@brainervirus/workit-claude-code 8.38.1 → 8.38.3

package/dist/workit.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.38.1",
+    version: "8.38.3",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.38.1",
+      "@brainervirus/workit-cursor": "^8.38.3",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.38.1"
+      "@brainervirus/workit-core": "^8.38.3"
     },
     engines: {
       node: ">=24"
@@ -69625,8 +69625,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return `${minutes} min ago`;
   const hours = Math.round(minutes / 60);
   return hours < 48 ? `${hours} h ago` : `${Math.round(hours / 24)} d ago`;
-}, checkHookRuns = (res) => {
-  const runs = readHookRuns(res.hookStateDir).filter((run) => run.event === "PreToolUse" || run.event === "SessionStart");
+}, HOOK_RUN_BASELINE, checkHookRuns = (res) => {
+  const runs = readHookRuns(res.hookStateDir);
   if (runs.length === 0)
     return {
       id: "hook_runs",
@@ -69636,7 +69636,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const now = Date.now();
   const hosts = [...new Set(runs.map((run) => run.host))].toSorted();
   const parts = hosts.map((host) => {
-    const seen = ["SessionStart", "PreToolUse"].map((event) => {
+    const others = runs.filter((run) => run.host === host && !HOOK_RUN_BASELINE.includes(run.event)).map((run) => run.event).toSorted();
+    const seen = [...HOOK_RUN_BASELINE, ...new Set(others)].map((event) => {
       const run = runs.find((r) => r.host === host && r.event === event);
       return `${event} ${run ? `${ago(now - Date.parse(run.at))} (${run.count})` : "never"}`;
     });
@@ -69703,6 +69704,7 @@ var init_doctor = __esm(() => {
   DAY_MS = 24 * 60 * 60 * 1000;
   SEMVER = /\d+\.\d+\.\d+/;
   workitVersions = new Map;
+  HOOK_RUN_BASELINE = ["SessionStart", "PreToolUse"];
   RUN_CHECKS = [
     checkRuntime,
     checkVersions,
@@ -74836,171 +74838,156 @@ var init_setup2 = __esm(() => {
   ALL_HOSTS = ["claude-code", "codex", "cursor", "opencode", "pi"];
 });
 
-// packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
-import {
-  existsSync as existsSync20,
-  mkdtempSync as mkdtempSync3,
-  rmSync as rmSync8,
-  readFileSync as readFileSync21,
-  readdirSync as readdirSync12,
-  mkdirSync as mkdirSync11,
-  copyFileSync as copyFileSync6,
-  chmodSync as chmodSync2,
-  cpSync as cpSync5,
-  lstatSync as lstatSync7
-} from "node:fs";
+// packages/workit-cli/src/upgrade/shared.ts
+import { existsSync as existsSync20, readFileSync as readFileSync21 } from "node:fs";
 import path44 from "node:path";
 import os16 from "node:os";
 import { createHash as createHash15 } from "node:crypto";
-function previewUpgrade(hosts = HOSTS2, deps = {}) {
-  const paths = upgradePaths(deps);
-  const { home, configDir } = paths;
-  const run = runner(deps);
-  const state = readSetupState(configDir);
-  const plan = {
-    ok: true,
-    blocked: [],
-    failed: [],
-    skipped: [],
-    entries: [],
-    configDigests: {},
-    migrations: []
+var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-opencode", OPENCODE_UPDATE, CODEX_MARKETPLACE = "workflow-toolkit", CLI_FIX = "npm install --global @brainervirus/workit-cli@latest", fixFor = (host, selector = "") => host === "pi" ? `pi update --extension ${selector || "npm:@brainervirus/workit-pi"}` : host === "codex" ? `codex plugin marketplace upgrade ${CODEX_MARKETPLACE} && codex plugin add workit@${CODEX_MARKETPLACE}` : host === "claude-code" ? "claude plugin marketplace update workit && claude plugin update workit@workit" : host === "opencode" ? OPENCODE_UPDATE : host === "cursor" ? "workit upgrade --hosts=cursor" : CLI_FIX, upgradePaths = (deps) => {
+  const home = deps.home ?? deps.env?.HOME ?? os16.homedir();
+  const env = {
+    ...process.env,
+    ...deps.home || deps.env?.HOME ? {
+      HOME: home,
+      CODEX_HOME: path44.join(home, ".codex"),
+      CLAUDE_CONFIG_DIR: path44.join(home, ".claude"),
+      PI_CODING_AGENT_DIR: path44.join(home, ".pi/agent"),
+      XDG_CONFIG_HOME: path44.join(home, ".config"),
+      WORKFLOW_TOOLKIT_CONFIG: undefined,
+      WORKFLOW_TOOLKIT_CONFIG_DIR: undefined
+    } : {},
+    ...deps.env,
+    HOME: home
   };
-  for (const file of [state.config, state.workspaces, state.youtrack, state.vcs]) {
-    if (file.status === "malformed")
-      plan.blocked.push(file.error ?? file.file);
-    plan.configDigests[file.file] = digest2(file.file);
+  const xdg = env.XDG_CONFIG_HOME || path44.join(home, ".config");
+  const codexHome = env.CODEX_HOME ?? path44.join(home, ".codex");
+  return {
+    home,
+    env,
+    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path44.join(xdg, "workit"),
+    opencodeConfig: path44.join(xdg, "opencode/opencode.json"),
+    piSettings: path44.join(env.PI_CODING_AGENT_DIR ?? path44.join(home, ".pi/agent"), "settings.json"),
+    codexHome,
+    codexConfig: path44.join(codexHome, "config.toml"),
+    cursorRoot: path44.join(home, ".cursor/plugins/local/workit")
+  };
+}, object2 = (file) => {
+  if (!existsSync20(file))
+    return null;
+  let data;
+  try {
+    data = JSON.parse(readFileSync21(file, "utf8"));
+  } catch {
+    throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
   }
-  for (const file of [
-    paths.opencodeConfig,
-    paths.opencodeConfig + "c",
-    path44.join(home, ".cursor/settings.json"),
-    path44.join(home, ".cursor/mcp.json"),
-    path44.join(paths.cursorRoot, "package.json"),
-    paths.codexConfig,
-    paths.piSettings
-  ])
-    plan.configDigests[file] = digest2(file);
+  if (!data || typeof data !== "object" || Array.isArray(data))
+    throw new Error(`${file} is not a configuration object`);
+  return data;
+}, objectOrNull = (file) => {
   try {
-    const config = object2(state.config.file);
-    if (config && Object.hasOwn(config, "trustedPaths"))
-      plan.migrations.push({
-        id: "2.0-remove-ignored-trusted-paths",
-        file: state.config.file,
-        description: "Remove ignored Workit trustedPaths; native host permissions remain unchanged"
-      });
-  } catch (error) {
-    plan.blocked.push(errorText(error));
+    return object2(file);
+  } catch {
+    return null;
   }
-  const installedSources = sources(paths, run, hosts, plan.failed);
-  let opencodeHelp;
-  if (installedSources.some((source) => source.host === "opencode")) {
-    const probe = opencodeProbe(deps, ["--version"]);
-    const installed = probe.status === 0 ? probe.stdout.match(/\d+\.\d+\.\d+/)?.[0] : undefined;
-    if (installed && !versionAtLeast(installed, SUPPORT_MATRIX.opencode.minimum))
-      (plan.warnings ??= []).push(`opencode ${installed}: ${OPENCODE_V1_FIX}`);
+}, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync21(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+  const { home, env } = upgradePaths(deps);
+  let step;
+  try {
+    step = hostCommand(command, args, { home, env });
+  } catch {
+    return { status: 1, stdout: "" };
   }
-  for (const host of ["opencode", "pi"]) {
-    if (new Set(installedSources.filter((source) => source.host === host).map((source) => source.selector)).size > 1)
-      plan.failed.push({
-        host,
-        status: "failed",
-        reason: "conflicting Workit registrations; reconcile them in the native host before upgrading"
-      });
+  const result = runHostCommand(step, { home, env });
+  return { status: result.exitCode, stdout: result.stdout };
+}), errorText = (error) => error instanceof Error ? error.message : "installed source could not be read", piInstalledVersion = (listing, selector) => {
+  const lines = listing.split(/\r?\n/).map((line) => line.trim());
+  const index = lines.indexOf(selector);
+  if (index < 0 || !lines[index + 1] || !path44.isAbsolute(lines[index + 1]))
+    return;
+  const found = objectOrNull(path44.join(lines[index + 1], "package.json"));
+  return found?.name === "@brainervirus/workit-pi" ? found.version : undefined;
+}, versionAtLeast = (installed, latest) => {
+  if (!/^\d+\.\d+\.\d+$/.test(installed))
+    return false;
+  const current = installed.split(".").map(Number);
+  const target = latest.split(".").map(Number);
+  for (let index = 0;index < 3; index++) {
+    if (current[index] !== target[index])
+      return current[index] > target[index];
   }
-  const conflicted = new Set(plan.failed.map((entry) => entry.host));
-  for (const source of installedSources.filter((candidate, index, list) => !conflicted.has(candidate.host) && list.findIndex((entry) => entry.host === candidate.host && entry.selector === candidate.selector) === index)) {
-    if (source.kind === "pinned" || source.kind === "local") {
-      plan.skipped.push({
-        host: source.host,
-        reason: `${source.kind} source preserved; change its source explicitly to upgrade`
-      });
-      continue;
-    }
-    if (source.host === "claude-code") {
-      const [market] = source.selector.split("@").slice(1);
-      plan.entries.push({
-        host: "claude-code",
-        selector: source.selector,
-        latest: "",
-        installedVersion: source.installedVersion,
-        commands: [
-          {
-            command: "claude",
-            args: ["plugin", "marketplace", "update", market ?? "workit"]
-          },
-          { command: "claude", args: ["plugin", "update", source.selector] }
-        ],
-        fix: `claude plugin marketplace update ${market ?? "workit"} && claude plugin update ${source.selector}`
-      });
-      continue;
-    }
-    if (source.host === "opencode") {
-      opencodeHelp ??= opencodeProbe(deps, ["plugin", "--help"]).stdout;
-      if (!/^\s*(?:opencode\s+plugin\s+)?update\b/m.test(opencodeHelp)) {
-        plan.skipped.push({
-          host: "opencode",
-          reason: "this OpenCode has no `opencode plugin update`; upgrade OpenCode, then run the fix. Workit never updates unrelated plugins",
-          fix: OPENCODE_UPDATE
-        });
-        continue;
-      }
-      plan.entries.push({
-        host: "opencode",
-        selector: source.selector,
-        latest: "",
-        commands: [{ command: "opencode", args: ["plugin", "update", OPENCODE_PACKAGE] }],
-        fix: OPENCODE_UPDATE
-      });
-      continue;
-    }
-    const latest = registryVersion(run, `@brainervirus/workit-${source.host}`);
-    if (!latest) {
-      plan.failed.push({
-        host: source.host,
-        status: "failed",
-        reason: "registry version unavailable; existing installation preserved",
-        fix: fixFor(source.host, source.selector)
-      });
-      continue;
-    }
-    if (source.installedVersion && versionAtLeast(source.installedVersion, latest)) {
-      plan.skipped.push({
-        host: source.host,
-        reason: `already current (${source.installedVersion})`
-      });
-      continue;
-    }
-    const commands = source.host === "pi" ? [{ command: "pi", args: ["update", "--extension", source.selector] }] : source.host === "codex" ? [
-      {
-        command: "codex",
-        args: ["plugin", "marketplace", "upgrade", CODEX_MARKETPLACE]
-      },
-      {
-        command: "codex",
-        args: ["plugin", "add", `workit@${CODEX_MARKETPLACE}`, "--json"]
-      }
-    ] : planHostInstall("cursor", {
-      home,
-      env: deps.env,
-      cwd: home,
-      packageVersion: latest,
-      targetDir: paths.cursorRoot
-    });
-    plan.entries.push({
-      host: source.host,
-      selector: source.selector,
-      latest,
-      commands,
-      installedVersion: source.installedVersion,
-      ...source.kind === "repair" ? { repair: true } : {},
-      fix: fixFor(source.host, source.selector)
+  return true;
+}, registryVersion = (run, name) => {
+  const latest = run("npm", ["view", name, "version"]);
+  const version = latest.stdout.trim();
+  return latest.status === 0 && /^\d+\.\d+\.\d+$/.test(version) ? version : undefined;
+};
+var init_shared = __esm(() => {
+  init_host_install();
+  LAUNCH_HOSTS = ["opencode", "cursor", "codex", "pi"];
+  HOSTS2 = [...LAUNCH_HOSTS, "claude-code"];
+  LIVE_HOSTS = new Set(["opencode", "claude-code"]);
+  OPENCODE_UPDATE = `opencode plugin update ${OPENCODE_PACKAGE}`;
+});
+
+// packages/workit-cli/src/upgrade/processes.ts
+import path45 from "node:path";
+var PROCESS_HOSTS, SCRIPT_RUNTIMES, classifyProcess = (proc) => {
+  if (proc.state.startsWith("Z") || proc.args.includes("<defunct>"))
+    return null;
+  const argv0 = proc.args.trim().split(/\s+/)[0] ?? "";
+  const baseName = (value) => path45.basename(value.replaceAll("\\", "/")).replace(/^\[|\]$/g, "").replace(/\.exe$/i, "").toLowerCase();
+  let host = PROCESS_HOSTS[baseName(argv0)];
+  if (!host && SCRIPT_RUNTIMES.has(baseName(argv0))) {
+    const script = proc.args.trim().split(/\s+/).slice(1).find((arg) => !arg.startsWith("-"));
+    if (script)
+      host = PROCESS_HOSTS[baseName(script).replace(/\.(?:[cm]?js|ts)$/, "")];
+  }
+  if (!host)
+    return null;
+  if (host === "codex" && /\bapp-server\b/.test(proc.args))
+    return /\bdaemon\s+pid-update-loop\b/.test(proc.args) ? null : { ...proc, host, kind: "daemon" };
+  if (host === "opencode" && /\bserve\b/.test(proc.args))
+    return { ...proc, host, kind: "daemon" };
+  return { ...proc, host, kind: "session" };
+}, listProcesses = (deps) => {
+  if (deps.processes)
+    return deps.processes();
+  if (deps.activeHosts)
+    return deps.activeHosts().map((host) => ({ pid: 0, state: "S", args: host }));
+  const run = runner(deps);
+  if (process.platform === "win32") {
+    const list = run("tasklist", ["/fo", "csv", "/nh"]);
+    if (list.status !== 0)
+      return null;
+    return list.stdout.split(/\r?\n/).flatMap((line) => {
+      const [image, pid] = line.split('","').map((cell) => cell.replaceAll('"', ""));
+      return image && /^\d+$/.test(pid ?? "") ? [{ pid: Number(pid), state: "R", args: image }] : [];
     });
   }
-  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
-  return plan;
-}
+  const list = run("ps", ["-eo", "pid=,stat=,args="]);
+  if (list.status !== 0)
+    return null;
+  return list.stdout.split(/\r?\n/).flatMap((line) => {
+    const match = /^\s*(\d+)\s+(\S+)\s+(.+)$/.exec(line);
+    return match ? [{ pid: Number(match[1]), state: match[2], args: match[3] }] : [];
+  });
+}, describe2 = (proc) => `pid ${proc.pid}: ${proc.args.length > 120 ? `${proc.args.slice(0, 117)}...` : proc.args}`;
+var init_processes = __esm(() => {
+  init_shared();
+  PROCESS_HOSTS = {
+    claude: "claude-code",
+    codex: "codex",
+    cursor: "cursor",
+    opencode: "opencode",
+    pi: "pi"
+  };
+  SCRIPT_RUNTIMES = new Set(["node", "nodejs", "bun"]);
+});
+
+// packages/workit-cli/src/upgrade/apply.ts
+import { existsSync as existsSync21, readdirSync as readdirSync12, mkdirSync as mkdirSync11, copyFileSync as copyFileSync6, chmodSync as chmodSync2, cpSync as cpSync5 } from "node:fs";
+import path46 from "node:path";
+import { createHash as createHash16 } from "node:crypto";
 function applyUpgrade(plan, deps = {}) {
   const hosts = [...plan.failed];
   const done = (backup) => {
@@ -75034,11 +75021,11 @@ function applyUpgrade(plan, deps = {}) {
       };
   const paths = upgradePaths(deps);
   const { home, configDir } = paths;
-  const backup = path44.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
+  const backup = path46.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
   mkdirSync11(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
-    if (existsSync20(file)) {
-      const target = path44.join(backup, createHash15("sha256").update(file).digest("hex").slice(0, 12) + "-" + path44.basename(file));
+    if (existsSync21(file)) {
+      const target = path46.join(backup, createHash16("sha256").update(file).digest("hex").slice(0, 12) + "-" + path46.basename(file));
       copyFileSync6(file, target);
       chmodSync2(target, 384);
     }
@@ -75057,9 +75044,11 @@ function applyUpgrade(plan, deps = {}) {
   }
   const run = runner(deps);
   let cursorBackupError = null;
-  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync20(paths.cursorRoot))
+  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync21(paths.cursorRoot))
     try {
-      cpSync5(paths.cursorRoot, path44.join(backup, "cursor-package"), { recursive: true });
+      cpSync5(paths.cursorRoot, path46.join(backup, "cursor-package"), {
+        recursive: true
+      });
     } catch (error) {
       cursorBackupError = `could not back up the Cursor plugin: ${errorText(error)}`;
     }
@@ -75067,7 +75056,12 @@ function applyUpgrade(plan, deps = {}) {
   const running = (listed ?? []).flatMap((entry) => classifyProcess(entry) ?? []);
   for (const entry of plan.entries) {
     if (entry.host === "cursor" && cursorBackupError) {
-      hosts.push({ host: "cursor", status: "failed", reason: cursorBackupError, fix: entry.fix });
+      hosts.push({
+        host: "cursor",
+        status: "failed",
+        reason: cursorBackupError,
+        fix: entry.fix
+      });
       continue;
     }
     if (!LIVE_HOSTS.has(entry.host)) {
@@ -75176,238 +75170,356 @@ function applyUpgrade(plan, deps = {}) {
     try {
       hosts.push(applyCli(plan.cli, run, backup));
     } catch (error) {
-      hosts.push({ host: "cli", status: "failed", reason: errorText(error), fix: CLI_FIX });
+      hosts.push({
+        host: "cli",
+        status: "failed",
+        reason: errorText(error),
+        fix: CLI_FIX
+      });
     }
   return done(backup);
 }
-async function runUpgradeCommand(argv, deps = {}) {
-  const out = deps.out ?? process.stdout;
-  const flags = new Set(argv);
-  const unknown = argv.filter((arg) => !["--apply", "--confirm", "--json", "--cli", "--preview", "--yes"].includes(arg) && !arg.startsWith("--hosts="));
-  const hostFlag = argv.find((arg) => arg.startsWith("--hosts="))?.slice(8);
-  const raw = hostFlag === "none" ? [] : hostFlag?.split(",") ?? HOSTS2;
-  if (unknown.length || raw.some((host) => !HOSTS2.includes(host)) || flags.has("--preview") && (flags.has("--apply") || flags.has("--yes"))) {
-    out.write(USAGE3);
-    return 2;
+var codexPluginRoot = (codexHome) => {
+  const dir = path46.join(codexHome, "plugins", "cache", CODEX_MARKETPLACE, "workit");
+  let versions = [];
+  try {
+    versions = readdirSync12(dir).filter((version) => /^\d+\.\d+\.\d+$/.test(version));
+  } catch {
+    return null;
   }
-  if (flags.has("--apply") && !flags.has("--confirm")) {
-    out.write(`Apply requires --confirm after reviewing the upgrade preview.
-`);
-    return 2;
+  const newest = versions.reduce((best, version) => best && versionAtLeast(best, version) ? best : version, null);
+  return newest ? path46.join(dir, newest) : null;
+}, opencodeVersion = (run) => {
+  const listing = run("opencode", ["plugin", "list"]);
+  if (listing.status !== 0)
+    return;
+  for (const line of listing.stdout.split(/\r?\n/)) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 3)
+      continue;
+    const source = fields[fields.length - 1].replace(/^file:\/\//, "");
+    const version = fields[fields.length - 2];
+    if (/^(?:npm:)?@brainervirus\/workit-opencode(?:@[^/\s]+)?$/.test(source) && /^\d+\.\d+\.\d+$/.test(version))
+      return version;
   }
-  const legacy = flags.has("--apply");
-  const json = flags.has("--json") || legacy;
-  const run = runner(deps);
-  const plan = previewUpgrade(raw, deps);
-  if (hostFlag === undefined || flags.has("--cli"))
-    planCli(plan, run);
-  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
-  const { home, env } = upgradePaths(deps);
-  const permissions = planHostPermissions({
-    hosts: raw,
-    refreshOnly: true,
-    shell: false,
-    home,
-    env
+  return;
+}, applyEntry = (entry, context) => {
+  const { run, paths, configDir } = context;
+  const { home, env } = paths;
+  const fail = (reason) => ({
+    host: entry.host,
+    status: "failed",
+    reason,
+    fix: entry.fix
   });
-  const permissionPreview = {
-    changes: permissions.changes.map((c) => ({
-      host: c.host,
-      file: c.file,
-      diff: permissionDiff(c)
-    })),
-    ...permissions.refused ? { refused: permissions.refused } : {}
-  };
-  const withPermissions = (value) => permissions.changes.length ? { ...value, permissions: permissionPreview } : value;
-  const applyCommand = `workit upgrade ${[...hostFlag === undefined ? [] : [`--hosts=${hostFlag}`], ...flags.has("--cli") ? ["--cli"] : [], "--yes"].join(" ")}`;
-  const nothingChanged = `preview only; nothing changed. Apply with: ${applyCommand}
-`;
-  if (json && !legacy && !flags.has("--yes")) {
-    out.write(JSON.stringify(withPermissions(plan), null, 2) + `
-`);
-    return plan.blocked.length ? 1 : 0;
+  if (entry.host === "cursor") {
+    const preview = {
+      ok: true,
+      blocked: [],
+      preserved: [],
+      overrides: [],
+      platforms: ["cursor"],
+      state: readSetupState(configDir),
+      mutations: [
+        {
+          type: "install-host",
+          platform: "cursor",
+          path: path46.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
+          commands: entry.commands.map((command) => ({
+            ...command,
+            purpose: command.purpose ?? "Upgrade Cursor"
+          }))
+        },
+        { type: "install-adapter", platform: "cursor", path: paths.cursorRoot }
+      ]
+    };
+    const result = applySetupPreview(preview, {
+      home,
+      env,
+      cwd: home,
+      preferInstalledAdapter: true,
+      runHostCommand: (command) => {
+        const outcome = run(command.command, command.args);
+        return {
+          exitCode: outcome.status ?? 1,
+          stdout: outcome.stdout,
+          stderr: ""
+        };
+      }
+    });
+    const installed = objectOrNull(path46.join(paths.cursorRoot, "package.json"));
+    if (!result.ok || installed?.version !== entry.latest)
+      return fail("Cursor install did not verify the requested package version; inspect the installer before retrying");
+    return {
+      host: "cursor",
+      status: "updated",
+      reason: entry.repair ? `reinstalled missing plugin files (${entry.latest})` : `${entry.installedVersion ?? "?"} -> ${entry.latest}`
+    };
   }
-  if (!json)
-    out.write(summary(plan, permissions.changes));
-  if (flags.has("--preview")) {
-    out.write(nothingChanged);
-    return plan.blocked.length ? 1 : 0;
+  const before = entry.host === "opencode" ? opencodeVersion(run) : undefined;
+  for (const command of entry.commands)
+    if (run(command.command, command.args).status !== 0)
+      return fail(`\`${command.command} ${command.args.join(" ")}\` failed`);
+  if (entry.host === "opencode") {
+    const after = opencodeVersion(run);
+    if (before && after)
+      return after === before ? {
+        host: "opencode",
+        status: "current",
+        reason: `already current (${after})`
+      } : {
+        host: "opencode",
+        status: "updated",
+        reason: `${before} -> ${after}; OpenCode V2 loads it live`
+      };
+    return {
+      host: "opencode",
+      status: "updated",
+      reason: "scoped update ran; OpenCode V2 loads it live"
+    };
   }
-  if (plan.blocked.length) {
-    out.write(`Upgrade blocked: ${plan.blocked.join("; ")}
-Nothing changed.
-`);
-    return 1;
+  if (entry.host === "claude-code") {
+    const after = claudeWorkitInstalls(home, env, null).find((install) => install.id === entry.selector)?.version;
+    return after && after === entry.installedVersion ? {
+      host: "claude-code",
+      status: "current",
+      reason: `already current (${after})`
+    } : {
+      host: "claude-code",
+      status: "updated",
+      reason: `${entry.installedVersion ?? "?"} -> ${after ?? "?"}; new sessions load it`
+    };
   }
-  const work = plan.entries.length + plan.migrations.length + (plan.cli ? 1 : 0) + permissions.changes.length;
-  if (work > 0 && !flags.has("--yes") && !legacy) {
-    const confirmed = await (deps.confirm ?? ((q) => askConfirm(q, out)))("Apply this upgrade? [y/N] ");
-    if (!confirmed) {
-      out.write(nothingChanged);
-      return 0;
-    }
+  const verify = entry.host === "codex" ? run("codex", ["plugin", "list", "--json"]) : run("pi", ["list"]);
+  if (verify.status !== 0)
+    return fail("update verification failed");
+  if (entry.host === "codex") {
+    let installed = [];
+    try {
+      installed = JSON.parse(verify.stdout).installed ?? [];
+    } catch {}
+    if (!installed.some((plugin) => plugin.name === "workit" && plugin.marketplaceName === CODEX_MARKETPLACE && plugin.version === entry.latest))
+      return fail("Codex did not report the requested Workit version");
   }
-  if (json)
-    for (const warning of plan.warnings ?? [])
-      out.write(`warning: ${warning}
-`);
-  const result = applyUpgrade(plan, deps);
-  let permissionsOk = true;
-  let written;
-  if (permissions.changes.length && !permissions.refused && !result.error?.startsWith("configuration changed")) {
-    written = applyHostPermissions(permissions, { home, env });
-    permissionsOk = written.every((entry) => entry.status === "written");
-    for (const entry of written)
-      result.hosts.push({
-        host: entry.host,
-        status: entry.status === "written" ? "updated" : "failed",
-        reason: `permission block ${entry.status === "written" ? "refreshed" : entry.status} in ${entry.file}`,
-        ...entry.status === "written" ? {} : { fix: `workit setup --hosts=${entry.host}` }
+  if (entry.host === "pi" && piInstalledVersion(verify.stdout, entry.selector) !== entry.latest)
+    return fail("Pi did not report the requested Workit package version");
+  return {
+    host: entry.host,
+    status: "updated",
+    reason: entry.repair ? `reinstalled missing plugin files (${entry.latest})` : `${entry.installedVersion ?? "?"} -> ${entry.latest}`
+  };
+}, refreshCodexAgents = (run, codexHome) => {
+  const root = codexPluginRoot(codexHome);
+  const launcher = root && path46.join(root, "dist", "launch-mcp.js");
+  if (!launcher || !existsSync21(launcher))
+    return { ok: true, note: "" };
+  const fix = `node ${JSON.stringify(launcher)} --install-agents`;
+  return run("node", [launcher, "--install-agents"]).status === 0 ? { ok: true, note: "agents refreshed" } : { ok: false, note: "agent refresh failed", fix };
+}, applyCli = (cli, run, backup) => {
+  const fail = (reason) => ({
+    host: "cli",
+    status: "failed",
+    reason,
+    fix: CLI_FIX
+  });
+  const currentRoot = run("npm", ["root", "--global"]);
+  if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== cli.root)
+    return fail("Global npm location changed; preview again");
+  const cliBackup = path46.join(backup, "cli-package");
+  cpSync5(path46.join(cli.root, "@brainervirus/workit-cli"), cliBackup, {
+    recursive: true
+  });
+  if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${cli.latest}`]).status !== 0)
+    return fail(`CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path46.join(cliBackup, "dist/index.js")}`);
+  const installed = objectOrNull(path46.join(cli.root, "@brainervirus/workit-cli/package.json"));
+  if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== cli.latest)
+    return fail(`CLI update did not verify the requested version; preserved package at ${cliBackup}`);
+  return {
+    host: "cli",
+    status: "updated",
+    reason: `${cli.installed} -> ${cli.latest}`
+  };
+};
+var init_apply = __esm(() => {
+  init_host_install();
+  init_setup_state();
+  init_setup();
+  init_safe_write();
+  init_processes();
+  init_shared();
+});
+
+// packages/workit-cli/src/upgrade/plan.ts
+import { existsSync as existsSync22, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync7, readFileSync as readFileSync22 } from "node:fs";
+import path47 from "node:path";
+import os17 from "node:os";
+function previewUpgrade(hosts = HOSTS2, deps = {}) {
+  const paths = upgradePaths(deps);
+  const { home, configDir } = paths;
+  const run = runner(deps);
+  const state = readSetupState(configDir);
+  const plan = {
+    ok: true,
+    blocked: [],
+    failed: [],
+    skipped: [],
+    entries: [],
+    configDigests: {},
+    migrations: []
+  };
+  for (const file of [state.config, state.workspaces, state.youtrack, state.vcs]) {
+    if (file.status === "malformed")
+      plan.blocked.push(file.error ?? file.file);
+    plan.configDigests[file.file] = digest2(file.file);
+  }
+  for (const file of [
+    paths.opencodeConfig,
+    paths.opencodeConfig + "c",
+    path47.join(home, ".cursor/settings.json"),
+    path47.join(home, ".cursor/mcp.json"),
+    path47.join(paths.cursorRoot, "package.json"),
+    paths.codexConfig,
+    paths.piSettings
+  ])
