fifony 0.1.43 → 0.1.47

package/dist/{chunk-SOBLO4YZ.js → chunk-QH6VCTET.js}

@@ -1,13 +1,10 @@
 import {
   markIssueDirty,
   normalizeAgentProvider
-} from "./chunk-FJNH3G2Z.js";
-import {
-  logger
-} from "./chunk-DVU3CXWA.js";
+} from "./chunk-PI7Y77R3.js";
 import {
   renderPrompt
-} from "./chunk-ESWHDHH6.js";
+} from "./chunk-AAZKYWOY.js";
 import {
   SOURCE_MARKER,
   SOURCE_ROOT,
@@ -16,12 +13,15 @@ import {
   appendFileTail,
   idToSafePath,
   now
-} from "./chunk-42AMQAJG.js";
+} from "./chunk-VM5QAYP5.js";
+import {
+  logger
+} from "./chunk-PXTIWKLQ.js";
 
 // src/domains/workspace.ts
 import {
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync3,
   readdirSync as readdirSync2,
   readFileSync as readFileSync3,
   rmSync as rmSync2,
@@ -29,18 +29,18 @@ import {
   writeFileSync as writeFileSync3
 } from "fs";
 import { copyFile, mkdir, readdir, stat, writeFile } from "fs/promises";
-import { extname, join as join3, resolve } from "path";
-import { execSync } from "child_process";
+import { extname, join as join4, resolve } from "path";
+import { execSync as execSync2 } from "child_process";
 
 // src/agents/command-executor.ts
 import {
   appendFileSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   readFileSync,
   rmSync,
   writeFileSync
 } from "fs";
-import { join } from "path";
+import { join as join2 } from "path";
 import { env, execPath } from "process";
 import { spawn } from "child_process";
 import { createConnection } from "net";
@@ -115,16 +115,142 @@ function buildDockerPlanCommand(innerCommand, tempDir, image) {
   ].join(" ");
 }
 
+// src/domains/sandbox.ts
+import { existsSync as existsSync2, chmodSync, mkdirSync } from "fs";
+import { homedir as homedir2, platform, arch } from "os";
+import { join } from "path";
+import { execSync } from "child_process";
+var BIN_DIR = join(homedir2(), ".fifony", "bin");
+var AI_JAIL_BIN = join(BIN_DIR, "ai-jail");
+var BWRAP_BIN = join(BIN_DIR, "bwrap");
+function resolveLinuxArch() {
+  const cpu = arch();
+  if (cpu === "x64") return "x86_64";
+  if (cpu === "arm64") return "aarch64";
+  throw new Error(`Unsupported Linux architecture: ${cpu}`);
+}
+function resolveAiJailSuffix() {
+  const os = platform();
+  const cpu = arch();
+  if (os === "linux" && cpu === "x64") return "linux-x86_64";
+  if (os === "darwin" && cpu === "arm64") return "macos-aarch64";
+  if (os === "darwin" && cpu === "x64") return "macos-x86_64";
+  throw new Error(`Unsupported platform for ai-jail: ${os}-${cpu}`);
+}
+function downloadTarball(url, destDir, binaryName) {
+  mkdirSync(destDir, { recursive: true });
+  execSync(
+    `curl -fsSL "${url}" | tar xz -C "${destDir}"`,
+    { stdio: "pipe", timeout: 12e4 }
+  );
+  const binPath = join(destDir, binaryName);
+  if (!existsSync2(binPath)) {
+    throw new Error(`Binary ${binaryName} not found at ${binPath} after extraction`);
+  }
+  chmodSync(binPath, 493);
+}
+function downloadRawBinary(url, destPath) {
+  mkdirSync(join(destPath, ".."), { recursive: true });
+  execSync(
+    `curl -fsSL -o "${destPath}" "${url}"`,
+    { stdio: "pipe", timeout: 12e4 }
+  );
+  if (!existsSync2(destPath)) {
+    throw new Error(`Binary not found at ${destPath} after download`);
+  }
+  chmodSync(destPath, 493);
+}
+function isBwrapAvailable() {
+  if (platform() !== "linux") return true;
+  if (existsSync2(BWRAP_BIN)) {
+    try {
+      execSync(`"${BWRAP_BIN}" --version`, { stdio: "pipe", timeout: 3e3 });
+      return true;
+    } catch {
+    }
+  }
+  try {
+    execSync("which bwrap", { stdio: "pipe", timeout: 3e3 });
+    return true;
+  } catch {
+  }
+  return false;
+}
+function downloadBwrap() {
+  const linuxArch = resolveLinuxArch();
+  const url = `https://github.com/forattini-dev/bubblewrap/releases/latest/download/bwrap-linux-${linuxArch}`;
+  logger.info({ url, dest: BWRAP_BIN }, "[Sandbox] Downloading bubblewrap");
+  downloadRawBinary(url, BWRAP_BIN);
+  logger.info("[Sandbox] bubblewrap installed successfully");
+}
+function ensureBwrap() {
+  if (platform() !== "linux") return;
+  if (isBwrapAvailable()) return;
+  downloadBwrap();
+  if (!isBwrapAvailable()) {
+    throw new Error("Failed to install bubblewrap. Sandbox requires bwrap on Linux.");
+  }
+}
+function getBwrapEnv() {
+  if (existsSync2(BWRAP_BIN)) return { BWRAP_BIN };
+  return {};
+}
+function isAiJailInstalled() {
+  if (!existsSync2(AI_JAIL_BIN)) return false;
+  try {
+    execSync(`"${AI_JAIL_BIN}" --version`, { stdio: "pipe", timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getAiJailVersion() {
+  try {
+    return execSync(`"${AI_JAIL_BIN}" --version`, { stdio: "pipe", timeout: 5e3 }).toString().trim() || null;
+  } catch {
+    return null;
+  }
+}
+function downloadAiJail() {
+  const suffix = resolveAiJailSuffix();
+  const url = `https://github.com/akitaonrails/ai-jail/releases/latest/download/ai-jail-${suffix}.tar.gz`;
+  logger.info({ url, dest: AI_JAIL_BIN }, "[Sandbox] Downloading ai-jail");
+  downloadTarball(url, BIN_DIR, "ai-jail");
+  const version = getAiJailVersion();
+  logger.info({ version }, "[Sandbox] ai-jail installed successfully");
+}
+async function ensureAiJail() {
