runcastle 1.0.10 → 1.0.12

package/bin/runcastle.js

@@ -1931,8 +1931,9 @@ var init_dev_pane = __esm(() => {
 });
 
 // src/services/git.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, realpathSync } from "fs";
-import { dirname, resolve as resolve3 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, mkdtempSync, realpathSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join as join6, resolve as resolve3 } from "path";
 import { simpleGit } from "simple-git";
 function featureBranch(slug) {
   return `feature/${slug}`;
@@ -2139,6 +2140,9 @@ function researchBranchName(slug, waypointSeq, unique) {
 function ticketBranchName(slug, ticketSeq, unique) {
   return `${TICKET_BRANCH_PREFIX}${tempBranchSlugSegment(slug)}/${ticketSeq}-${unique}`;
 }
+async function allowPushToCheckedOutBranches(repoPath) {
+  await git(repoPath).addConfig("receive.denyCurrentBranch", "ignore");
+}
 async function mergeTempBranch(repoPath, featureBranchName, tempBranch) {
   const g = git(repoPath);
   let branches;
@@ -2168,13 +2172,47 @@ async function mergeTempBranch(repoPath, featureBranchName, tempBranch) {
   } else {
     try {
       await g.raw(["fetch", ".", `${tempBranch}:${featureBranchName}`]);
-    } catch (e) {
-      return { ok: false, error: errMsg(e) };
+    } catch {
+      const merged = await mergeInDisposableWorktree(g, featureBranchName, tempBranch);
+      if (!merged.ok)
+        return merged;
     }
   }
   await deleteBranchDetachingWorktrees(g, repoPath, tempBranch);
   return { ok: true };
 }
+async function mergeInDisposableWorktree(g, featureBranchName, tempBranch) {
+  let dir;
+  try {
+    dir = mkdtempSync(join6(tmpdir(), "rc-land-"));
+  } catch (e) {
+    return { ok: false, error: errMsg(e) };
+  }
+  const wt = join6(dir, "wt");
+  try {
+    await g.raw(["worktree", "add", wt, featureBranchName]);
+    const gw = git(wt);
+    try {
+      await gw.merge([tempBranch]);
+    } catch (e) {
+      if (await mergeInProgress(gw)) {
+        await gw.raw(["merge", "--abort"]);
+        return { ok: false, conflict: true, error: errMsg(e) };
+      }
+      return { ok: false, error: errMsg(e) };
+    }
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: errMsg(e) };
+  } finally {
+    try {
+      await g.raw(["worktree", "remove", "--force", wt]);
+    } catch {}
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {}
+  }
+}
 async function deleteBranchDetachingWorktrees(g, repoPath, branch) {
   for (const holder of await worktreesOnBranch(g, branch, repoPath)) {
     try {
@@ -2380,7 +2418,7 @@ var init_git = __esm(() => {
 
 // src/services/knowledge.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync } from "fs";
-import { join as join6, relative, resolve as resolve4, sep } from "path";
+import { join as join7, relative, resolve as resolve4, sep } from "path";
 function scaffoldDocs(ctx, feature) {
   const project = projectForFeature(ctx, feature);
   const dir = featureDocsDir(project, feature);
@@ -2435,7 +2473,7 @@ function listDocs(ctx, feature) {
   const dir = featureDocsDir(project, feature);
   if (!existsSync8(dir))
     return [];
-  return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => ({ relPath: e.name, title: readTitle(join6(dir, e.name), e.name) })).sort((a, b) => a.relPath.localeCompare(b.relPath));
+  return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => ({ relPath: e.name, title: readTitle(join7(dir, e.name), e.name) })).sort((a, b) => a.relPath.localeCompare(b.relPath));
 }
 function readDoc(ctx, feature, relPath) {
   const project = projectForFeature(ctx, feature);
@@ -2476,21 +2514,21 @@ var init_knowledge = __esm(() => {
 
 // src/launcher/skills-root.ts
 import { existsSync as existsSync9 } from "fs";
-import { dirname as dirname2, join as join7, resolve as resolve5 } from "path";
+import { dirname as dirname2, join as join8, resolve as resolve5 } from "path";
 function resolveSkillsRoot(fromDir) {
   const override = process.env[SKILLS_DIR_ENV];
   if (override) {
     const root = resolve5(override);
-    if (existsSync9(join7(root, SKILLS_MARKER)))
+    if (existsSync9(join8(root, SKILLS_MARKER)))
       return root;
     throw new Error(`${SKILLS_DIR_ENV}=${override} is not a runcastle skills root (missing ${SKILLS_MARKER})`);
   }
   const searched = [];
   let dir = fromDir;
   for (let i = 0;i < 8; i += 1) {
-    const candidate = join7(dir, "packages", "skills");
+    const candidate = join8(dir, "packages", "skills");
     searched.push(candidate);
-    if (existsSync9(join7(candidate, SKILLS_MARKER)))
+    if (existsSync9(join8(candidate, SKILLS_MARKER)))
       return candidate;
     const parent = dirname2(dir);
     if (parent === dir)
@@ -2503,7 +2541,7 @@ function resolveSkillsRoot(fromDir) {
 }
 var SKILLS_DIR_ENV = "RUNCASTLE_SKILLS_DIR", SKILLS_MARKER;
 var init_skills_root = __esm(() => {
-  SKILLS_MARKER = join7("packs", "runcastle");
+  SKILLS_MARKER = join8("packs", "runcastle");
 });
 
