kantban-cli 0.1.51 → 0.1.54

package/dist/{pipeline-6J64Z7VH.js → pipeline-KKUWLU3L.js}

@@ -7,14 +7,20 @@ import {
   classifyTrajectory,
   cleanupGateProxyConfigs,
   cleanupMcpConfig,
+  cleanupWorktree,
   composeStuckDetectionPrompt,
+  defaultWorktreeRoot,
   detectBranchMerged,
+  ensureWorktreeRemote,
   generateGateProxyMcpConfig,
   generateMcpConfig,
+  generateWorktreeName,
+  mergeWorktreeBranch,
   parseJsonFromLlmOutput,
   parseStuckDetectionResponse,
-  reapOrphanedMcpConfigDirs
-} from "./chunk-X2CJ3ZAI.js";
+  reapOrphanedMcpConfigDirs,
+  renderWorktreePath
+} from "./chunk-3A4B7CUH.js";
 import {
   LoopCheckpointSchema,
   VerdictSchema,
@@ -34,8 +40,8 @@ import {
 // src/commands/pipeline.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync3, unlinkSync as unlinkSync3, existsSync as existsSync3, appendFileSync as appendFileSync2, promises as fsPromises } from "fs";
 import { execFile } from "child_process";
-import { homedir as homedir3 } from "os";
-import { join as join4, dirname as dirname2, resolve, sep } from "path";
+import { homedir as homedir2 } from "os";
+import { join as join3, dirname as dirname2, resolve, sep } from "path";
 import { promisify } from "util";
 
 // src/lib/harness-signal.ts
@@ -58,150 +64,6 @@ function resolveToolRestrictions(builtinTools, allowedTools, disallowedTools) {
   };
 }
 
-// src/lib/worktree.ts
-import { execFile as defaultExecFile, execFileSync } from "child_process";
-import { homedir } from "os";
-import { join } from "path";
-function generateWorktreeName(ticketNumber, columnName) {
-  const slug = columnSlug(columnName);
-  return `kantban-${ticketNumber}-${slug}`;
-}
-function columnSlug(columnName) {
-  return columnName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-function renderWorktreePath(ticketNumber, columnName, pathPattern, options) {
-  const slug = columnSlug(columnName);
-  const worktreeName = generateWorktreeName(ticketNumber, columnName);
-  if (pathPattern) {
-    return pathPattern.replace(/\{ticket_number\}/g, String(ticketNumber)).replace(/\{column_slug\}/g, slug).replace(/\{worktree_name\}/g, worktreeName);
-  }
-  return join(options.defaultRoot, options.boardId, slug, String(ticketNumber));
-}
-function defaultWorktreeRoot() {
-  return join(homedir(), ".kantban", "worktrees");
-}
-function isPlausibleRemoteUrl(url) {
-  return url.includes("/") || url.includes("@") || url.includes("://");
-}
-function ensureWorktreeRemote(worktreePath) {
-  try {
-    const remotes = normalizeEol(execFileSync("git", ["-C", worktreePath, "remote"], {
-      stdio: "pipe",
-      encoding: "utf-8"
-    })).trim();
-    if (remotes.split("\n").includes("origin")) {
-      const currentUrl = normalizeEol(execFileSync("git", ["-C", worktreePath, "remote", "get-url", "origin"], {
-        stdio: "pipe",
-        encoding: "utf-8"
-      })).trim();
-      if (isPlausibleRemoteUrl(currentUrl)) return;
-      console.error(`[worktree] Invalid origin URL in ${worktreePath}: "${currentUrl}" \u2014 fixing`);
-      execFileSync("git", ["-C", worktreePath, "remote", "remove", "origin"], {
-        stdio: "pipe"
-      });
-    }
-    const originUrl = normalizeEol(execFileSync("git", ["remote", "get-url", "origin"], {
-      stdio: "pipe",
-      encoding: "utf-8"
-    })).trim();
-    if (originUrl && isPlausibleRemoteUrl(originUrl)) {
-      execFileSync("git", ["-C", worktreePath, "remote", "add", "origin", originUrl], {
-        stdio: "pipe"
-      });
-      console.error(`[worktree] Added missing origin remote to ${worktreePath}: ${originUrl}`);
-    } else {
-      console.error(`[worktree] WARNING: main repo origin URL is also invalid: "${originUrl}"`);
-    }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`[worktree] Failed to ensure remote for ${worktreePath}: ${msg}`);
-  }
-}
-async function cleanupWorktree(worktreeName, exec = defaultExecFile) {
-  let target = worktreeName;