+  ensureBwrap();
+  if (!isAiJailInstalled()) downloadAiJail();
+  return AI_JAIL_BIN;
+}
+function buildSandboxCommand(command, worktreePath, extraRwPaths) {
+  const rwMaps = [...extraRwPaths ?? []];
+  const rwFlags = rwMaps.map((p) => `--rw-map "${p}"`).join(" ");
+  const escapedCommand = command.replace(/'/g, "'\\''");
+  const flags = [
+    "--exec",
+    "--no-docker",
+    "--no-display",
+    "--no-gpu",
+    "--no-status-bar",
+    rwFlags
+  ].filter(Boolean).join(" ");
+  const bwrapEnv = getBwrapEnv();
+  const envPrefix = bwrapEnv.BWRAP_BIN ? `BWRAP_BIN="${bwrapEnv.BWRAP_BIN}" ` : "";
+  return `cd "${worktreePath}" && ${envPrefix}"${AI_JAIL_BIN}" ${flags} -- sh -c '${escapedCommand}'`;
+}
+
 // src/agents/command-executor.ts
 function resolveDaemonScript() {
   const pkgRoot = process.env.FIFONY_PKG_ROOT;
   if (!pkgRoot) return null;
-  const compiled = join(pkgRoot, "dist", "agent", "pty-daemon.js");
-  if (existsSync2(compiled)) {
+  const compiled = join2(pkgRoot, "dist", "agent", "pty-daemon.js");
+  if (existsSync3(compiled)) {
     return { command: execPath, args: [compiled] };
   }
-  const source = join(pkgRoot, "src", "agents", "pty-daemon.ts");
-  if (existsSync2(source)) {
+  const source = join2(pkgRoot, "src", "agents", "pty-daemon.ts");
+  if (existsSync3(source)) {
     try {
       const require2 = createRequire(fileURLToPath(import.meta.url));
       const tsxCli = require2.resolve("tsx/cli");
@@ -154,6 +280,7 @@ var HOOK_RUNTIME_CONFIG = {
   autoReviewApproval: true,
   dockerExecution: false,
   dockerImage: "fifony-agent:latest",
+  sandboxExecution: false,
   afterCreateHook: "",
   beforeRunHook: "",
   afterRunHook: "",
@@ -162,7 +289,7 @@ var HOOK_RUNTIME_CONFIG = {
 async function waitForSocket(socketPath, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    if (existsSync2(socketPath)) return true;
+    if (existsSync3(socketPath)) return true;
     await new Promise((r) => setTimeout(r, 50));
   }
   return false;
@@ -179,7 +306,7 @@ async function runCommandWithTimeout(command, workspacePath, issue, config, prom
   };
   for (const [key, value] of Object.entries(extraEnv)) {
     if (value.length > 4e3) {
-      const valFile = join(workspacePath, `${key.toLowerCase()}.txt`);
+      const valFile = join2(workspacePath, `${key.toLowerCase()}.txt`);
       writeFileSync(valFile, value, "utf8");
       allVars[`${key}_FILE`] = valFile;
     } else {
@@ -191,7 +318,7 @@ async function runCommandWithTimeout(command, workspacePath, issue, config, prom
       allVars[key] = translatePaths(allVars[key], workspacePath);
     }
   }
-  const envFilePath = join(workspacePath, ".env.sh");
+  const envFilePath = join2(workspacePath, ".env.sh");
   const envFileLines = Object.entries(allVars).map(([k, v]) => `export ${k}='${String(v).replace(/'/g, "'\\''")}'`).join("\n");
   writeFileSync(envFilePath, envFileLines, "utf8");
   let effectiveCommand;
@@ -204,10 +331,15 @@ async function runCommandWithTimeout(command, workspacePath, issue, config, prom
       TARGET_ROOT,
       config.dockerImage
     );
+  } else if (config.sandboxExecution) {
+    await ensureAiJail();
+    const innerCommand = `. "${envFilePath}" && ${command}`;
+    const worktree = issue.worktreePath ?? workspacePath;
+    effectiveCommand = buildSandboxCommand(innerCommand, worktree, [workspacePath]);
   } else {
     effectiveCommand = `. "${envFilePath}" && ${command}`;
   }
-  const liveLogFile = join(workspacePath, "live-output.log");
+  const liveLogFile = join2(workspacePath, "live-output.log");
   if (outputFile) {
     try {
       const header = `# fifony stdout capture
@@ -222,8 +354,8 @@ async function runCommandWithTimeout(command, workspacePath, issue, config, prom
     }
   }
   if (!config.dockerExecution && DAEMON_SCRIPT) {
-    const socketPath = join(workspacePath, "agent.sock");
-    if (existsSync2(socketPath)) {
+    const socketPath = join2(workspacePath, "agent.sock");
+    if (existsSync3(socketPath)) {
       const { isDaemonAlive } = await import("./pid-manager-UBWXVSMD.js");
       if (isDaemonAlive(workspacePath)) {
         logger.info({ issueId: issue.id }, "[Agent] Live PTY daemon detected \u2014 reattaching to existing session");
@@ -241,17 +373,19 @@ async function runCommandWithTimeout(command, workspacePath, issue, config, prom
     const daemonArgs = JSON.stringify({
       command: effectiveCommand,
       workspacePath,
+      codePath: issue.worktreePath ?? workspacePath,
       issueId: issue.id,
       startedAt: new Date(started).toISOString(),
       commandSlice: command.slice(0, 200)
     });
+    const effectiveCwd = issue.worktreePath ?? workspacePath;
     const daemonProcess = spawn(DAEMON_SCRIPT.command, [...DAEMON_SCRIPT.args, daemonArgs], {
       detached: true,
       stdio: "ignore",
-      cwd: workspacePath
+      cwd: effectiveCwd
     });
     daemonProcess.unref();
-    logger.debug({ issueId: issue.id, daemonPid: daemonProcess.pid, command: command.slice(0, 120), cwd: workspacePath }, "[Agent] PTY daemon spawned");
+    logger.debug({ issueId: issue.id, daemonPid: daemonProcess.pid, command: command.slice(0, 120), cwd: effectiveCwd }, "[Agent] PTY daemon spawned");