 // src/services/agent-stream.ts
@@ -2548,7 +2586,7 @@ var init_agent_stream = __esm(() => {
 
 // src/workflows/ticket-burner.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "fs";
-import { dirname as dirname3, join as join8 } from "path";
+import { dirname as dirname3, join as join9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { claudeCode, run } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
@@ -2705,9 +2743,9 @@ function resolveBurnWorkspaceMode(config2, platform = process.platform) {
 function buildIsolatedSetupCommand(tempBranch, setupCommand) {
   const hookFile = `${ISOLATED_REPO_PATH}/.git/hooks/post-commit`;
   const parts = [
-    `git -C ${SANDBOX_WORKSPACE_PATH} config receive.denyCurrentBranch updateInstead`,
+    `git config --global --add safe.directory '*'`,
     `git clone ${SANDBOX_WORKSPACE_PATH} ${ISOLATED_REPO_PATH}`,
-    `printf '#!/bin/sh\\nexec git push --quiet origin HEAD:%s\\n' '${tempBranch}' > ${hookFile}`,
+    `printf '#!/bin/sh\\nunset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE\\ngit push --quiet origin HEAD:%s && exec git -C ${SANDBOX_WORKSPACE_PATH} reset --hard --quiet %s\\n' '${tempBranch}' '${tempBranch}' > ${hookFile}`,
     `chmod +x ${hookFile}`
   ];
   if (setupCommand)
@@ -2728,7 +2766,7 @@ function buildWorkspaceNotes(mode) {
 `);
 }
 function readRepoToolchain(repoPath) {
-  const pkgPath = join8(repoPath, "package.json");
+  const pkgPath = join9(repoPath, "package.json");
   const hasPackageJson = existsSync10(pkgPath);
   let packageManagerField;
   if (hasPackageJson) {
@@ -2742,10 +2780,10 @@ function readRepoToolchain(repoPath) {
     hasPackageJson,
     ...packageManagerField !== undefined ? { packageManagerField } : {},
     lockfiles: {
-      bun: existsSync10(join8(repoPath, "bun.lock")) || existsSync10(join8(repoPath, "bun.lockb")),
-      pnpm: existsSync10(join8(repoPath, "pnpm-lock.yaml")),
-      yarn: existsSync10(join8(repoPath, "yarn.lock")),
-      npm: existsSync10(join8(repoPath, "package-lock.json"))
+      bun: existsSync10(join9(repoPath, "bun.lock")) || existsSync10(join9(repoPath, "bun.lockb")),
+      pnpm: existsSync10(join9(repoPath, "pnpm-lock.yaml")),
+      yarn: existsSync10(join9(repoPath, "yarn.lock")),
+      npm: existsSync10(join9(repoPath, "package-lock.json"))
     }
   };
 }
@@ -2955,23 +2993,23 @@ async function burnRun(ctx, deps) {
 }
 function burnerTemplatePath() {
   const here = dirname3(fileURLToPath2(import.meta.url));
-  return join8(resolveSkillsRoot(here), "burner", "implement-ticket.md");
+  return join9(resolveSkillsRoot(here), "burner", "implement-ticket.md");
 }
 function readDocsDigestFromDisk(projectId, slug) {
   const worktree = worktreeDir(projectId, slug);
   if (!existsSync10(worktree))
     return "_No talk worktree on disk \u2014 docs digest skipped._";
-  const docsDir = join8(worktree, ...featureDocsRel(slug).split("/"));
+  const docsDir = join9(worktree, ...featureDocsRel(slug).split("/"));
   if (!existsSync10(docsDir))
     return "_No docs/features dir in the talk worktree \u2014 docs digest skipped._";
-  const files = readdirSync3(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync4(join8(docsDir, e.name), "utf8") }));
+  const files = readdirSync3(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync4(join9(docsDir, e.name), "utf8") }));
   return buildDocsDigest(files);
 }
 function readBlockedFile(dirs) {
   for (const dir of dirs) {
     if (!dir)
       continue;
-    const p = join8(dir, "BLOCKED.md");
+    const p = join9(dir, "BLOCKED.md");
     if (existsSync10(p)) {
       try {
         return readFileSync4(p, "utf8");
@@ -3014,10 +3052,12 @@ function selectSandbox(config2, mounts = []) {
       return noSandbox();
   }
 }
-async function realExecuteTicketRun(ctx, ticket, config2, token, model, land) {
+async function realExecuteTicketRun(ctx, ticket, config2, token, model, land, ensureIsolatedPushTarget) {
   const { project, feature } = ctx;
   const tempBranch = ticketBranchName(feature.slug, ticket.seq, newId("b").slice(2, 10));
   const workspaceMode = resolveBurnWorkspaceMode(config2);
+  if (workspaceMode === "isolated")
+    await ensureIsolatedPushTarget();
   const template = readFileSync4(burnerTemplatePath(), "utf8");
   const prompt = renderTicketPrompt(template, {
     TICKET_JSON: buildTicketJson(ticket),
@@ -3046,7 +3086,7 @@ async function realExecuteTicketRun(ctx, ticket, config2, token, model, land) {
     });
   }
   mkdirSync4(logsDir(), { recursive: true });
-  const logFilePath = join8(logsDir(), `burn-${feature.id}-${ticket.seq}.log`);
+  const logFilePath = join9(logsDir(), `burn-${feature.id}-${ticket.seq}.log`);
   const throttle = createStreamThrottle((e) => ctx.emitEvent({ ...e, ticketId: ticket.id }));
   beginTranscript(ticket.id);
   const onStreamEvent = (event) => {
@@ -3131,11 +3171,13 @@ function resolveBurnDeps(ctx) {
   const token = readTokenFromEnvFile(envPath());
   const model = resolveModel("implement", config2, ctx.project, ctx.modelOverride);
   const land = createSerialQueue();
+  let pushTargetReady;
+  const ensureIsolatedPushTarget = () => pushTargetReady ??= allowPushToCheckedOutBranches(ctx.project.repoPath);
   return {
     config: config2,
     hasAuthToken: token !== undefined,
     concurrency: config2.burnConcurrency,
-    executeTicketRun: (c, ticket) => realExecuteTicketRun(c, ticket, config2, token, model, land)
+    executeTicketRun: (c, ticket) => realExecuteTicketRun(c, ticket, config2, token, model, land, ensureIsolatedPushTarget)
   };
 }
 function readTokenFromEnvFile(path) {
@@ -3180,7 +3222,7 @@ var init_ticket_burner = __esm(() => {
 
