@brainervirus/workit-claude-code 8.1.0 → 8.2.0

package/dist/workit.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.1.0",
+    version: "8.2.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.1.0",
-      "@brainervirus/workit-cursor": "^8.1.0",
-      "@brainervirus/workit-opencode": "^8.1.0",
+      "@brainervirus/workit-core": "^8.2.0",
+      "@brainervirus/workit-cursor": "^8.2.0",
+      "@brainervirus/workit-opencode": "^8.2.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -12831,12 +12831,13 @@ function pushForge(cwd, options = {}) {
     };
   const forge = deriveForge(url, options);
   if (!forge) {
-    const host = parseRemoteUrl(url)?.host || null;
+    const parsed = parseRemoteUrl(url);
+    const host = parsed?.host || null;
     return {
       ok: false,
       code: "unavailable",
-      error: host ? `cannot tell whether push host "${host}" is GitHub or GitLab` : `push URL ${redactRemote(url)} of remote "${remote}" is not a GitHub/GitLab URL`,
-      unblock: host ? `map the alias in ~/.ssh/config (Host ${host} / HostName github.com|gitlab.com) or set github.host / gitlab.host in ~/.config/workit/vcs.json` : `git remote set-url --push ${remote} <ssh-or-https-url>`
+      error: host ? parsed?.protocol === "ssh" && !host.includes(".") ? `unsupported_forge: could not resolve ssh alias "${host}" to GitHub or GitLab; PR and CI verbs need one (workit git push still pushes with git)` : parsed?.protocol === "ssh" ? `unsupported_forge: ssh host "${host}" is not a GitHub/GitLab host or an alias workit can resolve; PR and CI verbs need one (workit git push still pushes with git)` : `unsupported_forge: cannot tell whether push host "${host}" is GitHub or GitLab; PR and CI verbs need one (workit git push still pushes with git)` : `push URL ${redactRemote(url)} of remote "${remote}" is not a GitHub/GitLab URL`,
+      unblock: host ? `if ${host} is an ssh alias of GitHub/GitLab, add "Host ${host}" with "HostName github.com" (or gitlab.com) to ~/.ssh/config; if it is a self-hosted GitHub/GitLab, set github.host or gitlab.host in ~/.config/workit/vcs.json; other forges (Bitbucket, Gitea…) have no PR/CI verbs` : `git remote set-url --push ${remote} <ssh-or-https-url>`
     };
   }
   return { ok: true, remote, url: redactRemote(url), forge };
@@ -12847,8 +12848,8 @@ function forgeConflict(derived, configuredProvider) {
     return null;
   return {
     code: "blocked",
-    error: `forge_mismatch: push remote ${derived.host} is ${derived.kind} but the workspace vcs.provider is ${configured}`,
-    unblock: `set vcs.provider to "${derived.kind}" for this repo in ~/.config/workit/workspaces.json (workit-github-override), or push to a ${configured} remote`
+    error: `forge_mismatch: push remote ${derived.host} is ${derived.kind} but the workspace vcs.provider is ${configured}, so its account and grants do not apply; PR and CI verbs stop here (workit git push still pushes with git)`,
+    unblock: `add a workspace whose glob matches only this repo, with "vcs": {"provider": "${derived.kind}"} (and its account), to ~/.config/workit/workspaces.json; the most specific glob wins`
   };
 }
 var MAX_BUFFER, GIT_TIMEOUTS, git2 = (cwd, args, options = {}) => {
@@ -15235,6 +15236,7 @@ var init_commit_flavors = __esm(() => {
 var init_git = () => {};
 
 // packages/workit-core/src/core/workspaces.ts
+import { spawnSync as spawnSync8 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
 import { readFileSync as readFileSync4, realpathSync as realpathSync3 } from "node:fs";
 import path14 from "node:path";
@@ -15362,6 +15364,46 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     };
   }
   return { ok: true };
+}, WorkspaceConfigError, mainCheckouts, mainCheckoutOf = (cwd) => {
+  const cached = mainCheckouts.get(cwd);
+  if (cached !== undefined)
+    return cached;
+  const env = { ...process.env };
+  for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE"])
+    delete env[name];
+  const git = (args) => {
+    const run = spawnSync8("git", args, {
+      cwd,
+      env,
+      encoding: "utf8",
+      timeout: 5000,
+      windowsHide: true
+    });
+    return run.status === 0 ? run.stdout : null;
+  };
+  let main = null;
+  const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
+  const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
+  if (gitDir && common && path14.resolve(gitDir) !== path14.resolve(common)) {
+    const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
+    main = listed?.trim() || (path14.basename(common) === ".git" ? path14.dirname(common) : common);
+  }
+  mainCheckouts.set(cwd, main);
+  return main;
+}, matchingEntries = (cwd, entries) => {
+  const match = (where) => {
+    const targets = [where, realpathOf(where)].map((value) => value.replaceAll("\\", "/"));
+    return entries.filter((entry) => {
+      const glob = entry.glob.replaceAll("\\", "/");
+      const canonical = canonicalGlob(glob);
+      return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
+    });
+  };
+  const direct = match(cwd);
+  if (direct.length)
+    return direct;
+  const main = mainCheckoutOf(cwd);
+  return main ? match(main) : direct;
 }, realpathOf = (p) => {
   const real = realpathSync3.native ?? realpathSync3;
   try {
@@ -15383,41 +15425,27 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     if (named.length === 1)
       return named[0];
     if (named.length > 1)
-      throw new Error(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
+      throw new WorkspaceConfigError(`ambiguous workspace ${JSON.stringify(workspaceName)} for ${cwd}`);
     if (matches.length > 0) {
-      throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
+      throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}; matching choices: ${matches.map((entry) => entry.name).join(", ")}`);
     }
-    throw new Error(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(workspaceName)} does not match ${cwd}`);
   }
   if (matches.length < 2)
     return matches[0];
   const highestSpecificity = Math.max(...matches.map((entry) => globSpecificity(entry.glob)));
   const mostSpecific = matches.filter((entry) => globSpecificity(entry.glob) === highestSpecificity);
   if (mostSpecific.length > 1) {
-    throw new Error(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
+    throw new WorkspaceConfigError(`ambiguous workspace for ${cwd}; choose one of: ${mostSpecific.map((entry) => entry.name).join(", ")}`);
   }
   return mostSpecific[0];
 }, resolveWorkspaceFromEntries = (cwd, entries, workspaceName) => {
-  const targets = [cwd, realpathOf(cwd)].map((p) => p.replaceAll("\\", "/"));
-  const matches = [];
-  for (const ws of entries) {
-    const glob = ws.glob.replaceAll("\\", "/");
-    const canonical = canonicalGlob(glob);
-    let matched = false;
-    for (const target of targets) {
-      if (matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target)) {