-  try {
-    const path = await findWorktreeForBranch(exec, worktreeName);
-    if (!path) return true;
-    target = path;
-  } catch {
-    return true;
-  }
-  return new Promise((resolve2) => {
-    exec("git", ["worktree", "remove", "--force", target], (err) => {
-      if (err) {
-        console.error(`[worktree] cleanup failed for ${worktreeName} (${target}): ${err.message}`);
-        resolve2(false);
-      } else {
-        resolve2(true);
-      }
-    });
-  });
-}
-function execPromise(exec, cmd, args) {
-  return new Promise((resolve2, reject) => {
-    exec(cmd, args, (err, stdout, stderr) => {
-      if (err) reject(Object.assign(err, { stdout, stderr }));
-      else resolve2({ stdout, stderr });
-    });
-  });
-}
-async function findWorktreeForBranch(exec, branch) {
-  try {
-    const { stdout } = await execPromise(exec, "git", ["worktree", "list", "--porcelain"]);
-    const targetRef = `refs/heads/${branch}`;
-    let currentPath = null;
-    for (const line of normalizeEol(stdout).split("\n")) {
-      if (line.startsWith("worktree ")) currentPath = line.slice("worktree ".length);
-      if (line.startsWith("branch ") && line.slice("branch ".length) === targetRef && currentPath) {
-        return currentPath;
-      }
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-async function mergeWorktreeBranch(worktreeName, integrationBranch, exec = defaultExecFile) {
-  try {
-    try {
-      await execPromise(exec, "git", ["rev-parse", "--verify", worktreeName]);
-    } catch {
-      return true;
-    }
-    await execPromise(exec, "git", ["branch", integrationBranch, "HEAD"]).catch(() => {
-    });
-    const checkedOutPath = await findWorktreeForBranch(exec, integrationBranch);
-    if (checkedOutPath) {
-      await execPromise(exec, "git", ["-C", checkedOutPath, "merge", "--no-edit", worktreeName]);
-      console.error(`[worktree] merged ${worktreeName} \u2192 ${integrationBranch}`);
-      return true;
-    }
-    const { stdout: baseOut } = await execPromise(exec, "git", ["merge-base", integrationBranch, worktreeName]);
-    const mergeBase = baseOut.trim();
-    const { stdout: integrationSha } = await execPromise(exec, "git", ["rev-parse", integrationBranch]);
-    if (integrationSha.trim() === mergeBase) {
-      const { stdout: worktreeSha } = await execPromise(exec, "git", ["rev-parse", worktreeName]);
-      await execPromise(exec, "git", ["update-ref", `refs/heads/${integrationBranch}`, worktreeSha.trim()]);
-      console.error(`[worktree] fast-forward merged ${worktreeName} \u2192 ${integrationBranch}`);
-      return true;
-    }
-    const tmpWorktree = `merge-tmp-${Date.now()}`;
-    try {
-      await execPromise(exec, "git", ["worktree", "add", tmpWorktree, integrationBranch]);
-      await execPromise(exec, "git", ["-C", tmpWorktree, "merge", "--no-edit", worktreeName]);
-      console.error(`[worktree] merged ${worktreeName} \u2192 ${integrationBranch}`);
-    } finally {
-      await execPromise(exec, "git", ["worktree", "remove", "--force", tmpWorktree]).catch(() => {
-      });
-    }
-    return true;
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`[worktree] merge failed for ${worktreeName} \u2192 ${integrationBranch}: ${msg}`);
-    return false;
-  }
-}
-
 // src/lib/constraint-evaluator.ts
 function resolveColumn(board, columnId, subjectRef) {
   const ref = subjectRef ?? "self";
@@ -2780,7 +2642,7 @@ var PipelineWsClient = class _PipelineWsClient {
 
 // src/lib/logger.ts
 import { mkdirSync, writeFileSync, appendFileSync, readdirSync, rmSync, statSync, renameSync } from "fs";
-import { join as join2 } from "path";
+import { join } from "path";
 var MAX_LOG_BYTES = 5 * 1024 * 1024;
 var MAX_ROTATED_FILES = 3;
 var ROTATION_CHECK_INTERVAL = 100;
@@ -2788,11 +2650,11 @@ var PipelineLogger = class {
   boardDir;
   writeCount = 0;
   constructor(baseDir, boardId) {
-    this.boardDir = join2(baseDir, boardId);
