runcastle 1.2.9 → 1.2.10

package/bin/runcastle.js

@@ -147,7 +147,6 @@ var init_config = __esm(() => {
     models: z.array(ModelEntry).default([]),
     sandbox: z.enum(["docker", "podman", "noSandbox"]).default("docker"),
     sessionMcp: z.enum(["inherit", "runcastleOnly"]).default("inherit"),
-    mainBranch: z.string().default("main"),
     sandboxImage: z.string().optional(),
     burnConcurrency: z.number().int().min(1).max(8).default(3),
     burnCpus: z.number().positive().max(256).optional(),
@@ -277,7 +276,7 @@ var init_schemas = __esm(() => {
     id: z2.string(),
     name: z2.string(),
     repoPath: z2.string(),
-    mainBranch: z2.string(),
+    sessionBranch: z2.string().optional(),
     devCommand: z2.string().optional(),
     model: z2.string().optional(),
     setupCommand: z2.string().optional(),
@@ -544,7 +543,7 @@ var init_db_schema = __esm(() => {
     id: text("id").primaryKey(),
     name: text("name").notNull(),
     repoPath: text("repo_path").notNull(),
-    mainBranch: text("main_branch").notNull(),
+    sessionBranch: text("session_branch"),
     devCommand: text("dev_command"),
     model: text("model"),
     sandbox: text("sandbox"),
@@ -817,8 +816,6 @@ function loadConfig(env = process.env) {
     overrides.sandbox = env.RUNCASTLE_SANDBOX;
   if (env.RUNCASTLE_SESSION_MCP)
     overrides.sessionMcp = env.RUNCASTLE_SESSION_MCP;
-  if (env.RUNCASTLE_MAIN_BRANCH)
-    overrides.mainBranch = env.RUNCASTLE_MAIN_BRANCH;
   if (env.RUNCASTLE_SANDBOX_IMAGE)
     overrides.sandboxImage = env.RUNCASTLE_SANDBOX_IMAGE;
   num("burnConcurrency", env.RUNCASTLE_BURN_CONCURRENCY);
@@ -1760,7 +1757,7 @@ function rowToProject(row) {
     id: row.id,
     name: row.name,
     repoPath: row.repoPath,
-    mainBranch: row.mainBranch,
+    sessionBranch: row.sessionBranch ?? undefined,
     devCommand: row.devCommand ?? undefined,
     model: row.model ?? undefined,
     setupCommand: row.setupCommand ?? undefined,
@@ -2498,11 +2495,12 @@ function markVerified(ctx, projectId, keys, sha) {
 async function listFindings(ctx, project) {
   const rows = ctx.db.select().from(projectFindings).where(eq4(projectFindings.projectId, project.id)).all();
   const distances = new Map;
-  for (const row of rows) {
-    const sha = row.establishedSha;
-    if (!sha || distances.has(sha))
-      continue;
-    distances.set(sha, await commitsSince(project.repoPath, sha, project.mainBranch));
+  const shas = new Set(rows.flatMap((row) => row.establishedSha ? [row.establishedSha] : []));
+  if (shas.size > 0) {
+    const mainLine = await detectMainBranch(project.repoPath);
+    for (const sha of shas) {
+      distances.set(sha, await commitsSince(project.repoPath, sha, mainLine));
+    }
   }
   const order = new Map(PREPARED_KEYS.map((k, i) => [k, i]));
   return rows.filter((row) => isPreparedKey(row.key)).sort((a, b) => (order.get(a.key) ?? 0) - (order.get(b.key) ?? 0)).map((row) => {
@@ -2571,8 +2569,11 @@ function migrationPaths(paths) {
 function featureBranch(slug) {
   return `feature/${slug}`;
 }
-function mergeTarget(project, feature) {
-  return feature.baseBranch ?? project.mainBranch;
+function featureBase(feature) {
+  if (!feature.baseBranch) {
+    throw new GateError(`feature ${feature.slug} has no recorded base branch \u2014 it has not been cut from one yet`);
+  }
+  return feature.baseBranch;
 }
 function git(repoPath) {
   return simpleGit(repoPath);
@@ -2622,9 +2623,31 @@ async function detectMainBranch(repoPath) {
   } catch {}
   return "main";
 }
+async function resolveSessionBranch(project) {
+  const stored = project.sessionBranch?.trim();
+  if (!stored)
+    return detectMainBranch(project.repoPath);
+  const local = await git(project.repoPath).branchLocal();
+  if (!local.all.includes(stored)) {
+    throw new GateError(`the configured session landing branch \`${stored}\` no longer exists in ${project.repoPath} \u2014 pick where this chat's work should land`);
+  }
+  return stored;
+}
+async function sessionBranchView(project) {
+  const stored = project.sessionBranch?.trim() || null;
+  const detected = await detectMainBranch(project.repoPath);
+  return { stored, effective: stored ?? detected, detected };
+}
+async function currentCheckoutBranch(project) {
+  const local = await git(project.repoPath).branchLocal();
+  if (local.detached || !local.current) {
+    throw new InvalidInputError(`${project.repoPath} has no branch checked out (detached HEAD) \u2014 name the branch to fork from`);
+  }
+  return local.current;
+}
 async function createFeatureBranch(project, slug, base) {
   const branch = featureBranch(slug);
-  const from = base?.trim() || project.mainBranch;
+  const from = base.trim();
   const g = git(project.repoPath);
   const branches = await g.branchLocal();
   if (branches.all.includes(branch))
@@ -2638,7 +2661,9 @@ async function createFeatureBranch(project, slug, base) {
 async function listBranches(project) {
   const g = git(project.repoPath);
   const local = await g.branchLocal();
-  const branches = local.all.filter((name) => !name.startsWith("feature/"));
+  const detachedRef = local.detached ? local.current : null;
+  const current = local.detached ? "" : local.current;
+  const branches = local.all.filter((name) => !name.startsWith("feature/") && name !== detachedRef);
   const localSet = new Set(local.all);
   let remoteBranches = [];
   try {
@@ -2648,7 +2673,7 @@ async function listBranches(project) {
       return !short.startsWith("feature/") && !localSet.has(short);
     });
   } catch {}
-  return { current: local.current, mainBranch: project.mainBranch, branches, remoteBranches };
+  return { current, branches, remoteBranches };
 }
 async function resolveBaseBranch(project, base) {
   const g = git(project.repoPath);
@@ -2674,7 +2699,7 @@ async function ensureTalkWorktree(project, feature) {
   const worktreePath = worktreeDir(project.id, feature.slug);
   const branch = featureBranch(feature.slug);
   const g = git(project.repoPath);
-  await ensureBranchExists(g, branch, feature.baseBranch ?? project.mainBranch);
+  await ensureBranchExists(g, branch, featureBase(feature));
   if (await worktreeIsValid(g, worktreePath, branch))
     return worktreePath;
   if (existsSync6(worktreePath) && (await registeredWorktrees(g)).has(canon(worktreePath))) {
@@ -2756,8 +2781,8 @@ function slash(path) {
 async function ensureProjectWorktree(project, onLanded) {
   const worktreePath = worktreeDir(project.id, PROJECT_WORKTREE_SLUG);
   const g = git(project.repoPath);
-  const base = project.mainBranch;
-  const landed = await landProjectBranch(project);
+  const base = await resolveSessionBranch(project);
+  const landed = await landProjectBranch(project, base);
   if (landed)
     onLanded?.(landed);
   const stillAhead = await branchCommitsAhead(project.repoPath, base, PROJECT_BRANCH);
@@ -2766,12 +2791,13 @@ async function ensureProjectWorktree(project, onLanded) {
     await g.raw(["branch", PROJECT_BRANCH, base]);
   }
   if (await worktreeIsValid(g, worktreePath, PROJECT_BRANCH))
-    return worktreePath;
+    return { worktreePath, base };
   if (existsSync6(worktreePath) && (await registeredWorktrees(g)).has(canon(worktreePath))) {
     if (await checkoutInWorktree(worktreePath, PROJECT_BRANCH))
-      return worktreePath;
+      return { worktreePath, base };
   }
-  return addWorktree(g, worktreePath, PROJECT_BRANCH, "project worktree");
+  const added = await addWorktree(g, worktreePath, PROJECT_BRANCH, "project worktree");
+  return { worktreePath: added, base };
 }
 async function checkoutInWorktree(worktreePath, branch) {
   const gw = git(worktreePath);
@@ -2935,7 +2961,7 @@ async function branchCommitsAhead(repoPath, base, branch) {
   }
 }
 async function reviewCommitCount(project, feature) {
-  const base = mergeTarget(project, feature);
+  const base = featureBase(feature);
   const branch = featureBranch(feature.slug);
   try {
     const out = (await git(project.repoPath).raw(["rev-list", "--count", `${base}..${branch}`])).trim();
@@ -2946,7 +2972,7 @@ async function reviewCommitCount(project, feature) {
   }
 }
 async function featureBranchDelta(project, feature) {
-  const base = mergeTarget(project, feature);
+  const base = featureBase(feature);
   const branch = featureBranch(feature.slug);
   try {
     const out = await git(project.repoPath).raw(["diff", "--stat", `${base}...${branch}`]);
@@ -3121,12 +3147,13 @@ async function deleteBranchDetachingWorktrees(g, repoPath, branch) {
     return false;
   }
 }
-async function landProjectBranch(project) {
-  const ahead = await branchCommitsAhead(project.repoPath, project.mainBranch, PROJECT_BRANCH);
+async function landProjectBranch(project, base) {
+  const ahead = await branchCommitsAhead(project.repoPath, base, PROJECT_BRANCH);
   if (ahead.length === 0)
     return null;
-  const res = await mergeTempBranch(project.repoPath, project.mainBranch, PROJECT_BRANCH);
+  const res = await mergeTempBranch(project.repoPath, base, PROJECT_BRANCH);
   return {
+    base,
     commits: ahead.length,
     landed: res.ok,
     ...res.conflict ? { conflict: true } : {},
@@ -3507,7 +3534,7 @@ async function stopDryRun(ctx, project, state) {
   });
   const { participating, failure } = dryRunVerdict(project, state);
   if (!failure && participating.length > 0) {
-    const sha = await headSha(project.repoPath, project.mainBranch) ?? null;
+    const sha = await headSha(project.repoPath, await detectMainBranch(project.repoPath)) ?? null;
     markVerified(ctx, project.id, participating, sha);
     emitProject(ctx, project.id, {
       type: "prep.dryrun.verified",
@@ -3669,7 +3696,7 @@ async function detectDbDrift(ctx, project, feature, previousBranch, driveBranch)
   return drift;
 }
 async function mergeFeature(project, feature) {
-  const target = mergeTarget(project, feature);
+  const target = featureBase(feature);
   if (testDriveState) {
     throw new GateError("Cannot merge while a test drive is active \u2014 stop it first");
   }
@@ -4273,7 +4300,7 @@ function renderDriveFixPrompt(brief) {
 `);
 }
 function renderProjectPrompt(brief, runtime = DEFAULT_RUNTIME) {
-  const { project, branch, worktreePath } = brief;
+  const { project, branch, worktreePath, base } = brief;
   return [
     `# runcastle \u2014 ${project.name} (project session)`,
     "",
@@ -4299,8 +4326,8 @@ function renderProjectPrompt(brief, runtime = DEFAULT_RUNTIME) {
     "## Where you are working \u2014 and where your writes go",
     `- Working directory: \`${worktreePath}\` \u2014 a runcastle-owned worktree, NOT the human's`,
     `  checkout at \`${project.repoPath}\`.`,
-    `- Branch: \`${branch}\`, cut from \`${project.mainBranch}\` when this session launched.`,
-    `- **Your commits land on \`${project.mainBranch}\` when this terminal closes**, arriving`,
+    `- Branch: \`${branch}\`, cut from \`${base}\` when this session launched.`,
+    `- **Your commits land on \`${base}\` when this terminal closes**, arriving`,
     "  in the human's checkout the way a `git pull` does. Write real code and real docs \u2014",
     "  there is no sandbox here \u2014 and commit everything you write before you finish.",
     "  A session that edits without committing leaves a dirty tree, which is exactly what",
@@ -4587,10 +4614,23 @@ var init_claude = __esm(() => {
   };
 });
 