 // src/workflows/research.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname4, join as join9 } from "path";
+import { dirname as dirname4, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { run as run2 } from "@ai-hero/sandcastle";
 import { docker as docker2 } from "@ai-hero/sandcastle/sandboxes/docker";
@@ -3252,16 +3294,16 @@ function interpretResearchResult(result, docRelPath) {
 }
 function researchTemplatePath() {
   const here = dirname4(fileURLToPath3(import.meta.url));
-  return join9(resolveSkillsRoot(here), "burner", "research-waypoint.md");
+  return join10(resolveSkillsRoot(here), "burner", "research-waypoint.md");
 }
 function readDocsDigestFromDisk2(projectId, slug) {
   const worktree = worktreeDir(projectId, slug);
   if (!existsSync11(worktree))
     return "_No talk worktree on disk \u2014 docs digest skipped._";
-  const docsDir = join9(worktree, ...featureDocsRel(slug).split("/"));
+  const docsDir = join10(worktree, ...featureDocsRel(slug).split("/"));
   if (!existsSync11(docsDir))
     return "_No docs/features dir in the talk worktree \u2014 docs digest skipped._";
-  const files = readdirSync4(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync5(join9(docsDir, e.name), "utf8") }));
+  const files = readdirSync4(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync5(join10(docsDir, e.name), "utf8") }));
   return buildDocsDigest(files);
 }
 async function realExecuteResearchRun(ctx, waypoint, config2, token, model) {
@@ -3276,7 +3318,7 @@ async function realExecuteResearchRun(ctx, waypoint, config2, token, model) {
     RESEARCH_DOC_PATH: docRelPath
   });
   mkdirSync5(logsDir(), { recursive: true });
-  const logFilePath = join9(logsDir(), `research-${feature.id}-${waypoint.seq}.log`);
+  const logFilePath = join10(logsDir(), `research-${feature.id}-${waypoint.seq}.log`);
   const throttle = createResearchStreamThrottle((e) => ctx.emitEvent(e));
   const runOptions = {
     agent: buildBurnAgent(config2, token, model),
@@ -4137,7 +4179,7 @@ var init_hooks = __esm(() => {
 // src/routes/web.ts
 import { existsSync as existsSync12, statSync } from "fs";
 import { readFile } from "fs/promises";
-import { extname, join as join10, normalize, resolve as resolve6, sep as sep2 } from "path";
+import { extname, join as join11, normalize, resolve as resolve6, sep as sep2 } from "path";
 function contentType(path) {
   return MIME[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
@@ -4155,7 +4197,7 @@ function safeJoin(root, pathname) {
   } catch {
     return null;
   }
-  const joined = normalize(join10(root, decoded));
+  const joined = normalize(join11(root, decoded));
   if (joined !== root && !joined.startsWith(root + sep2))
     return null;
   return joined;
@@ -4168,7 +4210,7 @@ function resolveWebDist() {
 }
 function mountWebApp(app, distDir) {
   const root = resolve6(distDir);
-  const indexHtml = join10(root, "index.html");
+  const indexHtml = join11(root, "index.html");
   app.get("*", async (c, next) => {
     const { pathname } = new URL(c.req.url);
     if (/^\/(api|mcp|ws|health)(\/|$)/.test(pathname))
@@ -4188,7 +4230,7 @@ function mountWebApp(app, distDir) {
 }
 function mountWebAppIfBuilt(app) {
   const dist = resolveWebDist();
-  if (existsSync12(join10(dist, "index.html")))
+  if (existsSync12(join11(dist, "index.html")))
     mountWebApp(app, dist);
 }
 var MIME;
@@ -4264,7 +4306,7 @@ var init_events2 = __esm(() => {
 // src/launcher/artifacts.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync2 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function hookClientPath() {
   return resolveAsset(ASSET_ENV.hookClient, fileURLToPath4(new URL("./hook-client.ts", import.meta.url)));
 }
@@ -4476,9 +4518,9 @@ async function writeSessionArtifacts(input) {
   const { session, feature, config: config2, waypoint } = input;
   const dir = sessionDir(session.id);
   mkdirSync6(dir, { recursive: true });
-  const systemPromptPath = join11(dir, "system-prompt.md");
-  const settingsPath = join11(dir, "settings.json");
-  const mcpConfigPath = join11(dir, "mcp.json");
+  const systemPromptPath = join12(dir, "system-prompt.md");
+  const settingsPath = join12(dir, "settings.json");
+  const mcpConfigPath = join12(dir, "mcp.json");
   writeFileSync2(systemPromptPath, renderSystemPrompt(feature, session.kind, waypoint), "utf8");
   writeFileSync2(settingsPath, JSON.stringify(renderSettings(hookClientPath()), null, 2), "utf8");
   writeFileSync2(mcpConfigPath, JSON.stringify(renderMcpConfig(session, config2), null, 2), "utf8");
@@ -4540,7 +4582,7 @@ var init_end_session = __esm(() => {
 
