@brainervirus/workit-claude-code 8.28.1 → 8.29.1

package/dist/workit.js

@@ -9144,12 +9144,15 @@ function sessionClaimRefusal(env, claimed, cwd, options = {}) {
     };
   if (real.kind === "none" || !real.session)
     return null;
-  const ownShell = claimed === real.session && !(real.kind === "declared" && claimed.includes(":")) || real.kind === "derived" && claimed.endsWith(`:${real.session}`);
-  if (ownShell)
-    return options.flag ? {
+  const ownShell = isOwnShellClaim(real, claimed);
+  if (ownShell) {
+    if (!options.flag || real.kind === "derived")
+      return null;
+    return {
       error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
       unblock: "drop --session: the shell's own session is already the acting one"
-    } : null;
+    };
+  }
   const issuedClaim = claimed === real.session || claimed.startsWith(`${real.session}:`);
   if (issuedClaim) {
     const binding = issuedBinding(cwd, claimed);
@@ -9213,7 +9216,10 @@ var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "")
   } catch {
     return { stored: null, leadBound: safeList(dir).length > 0 };
   }
-}, leadOf = (session) => session.slice(0, session.lastIndexOf(":")), OWN_CHILD_SHELL, HOST_SET_VARIABLE;
+}, leadOf = (session) => session.slice(0, session.lastIndexOf(":")), OWN_CHILD_SHELL, isOwnShellClaim = (real, claimed) => claimed === real.session && !(real.kind === "declared" && claimed.includes(":")) || real.kind === "derived" && claimed.endsWith(`:${real.session}`), namesOwnDerivedSession = (env, claimed) => {
+  const real = realHostSession(env);
+  return real.kind === "derived" && isOwnShellClaim(real, claimed);
+}, HOST_SET_VARIABLE;
 var init_host_session = __esm(() => {
   init_branch();
   init_logger();
@@ -9245,7 +9251,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.28.1",
+    version: "8.29.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9283,13 +9289,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.28.1",
+      "@brainervirus/workit-cursor": "^8.29.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.28.1"
+      "@brainervirus/workit-core": "^8.29.1"
     },
     engines: {
       node: ">=24"
@@ -9403,9 +9409,22 @@ function detectedChecks(root) {
     add(plain("test", ["make", "test"]));
   return checks;
 }
+function configFileFor(root) {
+  const own = checksConfigFile(root);
+  if (fs5.existsSync(own))
+    return own;
+  const common = git3(root, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (!common || path9.basename(common) !== ".git")
+    return own;
+  const main = path9.dirname(common);
+  if (path9.resolve(main) === path9.resolve(root))
+    return own;
+  const shared = checksConfigFile(main);
+  return fs5.existsSync(shared) ? shared : own;
+}
 function loadCheckConfig(cwd) {
   const root = checkRoot(cwd);
-  const file = checksConfigFile(root);
+  const file = configFileFor(root);
   const legacy = path9.basename(file) === LEGACY_CHECKS_FILE;
   const label = legacy ? LEGACY_CHECKS_FILE : CHECKS_FILE;
   const note = legacy ? {
@@ -18139,17 +18158,21 @@ function workitCheckTail(words) {
     return null;
   return args.slice(0, split).includes("--shell") ? { script: tail.join(" "), cwd } : { argv: tail, cwd };
 }
-function simpleCommand(command, dialect = "posix", depth = 0) {
+function simpleCommand(command, dialect = "posix", depth = 0, shaped = false) {
   let segments;
   try {
     segments = segmentsOf(command, dialect);
   } catch {
     return null;
   }
-  if (segments.length !== 1)
+  const filter = shaped && segments.length === 2 ? segments[1] : null;
+  if (filter) {
+    if (!segments[0].pipe || !OUTPUT_FILTERS.has(commandName(filter.words[0])) || filter.group || filter.pipe || filter.unanalyzable || filter.subs?.length || filter.stdin?.length)
+      return null;
+  } else if (segments.length !== 1)
     return null;
   const [segment] = segments;
-  if (segment.group || segment.pipe || segment.unanalyzable || segment.redirects.length || segment.subs?.length || segment.stdin?.length)
+  if (segment.group || segment.pipe && !filter || segment.unanalyzable || segment.redirects.length && !shaped || segment.subs?.length || segment.stdin?.length)
     return null;
   const { words } = stripPrefixes(segment.words);
   const name = commandName(words[0]);
@@ -18485,7 +18508,7 @@ var SHELLS, POWERSHELLS, EVALS, WRAPPERS, WRAPPER_VALUES, KEYWORDS, DECLARATIONS
     ...Object.keys(env).length ? { env } : {},