+    plan.configDigests[file] = digest2(file);
+  try {
+    const config = object2(state.config.file);
+    if (config && Object.hasOwn(config, "trustedPaths"))
+      plan.migrations.push({
+        id: "2.0-remove-ignored-trusted-paths",
+        file: state.config.file,
+        description: "Remove ignored Workit trustedPaths; native host permissions remain unchanged"
       });
+  } catch (error) {
+    plan.blocked.push(errorText(error));
   }
-  const failed = !result.ok || !permissionsOk;
-  const cliVersion = result.hosts.some((h) => h.host === "cli" && h.status === "updated") ? plan.cli.latest : package_default.version;
-  const report = (deps.doctor ?? ((version) => runDoctor({ home, env, cliVersion: version, only: "upgrade" })))(cliVersion);
-  const left = report.checks.filter((check) => check.status === "warn" || check.status === "fail");
-  if (json) {
-    out.write(JSON.stringify({
-      ...result,
-      ok: !failed,
-      ...written ? { permissions: { changes: permissionPreview.changes, written } } : permissions.refused ? { permissions: permissionPreview } : {},
-      doctor: { clean: left.length === 0, left }
-    }, null, 2) + `
-`);
-    return failed ? 1 : 0;
+  const installedSources = sources(paths, run, hosts, plan.failed);
+  let opencodeHelp;
+  if (installedSources.some((source) => source.host === "opencode")) {
+    const probe = opencodeProbe(deps, ["--version"]);
+    const installed = probe.status === 0 ? probe.stdout.match(/\d+\.\d+\.\d+/)?.[0] : undefined;
+    if (installed && !versionAtLeast(installed, SUPPORT_MATRIX.opencode.minimum))
+      (plan.warnings ??= []).push(`opencode ${installed}: ${OPENCODE_V1_FIX}`);
   }
-  if (result.error && result.hosts.every((h) => h.status !== "failed"))
-    out.write(`Upgrade stopped: ${result.error}
-`);
-  out.write(table(result.hosts));
-  if (permissions.refused)
-    out.write(`permissions: not refreshed: ${permissions.refused}
-`);
-  if (result.backup)
-    out.write(`Backup: ${result.backup}
-`);
-  out.write(left.length === 0 ? `Verified: workit doctor is clean for versions, assets, agents and permissions.
-` : `Left after upgrade (workit doctor):
-${left.map((check) => `  ${check.id}: ${check.detail}${check.fix ? `
-    fix: ${check.fix}` : ""}`).join(`
-`)}
-`);
-  return failed ? 1 : 0;
-}
-async function runLaunchCommand(argv, deps = {}) {
-  const [host, ...args] = argv;
-  if (!LAUNCH_HOSTS.includes(host)) {
-    (deps.out ?? process.stdout).write(`Usage: workit launch <opencode|cursor|codex|pi> [--auto-upgrade] [-- host arguments]
-`);
-    return 2;
+  for (const host of ["opencode", "pi"]) {
+    if (new Set(installedSources.filter((source) => source.host === host).map((source) => source.selector)).size > 1)
+      plan.failed.push({
+        host,
+        status: "failed",
+        reason: "conflicting Workit registrations; reconcile them in the native host before upgrading"
+      });
   }
-  const auto = args[0] === "--auto-upgrade";
-  const rest = auto ? args.slice(1) : args;
-  const hostArgs = rest[0] === "--" ? rest.slice(1) : rest;
-  const { home, env } = upgradePaths(deps);
-  let launch;
-  if (!deps.run) {
-    try {
-      launch = hostCommand(host, hostArgs, { home, env });
-    } catch (error) {
-      (deps.out ?? process.stderr).write(`${error instanceof Error ? error.message : "Host executable unavailable"}
-`);
-      return 1;
+  const conflicted = new Set(plan.failed.map((entry) => entry.host));
+  for (const source of installedSources.filter((candidate, index, list) => !conflicted.has(candidate.host) && list.findIndex((entry) => entry.host === candidate.host && entry.selector === candidate.selector) === index)) {
+    if (source.kind === "pinned" || source.kind === "local") {
+      plan.skipped.push({
+        host: source.host,
+        reason: `${source.kind} source preserved; change its source explicitly to upgrade`
+      });
+      continue;
     }
-  }
-  if (auto) {
-    const plan = previewUpgrade([host], deps);
-    const reasons = [...plan.blocked, ...plan.failed.map((entry) => entry.reason)];
-    if (plan.ok) {
-      for (const skipped of plan.skipped)
-        (deps.out ?? process.stderr).write(`${skipped.host}: ${skipped.reason}${skipped.fix ? ` (run: ${skipped.fix})` : ""}
-`);
-      const result = applyUpgrade(plan, deps);
-      if (!result.ok) {
-        (deps.out ?? process.stdout).write(`${result.error}
-`);
-        return 1;
+    if (source.host === "claude-code") {
+      const [market] = source.selector.split("@").slice(1);
+      plan.entries.push({
+        host: "claude-code",
+        selector: source.selector,
+        latest: "",
+        installedVersion: source.installedVersion,
+        commands: [
+          {
+            command: "claude",
+            args: ["plugin", "marketplace", "update", market ?? "workit"]
+          },
+          { command: "claude", args: ["plugin", "update", source.selector] }
+        ],
+        fix: `claude plugin marketplace update ${market ?? "workit"} && claude plugin update ${source.selector}`
+      });
+      continue;
+    }
+    if (source.host === "opencode") {
+      opencodeHelp ??= opencodeProbe(deps, ["plugin", "--help"]).stdout;
+      if (!/^\s*(?:opencode\s+plugin\s+)?update\b/m.test(opencodeHelp)) {
+        plan.skipped.push({
+          host: "opencode",
+          reason: "this OpenCode has no `opencode plugin update`; upgrade OpenCode, then run the fix. Workit never updates unrelated plugins",
+          fix: OPENCODE_UPDATE
+        });
+        continue;
       }
-    } else if (plan.blocked.length === 0 && reasons.every((reason) => reason.includes("registry version unavailable"))) {
-      (deps.out ?? process.stderr).write(`Upgrade unavailable: ${reasons.join("; ")}. Starting the unchanged host.
-`);
-    } else {
-      (deps.out ?? process.stderr).write(`Upgrade blocked: ${reasons.join("; ")}
-`);
-      return 1;
+      plan.entries.push({
+        host: "opencode",
+        selector: source.selector,
+        latest: "",
+        commands: [{ command: "opencode", args: ["plugin", "update", OPENCODE_PACKAGE] }],
+        fix: OPENCODE_UPDATE
+      });
+      continue;
     }
+    const latest = registryVersion(run, `@brainervirus/workit-${source.host}`);
+    if (!latest) {
+      plan.failed.push({
+        host: source.host,
+        status: "failed",
+        reason: "registry version unavailable; existing installation preserved",
+        fix: fixFor(source.host, source.selector)
+      });
+      continue;
+    }
+    if (source.installedVersion && versionAtLeast(source.installedVersion, latest)) {
+      plan.skipped.push({
+        host: source.host,
+        reason: `already current (${source.installedVersion})`
+      });
+      continue;
+    }
+    const commands = source.host === "pi" ? [{ command: "pi", args: ["update", "--extension", source.selector] }] : source.host === "codex" ? [
+      {
+        command: "codex",
+        args: ["plugin", "marketplace", "upgrade", CODEX_MARKETPLACE]
+      },
+      {
+        command: "codex",
+        args: ["plugin", "add", `workit@${CODEX_MARKETPLACE}`, "--json"]
+      }
+    ] : planHostInstall("cursor", {
+      home,
+      env: deps.env,
+      cwd: home,
+      packageVersion: latest,
+      targetDir: paths.cursorRoot
+    });
+    plan.entries.push({
+      host: source.host,
+      selector: source.selector,
+      latest,
+      commands,
+      installedVersion: source.installedVersion,
+      ...source.kind === "repair" ? { repair: true } : {},
+      fix: fixFor(source.host, source.selector)
+    });
   }
-  if (deps.run)
-    return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync17(launch.command, launch.args, {
-    stdio: "inherit",
-    env
-  }).status ?? 1;
+  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
+  return plan;
 }
-var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-opencode", OPENCODE_UPDATE, CODEX_MARKETPLACE = "workflow-toolkit", CLI_FIX = "npm install --global @brainervirus/workit-cli@latest", fixFor = (host, selector = "") => host === "pi" ? `pi update --extension ${selector || "npm:@brainervirus/workit-pi"}` : host === "codex" ? `codex plugin marketplace upgrade ${CODEX_MARKETPLACE} && codex plugin add workit@${CODEX_MARKETPLACE}` : host === "claude-code" ? "claude plugin marketplace update workit && claude plugin update workit@workit" : host === "opencode" ? OPENCODE_UPDATE : host === "cursor" ? "workit upgrade --hosts=cursor" : CLI_FIX, upgradePaths = (deps) => {
-  const home = deps.home ?? deps.env?.HOME ?? os16.homedir();
-  const env = {
-    ...process.env,
-    ...deps.home || deps.env?.HOME ? {
-      HOME: home,
-      CODEX_HOME: path44.join(home, ".codex"),
-      CLAUDE_CONFIG_DIR: path44.join(home, ".claude"),
-      PI_CODING_AGENT_DIR: path44.join(home, ".pi/agent"),
-      XDG_CONFIG_HOME: path44.join(home, ".config"),
-      WORKFLOW_TOOLKIT_CONFIG: undefined,
-      WORKFLOW_TOOLKIT_CONFIG_DIR: undefined
-    } : {},
-    ...deps.env,
-    HOME: home
-  };
-  const xdg = env.XDG_CONFIG_HOME || path44.join(home, ".config");
-  const codexHome = env.CODEX_HOME ?? path44.join(home, ".codex");
-  return {
-    home,
-    env,
-    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path44.join(xdg, "workit"),
-    opencodeConfig: path44.join(xdg, "opencode/opencode.json"),
-    piSettings: path44.join(env.PI_CODING_AGENT_DIR ?? path44.join(home, ".pi/agent"), "settings.json"),
-    codexHome,
-    codexConfig: path44.join(codexHome, "config.toml"),
-    cursorRoot: path44.join(home, ".cursor/plugins/local/workit")
-  };
-}, object2 = (file) => {
-  if (!existsSync20(file))
-    return null;
-  let data;
-  try {
-    data = JSON.parse(readFileSync21(file, "utf8"));
-  } catch {
-    throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
-  }
-  if (!data || typeof data !== "object" || Array.isArray(data))
-    throw new Error(`${file} is not a configuration object`);
-  return data;
-}, objectOrNull = (file) => {
-  try {
-    return object2(file);
-  } catch {
-    return null;
-  }
-}, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync21(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
-  const { home, env } = upgradePaths(deps);
-  let step;
+var codexRegistered = (configFile) => {
+  let text;
   try {
-    step = hostCommand(command, args, { home, env });
+    text = readFileSync22(configFile, "utf8");
   } catch {
-    return { status: 1, stdout: "" };
+    return false;
   }
-  const result = runHostCommand(step, { home, env });
-  return { status: result.exitCode, stdout: result.stdout };
-}), classify = (host, selector) => ({
+  const header = `[plugins."workit@${CODEX_MARKETPLACE}"]`;
+  const start = text.split(/\r?\n/).findIndex((line) => line.trim() === header);
+  if (start < 0)
+    return false;
+  const body = text.split(/\r?\n/).slice(start + 1).join(`
+`).split(/^\s*\[/m)[0];
+  return !/^\s*enabled\s*=\s*false\b/m.test(body);
+}, classify = (host, selector) => ({
   host,
   selector,
   kind: selector === `@brainervirus/workit-${host}` || selector === `@brainervirus/workit-${host}@latest` || selector === `npm:@brainervirus/workit-${host}` || selector === `npm:@brainervirus/workit-${host}@latest` ? "floating" : new RegExp(`^(?:npm:)?@brainervirus/workit-${host}@[^/]+$`).test(selector) ? "pinned" : "local"
-}), errorText = (error) => error instanceof Error ? error.message : "installed source could not be read", sources = (paths, run, hosts, failed) => {
+}), sources = (paths, run, hosts, failed) => {
   const { home } = paths;
   const result = [];
   const guard = (host, read) => {
@@ -75425,7 +75537,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
     }
   };
   guard("opencode", () => {
-    if (existsSync20(paths.opencodeConfig + "c"))
+    if (existsSync22(paths.opencodeConfig + "c"))
       throw new Error("OpenCode JSONC config is present; inspect effective native configuration before updating");
     const oc = object2(paths.opencodeConfig);
     if (oc && [oc.plugins, oc.plugin].some((value) => value !== undefined && !Array.isArray(value)))
@@ -75435,8 +75547,8 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
         result.push(classify("opencode", pin));
   });
   guard("cursor", () => {
-    const cursor = objectOrNull(path44.join(paths.cursorRoot, "package.json"));
-    const mcp = objectOrNull(path44.join(home, ".cursor/mcp.json"));
+    const cursor = objectOrNull(path47.join(paths.cursorRoot, "package.json"));
+    const mcp = objectOrNull(path47.join(home, ".cursor/mcp.json"));
     const args = mcp?.mcpServers?.workit?.args ?? [];
     const arg = args.find((value) => typeof value === "string" && value.startsWith("--package="));
     const selector = typeof arg === "string" ? arg.slice(10) : "local";
@@ -75447,7 +75559,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       });
       return;
     }
-    const settings = objectOrNull(path44.join(home, ".cursor/settings.json"));
+    const settings = objectOrNull(path47.join(home, ".cursor/settings.json"));
     const dirs = Array.isArray(settings?.plugin_dirs) ? settings.plugin_dirs : [];
     const registered = mcp?.mcpServers?.workit !== undefined || dirs.some((dir) => String(dir).replaceAll("\\", "/").replace(/\/+$/, "").endsWith("local/workit"));
     if (registered)
@@ -75462,7 +75574,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       if (typeof source !== "string")
         continue;
       const npm = /^(?:npm:)?@brainervirus\/workit-pi(?:@[^/]+)?$/.test(source);
-      const local = path44.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path44.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
+      const local = path47.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path47.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
       if (!npm && !local)
         continue;
       const found = classify("pi", source);
@@ -75482,7 +75594,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
         hostCommand("codex", [], { home, env: paths.env });
         available = true;
       } catch {}
-      if (available || existsSync20(paths.codexConfig))
+      if (available || existsSync22(paths.codexConfig))
         throw new Error("Codex plugin inventory failed; inspect the native host before upgrading");
       return;
     }
@@ -75504,6 +75616,12 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
         installedVersion: plugin.version
       });
     }
+    if (!result.some((found) => found.host === "codex") && codexRegistered(paths.codexConfig))
+      result.push({
+        host: "codex",
+        selector: "@brainervirus/workit-codex",
+        kind: "repair"
+      });
   });
   guard("claude-code", () => {
     for (const install of claudeWorkitInstalls(home, paths.env, null))
@@ -75515,213 +75633,24 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       });
   });
   return result;
-}, piInstalledVersion = (listing, selector) => {
-  const lines = listing.split(/\r?\n/).map((line) => line.trim());
-  const index = lines.indexOf(selector);
-  if (index < 0 || !lines[index + 1] || !path44.isAbsolute(lines[index + 1]))
-    return;
-  const found = objectOrNull(path44.join(lines[index + 1], "package.json"));
-  return found?.name === "@brainervirus/workit-pi" ? found.version : undefined;
-}, versionAtLeast = (installed, latest) => {
-  if (!/^\d+\.\d+\.\d+$/.test(installed))
-    return false;
-  const current = installed.split(".").map(Number);
-  const target = latest.split(".").map(Number);
-  for (let index = 0;index < 3; index++) {
-    if (current[index] !== target[index])
-      return current[index] > target[index];
-  }
-  return true;
 }, opencodeProbe = (deps, args) => {
-  const scratch = mkdtempSync3(path44.join(os16.tmpdir(), "workit-upgrade-opencode-"));
+  const scratch = mkdtempSync3(path47.join(os17.tmpdir(), "workit-upgrade-opencode-"));
   try {
     return runner({
       ...deps,
       env: {
         ...deps.env,
-        XDG_DATA_HOME: path44.join(scratch, "data"),
-        XDG_STATE_HOME: path44.join(scratch, "state"),
-        XDG_CACHE_HOME: path44.join(scratch, "cache")
+        XDG_DATA_HOME: path47.join(scratch, "data"),
+        XDG_STATE_HOME: path47.join(scratch, "state"),
+        XDG_CACHE_HOME: path47.join(scratch, "cache")
       }
     })("opencode", args);
   } finally {
     rmSync8(scratch, { recursive: true, force: true });
   }
-}, registryVersion = (run, name) => {
-  const latest = run("npm", ["view", name, "version"]);
-  const version = latest.stdout.trim();
-  return latest.status === 0 && /^\d+\.\d+\.\d+$/.test(version) ? version : undefined;
-}, PROCESS_HOSTS, classifyProcess = (proc) => {
-  if (proc.state.startsWith("Z") || proc.args.includes("<defunct>"))
-    return null;
-  const argv0 = proc.args.trim().split(/\s+/)[0] ?? "";
-  const name = path44.basename(argv0.replaceAll("\\", "/")).replace(/^\[|\]$/g, "").replace(/\.exe$/i, "").toLowerCase();
-  const host = PROCESS_HOSTS[name];
-  if (!host)
-    return null;
-  if (host === "codex" && /\bapp-server\b/.test(proc.args))
-    return /\bdaemon\s+pid-update-loop\b/.test(proc.args) ? null : { ...proc, host, kind: "daemon" };
-  if (host === "opencode" && /\bserve\b/.test(proc.args))
-    return { ...proc, host, kind: "daemon" };
-  return { ...proc, host, kind: "session" };
-}, listProcesses = (deps) => {
-  if (deps.processes)
-    return deps.processes();
-  if (deps.activeHosts)
-    return deps.activeHosts().map((host) => ({ pid: 0, state: "S", args: host }));
-  const run = runner(deps);
-  if (process.platform === "win32") {
-    const list = run("tasklist", ["/fo", "csv", "/nh"]);
-    if (list.status !== 0)
-      return null;
-    return list.stdout.split(/\r?\n/).flatMap((line) => {
-      const [image, pid] = line.split('","').map((cell) => cell.replaceAll('"', ""));
-      return image && /^\d+$/.test(pid ?? "") ? [{ pid: Number(pid), state: "R", args: image }] : [];
-    });
-  }
-  const list = run("ps", ["-eo", "pid=,stat=,args="]);
-  if (list.status !== 0)
-    return null;
-  return list.stdout.split(/\r?\n/).flatMap((line) => {
-    const match = /^\s*(\d+)\s+(\S+)\s+(.+)$/.exec(line);
-    return match ? [{ pid: Number(match[1]), state: match[2], args: match[3] }] : [];
-  });
-}, describe2 = (proc) => `pid ${proc.pid}: ${proc.args.length > 120 ? `${proc.args.slice(0, 117)}...` : proc.args}`, codexPluginRoot = (codexHome) => {
-  const dir = path44.join(codexHome, "plugins", "cache", CODEX_MARKETPLACE, "workit");
-  let versions = [];
-  try {
-    versions = readdirSync12(dir).filter((version) => /^\d+\.\d+\.\d+$/.test(version));
-  } catch {
-    return null;
-  }
-  const newest = versions.reduce((best, version) => best && versionAtLeast(best, version) ? best : version, null);
-  return newest ? path44.join(dir, newest) : null;
-}, applyEntry = (entry, context) => {
-  const { run, paths, configDir } = context;
-  const { home, env } = paths;
-  const fail = (reason) => ({
-    host: entry.host,
-    status: "failed",
-    reason,
-    fix: entry.fix
-  });
-  if (entry.host === "cursor") {
-    const preview = {
-      ok: true,
-      blocked: [],
-      preserved: [],
-      overrides: [],
-      platforms: ["cursor"],
-      state: readSetupState(configDir),
-      mutations: [
-        {
-          type: "install-host",
-          platform: "cursor",
-          path: path44.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
-          commands: entry.commands.map((command) => ({
-            ...command,
-            purpose: command.purpose ?? "Upgrade Cursor"
-          }))
-        },
-        { type: "install-adapter", platform: "cursor", path: paths.cursorRoot }
-      ]
-    };
-    const result = applySetupPreview(preview, {
-      home,
-      env,
-      cwd: home,
-      preferInstalledAdapter: true,
-      runHostCommand: (command) => {
-        const outcome = run(command.command, command.args);
-        return {
-          exitCode: outcome.status ?? 1,
-          stdout: outcome.stdout,
-          stderr: ""
-        };
-      }
-    });
-    const installed = objectOrNull(path44.join(paths.cursorRoot, "package.json"));
-    if (!result.ok || installed?.version !== entry.latest)
-      return fail("Cursor install did not verify the requested package version; inspect the installer before retrying");
-    return {
-      host: "cursor",
-      status: "updated",
-      reason: entry.repair ? `reinstalled missing plugin files (${entry.latest})` : `${entry.installedVersion ?? "?"} -> ${entry.latest}`
-    };
-  }
-  for (const command of entry.commands)
-    if (run(command.command, command.args).status !== 0)
-      return fail(`\`${command.command} ${command.args.join(" ")}\` failed`);
-  if (entry.host === "opencode")
-    return {
-      host: "opencode",
-      status: "updated",
-      reason: "scoped update ran; OpenCode V2 loads it live"
-    };
-  if (entry.host === "claude-code") {
-    const after = claudeWorkitInstalls(home, env, null).find((install) => install.id === entry.selector)?.version;
-    return after && after === entry.installedVersion ? {
-      host: "claude-code",
-      status: "current",
-      reason: `already current (${after})`
-    } : {
-      host: "claude-code",
-      status: "updated",
-      reason: `${entry.installedVersion ?? "?"} -> ${after ?? "?"}; new sessions load it`
-    };
-  }
-  const verify = entry.host === "codex" ? run("codex", ["plugin", "list", "--json"]) : run("pi", ["list"]);
-  if (verify.status !== 0)
-    return fail("update verification failed");
-  if (entry.host === "codex") {
-    let installed = [];
-    try {
-      installed = JSON.parse(verify.stdout).installed ?? [];
-    } catch {}
-    if (!installed.some((plugin) => plugin.name === "workit" && plugin.marketplaceName === CODEX_MARKETPLACE && plugin.version === entry.latest))
-      return fail("Codex did not report the requested Workit version");
-  }
-  if (entry.host === "pi" && piInstalledVersion(verify.stdout, entry.selector) !== entry.latest)
-    return fail("Pi did not report the requested Workit package version");
-  return {
-    host: entry.host,
-    status: "updated",
-    reason: `${entry.installedVersion ?? "?"} -> ${entry.latest}`
-  };
-}, refreshCodexAgents = (run, codexHome) => {
-  const root = codexPluginRoot(codexHome);
-  const launcher = root && path44.join(root, "dist", "launch-mcp.js");
-  if (!launcher || !existsSync20(launcher))
-    return { ok: true, note: "" };
-  const fix = `node ${JSON.stringify(launcher)} --install-agents`;
-  return run("node", [launcher, "--install-agents"]).status === 0 ? { ok: true, note: "agents refreshed" } : { ok: false, note: "agent refresh failed", fix };
-}, applyCli = (cli, run, backup) => {
-  const fail = (reason) => ({
-    host: "cli",
-    status: "failed",
-    reason,
-    fix: CLI_FIX
-  });
-  const currentRoot = run("npm", ["root", "--global"]);
-  if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== cli.root)
-    return fail("Global npm location changed; preview again");
-  const cliBackup = path44.join(backup, "cli-package");
-  cpSync5(path44.join(cli.root, "@brainervirus/workit-cli"), cliBackup, {
-    recursive: true
-  });
-  if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${cli.latest}`]).status !== 0)
-    return fail(`CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path44.join(cliBackup, "dist/index.js")}`);
-  const installed = objectOrNull(path44.join(cli.root, "@brainervirus/workit-cli/package.json"));
-  if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== cli.latest)
-    return fail(`CLI update did not verify the requested version; preserved package at ${cliBackup}`);
-  return {
-    host: "cli",
-    status: "updated",
-    reason: `${cli.installed} -> ${cli.latest}`
-  };
 }, planCli = (plan, run) => {
   const root = run("npm", ["root", "--global"]);
-  if (root.status !== 0 || !path44.isAbsolute(root.stdout.trim())) {
+  if (root.status !== 0 || !path47.isAbsolute(root.stdout.trim())) {
     plan.skipped.push({
       host: "cli",
       reason: "global npm location could not be verified",
@@ -75729,9 +75658,9 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
     });
     return;
   }
-  const packageFile = path44.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
+  const packageFile = path47.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
   const installed = objectOrNull(packageFile);
-  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync7(path44.dirname(packageFile)).isSymbolicLink()) {
+  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync7(path47.dirname(packageFile)).isSymbolicLink()) {
     plan.skipped.push({
       host: "cli",
       reason: "no managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
@@ -75758,7 +75687,18 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       host: "cli",
       reason: `already current (${installed.version})`
     });
-}, pad2 = (text) => text.padEnd(12), summary = (plan, permissions) => {
+};
+var init_plan = __esm(() => {
+  init_registration();
+  init_setup_state();
+  init_host_install();
+  init_doctor();
+  init_support_matrix();
+  init_shared();
+});
+
+// packages/workit-cli/src/upgrade/report.ts
+var pad2 = (text) => text.padEnd(12), summary = (plan, permissions) => {
   const lines = ["Workit upgrade plan:"];
   if (plan.cli)
     lines.push(`  ${pad2("cli")}update ${plan.cli.installed} -> ${plan.cli.latest}`);
@@ -75795,29 +75735,8 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
   }
   await Promise.resolve().then(() => init_prompt());
   return /^y(?:es)?$/i.test((await askLine(question)).trim());
-}, USAGE3 = `Usage: workit upgrade [--hosts=opencode,cursor,codex,pi,claude-code|none] [--cli] [--preview | --yes | --apply --confirm] [--json]
-`;
-var init_upgrade = __esm(() => {
-  init_package();
-  init_registration();
-  init_setup_state();
-  init_host_install();
-  init_setup();
-  init_doctor();
-  init_support_matrix();
-  init_safe_write();
-  init_host_permissions();
-  LAUNCH_HOSTS = ["opencode", "cursor", "codex", "pi"];
-  HOSTS2 = [...LAUNCH_HOSTS, "claude-code"];
-  LIVE_HOSTS = new Set(["opencode", "claude-code"]);
-  OPENCODE_UPDATE = `opencode plugin update ${OPENCODE_PACKAGE}`;
-  PROCESS_HOSTS = {
-    claude: "claude-code",
-    codex: "codex",
-    cursor: "cursor",
-    opencode: "opencode",
-    pi: "pi"
-  };
+};
+var init_report = __esm(() => {
   LABEL = {
     updated: "updated",
     current: "already current",
@@ -75826,6 +75745,191 @@ var init_upgrade = __esm(() => {
   };
 });
 
