 @@ async function main3(argv) {
     return 0;
   }
   await runWithContext(createDefaultContext({ layout, args }), async () => {
-    const { waitUntilExit } = render_default(import_react63.createElement(AgentMode, { args, projectRoot, statesDir, tasksDir }));
+    const { waitUntilExit } = render_default(import_react64.createElement(AgentMode, { args, projectRoot, statesDir, tasksDir }));
     await waitUntilExit();
   });
   return typeof process.exitCode === "number" ? process.exitCode : 0;
 }
-var import_react63;
+var import_react64;
 var init_src8 = __esm(async () => {
   init_context();
   init_layout();
@@ -265868,7 +266173,7 @@ var init_src8 = __esm(async () => {
     init_build2(),
     init_AgentMode()
   ]);
-  import_react63 = __toESM(require_react(), 1);
+  import_react64 = __toESM(require_react(), 1);
 });
 
 // apps/shell/src/index.ts
@@ -265957,11 +266262,21 @@ ${HELP}
   capture("command_run", { subcommand });
   bus.emit({ type: "command_run", subcommand });
   try {
-    if (shouldOfferSetup(subcommand, argv.slice(1))) {
+    if (CONFIG_SUBCOMMANDS.has(subcommand)) {
       try {
-        const { maybeRunSetupWizard: maybeRunSetupWizard2 } = await init_src4().then(() => exports_src);
+        const { maybeRunSetupWizard: maybeRunSetupWizard2, maybeUpgradeWorkflow: maybeUpgradeWorkflow2 } = await init_src4().then(() => exports_src);
         const { projectRoot, workflowFile } = parseWorkflowPathArgs(argv.slice(1));
-        await maybeRunSetupWizard2(projectRoot, workflowFile);
+        if (shouldOfferSetup(subcommand, argv.slice(1))) {
+          await maybeRunSetupWizard2(projectRoot, workflowFile);
+        }
+        if (await maybeUpgradeWorkflow2(projectRoot, workflowFile)) {
+          process.stdout.write(`
+WORKFLOW.md updated \u2014 re-run your command.
+`);
+          capture("command_exit", { subcommand, exit_code: 0 });
+          bus.emit({ type: "command_exit", subcommand, exit_code: 0 });
+          return 0;
+        }
       } catch (setupErr) {
         captureError("setup_wizard_error", setupErr, { subcommand });
       }