 // src/launcher/launcher.ts
 import { existsSync as existsSync13 } from "fs";
-import { dirname as dirname5, join as join12, resolve as resolve7 } from "path";
+import { dirname as dirname5, join as join13, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { and as and5, eq as eq8 } from "drizzle-orm";
 function ptyExitMessage(exitCode) {
@@ -4578,10 +4620,10 @@ function claudeSpawnTarget(claudeArgs) {
   return { file: exe, args: claudeArgs };
 }
 function resolvePluginDir(fromDir = dirname5(fileURLToPath5(import.meta.url))) {
-  const rel = join12("packages", "skills", "packs", "runcastle");
+  const rel = join13("packages", "skills", "packs", "runcastle");
   const override = process.env[SKILLS_DIR_ENV];
   if (override) {
-    const dir2 = join12(resolve7(override), "packs", "runcastle");
+    const dir2 = join13(resolve7(override), "packs", "runcastle");
     if (existsSync13(dir2))
       return dir2;
     throw new Error(`${SKILLS_DIR_ENV}=${override} has no plugin dir at ${dir2}`);
@@ -4589,7 +4631,7 @@ function resolvePluginDir(fromDir = dirname5(fileURLToPath5(import.meta.url))) {
   const searched = [];
   let dir = fromDir;
   for (let i = 0;i < 8; i += 1) {
-    const candidate = join12(dir, rel);
+    const candidate = join13(dir, rel);
     searched.push(candidate);
     if (existsSync13(candidate))
       return candidate;
@@ -4943,7 +4985,7 @@ var init_feature = __esm(() => {
 
 // src/services/projects.ts
 import { existsSync as existsSync14 } from "fs";
-import { basename, join as join13 } from "path";
+import { basename, join as join14 } from "path";
 import { eq as eq9, isNull } from "drizzle-orm";
 function listProjects(ctx) {
   return ctx.db.select().from(projects).where(isNull(projects.closedAt)).all().map(rowToProject);
@@ -5019,7 +5061,7 @@ async function assertRepoTolerant(ctx, repoPath) {
   } catch (e) {
     if (!isNotImplemented(e))
       throw e;
-    if (!existsSync14(join13(repoPath, ".git"))) {
+    if (!existsSync14(join14(repoPath, ".git"))) {
       throw new InvalidInputError(`not a git repository: ${repoPath}`);
     }
   }
@@ -5546,7 +5588,7 @@ var init_system_exec = __esm(() => {
 
 // src/services/setup.ts
 import { copyFileSync, existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname7, join as join14 } from "path";
+import { dirname as dirname7, join as join15 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 async function writeGitIdentity(exec, identity) {
   const name = identity.name.trim();
@@ -5624,11 +5666,11 @@ function resolveSandcastleBin() {
     const mainUrl = import.meta.resolve("@ai-hero/sandcastle");
     let dir = dirname7(fileURLToPath6(mainUrl));
     for (let hops = 0;hops < 6; hops++) {
-      const manifestPath = join14(dir, "package.json");
+      const manifestPath = join15(dir, "package.json");
       if (existsSync16(manifestPath)) {
         const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
         if (manifest.name === "@ai-hero/sandcastle" && manifest.bin?.sandcastle) {
-          return join14(dir, manifest.bin.sandcastle);
+          return join15(dir, manifest.bin.sandcastle);
         }
       }
       const parent = dirname7(dir);
@@ -5656,12 +5698,12 @@ function sandcastleTemplateDir() {
   return resolveAsset(ASSET_ENV.sandcastleTemplate, fileURLToPath6(new URL("../assets/sandcastle", import.meta.url)));
 }
 function scaffoldSandcastleConfig(templateDir, targetDir) {
-  const dir = join14(targetDir, ".sandcastle");
+  const dir = join15(targetDir, ".sandcastle");
   if (existsSync16(dir))
     return { scaffolded: false, dir };
   mkdirSync8(dir, { recursive: true });
   for (const name of readdirSync5(templateDir)) {
-    copyFileSync(join14(templateDir, name), join14(dir, name));
+    copyFileSync(join15(templateDir, name), join15(dir, name));
   }
   return { scaffolded: true, dir };
 }
@@ -5825,13 +5867,13 @@ var init_update_check = __esm(() => {
 
 // src/version.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname8, join as join15 } from "path";
+import { dirname as dirname8, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function runcastleVersion() {
   if (cached2)
     return cached2;
   const here = dirname8(fileURLToPath7(import.meta.url));
-  for (const pkgPath of [join15(here, "..", "package.json"), join15(here, "package.json")]) {
+  for (const pkgPath of [join16(here, "..", "package.json"), join16(here, "package.json")]) {
     try {
       const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
       if (typeof pkg.version === "string") {

package/index.js

@@ -1930,8 +1930,9 @@ var init_dev_pane = __esm(() => {
 });
 