+// packages/workit-cli/src/upgrade.ts
+import { spawnSync as spawnSync17 } from "node:child_process";
+async function runUpgradeCommand(argv, deps = {}) {
+  const out = deps.out ?? process.stdout;
+  const flags = new Set(argv);
+  const unknown = argv.filter((arg) => !["--apply", "--confirm", "--json", "--cli", "--preview", "--yes"].includes(arg) && !arg.startsWith("--hosts="));
+  const hostFlag = argv.find((arg) => arg.startsWith("--hosts="))?.slice(8);
+  const raw = hostFlag === "none" ? [] : hostFlag?.split(",") ?? HOSTS2;
+  if (unknown.length || raw.some((host) => !HOSTS2.includes(host)) || flags.has("--preview") && (flags.has("--apply") || flags.has("--yes"))) {
+    out.write(USAGE3);
+    return 2;
+  }
+  if (flags.has("--apply") && !flags.has("--confirm")) {
+    out.write(`Apply requires --confirm after reviewing the upgrade preview.
+`);
+    return 2;
+  }
+  const legacy = flags.has("--apply");
+  const json = flags.has("--json") || legacy;
+  const run = runner(deps);
+  const plan = previewUpgrade(raw, deps);
+  if (hostFlag === undefined || flags.has("--cli"))
+    planCli(plan, run);
+  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
+  const { home, env } = upgradePaths(deps);
+  const permissions = planHostPermissions({
+    hosts: raw,
+    refreshOnly: true,
+    shell: false,
+    home,
+    env
+  });
+  const permissionPreview = {
+    changes: permissions.changes.map((c) => ({
+      host: c.host,
+      file: c.file,
+      diff: permissionDiff(c)
+    })),
+    ...permissions.refused ? { refused: permissions.refused } : {}
+  };
+  const withPermissions = (value) => permissions.changes.length ? { ...value, permissions: permissionPreview } : value;
+  const applyCommand = `workit upgrade ${[...hostFlag === undefined ? [] : [`--hosts=${hostFlag}`], ...flags.has("--cli") ? ["--cli"] : [], "--yes"].join(" ")}`;
+  const nothingChanged = `preview only; nothing changed. Apply with: ${applyCommand}
+`;
+  if (json && !legacy && !flags.has("--yes")) {
+    out.write(JSON.stringify(withPermissions(plan), null, 2) + `
+`);
+    return plan.blocked.length ? 1 : 0;
+  }
+  if (!json)
+    out.write(summary(plan, permissions.changes));
+  if (flags.has("--preview")) {
+    out.write(nothingChanged);
+    return plan.blocked.length ? 1 : 0;
+  }
+  if (plan.blocked.length) {
+    out.write(`Upgrade blocked: ${plan.blocked.join("; ")}
+Nothing changed.
+`);
+    return 1;
+  }
+  const work = plan.entries.length + plan.migrations.length + (plan.cli ? 1 : 0) + permissions.changes.length;
+  if (work > 0 && !flags.has("--yes") && !legacy) {
+    const confirmed = await (deps.confirm ?? ((q) => askConfirm(q, out)))("Apply this upgrade? [y/N] ");
+    if (!confirmed) {
+      out.write(nothingChanged);
+      return 0;
+    }
+  }
+  if (json)
+    for (const warning of plan.warnings ?? [])
+      out.write(`warning: ${warning}
+`);
+  const result = applyUpgrade(plan, deps);
+  let permissionsOk = true;
+  let written;
+  if (permissions.changes.length && !permissions.refused && !result.error?.startsWith("configuration changed")) {
+    written = applyHostPermissions(permissions, { home, env });
+    permissionsOk = written.every((entry) => entry.status === "written");
+    for (const entry of written)
+      result.hosts.push({
+        host: entry.host,
+        status: entry.status === "written" ? "updated" : "failed",
+        reason: `permission block ${entry.status === "written" ? "refreshed" : entry.status} in ${entry.file}`,
+        ...entry.status === "written" ? {} : { fix: `workit setup --hosts=${entry.host}` }
+      });
+  }
+  const failed = !result.ok || !permissionsOk;
+  const cliVersion = result.hosts.some((h) => h.host === "cli" && h.status === "updated") ? plan.cli.latest : package_default.version;
+  const report = (deps.doctor ?? ((version) => runDoctor({ home, env, cliVersion: version, only: "upgrade" })))(cliVersion);
+  const left = report.checks.filter((check) => check.status === "warn" || check.status === "fail");
+  if (json) {
+    out.write(JSON.stringify({
+      ...result,
+      ok: !failed,
+      ...written ? { permissions: { changes: permissionPreview.changes, written } } : permissions.refused ? { permissions: permissionPreview } : {},
+      doctor: { clean: left.length === 0, left }
+    }, null, 2) + `
+`);
+    return failed ? 1 : 0;
+  }
+  if (result.error && result.hosts.every((h) => h.status !== "failed"))
+    out.write(`Upgrade stopped: ${result.error}
+`);
+  out.write(table(result.hosts));
+  if (permissions.refused)
+    out.write(`permissions: not refreshed: ${permissions.refused}
+`);
+  if (result.backup)
+    out.write(`Backup: ${result.backup}
+`);
+  out.write(left.length === 0 ? `Verified: workit doctor is clean for versions, assets, agents and permissions.
+` : `Left after upgrade (workit doctor):
+${left.map((check) => `  ${check.id}: ${check.detail}${check.fix ? `
+    fix: ${check.fix}` : ""}`).join(`
+`)}
+`);
+  return failed ? 1 : 0;
+}
+async function runLaunchCommand(argv, deps = {}) {
+  const [host, ...args] = argv;
+  if (!LAUNCH_HOSTS.includes(host)) {
+    (deps.out ?? process.stdout).write(`Usage: workit launch <opencode|cursor|codex|pi> [--auto-upgrade] [-- host arguments]
+`);
+    return 2;
+  }
+  const auto = args[0] === "--auto-upgrade";
+  const rest = auto ? args.slice(1) : args;
+  const hostArgs = rest[0] === "--" ? rest.slice(1) : rest;
+  const { home, env } = upgradePaths(deps);
+  let launch;
+  if (!deps.run) {
+    try {
+      launch = hostCommand(host, hostArgs, { home, env });
+    } catch (error) {
+      (deps.out ?? process.stderr).write(`${error instanceof Error ? error.message : "Host executable unavailable"}
+`);
+      return 1;
+    }
+  }
+  if (auto) {
+    const plan = previewUpgrade([host], deps);
+    const reasons = [...plan.blocked, ...plan.failed.map((entry) => entry.reason)];
+    if (plan.ok) {
+      for (const skipped of plan.skipped)
+        (deps.out ?? process.stderr).write(`${skipped.host}: ${skipped.reason}${skipped.fix ? ` (run: ${skipped.fix})` : ""}
+`);
+      const result = applyUpgrade(plan, deps);
+      if (!result.ok) {
+        (deps.out ?? process.stdout).write(`${result.error}
+`);
+        return 1;
+      }
+    } else if (plan.blocked.length === 0 && reasons.every((reason) => reason.includes("registry version unavailable"))) {
+      (deps.out ?? process.stderr).write(`Upgrade unavailable: ${reasons.join("; ")}. Starting the unchanged host.
+`);
+    } else {
+      (deps.out ?? process.stderr).write(`Upgrade blocked: ${reasons.join("; ")}
+`);
+      return 1;
+    }
+  }
+  if (deps.run)
+    return deps.run(host, hostArgs).status ?? 1;
+  return spawnSync17(launch.command, launch.args, {
+    stdio: "inherit",
+    env
+  }).status ?? 1;
+}
+var USAGE3 = `Usage: workit upgrade [--hosts=opencode,cursor,codex,pi,claude-code|none] [--cli] [--preview | --yes | --apply --confirm] [--json]
+`;
+var init_upgrade = __esm(() => {
+  init_package();
+  init_host_install();
+  init_doctor();
+  init_host_permissions();
+  init_apply();
+  init_plan();
+  init_report();
+  init_shared();
+  init_apply();
+  init_plan();
+  init_processes();
+});
+
 // packages/workit-cli/src/verbs/upgrade.ts
 var exports_upgrade = {};
 __export(exports_upgrade, {
@@ -75849,7 +75953,7 @@ var init_launch = __esm(() => {
 // packages/workit-core/src/knowledge.ts
 import { spawnSync as spawnSync18 } from "node:child_process";
 import fs20 from "node:fs";
-import path45 from "node:path";
+import path48 from "node:path";
 function lintKnowledge(root) {
   const seen = new Set;
   const unreadable = [];
@@ -75953,7 +76057,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   const end = lines.indexOf("---", 1);
   return end === -1 ? lines : [...lines.slice(0, end + 1).map(() => ""), ...lines.slice(end + 1)];
 }, read = (root, file) => {
-  const full = path45.join(root, file);
+  const full = path48.join(root, file);
   try {
     fs20.lstatSync(full);
   } catch {
@@ -75994,7 +76098,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   }
 }, brokenLinks = (root, doc, tracked) => {
   const findings = [];
-  const base = path45.dirname(path45.join(root, doc.file));
+  const base = path48.dirname(path48.join(root, doc.file));
   const missing = (target, line, how) => findings.push({
     rule: "broken-link",
     file: doc.file,
@@ -76013,7 +76117,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
       const local = localTarget(target);
       if (!local)
         continue;
-      const resolved = local.startsWith("/") ? path45.join(root, local) : path45.resolve(base, local);
+      const resolved = local.startsWith("/") ? path48.join(root, local) : path48.resolve(base, local);
       if (!exists2(resolved))
         missing(target, index + 1, "link");
     }
@@ -76023,9 +76127,9 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
         continue;
       const relative = /^\.\.?\//.test(candidate);
       const first = candidate.split("/")[0];
-      if (!relative && !(tracked ? tracked.has(first) : exists2(path45.join(root, first))))
+      if (!relative && !(tracked ? tracked.has(first) : exists2(path48.join(root, first))))
         continue;
-      const resolved = relative ? path45.resolve(base, candidate) : path45.join(root, candidate);
+      const resolved = relative ? path48.resolve(base, candidate) : path48.join(root, candidate);
       if (!exists2(resolved))
         missing(span, index + 1, "pointer");
     }
@@ -76348,10 +76452,10 @@ var init_redact = __esm(() => {
 