-        matched = true;
-        break;
-      }
-    }
-    if (matched)
-      matches.push(ws);
-  }
+  const matches = matchingEntries(cwd, entries);
   return selectWorkspaceMatch(matches, cwd, workspaceName) ?? null;
 }, resolveWorkspaceFrom = (cwd, dir, workspaceName) => {
   const result = readWorkspacesResult(dir);
   if (result.status === "malformed" || result.status === "invalid")
-    throw new Error(result.error);
+    throw new WorkspaceConfigError(result.error);
   return resolveWorkspaceFromEntries(cwd, result.entries, workspaceName);
 }, runtimeWorkspacePolicySchema = (kind) => {
   const key = kind === "branch" ? "branchPolicy" : kind === "commit" ? "commitPolicy" : "vcs";
@@ -15443,31 +15471,26 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   } catch (error) {
     if (error.code === "ENOENT")
       return null;
-    throw new Error(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    throw new WorkspaceConfigError(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`${file} is not valid JSON`);
+    throw new WorkspaceConfigError(`${file} is not valid JSON`);
   }
   const validated = runtimeWorkspaceIndexSchema.safeParse(parsed);
   if (!validated.success) {
     const detail = validated.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspaces"}: ${issue.message}`).join("; ");
-    throw new Error(`${file} has invalid workspace matching data: ${detail}`);
+    throw new WorkspaceConfigError(`${file} has invalid workspace matching data: ${detail}`);
   }
   const entries = validated.data.workspaces;
   for (const entry of entries ?? []) {
     const glob = validateWorkspaceGlob(entry.glob);
     if (!glob.ok)
-      throw new Error(`${file} workspace ${entry.name}: ${glob.error}`);
+      throw new WorkspaceConfigError(`${file} workspace ${entry.name}: ${glob.error}`);
   }
-  const targets = [cwd, realpathOf(cwd)].map((value) => value.replaceAll("\\", "/"));
-  const matches = (entries ?? []).filter((entry) => {
-    const glob = entry.glob.replaceAll("\\", "/");
-    const canonical = canonicalGlob(glob);
-    return targets.some((target) => matchWorkspace(glob, target) || canonical !== glob && matchWorkspace(canonical, target));
-  });
+  const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
   return selected ? { file, selected } : null;
@@ -15482,7 +15505,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   const policy = runtimeWorkspacePolicySchema(kind).safeParse(selected);
   if (!policy.success) {
     const detail = policy.error.issues.map((issue) => `${issue.path.map(String).join(".") || "workspace"}: ${issue.message}`).join("; ");
-    throw new Error(`${file} has invalid ${kind} policy configuration: ${detail}`);
+    throw new WorkspaceConfigError(`${file} has invalid ${kind} policy configuration: ${detail}`);
   }
   return policy.data;
 }, resolveRuntimeWorkspacePolicy = (cwd, kind, requestedProfile) => {
@@ -15492,10 +15515,10 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   const key = kind === "branch" ? "branchPolicy" : "commitPolicy";
   const profileName = requestedProfile?.trim() || candidate.defaultProfile;
   if (candidate.defaultProfile && !Object.hasOwn(candidate.profiles ?? {}, candidate.defaultProfile))
-    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(candidate.defaultProfile)}`);
   const profile = profileName ? candidate.profiles?.[profileName] : undefined;
   if (profileName && !profile)
-    throw new Error(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
+    throw new WorkspaceConfigError(`workspace ${JSON.stringify(candidate.name)} has no profile ${JSON.stringify(profileName)}`);
   const profilePolicy = profile?.[key];
   const workspacePolicy = candidate[key];
   return {
@@ -15666,6 +15689,10 @@ var init_workspaces = __esm(() => {
   });
   UNSUPPORTED_GLOB = /[?[\]{}]/;
   UNSUPPORTED_EXTGLOB = /[@+*]\(|!/;
+  WorkspaceConfigError = class WorkspaceConfigError extends Error {
+    name = "WorkspaceConfigError";
+  };
+  mainCheckouts = new Map;
   runtimeWorkspaceIndexSchema = object({
     workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
   }).passthrough();
@@ -15673,7 +15700,7 @@ var init_workspaces = __esm(() => {
 
 // packages/workit-core/src/core/release-tracks.ts
 import { createHash as createHash9 } from "node:crypto";
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { readFileSync as readFileSync5 } from "node:fs";
 function readReleaseTracks(raw) {
   const out = { tracks: [], issues: [], error: null, protectedBranches: [] };
@@ -16075,7 +16102,7 @@ var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER
   const remote = remotes.find((name) => bare.startsWith(`${name}/`));
   return remote ? bare.slice(remote.length + 1) : bare;
 }, MAX_RECORDED_HOPS = 10, git4 = (cwd, args) => {
-  const run = spawnSync8("git", args, {
+  const run = spawnSync9("git", args, {
     cwd,
     encoding: "utf8",
     timeout: 20000,
@@ -16136,7 +16163,7 @@ var init_release_tracks = __esm(() => {
 // packages/workit-core/src/core/vcs-config.ts
 import fs12 from "node:fs";
 import path15 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
   const wsVcs = ws?.vcs ?? {};
@@ -16219,7 +16246,7 @@ function vcsConfig(mode, cwd, options = {}) {
   return out;
 }
 var workspacesPath = () => path15.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
-  const r = spawnSync9("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
+  const r = spawnSync10("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
   const url = (r.stdout ?? "").trim();
@@ -18535,7 +18562,7 @@ var init_pr_body = __esm(() => {
 
 // packages/workit-core/src/core/pr-create.ts
 import path19 from "node:path";
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 var safePushUrl = (remote) => {
   const raw = remote.trim();
@@ -18563,7 +18590,7 @@ var safePushUrl = (remote) => {
   const target = safePushUrl(remote);
   if (!target)
     return false;
-  const result = spawnSync10("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
+  const result = spawnSync11("git", ["config", "--get-regexp", "^url\\..*\\.(insteadof|pushinsteadof)$"], { cwd, encoding: "utf8" });
   if (result.status !== 0 && result.status !== 1)
     return false;
   const prefixes = (result.stdout ?? "").split(/\r?\n/u).map((line) => line.trim().slice(line.trim().indexOf(" ") + 1)).filter(Boolean);
@@ -62851,7 +62878,7 @@ var init_support_matrix = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/host-install.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import {
   accessSync,
   constants as constants2,
@@ -63122,7 +63149,7 @@ function runHostCommand(step, context = {}) {
       stderr: `Cannot safely execute batch shim ${step.command}; resolve its Node.js CLI entrypoint and retry`
     };
   }
-  const result = spawnSync11(step.command, step.args, {