     ...stdin === undefined ? {} : { stdin }
   };
-}, RECENT, LAUNCHERS, WORKIT_PACKAGE, PACKAGE_RUNNERS, WORKIT_GLOBAL, PUSH_VALUE_OPTIONS, VALUE_OPTIONS, API_VALUES, API_FIELDS, GIT_COMMANDS;
+}, RECENT, LAUNCHERS, WORKIT_PACKAGE, PACKAGE_RUNNERS, OUTPUT_FILTERS, WORKIT_GLOBAL, PUSH_VALUE_OPTIONS, VALUE_OPTIONS, API_VALUES, API_FIELDS, GIT_COMMANDS;
 var init_raw_git = __esm(() => {
   init_branch();
   init_branch_policy();
@@ -18569,6 +18592,7 @@ var init_raw_git = __esm(() => {
   ]);
   WORKIT_PACKAGE = /^@brainervirus\/workit-cli(?:@\S*)?$/;
   PACKAGE_RUNNERS = new Set(["npx", "bunx", "pnpx"]);
+  OUTPUT_FILTERS = new Set(["tail", "head", "grep"]);
   WORKIT_GLOBAL = /^--(?:cwd|session|token|as)(=|$)/;
   PUSH_VALUE_OPTIONS = new Set(["-o", "--push-option", "--receive-pack", "--exec", "--repo"]);
   VALUE_OPTIONS = {
@@ -66801,7 +66825,7 @@ function permissionHealth(host, options = {}) {
     detail: `${target.file} lacks ${missing.length} Workit entr${missing.length === 1 ? "y" : "ies"} (${missing[0]}${missing.length > 1 ? ", …" : ""})`
   };
 }
-var PERMISSION_HOSTS, CLAUDE_ALLOW, CLAUDE_ASK, AUTO_MODE_ENVIRONMENT = "Org-specific CLIs: workit — the user's delivery CLI. Its push, pr merge, release and PR-thread verbs run only under per-workspace grants and non-author verdicts the user configured in ~/.config/workit, outside the agent's reach.", AUTO_MODE_ALLOW = "Workit-gated delivery: `workit pr merge`, `workit git push --force-with-lease` on the session's own branch, `workit release` and `workit pr reply/resolve` on the session's repo are authorized by the user's standing Workit grants; not Merge Without Review, Git Destructive or External System Writes. Does NOT cover `--unverified`, `--admin` or any bypass flag.", DEFAULTS2 = "$defaults", CURSOR_ALLOW, CODEX_HEADER, codexRulesText = () => {
+var PERMISSION_HOSTS, CLAUDE_ALLOW, CLAUDE_ASK, AUTO_MODE_ENVIRONMENT = "Org-specific CLIs: workit — the user's delivery CLI. Its push, pr merge, release and PR-thread verbs run only under per-workspace grants and non-author verdicts the user configured in ~/.config/workit, outside the agent's reach.", AUTO_MODE_ALLOW = "Workit-gated delivery: `workit pr merge`, `workit git push --force-with-lease` on the session's own branch, `workit release` and `workit pr reply/resolve` on the session's repo are authorized by the user's standing Workit grants; not Merge Without Review, Git Destructive or External System Writes. Does NOT cover `--unverified`, `--admin` or any bypass flag.", DEFAULTS2 = "$defaults", CHECK_NAMES, LOCK_VERBS, LEASE_PREFIXES, CURSOR_ALLOW, CODEX_HEADER, codexRulesText = () => {
   const rules = [...WORKIT_ALLOWED_VERBS, "--version"].map((verb) => {
     const examples = verb === "git" ? `
     match = [["workit", "git", "push", "--cwd", "/w"]],
@@ -66813,6 +66837,12 @@ var PERMISSION_HOSTS, CLAUDE_ALLOW, CLAUDE_ASK, AUTO_MODE_ENVIRONMENT = "Org-spe
 )
 `;
   });
+  const lease = LEASE_PREFIXES.map((rest) => `prefix_rule(
+    pattern = ${JSON.stringify(["workit", ...rest])},
+    decision = "allow",
+    justification = "Workit heavy-check lease: runs the repo's configured check, or reads the lease",
+)
+`);
   const grant = `prefix_rule(
     pattern = ["workit", "grant"],
     decision = "prompt",
@@ -66820,7 +66850,7 @@ var PERMISSION_HOSTS, CLAUDE_ALLOW, CLAUDE_ASK, AUTO_MODE_ENVIRONMENT = "Org-spe
 )
 `;
   return `${CODEX_HEADER}
-${[...rules, grant].join(`
+${[...rules, ...lease, grant].join(`
 `)}`;
 }, isRecord5 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), emptyOwned = () => ({ lists: {}, created: [], env: {} }), clone4 = (value) => structuredClone(value), objectAt = (root, keys, owned) => {
   let node = root;
@@ -66971,8 +67001,15 @@ var init_host_permissions = __esm(() => {
     "Bash(workit * --unverified*)",
     "Bash(workit * --overwrite-unintegrated*)"
   ];
+  CHECK_NAMES = ["test", "lint", "typecheck", "build", "format", "docs"];
+  LOCK_VERBS = ["status", "wait"];
+  LEASE_PREFIXES = [
+    ...CHECK_NAMES.map((name) => ["check", name]),
+    ...LOCK_VERBS.map((verb) => ["lock", verb])
+  ];
   CURSOR_ALLOW = [
     ...WORKIT_ALLOWED_VERBS.map((verb) => `Shell(workit ${verb})`),
+    ...LEASE_PREFIXES.map((rest) => `Shell(workit ${rest.join(" ")})`),
     "Shell(workit --version)"
   ];
   CODEX_HEADER = "# Workit-owned: written by `workit setup`, removed by `workit uninstall`.\n" + `# Workit's own grants, verdict gates and branch policy decide these verbs.
