@brainervirus/workit-claude-code 8.0.1 → 8.1.1

package/dist/workit.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.0.1",
+    version: "8.1.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.0.1",
-      "@brainervirus/workit-cursor": "^8.0.1",
-      "@brainervirus/workit-opencode": "^8.0.1",
+      "@brainervirus/workit-core": "^8.1.1",
+      "@brainervirus/workit-cursor": "^8.1.1",
+      "@brainervirus/workit-opencode": "^8.1.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -12831,12 +12831,13 @@ function pushForge(cwd, options = {}) {
     };
   const forge = deriveForge(url, options);
   if (!forge) {
-    const host = parseRemoteUrl(url)?.host || null;
+    const parsed = parseRemoteUrl(url);
+    const host = parsed?.host || null;
     return {
       ok: false,
       code: "unavailable",
-      error: host ? `cannot tell whether push host "${host}" is GitHub or GitLab` : `push URL ${redactRemote(url)} of remote "${remote}" is not a GitHub/GitLab URL`,
-      unblock: host ? `map the alias in ~/.ssh/config (Host ${host} / HostName github.com|gitlab.com) or set github.host / gitlab.host in ~/.config/workit/vcs.json` : `git remote set-url --push ${remote} <ssh-or-https-url>`
+      error: host ? parsed?.protocol === "ssh" && !host.includes(".") ? `unsupported_forge: could not resolve ssh alias "${host}" to GitHub or GitLab; PR and CI verbs need one (workit git push still pushes with git)` : parsed?.protocol === "ssh" ? `unsupported_forge: ssh host "${host}" is not a GitHub/GitLab host or an alias workit can resolve; PR and CI verbs need one (workit git push still pushes with git)` : `unsupported_forge: cannot tell whether push host "${host}" is GitHub or GitLab; PR and CI verbs need one (workit git push still pushes with git)` : `push URL ${redactRemote(url)} of remote "${remote}" is not a GitHub/GitLab URL`,
+      unblock: host ? `if ${host} is an ssh alias of GitHub/GitLab, add "Host ${host}" with "HostName github.com" (or gitlab.com) to ~/.ssh/config; if it is a self-hosted GitHub/GitLab, set github.host or gitlab.host in ~/.config/workit/vcs.json; other forges (Bitbucket, Gitea…) have no PR/CI verbs` : `git remote set-url --push ${remote} <ssh-or-https-url>`
     };
   }
   return { ok: true, remote, url: redactRemote(url), forge };
@@ -12847,8 +12848,8 @@ function forgeConflict(derived, configuredProvider) {
     return null;
   return {
     code: "blocked",
-    error: `forge_mismatch: push remote ${derived.host} is ${derived.kind} but the workspace vcs.provider is ${configured}`,
-    unblock: `set vcs.provider to "${derived.kind}" for this repo in ~/.config/workit/workspaces.json (workit-github-override), or push to a ${configured} remote`
+    error: `forge_mismatch: push remote ${derived.host} is ${derived.kind} but the workspace vcs.provider is ${configured}, so its account and grants do not apply; PR and CI verbs stop here (workit git push still pushes with git)`,
+    unblock: `add a workspace whose glob matches only this repo, with "vcs": {"provider": "${derived.kind}"} (and its account), to ~/.config/workit/workspaces.json; the most specific glob wins`
   };
 }
 var MAX_BUFFER, GIT_TIMEOUTS, git2 = (cwd, args, options = {}) => {
@@ -14919,60 +14920,6 @@ var init_task_context = __esm(() => {
   privateKey = /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gi;
 });
 
-// packages/workit-core/src/core/commit-flavors.ts
-var CONVENTIONAL_RE, TICKET_RE, GITMOJI_RE, matchCommitFlavor = (message, flavor, pattern) => {
-  const subject = message.split(`
-`, 1)[0] ?? "";
-  switch (flavor) {
-    case "conventional":
-      return CONVENTIONAL_RE.test(subject);
-    case "gitmoji":
-      return GITMOJI_RE.test(subject);
-    case "ticket-prefix":
-      return TICKET_RE.test(subject);
-    case "freeform":
-      return subject.trim().length > 0;
-    case "custom":
-      if (!pattern)
-        return false;
-      try {
-        return new RegExp(pattern).test(subject);
-      } catch {
-        return false;
-      }
-    case "auto":
-      return subject.trim().length > 0;
-  }
-}, DETECTABLE, detectCommitFlavor = (subjects, threshold = 0.7) => {
-  if (subjects.length === 0)
-    return { flavor: null, confidence: 0 };
-  const votes = new Map;
-  for (const subject of subjects) {
-    const hit = DETECTABLE.find((flavor) => matchCommitFlavor(subject, flavor));
-    if (hit)
-      votes.set(hit, (votes.get(hit) ?? 0) + 1);
-  }
-  let best = null;
-  let count = 0;
-  for (const [flavor, votesFor] of votes) {
-    if (votesFor > count) {
-      best = flavor;
-      count = votesFor;
-    }
-  }
-  const confidence = count / subjects.length;
-  return best !== null && confidence >= threshold ? { flavor: best, confidence } : { flavor: null, confidence };
-};
-var init_commit_flavors = __esm(() => {
-  CONVENTIONAL_RE = /^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?(!)?: .+/;
-  TICKET_RE = /^[A-Z]{2,}-\d+\b/;
-  GITMOJI_RE = /^\p{Extended_Pictographic}/u;
-  DETECTABLE = ["conventional", "gitmoji", "ticket-prefix"];
-});
-
-// packages/workit-core/src/core/git.ts
-var init_git = () => {};
-
 // packages/workit-core/src/core/boundary.ts
 var EVENT, errorDetail = (err) => {
   if (err instanceof Error) {
@@ -15057,7 +15004,7 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   if (!migrationFailed)
     migratedDir = dir;
   return dir;
-}, configDir = () => ensureConfigDir(), LOCALE_RE, DEFAULTS, readSafe = (p) => {
+}, configDir = () => ensureConfigDir(), LOCALE_RE, DEFAULTS, unchosenBranchPolicy, readSafe = (p) => {
   try {
     return readFileSync3(p, "utf8");
   } catch {
@@ -15079,22 +15026,21 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   const locale = LOCALE_RE.test(String(input.locale ?? "")) ? input.locale : DEFAULTS.locale;
   const preset = Object.hasOwn(PRESETS, input.branchPolicy?.preset) ? input.branchPolicy?.preset : "gitflow";
   const commitPreset = COMMIT_PRESETS.includes(String(input.commitPolicy?.preset ?? "")) ? input.commitPolicy?.preset : "conventional";
-  return {
-    status: "valid",
-    path: file,
-    config: {
-      locale,
-      localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
-      branchPolicy: mergePreset(preset, {
-        allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
-        protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
-      }, DEFAULTS),
-      commitPolicy: {
-        preset: commitPreset,
-        ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
-      }
+  const config = {
+    locale,
+    localeOptions: Array.isArray(input.localeOptions) ? input.localeOptions : DEFAULTS.localeOptions,
+    branchPolicy: mergePreset(preset, {
+      allowed: Array.isArray(input.branchPolicy?.allowed) ? input.branchPolicy.allowed : undefined,
+      protectedNames: Array.isArray(input.branchPolicy?.protected) ? input.branchPolicy.protected : undefined
+    }, DEFAULTS),
+    commitPolicy: {
+      preset: commitPreset,
+      ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
     }
   };
+  if (!Object.hasOwn(PRESETS, input.branchPolicy?.preset))
+    unchosenBranchPolicy.add(config);
+  return { status: "valid", path: file, config };
 }, readConfigTyped = (dir) => {
   const file = path13.join(dir ?? configDir(), "config.json");
   return parseConfigResult(readSafe(file), file);
@@ -15108,9 +15054,11 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   if (result.status === "malformed")
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
-}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path13.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace) => {
+}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path13.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
   const wp = workspace?.branchPolicy ?? {};
-  const preset = Object.hasOwn(PRESETS, wp.preset) ? wp.preset : config.branchPolicy?.preset ?? "gitflow";
+  const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
+  const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
+  const preset = workspacePreset ? wp.preset : detected ?? config.branchPolicy?.preset ?? "gitflow";
   const merged = mergePreset(preset, {
     allowed: wp.allowed,
     protectedNames: wp.protected
@@ -15119,9 +15067,10 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   return {
     preset,
     allowed,
-    protected: new Set(merged.protected.map((p) => p.toLowerCase())),
+    protected: new Set([...merged.protected, ...detected ? PRESETS.gitflow.protected : []].map((p) => p.toLowerCase())),
     integration: wp.integration === "merge" ? "merge" : "pr",
-    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop"
+    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop",
+    detected: detected !== null
   };
 }, COMMIT_PRESETS, resolveCommitPolicy = (config, workspace) => {
   const wp = workspace?.commitPolicy ?? {};
@@ -15155,6 +15104,7 @@ var init_config = __esm(() => {
     },
     commitPolicy: { preset: "conventional" }
   };
+  unchosenBranchPolicy = new WeakSet([DEFAULTS]);
   COMMIT_PRESETS = [
     "conventional",
     "gitmoji",
@@ -15165,7 +15115,128 @@ var init_config = __esm(() => {
   ];
 });
 