+    this.boardDir = join(baseDir, boardId);
     mkdirSync(this.boardDir, { recursive: true });
   }
   orchestrator(message) {
-    const logPath = join2(this.boardDir, "orchestrator.log");
+    const logPath = join(this.boardDir, "orchestrator.log");
     const entry = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
 `;
     appendFileSync(logPath, entry);
@@ -2824,10 +2686,10 @@ var PipelineLogger = class {
     }
   }
   iteration(ticketNumber, iterationNum, data) {
-    const ticketDir = join2(this.boardDir, ticketNumber);
+    const ticketDir = join(this.boardDir, ticketNumber);
     mkdirSync(ticketDir, { recursive: true });
     const padded = String(iterationNum).padStart(3, "0");
-    const logPath = join2(ticketDir, `iteration-${padded}.log`);
+    const logPath = join(ticketDir, `iteration-${padded}.log`);
     const entry = {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       iteration: iterationNum,
@@ -2846,7 +2708,7 @@ var PipelineLogger = class {
     try {
       const entries = readdirSync(this.boardDir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = join2(this.boardDir, entry.name);
+        const fullPath = join(this.boardDir, entry.name);
         if (entry.isDirectory() && entry.name !== ".") {
           try {
             const stat = statSync(fullPath);
@@ -3483,7 +3345,7 @@ var ProviderRegistry = class {
 };
 
 // src/providers/codex-provider.ts
-import { spawn as spawn2, execFileSync as execFileSync2 } from "child_process";
+import { spawn as spawn2, execFileSync } from "child_process";
 import { existsSync, rmSync as rmSync2 } from "fs";
 
 // src/providers/codex-jsonl-parser.ts
@@ -3624,12 +3486,12 @@ var CodexProvider = class {
       const branch = request.branch ?? request.workingDirectory;
       if (!existsSync(request.workingDirectory)) {
         try {
-          execFileSync2("git", ["worktree", "add", "-b", branch, request.workingDirectory, "HEAD"], {
+          execFileSync("git", ["worktree", "add", "-b", branch, request.workingDirectory, "HEAD"], {
             stdio: "pipe"
           });
         } catch {
           try {
-            execFileSync2("git", ["worktree", "add", request.workingDirectory, branch], {
+            execFileSync("git", ["worktree", "add", request.workingDirectory, branch], {
               stdio: "pipe"
             });
           } catch (err) {
@@ -3639,18 +3501,18 @@ var CodexProvider = class {
         }
       } else {
         try {
-          execFileSync2("git", ["-C", request.workingDirectory, "rev-parse", "--git-dir"], {
+          execFileSync("git", ["-C", request.workingDirectory, "rev-parse", "--git-dir"], {
             stdio: "pipe"
           });
         } catch {
           try {
             rmSync2(request.workingDirectory, { recursive: true, force: true });
-            execFileSync2("git", ["worktree", "add", "-b", branch, request.workingDirectory, "HEAD"], {
+            execFileSync("git", ["worktree", "add", "-b", branch, request.workingDirectory, "HEAD"], {
               stdio: "pipe"
             });
           } catch {
             try {
-              execFileSync2("git", ["worktree", "add", request.workingDirectory, branch], {
+              execFileSync("git", ["worktree", "add", request.workingDirectory, branch], {
                 stdio: "pipe"
               });
             } catch (err) {
@@ -3670,6 +3532,12 @@ var CodexProvider = class {
       const child = spawn2(cmd, resolvedArgs, {
         stdio: ["ignore", "pipe", "pipe"],
         env: { ...process.env, ...env },
+        // Run the agent process *inside* its worktree, not the orchestrator's
+        // launch dir. Codex's `-C` arg alone is not enough: without an explicit
+        // cwd the process inherits the orchestrator's cwd (the main checkout),
+        // and any shell command that resolves to process.cwd rather than `-C`
+        // corrupts the shared repo (detached HEAD, stray writes).