+  const result = spawnSync12(step.command, step.args, {
     cwd: step.cwd,
     env: (() => {
       const home = context.home ?? context.env?.HOME ?? os6.homedir();
@@ -63327,7 +63354,7 @@ var init_skill_manifests = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/doctor.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import {
   existsSync as existsSync13,
   lstatSync as lstatSync4,
@@ -63393,9 +63420,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return [
     ...new Set(entries.filter((entry) => typeof entry === "string" && isWorkitPlugin(entry)))
   ];
-}, commandOnPath = (name, env) => {
+}, commandOnPath = (name, env) => findOnPath(process.platform === "win32" ? [name, `${name}.exe`] : [name], env) !== null, pathextNames = (name, env) => process.platform === "win32" ? (env.PATHEXT ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map((ext) => `${name}${ext.toLowerCase()}`) : [name], findOnPath = (names, env) => {
   const dirs = (env.PATH ?? process.env.PATH ?? "").split(path29.delimiter);
-  const names = process.platform === "win32" ? [name, `${name}.exe`] : [name];
   for (const dir of dirs) {
     if (!dir)
       continue;
@@ -63405,13 +63431,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         const st = statSync4(candidate);
         if (process.platform !== "win32" && (st.mode & 73) === 0)
           continue;
-        return true;
+        return candidate;
       } catch {}
     }
   }
-  return false;
+  return null;
 }, versionOf = (bin, env, timeout) => {
-  const r = spawnSync12(bin, ["--version"], { encoding: "utf8", env, timeout });
+  const r = spawnSync13(bin, ["--version"], { encoding: "utf8", env, timeout });
   if (r.error)
     return null;
   return (r.stdout ?? "").trim();
@@ -63660,7 +63686,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 `)) {
       return false;
     }
-    return spawnSync12(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
+    return spawnSync13(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
   } catch {
     return false;
   }
@@ -63874,7 +63900,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!cmd)
     return null;
   try {
-    const r = spawnSync12(cmd, ["view", pkgName, "version"], {
+    const r = spawnSync13(cmd, ["view", pkgName, "version"], {
       encoding: "utf8",
       timeout: 20000,
       env: res.env
@@ -64313,7 +64339,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, defaultIdentityProbes = (env) => ({
   origin: (cwd) => {
     try {
-      const out = spawnSync12("git", ["remote", "get-url", "origin"], {
+      const out = spawnSync13("git", ["remote", "get-url", "origin"], {
         cwd,
         encoding: "utf8",
         env
@@ -64325,7 +64351,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync12("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync13("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -64334,7 +64360,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   glabLogin: (e) => {
     try {
-      const out = spawnSync12("glab", ["api", "user", "--jq", ".username"], {
+      const out = spawnSync13("glab", ["api", "user", "--jq", ".username"], {
         encoding: "utf8",
         env: e
       });
@@ -64346,7 +64372,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   sshLogin: (host) => {
     try {
-      const out = spawnSync12("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
+      const out = spawnSync13("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
         encoding: "utf8",
         env
       });
@@ -64503,6 +64529,67 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: repair,
     registryProbed
   };
+}, CLI_PACKAGE = "@brainervirus/workit-cli", SEMVER, WORKIT_PROBE_TIMEOUT_MS = 1e4, workitVersions, workitVersionAt = (bin, env) => {
+  let key;
+  try {
+    const st = statSync4(bin);
+    key = `${bin}:${st.ino}:${st.size}:${st.mtimeMs}`;
+  } catch {
+    return { version: null, timedOut: false };
+  }
+  const cached = workitVersions.get(key);
+  if (cached)
+    return cached;
+  const viaShell = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(bin);
+  const r = viaShell ? spawnSync13(`"${bin}" --version`, {
+    encoding: "utf8",
+    env,
+    timeout: WORKIT_PROBE_TIMEOUT_MS,
+    shell: true
+  }) : spawnSync13(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
+  const timedOut = r.error !== undefined && "code" in r.error && r.error.code === "ETIMEDOUT";
+  const version = r.status === 0 ? (r.stdout ?? "").match(SEMVER)?.[0] ?? null : null;
+  const probe = { version: timedOut ? null : version, timedOut };
+  workitVersions.set(key, probe);
+  return probe;
+}, checkWorkitOnPath = (res) => {
+  const plugins = [
+    ...claudeWorkitInstalls(res.home, res.env, res.cwd).map((i) => ({
+      label: `Claude Code plugin ${i.id}`,
+      version: i.version
+    })),
+    { label: "Cursor plugin", version: installedPluginVersion(res) },
+    { label: "OpenCode plugin", version: installedOpenCodeCacheVersion(res) }
+  ].filter((p) => p.version !== null);
+  const newest = plugins.reduce((best, p) => best && semverAtLeast(best.version, p.version) ? best : p, null);
+  const target = newest?.version ?? "latest";
+  const fix = `npm i -g ${CLI_PACKAGE}@${target} (or run it without a global install: npx -y ${CLI_PACKAGE}@${target} <command>)`;
+  const bin = findOnPath(pathextNames("workit", res.env), res.env);
+  if (!bin) {
+    return { id: "workit_on_path", status: "warn", detail: "no workit on PATH", fix };
+  }
+  const { version, timedOut } = workitVersionAt(bin, res.env);
+  if (!version) {
+    return {
+      id: "workit_on_path",
+      status: "warn",
+      detail: timedOut ? `${bin} does not run (\`workit --version\` timed out after ${WORKIT_PROBE_TIMEOUT_MS / 1000}s)` : `${bin} does not run (\`workit --version\` failed)`,
+      fix
+    };
+  }
+  if (newest && versionBehind(version, newest.version)) {
+    return {
+      id: "workit_on_path",
+      status: "warn",
+      detail: `workit ${version} at ${bin} is older than the ${newest.label} ${newest.version}`,
+      fix
+    };
+  }
+  return {
+    id: "workit_on_path",
+    status: "pass",
+    detail: `workit ${version} at ${bin}${newest ? ` (newest host plugin ${newest.version})` : ""}`
+  };
 }, RUN_CHECKS, INSTALLER_REQUIRED, runDoctor = (options = {}) => {
   const res = resolve(options);
   const raw = RUN_CHECKS.map((fn) => fn(res));
@@ -64550,12 +64637,15 @@ var init_doctor = __esm(() => {
   init_skill_manifests();
   OPENCODE_V1_FIX = `OpenCode < ${SUPPORT_MATRIX.opencode.minimum} cannot load Workit 3 (V2 plugin API only): upgrade OpenCode to ${SUPPORT_MATRIX.opencode.minimum}+, or stay on Workit 2.x by pinning "@brainervirus/workit-opencode@2" in the opencode.json "plugin" array`;
   canonicalCursorHook = cursorHooksEntry("").command;
+  SEMVER = /\d+\.\d+\.\d+/;
+  workitVersions = new Map;
   RUN_CHECKS = [
     checkRuntime,