 // src/services/git.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, realpathSync } from "fs";
-import { dirname, resolve as resolve3 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, mkdtempSync, realpathSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join as join6, resolve as resolve3 } from "path";
 import { simpleGit } from "simple-git";
 function featureBranch(slug) {
   return `feature/${slug}`;
@@ -2138,6 +2139,9 @@ function researchBranchName(slug, waypointSeq, unique) {
 function ticketBranchName(slug, ticketSeq, unique) {
   return `${TICKET_BRANCH_PREFIX}${tempBranchSlugSegment(slug)}/${ticketSeq}-${unique}`;
 }
+async function allowPushToCheckedOutBranches(repoPath) {
+  await git(repoPath).addConfig("receive.denyCurrentBranch", "ignore");
+}
 async function mergeTempBranch(repoPath, featureBranchName, tempBranch) {
   const g = git(repoPath);
   let branches;
@@ -2167,13 +2171,47 @@ async function mergeTempBranch(repoPath, featureBranchName, tempBranch) {
   } else {
     try {
       await g.raw(["fetch", ".", `${tempBranch}:${featureBranchName}`]);
-    } catch (e) {
-      return { ok: false, error: errMsg(e) };
+    } catch {
+      const merged = await mergeInDisposableWorktree(g, featureBranchName, tempBranch);
+      if (!merged.ok)
+        return merged;
     }
   }
   await deleteBranchDetachingWorktrees(g, repoPath, tempBranch);
   return { ok: true };
 }
+async function mergeInDisposableWorktree(g, featureBranchName, tempBranch) {
+  let dir;
+  try {
+    dir = mkdtempSync(join6(tmpdir(), "rc-land-"));
+  } catch (e) {
+    return { ok: false, error: errMsg(e) };
+  }
+  const wt = join6(dir, "wt");
+  try {
+    await g.raw(["worktree", "add", wt, featureBranchName]);
+    const gw = git(wt);
+    try {
+      await gw.merge([tempBranch]);
+    } catch (e) {
+      if (await mergeInProgress(gw)) {
+        await gw.raw(["merge", "--abort"]);
+        return { ok: false, conflict: true, error: errMsg(e) };
+      }
+      return { ok: false, error: errMsg(e) };
+    }
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: errMsg(e) };
+  } finally {
+    try {
+      await g.raw(["worktree", "remove", "--force", wt]);
+    } catch {}
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {}
+  }
+}
 async function deleteBranchDetachingWorktrees(g, repoPath, branch) {
   for (const holder of await worktreesOnBranch(g, branch, repoPath)) {
     try {
@@ -2379,7 +2417,7 @@ var init_git = __esm(() => {
 
 // src/services/knowledge.ts
 import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, writeFileSync } from "fs";
-import { join as join6, relative, resolve as resolve4, sep } from "path";
+import { join as join7, relative, resolve as resolve4, sep } from "path";
 function scaffoldDocs(ctx, feature) {
   const project = projectForFeature(ctx, feature);
   const dir = featureDocsDir(project, feature);
@@ -2434,7 +2472,7 @@ function listDocs(ctx, feature) {
   const dir = featureDocsDir(project, feature);
   if (!existsSync8(dir))
     return [];
-  return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => ({ relPath: e.name, title: readTitle(join6(dir, e.name), e.name) })).sort((a, b) => a.relPath.localeCompare(b.relPath));
+  return readdirSync2(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => ({ relPath: e.name, title: readTitle(join7(dir, e.name), e.name) })).sort((a, b) => a.relPath.localeCompare(b.relPath));
 }
 function readDoc(ctx, feature, relPath) {
   const project = projectForFeature(ctx, feature);
@@ -2475,21 +2513,21 @@ var init_knowledge = __esm(() => {
 
 // src/launcher/skills-root.ts
 import { existsSync as existsSync9 } from "fs";
-import { dirname as dirname2, join as join7, resolve as resolve5 } from "path";
+import { dirname as dirname2, join as join8, resolve as resolve5 } from "path";
 function resolveSkillsRoot(fromDir) {
   const override = process.env[SKILLS_DIR_ENV];
   if (override) {
     const root = resolve5(override);
-    if (existsSync9(join7(root, SKILLS_MARKER)))
+    if (existsSync9(join8(root, SKILLS_MARKER)))
       return root;
     throw new Error(`${SKILLS_DIR_ENV}=${override} is not a runcastle skills root (missing ${SKILLS_MARKER})`);
   }
   const searched = [];
   let dir = fromDir;
   for (let i = 0;i < 8; i += 1) {
-    const candidate = join7(dir, "packages", "skills");
+    const candidate = join8(dir, "packages", "skills");
     searched.push(candidate);
-    if (existsSync9(join7(candidate, SKILLS_MARKER)))
+    if (existsSync9(join8(candidate, SKILLS_MARKER)))
       return candidate;
     const parent = dirname2(dir);
     if (parent === dir)
@@ -2502,7 +2540,7 @@ function resolveSkillsRoot(fromDir) {
 }
 var SKILLS_DIR_ENV = "RUNCASTLE_SKILLS_DIR", SKILLS_MARKER;
 var init_skills_root = __esm(() => {
-  SKILLS_MARKER = join7("packs", "runcastle");
+  SKILLS_MARKER = join8("packs", "runcastle");
 });
 
 // src/services/agent-stream.ts
@@ -2547,7 +2585,7 @@ var init_agent_stream = __esm(() => {
 