-// src/doctor/doctor.ts
+// src/services/codex-auth.ts
 import { existsSync as existsSync8 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join9 } from "path";
+function codexHomeDir(env = process.env) {
+  return env.CODEX_HOME ?? join9(env.HOME ?? env.USERPROFILE ?? homedir2(), ".codex");
+}
+function codexAuthFile(env = process.env) {
+  return join9(codexHomeDir(env), "auth.json");
+}
+function codexLoggedIn(env = process.env, fileExists = existsSync8) {
+  return fileExists(codexAuthFile(env));
+}
+var init_codex_auth = () => {};
+
+// src/doctor/doctor.ts
+import { existsSync as existsSync9 } from "fs";
 async function versionProbe(exec, id, label, bin, fix) {
   const out = await exec(bin, ["--version"]);
   if (out.ok && out.code === 0) {
@@ -4622,9 +4662,6 @@ async function nodeProbe(exec) {
 async function gitProbe(exec) {
   return versionProbe(exec, "git", "Git", "git", "Install Git: winget install Git.Git / brew install git / apt install git");
 }
-function codexAuthFile(env) {
-  return join9(env.CODEX_HOME ?? join9(env.HOME ?? env.USERPROFILE ?? homedir2(), ".codex"), "auth.json");
-}
 function statusUnsupported(out) {
   return /unknown command|unrecognized subcommand|unexpected argument|invalid subcommand/i.test(`${out.stderr} ${out.stdout}`);
 }
@@ -4656,23 +4693,38 @@ async function runtimeAuthProbe(spec, exec, env, fileExists, severity) {
       fix: spec.installFix
     };
   }
+  const authFile = spec.authFile?.(env);
+  if (authFile) {
+    const present = fileExists(authFile);
+    const statusCommand = `${spec.bin} ${spec.authStatusArgs.join(" ")}`;
+    let coda;
+    if (statusUnsupported(out)) {
+      coda = ` \u2014 this ${spec.bin} cannot report login state`;
+    } else if (out.code === 0 === present) {
+      coda = ` \u2014 \`${statusCommand}\` agrees`;
+    } else if (present) {
+      coda = `, but \`${statusCommand}\` reports logged out \u2014 burns borrow the file, so this host counts as signed in`;
+    } else {
+      coda = `, but \`${statusCommand}\` reports a login \u2014 a burn borrows the file, and it is not there`;
+    }
+    return present ? { ...base, status: "ok", detail: `credentials found at ${authFile}${coda}` } : { ...loggedOut, detail: `no credentials at ${authFile}${coda}` };
+  }
   if (out.code === 0)
     return { ...base, status: "ok", detail: `${spec.bin} reports a login` };
   if (!statusUnsupported(out))
     return loggedOut;
-  const authFile = spec.authFile?.(env);
-  if (!authFile) {
-    return {
-      ...base,
-      status: "ok",
-      detail: `this ${spec.bin} cannot report login state \u2014 it prompts at launch`
-    };
-  }
-  return fileExists(authFile) ? { ...base, status: "ok", detail: `credentials found at ${authFile}` } : { ...loggedOut, detail: `no credentials at ${authFile}` };
+  return {
+    ...base,
+    status: "ok",
+    detail: `this ${spec.bin} cannot report login state \u2014 it prompts at launch`
+  };
 }
 function runtimeAfkKeyProbe(spec, env, severity = "error") {
+  const id = spec.ids.afkKey;
+  if (!id)
+    return;
   const base = {
-    id: spec.ids.afkKey,
+    id,
     label: `${spec.label} AFK ${spec.afkNoun} (${spec.afkKey})`,
     tier: 2,
     severity,
@@ -4691,11 +4743,12 @@ function runtimeAfkKeyProbe(spec, env, severity = "error") {
   };
 }
 async function runtimeProbes(spec, deps) {
-  const fileExists = deps.fileExists ?? existsSync8;
+  const fileExists = deps.fileExists ?? existsSync9;
+  const afkKeyProbe = runtimeAfkKeyProbe(spec, deps.env, deps.severity);
   return [
     await runtimeBinaryProbe(spec, deps.exec, deps.severity),
     await runtimeAuthProbe(spec, deps.exec, deps.env, fileExists, deps.severity),
-    runtimeAfkKeyProbe(spec, deps.env, deps.severity)
+    ...afkKeyProbe ? [afkKeyProbe] : []
   ];
 }
 async function gitIdentityProbe(exec, cwd) {
@@ -4849,6 +4902,7 @@ function exitCodeFor(report, mode) {
 var RUNTIME_SPECS;
 var init_doctor = __esm(() => {
   init_src();
+  init_codex_auth();
   RUNTIME_SPECS = {
     "claude-code": {
       runtime: "claude-code",
@@ -4868,13 +4922,13 @@ var init_doctor = __esm(() => {
       runtime: "codex",
       label: "Codex",
       bin: "codex",
-      ids: { binary: "codex", auth: "codex-auth", afkKey: "codex-api-key" },
+      ids: { binary: "codex", auth: "codex-auth" },
       authStatusArgs: ["login", "status"],
       loginCommand: "codex login",
       loginArgs: ["login"],
       afkKey: "CODEX_API_KEY",
       afkNoun: "API key",
-      afkFix: "Create an OpenAI API key (platform.openai.com/api-keys) and put CODEX_API_KEY in ~/.runcastle/.env",
+      afkFix: "Set CODEX_API_KEY in ~/.runcastle/.env to bill an OpenAI API key instead of your ChatGPT login",
       installFix: "Install Codex: npm install -g @openai/codex (or: brew install codex)",
       binOverrideEnv: "RUNCASTLE_CODEX_BIN",
       authFile: codexAuthFile
@@ -4885,31 +4939,33 @@ var init_doctor = __esm(() => {
 // src/launcher/runtimes/codex.ts
 import {
   copyFileSync,
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync4,
   readdirSync as readdirSync2,
   statSync,
   writeFileSync as writeFileSync3
 } from "fs";
-import { homedir as homedir3 } from "os";
 import { basename, dirname as dirname3, join as join10, resolve as resolve7 } from "path";
-function codexHomeDir(sessionId) {
+function codexHomeDir2(sessionId) {
   return join10(sessionDir(sessionId), "codex-home");
 }
 function realCodexAuthFile(env = process.env) {
-  return CODEX.authFile?.(env) ?? join10(homedir3(), ".codex", "auth.json");
+  return codexAuthFile(env);
 }
 function toml(value) {
   return JSON.stringify(value);
 }
+function approvalPolicyFor(permissionMode) {
+  return permissionMode === undefined || permissionMode === "acceptEdits" ? "never" : "untrusted";
+}
 function renderCodexConfig(input) {
-  const { session, config: config2, model, worktreePath, inheritedMcpServers } = input;
+  const { session, config: config2, model, worktreePath, inheritedMcpServers, permissionMode } = input;
   return [
     `# Generated by runcastle for session ${session.id} \u2014 rewritten at every launch.`,
     `model = ${toml(model)}`,
     'sandbox_mode = "workspace-write"',
-    'approval_policy = "never"',
+    `approval_policy = ${toml(approvalPolicyFor(permissionMode))}`,
     "",
     `[projects.${toml(worktreePath)}]`,
     'trust_level = "trusted"',
@@ -4941,7 +4997,7 @@ function mcpServerTables(userConfigToml) {
 }
 function readInheritedMcpServers(env = process.env) {