     const socketReady = await waitForSocket(socketPath, 1e4);
     if (!socketReady) {
       logger.warn({ issueId: issue.id }, "[Agent] PTY daemon socket not ready \u2014 falling back to inline PTY");
@@ -272,17 +406,18 @@ async function runCommandWithTimeout(command, workspacePath, issue, config, prom
       }
       writeFileSync(liveLogFile, "", "utf8");
       return new Promise((resolve2) => {
+        const ptyEffectiveCwd = issue.worktreePath ?? workspacePath;
         const ptyProcess = nodePty.spawn("sh", ["-c", effectiveCommand], {
           name: "xterm-256color",
           cols: 220,
           rows: 50,
-          cwd: workspacePath,
+          cwd: ptyEffectiveCwd,
           env: process.env
         });
         const pid = ptyProcess.pid;
-        const pidFile = join(workspacePath, "agent.pid");
+        const pidFile = join2(workspacePath, "agent.pid");
         if (pid) {
-          logger.debug({ issueId: issue.id, pid, command: command.slice(0, 120), cwd: workspacePath }, "[Agent] Process spawned (PTY)");
+          logger.debug({ issueId: issue.id, pid, command: command.slice(0, 120), cwd: ptyEffectiveCwd }, "[Agent] Process spawned (PTY)");
           writeFileSync(pidFile, JSON.stringify({
             pid,
             issueId: issue.id,
@@ -409,7 +544,7 @@ Command exit code ${exitCode ?? "unknown"} after ${duration}ms.`) });
     if (child.stdin) {
       child.stdin.end();
     }
-    const pidFile = join(workspacePath, "agent.pid");
+    const pidFile = join2(workspacePath, "agent.pid");
     const pid = child.pid;
     if (pid) {
       logger.debug({ issueId: issue.id, pid, command: command.slice(0, 120), cwd: workspacePath }, "[Agent] Process spawned");
@@ -539,7 +674,7 @@ Command exit code ${code ?? "unknown"} after ${duration}ms.`) });
 }
 function attachToDaemon(socketPath, workspacePath, issue, config, started, outputFile, resultFile) {
   return new Promise((resolve2) => {
-    const daemonExitFile = join(workspacePath, "daemon.exit.json");
+    const daemonExitFile = join2(workspacePath, "daemon.exit.json");
     let output = "";
     let outputHeader = "";
     let outputBytes = 0;
@@ -651,8 +786,8 @@ Agent process stuck \u2014 no output for ${Math.round(AGENT_STALE_OUTPUT_MS / 6e
   });
 }
 async function writeToDaemon(workspacePath, text) {
-  const socketPath = join(workspacePath, "agent.sock");
-  if (!existsSync2(socketPath)) return;
+  const socketPath = join2(workspacePath, "agent.sock");
+  if (!existsSync3(socketPath)) return;
   return new Promise((resolve2) => {
     const sock = createConnection(socketPath);
     const cleanup = () => {
@@ -957,13 +1092,13 @@ async function buildProviderBasePrompt(provider, issue, basePrompt, workspacePat
 
 // src/agents/memory-engine.ts
 import {
-  existsSync as existsSync3,
-  mkdirSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync2,
   readdirSync,
   readFileSync as readFileSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var MEMORY_DIRNAME = "memory";
 var WORKFLOW_FILE = "WORKFLOW.md";
 var MEMORY_FILE = "MEMORY.md";
@@ -972,19 +1107,19 @@ function resolveTodayDate(value = now()) {
   return value.slice(0, 10);
 }
 function resolvePaths(workspacePath, date = resolveTodayDate()) {
-  const memoryDir = join2(workspacePath, MEMORY_DIRNAME);
+  const memoryDir = join3(workspacePath, MEMORY_DIRNAME);
   return {
     root: workspacePath,
     memoryDir,
-    workflowFile: join2(workspacePath, WORKFLOW_FILE),
-    memoryFile: join2(workspacePath, MEMORY_FILE),
-    heartbeatFile: join2(workspacePath, HEARTBEAT_FILE),
-    dailyFile: join2(memoryDir, `${date}.md`)
+    workflowFile: join3(workspacePath, WORKFLOW_FILE),
+    memoryFile: join3(workspacePath, MEMORY_FILE),
+    heartbeatFile: join3(workspacePath, HEARTBEAT_FILE),
+    dailyFile: join3(memoryDir, `${date}.md`)
   };
 }
 function readText(filePath) {
   try {
-    return existsSync3(filePath) ? readFileSync2(filePath, "utf8") : "";
+    return existsSync4(filePath) ? readFileSync2(filePath, "utf8") : "";
   } catch {
     return "";
   }
@@ -996,7 +1131,7 @@ function writeIfChanged(filePath, next) {
   return true;
 }
 function ensureFile(filePath, initial) {
-  if (existsSync3(filePath)) return false;
+  if (existsSync4(filePath)) return false;
   writeFileSync2(filePath, initial, "utf8");
   return true;
 }
@@ -1185,13 +1320,13 @@ function appendUniqueEntry(filePath, entry) {
   return true;
 }
 function listRecentDailyFiles(memoryDir) {
-  if (!existsSync3(memoryDir)) return [];
-  return readdirSync(memoryDir).filter((entry) => entry.endsWith(".md")).sort((left, right) => right.localeCompare(left)).slice(0, 3).map((entry) => join2(memoryDir, entry));
+  if (!existsSync4(memoryDir)) return [];
+  return readdirSync(memoryDir).filter((entry) => entry.endsWith(".md")).sort((left, right) => right.localeCompare(left)).slice(0, 3).map((entry) => join3(memoryDir, entry));
 }
 function ensureWorkspaceMemoryFiles(issue, workspacePath) {
   const paths = resolvePaths(workspacePath);
-  mkdirSync(paths.root, { recursive: true });
-  mkdirSync(paths.memoryDir, { recursive: true });