 // packages/workit-core/src/checks.ts
 import { spawn, spawnSync as spawnSync19 } from "node:child_process";
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import fs21 from "node:fs";
-import os17 from "node:os";
-import path46 from "node:path";
+import os18 from "node:os";
+import path49 from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function tailLines(text, lines = TAIL_LINES) {
   const all = text.replace(/\r\n?/gu, `
@@ -76471,7 +76575,7 @@ function planSpawn(argv, options) {
     return { file: argv[0], args: [], verbatim: false, shell: true };
   if (options.platform !== "win32")
     return { file: argv[0], args: argv.slice(1), verbatim: false, shell: false };
-  const win = path46.win32;
+  const win = path49.win32;
   const isFile = options.isFile ?? ((file) => {
     try {
       return fs21.statSync(file).isFile();
@@ -76556,7 +76660,7 @@ function runCheckCommand(argv, options) {
 `);
       redactor.end();
       resolve({
-        exitCode: spawnError ? 127 : code !== null ? code : 128 + (signal ? os17.constants.signals[signal] ?? 1 : 1),
+        exitCode: spawnError ? 127 : code !== null ? code : 128 + (signal ? os18.constants.signals[signal] ?? 1 : 1),
         signal: signal ?? null,
         timedOut,
         durationMs: Date.now() - started,
@@ -76633,10 +76737,10 @@ function runCheckCommand(argv, options) {
 function storeLog(storeRoot, log) {
   const digest = logDigest(log);
   const ref = `blobs/logs/${digest.slice("sha256:".length)}.log`;
-  const file = path46.join(storeRoot, ref);
+  const file = path49.join(storeRoot, ref);
   try {
     if (!fs21.existsSync(file)) {
-      fs21.mkdirSync(path46.dirname(file), { recursive: true });
+      fs21.mkdirSync(path49.dirname(file), { recursive: true });
       const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
       fs21.writeFileSync(temp, log, { mode: 384 });
       fs21.renameSync(temp, file);
@@ -76649,7 +76753,7 @@ function storeLog(storeRoot, log) {
 function pruneCheckLogs(storeRoot, options = {}) {
   const limits = { ...LOG_RETENTION, ...options.retention };
   const now = options.now ?? Date.now();
-  const dir = path46.join(storeRoot, "blobs", "logs");
+  const dir = path49.join(storeRoot, "blobs", "logs");
   const report = { removed: 0, removedBytes: 0, kept: 0 };
   let names;
   try {
@@ -76659,7 +76763,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   const files = names.flatMap((name) => {
     try {
-      const stat = fs21.statSync(path46.join(dir, name));
+      const stat = fs21.statSync(path49.join(dir, name));
       return stat.isFile() ? [{ name, size: stat.size, mtimeMs: stat.mtimeMs }] : [];
     } catch {
       return [];
@@ -76678,7 +76782,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
       continue;
     if (!options.dryRun)
       try {
-        fs21.rmSync(path46.join(dir, file.name), { force: true });
+        fs21.rmSync(path49.join(dir, file.name), { force: true });
       } catch {
         continue;
       }
@@ -76687,7 +76791,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   return report;
 }
-var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash16("sha256").update(log).digest("hex")}`, LOG_RETENTION;
+var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash17("sha256").update(log).digest("hex")}`, LOG_RETENTION;
 var init_checks3 = __esm(() => {
   init_redact();
   MAX_LOG_BYTES = 2 * 1024 * 1024;
@@ -76951,7 +77055,7 @@ __export(exports_workspace, {
   run: () => run11,
   runWorkspace: () => runWorkspace
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync21 } from "node:fs";
+import { copyFileSync as copyFileSync7, existsSync as existsSync23 } from "node:fs";
 function list2(argv, io) {
   if (argv.length)
     return usage3(io, `unexpected argument ${argv[0]}`);
@@ -77161,7 +77265,7 @@ usage: ${USAGE5}`)), load = (io) => {
     return { ok: false, error: `${current.path} changed; retry` };
   let backup = null;
   try {
-    if (existsSync21(current.path)) {
+    if (existsSync23(current.path)) {
       backup = `${current.path}.bak`;
       copyFileSync7(current.path, backup);
     }
@@ -77229,12 +77333,12 @@ var init_workspace = __esm(() => {
 