   const path = join10(dirname3(realCodexAuthFile(env)), "config.toml");
-  if (!existsSync9(path))
+  if (!existsSync10(path))
     return "";
   try {
     return mcpServerTables(readFileSync4(path, "utf8"));
@@ -4965,15 +5021,15 @@ function renderCodexHooks(hookClient, kind, platform = process.platform) {
   };
 }
 function writeCodexSkills(worktreePath, packDir) {
-  if (!existsSync9(worktreePath))
+  if (!existsSync10(worktreePath))
     return [];
   const source = join10(packDir, "skills");
-  if (!existsSync9(source))
+  if (!existsSync10(source))
     return [];
   const written = [];
   for (const name of readdirSync2(source)) {
     const skill = join10(source, name, "SKILL.md");
-    if (!existsSync9(skill))
+    if (!existsSync10(skill))
       continue;
     const target = join10(worktreePath, CODEX_SKILLS_REL, name);
     mkdirSync4(target, { recursive: true });
@@ -4992,7 +5048,7 @@ function excludeFromGit(worktreePath, entry) {
       return;
     mkdirSync4(info, { recursive: true });
     const path = join10(info, "exclude");
-    const existing = existsSync9(path) ? readFileSync4(path, "utf8") : "";
+    const existing = existsSync10(path) ? readFileSync4(path, "utf8") : "";
     if (existing.split(/\r?\n/).some((line) => line.trim() === entry))
       return;
     const head = existing.length > 0 && !existing.endsWith(`
@@ -5004,7 +5060,7 @@ function excludeFromGit(worktreePath, entry) {
 }
 function gitInfoDir(worktreePath) {
   const dotGit = join10(worktreePath, ".git");
-  if (!existsSync9(dotGit))
+  if (!existsSync10(dotGit))
     return null;
   if (statSync(dotGit).isDirectory())
     return join10(dotGit, "info");
@@ -5025,6 +5081,7 @@ var CODEX_BIN = "codex", CODEX, CODEX_SKILLS_REL, CODEX_SKILLS_IGNORE = ".agents
 var init_codex = __esm(() => {
   init_paths();
   init_doctor();
+  init_codex_auth();
   init_resolve_executable();
   init_artifacts();
   init_edit_guard();
@@ -5047,7 +5104,7 @@ var init_codex = __esm(() => {
           doctorHint: 'Run `runcastle doctor` and fix its "Codex CLI" probe, then restart runcastle from a ' + "terminal where `codex --version` works."
         };
       }
-      if (!existsSync9(realCodexAuthFile())) {
+      if (!existsSync10(realCodexAuthFile())) {
         return {
           ok: false,
           reason: "Codex is installed but not logged in \u2014 runcastle copies your own credentials into " + `each session's home, and there are none at ${realCodexAuthFile()}`,
@@ -5057,7 +5114,7 @@ var init_codex = __esm(() => {
       return { ok: true };
     },
     async writeArtifacts(input) {
-      const home = codexHomeDir(input.session.id);
+      const home = codexHomeDir2(input.session.id);
       mkdirSync4(home, { recursive: true });
       const configPath2 = join10(home, "config.toml");
       const hooksPath = join10(home, "hooks.json");
@@ -5067,13 +5124,14 @@ var init_codex = __esm(() => {
         config: input.config,
         model: input.model,
         worktreePath: input.worktreePath,
+        ...input.permissionMode ? { permissionMode: input.permissionMode } : {},
         ...input.config.sessionMcp === "inherit" ? { inheritedMcpServers: readInheritedMcpServers() } : {}
       }), "utf8");
       writeFileSync3(hooksPath, JSON.stringify(renderCodexHooks(hookClientPath(), input.session.kind), null, 2), "utf8");
       writeFileSync3(agentsPath, renderSessionPrompt({ ...input, runtime: this.id }), "utf8");
       const files = [configPath2, hooksPath, agentsPath];
       const auth = realCodexAuthFile();
-      if (existsSync9(auth)) {
+      if (existsSync10(auth)) {
         const copied = join10(home, "auth.json");
         copyFileSync(auth, copied);
         files.push(copied);
@@ -5375,20 +5433,18 @@ function landProjectSession(ctx, session) {
   const project = getProjectById(ctx, session.projectId);
   if (!project)
     return;
-  const landing = landProjectBranch(project).then((res) => {
-    if (res)
-      reportProjectLanding(ctx, project, res, { sessionId: session.id });
-  }).catch((e) => {
+  const landFailed = (base, e) => {
+    const error = e instanceof Error ? e.message : String(e);
     emitProject(ctx, project.id, {
       type: "project.land_failed",
-      message: `could not land the project session's work onto ${project.mainBranch}: ${e instanceof Error ? e.message : String(e)} \u2014 ${LANDING_KEPT}`,
-      data: {
-        sessionId: session.id,
-        branch: PROJECT_BRANCH,
-        error: e instanceof Error ? e.message : String(e)
-      }
+      message: `could not land the project session's work${base ? ` onto ${base}` : ""}: ${error} \u2014 ${LANDING_KEPT}`,
+      data: { sessionId: session.id, branch: PROJECT_BRANCH, error }
     });
-  });
+  };
+  const landing = resolveSessionBranch(project).then((base) => landProjectBranch(project, base).then((res) => {
+    if (res)
+      reportProjectLanding(ctx, project, res, { sessionId: session.id });
+  }, (e) => landFailed(base, e)), (e) => landFailed(null, e));
   inFlightLandings.add(landing);
   landing.finally(() => inFlightLandings.delete(landing));
 }
@@ -5401,11 +5457,11 @@ function reportProjectLanding(ctx, project, res, data = {}) {
     });
   };
   if (res.landed) {
-    report("project.landed", `landed ${res.commits} commit(s) from the project session onto ${project.mainBranch}`, { commits: res.commits });
+    report("project.landed", `landed ${res.commits} commit(s) from the project session onto ${res.base}`, { commits: res.commits });
   } else if (res.conflict) {
-    report("project.land_conflict", `the project session's ${res.commits} commit(s) conflict with ${project.mainBranch} \u2014 nothing was overwritten; ${LANDING_KEPT}`, { commits: res.commits, files: res.files ?? [] });
+    report("project.land_conflict", `the project session's ${res.commits} commit(s) conflict with ${res.base} \u2014 nothing was overwritten; ${LANDING_KEPT}`, { commits: res.commits, files: res.files ?? [] });
   } else {
-    report("project.land_failed", `could not land the project session's ${res.commits} commit(s) onto ${project.mainBranch}: ${res.error ?? "unknown error"} \u2014 ${LANDING_KEPT}`, { commits: res.commits, error: res.error ?? null });
+    report("project.land_failed", `could not land the project session's ${res.commits} commit(s) onto ${res.base}: ${res.error ?? "unknown error"} \u2014 ${LANDING_KEPT}`, { commits: res.commits, error: res.error ?? null });
   }
 }
 function markSessionEnded(ctx, id) {
@@ -5746,7 +5802,7 @@ var init_tickets = __esm(() => {
 });
 