+  mkdirSync2(paths.root, { recursive: true });
+  mkdirSync2(paths.memoryDir, { recursive: true });
   ensureFile(paths.workflowFile, renderWorkflowDocument(issue));
   ensureFile(paths.memoryFile, renderMemoryHeader(issue));
   ensureFile(paths.heartbeatFile, renderHeartbeatDocument(issue));
@@ -1207,7 +1342,7 @@ function flushWorkspaceMemory(issue, workspacePath, reason) {
   let promotedEntries = 0;
   if (writeIfChanged(paths.workflowFile, renderWorkflowDocument(issue))) changedFiles.push(paths.workflowFile);
   if (writeIfChanged(paths.heartbeatFile, renderHeartbeatDocument(issue))) changedFiles.push(paths.heartbeatFile);
-  if (!existsSync3(paths.memoryFile)) {
+  if (!existsSync4(paths.memoryFile)) {
     writeFileSync2(paths.memoryFile, renderMemoryHeader(issue), "utf8");
     changedFiles.push(paths.memoryFile);
   }
@@ -1308,10 +1443,10 @@ function shouldSkipPath(relativePath) {
   return false;
 }
 function bootstrapSource() {
-  if (existsSync4(SOURCE_MARKER)) return;
+  if (existsSync5(SOURCE_MARKER)) return;
   logger.info("Creating local source snapshot for Fifony (local-only runtime)...");
   const copyRecursive = (source, target, rel = "") => {
-    mkdirSync2(target, { recursive: true });
+    mkdirSync3(target, { recursive: true });
     const items = readdirSync2(source, { withFileTypes: true });
     for (const item of items) {
       const nextRel = rel ? `${rel}/${item.name}` : item.name;
@@ -1338,7 +1473,7 @@ function bootstrapSource() {
       }
     }
   };
-  mkdirSync2(SOURCE_ROOT, { recursive: true });
+  mkdirSync3(SOURCE_ROOT, { recursive: true });
   copyRecursive(TARGET_ROOT, SOURCE_ROOT);
   writeFileSync3(SOURCE_MARKER, `${now()}
 `, "utf8");
@@ -1353,7 +1488,7 @@ async function ensureSourceReady(onProgress) {
     onProgress?.("ready");
     return;
   }
-  if (existsSync4(SOURCE_MARKER)) {
+  if (existsSync5(SOURCE_MARKER)) {
     onProgress?.("ready");
     return;
   }
@@ -1400,7 +1535,7 @@ async function ensureSourceReady(onProgress) {
 function getGitRepoStatus(dir) {
   const isGit = (() => {
     try {
-      execSync("git rev-parse --git-dir", { cwd: dir, stdio: "pipe" });
+      execSync2("git rev-parse --git-dir", { cwd: dir, stdio: "pipe" });
       return true;
     } catch {
       return false;
@@ -1411,10 +1546,10 @@ function getGitRepoStatus(dir) {
   }
   const branch = (() => {
     try {
-      return execSync("git symbolic-ref --short HEAD", { cwd: dir, encoding: "utf8", stdio: "pipe" }).trim() || null;
+      return execSync2("git symbolic-ref --short HEAD", { cwd: dir, encoding: "utf8", stdio: "pipe" }).trim() || null;
     } catch {
       try {
-        return execSync("git rev-parse --abbrev-ref HEAD", { cwd: dir, encoding: "utf8", stdio: "pipe" }).trim() || null;
+        return execSync2("git rev-parse --abbrev-ref HEAD", { cwd: dir, encoding: "utf8", stdio: "pipe" }).trim() || null;
       } catch {
         return null;
       }
@@ -1422,7 +1557,7 @@ function getGitRepoStatus(dir) {
   })();
   const hasCommits = (() => {
     try {
-      execSync("git rev-parse --verify HEAD", { cwd: dir, stdio: "pipe" });
+      execSync2("git rev-parse --verify HEAD", { cwd: dir, stdio: "pipe" });
       return true;
     } catch {
       return false;
@@ -1432,7 +1567,7 @@ function getGitRepoStatus(dir) {
   let untrackedCount = 0;
   if (hasCommits) {
     try {
-      const porcelain = execSync("git status --porcelain", { cwd: dir, encoding: "utf8", timeout: 5e3 }).trim();
+      const porcelain = execSync2("git status --porcelain", { cwd: dir, encoding: "utf8", timeout: 5e3 }).trim();
       isClean = porcelain.length === 0;
       untrackedCount = porcelain.split("\n").filter((l) => l.startsWith("??")).length;
     } catch {
@@ -1457,14 +1592,14 @@ function initializeGitRepoForWorktrees(dir) {
   let status = getGitRepoStatus(dir);
   if (!status.isGit) {
     try {
-      execSync("git init -b main", { cwd: dir, stdio: "pipe" });
+      execSync2("git init -b main", { cwd: dir, stdio: "pipe" });
     } catch {
-      execSync("git init", { cwd: dir, stdio: "pipe" });
+      execSync2("git init", { cwd: dir, stdio: "pipe" });
     }
     status = getGitRepoStatus(dir);
   }
   if (!status.hasCommits) {
-    execSync(
+    execSync2(
       'git -c user.name="fifony" -c user.email="fifony@local.invalid" commit --allow-empty -m "Initial commit"',
       { cwd: dir, stdio: "pipe" }
     );
@@ -1481,9 +1616,9 @@ function assertIssueHasGitWorktree(issue, action) {
 }
 function detectDefaultBranch(dir) {
   try {
-    const current = execSync("git rev-parse --abbrev-ref HEAD", { cwd: dir, encoding: "utf8" }).trim();
+    const current = execSync2("git rev-parse --abbrev-ref HEAD", { cwd: dir, encoding: "utf8" }).trim();
     if (current && current !== "HEAD") return current;
-    const remote = execSync("git symbolic-ref refs/remotes/origin/HEAD", { cwd: dir, encoding: "utf8" }).trim();
+    const remote = execSync2("git symbolic-ref refs/remotes/origin/HEAD", { cwd: dir, encoding: "utf8" }).trim();
     return remote.replace("refs/remotes/origin/", "");
   } catch {
     return "main";
@@ -1493,11 +1628,11 @@ var CLI_CONFIG_DIRS = [".claude", ".codex", ".gemini"];