@@ -76211,7 +76248,7 @@ function heavyPlan(command, options) {
   const heavy = heavyLines(lines, options);
   if (!heavy.length)
     return { kind: "none" };
-  const simple = simpleCommand(command, dialect);
+  const simple = simpleCommand(command, dialect, 0, true);
   const single = simple && !WORKIT.test(baseName2(simple[0])) && heavyLines([simple], options)[0];
   const judged = single ? [{ words: lines.flat(), text: command }] : heavy.map((match) => ({
     words: match.line,
@@ -76223,7 +76260,7 @@ function heavyPlan(command, options) {
       if (!verdict.ok)
         return {
           kind: "passthrough",
-          note: `workit: \`${command.trim()}\` is heavy but runs outside the heavy-check lease because a host permission rule names it (or \`workit\` is allowlisted); the host decides.`
+          note: ""
         };
     }
   if (single) {
@@ -76233,7 +76270,7 @@ function heavyPlan(command, options) {
   const parts = heavy.map((match) => leaseCommand(match.line));
   return {
     kind: "split",
-    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run each heavy part alone as \`workit check --heavy -- <segment>\` (here: ${parts.map((part) => `\`${part}\``).join("; ")}); run the other parts as their own commands.`,
+    reason: `heavy_command: \`${command.trim()}\` chains heavy work (${heavy.map((match) => match.reason).join("; ")}) with other commands, and a chain cannot run under the machine-wide heavy-check lease. Run the heavy part alone, now: \`${parts[0]}\`; then run the other parts as their own commands${parts.length > 1 ? ", each heavy one the same way" : ""}.`,
     unblock: parts[0] ?? null
   };
 }
@@ -76836,6 +76873,8 @@ var init_resources = __esm(() => {
 // packages/workit-cli/src/verbs/check.ts
 var exports_check = {};
 __export(exports_check, {
+  OUTPUT_LINES: () => OUTPUT_LINES,
+  boundedOutput: () => boundedOutput,
   hostToolWaitCapMs: () => hostToolWaitCapMs,
   run: () => run11,
   workspaceResources: () => workspaceResources
@@ -76849,6 +76888,7 @@ function parse6(argv) {
     name: null,
     shell: false,
     heavy: false,
+    full: false,
     noLease: false,
     reason: null,
     waitMs: null,
@@ -76867,8 +76907,11 @@ function parse6(argv) {
     };
     if (flag === "--json")
       continue;
-    if (flag === "--shell") {
-      options.shell = true;
+    if (flag === "--shell" || flag === "--full") {
+      if (flag === "--shell")
+        options.shell = true;
+      else
+        options.full = true;
       continue;
     }
     if (flag === "--heavy" || flag === "--no-lease") {
@@ -77016,6 +77059,17 @@ function boundedArgv(argv) {
   const truncated = cut.length !== argv.length || cut.some((item, index) => item !== argv[index]);
   return { argv: cut, truncated };
 }
+function boundedOutput(log, lines) {
+  const all = tailLines(log, Number.MAX_SAFE_INTEGER);
+  if (all.length === 0)
+    return "";
+  const shown = all.slice(-lines);
+  const omitted = all.length - shown.length;
+  return `${omitted ? `… ${omitted} earlier line${omitted === 1 ? "" : "s"} omitted (the full log is named below; --full streams it)
+` : ""}${shown.join(`
+`)}
+`;
+}
 function hostToolWaitCapMs(env) {
   if (!env.CLAUDECODE && !env.OPENCODE && !env.OPENCODE_SESSION_ID)
     return null;
@@ -77145,6 +77199,10 @@ async function run11(argv, io) {
   }
   const relCwd = posix(path49.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
+  const shadowed = !configured && name !== null ? config.checks.find((item) => item.name === name) : undefined;
+  if (shadowed)
+    io.stderr(`note: "${name}" is configured as \`${shadowed.argv.join(" ")}\`; this ad-hoc run does not satisfy a configured gate (run workit check ${name})
+`);
   const actor = actorFromEnv(io.env);
   const branchKey = codeKey(io.cwd, { base: options.base });
   const detached = branchKey.tree === null ? worktreeTree(io.cwd) : null;
@@ -77187,7 +77245,7 @@ async function run11(argv, io) {
       ...sinks,
       ...wrapper ? { wrapper } : {},
       ...lease ? { onSpawn: (pid) => updateLease(lease, { pgid: pid }) } : {}