+// packages/workit-core/src/core/branch-policy.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+var PREFIXES, branchNames = (workspaceRoot) => {
+  const r = spawnSync7("git", ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/remotes/origin"], { cwd: workspaceRoot, encoding: "utf8" });
+  if (r.status !== 0)
+    return new Set;
+  return new Set((r.stdout ?? "").split(`
+`).filter(Boolean).map((ref) => ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref.slice("refs/remotes/origin/".length)));
+}, detectBranchPolicy = (workspaceRoot) => {
+  const names = branchNames(workspaceRoot);
+  const develop = names.has("develop");
+  const main = names.has("main");
+  const master = names.has("master");
+  const root = main ? "main" : master ? "master" : null;
+  if (develop) {
+    return {
+      preset: "gitflow",
+      developBranch: "develop",
+      integration: "merge",
+      protected: root ? [root, "develop"] : ["develop"],
+      allowed: [...PRESETS.gitflow.allowed],
+      prefixes: PREFIXES
+    };
+  }
+  if (root === "main") {
+    return {
+      preset: "github-flow",
+      developBranch: null,
+      integration: "pr",
+      protected: [root],
+      allowed: ["*"],
+      prefixes: PREFIXES
+    };
+  }
+  if (root === "master") {
+    return {
+      preset: "trunk-based",
+      developBranch: null,
+      integration: "pr",
+      protected: [root],
+      allowed: ["*"],
+      prefixes: PREFIXES
+    };
+  }
+  return {
+    preset: "gitflow",
+    developBranch: null,
+    integration: "merge",
+    protected: [],
+    allowed: [],
+    prefixes: PREFIXES
+  };
+}, repoBranchPreset = (workspaceRoot) => {
+  const detected = detectBranchPolicy(workspaceRoot);
+  return detected.developBranch || detected.allowed.length ? detected.preset : null;
+};
+var init_branch_policy = __esm(() => {
+  init_config();
+  PREFIXES = {
+    feature: "feature/*",
+    bugfix: "bugfix/*",
+    release: "release/*",
+    hotfix: "hotfix/*"
+  };
+});
+
+// packages/workit-core/src/core/commit-flavors.ts
+var CONVENTIONAL_RE, TICKET_RE, GITMOJI_RE, matchCommitFlavor = (message, flavor, pattern) => {
+  const subject = message.split(`
+`, 1)[0] ?? "";
+  switch (flavor) {
+    case "conventional":
+      return CONVENTIONAL_RE.test(subject);
+    case "gitmoji":
+      return GITMOJI_RE.test(subject);
+    case "ticket-prefix":
+      return TICKET_RE.test(subject);
+    case "freeform":
+      return subject.trim().length > 0;
+    case "custom":
+      if (!pattern)
+        return false;
+      try {
+        return new RegExp(pattern).test(subject);
+      } catch {
+        return false;
+      }
+    case "auto":
+      return subject.trim().length > 0;
+  }
+}, DETECTABLE, detectCommitFlavor = (subjects, threshold = 0.7) => {
+  if (subjects.length === 0)
+    return { flavor: null, confidence: 0 };
+  const votes = new Map;
+  for (const subject of subjects) {
+    const hit = DETECTABLE.find((flavor) => matchCommitFlavor(subject, flavor));
+    if (hit)
+      votes.set(hit, (votes.get(hit) ?? 0) + 1);
+  }
+  let best = null;
+  let count = 0;
+  for (const [flavor, votesFor] of votes) {
+    if (votesFor > count) {
+      best = flavor;
+      count = votesFor;
+    }
+  }
+  const confidence = count / subjects.length;
+  return best !== null && confidence >= threshold ? { flavor: best, confidence } : { flavor: null, confidence };
+};
+var init_commit_flavors = __esm(() => {
+  CONVENTIONAL_RE = /^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?(!)?: .+/;
+  TICKET_RE = /^[A-Z]{2,}-\d+\b/;
+  GITMOJI_RE = /^\p{Extended_Pictographic}/u;
+  DETECTABLE = ["conventional", "gitmoji", "ticket-prefix"];
+});
+
+// packages/workit-core/src/core/git.ts
+var init_git = () => {};
+
 // packages/workit-core/src/core/workspaces.ts
+import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { readFileSync as readFileSync4, realpathSync as realpathSync3 } from "node:fs";
 import path14 from "node:path";
@@ -15174,7 +15245,7 @@ function workspaceDefaultTarget(cwd, globalDefault) {
   const wp = ws?.branchPolicy ?? {};
   const hasWorkspacePolicy = typeof wp.preset === "string" && Object.hasOwn(PRESETS, wp.preset);
   const selected = resolveRuntimeWorkspacePolicy(cwd, "branch", process.env.WORKFLOW_PROFILE?.trim() || undefined);
-  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null).defaultTargetBranch;
+  const policyDefault = resolveBranchPolicy(readConfig(), selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(cwd)).defaultTargetBranch;
   return String(ws?.vcs?.defaultTargetBranch ?? (hasWorkspacePolicy ? policyDefault : globalDefault ?? policyDefault) ?? "develop");
 }
 var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspaceCommitPolicySchema, workspaceProfileSchema, versionSourceSchema, releaseTrackSchema, workspaceConfigSchema, workspacesFileSchema, workspacesRevision = (contents) => createHash8("sha256").update(contents ?? "<missing>").digest("hex"), validateWorkspacesDocument = (parsed, file) => {
@@ -15293,6 +15364,46 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     };
   }
   return { ok: true };
+}, WorkspaceConfigError, mainCheckouts, mainCheckoutOf = (cwd) => {
+  const cached = mainCheckouts.get(cwd);
+  if (cached !== undefined)
+    return cached;
+  const env = { ...process.env };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE"])
+    delete env[name];
+  const git = (args) => {
+    const run = spawnSync8("git", args, {
+      cwd,
+      env,
+      encoding: "utf8",
+      timeout: 5000,
+      windowsHide: true
+    });
+    return run.status === 0 ? run.stdout : null;
+  };
+  let main = null;
+  const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
+  const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
+  if (gitDir && common && path14.resolve(gitDir) !== path14.resolve(common)) {
+    const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
+    main = listed?.trim() || (path14.basename(common) === ".git" ? path14.dirname(common) : common);
+  }
+  mainCheckouts.set(cwd, main);
+  return main;
+}, matchingEntries = (cwd, entries) => {
+  const match = (where) => {
+    const targets = [where, realpathOf(where)].map((value) => value.replaceAll("\\", "/"));
+    return entries.filter((entry) => {
+      const glob = entry.glob.replaceAll("\\", "/");
+      const canonical = canonicalGlob(glob);
+      return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
+    });
+  };
+  const direct = match(cwd);
+  if (direct.length)
+    return direct;
+  const main = mainCheckoutOf(cwd);
+  return main ? match(main) : direct;
 }, realpathOf = (p) => {
   const real = realpathSync3.native ?? realpathSync3;
   try {
@@ -15314,41 +15425,27 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     if (named.length === 1)
       return named[0];
     if (named.length > 1)
-      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+      throw new WorkspaceConfigError(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
     if (matches.length > 0) {
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+      throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
     }
-    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
   }
   if (matches.length < 2)
     return matches[0];
   const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
   const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
   if (mostSpecific.length > 1) {
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
+    throw new WorkspaceConfigError(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
   }
   return mostSpecific[0];
 }, resolveWorkspaceFromEntries = (cwd, entries, workspaceName) => {
-  const targets = [cwd, realpathOf(cwd)].map((p) => p.replaceAll("\\", "/"));
-  const matches = [];
-  for (const ws of entries) {
-    const glob = ws.glob.replaceAll("\\", "/");
-    const canonical = canonicalGlob(glob);
-    let matched = false;
-    for (const target of targets) {
-      if (matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target)) {
-        matched = true;
-        break;
-      }
-    }
-    if (matched)
-      matches.push(ws);
-  }
+  const matches = matchingEntries(cwd, entries);
   return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
 }, resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
   const result = readWorkspacesResult(dir);
   if (result.status === "malformed" || result.status === "invalid")
-    throw new Error(result.error);
+    throw new WorkspaceConfigError(result.error);
   return resolveWorkspaceFromEntries(cwd, result.entries, workspaceName);
 }, runtimeWorkspacePolicySchema = (kind) => {
   const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
@@ -15374,31 +15471,26 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
-    throw new Error(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    throw new WorkspaceConfigError(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`${file} is not valid JSON`);
+    throw new WorkspaceConfigError(`${file} is not valid JSON`);
   }
   const validated = runtimeWorkspaceIndexSchema.safeParse(parsed);
   if (!validated.success) {
     const detail = validated.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}`).join("; ");
-    throw new Error(`${file} has invalid workspace matching data: ${detail}`);
+    throw new WorkspaceConfigError(`${file} has invalid workspace matching data: ${detail}`);
   }
   const entries = validated.data.workspaces;
   for (const entry of entries ?? []) {
     const glob = validateWorkspaceGlob(entry.glob);
     if (!glob.ok)
-      throw new Error(`${file} workspace ${entry.name}: ${glob.error}`);
+      throw new WorkspaceConfigError(`${file} workspace ${entry.name}: ${glob.error}`);
   }
-  const targets = [cwd, realpathOf(cwd)].map((value) => value.replaceAll("\\", "/"));
-  const matches = (entries ?? []).filter((entry) => {
-    const glob = entry.glob.replaceAll("\\", "/");
-    const canonical = canonicalGlob(glob);
-    return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
-  });
+  const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
   return selected ? { file, selected } : null;
@@ -15413,7 +15505,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
   if (!policy.success) {
     const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
-    throw new Error(`${file} has invalid ${kind} policy configuration: ${detail}`);
+    throw new WorkspaceConfigError(`${file} has invalid ${kind} policy configuration: ${detail}`);
   }
   return policy.data;
 }, resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
@@ -15423,10 +15515,10 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   const key = kind === "branch" ? "branchPolicy" : "commitPolicy";
   const profileName = requestedProfile?.trim() || candidate.defaultProfile;
   if (candidate.defaultProfile && !Object.hasOwn(candidate.profiles ?? {}, candidate.defaultProfile))
-    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
   const profile = profileName ? candidate.profiles?.[profileName] : undefined;
   if (profileName && !profile)
-    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
   const profilePolicy = profile?.[key];
   const workspacePolicy = candidate[key];
   return {
@@ -15456,7 +15548,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
       commitPolicy: profile?.commitPolicy ? `profile:${profileName}` : workspace.commitPolicy ? `workspace:${workspace.name}` : "user-default"
     }
   };
-}, resolveWorkspacePolicy = (config, workspace, profileName) => {
+}, resolveWorkspacePolicy = (config, workspace, profileName, repoPreset) => {
   const selected = workspace ? resolveWorkspaceProfile(workspace, profileName) : {
     status: "resolved",
     profileName: null,
@@ -15469,7 +15561,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     status: "resolved",
     workspace: selected.workspace,
     profileName: selected.profileName,
-    branchPolicy: resolveBranchPolicy(config, selected.workspace),
+    branchPolicy: resolveBranchPolicy(config, selected.workspace, repoPreset),
     commitPolicy: resolveCommitPolicy(config, selected.workspace),
     provenance: selected.provenance
   };
@@ -15477,6 +15569,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
 var init_workspaces = __esm(() => {
   init_zod();
   init_config();
+  init_branch_policy();
   nonBlank = string2().refine((value) => value.trim().length > 0, "must not be blank");
   branchPreset = custom((value) => typeof value === "string" && Object.hasOwn(PRESETS, value), "unsupported branch preset");
   commitPreset = custom((value) => typeof value === "string" && COMMIT_PRESETS.includes(value), "unsupported commit preset");
@@ -15596,6 +15689,10 @@ var init_workspaces = __esm(() => {
   });
   UNSUPPORTED_GLOB = /[?[\]{}]/;
   UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
+  WorkspaceConfigError = class WorkspaceConfigError extends Error {
+    name = "WorkspaceConfigError";
+  };
+  mainCheckouts = new Map;
   runtimeWorkspaceIndexSchema = object({
     workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
   }).passthrough();
@@ -15603,7 +15700,7 @@ var init_workspaces = __esm(() => {
 
 // packages/workit-core/src/core/release-tracks.ts
 import { createHash as createHash9 } from "node:crypto";
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { readFileSync as readFileSync5 } from "node:fs";
 function readReleaseTracks(raw) {
   const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
@@ -16005,7 +16102,7 @@ var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER
   const remote = remotes.find((name) => bare.startsWith(`${name}/`));
   return remote ? bare.slice(remote.length + 1) : bare;
 }, MAX_RECORDED_HOPS = 10, git4 = (cwd, args) => {
-  const run = spawnSync7("git", args, {
+  const run = spawnSync9("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
@@ -16066,7 +16163,7 @@ var init_release_tracks = __esm(() => {
 // packages/workit-core/src/core/vcs-config.ts
 import fs12 from "node:fs";
 import path15 from "node:path";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
@@ -16149,7 +16246,7 @@ function vcsConfig(mode, cwd, options = {}) {
   return out;
 }
 var workspacesPath = () => path15.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
-  const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  const r = spawnSync10("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
   const url = (r.stdout ?? "").trim();
@@ -16199,7 +16296,7 @@ function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
   const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
   const config = readConfig();
   return kind === "branch" ? {
-    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null)),
+    branchPolicy: withReleaseTracks(workspaceRoot, resolveBranchPolicy(config, selected.policy ? { branchPolicy: selected.policy } : null, () => repoBranchPreset(workspaceRoot))),
     provenance: { branchPolicy: selected.source }
   } : {
     commitPolicy: resolveCommitPolicy(config, selected.policy ? { commitPolicy: selected.policy } : null),
@@ -16356,6 +16453,7 @@ var withReleaseTracks = (workspaceRoot, policy) => {
   return dirty ? "carry" : "clean";
 };
 var init_branch = __esm(() => {
+  init_branch_policy();
   init_commit_flavors();
   init_git();
   init_config();
@@ -18464,7 +18562,7 @@ var init_pr_body = __esm(() => {
 
 // packages/workit-core/src/core/pr-create.ts
 import path19 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 var safePushUrl = (remote) => {
   const raw = remote.trim();
@@ -18492,7 +18590,7 @@ var safePushUrl = (remote) => {
   const target = safePushUrl(remote);
   if (!target)
     return false;
-  const result = spawnSync9("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  const result = spawnSync11("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
   if (result.status !== 0 && result.status !== 1)
     return false;
   const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
@@ -62780,7 +62878,7 @@ var init_support_matrix = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/host-install.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import {
   accessSync,
   constants as constants2,
@@ -63051,7 +63149,7 @@ function runHostCommand(step, context = {}) {
       stderr: `Cannot safely execute batch shim ${step.command}; resolve its Node.js CLI entrypoint and retry`
     };
   }
-  const result = spawnSync10(step.command, step.args, {
+  const result = spawnSync12(step.command, step.args, {
     cwd: step.cwd,
     env: (() => {
       const home = context.home ?? context.env?.HOME ?? os6.homedir();
@@ -63256,7 +63354,7 @@ var init_skill_manifests = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/doctor.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import {
   existsSync as existsSync13,
   lstatSync as lstatSync4,
@@ -63340,7 +63438,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return false;
 }, versionOf = (bin, env, timeout) => {
-  const r = spawnSync11(bin, ["--version"], { encoding: "utf8", env, timeout });
+  const r = spawnSync13(bin, ["--version"], { encoding: "utf8", env, timeout });
   if (r.error)
     return null;
   return (r.stdout ?? "").trim();
@@ -63589,7 +63687,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 `)) {
       return false;
     }
-    return spawnSync11(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
+    return spawnSync13(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
   } catch {
     return false;
   }
@@ -63803,7 +63901,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!cmd)
     return null;
   try {
-    const r = spawnSync11(cmd, ["view", pkgName, "version"], {
+    const r = spawnSync13(cmd, ["view", pkgName, "version"], {
       encoding: "utf8",
       timeout: 20000,
       env: res.env
@@ -64087,6 +64185,16 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `malformed config: ${bad.join(", ")}`,
     fix: `Repair the malformed config in ${bad[0]}`
   };
+}, branchPresetLine = (res, workspace) => {
+  try {
+    const resolved = resolveWorkspacePolicy(readConfigFromDir(res.configDir), workspace, undefined, () => repoBranchPreset(res.cwd));
+    if (resolved.status === "invalid")
+      return [];
+    const { preset, detected } = resolved.branchPolicy;
+    return [`preset: ${detected ? `detected (${preset})` : preset}`];
+  } catch {
+    return [];
+  }
 }, checkWorkspaceMismatch = (res) => {
   const result = readWorkspacesResult(res.configDir);
   const file = result.path;
@@ -64094,7 +64202,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return {
       id: "workspace_mismatch",
       status: "pass",
-      detail: "no workspaces configured"
+      detail: ["no workspaces configured", ...branchPresetLine(res, null)].join("; ")
     };
   if (result.status === "malformed" || result.status === "invalid")
     return {
@@ -64118,7 +64226,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     const matched = `current directory matches workspace "${match.name}"`;
     const tracks = releaseTracksReport(res.cwd);
     const lines = describeReleaseTracks(tracks);
-    const detail = [matched, ...lines].join("; ");
+    const detail = [matched, ...branchPresetLine(res, match), ...lines].join("; ");
     if (tracks.error)
       return {
         id: "workspace_mismatch",
@@ -64232,7 +64340,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, defaultIdentityProbes = (env) => ({
   origin: (cwd) => {
     try {
-      const out = spawnSync11("git", ["remote", "get-url", "origin"], {
+      const out = spawnSync13("git", ["remote", "get-url", "origin"], {
         cwd,
         encoding: "utf8",
         env
@@ -64244,7 +64352,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync11("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync13("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -64253,7 +64361,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   glabLogin: (e) => {
     try {
-      const out = spawnSync11("glab", ["api", "user", "--jq", ".username"], {
+      const out = spawnSync13("glab", ["api", "user", "--jq", ".username"], {
         encoding: "utf8",
         env: e
       });
@@ -64265,7 +64373,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   sshLogin: (host) => {
     try {
-      const out = spawnSync11("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
+      const out = spawnSync13("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
         encoding: "utf8",
         env
       });
@@ -64460,6 +64568,7 @@ var init_doctor = __esm(() => {
   init_runtime_identity();
   init_boundary();
   init_release_tracks();
+  init_branch_policy();
   init_config();
   init_package_root();
   init_registration();
@@ -65473,69 +65582,6 @@ var init_setup = __esm(() => {
   SETUP_OVERRIDES = [...YT_OVERRIDES, ...VCS_OVERRIDES];
 });
 