     checkVersions,
     checkCodexPin,
     checkOpencodeVersion,
     checkClaudePlugin,
+    checkWorkitOnPath,
     checkAssets,
     checkLauncher,
     checkUtility,
@@ -69504,7 +69594,7 @@ var init_init = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 import {
   existsSync as existsSync17,
   mkdtempSync as mkdtempSync3,
@@ -69860,7 +69950,7 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (deps.run)
     return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync13(launch.command, launch.args, {
+  return spawnSync14(launch.command, launch.args, {
     stdio: "inherit",
     env
   }).status ?? 1;
@@ -70042,7 +70132,7 @@ var init_launch = __esm(() => {
 });
 
 // packages/workit-core/src/knowledge.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 import fs17 from "node:fs";
 import path36 from "node:path";
 function lintKnowledge(root) {
@@ -70163,7 +70253,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
     return "unreadable";
   }
 }, trackedTopLevel = (root) => {
-  const run = spawnSync14("git", ["ls-files", "-z", "--cached"], {
+  const run = spawnSync15("git", ["ls-files", "-z", "--cached"], {
     cwd: root,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -70542,7 +70632,7 @@ var init_redact = __esm(() => {
 });
 
 // packages/workit-core/src/checks.ts
-import { spawn, spawnSync as spawnSync15 } from "node:child_process";
+import { spawn, spawnSync as spawnSync16 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import fs18 from "node:fs";
 import os13 from "node:os";
@@ -70721,7 +70811,7 @@ function runCheckCommand(argv, options) {
       if (!child?.pid)
         return;
       if (windows)
-        spawnSync15("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        spawnSync16("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -71443,7 +71533,7 @@ var init_check = __esm(() => {
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
 // packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 import { existsSync as existsSync18, readFileSync as readFileSync18 } from "node:fs";
 import path39 from "node:path";
 function operationInProgress(cwd) {
@@ -71931,7 +72021,8 @@ ${gitOutput(run)}`);
     url: plan.url,
     previous: before.sha,
     pushed,
-    forced
+    forced,
+    ...input.identity ? { identity: input.identity } : {}
   });
   return success2({
     remote: plan.remote,
@@ -71975,7 +72066,7 @@ ${run.stdout}`;
   } : { ok: false, lease: false, error: gitError(run) };
 }
 var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
-  const result = spawnSync16("git", args, {
+  const result = spawnSync17("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
@@ -72355,16 +72446,16 @@ function waitVerdict(doc, options) {
   const checks = doc.checks.state;
   if (checks === "failing")
     return { state: "failed", reason: "checks_failing" };
-  if (checks === "pending")
-    return { state: "waiting", reason: "checks_pending" };
-  if (checks === "passing")
-    return { state: "ready", reason: "checks_passing" };
-  if (doc.conflicts)
+  if (doc.conflicts && checks !== "passing")
     return {
       state: "blocked",
       reason: "conflicts",
       unblock: `rebase onto ${doc.base} and push; CI does not run on a conflicting PR`
     };
+  if (checks === "pending")
+    return { state: "waiting", reason: "checks_pending" };
+  if (checks === "passing")
+    return { state: "ready", reason: "checks_passing" };
   const ciRequired = doc.checks.missingRequired === null || doc.mergeState === "ci_must_pass" || doc.mergeState === "ci_still_running";
   if (ciRequired)
     return { state: "waiting", reason: "no_checks_yet" };
@@ -72472,7 +72563,7 @@ var init_report = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-ops.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+import { spawnSync as spawnSync18 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
   if (!base.startsWith("-"))
@@ -72480,7 +72571,7 @@ function fillFromCommits(cwd, resolved, base) {
   const from = resolveRef(cwd, tracking) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return failure3("not_found", `base ${base} is not available locally`, `git fetch ${resolved.baseRemote} ${base}`);
-  const log = spawnSync17("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
+  const log = spawnSync18("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -72785,7 +72876,7 @@ var init_pr_ops = __esm(() => {
 });
 
 // packages/workit-core/src/forge/exec.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 import fs20 from "node:fs";
 import path41 from "node:path";
 function findExecutable(bin, env) {
@@ -72820,7 +72911,7 @@ function systemRunner(kind, apiHost, env = process.env) {
     if (!exe)
       return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
     const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
-    const result = spawnSync18(exe, [...args], {
+    const result = spawnSync19(exe, [...args], {
       encoding: "utf8",
       env: { ...childEnv, ...token },
       maxBuffer: MAX_BUFFER2,
@@ -72839,17 +72930,45 @@ function systemRunner(kind, apiHost, env = process.env) {
     };
   };
 }
+function forgeReason(run) {
+  const parts = [];
+  try {
+    const body = JSON.parse(run.stdout);
+    const add = (value) => {
+      if (typeof value === "string" && value.trim())
+        parts.push(value.trim());
+      else if (Array.isArray(value))
+        value.forEach(add);
+      else if (value && typeof value === "object") {
+        const record = value;
+        if (typeof record.message === "string")
+          add(record.message);
+        else if (!("code" in record))
+          Object.values(record).forEach(add);
+      }
+    };
+    add(body.message);
+    add(body.error);
+    add(body.errors);
+  } catch {}
+  const stderr = (run.stderr.split(/\r?\n/u).find((value) => value.trim()) ?? "").trim();
+  const unique = [...new Set(parts)];
+  const text = unique.length ? `${unique.join("; ")}${stderr ? ` (${stderr.replace(/^gh: |^glab: /u, "")})` : ""}` : stderr || (run.stdout.split(/\r?\n/u).find((value) => value.trim()) ?? "");
+  return redactText(text).slice(0, 300);
+}
 function cliFailure(bin, apiHost, run, what, timeoutMs) {
   if (run.missing)
     return failure3("unavailable", `${bin} is not installed`, installHint(bin));
   if (run.timedOut)
-    return failure3("unavailable", `${bin} api ${what} timed out after ${timeoutMs} ms`);
+    return failure3("unavailable", run.timeoutMs === 0 ? `${bin} api ${what} not attempted: the command's time budget ran out` : `${bin} api ${what} timed out after ${run.timeoutMs ?? timeoutMs} ms`, `check the network to ${apiHost}, then retry`);
   const stderr = redactText(run.stderr).trim();
   if (/auth login|not logged in|no token|authentication required|bad credentials|\b401\b|unauthorized/iu.test(stderr))