 var CLI_CONFIG_FILES = ["CLAUDE.md"];
 function copyCliConfigDirs(sourceRoot, worktreePath) {
   for (const dir of CLI_CONFIG_DIRS) {
-    const src = join3(sourceRoot, dir);
-    const dst = join3(worktreePath, dir);
-    if (existsSync4(src) && statSync(src).isDirectory() && !existsSync4(dst)) {
+    const src = join4(sourceRoot, dir);
+    const dst = join4(worktreePath, dir);
+    if (existsSync5(src) && statSync(src).isDirectory() && !existsSync5(dst)) {
       try {
-        execSync(`cp -R "${src}" "${dst}"`, { stdio: "pipe", timeout: 1e4 });
+        execSync2(`cp -R "${src}" "${dst}"`, { stdio: "pipe", timeout: 1e4 });
         logger.debug({ dir, worktreePath }, "[Workspace] Copied CLI config dir to worktree");
       } catch (err) {
         logger.warn({ err: String(err), dir }, "[Workspace] Failed to copy CLI config dir");
@@ -1505,11 +1640,11 @@ function copyCliConfigDirs(sourceRoot, worktreePath) {
     }
   }
   for (const file of CLI_CONFIG_FILES) {
-    const src = join3(sourceRoot, file);
-    const dst = join3(worktreePath, file);
-    if (existsSync4(src) && !existsSync4(dst)) {
+    const src = join4(sourceRoot, file);
+    const dst = join4(worktreePath, file);
+    if (existsSync5(src) && !existsSync5(dst)) {
       try {
-        execSync(`cp "${src}" "${dst}"`, { stdio: "pipe", timeout: 5e3 });
+        execSync2(`cp "${src}" "${dst}"`, { stdio: "pipe", timeout: 5e3 });
         logger.debug({ file, worktreePath }, "[Workspace] Copied CLI config file to worktree");
       } catch (err) {
         logger.warn({ err: String(err), file }, "[Workspace] Failed to copy CLI config file");
@@ -1519,23 +1654,23 @@ function copyCliConfigDirs(sourceRoot, worktreePath) {
 }
 function isGitWorkingTree(dir) {
   try {
-    execSync("git rev-parse --git-dir", { cwd: dir, stdio: "pipe", timeout: 5e3 });
+    execSync2("git rev-parse --git-dir", { cwd: dir, stdio: "pipe", timeout: 5e3 });
     return true;
   } catch {
     return false;
   }
 }
 function resolveTestWorkspacePath(issue) {
-  const workspaceRoot = issue.workspacePath ?? join3(WORKSPACE_ROOT, idToSafePath(issue.id));
-  return join3(workspaceRoot, "test-worktree");
+  const workspaceRoot = issue.workspacePath ?? join4(WORKSPACE_ROOT, idToSafePath(issue.id));
+  return join4(workspaceRoot, "test-worktree");
 }
 function createTestWorkspace(issue) {
   ensureGitRepoReadyForWorktrees(TARGET_ROOT, "create isolated test workspaces");
   assertIssueHasGitWorktree(issue, "create a test workspace");
-  const workspaceRoot = issue.workspacePath ?? join3(WORKSPACE_ROOT, idToSafePath(issue.id));
+  const workspaceRoot = issue.workspacePath ?? join4(WORKSPACE_ROOT, idToSafePath(issue.id));
   const testWorkspacePath = issue.testWorkspacePath ?? resolveTestWorkspacePath(issue);
-  mkdirSync2(workspaceRoot, { recursive: true });
-  if (existsSync4(testWorkspacePath)) {
+  mkdirSync3(workspaceRoot, { recursive: true });
+  if (existsSync5(testWorkspacePath)) {
     if (isGitWorkingTree(testWorkspacePath)) {
       issue.testWorkspacePath = testWorkspacePath;
       issue.testApplied = true;
@@ -1544,7 +1679,7 @@ function createTestWorkspace(issue) {
     rmSync2(testWorkspacePath, { recursive: true, force: true });
   }
   try {
-    execSync(`git worktree add --detach "${testWorkspacePath}" "${issue.branchName}"`, {
+    execSync2(`git worktree add --detach "${testWorkspacePath}" "${issue.branchName}"`, {
       cwd: TARGET_ROOT,
       stdio: "pipe",
       timeout: 3e4
@@ -1564,7 +1699,7 @@ function removeTestWorkspace(issue) {
   issue.testWorkspacePath = void 0;
   if (!testWorkspacePath) return;
   try {
-    execSync(`git worktree remove --force "${testWorkspacePath}"`, {
+    execSync2(`git worktree remove --force "${testWorkspacePath}"`, {
       cwd: TARGET_ROOT,
       stdio: "pipe",
       timeout: 3e4
@@ -1584,20 +1719,55 @@ async function createGitWorktree(issue, worktreePath, baseBranch) {
   let headCommitAtStart = "";
   const resolvedBaseBranch = baseBranch ?? detectDefaultBranch(TARGET_ROOT);
   try {
-    headCommitAtStart = execSync("git rev-parse HEAD", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
+    headCommitAtStart = execSync2("git rev-parse HEAD", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
   } catch {
   }
   const branchName = `fifony/${issue.id}`;
-  execSync(`git worktree add "${worktreePath}" -B "${branchName}"`, {
+  try {
+    execSync2("git worktree prune", { cwd: TARGET_ROOT, stdio: "pipe" });
+  } catch {
+  }
+  if (existsSync5(worktreePath)) {
+    try {
+      execSync2(`git worktree remove --force "${worktreePath}"`, { cwd: TARGET_ROOT, stdio: "pipe" });
+    } catch {
+      rmSync2(worktreePath, { recursive: true, force: true });
+      try {
+        execSync2("git worktree prune", { cwd: TARGET_ROOT, stdio: "pipe" });
+      } catch {
+      }
+    }
+  }
+  try {
+    const wtList = execSync2("git worktree list --porcelain", { cwd: TARGET_ROOT, encoding: "utf8" });
+    for (const block of wtList.split("\n\n").filter(Boolean)) {
+      if (block.includes(`branch refs/heads/${branchName}`)) {
+        const m = block.match(/^worktree (.+)$/m);
+        if (m) {