 // src/services/gates.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { and as and7, desc as desc4, eq as eq7, inArray as inArray3 } from "drizzle-orm";
 function checkGate(ctx, check, feature) {
   switch (check) {
@@ -5796,7 +5852,7 @@ function notYetTerminal(noun, statuses, order) {
 }
 function fileGate(ctx, feature, fileName, reason) {
   const project = projectForFeature(ctx, feature);
-  return existsSync10(featureDocPath(project, feature, fileName)) ? { satisfied: true } : { satisfied: false, reason };
+  return existsSync11(featureDocPath(project, feature, fileName)) ? { satisfied: true } : { satisfied: false, reason };
 }
 function docGate(ctx, feature, fileName, reason) {
   const file = fileGate(ctx, feature, fileName, reason);
@@ -5860,14 +5916,14 @@ var init_gates = __esm(() => {
 });
 
 // src/services/knowledge.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, writeFileSync as writeFileSync4 } from "fs";
 import { join as join11, relative as relative2, resolve as resolve8, sep } from "path";
 function scaffoldDocs(ctx, feature, opts = {}) {
   const project = projectForFeature(ctx, feature);
   const dir = featureDocsDir(project, feature);
   mkdirSync5(dir, { recursive: true });
   const briefPath = featureDocPath(project, feature, "brief.md");
-  if (!existsSync11(briefPath)) {
+  if (!existsSync12(briefPath)) {
     const override = opts.brief?.trim();
     const created = new Date().toISOString();
     const brief = override ? `${override}
@@ -5894,7 +5950,7 @@ function scaffoldDocs(ctx, feature, opts = {}) {
 function scaffoldMapDoc(project, feature, seed) {
   mkdirSync5(featureDocsDir(project, feature), { recursive: true });
   const mapPath = featureDocPath(project, feature, "map.md");
-  if (existsSync11(mapPath))
+  if (existsSync12(mapPath))
     return;
   writeFileSync4(mapPath, mapDocBody(feature, seed), "utf8");
 }
@@ -5915,7 +5971,7 @@ function mapDocBody(feature, seed) {
 }
 function readCharter(repoRoot) {
   const path = join11(repoRoot, CHARTER_FILE);
-  if (!existsSync11(path))
+  if (!existsSync12(path))
     return;
   try {
     return readFileSync5(path, "utf8");
@@ -5925,7 +5981,7 @@ function readCharter(repoRoot) {
 }
 function listLiveAdrs(repoRoot) {
   const dir = join11(repoRoot, ADR_DIR_REL);
-  if (!existsSync11(dir))
+  if (!existsSync12(dir))
     return [];
   const docs2 = [];
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
@@ -5946,7 +6002,7 @@ function listLiveAdrs(repoRoot) {
 function listDocs(ctx, feature) {
   const project = projectForFeature(ctx, feature);
   const dir = featureDocsDir(project, feature);
-  if (!existsSync11(dir))
+  if (!existsSync12(dir))
     return [];
   return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => ({ relPath: e.name, title: readTitle(join11(dir, e.name), e.name) })).sort((a, b) => a.relPath.localeCompare(b.relPath));
 }
@@ -5959,7 +6015,7 @@ function readDoc(ctx, feature, relPath) {
   if (rel === "" || rel.startsWith("..") || rel.split(sep).includes("..")) {
     throw new InvalidInputError(`doc path escapes the feature docs dir: ${relPath}`);
   }
-  if (!existsSync11(target))
+  if (!existsSync12(target))
     throw new NotFoundError(`doc not found: ${relPath}`);
   return { content: readFileSync5(target, "utf8") };
 }
@@ -6017,12 +6073,12 @@ var init_end_session = __esm(() => {
 });
 
 // src/services/settings.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { dirname as dirname4 } from "path";
 import * as z3 from "zod";
 import { eq as eq8 } from "drizzle-orm";
 function readRawConfig(configFile) {
-  if (!existsSync12(configFile))
+  if (!existsSync13(configFile))
     return {};
   try {
     const parsed = JSON.parse(readFileSync6(configFile, "utf8"));
@@ -6052,6 +6108,7 @@ function projectOverrides(ctx, projectId) {
   const row = ctx.db.select({
     model: projects.model,
     sandbox: projects.sandbox,
+    sessionBranch: projects.sessionBranch,
     devCommand: projects.devCommand,
     setupCommand: projects.setupCommand,
     verifyCommands: projects.verifyCommands,
@@ -6063,6 +6120,7 @@ function projectOverrides(ctx, projectId) {
   return {
     model: row?.model ?? null,
     sandbox: row?.sandbox ?? null,
+    sessionBranch: row?.sessionBranch ?? null,
     devCommand: row?.devCommand ?? null,
     setupCommand: row?.setupCommand ?? null,
     verifyCommands: row?.verifyCommands ?? null,
@@ -6341,16 +6399,15 @@ var init_settings = __esm(() => {
       parseEnv: idEnv
     },
     {
-      key: "mainBranch",
-      configKey: "mainBranch",
-      envVar: "RUNCASTLE_MAIN_BRANCH",
+      key: "devCommand",
+      projectColumn: "devCommand",
       restartRequired: false,
       valueSchema: z3.string().min(1),
       parseEnv: idEnv
     },
     {
-      key: "devCommand",
-      projectColumn: "devCommand",
+      key: "sessionBranch",
+      projectColumn: "sessionBranch",
       restartRequired: false,
       valueSchema: z3.string().min(1),
       parseEnv: idEnv
@@ -6382,7 +6439,7 @@ var init_settings = __esm(() => {
 });
 
 // src/services/setup.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname5, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 async function writeGitIdentity(exec, identity) {
@@ -6490,7 +6547,7 @@ function resolveSandcastleBin() {
     let dir = dirname5(fileURLToPath4(mainUrl));
     for (let hops = 0;hops < 6; hops++) {
       const manifestPath = join12(dir, "package.json");
-      if (existsSync13(manifestPath)) {
+      if (existsSync14(manifestPath)) {
         const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
         if (manifest.name === "@ai-hero/sandcastle" && manifest.bin?.sandcastle) {
           return join12(dir, manifest.bin.sandcastle);
@@ -6526,7 +6583,7 @@ function sandcastleTemplateDir() {
 }
 function scaffoldSandcastleConfig(templateDir, targetDir) {
   const dir = join12(targetDir, ".sandcastle");
-  if (existsSync13(dir))
+  if (existsSync14(dir))
     return { scaffolded: false, dir };
   mkdirSync7(dir, { recursive: true });
   for (const name of readdirSync4(templateDir)) {
@@ -6573,7 +6630,7 @@ function createCredentialVerifier(exec, runtime = DEFAULT_RUNTIME) {
 function fileAfkTokenIo(exec, runtime = DEFAULT_RUNTIME) {
   const path = envPath();
   return {
-    read: () => existsSync13(path) ? readFileSync7(path, "utf8") : "",
+    read: () => existsSync14(path) ? readFileSync7(path, "utf8") : "",
     write: (content) => {
       mkdirSync7(dirname5(path), { recursive: true });
       writeFileSync6(path, content, "utf8");
@@ -6597,7 +6654,7 @@ var init_setup = __esm(() => {
   };
   RUNTIME_AUTH_SETUP_HINT = {
     "claude-code": RUNTIME_SPECS["claude-code"].afkFix,
-    codex: RUNTIME_SPECS.codex.afkFix
+    codex: `Run \`${RUNTIME_SPECS.codex.loginCommand}\` on this host, then burn again`
   };
   LOGIN_TERMINAL_KIND = {
     "claude-code": "claude-login",
@@ -6754,7 +6811,7 @@ var init_burn_guard = __esm(() => {
 });
 
 // src/workflows/review-ticket.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
 import { delimiter, join as join13 } from "path";
 import { run } from "@ai-hero/sandcastle";
 import { noSandbox } from "@ai-hero/sandcastle/sandboxes/no-sandbox";
@@ -6770,7 +6827,7 @@ function findOnPath(bin, env = process.env, platform = process.platform) {
   for (const dir of dirs) {
     for (const suffix of suffixes) {
       const candidate = join13(dir, `${bin}${suffix}`);
-      if (existsSync14(candidate))
+      if (existsSync15(candidate))
         return candidate;
     }
   }
@@ -6798,6 +6855,9 @@ async function releaseDriveQuietly() {
 }
 async function executeReviewTicket(ctx, ticket, deps) {
   const { project, feature } = ctx;
+  if (!feature.baseBranch) {
+    return couldNotReview(ticket, `feature ${feature.slug} has no recorded base branch, so there is nothing to diff \`${feature.branch}\` against.`);
+  }
   if (!findOnPath(AGENT_BROWSER_BIN)) {
     return couldNotReview(ticket, `\`${AGENT_BROWSER_BIN}\` is not on this machine's PATH, so there is no way to drive the app. Install it and re-burn this ticket.`);
   }
@@ -6808,7 +6868,7 @@ async function executeReviewTicket(ctx, ticket, deps) {
     DOCS_DIGEST: deps.docsDigest,
     LAP_DIGESTS: buildLapDigestsBlock(deps.lapDigests),
     FEATURE_BRANCH: feature.branch,
-    BASE_BRANCH: project.mainBranch,
+    BASE_BRANCH: feature.baseBranch,
     DIGEST_PATH: artifacts.digestPath,
     BLOCKED_PATH: artifacts.blockedPath,
     WALKTHROUGH_PATH: artifacts.walkthroughPath
@@ -6890,13 +6950,18 @@ var init_review_ticket = __esm(() => {
 });
 