-    }), heavy?.wrapper ?? null, { onStdout: io.json ? io.stderr : io.stdout, onStderr: io.stderr });
+    }), heavy?.wrapper ?? null, options.full ? { onStdout: io.json ? io.stderr : io.stdout, onStderr: io.stderr } : { onStdout: () => {}, onStderr: () => {} });
     result = scoped.result;
     if (heavy && scoped.fallback) {
       io.stderr(`workit: the memory/CPU scope could not start (${scoped.fallback}); ran without it
@@ -77201,6 +77259,7 @@ async function run11(argv, io) {
   const modifiedWorktree = key.tree !== null && treeAfter !== key.tree;
   const store = storeRoot(io.cwd);
   const blob = store.ok ? storeLog(store.value.root, result.log) : null;
+  const logPath = store.ok && blob ? path49.join(store.value.root, blob.ref) : null;
   const tail = tailLines(result.log, TAIL_LINES);
   const passed = result.exitCode === 0 && !result.timedOut;
   const bounded = boundedArgv(command);
@@ -77273,6 +77332,7 @@ async function run11(argv, io) {
     patchId: key.patchId,
     logDigest: observation.logDigest,
     logRef: observation.logRef,
+    logPath,
     logTail: tail,
     outputBytes: result.outputBytes,
     logTruncated: result.truncated,
@@ -77289,18 +77349,21 @@ async function run11(argv, io) {
   const code = !passed ? "failed" : recordError ? recordError.code : "ok";
   const error = !passed ? result.timedOut ? `timed out after ${options.timeoutMs} ms` : result.spawnError ? `cannot start ${command[0]}: ${result.spawnError}` : `exited ${result.exitCode}` : recordError?.message;
   const label = name ?? command.join(" ");
-  const summary = `workit check ${label}: ${passed ? "passed" : error ?? "failed"} in ${result.durationMs} ms (${configured ? "configured" : "ad-hoc"}${name && !configured && config.checks.some((item) => item.name === name) ? `; not the configured command for "${name}"` : ""}); ${task.evidenceId ? `evidence ${task.evidenceId} on task ${task.task?.id}` : task.note ?? (task.error ? `task: ${task.error.message}` : "ledger only")}${observation.logRef ? `; log ${observation.logRef}` : ""}`;
+  const summary = `workit check ${label}: ${passed ? "passed, exit 0" : error ?? "failed"} in ${result.durationMs} ms (${configured ? "configured" : "ad-hoc"}${name && !configured && config.checks.some((item) => item.name === name) ? `; not the configured command for "${name}"` : ""}); ${task.evidenceId ? `evidence ${task.evidenceId} on task ${task.task?.id}` : task.note ?? (task.error ? `task: ${task.error.message}` : "ledger only")}; log: ${logPath ?? "not stored"}`;
   if (io.json)
     io.stdout(`${JSON.stringify({ ok: code === "ok", code, data, ...error ? { error } : {}, ...task.stillUnsatisfied[0] ? { unblock: task.stillUnsatisfied[0].unblock } : {} })}
 `);
   else {
+    if (!options.full)
+      io.stdout(boundedOutput(result.log, OUTPUT_LINES));
     io.stderr(`${summary}
 `);
     if (recordError && passed)
       io.stderr(`workit: ${recordError.message}
 `);
-    for (const gap of task.stillUnsatisfied)
-      io.stderr(`  still unsatisfied: ${gap.ruleId}: ${gap.reason}
+    if (!shadowed)
+      for (const gap of task.stillUnsatisfied)
+        io.stderr(`  still unsatisfied: ${gap.ruleId}: ${gap.reason}
 `);
   }
   if (!passed)
@@ -77309,7 +77372,7 @@ async function run11(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE4 = 'workit check <name> [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path49.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, HOST_TOOL_WAIT_CAP_MS = 1e5;
+var USAGE4 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path49.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, HOST_TOOL_WAIT_CAP_MS = 1e5;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -78578,18 +78641,18 @@ var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}
   const lines = redactText(`${run.stderr}
 ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trim()).filter((value) => value && !value.startsWith("hint:"));
   return lines.slice(-max).join(" / ").slice(0, 400) || "git failed";
-}, OUTPUT_LINES = 200, OUTPUT_LINE_CHARS = 1000, gitOutput = (run) => {