+          try {
+            execSync2(`git worktree remove --force "${m[1]}"`, { cwd: TARGET_ROOT, stdio: "pipe" });
+          } catch {
+            rmSync2(m[1], { recursive: true, force: true });
+            try {
+              execSync2("git worktree prune", { cwd: TARGET_ROOT, stdio: "pipe" });
+            } catch {
+            }
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  execSync2(`git worktree add "${worktreePath}" -B "${branchName}"`, {
     cwd: TARGET_ROOT,
     stdio: "pipe"
   });
   try {
-    const gitFileContent = readFileSync3(join3(worktreePath, ".git"), "utf8").trim();
+    const gitFileContent = readFileSync3(join4(worktreePath, ".git"), "utf8").trim();
     const gitDirRel = gitFileContent.replace("gitdir: ", "").trim();
     const gitDirPath = resolve(worktreePath, gitDirRel);
-    mkdirSync2(join3(gitDirPath, "info"), { recursive: true });
-    writeFileSync3(join3(gitDirPath, "info", "exclude"), "fifony-*\n.fifony-*\nfifony_*\n", "utf8");
+    mkdirSync3(join4(gitDirPath, "info"), { recursive: true });
+    writeFileSync3(join4(gitDirPath, "info", "exclude"), "fifony-*\n.fifony-*\nfifony_*\n", "utf8");
   } catch (err) {
     logger.warn({ err: String(err) }, "[Agent] Failed to write worktree excludes");
   }
@@ -1610,15 +1780,15 @@ async function createGitWorktree(issue, worktreePath, baseBranch) {
 }
 async function prepareWorkspace(issue, state, defaultBranch) {
   const safeId = idToSafePath(issue.id);
-  const workspaceRoot = join3(WORKSPACE_ROOT, safeId);
-  const worktreePath = join3(workspaceRoot, "worktree");
-  const createdNow = !existsSync4(worktreePath);
+  const workspaceRoot = join4(WORKSPACE_ROOT, safeId);
+  const worktreePath = join4(workspaceRoot, "worktree");
+  const createdNow = !existsSync5(worktreePath);
   if (createdNow) {
-    mkdirSync2(workspaceRoot, { recursive: true });
+    mkdirSync3(workspaceRoot, { recursive: true });
     logger.debug({ issueId: issue.id, identifier: issue.identifier, workspacePath: workspaceRoot }, "[Agent] Creating workspace");
     ensureGitRepoReadyForWorktrees(TARGET_ROOT, "execute issues");
     if (state.config.afterCreateHook) {
-      mkdirSync2(worktreePath, { recursive: true });
+      mkdirSync3(worktreePath, { recursive: true });
       await runHook(state.config.afterCreateHook, worktreePath, issue, "after_create");
     } else {
       await createGitWorktree(issue, worktreePath, defaultBranch);
@@ -1627,9 +1797,9 @@ async function prepareWorkspace(issue, state, defaultBranch) {
   } else {
     logger.debug({ issueId: issue.id, workspacePath: workspaceRoot }, "[Agent] Reusing existing workspace");
   }
-  const metaPath = join3(workspaceRoot, "issue.json");
+  const metaPath = join4(workspaceRoot, "issue.json");
   const promptText = await buildPrompt(issue, null);
-  const promptFile = join3(workspaceRoot, "prompt.md");
+  const promptFile = join4(workspaceRoot, "prompt.md");
   ensureWorkspaceMemoryFiles(issue, workspaceRoot);
   if (createdNow) {
     recordWorkspaceMemoryEvent(issue, workspaceRoot, {
@@ -1656,8 +1826,8 @@ async function prepareWorkspace(issue, state, defaultBranch) {
 }
 async function cleanWorkspace(issueId, issue, state) {
   const safeId = idToSafePath(issueId);
-  const workspacePath = issue?.workspacePath ?? join3(WORKSPACE_ROOT, safeId);
-  if (!existsSync4(workspacePath)) return;
+  const workspacePath = issue?.workspacePath ?? join4(WORKSPACE_ROOT, safeId);
+  if (!existsSync5(workspacePath)) return;
   if (state.config.beforeRemoveHook) {
     try {
       const dummyIssue = issue ?? { id: issueId, identifier: issueId };
@@ -1671,7 +1841,7 @@ async function cleanWorkspace(issueId, issue, state) {
   }
   if (issue?.branchName && issue.worktreePath) {
     try {
-      execSync(`git worktree remove --force "${issue.worktreePath}"`, { cwd: TARGET_ROOT, stdio: "pipe" });
+      execSync2(`git worktree remove --force "${issue.worktreePath}"`, { cwd: TARGET_ROOT, stdio: "pipe" });
       logger.info(`Removed worktree for ${issueId}: ${issue.worktreePath}`);
     } catch (error) {
       logger.warn(`Failed to remove worktree for ${issueId}: ${String(error)}`);
@@ -1681,7 +1851,7 @@ async function cleanWorkspace(issueId, issue, state) {
       }
     }
     try {
-      execSync(`git branch -D "${issue.branchName}"`, { cwd: TARGET_ROOT, stdio: "pipe" });
+      execSync2(`git branch -D "${issue.branchName}"`, { cwd: TARGET_ROOT, stdio: "pipe" });
     } catch {
     }
     try {
@@ -1700,7 +1870,7 @@ async function cleanWorkspace(issueId, issue, state) {
 function inferChangedWorkspacePaths(_workspacePath, limit = 32, issue) {
   if (!issue?.baseBranch || !issue.branchName) return [];
   try {
-    const output = execSync(
+    const output = execSync2(
       `git diff --name-only "${issue.baseBranch}"..."${issue.branchName}"`,
       { cwd: TARGET_ROOT, encoding: "utf8", timeout: 1e4, stdio: "pipe" }
     );
@@ -1714,7 +1884,7 @@ function computeDiffStats(issue) {
   try {
     let raw = "";
     try {
-      raw = execSync(
+      raw = execSync2(
         `git diff --stat "${issue.baseBranch}"..."${issue.branchName}"`,