 // src/workflows/ticket-burner.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync9, readdirSync as readdirSync5, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync9, readdirSync as readdirSync5, rmSync as rmSync3 } from "fs";
 import { dirname as dirname6, join as join14, posix as posixPath, win32 as winPath } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { claudeCode, codex, run as run2 } from "@ai-hero/sandcastle";
 import { docker } from "@ai-hero/sandcastle/sandboxes/docker";
 import { podman } from "@ai-hero/sandcastle/sandboxes/podman";
 import { noSandbox as noSandbox2 } from "@ai-hero/sandcastle/sandboxes/no-sandbox";
+function burnAuthReady(runtime, token, loggedIn = codexLoggedIn) {
+  if (token !== undefined)
+    return true;
+  return runtime === "codex" && loggedIn();
+}
 function isReviewTicket(ticket) {
   return ticket.kind === "review";
 }
@@ -7037,10 +7102,10 @@ _(The "${DROPPED_MAP_SECTIONS.join('" and "')}" sections are omitted here: they
 }
 function buildProjectStandards(repoPath) {
   const present = [];
-  if (existsSync15(join14(repoPath, AGENT_CONVENTIONS_FILE))) {
+  if (existsSync16(join14(repoPath, AGENT_CONVENTIONS_FILE))) {
     present.push("`CLAUDE.md` \u2014 this repo's agent-facing conventions, and the highest authority on them");
   }
-  if (existsSync15(join14(repoPath, CHARTER_FILE))) {
+  if (existsSync16(join14(repoPath, CHARTER_FILE))) {
     present.push(`\`${CHARTER_FILE}\` \u2014 the project charter: what this codebase is for`);
   }
   const adrs = listLiveAdrs(repoPath).map((a) => a.relPath);
@@ -7071,7 +7136,7 @@ function buildDriveNotes(settings) {
   add("stop", settings.driveStopCommand);
   add("dev server", settings.devCommand);
   add("db reset", settings.dbResetCommand);
-  const hasDir = existsSync15(join14(settings.repoPath, ".runcastle"));
+  const hasDir = existsSync16(join14(settings.repoPath, ".runcastle"));
   if (configured.length === 0 && !hasDir) {
     return [
       "This project has no test-drive machinery configured, so there is nothing here for you to keep in step \u2014 do not invent any.",
@@ -7207,6 +7272,18 @@ function cacheMountFor(pm, hostPath) {
   const sandboxPath = PM_CACHE_SANDBOX_PATHS[pm];
   return sandboxPath ? { hostPath, sandboxPath } : undefined;
 }
+function codexAuthMountFor(runtime, sandbox, env = process.env, loggedIn = codexLoggedIn) {
+  if (runtime !== "codex" || sandbox === "noSandbox" || !loggedIn(env))
+    return;
+  return { hostPath: codexHomeDir(env), sandboxPath: CODEX_HOST_MOUNT_PATH, readonly: true };
+}
+function buildCodexAuthCopyCommand() {
+  return `mkdir -p "$HOME/.codex" && cp "${CODEX_HOST_MOUNT_PATH}/auth.json" "$HOME/.codex/auth.json"`;
+}
+function chainSetupCommands(...steps) {
+  const present = steps.filter((step) => !!step);
+  return present.length > 0 ? present.join(" && ") : undefined;
+}
 function resolveBurnWorkspaceMode(config2, platform = process.platform) {
   if (config2.sandbox === "noSandbox")
     return "mounted";
@@ -7269,7 +7346,7 @@ function attachedNoteIds(context) {
   return ids2;
 }
 function attachmentSources(context) {
-  return attachedNoteIds(context).map(annotationPath).filter((p) => existsSync15(p));
+  return attachedNoteIds(context).map(annotationPath).filter((p) => existsSync16(p));
 }
 function buildAttachmentCopyCommands(sources, platform = process.platform) {
   if (sources.length === 0)
@@ -7312,7 +7389,7 @@ function buildVerifyNotes(config2) {
 }
 function readRepoToolchain(repoPath) {
   const pkgPath = join14(repoPath, "package.json");
-  const hasPackageJson = existsSync15(pkgPath);
+  const hasPackageJson = existsSync16(pkgPath);
   let packageManagerField;
   if (hasPackageJson) {
     try {
@@ -7325,10 +7402,10 @@ function readRepoToolchain(repoPath) {
     hasPackageJson,
     ...packageManagerField !== undefined ? { packageManagerField } : {},
     lockfiles: {
-      bun: existsSync15(join14(repoPath, "bun.lock")) || existsSync15(join14(repoPath, "bun.lockb")),
-      pnpm: existsSync15(join14(repoPath, "pnpm-lock.yaml")),
-      yarn: existsSync15(join14(repoPath, "yarn.lock")),
-      npm: existsSync15(join14(repoPath, "package-lock.json"))
+      bun: existsSync16(join14(repoPath, "bun.lock")) || existsSync16(join14(repoPath, "bun.lockb")),
+      pnpm: existsSync16(join14(repoPath, "pnpm-lock.yaml")),
+      yarn: existsSync16(join14(repoPath, "yarn.lock")),
+      npm: existsSync16(join14(repoPath, "package-lock.json"))
     }
   };
 }
@@ -7704,6 +7781,19 @@ ${e.digest.trim()}`).join(`
 