+}, OUTPUT_LINES2 = 200, OUTPUT_LINE_CHARS = 1000, gitOutput = (run) => {
   const lines = redactText(`${run.stderr}
 ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((value) => value.trim() && !value.trimStart().startsWith("hint:")).map((value) => value.length > OUTPUT_LINE_CHARS ? `${value.slice(0, OUTPUT_LINE_CHARS)}…` : value);
   if (!lines.length)
     return "git failed";
-  if (lines.length <= OUTPUT_LINES)
+  if (lines.length <= OUTPUT_LINES2)
     return lines.join(`
 `);
-  const half = OUTPUT_LINES / 2;
+  const half = OUTPUT_LINES2 / 2;
   return [
     ...lines.slice(0, half),
-    `… ${lines.length - OUTPUT_LINES} lines omitted …`,
+    `… ${lines.length - OUTPUT_LINES2} lines omitted …`,
     ...lines.slice(-half)
   ].join(`
 `);
@@ -84336,16 +84399,66 @@ async function rerun(argv, io) {
     "next: workit ci wait"
   ]);
 }
+async function logs(argv, io) {
+  const flags = parseFlags(argv, { pr: "value", branch: "value", failed: "boolean" });
+  if (typeof flags === "string")
+    return usage3(io, flags, LOGS_USAGE);
+  if (flags.positionals.length)
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, LOGS_USAGE);
+  if (!flags.booleans.has("failed"))
+    return usage3(io, "pass --failed: only the failing steps' tails are printed", LOGS_USAGE);
+  const pr = positiveInt(flags.values.pr, "--pr");
+  if (typeof pr === "string")
+    return usage3(io, pr, LOGS_USAGE);
+  if (pr && flags.values.branch)
+    return usage3(io, "pass --pr or --branch, not both", LOGS_USAGE);
+  const connected = connect(io, flags.values.branch);
+  if (!connected.ok)
+    return forgeFail(io, connected);
+  const resolved = connected.data;
+  const number = selectPr(io.cwd, resolved, { pr, branch: flags.values.branch ?? null });
+  if (!number.ok)
+    return forgeFail(io, number);
+  const status = resolved.forge.prStatus(number.data);
+  if (!status.ok)
+    return forgeFail(io, status);
+  const doc = buildStatusDoc(io.cwd, resolved, status.data, { logLines: LOG_LINES, behind: false });
+  if (!doc.ok)
+    return forgeFail(io, doc);
+  const data = {
+    pr: doc.data.number,
+    head: status.data.head.sha,
+    failing: doc.data.checks.failing.map((check) => ({
+      name: check.name,
+      url: check.url,
+      conclusion: check.conclusion,
+      logTail: check.logTail,
+      ...check.logError ? { logError: check.logError } : {}
+    }))
+  };
+  return emit(io, ok2(data), () => data.failing.length ? [
+    `PR #${data.pr} head ${data.head.slice(0, 7)}: ${data.failing.length} failing check${data.failing.length === 1 ? "" : "s"} (last ${LOG_LINES} log lines each)`,
+    ...data.failing.flatMap((check) => [
+      `x ${check.name}${check.conclusion ? ` (${check.conclusion})` : ""}${check.url ? ` ${check.url}` : ""}`,
+      ...check.logTail.length ? check.logTail.map((line) => `  ${line}`) : [
+        `  (no log: ${check.logError ?? "not an Actions job, or beyond the tails fetched"})`
+      ]
+    ])
+  ] : [`PR #${data.pr} head ${data.head.slice(0, 7)}: no failing checks`]);
+}
 async function run15(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "wait")
     return wait2(rest, io);
   if (sub === "rerun")
     return rerun(rest, io);
+  if (sub === "logs")
+    return logs(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown ci subcommand "${sub}"` : "missing ci subcommand", `${WAIT_USAGE}
-       ${RERUN_USAGE}`);
+       ${RERUN_USAGE}
+       ${LOGS_USAGE}`);
 }
-var WAIT_USAGE = "workit ci wait [--pr <n> | --branch <b>] [--head <sha>] [--timeout 20m] [--interval 30s] [--json]", RERUN_USAGE = "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force] [--json]", ONE_POLL_MS = 20000, MAX_POLL_ERRORS = 3, seconds = (ms) => `${Math.round(ms / 1000)}s`;
+var WAIT_USAGE = "workit ci wait [--pr <n> | --branch <b>] [--head <sha>] [--timeout 20m] [--interval 30s] [--json]", RERUN_USAGE = "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force] [--json]", LOGS_USAGE = "workit ci logs --failed [--pr <n> | --branch <b>] [--json]", LOG_LINES = 60, ONE_POLL_MS = 20000, MAX_POLL_ERRORS = 3, seconds = (ms) => `${Math.round(ms / 1000)}s`;