 // packages/workit-core/src/core/heavy-rules.ts
 import fs22 from "node:fs";
-import path47 from "node:path";
+import path50 from "node:path";
 function gitTop(cwd) {
-  for (let dir = path47.resolve(cwd);; dir = path47.dirname(dir)) {
-    if (fs22.existsSync(path47.join(dir, ".git")))
+  for (let dir = path50.resolve(cwd);; dir = path50.dirname(dir)) {
+    if (fs22.existsSync(path50.join(dir, ".git")))
       return dir;
-    if (path47.dirname(dir) === dir)
+    if (path50.dirname(dir) === dir)
       return null;
   }
 }
@@ -77275,19 +77379,19 @@ var init_heavy_rules = () => {};
 
 // packages/workit-core/src/core/heavy.ts
 import fs23 from "node:fs";
-import os18 from "node:os";
-import path48 from "node:path";
+import os19 from "node:os";
+import path51 from "node:path";
 function stateDir2(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path48.join(env.XDG_STATE_HOME, "workit");
-  const home = env.HOME || os18.homedir();
+    return path51.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os19.homedir();
   if (platform === "darwin")
-    return path48.join(home, "Library", "Application Support", "workit");
+    return path51.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path48.join(env.LOCALAPPDATA ?? path48.join(home, "AppData", "Local"), "workit");
-  return path48.join(home, ".local", "state", "workit");
+    return path51.join(env.LOCALAPPDATA ?? path51.join(home, "AppData", "Local"), "workit");
+  return path51.join(home, ".local", "state", "workit");
 }
 function positional(words, from, values = PM_VALUES) {
   let index = from;
@@ -77427,7 +77531,7 @@ function machinePatterns(env) {
   return isRecord8(value) ? stringList2(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path48.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path51.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -77506,7 +77610,7 @@ function leaseRewrite(command) {
     return null;
   return `${prefix}workit check --heavy -- ${rest}`;
 }
-var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path48.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
+var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path51.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
   try {
     return JSON.parse(fs23.readFileSync(file, "utf8"));
   } catch {
@@ -77652,8 +77756,8 @@ var init_heavy = __esm(() => {
 // packages/workit-core/src/core/resources.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import fs24 from "node:fs";
-import os19 from "node:os";
-import path49 from "node:path";
+import os20 from "node:os";
+import path52 from "node:path";
 function memoryValue(value, host) {
   const text = typeof value === "number" ? String(value) : typeof value === "string" ? value : "";
   const percent = PERCENT.exec(text.trim());
@@ -77834,7 +77938,7 @@ function tryOnce(options, record, reclaimed) {
   const text = `${JSON.stringify(record)}
 `;
   for (let slot = 0;slot < options.slots; slot += 1) {
-    const file = path49.join(options.dir, `slot-${slot}.json`);
+    const file = path52.join(options.dir, `slot-${slot}.json`);
     for (let attempt = 0;attempt < 2; attempt += 1) {
       try {
         const fd = fs24.openSync(file, "wx", 384);
@@ -77959,7 +78063,7 @@ function heldLease(dir, id, options = {}) {
   for (const name of names) {
     if (!/^slot-\d+\.json$/u.test(name))
       continue;
-    const lease = parseLease(readText5(path49.join(dir, name)));
+    const lease = parseLease(readText5(path52.join(dir, name)));
     if (lease?.id === id && !staleReason(lease, options.probe) && (options.ancestor ?? isAncestor)(lease.pid))
       return lease;
   }
@@ -78014,10 +78118,10 @@ async function runScoped(run, wrapper, sinks) {
 }
 function firstNotice(env, session, key, now = Date.now()) {
   const id = (session ?? `ppid-${process.ppid}`).replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 120);
-  const dir = path49.join(stateDir2(env), "notices");
+  const dir = path52.join(stateDir2(env), "notices");
   try {
     fs24.mkdirSync(dir, { recursive: true, mode: 448 });
-    fs24.writeFileSync(path49.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
+    fs24.writeFileSync(path52.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
 `, {
       flag: "wx",
       mode: 384
@@ -78027,7 +78131,7 @@ function firstNotice(env, session, key, now = Date.now()) {
   }
   try {
     for (const name of fs24.readdirSync(dir)) {
-      const file = path49.join(dir, name);
+      const file = path52.join(dir, name);
       if (now - fs24.statSync(file).mtimeMs > NOTICE_TTL_MS)
         fs24.rmSync(file, { force: true });
     }
@@ -78037,7 +78141,7 @@ function firstNotice(env, session, key, now = Date.now()) {
 function leaseSlots(dir, slots, probe = {}) {
   const states = [];
   for (let slot = 0;slot < slots; slot += 1) {
-    const lease = parseLease(readText5(path49.join(dir, `slot-${slot}.json`)));
+    const lease = parseLease(readText5(path52.join(dir, `slot-${slot}.json`)));
     states.push({
       slot,
       holder: lease ? holderOf(lease) : null,
@@ -78047,15 +78151,15 @@ function leaseSlots(dir, slots, probe = {}) {
   return states;
 }
 var DEFAULT_HEAVY_CHECKS, DEFAULT_SLOTS = 1, DEFAULT_WAIT_S = 600, DEFAULT_MEMORY_SHARE = 0.4, DEFAULT_CPU_SHARE = 0.7, MAX_SLOTS = 64, UNREADABLE_TTL_MS = 30000, GUARD_TTL_MS = 30000, hostShape = () => ({
-  totalMemBytes: os19.totalmem(),
-  cpus: Math.max(1, os19.availableParallelism?.() ?? os19.cpus().length)
-}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path49.join(stateDir2(env), "leases"), readText5 = (file) => {
+  totalMemBytes: os20.totalmem(),
+  cpus: Math.max(1, os20.availableParallelism?.() ?? os20.cpus().length)
+}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path52.join(stateDir2(env), "leases"), readText5 = (file) => {
   try {
     return fs24.readFileSync(file, "utf8");
   } catch {
     return null;
   }
-}, bootId = () => readText5("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os19.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
+}, bootId = () => readText5("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os20.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
   const stat = readText5(`/proc/${pid}/stat`);
   return stat ? stat.slice(stat.lastIndexOf(")") + 2).split(" ") : null;
 }, processStart = (pid) => statFields(pid)?.[19] ?? null, pidAlive2 = (pid) => {
@@ -78104,8 +78208,8 @@ __export(exports_check, {
   run: () => run12,
   workspaceResources: () => workspaceResources
 });
-import os20 from "node:os";
-import path50 from "node:path";
+import os21 from "node:os";
+import path53 from "node:path";
 function parse6(argv) {
   const split = argv.indexOf("--");
   const head = split >= 0 ? argv.slice(0, split) : [...argv];
@@ -78307,7 +78411,7 @@ function hostToolWaitCapMs(env) {
 }
 async function workspaceResources(io) {
   const env = io.env;
-  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path50.join(env.XDG_CONFIG_HOME || path50.join(env.HOME || os20.homedir(), ".config"), "workit");
+  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path53.join(env.XDG_CONFIG_HOME || path53.join(env.HOME || os21.homedir(), ".config"), "workit");
   try {
     await Promise.resolve().then(() => init_workspaces());
     const workspace = resolveWorkspaceFrom(io.cwd, dir, env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
@@ -78426,7 +78530,7 @@ async function run12(argv, io) {
     if (options.shell && command.length !== 1)
       return emit(io, fail2("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
-  const relCwd = posix(path50.relative(top, runCwd));
+  const relCwd = posix(path53.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
   const shadowed = !configured && name !== null ? config.checks.find((item) => item.name === name) : undefined;
   if (shadowed)
@@ -78488,7 +78592,7 @@ async function run12(argv, io) {
   const modifiedWorktree = key.tree !== null && treeAfter !== key.tree;
   const store = storeRoot(io.cwd);
   const blob = store.ok ? storeLog(store.value.root, result.log) : null;
-  const logPath = store.ok && blob ? path50.join(store.value.root, blob.ref) : null;
+  const logPath = store.ok && blob ? path53.join(store.value.root, blob.ref) : null;
   const tail = tailLines(result.log, TAIL_LINES);
   const passed = result.exitCode === 0 && !result.timedOut;
   const bounded = boundedArgv(command);
@@ -78603,7 +78707,7 @@ async function run12(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE6 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path50.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, HOST_TOOL_WAIT_CAP_MS = 1e5;
+var USAGE6 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path53.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, HOST_TOOL_WAIT_CAP_MS = 1e5;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -78632,7 +78736,7 @@ __export(exports_lock, {
   run: () => run13
 });
 import fs25 from "node:fs";
-import path51 from "node:path";
+import path54 from "node:path";
 async function settingsFor(io) {
   const workspace = await workspaceResources(io);
   const config = loadCheckConfig(io.cwd);
@@ -78714,7 +78818,7 @@ function readPatterns(file) {
   return { patterns: [] };
 }
 function writePatterns(file, value) {
-  fs25.mkdirSync(path51.dirname(file), { recursive: true, mode: 448 });
+  fs25.mkdirSync(path54.dirname(file), { recursive: true, mode: 448 });
   const temp = `${file}.${process.pid}.tmp`;
   fs25.writeFileSync(temp, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -78800,9 +78904,9 @@ var exports_models = {};
 __export(exports_models, {
   run: () => run14
 });
-import { existsSync as existsSync22, readdirSync as readdirSync13, readFileSync as readFileSync22, statSync as statSync9 } from "node:fs";
-import os21 from "node:os";
-import path52 from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync13, readFileSync as readFileSync23, statSync as statSync9 } from "node:fs";
+import os22 from "node:os";
+import path55 from "node:path";
 async function run14(argv, io) {
   const [sub, ...args] = argv.filter((arg) => arg !== "--json");
   if (sub !== "show")
@@ -78863,7 +78967,7 @@ var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
   const found = new Set;
   let text = "";
   try {
-    text = readFileSync22(file, "utf8");
+    text = readFileSync23(file, "utf8");
   } catch {
     return found;
   }
@@ -78877,26 +78981,26 @@ var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
       } catch {}
   return found;
 }, matches3 = (ran, configured) => ran.toLowerCase().includes(configured.toLowerCase()), usageReport = (cwd, env, days) => {
-  const projects = path52.join(env.CLAUDE_CONFIG_DIR || path52.join(env.HOME || os21.homedir(), ".claude"), "projects");
+  const projects = path55.join(env.CLAUDE_CONFIG_DIR || path55.join(env.HOME || os22.homedir(), ".claude"), "projects");
   const since = Date.now() - days * 86400000;
   const types = {};
   let agents = 0;
   const dirs = (dir) => {
     try {
-      return readdirSync13(dir).map((name) => path52.join(dir, name));
+      return readdirSync13(dir).map((name) => path55.join(dir, name));
     } catch {
       return [];
     }
   };
   for (const project of dirs(projects))
     for (const session of dirs(project))
-      for (const meta of dirs(path52.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
+      for (const meta of dirs(path55.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
         try {
           if (statSync9(meta).mtimeMs < since)
             continue;
-          const agentType = JSON.parse(readFileSync22(meta, "utf8")).agentType;
+          const agentType = JSON.parse(readFileSync23(meta, "utf8")).agentType;
           const transcript = meta.replace(/\.meta\.json$/, ".jsonl");
-          if (typeof agentType !== "string" || !existsSync22(transcript))
+          if (typeof agentType !== "string" || !existsSync24(transcript))
             continue;
           const ran = modelsOf(transcript);
           if (!ran.size)
@@ -79035,8 +79139,8 @@ var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock)
 