 `);
 }
+function gateTicketAuth(deps) {
+  const authMissing = deps.ticketAuthMissing;
+  if (!authMissing || deps.config.sandbox === "noSandbox")
+    return deps.executeTicketRun;
+  return async (ctx, ticket, run3) => {
+    const runtime = authMissing(ticket);
+    if (!runtime)
+      return deps.executeTicketRun(ctx, ticket, run3);
+    const hint = `${runtime} is not authenticated \u2014 ${RUNTIME_AUTH_SETUP_HINT[runtime]}`;
+    ctx.emitEvent({ type: AUTH_MISSING_EVENT, message: hint, ticketId: ticket.id });
+    return { status: "failed", error: hint };
+  };
+}
 async function burnRun(ctx, deps) {
   const tickets2 = ctx.tickets;
   const burnable = tickets2.filter((t) => t.status !== "cancelled");
@@ -7723,7 +7813,7 @@ async function burnRun(ctx, deps) {
     });
     return { status: "failed", summary: `dependency cycle: ${path}` };
   }
-  const { done, digests } = await burnTickets(ctx, tickets2, deps.executeTicketRun, deps.concurrency);
+  const { done, digests } = await burnTickets(ctx, tickets2, gateTicketAuth(deps), deps.concurrency);
   const summary = cancelled > 0 ? `${done}/${total} tickets done (${cancelled} cancelled)` : `${done}/${total} tickets done`;
   ctx.emitEvent({ type: "burn.summary", message: summary, data: { done, total, cancelled } });
   const digest = composeRunDigest(digests);
@@ -7760,11 +7850,11 @@ function readDocsDigest(projectId, slug) {
     ...missing ? { missing } : {}
   });
   const worktree = worktreeDir(projectId, slug);
-  if (!existsSync15(worktree)) {
+  if (!existsSync16(worktree)) {
     return done("_No talk worktree on disk \u2014 docs digest skipped._", "no-worktree");
   }
   const docsDir = join14(worktree, ...docsRel.split("/"));
-  if (!existsSync15(docsDir)) {
+  if (!existsSync16(docsDir)) {
     return done("_No docs/features dir in the talk worktree \u2014 docs digest skipped._", "no-docs-dir");
   }
   const names = listFeatureDocs(docsDir).sort((a, b) => agentDigestDocOrder(a) - agentDigestDocOrder(b) || a.localeCompare(b));
@@ -7827,7 +7917,7 @@ function readAgentFile(dirs, file) {
     if (!dir)
       continue;
     const p = join14(dir, file);
-    if (existsSync15(p)) {
+    if (existsSync16(p)) {
       try {
         return readFileSync9(p, "utf8");
       } catch {}
@@ -7962,8 +8052,11 @@ async function realExecuteTicketRun(ctx, ticket, config2, token, model, land, en
       mounts.push(mount);
     }
   }
+  const codexAuthMount = codexAuthMountFor(model.runtime, config2.sandbox);
+  if (codexAuthMount)
+    mounts.push(codexAuthMount);
   const guardInstall = guardInstalled ? buildGuardInstallCommand(model.runtime) : undefined;
-  const withGuard = (setup) => guardInstall === undefined ? setup : setup ? `${guardInstall} && ${setup}` : guardInstall;
+  const withPrelude = (setup) => chainSetupCommands(codexAuthMount ? buildCodexAuthCopyCommand() : undefined, guardInstall, setup);
   const agentOptions = guardInstalled ? { bypassHookTrust: true } : {};
   mkdirSync9(logsDir(), { recursive: true });
   const logFilePath = join14(logsDir(), `burn-${feature.id}-${ticket.seq}.log`);
@@ -8023,7 +8116,7 @@ async function realExecuteTicketRun(ctx, ticket, config2, token, model, land, en
       OTHER_SIDE: buildOtherSideBlock(otherSide),
       MERGE_COMMAND: resolveMergeCommand(workspaceMode, feature.branch)
     });
-    const hookCommand = withGuard(workspaceMode === "isolated" ? buildIsolatedSetupCommand(resolveBranch, setupCommand, pm) : setupCommand);
+    const hookCommand = withPrelude(workspaceMode === "isolated" ? buildIsolatedSetupCommand(resolveBranch, setupCommand, pm) : setupCommand);
     appendTranscript(ticket.id, {
       kind: "text",
       text: `
@@ -8158,7 +8251,7 @@ ${blocked.trim()}`
     let tempBranch = "";
     for (let attempt = 1;; attempt++) {
       tempBranch = ticketBranchName(feature.slug, ticket.seq, newId("b").slice(2, 10));
-      const hookCommand = withGuard(workspaceMode === "isolated" ? buildIsolatedSetupCommand(tempBranch, setupCommand, pm) : setupCommand);
+      const hookCommand = withPrelude(workspaceMode === "isolated" ? buildIsolatedSetupCommand(tempBranch, setupCommand, pm) : setupCommand);
       if (hookCommand && attempt === 1) {
         ctx.emitEvent({
           type: "burn.setup",
@@ -8337,14 +8430,24 @@ function resolveBurnDeps(ctx) {
       dbResetCommand: ctx.project.dbResetCommand
     })
   };
+  const ticketCredentials = (ticket) => {
+    const ticketModel = resolveTicketModel(config2, ctx.project, ctx.modelOverride, ticket);
+    return {
+      model: ticketModel,
+      token: ticketModel.runtime === model.runtime ? token : readTokenFromEnvFile(envPath(), ticketModel.runtime)
+    };
+  };
   return {
     config: config2,
     runtime: model.runtime,
-    hasAuthToken: token !== undefined,
+    hasAuthToken: burnAuthReady(model.runtime, token),
+    ticketAuthMissing: (ticket) => {
+      const { model: ticketModel, token: ticketToken } = ticketCredentials(ticket);
+      return burnAuthReady(ticketModel.runtime, ticketToken) ? undefined : ticketModel.runtime;
+    },
     concurrency: config2.burnConcurrency,
     executeTicketRun: (c, ticket, run3) => {
-      const ticketModel = resolveTicketModel(config2, ctx.project, ctx.modelOverride, ticket);
-      const ticketToken = ticketModel.runtime === model.runtime ? token : readTokenFromEnvFile(envPath(), ticketModel.runtime);
+      const { model: ticketModel, token: ticketToken } = ticketCredentials(ticket);
       return isReviewTicket(ticket) ? executeReviewTicket(c, ticket, {
         config: config2,
         token: ticketToken,
@@ -8358,7 +8461,7 @@ function resolveBurnDeps(ctx) {
 function readTokenFromEnvFile(path, runtime) {
   const key = RUNTIME_AUTH_KEY[runtime];
   let fromFile;
-  if (existsSync15(path)) {
+  if (existsSync16(path)) {
     try {
       fromFile = parseEnvFile2(readFileSync9(path, "utf8"))[key];
     } catch {
@@ -8368,12 +8471,13 @@ function readTokenFromEnvFile(path, runtime) {
   const token = fromFile && fromFile.length > 0 ? fromFile : process.env[key];
   return token && token.length > 0 ? token : undefined;
 }
-var AUTH_MISSING_EVENT = "auth.missing", DROPPED_MAP_SECTIONS, AGENT_CONVENTIONS_FILE = "CLAUDE.md", PACKAGE_MANAGERS, PM_CACHE_SANDBOX_PATHS, SANDBOX_WORKSPACE_PATH = "/home/agent/workspace", ISOLATED_REPO_PATH = "/home/agent/repo", RUN, BASH_PATTERNS, TOOL_NAME_CATEGORY, MAX_ATTRIBUTABLE_GAP_MS, BURN_WORKTREE_PATH, WORKTREE_REMOVAL_FAILURES, FATAL_ERROR_PATTERNS, RUNTIME_FATAL_ERROR_PATTERNS, RETRYABLE_ERROR_PATTERNS, RUNTIME_RETRYABLE_ERROR_PATTERNS, activeTicketAborts, SETUP_HOOK_TIMEOUT_MS, ticketBurner;
+var AUTH_MISSING_EVENT = "auth.missing", DROPPED_MAP_SECTIONS, AGENT_CONVENTIONS_FILE = "CLAUDE.md", PACKAGE_MANAGERS, PM_CACHE_SANDBOX_PATHS, CODEX_HOST_MOUNT_PATH = "/mnt/host-codex", SANDBOX_WORKSPACE_PATH = "/home/agent/workspace", ISOLATED_REPO_PATH = "/home/agent/repo", RUN, BASH_PATTERNS, TOOL_NAME_CATEGORY, MAX_ATTRIBUTABLE_GAP_MS, BURN_WORKTREE_PATH, WORKTREE_REMOVAL_FAILURES, FATAL_ERROR_PATTERNS, RUNTIME_FATAL_ERROR_PATTERNS, RETRYABLE_ERROR_PATTERNS, RUNTIME_RETRYABLE_ERROR_PATTERNS, activeTicketAborts, SETUP_HOOK_TIMEOUT_MS, ticketBurner;
 var init_ticket_burner = __esm(() => {
   init_src();
   init_config_load();
   init_paths();
   init_skills_root();
+  init_codex_auth();
   init_knowledge();
   init_setup();
   init_agent_stream();
@@ -8432,7 +8536,10 @@ var init_ticket_burner = __esm(() => {
       /\b401\b|\b403\b/,
       /insufficient_quota|exceeded your current quota/i,
       /model_not_found|does not exist or you do not have access/i,
-      /CODEX_API_KEY/
+      /CODEX_API_KEY/,
+      /not logged in/i,
+      /\bauth (failed|required)\b/i,
+      /refresh token/i
     ]
   };
   RETRYABLE_ERROR_PATTERNS = [
@@ -8545,14 +8652,16 @@ async function realExecuteResearchRun(ctx, waypoint, config2, token, model) {
   mkdirSync10(logsDir(), { recursive: true });
   const logFilePath = join15(logsDir(), `research-${feature.id}-${waypoint.seq}.log`);
   const throttle = createResearchStreamThrottle((e) => ctx.emitEvent(e));
+  const codexAuthMount = codexAuthMountFor(model.runtime, config2.sandbox);
   const runOptions = {
     agent: buildBurnAgent(config2, token, model),
-    sandbox: selectSandbox(config2),
+    sandbox: selectSandbox(config2, codexAuthMount ? [codexAuthMount] : []),
     cwd: project.repoPath,
     prompt,
     branchStrategy: { type: "branch", branch: tempBranch, baseBranch: feature.branch },
     signal: ctx.signal,
     name: `research-${waypoint.seq}`,
+    ...codexAuthMount ? { hooks: { sandbox: { onSandboxReady: [{ command: buildCodexAuthCopyCommand() }] } } } : {},
     logging: { type: "file", path: logFilePath, onAgentStreamEvent: throttle.onEvent }
   };
   let result;
@@ -8600,7 +8709,7 @@ function resolveResearchDeps(ctx) {
   return {
     config: config2,
     runtime: model.runtime,
-    hasAuthToken: token !== undefined,
+    hasAuthToken: burnAuthReady(model.runtime, token),
     executeResearchRun: (c, waypoint) => realExecuteResearchRun(c, waypoint, config2, token, model)
   };
 }
@@ -8786,8 +8895,7 @@ async function createFeature(ctx, input) {
   const project = requireProjectById(ctx, input.projectId);
   const slug = uniqueSlug(ctx, project.id, input.title);
   const branch = `feature/${slug}`;
-  const requestedBase = input.baseBranch?.trim() || project.mainBranch;
-  const cut = input.draft ? null : await ensureFeatureBranch(project, slug, requestedBase);
+  const cut = input.draft ? null : await ensureFeatureBranch(project, slug, await requestedBase(project, input.baseBranch));
   const row = {
     id: newId("feat"),
     projectId: project.id,
@@ -8837,8 +8945,8 @@ async function startDraft(ctx, featureId, opts = {}) {
     throw new GateError(`feature ${feature.slug} is not a draft \u2014 it has already been started`);
   }
   const project = projectForFeature(ctx, feature);
-  const requestedBase = opts.baseBranch?.trim() || project.mainBranch;
-  const { branchReady, baseBranch } = await ensureFeatureBranch(project, feature.slug, requestedBase);
+  const base = await requestedBase(project, opts.baseBranch);
+  const { branchReady, baseBranch } = await ensureFeatureBranch(project, feature.slug, base);
   ctx.db.update(features).set({ status: "active", baseBranch }).where(eq10(features.id, featureId)).run();
   const started = { ...feature, status: "active", baseBranch };
   emit(ctx, featureId, {
@@ -8898,8 +9006,8 @@ async function quickChange(ctx, input) {
     throw new InvalidInputError("a quick change needs a sentence describing the change");
   const slug = uniqueSlug(ctx, project.id, title);
   const branch = `feature/${slug}`;
-  const requestedBase = input.baseBranch?.trim() || project.mainBranch;
-  const { branchReady, baseBranch } = await ensureFeatureBranch(project, slug, requestedBase);
+  const base = await requestedBase(project, input.baseBranch);
+  const { branchReady, baseBranch } = await ensureFeatureBranch(project, slug, base);
   const inserted = ctx.db.insert(features).values({
     id: newId("feat"),
     projectId: project.id,
@@ -8948,14 +9056,17 @@ async function quickChange(ctx, input) {
   }
   return feature;
 }
-async function ensureFeatureBranch(project, slug, requestedBase) {
+async function requestedBase(project, picked) {
+  return picked?.trim() || await currentCheckoutBranch(project);
+}
+async function ensureFeatureBranch(project, slug, base) {
   try {
-    const baseBranch = await resolveBaseBranch(project, requestedBase);
+    const baseBranch = await resolveBaseBranch(project, base);
     await createFeatureBranch(project, slug, baseBranch);
     return { branchReady: true, baseBranch };
   } catch (e) {
     if (isNotImplemented(e))
-      return { branchReady: false, baseBranch: requestedBase };
+      return { branchReady: false, baseBranch: base };
     throw e;
   }
 }
@@ -9298,7 +9409,7 @@ var init_features = __esm(() => {
 });
 