-// packages/workit-core/src/core/branch-policy.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
-var PREFIXES, detectBranchPolicy = (workspaceRoot) => {
-  const branchExists = (name) => {
-    const r = spawnSync12("git", ["branch", "--list", name], {
-      cwd: workspaceRoot,
-      encoding: "utf8"
-    });
-    return r.status === 0 && (r.stdout ?? "").trim() !== "";
-  };
-  const develop = branchExists("develop");
-  const main = branchExists("main");
-  const master = branchExists("master");
-  const root = main ? "main" : master ? "master" : null;
-  if (develop) {
-    return {
-      preset: "gitflow",
-      developBranch: "develop",
-      integration: "merge",
-      protected: root ? [root, "develop"] : ["develop"],
-      allowed: [...PRESETS.gitflow.allowed],
-      prefixes: PREFIXES
-    };
-  }
-  if (root === "main") {
-    return {
-      preset: "github-flow",
-      developBranch: null,
-      integration: "pr",
-      protected: [root],
-      allowed: ["*"],
-      prefixes: PREFIXES
-    };
-  }
-  if (root === "master") {
-    return {
-      preset: "trunk-based",
-      developBranch: null,
-      integration: "pr",
-      protected: [root],
-      allowed: ["*"],
-      prefixes: PREFIXES
-    };
-  }
-  return {
-    preset: "gitflow",
-    developBranch: null,
-    integration: "merge",
-    protected: [],
-    allowed: [],
-    prefixes: PREFIXES
-  };
-};
-var init_branch_policy = __esm(() => {
-  init_config();
-  PREFIXES = {
-    feature: "feature/*",
-    bugfix: "bugfix/*",
-    release: "release/*",
-    hotfix: "hotfix/*"
-  };
-});
-
 // packages/workit-core/src/core/workspace-branch-policy.ts
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync15, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
 import path31 from "node:path";
@@ -68624,7 +68670,7 @@ function Screen({
           };
           const checkout = resolveBasePath(draft.values);
           const workspace = resolveWorkspaceFromEntries(checkout, draft.values.workspaces);
-          const resolved = resolveWorkspacePolicy(config, workspace);
+          const resolved = resolveWorkspacePolicy(config, workspace, undefined, () => repoBranchPreset(checkout));
           if (resolved.status === "invalid")
             return { error: resolved.error };
           return {
@@ -69485,7 +69531,7 @@ var init_init = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 import {
   existsSync as existsSync17,
   mkdtempSync as mkdtempSync3,
@@ -69841,7 +69887,7 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (deps.run)
     return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync13(launch.command, launch.args, {
+  return spawnSync14(launch.command, launch.args, {
     stdio: "inherit",
     env
   }).status ?? 1;
@@ -70023,7 +70069,7 @@ var init_launch = __esm(() => {
 });
 
 // packages/workit-core/src/knowledge.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 import fs17 from "node:fs";
 import path36 from "node:path";
 function lintKnowledge(root) {
@@ -70144,7 +70190,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
     return "unreadable";
   }
 }, trackedTopLevel = (root) => {
-  const run = spawnSync14("git", ["ls-files", "-z", "--cached"], {
+  const run = spawnSync15("git", ["ls-files", "-z", "--cached"], {
     cwd: root,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -70523,7 +70569,7 @@ var init_redact = __esm(() => {
 });
 