         { cwd: TARGET_ROOT, encoding: "utf8", maxBuffer: 512e3, timeout: 1e4, stdio: "pipe" }
       );
@@ -1743,7 +1913,7 @@ function parseDiffStats(issue, raw) {
 }
 async function syncIssueDiffStatsToStore(issue) {
   if (!issue?.id) return;
-  const { getIssueStateResource } = await import("./store-M6NCKMZY.js");
+  const { getIssueStateResource } = await import("./store-S3NAYZ3S.js");
   const issueResource = getIssueStateResource();
   if (!issueResource) return;
   const toNumber = (value) => {
@@ -1796,35 +1966,50 @@ async function syncIssueDiffStatsToStore(issue) {
 function ensureWorktreeCommitted(issue) {
   const worktreePath = issue.worktreePath;
   if (!worktreePath || !issue.branchName) return;
-  execSync("git add -A", { cwd: worktreePath, stdio: "pipe" });
-  const statusBeforeCommit = execSync("git status --porcelain", { cwd: worktreePath, encoding: "utf8" }).trim();
+  execSync2("git add -A", { cwd: worktreePath, stdio: "pipe" });
+  const statusBeforeCommit = execSync2("git status --porcelain", { cwd: worktreePath, encoding: "utf8" }).trim();
   if (!statusBeforeCommit) return;
   try {
-    execSync(`git commit -m "fifony: agent changes for ${issue.identifier}"`, { cwd: worktreePath, stdio: "pipe" });
+    execSync2(`git commit -m "fifony: agent changes for ${issue.identifier}"`, { cwd: worktreePath, stdio: "pipe" });
   } catch (error) {
-    const remaining = execSync("git status --porcelain", { cwd: worktreePath, encoding: "utf8" }).trim();
+    const remaining = execSync2("git status --porcelain", { cwd: worktreePath, encoding: "utf8" }).trim();
     if (remaining) {
       throw new Error(`Failed to commit agent changes for ${issue.identifier}: ${String(error)}`);
     }
   }
-  const statusAfterCommit = execSync("git status --porcelain", { cwd: worktreePath, encoding: "utf8" }).trim();
+  const statusAfterCommit = execSync2("git status --porcelain", { cwd: worktreePath, encoding: "utf8" }).trim();
   if (statusAfterCommit) {
     throw new Error(`Worktree for ${issue.identifier} still has uncommitted changes after commit.`);
   }
 }
-function mergeWorktree(issue, abortOnConflict = true) {
+function autoCommitTargetIfDirty() {
+  const status = execSync2("git status --porcelain", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
+  if (!status) return;
+  try {
+    execSync2("git add -A", { cwd: TARGET_ROOT, stdio: "pipe" });
+    execSync2('git commit -m "chore: auto-commit uncommitted changes before fifony merge"', { cwd: TARGET_ROOT, stdio: "pipe" });
+    logger.info("[Workspace] Auto-committed dirty TARGET_ROOT before merge");
+  } catch (err) {
+    logger.warn({ err: String(err) }, "[Workspace] Failed to auto-commit TARGET_ROOT");
+  }
+}
+function mergeWorktree(issue, abortOnConflict = true, autoCommit = true) {
   const result = { copied: [], deleted: [], skipped: [], conflicts: [] };
   ensureWorktreeCommitted(issue);
-  const currentBranch = execSync("git rev-parse --abbrev-ref HEAD", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
+  const currentBranch = execSync2("git rev-parse --abbrev-ref HEAD", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
   if (currentBranch !== issue.baseBranch) {
     throw new Error(`Cannot merge ${issue.identifier}: current branch is ${currentBranch}, expected ${issue.baseBranch}.`);
   }
-  const targetStatus = execSync("git status --porcelain", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
+  const targetStatus = execSync2("git status --porcelain", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
   if (targetStatus) {
-    throw new Error(`Cannot merge ${issue.identifier}: target repository has uncommitted changes.`);
+    if (autoCommit) {
+      autoCommitTargetIfDirty();
+    } else {
+      throw new Error(`Cannot merge ${issue.identifier}: target repository has uncommitted changes. Enable 'Auto-commit before merge' in Settings or commit manually.`);
+    }
   }
   try {
-    const diffOut = execSync(
+    const diffOut = execSync2(
       `git diff --name-status "${issue.baseBranch}"..."${issue.branchName}"`,
       { cwd: TARGET_ROOT, encoding: "utf8" }
     );
@@ -1837,13 +2022,13 @@ function mergeWorktree(issue, abortOnConflict = true) {
   } catch {
   }
   try {
-    execSync(
+    execSync2(
       `git merge --no-ff "${issue.branchName}" -m "fifony: merge ${issue.identifier}"`,
       { cwd: TARGET_ROOT, stdio: "pipe" }
     );
   } catch (err) {
     try {
-      const conflictOut = execSync(
+      const conflictOut = execSync2(
         "git diff --name-only --diff-filter=U",
         { cwd: TARGET_ROOT, encoding: "utf8" }
       );
@@ -1852,7 +2037,7 @@ function mergeWorktree(issue, abortOnConflict = true) {
     }
     if (abortOnConflict) {
       try {
-        execSync("git merge --abort", { cwd: TARGET_ROOT, stdio: "pipe" });
+        execSync2("git merge --abort", { cwd: TARGET_ROOT, stdio: "pipe" });
       } catch {
       }
       logger.warn({ issueId: issue.id, err: String(err) }, "[Agent] Git merge failed, aborted");
@@ -1870,34 +2055,38 @@ function shouldSkipMergePath(relativePath) {
   const base = parts.at(-1) ?? "";
