diff --git a/entry b/entry
index 63d14ce..fe82eb7 100755
--- a/entry
+++ b/entry
@@ -146453,6 +146453,15 @@ function PushBranchTool(ctx) {
         throw new Error("Push is disabled. This repository is configured for read-only access.");
       }
       const branch = branchName || $("git", ["rev-parse", "--abbrev-ref", "HEAD"], { log: false });
+      const status = $("git", ["status", "--porcelain"], { log: false });
+      if (status) {
+        throw new Error(
+          `push blocked: working tree has uncommitted changes. commit or discard them before pushing.
+
+git status:
+${status}`
+        );
+      }
       const pushUrl = ctx.toolState.pushUrl;
       if (!pushUrl) {
         throw new Error("pushUrl not set - setupGit must run before push_branch");
diff --git a/mcp/git.ts b/mcp/git.ts
index eafcd5b..dcd56e0 100644
--- a/mcp/git.ts
+++ b/mcp/git.ts
@@ -108,6 +108,15 @@ export function PushBranchTool(ctx: ToolContext) {
 
       const branch = branchName || $("git", ["rev-parse", "--abbrev-ref", "HEAD"], { log: false });
 
+      // reject push if working tree is dirty — forces agent to commit or discard before pushing
+      const status = $("git", ["status", "--porcelain"], { log: false });
+      if (status) {
+        throw new Error(
+          `push blocked: working tree has uncommitted changes. commit or discard them before pushing.\n\n` +
+            `git status:\n${status}`
+        );
+      }
+
       // validate push destination matches expected URL
       const pushUrl = ctx.toolState.pushUrl;
       if (!pushUrl) {