 // src/services/test-notes.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync11, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync11, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname8 } from "path";
 import { asc as asc4, eq as eq11 } from "drizzle-orm";
 function rowToNote(row) {
@@ -9311,7 +9422,7 @@ function rowToNote(row) {
     author: row.author,
     ticketId: row.ticketId ?? undefined,
     videoTimestamp: row.videoTimestamp ?? undefined,
-    screenshotUrl: existsSync17(annotationPath(row.id)) ? noteScreenshotUrl(row.id) : undefined,
+    screenshotUrl: existsSync18(annotationPath(row.id)) ? noteScreenshotUrl(row.id) : undefined,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt
   });
@@ -9519,7 +9630,7 @@ var init_test_notes = __esm(() => {
 });
 
 // src/mcp/server.ts
-import { existsSync as existsSync18, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync11 } from "fs";
 import { join as join16, relative as relative3, resolve as resolve9, sep as sep2 } from "path";
 import { StreamableHTTPTransport } from "@hono/mcp";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -9873,7 +9984,7 @@ async function toolCreateFeature(ctx, session, input) {
     phase: feature.phase
   };
 }
-function toolGetProjectContext(ctx, session) {
+async function toolGetProjectContext(ctx, session) {
   const project = requireProject(ctx, session);
   const charter = readCharter(session.worktreePath);
   return {
@@ -9881,7 +9992,18 @@ function toolGetProjectContext(ctx, session) {
     ...charter !== undefined ? { charter } : {},
     adrs: listLiveAdrs(session.worktreePath).map(adrRef),
     adrsNote: ADRS_NOTE,
-    featureIndex: list(ctx, project.id).map(featureIndexLine)
+    featureIndex: list(ctx, project.id).map(featureIndexLine),
+    baseBranches: await readBaseBranches(project)
+  };
+}
+async function readBaseBranches(project) {
+  const { current: current2, branches, remoteBranches } = await listBranches(project);
+  const selectable = [...branches, ...remoteBranches];
+  return {
+    current: current2,
+    currentIsSelectable: selectable.includes(current2),
+    selectable,
+    detectedMain: await detectMainBranch(project.repoPath)
   };
 }
 function adrRef(adr) {
@@ -9903,7 +10025,7 @@ function toolReadAdr(ctx, session, input) {
   if (rel === "" || rel.startsWith("..") || rel.split(sep2).includes("..")) {
     throw new InvalidInputError(`adr path escapes ${ADR_DIR_REL}: ${input.relPath}`);
   }
-  if (!existsSync18(target))
+  if (!existsSync19(target))
     throw new NotFoundError(`adr not found: ${input.relPath}`);
   return { relPath: `${ADR_DIR_REL}/${name}`, content: readFileSync11(target, "utf8") };
 }
@@ -10100,7 +10222,7 @@ function buildMcpServer(audience) {
       inputSchema: {
         title: z4.string().min(1).describe("The feature\u2019s name; its slug and branch derive from this."),
         oneLiner: z4.string().optional().describe("One line saying what this feature is. Required for every shape EXCEPT `tickets`, " + "where the first ticket\u2019s prose becomes the one-liner and anything sent here is " + "ignored."),
-        baseBranch: z4.string().optional().describe("Branch to cut from; defaults to the project\u2019s main branch."),
+        baseBranch: z4.string().optional().describe("Branch to cut from \u2014 always pass it explicitly, naming the base you told the " + "human you would use (see `get_project_context`\u2019s `baseBranches`). Omitted, it " + "falls back to whatever the project checkout happens to be on. Drafts pass none: " + "a parked feature picks its base at Start."),
         brief: z4.string().optional().describe("The reasoning you just worked out with the human \u2014 why this feature exists and " + "what it must NOT swallow. Becomes brief.md verbatim, and without it that " + "reasoning is lost. Unused by the `tickets` shape, whose brief IS the proses."),
         draft: z4.boolean().optional().describe("PARK it instead of starting it: a row and its brief, no branch and no files, " + "until the human clicks Start. Ask them per feature whether to start or park."),
         tickets: z4.array(z4.string().min(1)).min(1).optional().describe("The quick-change shape: work too small to deserve a grill. Creates ONE feature at " + "the implementation phase carrying a ticket per prose (plus the review ticket " + "every batch closes with). Send every sentence of one quick change in a SINGLE " + "call \u2014 calling this once per ticket makes one feature per ticket.")
@@ -10115,13 +10237,13 @@ function buildMcpServer(audience) {
   if (wants("get_project_context")) {
     server.registerTool("get_project_context", {
       title: "Get project context",
-      description: "The project as it stands: the project row, the charter (CONTEXT.md) in full, an INDEX " + "of every live ADR (superseded ones omitted) and a one-line index of every feature. " + "ADR bodies are not inlined \u2014 read the ones your work touches with `read_adr`. Shipped " + "features carry their one-liner and docs path (readable on disk); in-flight ones carry " + "slug, phase, lap and ticket counts but no docs path, because their docs live on an " + "unmerged branch. Use the slug with `get_work_record` to see what one actually did.",
+      description: "The project as it stands: the project row, the charter (CONTEXT.md) in full, an INDEX " + "of every live ADR (superseded ones omitted) and a one-line index of every feature. " + "ADR bodies are not inlined \u2014 read the ones your work touches with `read_adr`. Shipped " + "features carry their one-liner and docs path (readable on disk); in-flight ones carry " + "slug, phase, lap and ticket counts but no docs path, because their docs live on an " + "unmerged branch. Use the slug with `get_work_record` to see what one actually did. " + "Plus `baseBranches` \u2014 the branch a new feature would cut from: the checkout\u2019s `current` " + "branch, `currentIsSelectable` (false mid test drive or on a detached HEAD, the one case " + "with no default), every `selectable` base, and the `detectedMain` line to suggest then.",
       inputSchema: {}
     }, async (_args, extra) => {
       const rs = await resolveCtxSession(extra);
       if (!rs)
         return noSession();
-      return ok(toolGetProjectContext(rs.ctx, rs.session));
+      return ok(await toolGetProjectContext(rs.ctx, rs.session));
     });
   }
   if (wants("read_adr")) {
@@ -10943,7 +11065,7 @@ var init_stream = __esm(() => {
 });
 
 // src/routes/web.ts
-import { existsSync as existsSync19, statSync as statSync4 } from "fs";
+import { existsSync as existsSync20, statSync as statSync4 } from "fs";
 import { readFile } from "fs/promises";
 import { extname, join as join17, normalize, resolve as resolve10, sep as sep3 } from "path";
 function contentType(path) {
@@ -10996,7 +11118,7 @@ function mountWebApp(app, distDir) {
 }
 function mountWebAppIfBuilt(app) {
   const dist = resolveWebDist();
-  if (existsSync19(join17(dist, "index.html")))
+  if (existsSync20(join17(dist, "index.html")))
     mountWebApp(app, dist);
 }
 var MIME;
@@ -11047,12 +11169,12 @@ var init_version = () => {};
 
 // src/services/install-id.ts
 import { randomUUID } from "crypto";
-import { existsSync as existsSync20, mkdirSync as mkdirSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname10 } from "path";
 function getInstallId() {
   const file = installIdPath();
   try {
-    if (existsSync20(file)) {
+    if (existsSync21(file)) {
       const existing = readFileSync13(file, "utf8").trim();
       if (UUID_RE.test(existing))
         return existing;
@@ -11252,7 +11374,7 @@ var init_events2 = __esm(() => {
 });
 