 // packages/workit-core/src/checks.ts
-import { spawn, spawnSync as spawnSync15 } from "node:child_process";
+import { spawn, spawnSync as spawnSync16 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import fs18 from "node:fs";
 import os13 from "node:os";
@@ -70702,7 +70748,7 @@ function runCheckCommand(argv, options) {
       if (!child?.pid)
         return;
       if (windows)
-        spawnSync15("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        spawnSync16("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -71424,7 +71470,47 @@ var init_check = __esm(() => {
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
 // packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
+import path39 from "node:path";
+function operationInProgress(cwd) {
+  const markers = [
+    ["rebase-merge", "rebase"],
+    ["rebase-apply", "rebase"],
+    ["MERGE_HEAD", "merge"],
+    ["CHERRY_PICK_HEAD", "cherry-pick"],
+    ["REVERT_HEAD", "revert"]
+  ];
+  const run = git5(cwd, ["rev-parse", ...markers.flatMap(([name]) => ["--git-path", name])]);
+  if (!run.ok)
+    return null;
+  const found = run.stdout.split(`
+`).map((line) => path39.resolve(cwd, line.trim()));
+  const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
+  for (const [index, [, operation]] of markers.entries()) {
+    const marker = found[index];
+    if (!marker || !existsSync18(marker))
+      continue;
+    if (index === 1 && existsSync18(path39.join(marker, "applying")))
+      return { operation: "am", commitAllowed: false, branch: null };
+    if (index === 0 && existsSync18(path39.join(marker, "amend")) && !conflicted()) {
+      let headName = "";
+      try {
+        headName = readFileSync18(path39.join(marker, "head-name"), "utf8").trim();
+      } catch {}
+      const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
+      return { operation, commitAllowed: branch !== null, branch };
+    }
+    if ((operation === "revert" || operation === "merge") && !conflicted())
+      return { operation, commitAllowed: true, branch: null };
+    return { operation, commitAllowed: false, branch: null };
+  }
+  return null;
+}
+function inProgressFailure(operation, verb) {
+  const command = operation === "am" ? "git am" : `git ${operation}`;
+  return failure3("blocked", `${operation.replace("-", "_")}_in_progress: a ${operation === "am" ? "git am" : operation} is in progress; finish or abort it before workit can ${verb}`, `resolve the conflicts, git add <files>, then ${command} --continue  # or ${command} --abort to return to where you started`);
+}
 function dirtEntries(cwd) {
   const run = git5(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]);
   if (!run.ok)
@@ -71444,6 +71530,9 @@ function dirtEntries(cwd) {
 function gitBranch(cwd, input) {
   if (!headSha(cwd) && currentBranch(cwd) === null)
     return failure3("invalid_input", "not inside a git repository with a commit");
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "create a branch");
   const explicitBase = input.base?.trim() || null;
   const resolved = vcsConfig("resolve", cwd, {
     track: input.track ?? null,
@@ -71548,53 +71637,156 @@ function lintCommitMessage(cwd, message) {
     correction: `use a ${detected} commit subject`
   };
 }
+function messageTrailers(cwd, message) {
+  const run = git5(cwd, [...TRAILER_CONFIG, "interpret-trailers", "--parse", "--no-divider"], {
+    input: `${message}
+`
+  });
+  return run.ok ? run.stdout.split(`
+`).filter((line) => line.trim()) : [];
+}
+function withTrailers(cwd, message, trailers) {
+  if (!trailers.length)
+    return message;
+  const run = git5(cwd, [
+    ...TRAILER_CONFIG,
+    "interpret-trailers",
+    "--no-divider",
+    "--if-exists",
+    "addIfDifferent",
+    ...trailers.flatMap((trailer) => ["--trailer", trailer])
+  ], { input: `${message}
+` });
+  return run.ok ? run.stdout.trim() : `${message}
+
+${trailers.join(`
+`)}`;
+}
+function branchesContaining(cwd, sha) {
+  const run = git5(cwd, [
+    "for-each-ref",
+    "--format=%(refname)",
+    "--contains",
+    sha,
+    "refs/heads",
+    "refs/remotes"
+  ]);
+  const names = new Set;
+  for (const ref of run.ok ? run.stdout.split(`
+`) : []) {
+    if (ref.startsWith("refs/heads/"))
+      names.add(ref.slice("refs/heads/".length));
+    else if (ref.startsWith("refs/remotes/")) {
+      const name = ref.split("/").slice(3).join("/");
+      if (name && name !== "HEAD")
+        names.add(name);
+    }
+  }
+  return names;
+}
+function sharedBranchContaining(cwd, sha, branch) {
+  const resolved = vcsConfig("resolve", cwd);
+  const defaults = new Set(resolved.ok === false ? [] : [resolved.defaultTargetBranch, resolved.baseBranch].map((value) => String(value ?? "")).filter(Boolean));
+  for (const name of branchesContaining(cwd, sha))
+    if (name !== branch && (defaults.has(name) || isProtectedTarget(cwd, name)))
+      return name;
+  return null;
+}
 function gitCommit(cwd, input) {
-  const message = input.message.trim();
-  if (!message)
-    return failure3("invalid_input", "a commit message is required (-m <msg>)");
+  const given = input.message?.trim() ?? "";
+  if (!given && !input.amend)
+    return failure3("invalid_input", "a commit message is required (-m <msg> or -F <file>)");
   const paths = input.paths ?? [];
   if (input.all && paths.length)
     return failure3("invalid_input", "pass --all or paths, not both");
-  const branch = currentBranch(cwd);
+  const progress = operationInProgress(cwd);
+  if (progress && !progress.commitAllowed)
+    return inProgressFailure(progress.operation, "commit");
+  const branch = progress?.branch ?? currentBranch(cwd);
   if (!branch)
     return failure3("invalid_input", "HEAD is detached; commit on a branch (workit git branch <name>)");
   if (isProtectedTarget(cwd, branch))
     return failure3("blocked", `protected_branch: ${branch} is protected by the workspace branch policy; workit never commits to it`, "workit git branch <feature/name>  # then commit there");
-  const lint = lintCommitMessage(cwd, message);
-  if (!lint.ok)
-    return failure3("blocked", lint.error, lint.correction);
+  const previous = input.amend ? headSha(cwd) : null;
+  if (input.amend && !previous)
+    return failure3("invalid_input", `nothing to amend: ${branch} has no commit yet`);
+  if (previous) {
+    const shared = sharedBranchContaining(cwd, previous, branch);
+    if (shared)
+      return failure3("blocked", `amend_shared_commit: ${previous.slice(0, 12)} is already on ${shared}, so it is not ${branch}'s own commit; workit never rewrites it`, "workit git commit -m '<msg>' -- <paths>  # add a new commit instead");
+  }
+  let message = given;
+  let carried = [];
+  if (given) {
+    const lint = lintCommitMessage(cwd, given);
+    if (!lint.ok)
+      return failure3("blocked", lint.error, lint.correction);
+  }
+  if (previous) {
+    const kept = git5(cwd, ["log", "-1", "--format=%B", previous]);
+    if (!kept.ok)
+      return failure3("failed", `could not read the message of ${branch}: ${gitError(kept)}`);
+    if (given)
+      carried = messageTrailers(cwd, kept.stdout.trim());
+    else
+      message = kept.stdout.trim();
+  }
   const session = input.actor.session;
   if (session && !SESSION_SAFE.test(session))
     return failure3("invalid_input", "WORKIT_SESSION_ID must be 1-128 characters of [A-Za-z0-9_.:@/+-]");
-  const args = ["commit", "--no-edit", "-m", message];
-  if (session)
-    args.push("--trailer", `Workit-Session: ${session}`);
+  const changeRequired = !input.amend && !input.allowEmpty;
+  const emptyAmend = previous !== null && git5(cwd, ["rev-parse", "--verify", "-q", `${previous}^{tree}`]).stdout.trim() === git5(cwd, ["rev-parse", "--verify", "-q", `${previous}~1^{tree}`]).stdout.trim();
+  const args = ["commit", "--no-edit"];
+  if (input.amend)
+    args.push("--amend");
+  if (input.allowEmpty || emptyAmend)
+    args.push("--allow-empty");
+  args.push("-m", withTrailers(cwd, message, [...carried, ...session ? [`Workit-Session: ${session}`] : []]));
   if (paths.length) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
-    const added = git5(cwd, ["add", "-A", "--", ...paths]);
-    if (!added.ok)
-      return failure3("failed", `git add failed: ${gitError(added)}`);
+    const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
+    const addable = paths.filter((value) => existsSync18(path39.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    if (addable.length) {
+      const added = git5(cwd, ["add", "-A", "--", ...addable]);
+      if (!added.ok)
+        return failure3("failed", `git add failed: ${gitError(added)}`);
+    }
+    if (changeRequired && git5(cwd, ["diff", "--cached", "--quiet", "HEAD", "--", ...paths]).ok)
+      return nothingToCommit(`${paths.join(", ")} has no change to commit`);
     args.push("--", ...paths);
   } else if (input.all) {
     const added = git5(cwd, ["add", "-A"]);
     if (!added.ok)
       return failure3("failed", `git add failed: ${gitError(added)}`);
-  } else {
+    if (changeRequired && git5(cwd, ["diff", "--cached", "--quiet"]).ok)
+      return nothingToCommit("the working tree is clean");
+  } else if (changeRequired) {
     const staged = git5(cwd, ["diff", "--cached", "--name-only", "-z"]);
     if (staged.ok && !staged.stdout.replaceAll("\x00", "")) {
       const dirt = dirtEntries(cwd);
-      return failure3(dirt.length ? "blocked" : "failed", dirt.length ? `nothing_staged: nothing is staged and workit never commits unrelated changes implicitly (${dirt.length} changed: ${dirt.slice(0, 5).map((entry) => entry.slice(3)).join(", ")}${dirt.length > 5 ? ", …" : ""})` : "nothing_to_commit: the working tree is clean", dirt.length ? `workit git commit -m '<msg>' -- <paths>  # or --all to commit every change` : undefined);
+      if (!dirt.length)
+        return nothingToCommit("the working tree is clean");
+      return failure3("blocked", `nothing_staged: nothing is staged and workit never commits unrelated changes implicitly (${dirt.length} changed: ${dirt.slice(0, 5).map((entry) => entry.slice(3)).join(", ")}${dirt.length > 5 ? ", …" : ""})`, `workit git commit -m '<msg>' -- <paths>  # or --all to commit every change`);
     }
   }
-  const committed = git5(cwd, args, { timeoutMs: COMMIT_TIMEOUT_MS, env: input.env });
+  const committed = git5(cwd, args, {
+    timeoutMs: COMMIT_TIMEOUT_MS,
+    env: input.env
+  });
   if (!committed.ok)
-    return failure3("failed", `git commit failed: ${gitError(committed, 6)}`);
+    return failure3("failed", `git commit failed (a hook or git refused it):
+${gitOutput(committed)}`);
   const sha = headSha(cwd);
   if (!sha)
     return failure3("failed", "the commit did not resolve");
-  const files = nulList(git5(cwd, ["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", sha]).stdout);
+  const merge = git5(cwd, ["rev-parse", "-q", "--verify", `${sha}^2`]).ok;
+  const files = nulList(git5(cwd, merge ? ["diff", "--name-only", "-z", `${sha}^1`, sha] : ["diff-tree", "--root", "--no-commit-id", "--name-only", "-r", "-z", sha]).stdout);
   const leftDirty = dirtEntries(cwd).length;
+  const notes = [];
+  const upstream = `refs/remotes/${pushRemoteName(cwd, branch) ?? "origin"}/${branch}`;
+  if (previous && git5(cwd, ["merge-base", "--is-ancestor", previous, upstream]).ok)
+    notes.push(`the amended commit ${previous.slice(0, 12)} was already pushed (${upstream.slice("refs/remotes/".length)}); publish the rewrite with: workit git push --force-with-lease`);
   const listed = [];
   let size = 0;
   for (const file of files) {
@@ -71614,7 +71806,8 @@ function gitCommit(cwd, input) {
     subject: (message.split(`
 `, 1)[0] ?? "").slice(0, 200),
     files: listed,
-    fileCount: files.length
+    fileCount: files.length,
+    ...previous ? { amended: previous } : {}
   });
   return success2({
     sha,
@@ -71623,10 +71816,15 @@ function gitCommit(cwd, input) {
     files,
     leftDirty,
     session,
+    amended: previous,
+    notes,
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
   });
 }
 function pushPreflight(cwd, options = {}) {
+  const progress = operationInProgress(cwd);
+  if (progress)
+    return inProgressFailure(progress.operation, "push");
   const branch = options.branch ?? currentBranch(cwd);
   if (!branch)
     return failure3("invalid_input", "HEAD is detached; push a branch");
@@ -71665,11 +71863,35 @@ function recordedRemoteTip(cwd, plan) {
   return;
 }
 function includesRemoteTip(cwd, branch, tip) {
-  if (git5(cwd, ["merge-base", "--is-ancestor", tip, `refs/heads/${branch}`]).ok)
+  const ref = `refs/heads/${branch}`;
+  if (git5(cwd, ["merge-base", "--is-ancestor", tip, ref]).ok)
+    return true;
+  const reflog = git5(cwd, ["reflog", "show", "--format=%H", ref, "--"]);
+  const former = [
+    ...new Set((reflog.ok ? reflog.stdout : "").split(`
+`).map((line) => line.trim()).filter(Boolean))
+  ];
+  if (former.includes(tip))
     return true;
-  const reflog = git5(cwd, ["reflog", "show", "--format=%H", `refs/heads/${branch}`, "--"]);
-  return reflog.ok && reflog.stdout.split(`
-`).some((line) => line.trim() === tip);
+  if (!former.length)
+    return false;
+  const outside = git5(cwd, ["rev-list", "-n", "1", "--stdin"], {
+    input: `${tip}
+${former.map((sha) => `^${sha}`).join(`
+`)}
+`
+  });
+  return outside.ok && !outside.stdout.trim();
+}
+function patchEquivalent(cwd, branch, tip) {
+  const ref = `refs/heads/${branch}`;
+  const merges = git5(cwd, ["rev-list", "--count", "--merges", `${ref}..${tip}`]);
+  if (!merges.ok || merges.stdout.trim() !== "0")
+    return false;
+  const cherry = git5(cwd, ["cherry", ref, tip]);
+  const lines = cherry.ok ? cherry.stdout.split(`
+`).filter(Boolean) : [];
+  return lines.length > 0 && lines.every((line) => line.startsWith("-"));
 }
 function executePush(cwd, plan, input) {
   const before = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.branch}`);
@@ -71704,9 +71926,17 @@ ${run.stdout}`;
         return failure3("unavailable", `git push to ${plan.url} timed out`);
       if (/stale info/iu.test(text))
         return failure3("blocked", `lease_mismatch: ${plan.remote}/${plan.branch} moved while pushing`, `git fetch ${plan.remote} ${plan.branch} && git rebase ${plan.remote}/${plan.branch}  # or merge it; then: workit git push`);
+      const rejected = /non-fast-forward|fetch first|\[rejected\]/iu.test(text);
+      const integrated = rejected && before.sha !== null && includesRemoteTip(cwd, plan.branch, before.sha);
+      const equivalent = rejected && !integrated && before.sha !== null && patchEquivalent(cwd, plan.branch, before.sha);
+      if (before.sha !== null && (integrated || equivalent)) {
+        const lease = recordedRemoteTip(cwd, plan) === before.sha ? "workit git push --force-with-lease" : `workit git push --force-with-lease --expect ${before.sha}`;
+        return failure3("failed", integrated ? `non_fast_forward: local ${plan.branch} was rewritten (amend or rebase) after ${plan.remote}/${plan.branch} (${before.sha.slice(0, 12)}) was pushed; that tip is already part of the local history, so do not fetch and rebase` : `non_fast_forward: every commit on ${plan.remote}/${plan.branch} (${before.sha.slice(0, 12)}) has a patch-equivalent commit in local ${plan.branch} (rebased elsewhere); fetching and rebasing would apply them twice`, integrated ? lease : `${lease} --overwrite-unintegrated  # after checking ${plan.remote}/${plan.branch} holds nothing else`);
+      }
       if (/non-fast-forward|fetch first|\[rejected\]/iu.test(text))
         return failure3("failed", `non_fast_forward: ${plan.remote}/${plan.branch} has commits this branch does not`, `git fetch ${plan.remote} && git rebase ${plan.remote}/${plan.branch}  # or, if the rewrite is intended: workit git push --force-with-lease`);
-      return failure3("failed", `git push to ${plan.url} failed: ${gitError(run)}`);
+      return failure3("failed", `git push to ${plan.url} failed:
+${gitOutput(run)}`);
     }
     pushed = true;
   }
@@ -71728,7 +71958,8 @@ ${run.stdout}`;
     url: plan.url,
     previous: before.sha,
     pushed,
-    forced
+    forced,
+    ...input.identity ? { identity: input.identity } : {}
   });
   return success2({
     remote: plan.remote,
@@ -71765,10 +71996,14 @@ function deleteRemoteBranch(cwd, target, branch, expectedTip, options = {}) {
     return { ok: true };
   const text = `${run.stderr}
 ${run.stdout}`;
-  return /stale info|cannot lock ref|fetch first|non-fast-forward/iu.test(text) ? { ok: false, lease: true, error: "the remote branch tip changed before deletion" } : { ok: false, lease: false, error: gitError(run) };
+  return /stale info|cannot lock ref|fetch first|non-fast-forward/iu.test(text) ? {
+    ok: false,
+    lease: true,
+    error: "the remote branch tip changed before deletion"
+  } : { ok: false, lease: false, error: gitError(run) };
 }
 var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
-  const result = spawnSync16("git", args, {
+  const result = spawnSync17("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
@@ -71776,7 +72011,7 @@ var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}
     timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
     killSignal: "SIGKILL",
     windowsHide: true,
-    stdio: ["ignore", "pipe", "pipe"]
+    ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
   });
   return {
     ok: result.status === 0,
@@ -71788,7 +72023,22 @@ var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}
   const lines = redactText(`${run.stderr}
 ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trim()).filter((value) => value && !value.startsWith("hint:"));
   return lines.slice(-max).join(" / ").slice(0, 400) || "git failed";
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, SHA;
+}, OUTPUT_LINES = 200, OUTPUT_LINE_CHARS = 1000, gitOutput = (run) => {
+  const lines = redactText(`${run.stderr}
+${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((value) => value.trim() && !value.trimStart().startsWith("hint:")).map((value) => value.length > OUTPUT_LINE_CHARS ? `${value.slice(0, OUTPUT_LINE_CHARS)}…` : value);
+  if (!lines.length)
+    return "git failed";
+  if (lines.length <= OUTPUT_LINES)
+    return lines.join(`
+`);
+  const half = OUTPUT_LINES / 2;
+  return [
+    ...lines.slice(0, half),
+    `… ${lines.length - OUTPUT_LINES} lines omitted …`,
+    ...lines.slice(-half)
+  ].join(`
+`);
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA;
 var init_ops = __esm(() => {
   init_branch();
   init_commit_flavors();
@@ -71800,15 +72050,16 @@ var init_ops = __esm(() => {
   init_rev();
   COMMIT_TIMEOUT_MS = 10 * 60000;
   SESSION_SAFE = /^[\w.:@/+-]{1,128}$/u;
+  TRAILER_CONFIG = ["-c", "trailer.separators=:", "-c", "trailer.where=end"];
   SHA = /^[0-9a-f]{40,64}$/u;
 });
 