+        ...request.workingDirectory ? { cwd: request.workingDirectory } : {},
         ...prefixArgs.length > 0 ? {} : crossSpawnOptions()
       });
       const parser = new CodexJsonlParser();
@@ -3786,10 +3654,10 @@ var CodexProvider = class {
 };
 
 // src/providers/gemini-provider.ts
-import { spawn as spawn3, execFileSync as execFileSync3 } from "child_process";
+import { spawn as spawn3, execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, rmSync as rmSync3 } from "fs";
-import { join as join3, dirname } from "path";
-import { homedir as homedir2 } from "os";
+import { join as join2, dirname } from "path";
+import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { readFileSync as readFileSync2 } from "fs";
 
@@ -3952,13 +3820,13 @@ function resolveHookScriptPath() {
   try {
     const thisDir = dirname(fileURLToPath(import.meta.url));
     const candidates = [
-      join3(thisDir, "lib", "gemini-hooks.mjs"),
+      join2(thisDir, "lib", "gemini-hooks.mjs"),
       // dist/lib/ (flat bundle)
-      join3(thisDir, "..", "lib", "gemini-hooks.mjs"),
+      join2(thisDir, "..", "lib", "gemini-hooks.mjs"),
       // dist/../lib/ (nested)
-      join3(thisDir, "..", "src", "lib", "gemini-hooks.mjs"),
+      join2(thisDir, "..", "src", "lib", "gemini-hooks.mjs"),
       // source from dist/
-      join3(thisDir, "..", "..", "src", "lib", "gemini-hooks.mjs")
+      join2(thisDir, "..", "..", "src", "lib", "gemini-hooks.mjs")
       // source from dist/providers/
     ];
     for (const p of candidates) {
@@ -3998,12 +3866,12 @@ var GeminiProvider = class _GeminiProvider {
     if (request.workingDirectory) {
       if (!existsSync2(request.workingDirectory)) {
         try {
-          execFileSync3("git", ["worktree", "add", "-b", request.workingDirectory, request.workingDirectory, "HEAD"], {
+          execFileSync2("git", ["worktree", "add", "-b", request.workingDirectory, request.workingDirectory, "HEAD"], {
             stdio: "pipe"
           });
         } catch {
           try {
-            execFileSync3("git", ["worktree", "add", request.workingDirectory, request.workingDirectory], {
+            execFileSync2("git", ["worktree", "add", request.workingDirectory, request.workingDirectory], {
               stdio: "pipe"
             });
           } catch {
@@ -4012,18 +3880,18 @@ var GeminiProvider = class _GeminiProvider {
         }
       } else {
         try {
-          execFileSync3("git", ["-C", request.workingDirectory, "rev-parse", "--git-dir"], {
+          execFileSync2("git", ["-C", request.workingDirectory, "rev-parse", "--git-dir"], {
             stdio: "pipe"
           });
         } catch {
           try {
             rmSync3(request.workingDirectory, { recursive: true, force: true });
-            execFileSync3("git", ["worktree", "add", "-b", request.workingDirectory, request.workingDirectory, "HEAD"], {
+            execFileSync2("git", ["worktree", "add", "-b", request.workingDirectory, request.workingDirectory, "HEAD"], {
               stdio: "pipe"
             });
           } catch {
             try {
-              execFileSync3("git", ["worktree", "add", request.workingDirectory, request.workingDirectory], {
+              execFileSync2("git", ["worktree", "add", request.workingDirectory, request.workingDirectory], {
                 stdio: "pipe"
               });
             } catch {
@@ -4152,9 +4020,9 @@ var GeminiProvider = class _GeminiProvider {
   }
   writeGeminiSettings(request, degraded) {
     try {
-      const baseDir = join3(homedir2(), ".kantban", "pipelines", "gemini-tmp");
-      const dir = join3(baseDir, `session-${Date.now()}`);
-      const geminiDir = join3(dir, ".gemini");
+      const baseDir = join2(homedir(), ".kantban", "pipelines", "gemini-tmp");
+      const dir = join2(baseDir, `session-${Date.now()}`);
+      const geminiDir = join2(dir, ".gemini");
       mkdirSync2(geminiDir, { recursive: true, mode: 448 });