 // src/workflows/ticket-burner.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "fs";
-import { dirname as dirname3, join as join8 } from "path";
+import { dirname as dirname3, join as join9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { claudeCode, run } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
@@ -2704,9 +2742,9 @@ function resolveBurnWorkspaceMode(config2, platform = process.platform) {
 function buildIsolatedSetupCommand(tempBranch, setupCommand) {
   const hookFile = `${ISOLATED_REPO_PATH}/.git/hooks/post-commit`;
   const parts = [
-    `git -C ${SANDBOX_WORKSPACE_PATH} config receive.denyCurrentBranch updateInstead`,
+    `git config --global --add safe.directory '*'`,
     `git clone ${SANDBOX_WORKSPACE_PATH} ${ISOLATED_REPO_PATH}`,
-    `printf '#!/bin/sh\\nexec git push --quiet origin HEAD:%s\\n' '${tempBranch}' > ${hookFile}`,
+    `printf '#!/bin/sh\\nunset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE\\ngit push --quiet origin HEAD:%s && exec git -C ${SANDBOX_WORKSPACE_PATH} reset --hard --quiet %s\\n' '${tempBranch}' '${tempBranch}' > ${hookFile}`,
     `chmod +x ${hookFile}`
   ];
   if (setupCommand)
@@ -2727,7 +2765,7 @@ function buildWorkspaceNotes(mode) {
 `);
 }
 function readRepoToolchain(repoPath) {
-  const pkgPath = join8(repoPath, "package.json");
+  const pkgPath = join9(repoPath, "package.json");
   const hasPackageJson = existsSync10(pkgPath);
   let packageManagerField;
   if (hasPackageJson) {
@@ -2741,10 +2779,10 @@ function readRepoToolchain(repoPath) {
     hasPackageJson,
     ...packageManagerField !== undefined ? { packageManagerField } : {},
     lockfiles: {
-      bun: existsSync10(join8(repoPath, "bun.lock")) || existsSync10(join8(repoPath, "bun.lockb")),
-      pnpm: existsSync10(join8(repoPath, "pnpm-lock.yaml")),
-      yarn: existsSync10(join8(repoPath, "yarn.lock")),
-      npm: existsSync10(join8(repoPath, "package-lock.json"))
+      bun: existsSync10(join9(repoPath, "bun.lock")) || existsSync10(join9(repoPath, "bun.lockb")),
+      pnpm: existsSync10(join9(repoPath, "pnpm-lock.yaml")),
+      yarn: existsSync10(join9(repoPath, "yarn.lock")),
+      npm: existsSync10(join9(repoPath, "package-lock.json"))
     }
   };
 }
@@ -2954,23 +2992,23 @@ async function burnRun(ctx, deps) {
 }
 function burnerTemplatePath() {
   const here = dirname3(fileURLToPath2(import.meta.url));
-  return join8(resolveSkillsRoot(here), "burner", "implement-ticket.md");
+  return join9(resolveSkillsRoot(here), "burner", "implement-ticket.md");
 }
 function readDocsDigestFromDisk(projectId, slug) {
   const worktree = worktreeDir(projectId, slug);
   if (!existsSync10(worktree))
     return "_No talk worktree on disk \u2014 docs digest skipped._";
-  const docsDir = join8(worktree, ...featureDocsRel(slug).split("/"));
+  const docsDir = join9(worktree, ...featureDocsRel(slug).split("/"));
   if (!existsSync10(docsDir))
     return "_No docs/features dir in the talk worktree \u2014 docs digest skipped._";
-  const files = readdirSync3(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync4(join8(docsDir, e.name), "utf8") }));
+  const files = readdirSync3(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync4(join9(docsDir, e.name), "utf8") }));
   return buildDocsDigest(files);
 }
 function readBlockedFile(dirs) {
   for (const dir of dirs) {
     if (!dir)
       continue;
-    const p = join8(dir, "BLOCKED.md");
+    const p = join9(dir, "BLOCKED.md");
     if (existsSync10(p)) {
       try {
         return readFileSync4(p, "utf8");
@@ -3013,10 +3051,12 @@ function selectSandbox(config2, mounts = []) {
       return noSandbox();
   }
 }
-async function realExecuteTicketRun(ctx, ticket, config2, token, model, land) {
+async function realExecuteTicketRun(ctx, ticket, config2, token, model, land, ensureIsolatedPushTarget) {
   const { project, feature } = ctx;
   const tempBranch = ticketBranchName(feature.slug, ticket.seq, newId("b").slice(2, 10));
   const workspaceMode = resolveBurnWorkspaceMode(config2);
+  if (workspaceMode === "isolated")
+    await ensureIsolatedPushTarget();
   const template = readFileSync4(burnerTemplatePath(), "utf8");
   const prompt = renderTicketPrompt(template, {
     TICKET_JSON: buildTicketJson(ticket),
@@ -3045,7 +3085,7 @@ async function realExecuteTicketRun(ctx, ticket, config2, token, model, land) {
     });
   }
   mkdirSync4(logsDir(), { recursive: true });
-  const logFilePath = join8(logsDir(), `burn-${feature.id}-${ticket.seq}.log`);
+  const logFilePath = join9(logsDir(), `burn-${feature.id}-${ticket.seq}.log`);
   const throttle = createStreamThrottle((e) => ctx.emitEvent({ ...e, ticketId: ticket.id }));
   beginTranscript(ticket.id);
   const onStreamEvent = (event) => {
@@ -3130,11 +3170,13 @@ function resolveBurnDeps(ctx) {
   const token = readTokenFromEnvFile(envPath());
   const model = resolveModel("implement", config2, ctx.project, ctx.modelOverride);
   const land = createSerialQueue();
+  let pushTargetReady;
+  const ensureIsolatedPushTarget = () => pushTargetReady ??= allowPushToCheckedOutBranches(ctx.project.repoPath);
   return {
     config: config2,
     hasAuthToken: token !== undefined,
     concurrency: config2.burnConcurrency,
-    executeTicketRun: (c, ticket) => realExecuteTicketRun(c, ticket, config2, token, model, land)
+    executeTicketRun: (c, ticket) => realExecuteTicketRun(c, ticket, config2, token, model, land, ensureIsolatedPushTarget)
   };
 }
 function readTokenFromEnvFile(path) {
@@ -3179,7 +3221,7 @@ var init_ticket_burner = __esm(() => {
 