     return failure3("unavailable", `${bin} is not authenticated for ${apiHost}`, loginHint(bin, apiHost));
   if (/\b404\b|not found/iu.test(stderr))
     return failure3("not_found", `${what} was not found`);
   const first = stderr.split(/\r?\n/u).find((value) => value.trim()) ?? `exit ${run.status}`;
+  if (isNetworkError(stderr))
+    return failure3("unavailable", `${bin} api ${what} failed (network): ${first.slice(0, 200)}`, `check the network to ${apiHost}, then retry`);
   return failure3("failed", `${bin} api ${what} failed: ${first.slice(0, 200)}`);
 }
 function apiJson(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.api, options = {}) {
@@ -72880,12 +72999,15 @@ function apiWrite(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.a
   if (run.status !== 0) {
     const text = redactText(`${run.stderr}
 ${run.stdout}`).trim();
-    const reason = (text.split(/\r?\n/u).find((value) => value.trim()) ?? "").slice(0, 200);
+    const reason = forgeReason(run);
     if (!run.missing && !run.timedOut && /\b409\b|head branch was modified|sha does not match|sha.*mismatch/iu.test(text))
       return failure3("blocked", `head_moved: ${what} refused because the head changed (${reason})`, "workit pr status  # re-check the new head, then verify it again");
     if (!run.missing && !run.timedOut && /\b(405|406|422)\b/u.test(text))
       return failure3("blocked", `${what} refused by the forge: ${reason}`);
-    return cliFailure(bin, apiHost, run, what, timeoutMs);
+    const failed = cliFailure(bin, apiHost, run, what, timeoutMs);
+    if (!failed.ok && failed.code === "unavailable" && !run.missing && !/ is not authenticated for /u.test(failed.error))
+      return failure3("unavailable", failed.error, "workit pr status  # the write may have gone through; check it first, then retry");
+    return failed;
   }
   if (!run.stdout.trim())
     return { ok: true, data: {} };
@@ -72895,11 +73017,12 @@ ${run.stdout}`).trim();
     return failure3("failed", `${bin} api ${what} returned invalid JSON`);
   }
 }
-var FORGE_TIMEOUTS, MAX_BUFFER2, installHint = (bin) => bin === "gh" ? "install the GitHub CLI (https://cli.github.com) and run: gh auth login" : "install glab (https://gitlab.com/gitlab-org/cli) and run: glab auth login", loginHint = (bin, apiHost) => `${bin} auth login --hostname ${apiHost}`;
+var FORGE_TIMEOUTS, MAX_BUFFER2, installHint = (bin) => bin === "gh" ? "install the GitHub CLI (https://cli.github.com) and run: gh auth login" : "install glab (https://gitlab.com/gitlab-org/cli) and run: glab auth login", loginHint = (bin, apiHost) => `${bin} auth login --hostname ${apiHost}`, NETWORK, isNetworkError = (text) => NETWORK.test(text);
 var init_exec = __esm(() => {
   init_redact();
   FORGE_TIMEOUTS = { api: 20000, log: 30000 };
   MAX_BUFFER2 = 64 * 1024 * 1024;
+  NETWORK = /error connecting|could not resolve|no such host|connection (refused|reset|timed out)|network is unreachable|i\/o timeout|tls handshake|unexpected eof|\bHTTP 5\d\d\b|bad gateway|service unavailable|gateway time-?out/iu;
 });
 
 // packages/workit-core/src/forge/github.ts
@@ -73491,6 +73614,82 @@ var init_gitlab = __esm(() => {
 
 // packages/workit-core/src/forge/resolve.ts
 import fs21 from "node:fs";
+function memo4(scope, key, compute, now = Date.now) {
+  let entries = memoScopes.get(scope.owner);
+  if (!entries)
+    memoScopes.set(scope.owner, entries = new Map);
+  const full = `${scope.key} ${key}`;
+  const hit = entries.get(full);
+  if (hit && now() - hit.at < MEMO_TTL_MS)
+    return hit.value;
+  const { keep, value } = compute();
+  if (keep)
+    entries.set(full, { at: now(), value });
+  return value;
+}
+function clampedRunner(base, limits, now, token) {
+  return (bin, args, callOptions) => {
+    let timeoutMs = callOptions.timeoutMs;
+    if (limits.deadline !== null) {
+      const remaining = limits.deadline - now();
+      if (remaining <= 0)
+        return {
+          status: null,
+          stdout: "",
+          stderr: "",
+          timedOut: true,
+          missing: false,
+          timeoutMs: 0
+        };
+      timeoutMs = Math.min(timeoutMs, remaining);
+    }
+    const run = base(bin, args, { ...callOptions, timeoutMs, ...token ? { token } : {} });
+    return run.timedOut && run.timeoutMs === undefined ? { ...run, timeoutMs } : run;
+  };
+}
+function resolveCredential(workspace, derived, run, scope) {
+  const { kind, apiHost } = derived;
+  const expectedAccount = workspace?.vcs?.account ?? null;
+  const tokenFile = workspace?.vcs?.tokenFile;
+  if (typeof tokenFile === "string" && tokenFile.trim()) {
+    const workspaceHost = workspace?.vcs?.host;
+    const explicit = typeof workspaceHost === "string" && workspaceHost.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "") === apiHost;
+    if (derived.via === "host_name" && !explicit)
+      return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
+    let token = "";
+    try {
+      token = fs21.readFileSync(tokenFile.trim(), "utf8").trim();
+    } catch {
+      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
+    }
+    if (!token)
+      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
+    return success2({ token, credential: "workspace_token_file" });
+  }
+  if (!expectedAccount || kind !== "github")
+    return success2({ token: undefined, credential: "cli_login" });
+  return memo4(scope, `token ${apiHost} ${expectedAccount}`, () => {
+    const issued = run("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
+      timeoutMs: FORGE_TIMEOUTS.api
+    });
+    const value = authTokenResult(issued, apiHost, expectedAccount, workspace?.name ?? "?");
+    return { keep: value.ok, value };
+  });
+}
+function authTokenResult(issued, apiHost, account, workspace) {
+  if (issued.missing)
+    return failure3("unavailable", "gh is not installed", "install the GitHub CLI (https://cli.github.com) and run: gh auth login");
+  if (issued.timedOut)
+    return failure3("unavailable", `gh auth token ${issued.timeoutMs === 0 ? "not attempted: the time budget ran out" : `timed out after ${issued.timeoutMs ?? FORGE_TIMEOUTS.api} ms`} (looking up the ${account} login on ${apiHost})`, "gh auth status  # check gh and the network, then retry");
+  const token = issued.status === 0 ? issued.stdout.trim() : "";
+  if (token)
+    return success2({ token, credential: "gh_account_token" });
+  const stderr = redactText(issued.stderr).trim();
+  const first = stderr.split(/\r?\n/u).find((line) => line.trim()) ?? "";
+  if (issued.status !== 0 && first && !/no oauth token|not logged in|no account/iu.test(stderr))
+    return failure3("unavailable", `gh auth token failed${isNetworkError(stderr) ? " (network)" : ""}: ${first.slice(0, 200)}`, "gh auth status  # check gh and the network, then retry");