   return base === "WORKFLOW.local.md" || base === ".fifony-env.sh" || base === ".fifony-compiled-env.sh" || base === ".fifony-local-source-ready" || base.startsWith("fifony-") || base.startsWith("fifony_");
 }
-function mergeWorkspace(issue, abortOnConflict = true) {
+function mergeWorkspace(issue, abortOnConflict = true, autoCommit = true) {
   ensureGitRepoReadyForWorktrees(TARGET_ROOT, "merge issues");
   assertIssueHasGitWorktree(issue, "merge");
-  return mergeWorktree(issue, abortOnConflict);
+  return mergeWorktree(issue, abortOnConflict, autoCommit);
 }
-function dryMerge(issue) {
+function dryMerge(issue, autoCommit = true) {
   ensureGitRepoReadyForWorktrees(TARGET_ROOT, "preview merges");
   assertIssueHasGitWorktree(issue, "preview merge");
   ensureWorktreeCommitted(issue);
-  const currentBranch = execSync("git rev-parse --abbrev-ref HEAD", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
+  const currentBranch = execSync2("git rev-parse --abbrev-ref HEAD", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
   if (currentBranch !== issue.baseBranch) {
     throw new Error(`Cannot preview merge: current branch is ${currentBranch}, expected ${issue.baseBranch}.`);
   }
-  const targetStatus = execSync("git status --porcelain", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
+  const targetStatus = execSync2("git status --porcelain", { cwd: TARGET_ROOT, encoding: "utf8" }).trim();
   if (targetStatus) {
-    throw new Error(`Cannot preview merge: target repository has uncommitted changes.`);
+    if (autoCommit) {
+      autoCommitTargetIfDirty();
+    } else {
+      throw new Error(`Cannot preview merge: target repository has uncommitted changes. Enable 'Auto-commit before merge' in Settings or commit manually.`);
+    }
   }
   let conflictFiles = [];
   let willConflict = false;
   try {
-    execSync(
+    execSync2(
       `git merge --no-commit --no-ff "${issue.branchName}"`,
       { cwd: TARGET_ROOT, stdio: "pipe" }
     );
   } catch {
     willConflict = true;
     try {
-      const conflictOut = execSync(
+      const conflictOut = execSync2(
         "git diff --name-only --diff-filter=U",
         { cwd: TARGET_ROOT, encoding: "utf8" }
       );
@@ -1906,13 +2095,13 @@ function dryMerge(issue) {
     }
   }
   try {
-    execSync("git merge --abort", { cwd: TARGET_ROOT, stdio: "pipe" });
+    execSync2("git merge --abort", { cwd: TARGET_ROOT, stdio: "pipe" });
   } catch {
     try {
-      execSync("git reset --merge ORIG_HEAD", { cwd: TARGET_ROOT, stdio: "pipe" });
+      execSync2("git reset --merge ORIG_HEAD", { cwd: TARGET_ROOT, stdio: "pipe" });
     } catch {
       try {
-        execSync("git reset --merge", { cwd: TARGET_ROOT, stdio: "pipe" });
+        execSync2("git reset --merge", { cwd: TARGET_ROOT, stdio: "pipe" });
       } catch (error) {
         logger.warn({ issueId: issue.id, err: String(error) }, "[Workspace] Failed to safely clean dry-merge state");
       }
@@ -1920,7 +2109,7 @@ function dryMerge(issue) {
   }
   let changedFiles = 0;
   try {
-    const diffOut = execSync(
+    const diffOut = execSync2(
       `git diff --name-only "${issue.baseBranch}"..."${issue.branchName}"`,
       { cwd: TARGET_ROOT, encoding: "utf8" }
     );
@@ -1934,7 +2123,7 @@ function rebaseWorktree(issue) {
   assertIssueHasGitWorktree(issue, "rebase");
   ensureWorktreeCommitted(issue);
   try {
-    execSync(
+    execSync2(
       `git rebase "${issue.baseBranch}"`,
       { cwd: issue.worktreePath, stdio: "pipe" }
     );
@@ -1942,7 +2131,7 @@ function rebaseWorktree(issue) {
   } catch {
     let conflictFiles = [];
     try {
-      const conflictOut = execSync(
+      const conflictOut = execSync2(
         "git diff --name-only --diff-filter=U",
         { cwd: issue.worktreePath, encoding: "utf8" }
       );
@@ -1950,7 +2139,7 @@ function rebaseWorktree(issue) {
     } catch {
     }
     try {
-      execSync("git rebase --abort", { cwd: issue.worktreePath, stdio: "pipe" });
+      execSync2("git rebase --abort", { cwd: issue.worktreePath, stdio: "pipe" });
     } catch {
     }
     return { success: false, conflictFiles };
@@ -1963,11 +2152,11 @@ function hydrateIssuePathsFromWorkspace(issue) {
   return inferredPaths;
 }
 function writeVersionedArtifacts(workspacePath, prefix, planVersion, attempt, sources) {
-  const { writeFileSync: _wfs, readFileSync: _rfs, existsSync: _es } = { writeFileSync: writeFileSync3, readFileSync: readFileSync3, existsSync: existsSync4 };
+  const { writeFileSync: _wfs, readFileSync: _rfs, existsSync: _es } = { writeFileSync: writeFileSync3, readFileSync: readFileSync3, existsSync: existsSync5 };
   for (const { srcFile, destSuffix } of sources) {
-    const src = join3(workspacePath, srcFile);
+    const src = join4(workspacePath, srcFile);
     if (_es(src)) {
-      _wfs(join3(workspacePath, `${prefix}.v${planVersion}a${attempt}.${destSuffix}`), _rfs(src, "utf8"), "utf8");
+      _wfs(join4(workspacePath, `${prefix}.v${planVersion}a${attempt}.${destSuffix}`), _rfs(src, "utf8"), "utf8");
     }
   }
 }
@@ -2013,4 +2202,4 @@ export {
   hydrateIssuePathsFromWorkspace,
   writeVersionedArtifacts
 };
-//# sourceMappingURL=chunk-SOBLO4YZ.js.map
+//# sourceMappingURL=chunk-QH6VCTET.js.map