 // src/workflows/research.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname4, join as join9 } from "path";
+import { dirname as dirname4, join as join10 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { run as run2 } from "@ai-hero/sandcastle";
 import { docker as docker2 } from "@ai-hero/sandcastle/sandboxes/docker";
@@ -3251,16 +3293,16 @@ function interpretResearchResult(result, docRelPath) {
 }
 function researchTemplatePath() {
   const here = dirname4(fileURLToPath3(import.meta.url));
-  return join9(resolveSkillsRoot(here), "burner", "research-waypoint.md");
+  return join10(resolveSkillsRoot(here), "burner", "research-waypoint.md");
 }
 function readDocsDigestFromDisk2(projectId, slug) {
   const worktree = worktreeDir(projectId, slug);
   if (!existsSync11(worktree))
     return "_No talk worktree on disk \u2014 docs digest skipped._";
-  const docsDir = join9(worktree, ...featureDocsRel(slug).split("/"));
+  const docsDir = join10(worktree, ...featureDocsRel(slug).split("/"));
   if (!existsSync11(docsDir))
     return "_No docs/features dir in the talk worktree \u2014 docs digest skipped._";
-  const files = readdirSync4(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync5(join9(docsDir, e.name), "utf8") }));
+  const files = readdirSync4(docsDir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).sort((a, b) => a.name.localeCompare(b.name)).map((e) => ({ name: e.name, content: readFileSync5(join10(docsDir, e.name), "utf8") }));
   return buildDocsDigest(files);
 }
 async function realExecuteResearchRun(ctx, waypoint, config2, token, model) {
@@ -3275,7 +3317,7 @@ async function realExecuteResearchRun(ctx, waypoint, config2, token, model) {
     RESEARCH_DOC_PATH: docRelPath
   });
   mkdirSync5(logsDir(), { recursive: true });
-  const logFilePath = join9(logsDir(), `research-${feature.id}-${waypoint.seq}.log`);
+  const logFilePath = join10(logsDir(), `research-${feature.id}-${waypoint.seq}.log`);
   const throttle = createResearchStreamThrottle((e) => ctx.emitEvent(e));
   const runOptions = {
     agent: buildBurnAgent(config2, token, model),
@@ -4136,7 +4178,7 @@ var init_hooks = __esm(() => {
 // src/routes/web.ts
 import { existsSync as existsSync12, statSync } from "fs";
 import { readFile } from "fs/promises";
-import { extname, join as join10, normalize, resolve as resolve6, sep as sep2 } from "path";
+import { extname, join as join11, normalize, resolve as resolve6, sep as sep2 } from "path";
 function contentType(path) {
   return MIME[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
@@ -4154,7 +4196,7 @@ function safeJoin(root, pathname) {
   } catch {
     return null;
   }
-  const joined = normalize(join10(root, decoded));
+  const joined = normalize(join11(root, decoded));
   if (joined !== root && !joined.startsWith(root + sep2))
     return null;
   return joined;
@@ -4167,7 +4209,7 @@ function resolveWebDist() {
 }
 function mountWebApp(app, distDir) {
   const root = resolve6(distDir);
-  const indexHtml = join10(root, "index.html");
+  const indexHtml = join11(root, "index.html");
   app.get("*", async (c, next) => {
     const { pathname } = new URL(c.req.url);
     if (/^\/(api|mcp|ws|health)(\/|$)/.test(pathname))
@@ -4187,7 +4229,7 @@ function mountWebApp(app, distDir) {
 }
 function mountWebAppIfBuilt(app) {
   const dist = resolveWebDist();
-  if (existsSync12(join10(dist, "index.html")))
+  if (existsSync12(join11(dist, "index.html")))
     mountWebApp(app, dist);
 }
 var MIME;
@@ -4263,7 +4305,7 @@ var init_events2 = __esm(() => {
 // src/launcher/artifacts.ts
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync2 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function hookClientPath() {
   return resolveAsset(ASSET_ENV.hookClient, fileURLToPath4(new URL("./hook-client.ts", import.meta.url)));
 }
@@ -4475,9 +4517,9 @@ async function writeSessionArtifacts(input) {
   const { session, feature, config: config2, waypoint } = input;
   const dir = sessionDir(session.id);
   mkdirSync6(dir, { recursive: true });
-  const systemPromptPath = join11(dir, "system-prompt.md");
-  const settingsPath = join11(dir, "settings.json");
-  const mcpConfigPath = join11(dir, "mcp.json");
+  const systemPromptPath = join12(dir, "system-prompt.md");
+  const settingsPath = join12(dir, "settings.json");
+  const mcpConfigPath = join12(dir, "mcp.json");
   writeFileSync2(systemPromptPath, renderSystemPrompt(feature, session.kind, waypoint), "utf8");
   writeFileSync2(settingsPath, JSON.stringify(renderSettings(hookClientPath()), null, 2), "utf8");
   writeFileSync2(mcpConfigPath, JSON.stringify(renderMcpConfig(session, config2), null, 2), "utf8");
@@ -4539,7 +4581,7 @@ var init_end_session = __esm(() => {
 