+  return failure3("blocked", `identity_unavailable: gh has no login for ${account} on ${apiHost} (workspace ${workspace})`, `gh auth login --hostname ${apiHost}  # sign in as ${account}; workit passes that account's token per call and never switches the active account`);
+}
 function resolveForge(cwd, options = {}) {
   let workspace;
   try {
@@ -73508,48 +73707,16 @@ function resolveForge(cwd, options = {}) {
   const derived = pushed.forge;
   const { kind, apiHost } = derived;
   const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
   const now = options.now ?? Date.now;
   const expectedAccount = workspace?.vcs?.account ?? null;
-  let token;
-  let credential = "cli_login";
-  const tokenFile = workspace?.vcs?.tokenFile;
-  if (typeof tokenFile === "string" && tokenFile.trim()) {
-    const workspaceHost = workspace?.vcs?.host;
-    const explicit = typeof workspaceHost === "string" && workspaceHost.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "") === apiHost;
-    if (derived.via === "host_name" && !explicit)
-      return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
-    try {
-      token = fs21.readFileSync(tokenFile.trim(), "utf8").trim();
-    } catch {
-      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
-    }
-    if (!token)
-      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
-    credential = "workspace_token_file";
-  } else if (expectedAccount && kind === "github") {
-    const issued = base("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
-      timeoutMs: FORGE_TIMEOUTS.api
-    });
-    if (issued.missing)
-      return failure3("unavailable", "gh is not installed", "install the GitHub CLI (https://cli.github.com) and run: gh auth login");
-    token = issued.status === 0 ? issued.stdout.trim() : "";
-    if (!token)
-      return failure3("blocked", `identity_unavailable: gh has no login for ${expectedAccount} on ${apiHost} (workspace ${workspace?.name ?? "?"})`, `gh auth login --hostname ${apiHost}  # sign in as ${expectedAccount}; workit passes that account's token per call and never switches the active account`);
-    credential = "gh_account_token";
-  }
-  const limits = { deadline: null };
-  const runner = (bin, args, callOptions) => {
-    let timeoutMs = callOptions.timeoutMs;
-    if (limits.deadline !== null) {
-      const remaining = limits.deadline - now();
-      if (remaining <= 0)
-        return { status: null, stdout: "", stderr: "", timedOut: true, missing: false };
-      timeoutMs = Math.min(timeoutMs, remaining);
-    }
-    return base(bin, args, { ...callOptions, timeoutMs, ...token ? { token } : {} });
-  };
+  const limits = { deadline: options.deadline ?? null };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  if (!credential.ok)
+    return credential;
+  const runner = clampedRunner(base, limits, now, credential.data.token);
   const headRepo = derived.repo;
-  const probe = createForge(derived, headRepo, runner);
+  const probe = memoizedIdentity(createForge(derived, headRepo, runner), scope, credential.data);
   const info = probe.repoInfo(headRepo);
   if (!info.ok && info.code !== "not_found")
     return info;
@@ -73564,13 +73731,13 @@ function resolveForge(cwd, options = {}) {
   const baseRepo = upstream && upstream !== headRepo ? upstream : info.ok && info.data.parent ? info.data.parent : headRepo;
   const baseRemote = baseRepo === headRepo ? pushed.remote : remotes.find((name) => repoOfRemote(name) === baseRepo) ?? pushed.remote;
   return success2({
-    forge: baseRepo === headRepo ? probe : createForge(derived, baseRepo, runner),
+    forge: baseRepo === headRepo ? probe : memoizedIdentity(createForge(derived, baseRepo, runner), scope, credential.data),
     remote: pushed.remote,
     url: pushed.url,
     derived,
     workspace: workspace?.name ?? null,
     expectedAccount,
-    credential,
+    credential: credential.data.credential,
     headRepo,
     headProjectId,
     fork: baseRepo !== headRepo,
@@ -73583,14 +73750,74 @@ function checkIdentity(resolved) {
   const identity = forge.identity(expectedAccount);
   if (!identity.ok)
     return identity;
-  if (identity.data.matches === false) {
-    const bin = forge.kind === "github" ? "gh" : "glab";
-    const where = `workspace ${resolved.workspace ?? "?"}`;
-    return failure3("blocked", `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${identity.data.login} but ${where} expects ${expectedAccount}`, resolved.credential === "workspace_token_file" ? `put a token for ${expectedAccount} in the ${where} vcs.tokenFile` : `${bin} auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`);
-  }
+  if (identity.data.matches === false)
+    return mismatch(resolved, identity.data.login ?? "?", resolved.workspace);
   return identity;
 }
-var configuredHosts = () => {
+function checkPushIdentity(cwd, options = {}) {
+  let workspace;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
+    return failure3("blocked", error instanceof Error ? error.message : String(error), "fix ~/.config/workit/workspaces.json (workit init → Workspaces)");
+  }
+  const account = workspace?.vcs?.account ?? null;
+  const skipped = (forge, reason, unblock) => success2({
+    status: "skipped",
+    forge,
+    account,
+    login: null,
+    reason,
+    ...unblock ? { unblock } : {}
+  });
+  const pushed = pushForge(cwd, {
+    branch: options.branch,
+    hosts: configuredHosts(),
+    sshConfig: options.sshConfig
+  });
+  if (!pushed.ok) {
+    const host = /^unsupported_forge: .*?"([^"]+)"/u.exec(pushed.error)?.[1];
+    const what = /could not resolve ssh alias/u.test(pushed.error) ? `could not resolve ssh alias ${host} to GitHub or GitLab` : pushed.error.startsWith("unsupported_forge: ssh host") ? `ssh host ${host} is not a GitHub/GitLab host or an alias workit can resolve` : `${host} is not a GitHub or GitLab host workit knows`;
+    return skipped(null, host ? `unsupported_forge: ${what}; account checks skipped, pushed with git only (no PR or CI verbs)` : pushed.error, pushed.unblock);
+  }
+  const derived = pushed.forge;
+  const conflict = forgeConflict(derived, workspace?.vcs?.provider);
+  if (conflict)
+    return skipped(derived.kind, conflict.error, conflict.unblock);
+  if (!account)
+    return success2({ status: "no_account", forge: derived.kind, account, login: null });
+  const base = options.runner ?? systemRunner(derived.kind, derived.apiHost, options.env ?? process.env);
+  const scope = memoScope(options.runner, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const limits = { deadline: now() + (options.budgetMs ?? PUSH_IDENTITY_BUDGET_MS) };
+  const credential = resolveCredential(workspace, derived, clampedRunner(base, limits, now), scope);
+  if (!credential.ok)
+    return unreachable(credential) ? skipped(derived.kind, credential.error, credential.unblock) : credential;
+  const forge = memoizedIdentity(createForge(derived, derived.repo, clampedRunner(base, limits, now, credential.data.token)), scope, credential.data);