       const settings = {};
       if (request.mcpConfig && Object.keys(request.mcpConfig.servers).length > 0) {
@@ -4178,20 +4046,20 @@ var GeminiProvider = class _GeminiProvider {
           hookConfig.disallowedTools = tr.disallowedTools ? translateToolNames(tr.disallowedTools) : null;
           if (tr.tools !== void 0) hookConfig.builtinToolsMode = tr.tools;
           const ext = IS_WINDOWS ? ".cmd" : ".sh";
-          const wrapperPath = join3(dir, `.kantban-hook-before-tool${ext}`);
-          writeFileSync3(wrapperPath, this.generateHookWrapper(hookPath, "BeforeToolSelection", join3(dir, ".kantban-hook-config.json")), { mode: 493 });
+          const wrapperPath = join2(dir, `.kantban-hook-before-tool${ext}`);
+          writeFileSync3(wrapperPath, this.generateHookWrapper(hookPath, "BeforeToolSelection", join2(dir, ".kantban-hook-config.json")), { mode: 493 });
           hooks.BeforeToolSelection = [{ matcher: "*", hooks: [{ type: "command", command: wrapperPath, timeout: 3e4 }] }];
         }
         if (request.maxTurns && request.mcpConfig) {
           hookConfig.maxTurns = request.maxTurns;
-          hookConfig.turnFile = join3(dir, ".kantban-turn-counter");
+          hookConfig.turnFile = join2(dir, ".kantban-turn-counter");
           const ext = IS_WINDOWS ? ".cmd" : ".sh";
-          const wrapperPath = join3(dir, `.kantban-hook-after-agent${ext}`);
-          writeFileSync3(wrapperPath, this.generateHookWrapper(hookPath, "AfterAgent", join3(dir, ".kantban-hook-config.json")), { mode: 493 });
+          const wrapperPath = join2(dir, `.kantban-hook-after-agent${ext}`);
+          writeFileSync3(wrapperPath, this.generateHookWrapper(hookPath, "AfterAgent", join2(dir, ".kantban-hook-config.json")), { mode: 493 });
           hooks.AfterAgent = [{ matcher: "*", hooks: [{ type: "command", command: wrapperPath, timeout: 3e4 }] }];
         }
         if (Object.keys(hookConfig).length > 0) {
-          writeFileSync3(join3(dir, ".kantban-hook-config.json"), JSON.stringify(hookConfig), { mode: 384 });
+          writeFileSync3(join2(dir, ".kantban-hook-config.json"), JSON.stringify(hookConfig), { mode: 384 });
         }
         if (Object.keys(hooks).length > 0) {
           settings.hooks = hooks;
@@ -4204,7 +4072,7 @@ var GeminiProvider = class _GeminiProvider {
         process.stderr.write(`[gemini] Hook script not found \u2014 tool scoping and turn limits unavailable
 `);
       }
-      writeFileSync3(join3(geminiDir, "settings.json"), JSON.stringify(settings, null, 2), { mode: 384 });
+      writeFileSync3(join2(geminiDir, "settings.json"), JSON.stringify(settings, null, 2), { mode: 384 });
       return dir;
     } catch (err) {
       process.stderr.write(`[gemini] Failed to write settings.json: ${err}
@@ -4270,11 +4138,11 @@ node "${hookScript}" "${event}" "${configFile}" < "$STDIN_FILE"
   }
   copySettingsToDir(settingsDir, targetDir) {
     try {
-      const sourceFile = join3(settingsDir, ".gemini", "settings.json");
-      const targetGeminiDir = join3(targetDir, ".gemini");
+      const sourceFile = join2(settingsDir, ".gemini", "settings.json");
+      const targetGeminiDir = join2(targetDir, ".gemini");
       mkdirSync2(targetGeminiDir, { recursive: true, mode: 448 });
       const content = readFileSync2(sourceFile, "utf-8");
-      writeFileSync3(join3(targetGeminiDir, "settings.json"), content, { mode: 384 });
+      writeFileSync3(join2(targetGeminiDir, "settings.json"), content, { mode: 384 });
     } catch {
     }
   }
@@ -4414,10 +4282,10 @@ Flags:
   return { boardId, once, dryRun, columnFilter, maxIterations, maxBudget, model, provider, concurrency, logRetention, yes };
 }
 function pidDir(boardId) {
-  return join4(homedir3(), ".kantban", "pipelines", boardId);
+  return join3(homedir2(), ".kantban", "pipelines", boardId);
 }
 function pidFilePath(boardId) {
-  return join4(pidDir(boardId), "orchestrator.pid");
+  return join3(pidDir(boardId), "orchestrator.pid");
