From 6c9747585f1e6beac7258b642015b7e5d55b8c66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Burzy=C5=84ski?= <mateuszburzynski@gmail.com>
Date: Tue, 10 Mar 2026 20:16:42 +0000
Subject: [PATCH] Reject `push_branch` when working tree has uncommitted
 changes (#468)

---
 entry      | 9 +++++++++
 mcp/git.ts | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/entry b/entry
index 63d14ce..fe82eb7 100755
--- a/entry
+++ b/entry
@@ -146453,6 +146453,15 @@ function PushBranchTool(ctx) {
         throw new Error("Push is disabled. This repository is configured for read-only access.");
       }
       const branch = branchName || $("git", ["rev-parse", "--abbrev-ref", "HEAD"], { log: false });
+      const status = $("git", ["status", "--porcelain"], { log: false });
+      if (status) {
+        throw new Error(
+          `push blocked: working tree has uncommitted changes. commit or discard them before pushing.
+
+git status:
+${status}`
+        );
+      }
       const pushUrl = ctx.toolState.pushUrl;
       if (!pushUrl) {
         throw new Error("pushUrl not set - setupGit must run before push_branch");
diff --git a/mcp/git.ts b/mcp/git.ts
index eafcd5b..dcd56e0 100644
--- a/mcp/git.ts
+++ b/mcp/git.ts
@@ -108,6 +108,15 @@ export function PushBranchTool(ctx: ToolContext) {
 
       const branch = branchName || $("git", ["rev-parse", "--abbrev-ref", "HEAD"], { log: false });
 
+      // reject push if working tree is dirty — forces agent to commit or discard before pushing
+      const status = $("git", ["status", "--porcelain"], { log: false });
+      if (status) {
+        throw new Error(
+          `push blocked: working tree has uncommitted changes. commit or discard them before pushing.\n\n` +
+            `git status:\n${status}`
+        );
+      }
+
       // validate push destination matches expected URL
       const pushUrl = ctx.toolState.pushUrl;
       if (!pushUrl) {