+  const identity = forge.identity(account);
+  if (!identity.ok)
+    return unreachable(identity) ? skipped(derived.kind, identity.error, identity.unblock) : identity;
+  if (identity.data.matches === false)
+    return mismatch({ forge, credential: credential.data.credential, expectedAccount: account }, identity.data.login ?? "?", workspace?.name ?? null);
+  if (identity.data.matches === null)
+    return skipped(derived.kind, identity.data.note ?? "the credential cannot read /user");
+  return success2({ status: "verified", forge: derived.kind, account, login: identity.data.login });
+}
+var MEMO_TTL_MS, SYSTEM_SCOPE, memoScopes, memoScope = (runner, env) => ({
+  owner: runner ?? SYSTEM_SCOPE,
+  key: [env.GH_CONFIG_DIR, env.GLAB_CONFIG_DIR, env.XDG_CONFIG_HOME, env.HOME].map((value) => value ?? "").join("|")
+}), memoizedIdentity = (forge, scope, credential) => {
+  if (credential.credential === "cli_login")
+    return forge;
+  const identity = (expected) => forge.identity(expected);
+  return {
+    ...forge,
+    identity: (expected) => memo4(scope, `identity ${forge.kind} ${forge.apiHost} ${credential.credential} ${credential.token ?? ""} ${expected ?? ""}`, () => {
+      const value = identity(expected);
+      return { keep: value.ok, value };
+    })
+  };
+}, configuredHosts = () => {
   const vcs = readVcsConfig();
   if (vcs.status !== "valid")
     return {};
@@ -73599,7 +73826,13 @@ var configuredHosts = () => {
     return typeof value === "string" && value.trim() ? [value.trim()] : [];
   };
   return { github: host("github"), gitlab: host("gitlab") };
-}, createForge = (derived, repo, runner) => derived.kind === "github" ? createGitHubForge({ apiHost: derived.apiHost, repo, runner }) : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+}, createForge = (derived, repo, runner) => derived.kind === "github" ? createGitHubForge({ apiHost: derived.apiHost, repo, runner }) : createGitLabForge({ apiHost: derived.apiHost, repo, runner }), mismatch = (resolved, login, workspace) => {
+  const { forge, expectedAccount } = resolved;
+  const bin = forge.kind === "github" ? "gh" : "glab";
+  const where = `workspace ${workspace ?? "?"}`;
+  const fileFix = `put a token for ${expectedAccount} in the ${where} vcs.tokenFile`;
+  return failure3("blocked", `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${login} but ${where} expects ${expectedAccount}`, resolved.credential === "workspace_token_file" ? fileFix : forge.kind === "github" ? `gh auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}` : `${fileFix} (glab keeps one login per host, so workit never switches it)`);
+}, unreachable = (result) => result.code === "unavailable" && !/ is not authenticated for /u.test(result.error), PUSH_IDENTITY_BUDGET_MS = 5000;
 var init_resolve = __esm(() => {
   init_vcs_config();
   init_workspaces();
@@ -73607,6 +73840,10 @@ var init_resolve = __esm(() => {
   init_exec();
   init_github();
   init_gitlab();
+  init_redact();
+  MEMO_TTL_MS = 5 * 60000;
+  SYSTEM_SCOPE = {};
+  memoScopes = new WeakMap;
 });
 
 // packages/workit-core/src/duration.ts
@@ -73699,16 +73936,19 @@ function releaseTrunk(io, track, branch) {
     tracked: Boolean(resolved.releaseTrack)
   };
 }
-function connect(io, branch) {
+function connect(io, branch, options = {}) {
+  const verbDeadline = options.deadline ?? null;
   const resolved = resolveForge(io.cwd, {
     branch,
     env: io.env,
     runner: forgeDeps.runner,
-    now: forgeDeps.now
+    now: forgeDeps.now,
+    deadline: verbDeadline ?? forgeDeps.now() + CONNECT_BUDGET_MS
   });
   if (!resolved.ok)
     return resolved;
   const identity = checkIdentity(resolved.data);
+  resolved.data.limits.deadline = verbDeadline;
   if (!identity.ok)
     return identity;
   return {
@@ -73763,7 +74003,12 @@ function renderStatus(doc) {
   lines.push(`next: ${doc.next}`);
   return lines;
 }
-var forgeDeps, MAX_REASON = 500, usage3 = (io, message, line) => emit(io, fail("invalid_input", message, { unblock: line })), forgeFail = (io, result, data) => emit(io, fail(result.code, result.error, { data, unblock: result.unblock })), short = (sha) => sha ? sha.slice(0, 7) : "?";
+var forgeDeps, MAX_REASON = 500, usage3 = (io, message, line) => emit(io, fail("invalid_input", message, { unblock: line })), forgeFail = (io, result, data) => emit(io, fail(result.code, result.error, { data, unblock: result.unblock })), CONNECT_BUDGET_MS = 15000, pushIdentity = (io, branch) => checkPushIdentity(io.cwd, {
+  branch,
+  env: io.env,
+  runner: forgeDeps.runner,
+  now: forgeDeps.now
+}), short = (sha) => sha ? sha.slice(0, 7) : "?";
 var init_forge_common = __esm(() => {
   init_resolve();
   init_vcs_config();
@@ -74013,16 +74258,17 @@ async function wait(argv, io) {
   const head = flags.values.head ?? null;
   if (head !== null && !/^[0-9a-f]{7,64}$/u.test(head))
     return usage3(io, "--head must be a commit sha (7-64 hex chars)", WAIT_USAGE);
-  const connected = connect(io, flags.values.branch);
+  const started = forgeDeps.now();
+  const deadline = started + timeoutMs;
+  const connected = connect(io, flags.values.branch, {
+    deadline: started + Math.max(timeoutMs, ONE_POLL_MS)
+  });
   if (!connected.ok)
     return forgeFail(io, connected);
   const resolved = connected.data;
   const number = selectPr(io.cwd, resolved, { pr, branch: flags.values.branch ?? null });
   if (!number.ok)
     return forgeFail(io, number);
-  const started = forgeDeps.now();
-  const deadline = started + timeoutMs;
-  resolved.limits.deadline = started + Math.max(timeoutMs, ONE_POLL_MS);
   let polls = 0;
   let errors = 0;
   let status = null;
@@ -74359,12 +74605,11 @@ async function push(argv, io) {
   const plan = pushPreflight(io.cwd);
   if (!plan.ok)
     return forgeFail(io, plan);
-  if (!plan.data.local) {
-    const connected = connect(io, plan.data.branch);
-    if (!connected.ok)
-      return forgeFail(io, connected);
-  }
-  const grant = requireGrant(io.cwd, "push", { forge: !plan.data.local });
+  const identity = plan.data.local ? null : pushIdentity(io, plan.data.branch);
+  if (identity && !identity.ok)
+    return forgeFail(io, identity);
+  const checked = identity?.data ?? null;
+  const grant = requireGrant(io.cwd, "push", { forge: checked?.forge != null });
   if (!grant.allowed)
     return emit(io, fail("blocked", grant.error, {
       unblock: grant.unblock,
@@ -74375,14 +74620,22 @@ async function push(argv, io) {
     overwriteUnintegrated: flags.booleans.has("overwrite-unintegrated"),
     expect,
     setUpstream: flags.booleans.has("set-upstream"),
-    actor: actorFromEnv(io.env)
+    actor: actorFromEnv(io.env),
+    ...checked ? { identity: { ...checked } } : {}
   });
   if (!result.ok)
     return forgeFail(io, result, {
       branch: plan.data.branch,
       sha: plan.data.sha
     });
-  return emit(io, ok(result.data), (data) => [