 // packages/workit-core/src/forge/reruns.ts
 import fs19 from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path39.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path40.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -71843,7 +72094,7 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs19.mkdirSync(path39.dirname(file), { recursive: true });
+    fs19.mkdirSync(path40.dirname(file), { recursive: true });
     fs19.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
@@ -71856,7 +72107,7 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs19.mkdirSync(path39.dirname(lock), { recursive: true });
+  fs19.mkdirSync(path40.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
@@ -72132,16 +72383,16 @@ function waitVerdict(doc, options) {
   const checks = doc.checks.state;
   if (checks === "failing")
     return { state: "failed", reason: "checks_failing" };
-  if (checks === "pending")
-    return { state: "waiting", reason: "checks_pending" };
-  if (checks === "passing")
-    return { state: "ready", reason: "checks_passing" };
-  if (doc.conflicts)
+  if (doc.conflicts && checks !== "passing")
     return {
       state: "blocked",
       reason: "conflicts",
       unblock: `rebase onto ${doc.base} and push; CI does not run on a conflicting PR`
     };
+  if (checks === "pending")
+    return { state: "waiting", reason: "checks_pending" };
+  if (checks === "passing")
+    return { state: "ready", reason: "checks_passing" };
   const ciRequired = doc.checks.missingRequired === null || doc.mergeState === "ci_must_pass" || doc.mergeState === "ci_still_running";
   if (ciRequired)
     return { state: "waiting", reason: "no_checks_yet" };
@@ -72249,7 +72500,7 @@ var init_report = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-ops.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
   if (!base.startsWith("-"))
@@ -72257,7 +72508,7 @@ function fillFromCommits(cwd, resolved, base) {
   const from = resolveRef(cwd, tracking) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return failure3("not_found", `base ${base} is not available locally`, `git fetch ${resolved.baseRemote} ${base}`);
-  const log = spawnSync17("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
+  const log = spawnSync18("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -72562,15 +72813,15 @@ var init_pr_ops = __esm(() => {
 });
 
 // packages/workit-core/src/forge/exec.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 import fs20 from "node:fs";
-import path40 from "node:path";
+import path41 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path40.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path41.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path40.join(dir, `${bin}${ext}`);
+      const candidate = path41.join(dir, `${bin}${ext}`);
       try {
         const stat = fs20.statSync(candidate);
         if (stat.isFile())
@@ -72597,7 +72848,7 @@ function systemRunner(kind, apiHost, env = process.env) {
     if (!exe)
       return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
     const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
-    const result = spawnSync18(exe, [...args], {
+    const result = spawnSync19(exe, [...args], {
       encoding: "utf8",
       env: { ...childEnv, ...token },
       maxBuffer: MAX_BUFFER2,
@@ -72616,17 +72867,45 @@ function systemRunner(kind, apiHost, env = process.env) {
     };
   };
 }
+function forgeReason(run) {
+  const parts = [];
+  try {
+    const body = JSON.parse(run.stdout);
+    const add = (value) => {
+      if (typeof value === "string" && value.trim())
+        parts.push(value.trim());
+      else if (Array.isArray(value))
+        value.forEach(add);
+      else if (value && typeof value === "object") {
+        const record = value;
+        if (typeof record.message === "string")
+          add(record.message);
+        else if (!("code" in record))
+          Object.values(record).forEach(add);
+      }
+    };
+    add(body.message);
+    add(body.error);
+    add(body.errors);
+  } catch {}
+  const stderr = (run.stderr.split(/\r?\n/u).find((value) => value.trim()) ?? "").trim();
+  const unique = [...new Set(parts)];
+  const text = unique.length ? `${unique.join("; ")}${stderr ? ` (${stderr.replace(/^gh: |^glab: /u, "")})` : ""}` : stderr || (run.stdout.split(/\r?\n/u).find((value) => value.trim()) ?? "");
+  return redactText(text).slice(0, 300);
+}
 function cliFailure(bin, apiHost, run, what, timeoutMs) {
   if (run.missing)
     return failure3("unavailable", `${bin} is not installed`, installHint(bin));
   if (run.timedOut)
-    return failure3("unavailable", `${bin} api ${what} timed out after ${timeoutMs} ms`);
+    return failure3("unavailable", run.timeoutMs === 0 ? `${bin} api ${what} not attempted: the command's time budget ran out` : `${bin} api ${what} timed out after ${run.timeoutMs ?? timeoutMs} ms`, `check the network to ${apiHost}, then retry`);
   const stderr = redactText(run.stderr).trim();
   if (/auth login|not logged in|no token|authentication required|bad credentials|\b401\b|unauthorized/iu.test(stderr))
     return failure3("unavailable", `${bin} is not authenticated for ${apiHost}`, loginHint(bin, apiHost));
   if (/\b404\b|not found/iu.test(stderr))
     return failure3("not_found", `${what} was not found`);
   const first = stderr.split(/\r?\n/u).find((value) => value.trim()) ?? `exit ${run.status}`;
+  if (isNetworkError(stderr))
+    return failure3("unavailable", `${bin} api ${what} failed (network): ${first.slice(0, 200)}`, `check the network to ${apiHost}, then retry`);
   return failure3("failed", `${bin} api ${what} failed: ${first.slice(0, 200)}`);
 }
 function apiJson(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.api, options = {}) {
@@ -72657,12 +72936,15 @@ function apiWrite(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.a
   if (run.status !== 0) {
     const text = redactText(`${run.stderr}
 ${run.stdout}`).trim();
-    const reason = (text.split(/\r?\n/u).find((value) => value.trim()) ?? "").slice(0, 200);
+    const reason = forgeReason(run);
     if (!run.missing && !run.timedOut && /\b409\b|head branch was modified|sha does not match|sha.*mismatch/iu.test(text))
       return failure3("blocked", `head_moved: ${what} refused because the head changed (${reason})`, "workit pr status  # re-check the new head, then verify it again");
     if (!run.missing && !run.timedOut && /\b(405|406|422)\b/u.test(text))
       return failure3("blocked", `${what} refused by the forge: ${reason}`);
-    return cliFailure(bin, apiHost, run, what, timeoutMs);
+    const failed = cliFailure(bin, apiHost, run, what, timeoutMs);
+    if (!failed.ok && failed.code === "unavailable" && !run.missing && !/ is not authenticated for /u.test(failed.error))
+      return failure3("unavailable", failed.error, "workit pr status  # the write may have gone through; check it first, then retry");
+    return failed;
   }
   if (!run.stdout.trim())
     return { ok: true, data: {} };
@@ -72672,11 +72954,12 @@ ${run.stdout}`).trim();
     return failure3("failed", `${bin} api ${what} returned invalid JSON`);
   }
 }
-var FORGE_TIMEOUTS, MAX_BUFFER2, installHint = (bin) => bin === "gh" ? "install the GitHub CLI (https://cli.github.com) and run: gh auth login" : "install glab (https://gitlab.com/gitlab-org/cli) and run: glab auth login", loginHint = (bin, apiHost) => `${bin} auth login --hostname ${apiHost}`;
+var FORGE_TIMEOUTS, MAX_BUFFER2, installHint = (bin) => bin === "gh" ? "install the GitHub CLI (https://cli.github.com) and run: gh auth login" : "install glab (https://gitlab.com/gitlab-org/cli) and run: glab auth login", loginHint = (bin, apiHost) => `${bin} auth login --hostname ${apiHost}`, NETWORK, isNetworkError = (text) => NETWORK.test(text);
 var init_exec = __esm(() => {
   init_redact();
   FORGE_TIMEOUTS = { api: 20000, log: 30000 };
   MAX_BUFFER2 = 64 * 1024 * 1024;
+  NETWORK = /error connecting|could not resolve|no such host|connection (refused|reset|timed out)|network is unreachable|i\/o timeout|tls handshake|unexpected eof|\bHTTP 5\d\d\b|bad gateway|service unavailable|gateway time-?out/iu;
 });
 
 // packages/workit-core/src/forge/github.ts
@@ -73268,6 +73551,82 @@ var init_gitlab = __esm(() => {
 