 var init_ci = __esm(() => {
   init_report();
   init_ledger();
@@ -86179,6 +86292,27 @@ function excludeScratch(cwd) {
 ${EXCLUDE_LINE}
 `);
 }
+function worktreeDependencies(main, worktree) {
+  for (const [name, install] of LOCKFILES2) {
+    const ours = readBytes(path62.join(main, name));
+    const theirs = readBytes(path62.join(worktree, name));
+    if (ours === null && theirs === null)
+      continue;
+    if (ours !== null && theirs !== null && ours.equals(theirs))
+      continue;
+    if (fs33.existsSync(path62.join(worktree, "node_modules")))
+      break;
+    const command = install(worktree);
+    return {
+      linked: null,
+      install: command,
+      notes: [
+        `${name} differs from the main checkout's (${main}), so its node_modules was not linked; install dependencies first: ${command}`
+      ]
+    };
+  }
+  return { ...linkWorktreeDependencies(main, worktree), install: null };
+}
 function ensureScratch(worktree) {
   const scratch = path62.join(worktree, SCRATCH_DIR);
   fs33.mkdirSync(scratch, { recursive: true });
@@ -86208,7 +86342,7 @@ function createSliceWorktree(cwd, plan, input) {
     if (!createdRow(cwd, plan, slice, target))
       return fanoutFail("blocked", `${target} is a worktree that workit fanout worktree create did not make for slice ${slice.id}`, `remove it yourself (git worktree remove ${target}) once you know what it holds`);
     excludeScratch(cwd);
-    const deps = linkWorktreeDependencies(mainCheckout(cwd), target);
+    const deps = worktreeDependencies(mainCheckout(cwd), target);
     return {
       ok: true,
       data: {
@@ -86218,6 +86352,7 @@ function createSliceWorktree(cwd, plan, input) {
         mode: resolveRef(cwd, localRef) ? "resume" : "new",
         created: false,
         dependencies: deps.linked,
+        install: deps.install,
         notes: [
           deps.linked ? "the worktree already exists; only its missing dependencies were linked" : "the worktree already exists; nothing was changed",
           ...deps.notes
@@ -86271,7 +86406,7 @@ function createSliceWorktree(cwd, plan, input) {
   }
   excludeScratch(cwd);
   const scratch = ensureScratch(target);
-  const deps = linkWorktreeDependencies(mainCheckout(cwd), target);
+  const deps = worktreeDependencies(mainCheckout(cwd), target);
   notes.push(...deps.notes);
   const head = gitRun4(target, ["rev-parse", "HEAD"]).stdout.trim();
   const baseSha = mode === "new" ? head : null;
@@ -86294,7 +86429,16 @@ function createSliceWorktree(cwd, plan, input) {
   });
   return {
     ok: true,
-    data: { ...base, scratch, head, mode, created: true, dependencies: deps.linked, notes }
+    data: {
+      ...base,
+      scratch,
+      head,
+      mode,
+      created: true,
+      dependencies: deps.linked,
+      install: deps.install,
+      notes
+    }
   };
 }
 function releaseSliceWorktree(cwd, plan, input) {
@@ -86433,7 +86577,13 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
 }, inside3 = (child, parent) => {
   const relative = path62.relative(canonical2(parent), canonical2(child));
   return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path62.isAbsolute(slice.worktree) ? slice.worktree : path62.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
+}, slicePath = (cwd, slice) => path62.isAbsolute(slice.worktree) ? slice.worktree : path62.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
+  try {
+    return fs33.readFileSync(file);
+  } catch {
+    return null;
+  }
+}, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
 `)[0] || "unknown error"}`);
 var init_fanout_worktree = __esm(() => {
   init_ops();
@@ -86447,6 +86597,13 @@ var init_fanout_worktree = __esm(() => {
   worktreeDeps = {
     stat: (file) => fs33.statSync(file, { bigint: true })
   };
+  LOCKFILES2 = [
+    ["bun.lock", (dir) => `bun install --frozen-lockfile --cwd ${dir}`],
+    ["bun.lockb", (dir) => `bun install --frozen-lockfile --cwd ${dir}`],
+    ["pnpm-lock.yaml", (dir) => `pnpm install --frozen-lockfile --dir ${dir}`],
+    ["yarn.lock", (dir) => `yarn install --frozen-lockfile --cwd ${dir}`],