+  const warnings = checked?.status === "skipped" ? [
+    `identity check skipped: ${checked.reason}${checked.unblock ? ` (to restore it: ${checked.unblock})` : ""}`
+  ] : [];
+  for (const warning of warnings)
+    io.stderr(`warning: ${warning}
+`);
+  const envelope = ok({ ...result.data, identity: checked });
+  return emit(io, warnings.length ? { ...envelope, warnings } : envelope, (data) => [
     data.pushed ? `pushed ${data.branch} ${short2(data.previous)} -> ${short2(data.sha)} to ${data.remote}${data.forced ? " (force-with-lease)" : ""}; remote tip verified` : `${data.remote}/${data.branch} is already at ${short2(data.sha)}; remote tip verified`,
     ...data.upstream ? [`upstream: ${data.remote}/${data.branch}`] : []
   ]);
@@ -74415,7 +74668,7 @@ var init_git2 = __esm(() => {
 });
 
 // packages/workit-core/src/forge/verify.ts
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
   const out = { ...report, delivered };
@@ -74546,7 +74799,7 @@ function parsePackageSpec(spec) {
   const version = at > 0 ? value.slice(at + 1) : null;
   if (!name || name.length > 214 || !NPM_NAME.test(name))
     return null;
-  if (version !== null && !SEMVER.test(version))
+  if (version !== null && !SEMVER2.test(version))
     return null;
   return { name, version };
 }
@@ -74581,7 +74834,7 @@ function verifyReleased(cwd, input, npm = systemNpm) {
     const version = spec.version ?? (input.tag ? input.tag.replace(/^v(?=\d)/u, "") : null);
     if (!version)
       return failure3("invalid_input", "--package needs a version (<name>@<version>) or --tag");
-    if (!SEMVER.test(version))
+    if (!SEMVER2.test(version))
       return failure3("invalid_input", `${version} (from --tag) is not a semver version; pass <name>@<version>`);
     const viewed = npm(["view", `${spec.name}@${version}`, "version", "gitHead", "--json"]);
     if (viewed.status !== 0 && !/E404|404 Not Found|is not in this registry|No match found/iu.test(viewed.stderr))
@@ -74615,7 +74868,7 @@ function verifyReleased(cwd, input, npm = systemNpm) {
     observations
   }, input.actor));
 }
-var NPM_NAME, SEMVER, SAFE_ARG, systemNpm = (args) => {
+var NPM_NAME, SEMVER2, SAFE_ARG, systemNpm = (args) => {
   if (!args.every((arg) => SAFE_ARG.test(arg)))
     return { status: 2, stdout: "", stderr: "refused: unsafe npm argument" };
   const options = {
@@ -74628,7 +74881,7 @@ var NPM_NAME, SEMVER, SAFE_ARG, systemNpm = (args) => {
   };
   const found = process.platform === "win32" ? findExecutable("npm.cmd", process.env) : null;
   const npmCmd = found && !/["%!^]/u.test(found) ? `"${found}"` : "npm.cmd";
-  const result = process.platform === "win32" ? spawnSync19(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync19("npm", [...args], options);
+  const result = process.platform === "win32" ? spawnSync20(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync20("npm", [...args], options);
   return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }, short3 = (sha) => sha ? sha.slice(0, 12) : "(absent)", npmView = (stdout) => {
   try {
@@ -74646,7 +74899,7 @@ var init_verify = __esm(() => {
   init_report();
   init_redact();
   NPM_NAME = /^(?:@[A-Za-z0-9~][A-Za-z0-9-._~]*\/)?[A-Za-z0-9~][A-Za-z0-9-._~]*$/u;
-  SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+  SEMVER2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
   SAFE_ARG = /^[0-9A-Za-z@/._~+-]+$/u;
 });
 
@@ -74735,7 +74988,7 @@ var init_verify_delivery = __esm(() => {
 });
 
 // packages/workit-core/src/stack.ts
-import { spawnSync as spawnSync20 } from "node:child_process";
+import { spawnSync as spawnSync21 } from "node:child_process";
 import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
 import fs22 from "node:fs";
 import path44 from "node:path";
@@ -75248,7 +75501,7 @@ function commitKeys(cwd, range) {
   const patches = new Map;
   const diff = gitRun3(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
   if (diff.ok && diff.stdout.trim()) {
-    const ids = spawnSync20("git", ["patch-id", "--stable"], {
+    const ids = spawnSync21("git", ["patch-id", "--stable"], {
       cwd,
       input: diff.stdout,
       encoding: "utf8",
@@ -75872,7 +76125,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
 }), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync20("git", args, {
+  const run = spawnSync21("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -76167,7 +76420,7 @@ var init_stack2 = __esm(() => {
 });
 
 // packages/workit-core/src/fanout.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
 import fs23 from "node:fs";
 import path45 from "node:path";
@@ -76940,7 +77193,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
     text: edges.map((edge) => `add "${edge.dependsOn}" to "dependsOn" of slice ${edge.slice}`).join("; ")
   };
 }, gitRun4 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync21("git", args, {
+  const run = spawnSync22("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -77460,7 +77713,7 @@ var init_fanout_brief = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-landed.ts
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
     return { forge: null, down: () => null };
@@ -77551,7 +77804,7 @@ function trunkPatchIds(ctx, fork) {
     "--"
   ]);
   if (log.ok && log.stdout.trim()) {
-    const run = spawnSync22("git", ["patch-id", "--stable"], {
+    const run = spawnSync23("git", ["patch-id", "--stable"], {
       cwd: ctx.cwd,
       input: log.stdout,
       encoding: "utf8",
@@ -94494,11 +94747,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 import { existsSync as existsSync19, readdirSync as readdirSync8, readFileSync as readFileSync21, statSync as statSync7 } from "node:fs";
 import path49 from "node:path";
 function git6(cwd, args) {
-  const run = spawnSync23("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync24("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -96391,9 +96644,21 @@ async function main(argv, overrides = {}, options = {}) {
   globalThis[Symbol.for("workit.migrationReporter")] = (report) => io.stderr(`workit: migrated ${report.tasks} task${report.tasks === 1 ? "" : "s"} from ${report.from} to ${report.to} (backup: ${report.backup})
 `);
   const verb = await entry.load();
+  const runVerb = (target) => guarded(target, () => verb.run(ended, target));
   if (!io.json)
-    return verb.run(ended, io);
-  return runJsonPure(io, command, (pure) => verb.run(ended, pure));
+    return runVerb(io);
+  return runJsonPure(io, command, runVerb);
+}
+async function guarded(io, run) {
+  try {
+    return await run();
+  } catch (error) {
+    if (!(error instanceof Error) || error.name !== "WorkspaceConfigError")
+      throw error;
+    return emit(io, fail("blocked", error.message, {
+      unblock: "fix ~/.config/workit/workspaces.json (workit init → Workspaces)"
+    }));
+  }
 }
 var CODE_FOR_EXIT = {
   1: "failed",