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync23 } from "node:fs";
-import path53 from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync24 } from "node:fs";
+import path56 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
     ["rebase-merge", "rebase"],
@@ -79049,18 +79153,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path53.resolve(cwd, line.trim()));
+`).map((line) => path56.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
-    if (!marker || !existsSync23(marker))
+    if (!marker || !existsSync25(marker))
       continue;
-    if (index === 1 && existsSync23(path53.join(marker, "applying")))
+    if (index === 1 && existsSync25(path56.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync23(path53.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync25(path56.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync23(path53.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync24(path56.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -79388,7 +79492,7 @@ function gitCommit(cwd, input) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync23(path53.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync25(path56.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -79927,12 +80031,12 @@ var init_ops = __esm(() => {
 
 // packages/workit-core/src/verdict-cover.ts
 import fs26 from "node:fs";
-import path54 from "node:path";
+import path57 from "node:path";
 function chainsAbove(cwd, branch) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return [];
-  const dir = path54.join(root.value.root, "stacks");
+  const dir = path57.join(root.value.root, "stacks");
   let names = [];
   try {
     names = fs26.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -79943,7 +80047,7 @@ function chainsAbove(cwd, branch) {
   for (const name of names.toSorted()) {
     let parsed;
     try {
-      parsed = JSON.parse(fs26.readFileSync(path54.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs26.readFileSync(path57.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -80038,10 +80142,10 @@ var init_pr_lane = __esm(() => {
 
 // packages/workit-core/src/forge/reruns.ts
 import fs27 from "node:fs";
-import path55 from "node:path";
+import path58 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path55.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path58.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -80076,7 +80180,7 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs27.mkdirSync(path55.dirname(file), { recursive: true });
+    fs27.mkdirSync(path58.dirname(file), { recursive: true });
     fs27.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
@@ -80089,7 +80193,7 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs27.mkdirSync(path55.dirname(lock), { recursive: true });
+  fs27.mkdirSync(path58.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
@@ -80506,7 +80610,7 @@ function recordAccepted(cwd, resolved, status, accepted, options) {
   return recordReruns(cwd, rows);
 }
 var MAX_LOG_TAILS = 5, GITLAB_MERGEABLE, GITHUB_MERGEABLE, NO_CHECKS_GRACE_MS = 90000;
-var init_report = __esm(() => {
+var init_report2 = __esm(() => {
   init_rev();
   init_ledger();
   init_reruns();
@@ -81055,7 +81159,7 @@ var init_pr_ops = __esm(() => {
   init_ledger();
   init_verdict_cover();
   init_pr_lane();
-  init_report();
+  init_report2();
   VERIFY_DELAYS_MS = [1000, 2000, 4000];
   AFTER_REVIEW = {
     commit: "stop here; review comes when the user asks",
@@ -81068,9 +81172,9 @@ var init_pr_ops = __esm(() => {
 
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync22 } from "node:child_process";
-import { createHash as createHash17, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash18, randomBytes as randomBytes4 } from "node:crypto";
 import fs28 from "node:fs";
-import path56 from "node:path";
+import path59 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -81119,7 +81223,7 @@ function gitRestack(cwd, input) {
         error: "no store root"
       };
     fs28.mkdirSync(scratch, { recursive: true });
-    dir = path56.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    dir = path59.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return {
@@ -81175,7 +81279,7 @@ function pruneScratch(cwd) {
   if (!scratch || !fs28.existsSync(scratch))
     return;
   for (const name of fs28.readdirSync(scratch)) {
-    const dir = path56.join(scratch, name);
+    const dir = path59.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -81185,7 +81289,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path56.join(root.value.root, "stacks") };
+  return { ok: true, data: path59.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
   if (!isRecord12(raw) || !Array.isArray(raw.branches))
@@ -81237,7 +81341,7 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path56.join(dir.data, fileFor(name));
+  const file = path59.join(dir.data, fileFor(name));
   let text;
   try {
     text = fs28.readFileSync(file, "utf8");
@@ -81258,7 +81362,7 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path56.join(dir.data, fileFor(stack.name));
+  const file = path59.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
@@ -81286,7 +81390,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs28.readFileSync(path56.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs28.readFileSync(path59.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -81348,7 +81452,7 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes4(8).toString("hex")
   };
-  fs28.writeFileSync(path56.join(lock, OWNER), JSON.stringify(owner));
+  fs28.writeFileSync(path59.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
@@ -81385,7 +81489,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path56.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path59.join(dir.data, `${fileFor(name)}.lock`);
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
@@ -81415,7 +81519,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs28.utimesSync(path56.join(lock, OWNER), now, now);
+      fs28.utimesSync(path59.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -82316,10 +82420,10 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path56.join(dir.data, "worktrees") : null;
+  return dir.ok ? path59.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
-`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash17("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash18("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
   if (name.length === 0 || name.length > 200)
     return false;
   for (let index = 0;index < name.length; index += 1) {
@@ -82331,12 +82435,12 @@ ${run.stdout}`.split(`
 }, isRecord12 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs28.readFileSync(path56.join(lock, OWNER), "utf8");
+    raw = fs28.readFileSync(path59.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path56.join(lock, OWNER), lock])
+  for (const target of [path59.join(lock, OWNER), lock])
     try {
       age = Date.now() - fs28.statSync(target).mtimeMs;
       break;
@@ -82360,7 +82464,7 @@ var init_stack = __esm(() => {
   init_autonomy();
   init_store_lock();
   init_pr_ops();
-  init_report();
+  init_report2();
   init_ops();
   init_rev();
   init_ledger();
@@ -82377,9 +82481,9 @@ var init_stack = __esm(() => {
 
 // packages/workit-core/src/fanout.ts
 import { spawnSync as spawnSync23 } from "node:child_process";
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 import fs29 from "node:fs";
-import path57 from "node:path";
+import path60 from "node:path";
 function expandBraces2(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -82625,7 +82729,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path57.resolve(defaults.root, optional("worktree") ?? path57.join(defaults.worktreeRoot, id)),
+      worktree: path60.resolve(defaults.root, optional("worktree") ?? path60.join(defaults.worktreeRoot, id)),
       tier,
       reason,
       dependsOn: [...new Set(dependsOn ?? [])],
@@ -82754,12 +82858,12 @@ function regeneratedFiles(root, tracked) {
   const found = new Map;
   let scripts;
   try {
-    const manifest = JSON.parse(fs29.readFileSync(path57.join(root, "package.json"), "utf8"));
+    const manifest = JSON.parse(fs29.readFileSync(path60.join(root, "package.json"), "utf8"));
     scripts = manifest.scripts ?? {};
   } catch {
     return found;
   }
-  const runner = fs29.existsSync(path57.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path57.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path57.join(root, "yarn.lock")) ? "yarn run" : "npm run";
+  const runner = fs29.existsSync(path60.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path60.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path60.join(root, "yarn.lock")) ? "yarn run" : "npm run";
   const outputs = tracked.filter((file) => !CODE.test(file));
   for (const [name, command] of Object.entries(scripts)) {
     if (!name.startsWith("write:") || typeof command !== "string")
@@ -82767,7 +82871,7 @@ function regeneratedFiles(root, tracked) {
     for (const file of command.match(/[\w./-]+\.[cm]?[jt]s\b/gu) ?? []) {
       let source;
       try {
-        source = fs29.readFileSync(path57.join(root, file), "utf8");
+        source = fs29.readFileSync(path60.join(root, file), "utf8");
       } catch {
         continue;
       }
@@ -82889,11 +82993,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path57.basename(common) === ".git" ? path57.dirname(common) : path57.resolve(cwd);
+  return common && path60.basename(common) === ".git" ? path60.dirname(common) : path60.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path57.join(path57.dirname(main), `${path57.basename(main)}-wt`);
+  return path60.join(path60.dirname(main), `${path60.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -82907,13 +83011,13 @@ function sliceHash(slice) {
     issues: _issues,
     ...definition
   } = slice;
-  return createHash18("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
+  return createHash19("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
 }
 function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path57.join(root.value.root, "fanouts") };
+  return { ok: true, data: path60.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord13(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -82981,7 +83085,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path57.join(dir.data, stackFileName(name));
+  const file = path60.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs29.readFileSync(file, "utf8")));
@@ -83006,7 +83110,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs29.readFileSync(path57.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs29.readFileSync(path60.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -83045,7 +83149,7 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path57.join(dir.data, stackFileName(plan.name));
+  const file = path60.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs29.mkdirSync(dir.data, { recursive: true });
@@ -83256,13 +83360,13 @@ var init_fanout = __esm(() => {
 // packages/workit-core/src/forge/exec.ts
 import { spawnSync as spawnSync24 } from "node:child_process";
 import fs30 from "node:fs";
-import path58 from "node:path";
+import path61 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path58.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path61.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path58.join(dir, `${bin}${ext}`);
+      const candidate = path61.join(dir, `${bin}${ext}`);
       try {
         const stat = fs30.statSync(candidate);
         if (stat.isFile())
@@ -84805,7 +84909,7 @@ var init_pr_edit = __esm(() => {
   init_rev();
   init_stack();
   init_pr_ops();
-  init_report();
+  init_report2();
 });
 