+    ["package-lock.json", (dir) => `npm ci --prefix ${dir}`]
+  ];
 });
 
 // packages/workit-core/src/fanout-brief.ts
@@ -87805,6 +87962,8 @@ var USAGE13 = "workit ledger decision|ruling|verdict|standing|list|check ... (wo
   if (values.session !== undefined) {
     if (!SESSION_SAFE2.test(values.session))
       return new Error("--session must be 1-128 characters of [A-Za-z0-9_.:@/+-]");
+    if (namesOwnDerivedSession(io.env, values.session))
+      return { actor, source: "env" };
     return { actor: { ...actor, session: values.session }, source: "flag" };
   }
   if (values.as !== undefined) {
@@ -104787,10 +104946,13 @@ var init_changelog2 = __esm(() => {
 // packages/workit-cli/src/verbs/handoff.ts
 var exports_handoff = {};
 __export(exports_handoff, {
+  MAX_BRIEF_BYTES: () => MAX_BRIEF_BYTES,
   run: () => run26
 });
+import fs35 from "node:fs";
+import path70 from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
-function human2(brief) {
+function render3(brief) {
   const lines = [
     `branch: ${brief.branch ?? "(detached)"} @ ${short7(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
   ];
@@ -104810,14 +104972,42 @@ function human2(brief) {
     lines.push(`last handoff (${brief.lastHandoff.at}): ${brief.lastHandoff.next}${brief.lastHandoff.note ? ` (note: ${brief.lastHandoff.note})` : ""}`);
   if (brief.recent.length)
     lines.push("recent ledger:", ...brief.recent.map((row) => `  #${row.seq} ${row.type}${row.branch ? ` [${row.branch}]` : ""}${row.labels.length ? ` (${row.labels.join(", ")})` : ""}  ${row.summary}`));
+  const tail = [];
   if (brief.note)
-    lines.push(`note:   ${brief.note}`);
-  lines.push(`next:   ${brief.next}`);
+    tail.push(`note:   ${brief.note}`);
+  tail.push(`next:   ${brief.next}`);
   if (brief.next !== brief.nextCommand)
-    lines.push(`next command: ${brief.nextCommand}`);
+    tail.push(`next command: ${brief.nextCommand}`);
   if (brief.recorded)
-    lines.push(`recorded handoff ${brief.recorded}`);
-  return lines;
+    tail.push(`recorded handoff ${brief.recorded}`);
+  return { body: lines, tail };
+}
+function bounded(brief, cwd) {
+  const { body, tail } = render3(brief);
+  if (bytes([...body, ...tail]) <= MAX_BRIEF_BYTES)
+    return [...body, ...tail];
+  const store = storeRoot(cwd);
+  let file = null;
+  if (store.ok)
+    try {
+      const dir = path70.join(store.value.root, "handoff");
+      fs35.mkdirSync(dir, { recursive: true });
+      file = path70.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
+      fs35.writeFileSync(file, `${[...body, ...tail].join(`
+`)}
+`, { mode: 384 });
+    } catch {
+      file = null;
+    }
+  const pointer = `… cut to ${MAX_BRIEF_BYTES} bytes; full brief: ${file ?? "not written (workit handoff --json has it all)"}`;
+  const kept = [];
+  for (const line of body) {
+    const cut = line.length > 400 ? `${line.slice(0, 400)}…` : line;
+    if (bytes([...kept, cut, pointer, ...tail]) > MAX_BRIEF_BYTES)
+      break;
+    kept.push(cut);
+  }
+  return [...kept, pointer, ...tail];
 }
 async function resumeBrief(argv, io) {
   let values;
@@ -104855,7 +105045,7 @@ async function resumeBrief(argv, io) {
       return emit(io, fail2(row.code, row.error, { data: { ...data, recorded } }));
     recorded = row.value.id;
   }
-  return emit(io, ok2({ ...data, recorded }), human2);
+  return emit(io, ok2({ ...data, recorded }), (brief) => bounded(brief, io.cwd));
 }
 async function run26(argv, io) {
   if (!argv.some((arg) => arg === "--task" || arg.startsWith("--task=")))
@@ -104863,7 +105053,9 @@ async function run26(argv, io) {
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
 }
-var USAGE18 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short7 = (sha) => sha ? sha.slice(0, 12) : "no commit";
+var USAGE18 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", MAX_BRIEF_BYTES = 4096, short7 = (sha) => sha ? sha.slice(0, 12) : "no commit", bytes = (lines) => Buffer.byteLength(`${lines.join(`
+`)}
+`);
 var init_handoff = __esm(() => {
   init_ledger();
   init_output();