 // packages/workit-core/src/forge/resolve.ts
 import fs21 from "node:fs";
+function memo4(scope, key, compute, now = Date.now) {
+  let entries = memoScopes.get(scope.owner);
+  if (!entries)
+    memoScopes.set(scope.owner, entries = new Map);
+  const full = `${scope.key} ${key}`;
+  const hit = entries.get(full);
+  if (hit && now() - hit.at < MEMO_TTL_MS)
+    return hit.value;
+  const { keep, value } = compute();
+  if (keep)
+    entries.set(full, { at: now(), value });
+  return value;
+}
+function clampedRunner(base, limits, now, token) {
+  return (bin, args, callOptions) => {
+    let timeoutMs = callOptions.timeoutMs;
+    if (limits.deadline !== null) {
+      const remaining = limits.deadline - now();
+      if (remaining <= 0)
+        return {
+          status: null,
+          stdout: "",
+          stderr: "",
+          timedOut: true,
+          missing: false,
+          timeoutMs: 0
+        };
+      timeoutMs = Math.min(timeoutMs, remaining);
+    }
+    const run = base(bin, args, { ...callOptions, timeoutMs, ...token ? { token } : {} });
+    return run.timedOut && run.timeoutMs === undefined ? { ...run, timeoutMs } : run;
+  };
+}
+function resolveCredential(workspace, derived, run, scope) {
+  const { kind, apiHost } = derived;
+  const expectedAccount = workspace?.vcs?.account ?? null;
+  const tokenFile = workspace?.vcs?.tokenFile;
+  if (typeof tokenFile === "string" && tokenFile.trim()) {
+    const workspaceHost = workspace?.vcs?.host;
+    const explicit = typeof workspaceHost === "string" && workspaceHost.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "") === apiHost;
+    if (derived.via === "host_name" && !explicit)
+      return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
+    let token = "";
+    try {
+      token = fs21.readFileSync(tokenFile.trim(), "utf8").trim();
+    } catch {
+      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
+    }
+    if (!token)
+      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
+    return success2({ token, credential: "workspace_token_file" });
+  }
+  if (!expectedAccount || kind !== "github")
+    return success2({ token: undefined, credential: "cli_login" });
+  return memo4(scope, `token ${apiHost} ${expectedAccount}`, () => {
+    const issued = run("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
+      timeoutMs: FORGE_TIMEOUTS.api
+    });
+    const value = authTokenResult(issued, apiHost, expectedAccount, workspace?.name ?? "?");
+    return { keep: value.ok, value };
+  });
+}
+function authTokenResult(issued, apiHost, account, workspace) {
+  if (issued.missing)
+    return failure3("unavailable", "gh is not installed", "install the GitHub CLI (https://cli.github.com) and run: gh auth login");
+  if (issued.timedOut)
+    return failure3("unavailable", `gh auth token ${issued.timeoutMs === 0 ? "not attempted: the time budget ran out" : `timed out after ${issued.timeoutMs ?? FORGE_TIMEOUTS.api} ms`} (looking up the ${account} login on ${apiHost})`, "gh auth status  # check gh and the network, then retry");
+  const token = issued.status === 0 ? issued.stdout.trim() : "";
+  if (token)
+    return success2({ token, credential: "gh_account_token" });
+  const stderr = redactText(issued.stderr).trim();
+  const first = stderr.split(/\r?\n/u).find((line) => line.trim()) ?? "";
+  if (issued.status !== 0 && first && !/no oauth token|not logged in|no account/iu.test(stderr))
+    return failure3("unavailable", `gh auth token failed${isNetworkError(stderr) ? " (network)" : ""}: ${first.slice(0, 200)}`, "gh auth status  # check gh and the network, then retry");
+  return failure3("blocked", `identity_unavailable: gh has no login for ${account} on ${apiHost} (workspace ${workspace})`, `gh auth login --hostname ${apiHost}  # sign in as ${account}; workit passes that account's token per call and never switches the active account`);
+}
 function resolveForge(cwd, options = {}) {
   let workspace;
   try {
@@ -73285,48 +73644,16 @@ function resolveForge(cwd, options = {}) {
   const derived = pushed.forge;
   const { kind, apiHost } = derived;
   const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
   const now = options.now ?? Date.now;
   const expectedAccount = workspace?.vcs?.account ?? null;
-  let token;
-  let credential = "cli_login";
-  const tokenFile = workspace?.vcs?.tokenFile;
-  if (typeof tokenFile === "string" && tokenFile.trim()) {
-    const workspaceHost = workspace?.vcs?.host;
-    const explicit = typeof workspaceHost === "string" && workspaceHost.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "") === apiHost;
-    if (derived.via === "host_name" && !explicit)
-      return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
-    try {
-      token = fs21.readFileSync(tokenFile.trim(), "utf8").trim();
-    } catch {
-      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
-    }
-    if (!token)
-      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
-    credential = "workspace_token_file";
-  } else if (expectedAccount && kind === "github") {
-    const issued = base("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
-      timeoutMs: FORGE_TIMEOUTS.api
-    });
-    if (issued.missing)
-      return failure3("unavailable", "gh is not installed", "install the GitHub CLI (https://cli.github.com) and run: gh auth login");
-    token = issued.status === 0 ? issued.stdout.trim() : "";
-    if (!token)
-      return failure3("blocked", `identity_unavailable: gh has no login for ${expectedAccount} on ${apiHost} (workspace ${workspace?.name ?? "?"})`, `gh auth login --hostname ${apiHost}  # sign in as ${expectedAccount}; workit passes that account's token per call and never switches the active account`);
-    credential = "gh_account_token";
-  }
-  const limits = { deadline: null };
-  const runner = (bin, args, callOptions) => {
-    let timeoutMs = callOptions.timeoutMs;
-    if (limits.deadline !== null) {
-      const remaining = limits.deadline - now();
-      if (remaining <= 0)
-        return { status: null, stdout: "", stderr: "", timedOut: true, missing: false };
-      timeoutMs = Math.min(timeoutMs, remaining);
-    }
-    return base(bin, args, { ...callOptions, timeoutMs, ...token ? { token } : {} });
-  };
+  const limits = { deadline: options.deadline ?? null };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  if (!credential.ok)
+    return credential;
+  const runner = clampedRunner(base, limits, now, credential.data.token);
   const headRepo = derived.repo;
-  const probe = createForge(derived, headRepo, runner);
+  const probe = memoizedIdentity(createForge(derived, headRepo, runner), scope, credential.data);
   const info = probe.repoInfo(headRepo);
   if (!info.ok && info.code !== "not_found")
     return info;
@@ -73341,13 +73668,13 @@ function resolveForge(cwd, options = {}) {
   const baseRepo = upstream && upstream !== headRepo ? upstream : info.ok && info.data.parent ? info.data.parent : headRepo;
   const baseRemote = baseRepo === headRepo ? pushed.remote : remotes.find((name) => repoOfRemote(name) === baseRepo) ?? pushed.remote;
   return success2({
-    forge: baseRepo === headRepo ? probe : createForge(derived, baseRepo, runner),
+    forge: baseRepo === headRepo ? probe : memoizedIdentity(createForge(derived, baseRepo, runner), scope, credential.data),
     remote: pushed.remote,
     url: pushed.url,
     derived,
     workspace: workspace?.name ?? null,
     expectedAccount,
-    credential,
+    credential: credential.data.credential,
     headRepo,
     headProjectId,
     fork: baseRepo !== headRepo,
@@ -73360,14 +73687,74 @@ function checkIdentity(resolved) {
   const identity = forge.identity(expectedAccount);
   if (!identity.ok)
     return identity;
-  if (identity.data.matches === false) {
-    const bin = forge.kind === "github" ? "gh" : "glab";
-    const where = `workspace ${resolved.workspace ?? "?"}`;
-    return failure3("blocked", `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${identity.data.login} but ${where} expects ${expectedAccount}`, resolved.credential === "workspace_token_file" ? `put a token for ${expectedAccount} in the ${where} vcs.tokenFile` : `${bin} auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`);
-  }
+  if (identity.data.matches === false)
+    return mismatch(resolved, identity.data.login ?? "?", resolved.workspace);
   return identity;
 }
-var configuredHosts = () => {
+function checkPushIdentity(cwd, options = {}) {
+  let workspace;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
+    return failure3("blocked", error instanceof Error ? error.message : String(error), "fix ~/.config/workit/workspaces.json (workit init → Workspaces)");
+  }
+  const account = workspace?.vcs?.account ?? null;
+  const skipped = (forge, reason, unblock) => success2({
+    status: "skipped",
+    forge,
+    account,
+    login: null,
+    reason,
+    ...unblock ? { unblock } : {}
+  });
+  const pushed = pushForge(cwd, {
+    branch: options.branch,
+    hosts: configuredHosts(),
+    sshConfig: options.sshConfig
+  });
+  if (!pushed.ok) {
+    const host = /^unsupported_forge: .*?"([^"]+)"/u.exec(pushed.error)?.[1];
+    const what = /could not resolve ssh alias/u.test(pushed.error) ? `could not resolve ssh alias ${host} to GitHub or GitLab` : pushed.error.startsWith("unsupported_forge: ssh host") ? `ssh host ${host} is not a GitHub/GitLab host or an alias workit can resolve` : `${host} is not a GitHub or GitLab host workit knows`;
+    return skipped(null, host ? `unsupported_forge: ${what}; account checks skipped, pushed with git only (no PR or CI verbs)` : pushed.error, pushed.unblock);
+  }
+  const derived = pushed.forge;
+  const conflict = forgeConflict(derived, workspace?.vcs?.provider);
+  if (conflict)
+    return skipped(derived.kind, conflict.error, conflict.unblock);
+  if (!account)
+    return success2({ status: "no_account", forge: derived.kind, account, login: null });
+  const base = options.runner ?? systemRunner(derived.kind, derived.apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const limits = { deadline: now() + (options.budgetMs ?? PUSH_IDENTITY_BUDGET_MS) };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  if (!credential.ok)
+    return unreachable(credential) ? skipped(derived.kind, credential.error, credential.unblock) : credential;
+  const forge = memoizedIdentity(createForge(derived, derived.repo, clampedRunner(base, limits, now, credential.data.token)), scope, credential.data);
+  const identity = forge.identity(account);
+  if (!identity.ok)
+    return unreachable(identity) ? skipped(derived.kind, identity.error, identity.unblock) : identity;
+  if (identity.data.matches === false)
+    return mismatch({ forge, credential: credential.data.credential, expectedAccount: account }, identity.data.login ?? "?", workspace?.name ?? null);
+  if (identity.data.matches === null)
+    return skipped(derived.kind, identity.data.note ?? "the credential cannot read /user");
+  return success2({ status: "verified", forge: derived.kind, account, login: identity.data.login });
+}
+var MEMO_TTL_MS, SYSTEM_SCOPE, memoScopes, memoScope = (runner, env) => ({
+  owner: runner ?? SYSTEM_SCOPE,
+  key: [env.GH_CONFIG_DIR, env.GLAB_CONFIG_DIR, env.XDG_CONFIG_HOME, env.HOME].map((value) => value ?? "").join("|")
+}), memoizedIdentity = (forge, scope, credential) => {
+  if (credential.credential === "cli_login")
+    return forge;
+  const identity = (expected) => forge.identity(expected);
+  return {
+    ...forge,
+    identity: (expected) => memo4(scope, `identity ${forge.kind} ${forge.apiHost} ${credential.credential} ${credential.token ?? ""} ${expected ?? ""}`, () => {
+      const value = identity(expected);
+      return { keep: value.ok, value };
+    })
+  };
+}, configuredHosts = () => {
   const vcs = readVcsConfig();
   if (vcs.status !== "valid")
     return {};
@@ -73376,7 +73763,13 @@ var configuredHosts = () => {
     return typeof value === "string" && value.trim() ? [value.trim()] : [];
   };
   return { github: host("github"), gitlab: host("gitlab") };
-}, createForge = (derived, repo, runner) => derived.kind === "github" ? createGitHubForge({ apiHost: derived.apiHost, repo, runner }) : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+}, createForge = (derived, repo, runner) => derived.kind === "github" ? createGitHubForge({ apiHost: derived.apiHost, repo, runner }) : createGitLabForge({ apiHost: derived.apiHost, repo, runner }), mismatch = (resolved, login, workspace) => {
+  const { forge, expectedAccount } = resolved;
+  const bin = forge.kind === "github" ? "gh" : "glab";
+  const where = `workspace ${workspace ?? "?"}`;
+  const fileFix = `put a token for ${expectedAccount} in the ${where} vcs.tokenFile`;
+  return failure3("blocked", `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${login} but ${where} expects ${expectedAccount}`, resolved.credential === "workspace_token_file" ? fileFix : forge.kind === "github" ? `gh auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}` : `${fileFix} (glab keeps one login per host, so workit never switches it)`);
+}, unreachable = (result) => result.code === "unavailable" && !/ is not authenticated for /u.test(result.error), PUSH_IDENTITY_BUDGET_MS = 5000;
 var init_resolve = __esm(() => {
   init_vcs_config();
   init_workspaces();
@@ -73384,6 +73777,10 @@ var init_resolve = __esm(() => {
   init_exec();
   init_github();
   init_gitlab();
+  init_redact();
+  MEMO_TTL_MS = 5 * 60000;
+  SYSTEM_SCOPE = {};
+  memoScopes = new WeakMap;
 });
 