 // src/launcher/launcher.ts
 import { existsSync as existsSync13 } from "fs";
-import { dirname as dirname5, join as join12, resolve as resolve7 } from "path";
+import { dirname as dirname5, join as join13, resolve as resolve7 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { and as and5, eq as eq8 } from "drizzle-orm";
 function ptyExitMessage(exitCode) {
@@ -4577,10 +4619,10 @@ function claudeSpawnTarget(claudeArgs) {
   return { file: exe, args: claudeArgs };
 }
 function resolvePluginDir(fromDir = dirname5(fileURLToPath5(import.meta.url))) {
-  const rel = join12("packages", "skills", "packs", "runcastle");
+  const rel = join13("packages", "skills", "packs", "runcastle");
   const override = process.env[SKILLS_DIR_ENV];
   if (override) {
-    const dir2 = join12(resolve7(override), "packs", "runcastle");
+    const dir2 = join13(resolve7(override), "packs", "runcastle");
     if (existsSync13(dir2))
       return dir2;
     throw new Error(`${SKILLS_DIR_ENV}=${override} has no plugin dir at ${dir2}`);
@@ -4588,7 +4630,7 @@ function resolvePluginDir(fromDir = dirname5(fileURLToPath5(import.meta.url))) {
   const searched = [];
   let dir = fromDir;
   for (let i = 0;i < 8; i += 1) {
-    const candidate = join12(dir, rel);
+    const candidate = join13(dir, rel);
     searched.push(candidate);
     if (existsSync13(candidate))
       return candidate;
@@ -4942,7 +4984,7 @@ var init_feature = __esm(() => {
 
 // src/services/projects.ts
 import { existsSync as existsSync14 } from "fs";
-import { basename, join as join13 } from "path";
+import { basename, join as join14 } from "path";
 import { eq as eq9, isNull } from "drizzle-orm";
 function listProjects(ctx) {
   return ctx.db.select().from(projects).where(isNull(projects.closedAt)).all().map(rowToProject);
@@ -5018,7 +5060,7 @@ async function assertRepoTolerant(ctx, repoPath) {
   } catch (e) {
     if (!isNotImplemented(e))
       throw e;
-    if (!existsSync14(join13(repoPath, ".git"))) {
+    if (!existsSync14(join14(repoPath, ".git"))) {
       throw new InvalidInputError(`not a git repository: ${repoPath}`);
     }
   }
@@ -5545,7 +5587,7 @@ var init_system_exec = __esm(() => {
 
 // src/services/setup.ts
 import { copyFileSync, existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync7, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname7, join as join14 } from "path";
+import { dirname as dirname7, join as join15 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 async function writeGitIdentity(exec, identity) {
   const name = identity.name.trim();
@@ -5623,11 +5665,11 @@ function resolveSandcastleBin() {
     const mainUrl = import.meta.resolve("@ai-hero/sandcastle");
     let dir = dirname7(fileURLToPath6(mainUrl));
     for (let hops = 0;hops < 6; hops++) {
-      const manifestPath = join14(dir, "package.json");
+      const manifestPath = join15(dir, "package.json");
       if (existsSync16(manifestPath)) {
         const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
         if (manifest.name === "@ai-hero/sandcastle" && manifest.bin?.sandcastle) {
-          return join14(dir, manifest.bin.sandcastle);
+          return join15(dir, manifest.bin.sandcastle);
         }
       }
       const parent = dirname7(dir);
@@ -5655,12 +5697,12 @@ function sandcastleTemplateDir() {
   return resolveAsset(ASSET_ENV.sandcastleTemplate, fileURLToPath6(new URL("../assets/sandcastle", import.meta.url)));
 }
 function scaffoldSandcastleConfig(templateDir, targetDir) {
-  const dir = join14(targetDir, ".sandcastle");
+  const dir = join15(targetDir, ".sandcastle");
   if (existsSync16(dir))
     return { scaffolded: false, dir };
   mkdirSync8(dir, { recursive: true });
   for (const name of readdirSync5(templateDir)) {
-    copyFileSync(join14(templateDir, name), join14(dir, name));
+    copyFileSync(join15(templateDir, name), join15(dir, name));
   }
   return { scaffolded: true, dir };
 }
@@ -5824,13 +5866,13 @@ var init_update_check = __esm(() => {
 
 // src/version.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname8, join as join15 } from "path";
+import { dirname as dirname8, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function runcastleVersion() {
   if (cached2)
     return cached2;
   const here = dirname8(fileURLToPath7(import.meta.url));
-  for (const pkgPath of [join15(here, "..", "package.json"), join15(here, "package.json")]) {
+  for (const pkgPath of [join16(here, "..", "package.json"), join16(here, "package.json")]) {
     try {
       const pkg = JSON.parse(readFileSync8(pkgPath, "utf8"));
       if (typeof pkg.version === "string") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcastle",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Burn tickets into shipped features with Claude Code.",
   "license": "MIT",
   "type": "module",