 }
 function writePidFile(boardId) {
   const dir = pidDir(boardId);
@@ -4431,7 +4299,7 @@ function removePidFile(boardId) {
   }
 }
 function childManifestPath(boardId) {
-  return join4(pidDir(boardId), "children.pid");
+  return join3(pidDir(boardId), "children.pid");
 }
 function readChildManifest(boardId) {
   try {
@@ -4476,7 +4344,7 @@ function cleanupOrphanedProcesses(boardId) {
     console.log(`Killed ${String(manifestPids.length)} orphaned child process(es) from manifest`);
     removeChildManifest(boardId);
   }
-  const staleReaperPath = join4(pidDir(boardId), "reaper.pid");
+  const staleReaperPath = join3(pidDir(boardId), "reaper.pid");
   try {
     if (existsSync3(staleReaperPath)) {
       const reaperPid = parseInt(readFileSync3(staleReaperPath, "utf-8").trim(), 10);
@@ -4535,7 +4403,7 @@ async function runPipeline(client, args) {
       return;
     }
   }
-  const gateFilePath = join4(process.cwd(), "pipeline.gates.yaml");
+  const gateFilePath = join3(process.cwd(), "pipeline.gates.yaml");
   let gateConfig;
   if (!existsSync3(gateFilePath)) {
     console.error(`Error: pipeline.gates.yaml not found in ${process.cwd()}`);
@@ -4572,7 +4440,7 @@ async function runPipeline(client, args) {
     ...opts.provider ? { intelligence_provider: opts.provider } : {}
   };
   const intelligenceProvider = registry.resolveForIntelligence(boardProviderConfig);
-  const logBaseDir = join4(homedir3(), ".kantban", "pipelines");
+  const logBaseDir = join3(homedir2(), ".kantban", "pipelines");
   const logger = new PipelineLogger(logBaseDir, opts.boardId);
   logger.pruneOldLogs(opts.logRetention);
   let runMemory = null;
@@ -4636,7 +4504,21 @@ async function runPipeline(client, args) {
         effectiveConfig.model = registry.resolveModel(columnProvider, effectiveConfig.model);
       }
       const { gates: columnGates } = resolveGatesForColumn(gateConfig, resolvedColumnName);
-      const gateCwd = effectiveConfig.worktreePath ?? (effectiveConfig.worktreeName ? join4(process.cwd(), effectiveConfig.worktreeName) : process.cwd());
+      const gateCwd = effectiveConfig.worktreePath ?? (effectiveConfig.worktreeName ? join3(process.cwd(), effectiveConfig.worktreeName) : process.cwd());
+      if (effectiveConfig.worktreePath || effectiveConfig.worktreeName) {
+        const primaryRepoRoot = await getPrimaryRepoRoot();
+        const resolvedGate = resolve(gateCwd);
+        const insideRepo = resolvedGate === primaryRepoRoot || resolvedGate.startsWith(primaryRepoRoot + sep) || primaryRepoRoot.startsWith(resolvedGate + sep);
+        if (insideRepo) {
+          const errMsg = `[fatal] dispatch refused: gate cwd "${resolvedGate}" is inside the primary repo "${primaryRepoRoot}" \u2014 refusing to run gates against the shared checkout. Fix agent_config.worktree.path_pattern.`;
+          logger.orchestrator(errMsg);
+          await deps.createComment(
+            ticketId,
+            `[dispatch] failed: gate cwd would be the primary repo ("${resolvedGate}"). Fix worktree.path_pattern; the orchestrator will retry.`
+          );
+          return { reason: "error", iterations: 0, gutterCount: 0, lastError: errMsg };
+        }
+      }
       const effectiveMcpConfigPath = columnGates.length > 0 ? generateGateProxyMcpConfig(
         client.baseUrl,
         client.token,
@@ -5145,7 +5027,7 @@ Received ${signal}. Shutting down gracefully...`);
   cleanupOrphanedProcesses(opts.boardId);
   writePidFile(opts.boardId);
   logger.orchestrator(`PID file written: ${String(process.pid)}`);
-  const reaperPidPath = join4(pidDir(opts.boardId), "reaper.pid");
+  const reaperPidPath = join3(pidDir(opts.boardId), "reaper.pid");
   const reaperProcess = spawnReaper({
     orchestratorPid: process.pid,
     manifestPath: childManifestPath(opts.boardId),
@@ -5335,4 +5217,4 @@ export {
   runPipeline,
   stopPipeline
 };
-//# sourceMappingURL=pipeline-6J64Z7VH.js.map
+//# sourceMappingURL=pipeline-KKUWLU3L.js.map