 // packages/workit-core/src/duration.ts
@@ -73476,16 +73873,19 @@ function releaseTrunk(io, track, branch) {
     tracked: Boolean(resolved.releaseTrack)
   };
 }
-function connect(io, branch) {
+function connect(io, branch, options = {}) {
+  const verbDeadline = options.deadline ?? null;
   const resolved = resolveForge(io.cwd, {
     branch,
     env: io.env,
     runner: forgeDeps.runner,
-    now: forgeDeps.now
+    now: forgeDeps.now,
+    deadline: verbDeadline ?? forgeDeps.now() + CONNECT_BUDGET_MS
   });
   if (!resolved.ok)
     return resolved;
   const identity = checkIdentity(resolved.data);
+  resolved.data.limits.deadline = verbDeadline;
   if (!identity.ok)
     return identity;
   return {
@@ -73540,7 +73940,12 @@ function renderStatus(doc) {
   lines.push(`next: ${doc.next}`);
   return lines;
 }
-var forgeDeps, MAX_REASON = 500, usage3 = (io, message, line) => emit(io, fail("invalid_input", message, { unblock: line })), forgeFail = (io, result, data) => emit(io, fail(result.code, result.error, { data, unblock: result.unblock })), short = (sha) => sha ? sha.slice(0, 7) : "?";
+var forgeDeps, MAX_REASON = 500, usage3 = (io, message, line) => emit(io, fail("invalid_input", message, { unblock: line })), forgeFail = (io, result, data) => emit(io, fail(result.code, result.error, { data, unblock: result.unblock })), CONNECT_BUDGET_MS = 15000, pushIdentity = (io, branch) => checkPushIdentity(io.cwd, {
+  branch,
+  env: io.env,
+  runner: forgeDeps.runner,
+  now: forgeDeps.now
+}), short = (sha) => sha ? sha.slice(0, 7) : "?";
 var init_forge_common = __esm(() => {
   init_resolve();
   init_vcs_config();
@@ -73559,8 +73964,8 @@ var exports_pr = {};
 __export(exports_pr, {
   run: () => run10
 });
-import { readFileSync as readFileSync18 } from "node:fs";
-import path41 from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import path42 from "node:path";
 async function status(argv, io) {
   const flags = parseFlags(argv, { pr: "value", branch: "value", "log-lines": "value" });
   if (typeof flags === "string")
@@ -73631,7 +74036,7 @@ async function create4(argv, io) {
   let body = flags.values.body ?? null;
   if (flags.values["body-file"] !== undefined) {
     try {
-      body = readFileSync18(path41.resolve(io.cwd, flags.values["body-file"]), "utf8");
+      body = readFileSync19(path42.resolve(io.cwd, flags.values["body-file"]), "utf8");
     } catch {
       return usage3(io, `cannot read --body-file ${flags.values["body-file"]}`, CREATE_USAGE);
     }
@@ -73790,16 +74195,17 @@ async function wait(argv, io) {
   const head = flags.values.head ?? null;
   if (head !== null && !/^[0-9a-f]{7,64}$/u.test(head))
     return usage3(io, "--head must be a commit sha (7-64 hex chars)", WAIT_USAGE);
-  const connected = connect(io, flags.values.branch);
+  const started = forgeDeps.now();
+  const deadline = started + timeoutMs;
+  const connected = connect(io, flags.values.branch, {
+    deadline: started + Math.max(timeoutMs, ONE_POLL_MS)
+  });
   if (!connected.ok)
     return forgeFail(io, connected);
   const resolved = connected.data;
   const number = selectPr(io.cwd, resolved, { pr, branch: flags.values.branch ?? null });
   if (!number.ok)
     return forgeFail(io, number);
-  const started = forgeDeps.now();
-  const deadline = started + timeoutMs;
-  resolved.limits.deadline = started + Math.max(timeoutMs, ONE_POLL_MS);
   let polls = 0;
   let errors = 0;
   let status = null;
@@ -73976,6 +74382,8 @@ var exports_git = {};
 __export(exports_git, {
   run: () => run12
 });
+import { readFileSync as readFileSync20 } from "node:fs";
+import path43 from "node:path";
 async function branch(argv, io) {
   const flags = parseFlags(argv, {
     base: "value",
@@ -74012,7 +74420,15 @@ async function branch(argv, io) {
   ]);
 }
 function parseCommit(argv) {
-  const out = { messages: [], all: false, paths: [] };
+  const out = {
+    messages: [],
+    files: [],
+    all: false,
+    amend: false,
+    noEdit: false,
+    allowEmpty: false,
+    paths: []
+  };
   for (let index = 0;index < argv.length; index += 1) {
     const arg = argv[index];
     if (arg === "--") {
@@ -74021,23 +74437,24 @@ function parseCommit(argv) {
     }
     if (arg === "--json")
       continue;
-    if (arg === "-a" || arg === "--all") {
-      out.all = true;
-      continue;
-    }
-    if (arg === "-m" || arg === "--message") {
-      const value = argv[++index];
-      if (value === undefined)
-        return `${arg} requires a message`;
-      out.messages.push(value);
-      continue;
-    }
-    if (arg.startsWith("--message=")) {
-      out.messages.push(arg.slice("--message=".length));
+    const flag = COMMIT_SWITCHES[arg];
+    if (flag) {
+      out[flag] = true;
       continue;
     }
-    if (arg.startsWith("-m") && arg.length > 2) {
-      out.messages.push(arg.slice(2));
+    const valued = [
+      ["-m", "--message", out.messages],
+      ["-F", "--file", out.files]
+    ].find(([shortName, longName]) => arg === shortName || arg === longName || arg.startsWith(`${longName}=`) || arg.startsWith(shortName) && arg.length > 2);
+    if (valued) {
+      const [shortName, longName, into] = valued;
+      if (arg === shortName || arg === longName) {
+        const value = argv[++index];
+        if (value === undefined)
+          return `${arg} requires a ${shortName === "-m" ? "message" : "file"}`;
+        into.push(value);
+      } else
+        into.push(arg.startsWith(`${longName}=`) ? arg.slice(longName.length + 1) : arg.slice(2));
       continue;
     }
     if (arg.startsWith("-"))
@@ -74046,20 +74463,48 @@ function parseCommit(argv) {
   }
   return out;
 }
+function commitMessage(parsed, io) {
+  if (parsed.messages.length && parsed.files.length)
+    return { error: "pass -m or -F, not both" };
+  if (parsed.files.length > 1)
+    return { error: "-F takes one file" };
+  const [file] = parsed.files;
+  if (file === undefined)
+    return parsed.messages.join(`
+
+`);
+  try {
+    return file === "-" ? readFileSync20(0, "utf8") : readFileSync20(path43.resolve(io.cwd, file), "utf8");
+  } catch (error) {
+    return {
+      error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
 async function commit(argv, io) {
   const parsed = parseCommit(argv);
   if (typeof parsed === "string")
     return usage3(io, parsed, COMMIT_USAGE);
-  if (!parsed.messages.length)
-    return usage3(io, "missing -m <msg>", COMMIT_USAGE);
   if (parsed.all && parsed.paths.length)
     return usage3(io, "pass --all or paths, not both", COMMIT_USAGE);
+  if (parsed.noEdit && !parsed.amend)
+    return usage3(io, "--no-edit only applies with --amend", COMMIT_USAGE);
+  const given = parsed.messages.length + parsed.files.length > 0;
+  if (parsed.noEdit && given)
+    return usage3(io, "--no-edit keeps the message; drop -m/-F or --no-edit", COMMIT_USAGE);
+  if (!given && !parsed.noEdit)
+    return usage3(io, parsed.amend ? "--amend needs -m/-F or --no-edit" : "missing -m <msg> or -F <file>", COMMIT_USAGE);
+  const message = given ? commitMessage(parsed, io) : null;
+  if (message !== null && typeof message !== "string")
+    return usage3(io, message.error, COMMIT_USAGE);
+  if (message !== null && !message.trim())
+    return usage3(io, "the commit message is empty", COMMIT_USAGE);
   const result = gitCommit(io.cwd, {
-    message: parsed.messages.join(`
-
-`),
+    message,
     all: parsed.all,
     paths: parsed.paths,
+    amend: parsed.amend,
+    allowEmpty: parsed.allowEmpty,
     actor: actorFromEnv(io.env),
     env: io.env
   });
@@ -74068,8 +74513,9 @@ async function commit(argv, io) {
   await ensureImplicitTask(io);
   return emit(io, ok(result.data), (data) => [
     `${data.branch} ${short2(data.sha)} ${data.message.split(`
-`, 1)[0]} (${data.files.length} file${data.files.length === 1 ? "" : "s"})`,
+`, 1)[0]} (${data.files.length ? `${data.files.length} file${data.files.length === 1 ? "" : "s"}` : "empty commit"})${data.amended ? `, amends ${short2(data.amended)}` : ""}`,
     ...data.leftDirty ? [`${data.leftDirty} change(s) left uncommitted`] : [],
+    ...data.notes.map((note) => `note: ${note}`),
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : [],
     ...data.session ? [] : ["note: WORKIT_SESSION_ID is unset; this commit has no session author"]
   ]);
@@ -74096,24 +74542,37 @@ async function push(argv, io) {
   const plan = pushPreflight(io.cwd);
   if (!plan.ok)
     return forgeFail(io, plan);
-  if (!plan.data.local) {
-    const connected = connect(io, plan.data.branch);
-    if (!connected.ok)
-      return forgeFail(io, connected);
-  }
-  const grant = requireGrant(io.cwd, "push", { forge: !plan.data.local });
+  const identity = plan.data.local ? null : pushIdentity(io, plan.data.branch);
+  if (identity && !identity.ok)
+    return forgeFail(io, identity);
+  const checked = identity?.data ?? null;
+  const grant = requireGrant(io.cwd, "push", { forge: checked?.forge != null });
   if (!grant.allowed)
-    return emit(io, fail("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } }));
+    return emit(io, fail("blocked", grant.error, {
+      unblock: grant.unblock,
+      data: { reason: grant.reason }
+    }));
   const result = executePush(io.cwd, plan.data, {
     forceWithLease: flags.booleans.has("force-with-lease"),
     overwriteUnintegrated: flags.booleans.has("overwrite-unintegrated"),
     expect,
     setUpstream: flags.booleans.has("set-upstream"),
-    actor: actorFromEnv(io.env)
+    actor: actorFromEnv(io.env),
+    ...checked ? { identity: { ...checked } } : {}
   });
   if (!result.ok)
-    return forgeFail(io, result, { branch: plan.data.branch, sha: plan.data.sha });
-  return emit(io, ok(result.data), (data) => [
+    return forgeFail(io, result, {
+      branch: plan.data.branch,
+      sha: plan.data.sha
+    });
+  const warnings = checked?.status === "skipped" ? [
+    `identity check skipped: ${checked.reason}${checked.unblock ? ` (to restore it: ${checked.unblock})` : ""}`
+  ] : [];
+  for (const warning of warnings)
+    io.stderr(`warning: ${warning}
+`);
+  const envelope = ok({ ...result.data, identity: checked });
+  return emit(io, warnings.length ? { ...envelope, warnings } : envelope, (data) => [
     data.pushed ? `pushed ${data.branch} ${short2(data.previous)} -> ${short2(data.sha)} to ${data.remote}${data.forced ? " (force-with-lease)" : ""}; remote tip verified` : `${data.remote}/${data.branch} is already at ${short2(data.sha)}; remote tip verified`,
     ...data.upstream ? [`upstream: ${data.remote}/${data.branch}`] : []
   ]);
@@ -74128,7 +74587,7 @@ async function run12(argv, io) {
     return push(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE5);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m <msg> [--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)";
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
 var init_git2 = __esm(() => {
   init_autonomy();
   init_ops();
@@ -74136,10 +74595,17 @@ var init_git2 = __esm(() => {
   init_implicit_task();
   init_output();
   init_forge_common();
+  COMMIT_SWITCHES = {
+    "-a": "all",
+    "--all": "all",
+    "--amend": "amend",
+    "--no-edit": "noEdit",
+    "--allow-empty": "allowEmpty"
+  };
 });
 
 // packages/workit-core/src/forge/verify.ts
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
   const out = { ...report, delivered };
@@ -74352,7 +74818,7 @@ var NPM_NAME, SEMVER, SAFE_ARG, systemNpm = (args) => {
   };
   const found = process.platform === "win32" ? findExecutable("npm.cmd", process.env) : null;
   const npmCmd = found && !/["%!^]/u.test(found) ? `"${found}"` : "npm.cmd";
-  const result = process.platform === "win32" ? spawnSync19(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync19("npm", [...args], options);
+  const result = process.platform === "win32" ? spawnSync20(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync20("npm", [...args], options);
   return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }, short3 = (sha) => sha ? sha.slice(0, 12) : "(absent)", npmView = (stdout) => {
   try {
@@ -74459,10 +74925,10 @@ var init_verify_delivery = __esm(() => {
 });
 
 // packages/workit-core/src/stack.ts
-import { spawnSync as spawnSync20 } from "node:child_process";
+import { spawnSync as spawnSync21 } from "node:child_process";
 import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
 import fs22 from "node:fs";
-import path42 from "node:path";
+import path44 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -74506,7 +74972,7 @@ function gitRestack(cwd, input) {
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
     fs22.mkdirSync(scratch, { recursive: true });
-    dir = path42.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -74547,7 +75013,7 @@ function pruneScratch(cwd) {
   if (!scratch || !fs22.existsSync(scratch))
     return;
   for (const name of fs22.readdirSync(scratch)) {
-    const dir = path42.join(scratch, name);
+    const dir = path44.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -74557,7 +75023,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path42.join(root.value.root, "stacks") };
+  return { ok: true, data: path44.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
   if (!isRecord7(raw) || !Array.isArray(raw.branches))
@@ -74609,7 +75075,7 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path42.join(dir.data, fileFor(name));
+  const file = path44.join(dir.data, fileFor(name));
   let text;
   try {
     text = fs22.readFileSync(file, "utf8");
@@ -74630,7 +75096,7 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path42.join(dir.data, fileFor(stack.name));
+  const file = path44.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs22.mkdirSync(dir.data, { recursive: true });
@@ -74658,7 +75124,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs22.readFileSync(path42.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs22.readFileSync(path44.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -74717,7 +75183,7 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes3(8).toString("hex")
   };
-  fs22.writeFileSync(path42.join(lock, OWNER), JSON.stringify(owner));
+  fs22.writeFileSync(path44.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
@@ -74754,7 +75220,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path42.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path44.join(dir.data, `${fileFor(name)}.lock`);
   try {
     fs22.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
@@ -74784,7 +75250,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs22.utimesSync(path42.join(lock, OWNER), now, now);
+      fs22.utimesSync(path44.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -74972,7 +75438,7 @@ function commitKeys(cwd, range) {
   const patches = new Map;
   const diff = gitRun3(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
   if (diff.ok && diff.stdout.trim()) {
-    const ids = spawnSync20("git", ["patch-id", "--stable"], {
+    const ids = spawnSync21("git", ["patch-id", "--stable"], {
       cwd,
       input: diff.stdout,
       encoding: "utf8",
@@ -75596,7 +76062,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
 }), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync20("git", args, {
+  const run = spawnSync21("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -75624,7 +76090,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path42.join(dir.data, "worktrees") : null;
+  return dir.ok ? path44.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
@@ -75639,12 +76105,12 @@ ${run.stdout}`.split(`
 }, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs22.readFileSync(path42.join(lock, OWNER), "utf8");
+    raw = fs22.readFileSync(path44.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path42.join(lock, OWNER), lock])
+  for (const target of [path44.join(lock, OWNER), lock])
     try {
       age = Date.now() - fs22.statSync(target).mtimeMs;
       break;
@@ -75891,10 +76357,10 @@ var init_stack2 = __esm(() => {
 });
 