@@ -104872,7 +105064,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_host_session();
 init_package();
-import path70 from "node:path";
+import path71 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -104977,7 +105169,8 @@ var LEASE_NOTES = [
   "The heavy-check lease: heavy work (tests, builds, lint, typecheck, installs, image builds) shares one machine-wide lease, so parallel agents and worktrees never exhaust this machine's memory and CPU. `slots` (default 1) heavy checks run at once; on Linux each also runs in a systemd scope with MemoryMax and CPUQuota.",
   "Waiting: a heavy check that finds every slot held prints one `waiting for the heavy-check lease` line naming the holder (check, pid, session, age, directory), polls once a second, and exits 4 (busy) after `--wait <s>`, else `resources.wait` seconds (default 600, capped at 100 inside a Claude Code or OpenCode shell). `workit lock status` shows the holders; `workit lock wait` waits for a free slot.",
   "--heavy: an ad-hoc `workit check -- <cmd>` takes the lease only with --heavy; the named checks test, build and typecheck always do. The shell hook runs a raw heavy command (`npx jest`, `npm run test:ci`, `cargo test`, `docker build`) as `workit check --heavy -- <cmd>` on Claude Code, OpenCode and Pi, and denies it with that exact command on Codex and Cursor.",
-  '--no-lease skips the lease and needs --reason "<why>". Never hand-roll a flock: the lease already queues every agent on the machine.'
+  '--no-lease skips the lease and needs --reason "<why>". Never hand-roll a flock: the lease already queues every agent on the machine.',
+  "Output: a check prints the last 60 lines of its output and one summary line with `log: <path>` to the full log; --full streams all of it."
 ];
 var VERIFY_OPTIONS = "[--expect pushed|pr|merged|released] [--pr <n> | --branch <b>] [--sha <sha>] [--tag <t>] [--package <name[@version]>]";
 var LEDGER_ACTOR = "[--branch <b> | --pr <n>] [--supersedes <id>] [--session <id> [--token <t>] | --as <role>]";
@@ -105060,7 +105253,7 @@ var VERBS = [
   {
     name: "check",
     group: "delivery",
-    usage: 'workit check <name> [--task <id>] [--base <ref>] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--base <ref>] [--heavy [--wait <s>]] [--no-lease --reason "<why>"] -- <cmd…>',
+    usage: 'workit check <name> [--full] [--task <id>] [--base <ref>] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--full] [--timeout <s>] [--task <id>] [--base <ref>] [--heavy [--wait <s>]] [--no-lease --reason "<why>"] -- <cmd…>',
     flagHints: {
       list: "workit check <name> runs a configured check; a name that is not configured prints the valid ones (workit check test|lint|typecheck|check)"
     },
@@ -105180,7 +105373,7 @@ var VERBS = [
   withSubcommands({
     name: "ci",
     group: "delivery",
-    summary: "Wait for CI on the PR head (exit 0/1/3/4), or rerun failed jobs once per head",
+    summary: "Wait for CI on the PR head (exit 0/1/3/4), read the failing jobs' log tails, or rerun failed jobs once per head",
     subcommands: [
       {
         name: "wait",
@@ -105191,9 +105384,18 @@ var VERBS = [
         name: "rerun",
         usage: "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force]",
         summary: "Rerun failed jobs once per head, with a recorded reason"
+      },
+      {
+        name: "logs",
+        usage: "workit ci logs --failed [--pr <n> | --branch <b>]",
+        summary: "The failing checks of the PR head, each with its job log's last 60 lines"
       }
     ],
-    examples: ["workit ci wait --timeout 30m", "workit ci rerun --failed --reason flake"],
+    examples: [
+      "workit ci wait --timeout 30m",
+      "workit ci logs --failed",
+      "workit ci rerun --failed --reason flake"
+    ],
     load: () => Promise.resolve().then(() => (init_ci(), exports_ci))
   }),
   withSubcommands({
@@ -105734,7 +105936,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path70.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path71.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail2("invalid_input", parsed.error));