 // src/launcher/launcher.ts
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 import { join as join19 } from "path";
 import { and as and9, eq as eq13 } from "drizzle-orm";
 function ptyExitMessage(exitCode) {
@@ -11638,7 +11760,7 @@ async function launchProjectSession(ctx, input, opts = {}) {
   const model = resolveModelEntry("project", ctx.config, project);
   const runtime = runtimeAdapterFor(model.runtime);
   assertRuntimeReady(runtime, opts);
-  const worktreePath = await ensureProjectWorktree(project, (res) => reportProjectLanding(ctx, project, res, { retried: true }));
+  const { worktreePath, base } = await ensureProjectWorktree(project, (res) => reportProjectLanding(ctx, project, res, { retried: true }));
   const session = createSessionRow(ctx, {
     projectId: project.id,
     kind: "project",
@@ -11691,7 +11813,7 @@ async function launchProjectSession(ctx, input, opts = {}) {
     session,
     project,
     config: ctx.config,
-    projectBrief: { project, branch: PROJECT_BRANCH, worktreePath },
+    projectBrief: { project, branch: PROJECT_BRANCH, worktreePath, base },
     worktreePath,
     serverUrl: serverUrlFor(ctx.config),
     model: model.id,
@@ -11725,7 +11847,7 @@ async function buildPrepareBrief(ctx, project) {
   };
 }
 function probePrepareHost(repoPath) {
-  const has = (rel) => existsSync21(join19(repoPath, rel));
+  const has = (rel) => existsSync22(join19(repoPath, rel));
   const lock = LOCKFILES.find(([file]) => has(file));
   return {
     platform: process.platform,
@@ -12075,10 +12197,10 @@ var init_feature = __esm(() => {
 });
 
 // src/services/fsbrowse.ts
-import { existsSync as existsSync22, readdirSync as readdirSync6, statSync as statSync5 } from "fs";
-import { homedir as homedir4 } from "os";
+import { existsSync as existsSync23, readdirSync as readdirSync6, statSync as statSync5 } from "fs";
+import { homedir as homedir3 } from "os";
 import { basename as basename3, dirname as dirname11, isAbsolute as isAbsolute2, join as join21, resolve as resolve11, sep as sep4 } from "path";
-function expandPath(input, home = homedir4()) {
+function expandPath(input, home = homedir3()) {
   const trimmed = input.trim();
   if (trimmed === "")
     return trimmed;
@@ -12091,31 +12213,31 @@ function expandPath(input, home = homedir4()) {
 }
 function looksLikeRepo(dir) {
   try {
-    return existsSync22(join21(dir, ".git"));
+    return existsSync23(join21(dir, ".git"));
   } catch {
     return false;
   }
 }
-function listRoots(home = homedir4()) {
+function listRoots(home = homedir3()) {
   const roots = [];
   if (process.platform === "win32") {
     for (let code = 67;code <= 90; code++) {
       const drive = `${String.fromCharCode(code)}:${sep4}`;
       try {
-        if (existsSync22(drive))
+        if (existsSync23(drive))
           roots.push({ label: drive.replace(/\\$/, ""), path: drive, kind: "drive" });
       } catch {}
     }
   } else {
     roots.push({ label: "/", path: "/", kind: "drive" });
   }
-  if (existsSync22(home))
+  if (existsSync23(home))
     roots.push({ label: "Home", path: home, kind: "home" });
   const seen = new Set(roots.map(pathKey));
   for (const name of COMMON_DIRS) {
     const candidate = join21(home, name);
     const key = pathKey({ path: candidate });
-    if (seen.has(key) || !existsSync22(candidate))
+    if (seen.has(key) || !existsSync23(candidate))
       continue;
     seen.add(key);
     roots.push({ label: name, path: candidate, kind: "common" });
@@ -12141,12 +12263,12 @@ function parentOf(dir) {
   const parent = dirname11(dir);
   return parent === dir ? null : parent;
 }
-function browseDir(input, showHidden = false, home = homedir4()) {
+function browseDir(input, showHidden = false, home = homedir3()) {
   const target = input && input.trim() !== "" ? expandPath(input, home) : home;
   if (!isAbsolute2(target)) {
     throw new InvalidInputError(`path is not absolute: ${target}`);
   }
-  if (!existsSync22(target)) {
+  if (!existsSync23(target)) {
     throw new InvalidInputError(`path does not exist: ${target}`);
   }
   let dir = target;
@@ -12371,7 +12493,7 @@ var init_conversations = __esm(() => {
 });
 
 // src/services/projects.ts
-import { existsSync as existsSync23 } from "fs";
+import { existsSync as existsSync24 } from "fs";
 import { basename as basename4, join as join22 } from "path";
 import { eq as eq14, isNull } from "drizzle-orm";
 function listProjects(ctx) {
@@ -12391,15 +12513,14 @@ function warnIfTranslatedMount(ctx, projectId, repoPath) {
 async function openProject(ctx, rawPath) {
   const repoPath = expandPath(rawPath);
   await assertRepoTolerant(ctx, repoPath);
-  const mainBranch = await detectMainBranchTolerant(ctx, repoPath);
   const name = basename4(repoPath) || repoPath;
   const existing = getProjectByRepoPath(ctx, repoPath) ?? findProjectByCanonPath(ctx, repoPath);
   if (existing) {
-    ctx.db.update(projects).set({ mainBranch, repoPath, closedAt: null }).where(eq14(projects.id, existing.id)).run();
-    const reopened = { ...existing, mainBranch, repoPath, closedAt: undefined };
+    ctx.db.update(projects).set({ repoPath, closedAt: null }).where(eq14(projects.id, existing.id)).run();
+    const reopened = { ...existing, repoPath, closedAt: undefined };
     emitProject(ctx, existing.id, {
       type: "project.opened",
-      message: `project ${existing.name} re-opened at ${repoPath} (${mainBranch})`
+      message: `project ${existing.name} re-opened at ${repoPath}`
     });
     warnIfTranslatedMount(ctx, existing.id, repoPath);
     return reopened;
@@ -12408,7 +12529,6 @@ async function openProject(ctx, rawPath) {
     id: newId("proj"),
     name,
     repoPath,
-    mainBranch,
     devCommand: null,
     closedAt: null
   };
@@ -12416,7 +12536,7 @@ async function openProject(ctx, rawPath) {
   const project = rowToProject(inserted);
   emitProject(ctx, project.id, {
     type: "project.opened",
-    message: `project ${name} at ${repoPath} (${mainBranch})`
+    message: `project ${name} at ${repoPath}`
   });
   warnIfTranslatedMount(ctx, project.id, repoPath);
   return project;
@@ -12453,20 +12573,11 @@ async function assertRepoTolerant(ctx, repoPath) {
   } catch (e) {
     if (!isNotImplemented(e))
       throw e;
-    if (!existsSync23(join22(repoPath, ".git"))) {
+    if (!existsSync24(join22(repoPath, ".git"))) {
       throw new InvalidInputError(`not a git repository: ${repoPath}`);
     }
   }
 }
-async function detectMainBranchTolerant(ctx, repoPath) {
-  try {
-    return await detectMainBranch(repoPath);
-  } catch (e) {
-    if (!isNotImplemented(e))
-      throw e;
-    return ctx.config.mainBranch;
-  }
-}
 var init_projects = __esm(() => {
   init_src();
   init_schema();
@@ -12496,6 +12607,7 @@ var init_project = __esm(() => {
     roots: publicProcedure.query(() => listRoots()),
     browse: publicProcedure.input(z8.object({ dir: z8.string().optional(), showHidden: z8.boolean().optional() }).optional()).query(({ input }) => browseDir(input?.dir, input?.showHidden ?? false)),
     branches: publicProcedure.input(z8.object({ projectId: z8.string() })).query(({ ctx, input }) => listBranches(requireProjectById(ctx, input.projectId))),
+    sessionBranch: publicProcedure.input(z8.object({ projectId: z8.string() })).query(({ ctx, input }) => sessionBranchView(requireProjectById(ctx, input.projectId))),
     open: publicProcedure.input(z8.object({ repoPath: z8.string().min(1) })).mutation(({ ctx, input }) => openProject(ctx, input.repoPath)),
     close: publicProcedure.input(z8.object({ projectId: z8.string() })).mutation(({ ctx, input }) => closeProject(ctx, input.projectId)),
     rename: publicProcedure.input(z8.object({ projectId: z8.string(), name: ProjectName })).mutation(({ ctx, input }) => renameProject(ctx, input.projectId, input.name)),
@@ -12913,7 +13025,7 @@ __export(exports_cli, {
   resolveDoctorEnv: () => resolveDoctorEnv,
   parseMode: () => parseMode
 });
-import { existsSync as existsSync24, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync15 } from "fs";
 function parseMode(argv) {
   return argv.includes("--gate") || argv.includes("--boot") ? "gate" : "diagnostic";
 }
@@ -12921,7 +13033,7 @@ function envWithAfkCredentials() {
   const merged = { ...process.env };
   try {
     const path = envPath();
-    if (existsSync24(path)) {
+    if (existsSync25(path)) {
       const fromFile = parseEnvFile2(readFileSync15(path, "utf8"));
       for (const runtime of AGENT_RUNTIMES) {
         const key = RUNTIME_SPECS[runtime].afkKey;