 // packages/workit-core/src/fanout.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
 import fs23 from "node:fs";
-import path43 from "node:path";
+import path45 from "node:path";
 function expandBraces(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -76128,7 +76594,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path43.resolve(defaults.root, optional("worktree") ?? path43.join(defaults.worktreeRoot, id)),
+      worktree: path45.resolve(defaults.root, optional("worktree") ?? path45.join(defaults.worktreeRoot, id)),
       tier,
       dependsOn: [...new Set(dependsOn ?? [])],
       scope,
@@ -76357,11 +76823,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path43.basename(common) === ".git" ? path43.dirname(common) : path43.resolve(cwd);
+  return common && path45.basename(common) === ".git" ? path45.dirname(common) : path45.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path43.join(path43.dirname(main), `${path43.basename(main)}-wt`);
+  return path45.join(path45.dirname(main), `${path45.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -76379,7 +76845,7 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path43.join(root.value.root, "fanouts") };
+  return { ok: true, data: path45.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord8(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -76445,7 +76911,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, stackFileName(name));
+  const file = path45.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs23.readFileSync(file, "utf8")));
@@ -76470,7 +76936,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs23.readFileSync(path43.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs23.readFileSync(path45.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -76500,7 +76966,7 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, stackFileName(plan.name));
+  const file = path45.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs23.mkdirSync(dir.data, { recursive: true });
@@ -76664,7 +77130,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
     text: edges.map((edge) => `add "${edge.dependsOn}" to "dependsOn" of slice ${edge.slice}`).join("; ")
   };
 }, gitRun4 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync21("git", args, {
+  const run = spawnSync22("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -76704,7 +77170,7 @@ var init_fanout = __esm(() => {
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import fs24 from "node:fs";
-import path44 from "node:path";
+import path46 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -76764,7 +77230,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs24.readFileSync(path44.join(file, TOKEN_FILE), "utf8").trim() || null;
+    token = fs24.readFileSync(path46.join(file, TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -76772,7 +77238,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path44.basename(file),
+      id: path46.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -76788,7 +77254,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes4(16).toString("hex");
   try {
-    fs24.writeFileSync(path44.join(admin.path, TOKEN_FILE), `${token}
+    fs24.writeFileSync(path46.join(admin.path, TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -76803,7 +77269,7 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path44.join(common, "info", "exclude");
+  const file = path46.join(common, "info", "exclude");
   let text = "";
   try {
     text = fs24.readFileSync(file, "utf8");
@@ -76812,7 +77278,7 @@ function excludeScratch(cwd) {
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs24.mkdirSync(path44.dirname(file), { recursive: true });
+  fs24.mkdirSync(path46.dirname(file), { recursive: true });
   fs24.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
@@ -76820,7 +77286,7 @@ ${EXCLUDE_LINE}
 `);
 }
 function ensureScratch(worktree) {
-  const scratch = path44.join(worktree, SCRATCH_DIR);
+  const scratch = path46.join(worktree, SCRATCH_DIR);
   fs24.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
@@ -77038,7 +77504,7 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path44.join(worktree, SCRATCH_DIR);
+  const scratch = path46.join(worktree, SCRATCH_DIR);
   let stat;
   try {
     stat = fs24.lstatSync(scratch);
@@ -77054,16 +77520,16 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
   try {
     return fs24.realpathSync.native(target);
   } catch {
-    return path44.resolve(target);
+    return path46.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside2 = (child, parent) => {
-  const relative = path44.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path44.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path44.isAbsolute(slice.worktree) ? slice.worktree : path44.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
+  const relative = path46.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path46.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path46.isAbsolute(slice.worktree) ? slice.worktree : path46.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
 `)[0] || "unknown error"}`);
 var init_fanout_worktree = __esm(() => {
   init_ops();
@@ -77184,7 +77650,7 @@ var init_fanout_brief = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-landed.ts
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
     return { forge: null, down: () => null };
@@ -77275,7 +77741,7 @@ function trunkPatchIds(ctx, fork) {
     "--"
   ]);
   if (log.ok && log.stdout.trim()) {
-    const run = spawnSync22("git", ["patch-id", "--stable"], {
+    const run = spawnSync23("git", ["patch-id", "--stable"], {
       cwd: ctx.cwd,
       input: log.stdout,
       encoding: "utf8",
@@ -77839,7 +78305,7 @@ __export(exports_fanout, {
   run: () => run15
 });
 import fs25 from "node:fs";
-import path45 from "node:path";
+import path47 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -77900,7 +78366,7 @@ function plan2(argv, io) {
     return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path45.resolve(io.cwd, flags.positionals[0]);
+  const file = path47.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
     raw = JSON.parse(fs25.readFileSync(file, "utf8"));
@@ -93332,7 +93798,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path46 from "node:path";
+import path48 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -93825,12 +94291,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path46.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path48.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path46.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path48.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -94218,11 +94684,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
-import { existsSync as existsSync18, readdirSync as readdirSync8, readFileSync as readFileSync19, statSync as statSync7 } from "node:fs";
-import path47 from "node:path";
+import { spawnSync as spawnSync24 } from "node:child_process";
+import { existsSync as existsSync19, readdirSync as readdirSync8, readFileSync as readFileSync21, statSync as statSync7 } from "node:fs";
+import path49 from "node:path";
 function git6(cwd, args) {
-  const run = spawnSync23("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync24("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -94233,7 +94699,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync8(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path47.join(dir, entry.name);
+    const full = path49.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -94245,8 +94711,8 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path47.resolve(cwd, input);
-    if (!existsSync18(full))
+    const full = path49.resolve(cwd, input);
+    if (!existsSync19(full))
       missing.push(input);
     else if (statSync7(full).isDirectory())
       walkTests(full, files);
@@ -94282,11 +94748,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path47.join(root, file), lines);
+    changed.set(path49.join(root, file), lines);
   }
   const untracked = git6(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path47.join(root, file), "all");
+    changed.set(path49.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -94299,7 +94765,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync19(file, "utf8"), file);
+      parsed = parseSource(readFileSync21(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -94348,7 +94814,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path47.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path49.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -94362,12 +94828,12 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   lstatSync as lstatSync7,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync9,
-  readFileSync as readFileSync20,
+  readFileSync as readFileSync22,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
   renameSync as renameSync5,
@@ -94378,7 +94844,7 @@ import {
   copyFileSync as copyFileSync6
 } from "node:fs";
 import os14 from "node:os";
-import path48 from "node:path";
+import path50 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -94451,7 +94917,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path48.posix.join(path48.posix.dirname(file), spec)) === target)
+        if (stripExt(path50.posix.join(path50.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -94471,12 +94937,12 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path48.join(tmp, name);
+    const dir = path50.join(tmp, name);
     try {
       const stat = lstatSync7(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync20(path48.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync22(path50.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -94493,8 +94959,8 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync9(target, { recursive: true });
   for (const entry of readdirSync9(origin, { withFileTypes: true })) {
-    const from = path48.join(origin, entry.name);
-    const to = path48.join(target, entry.name);
+    const from = path50.join(origin, entry.name);
+    const to = path50.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -94510,9 +94976,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path48.relative(repo, real);
-      if (!relative.startsWith("..") && !path48.isAbsolute(relative) && !relative.split(path48.sep).includes("node_modules")) {
-        symlinkSync(path48.join(copy, relative), to, "junction");
+      const relative = path50.relative(repo, real);
+      if (!relative.startsWith("..") && !path50.isAbsolute(relative) && !relative.split(path50.sep).includes("node_modules")) {
+        symlinkSync(path50.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -94528,7 +94994,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync9(repo);
   if (real && inside3(realRepo, real)) {
-    symlinkSync(path48.relative(path48.dirname(to), path48.join(tree, path48.relative(realRepo, real))), to);
+    symlinkSync(path50.relative(path50.dirname(to), path50.join(tree, path50.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync8(real).isFile())
@@ -94537,10 +95003,10 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path48.join(copy, file);
+  const target = path50.join(copy, file);
   try {
     const stat = lstatSync7(target);
-    if (!stat.isFile() || !inside3(realpathSync9(copy), realpathSync9(path48.dirname(target))))
+    if (!stat.isFile() || !inside3(realpathSync9(copy), realpathSync9(path50.dirname(target))))
       return false;
   } catch {
     return false;
@@ -94551,9 +95017,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path48.join(os14.tmpdir(), TEMP_PREFIX));
-  writeFileSync10(path48.join(dir, PID_FILE), String(process.pid));
-  const tree = path48.join(dir, "tree");
+  const dir = mkdtempSync4(path50.join(os14.tmpdir(), TEMP_PREFIX));
+  writeFileSync10(path50.join(dir, PID_FILE), String(process.pid));
+  const tree = path50.join(dir, "tree");
   const head = git6(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git6(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git6(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -94570,29 +95036,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path48.join(repo, relative);
+    const from = path50.join(repo, relative);
     let stat;
     try {
       stat = lstatSync7(from);
     } catch {
       continue;
     }
-    const to = path48.join(tree, relative);
-    mkdirSync9(path48.dirname(to), { recursive: true });
+    const to = path50.join(tree, relative);
+    mkdirSync9(path50.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync6(from, to);
-    let parent = path48.dirname(relative);
+    let parent = path50.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path48.dirname(parent);
+      parent = path50.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path48.join(repo, parent, "node_modules");
-    if (existsSync19(modules) && !existsSync19(path48.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path48.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path50.join(repo, parent, "node_modules");
+    if (existsSync20(modules) && !existsSync20(path50.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path50.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -94631,20 +95097,20 @@ async function runMutation(options) {
   const tracked = git6(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync20(path48.join(repo, file), "utf8") };
+      return { file, text: readFileSync22(path50.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path48.relative(repo, absolute));
+    const relative = toPosix(path50.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync19(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync20(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync20(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync22(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -94652,9 +95118,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path48.relative(repo, options.cwd);
+  const cwdRelative = path50.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path48.relative(cwdRelative, file));
+    const relative = toPosix(path50.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -94689,7 +95155,7 @@ async function runMutation(options) {
     return finish2(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path48.join(copy, cwdRelative);
+  const copyCwd = path50.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -94724,7 +95190,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync20(path48.join(copy, mutant.file), "utf8");
+      const original = readFileSync22(path50.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -94781,8 +95247,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside3 = (root, file) => {
-  const relative = path48.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path48.isAbsolute(relative);
+  const relative = path50.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path50.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -94830,8 +95296,8 @@ var exports_test_audit = {};
 __export(exports_test_audit, {
   run: () => run17
 });
-import { existsSync as existsSync20 } from "node:fs";
-import path49 from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import path51 from "node:path";
 function parse7(argv) {
   const options = {
     paths: [],
@@ -94935,8 +95401,8 @@ async function run17(argv, io) {
     return emit(io, fail("invalid_input", `${options}
 usage: ${USAGE10}`));
   const top = git6(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path49.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path49.relative(io.cwd, file) || file);
+  const repo = top.ok ? path51.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path51.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -94953,7 +95419,7 @@ usage: ${USAGE10}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync20(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync21(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -95178,8 +95644,8 @@ var exports_youtrack = {};
 __export(exports_youtrack, {
   run: () => run19
 });
-import { readFileSync as readFileSync21 } from "node:fs";
-import path50 from "node:path";
+import { readFileSync as readFileSync23 } from "node:fs";
+import path52 from "node:path";
 async function run19(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -95225,7 +95691,7 @@ async function run19(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync21(path50.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync23(path52.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE12);
       }
@@ -95293,8 +95759,8 @@ var exports_changelog = {};
 __export(exports_changelog, {
   run: () => run20
 });
-import { readFileSync as readFileSync22 } from "node:fs";
-import path51 from "node:path";
+import { readFileSync as readFileSync24 } from "node:fs";
+import path53 from "node:path";
 async function run20(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -95340,7 +95806,7 @@ async function run20(argv, io) {
   ]);
 }
 var USAGE13 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync22(0, "utf8") : raw.startsWith("@") ? readFileSync22(path51.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync24(0, "utf8") : raw.startsWith("@") ? readFileSync24(path53.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -95436,7 +95902,7 @@ var init_handoff = __esm(() => {
 
 // packages/workit-cli/src/main.ts
 init_package();
-import path52 from "node:path";
+import path54 from "node:path";
 
 // packages/workit-cli/src/help.ts
 var HELP_FLAGS = new Set(["--help", "-h"]);
@@ -95764,8 +96230,8 @@ var VERBS = [
       },
       {
         name: "commit",
-        usage: "workit git commit -m|--message <msg>… [-a|--all | [--] <paths…>]",
-        summary: "Commit with a linted Conventional Commit message and the session trailer"
+        usage: "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>]",
+        summary: "Commit (or --amend) with a linted Conventional Commit message and the session trailer"
       },
       {
         name: "push",
@@ -95776,6 +96242,7 @@ var VERBS = [
     examples: [
       "workit git branch --kind feature --slug help-everywhere",
       'workit git commit -m "fix(cli): answer help flags first" --all',
+      "workit git commit --amend --no-edit -- src/forgotten.ts",
       "workit git push --set-upstream"
     ],
     load: () => Promise.resolve().then(() => (init_git2(), exports_git))
@@ -96056,7 +96523,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path52.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path54.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail("invalid_input", parsed.error));
@@ -96114,9 +96581,21 @@ async function main(argv, overrides = {}, options = {}) {
   globalThis[Symbol.for("workit.migrationReporter")] = (report) => io.stderr(`workit: migrated ${report.tasks} task${report.tasks === 1 ? "" : "s"} from ${report.from} to ${report.to} (backup: ${report.backup})
 `);
   const verb = await entry.load();
+  const runVerb = (target) => guarded(target, () => verb.run(ended, target));
   if (!io.json)
-    return verb.run(ended, io);
-  return runJsonPure(io, command, (pure) => verb.run(ended, pure));
+    return runVerb(io);
+  return runJsonPure(io, command, runVerb);
+}
+async function guarded(io, run) {
+  try {
+    return await run();
+  } catch (error) {
+    if (!(error instanceof Error) || error.name !== "WorkspaceConfigError")
+      throw error;
+    return emit(io, fail("blocked", error.message, {
+      unblock: "fix ~/.config/workit/workspaces.json (workit init → Workspaces)"
+    }));
+  }
 }
 var CODE_FOR_EXIT = {
   1: "failed",