 // packages/workit-core/src/core/live-session.ts
@@ -84825,7 +84929,7 @@ var init_live_session = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/write-gate.ts
-import path59 from "node:path";
+import path62 from "node:path";
 var CASE_INSENSITIVE, PREFIXES2, SCRIPT_SHELLS, cache3, MUTATING_GIT, DRY_N, MUTATING_WORKIT_GIT, CD2, PUSHD2, POPD2, UNKNOWN_DIR;
 var init_write_gate = __esm(() => {
   init_task_store();
@@ -84865,7 +84969,7 @@ var init_write_gate = __esm(() => {
   CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
   PUSHD2 = new Set(["pushd", "push-location"]);
   POPD2 = new Set(["popd", "pop-location"]);
-  UNKNOWN_DIR = path59.resolve(path59.parse(process.cwd()).root, ".workit-unknown-dir");
+  UNKNOWN_DIR = path62.resolve(path62.parse(process.cwd()).root, ".workit-unknown-dir");
 });
 
 // packages/workit-core/src/hooks/worktree-confine.ts
@@ -84890,20 +84994,20 @@ var init_worktree_confine = __esm(() => {
 
 // packages/workit-core/src/worktree-deps.ts
 import fs31 from "node:fs";
-import path60 from "node:path";
+import path63 from "node:path";
 function moduleDirs(main) {
   const out = [];
   const walk = (relative, depth) => {
     let entries;
     try {
-      entries = fs31.readdirSync(path60.join(main, relative), { withFileTypes: true });
+      entries = fs31.readdirSync(path63.join(main, relative), { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const child = path60.join(relative, entry.name);
+      const child = path63.join(relative, entry.name);
       if (entry.name === MODULES)
         out.push(child);
       else if (depth < MAX_DEPTH2 && !entry.name.startsWith("."))
@@ -84917,8 +85021,8 @@ function linkEntry(main, worktree, source, target) {
   const stat = fs31.lstatSync(source);
   if (stat.isSymbolicLink()) {
     const link = fs31.readlinkSync(source);
-    const outside = path60.isAbsolute(link) && within(link, main) && !path60.relative(main, link).split(path60.sep).includes(MODULES);
-    const to = outside ? path60.join(worktree, path60.relative(main, link)) : link;
+    const outside = path63.isAbsolute(link) && within(link, main) && !path63.relative(main, link).split(path63.sep).includes(MODULES);
+    const to = outside ? path63.join(worktree, path63.relative(main, link)) : link;
     fs31.symlinkSync(to, target, process.platform === "win32" ? "junction" : undefined);
     return;
   }
@@ -84928,8 +85032,8 @@ function mirror(main, worktree, source, target, top) {
   fs31.mkdirSync(target);
   let count = 0;
   for (const entry of fs31.readdirSync(source, { withFileTypes: true })) {
-    const from = path60.join(source, entry.name);
-    const to = path60.join(target, entry.name);
+    const from = path63.join(source, entry.name);
+    const to = path63.join(target, entry.name);
     if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin"))
       count += mirror(main, worktree, from, to, false);
     else {
@@ -84945,16 +85049,16 @@ function linkWorktreeDependencies(main, worktree) {
   const dirs = [];
   let entries = 0;
   for (const relative of moduleDirs(main)) {
-    const target = path60.join(worktree, relative);
-    if (!fs31.existsSync(path60.dirname(target)) || fs31.existsSync(target))
+    const target = path63.join(worktree, relative);
+    if (!fs31.existsSync(path63.dirname(target)) || fs31.existsSync(target))
       continue;
-    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path60.sep).join("/")}/`]).ok) {
-      notes.push(`${relative.split(path60.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
+    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path63.sep).join("/")}/`]).ok) {
+      notes.push(`${relative.split(path63.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
       continue;
     }
     try {
-      entries += mirror(main, worktree, path60.join(main, relative), target, true);
-      dirs.push(relative.split(path60.sep).join("/"));
+      entries += mirror(main, worktree, path63.join(main, relative), target, true);
+      dirs.push(relative.split(path63.sep).join("/"));
     } catch (error) {
       fs31.rmSync(target, { recursive: true, force: true });
       notes.push(`could not link ${relative} from ${main} (${error.message}); install dependencies in the worktree yourself`);
@@ -84967,8 +85071,8 @@ function linkWorktreeDependencies(main, worktree) {
   return { linked: { from: main, dirs, entries, ms }, notes };
 }
 var MODULES = "node_modules", MAX_DEPTH2 = 2, within = (child, parent) => {
-  const relative = path60.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path60.isAbsolute(relative);
+  const relative = path63.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path63.isAbsolute(relative);
 };
 var init_worktree_deps = __esm(() => {
   init_fanout();
@@ -84977,7 +85081,7 @@ var init_worktree_deps = __esm(() => {
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
 import fs32 from "node:fs";
-import path61 from "node:path";
+import path64 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -85037,7 +85141,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs32.readFileSync(path61.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
+    token = fs32.readFileSync(path64.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -85045,7 +85149,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path61.basename(file),
+      id: path64.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -85061,7 +85165,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes5(16).toString("hex");
   try {
-    fs32.writeFileSync(path61.join(admin.path, FANOUT_TOKEN_FILE), `${token}
+    fs32.writeFileSync(path64.join(admin.path, FANOUT_TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -85076,7 +85180,7 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path61.join(common, "info", "exclude");
+  const file = path64.join(common, "info", "exclude");
   let text = "";
   try {
     text = fs32.readFileSync(file, "utf8");
@@ -85085,7 +85189,7 @@ function excludeScratch(cwd) {
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs32.mkdirSync(path61.dirname(file), { recursive: true });
+  fs32.mkdirSync(path64.dirname(file), { recursive: true });
   fs32.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
@@ -85094,13 +85198,13 @@ ${EXCLUDE_LINE}
 }
 function worktreeDependencies(main, worktree) {
   for (const [name, install] of LOCKFILES2) {
-    const ours = readBytes(path61.join(main, name));
-    const theirs = readBytes(path61.join(worktree, name));
+    const ours = readBytes(path64.join(main, name));
+    const theirs = readBytes(path64.join(worktree, name));
     if (ours === null && theirs === null)
       continue;
     if (ours !== null && theirs !== null && ours.equals(theirs))
       continue;
-    if (fs32.existsSync(path61.join(worktree, "node_modules")))
+    if (fs32.existsSync(path64.join(worktree, "node_modules")))
       break;
     const command = install(worktree);
     return {
@@ -85114,7 +85218,7 @@ function worktreeDependencies(main, worktree) {
   return { ...linkWorktreeDependencies(main, worktree), install: null };
 }
 function ensureScratch(worktree) {
-  const scratch = path61.join(worktree, SCRATCH_DIR);
+  const scratch = path64.join(worktree, SCRATCH_DIR);
   fs32.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
@@ -85353,7 +85457,7 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path61.join(worktree, SCRATCH_DIR);
+  const scratch = path64.join(worktree, SCRATCH_DIR);
   let stat;
   try {
     stat = fs32.lstatSync(scratch);
@@ -85369,16 +85473,16 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
   try {
     return fs32.realpathSync.native(target);
   } catch {
-    return path61.resolve(target);
+    return path64.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside3 = (child, parent) => {
-  const relative = path61.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path61.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path61.isAbsolute(slice.worktree) ? slice.worktree : path61.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
+  const relative = path64.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path64.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path64.isAbsolute(slice.worktree) ? slice.worktree : path64.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
   try {
     return fs32.readFileSync(file);
   } catch {
@@ -85409,7 +85513,7 @@ var init_fanout_worktree = __esm(() => {
 
 // packages/workit-core/src/forge/merge-cleanup.ts
 import fs33 from "node:fs";
-import path62 from "node:path";
+import path65 from "node:path";
 function cleanupMergedBranch(cwd, branch, mergedHead) {
   const out = { branchDeleted: false, worktreeRemoved: null, notes: [] };
   if (!branch || branch.startsWith("-"))
@@ -85469,13 +85573,13 @@ var SLOW2, isFanoutWorktree = (worktree) => {
   if (!dir.ok)
     return false;
   try {
-    return fs33.readFileSync(path62.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
+    return fs33.readFileSync(path65.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
   } catch {
     return false;
   }
 }, inside4 = (child, parent) => {
-  const relative = path62.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
-  return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
+  const relative = path65.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
+  return relative === "" || !relative.startsWith("..") && !path65.isAbsolute(relative);
 };
 var init_merge_cleanup = __esm(() => {
   init_fanout();
@@ -85756,7 +85860,7 @@ var init_duration = __esm(() => {
 });
 
 // packages/workit-cli/src/verbs/forge-common.ts
-import { readFileSync as readFileSync24 } from "node:fs";
+import { readFileSync as readFileSync25 } from "node:fs";
 function parseFlags(argv, spec) {
   const parsed = { values: {}, booleans: new Set, lists: {}, positionals: [] };
   for (let index = 0;index < argv.length; index += 1) {
@@ -85911,7 +86015,7 @@ var init_forge_common = __esm(() => {
   forgeDeps = {
     runner: undefined,
     npm: undefined,
-    readStdin: () => readFileSync24(0, "utf8"),
+    readStdin: () => readFileSync25(0, "utf8"),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     now: () => Date.now()
   };
@@ -85922,12 +86026,12 @@ var exports_pr = {};
 __export(exports_pr, {
   run: () => run15
 });
-import { readFileSync as readFileSync25 } from "node:fs";
-import path63 from "node:path";
+import { readFileSync as readFileSync26 } from "node:fs";
+import path66 from "node:path";
 function readBodyFile(io, file) {
   try {
     return {
-      body: file === "-" ? forgeDeps.readStdin() : readFileSync25(path63.resolve(io.cwd, file), "utf8")
+      body: file === "-" ? forgeDeps.readStdin() : readFileSync26(path66.resolve(io.cwd, file), "utf8")
     };
   } catch {
     return `cannot read --body-file ${file}`;
@@ -86256,7 +86360,7 @@ async function merge3(argv, io) {
   const cleanup = result.data.deletedBranch === true ? cleanupMergedBranch(io.cwd, result.data.branch, result.data.head) : null;
   return emit(io, ok2({ ...result.data, localCleanup: cleanup }), (data) => [
     `merged ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number} (${data.method}) at head ${data.head.slice(0, 12)}${data.mergeSha ? ` -> ${data.mergeSha.slice(0, 12)}` : ""}`,
-    data.unverified ? `UNVERIFIED: merged without a verdict (--unverified: ${data.unverified.reason}); ledger ${data.unverified.recorded}` : `verdict ${data.verdict.verdictId ?? "?"} accepted for that head${data.verdict.cover ? ` (stack verdict on ${data.verdict.cover.branch} @ ${data.verdict.cover.head.slice(0, 12)})` : data.verdict.carry ? ` (${carryLabel(data.verdict.carry)})` : ""}`,
+    data.unverified ? `UNVERIFIED: merged without a verdict (--unverified: ${data.unverified.reason}); ledger ${data.unverified.recorded}` : mergedOnLine(data.verdict),
     ...data.baseCi.note ? [data.baseCi.note] : [],
     ...data.mergeBack.length ? [
       `merge back: ${data.base} is the ${data.mergeBackTrack} production branch; bring it into ${data.mergeBack.join(", ")}`
@@ -86424,13 +86528,21 @@ async function run15(argv, io) {
     return reply(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE9);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE9 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE9 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, mergedOnLine = (verdict) => {
+  if (verdict.review === "self-reviewed")
+    return `self-reviewed (lane ${verdict.lane}): the author's verdict ${verdict.verdictId ?? "?"}; no independent verdict accepted for that head`;
+  if (!verdict.verdictId)
+    return `no verdict required (lane ${verdict.lane})`;
+  if (!verdict.accepted && !verdict.cover && !verdict.carry)
+    return `verdict ${verdict.verdictId} satisfied lane ${verdict.lane}; not an accepted independent verdict for that head`;
+  return `verdict ${verdict.verdictId} accepted for that head${verdict.cover ? ` (stack verdict on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)})` : verdict.carry ? ` (${carryLabel(verdict.carry)})` : ""}`;
+}, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
 var init_pr = __esm(() => {
   init_autonomy();
   init_issue_link();
   init_pr_edit();
   init_pr_ops();
-  init_report();
+  init_report2();
   init_rev();
   init_workspaces();
   init_merge_cleanup();
@@ -86684,7 +86796,7 @@ async function run16(argv, io) {
 }
 var WAIT_USAGE = "workit ci wait [--pr <n> | --branch <b>] [--head <sha>] [--timeout 20m] [--interval 30s] [--json]", RERUN_USAGE = "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force] [--json]", LOGS_USAGE = "workit ci logs --failed [--pr <n> | --branch <b>] [--json]", LOG_LINES = 60, ONE_POLL_MS = 20000, MAX_POLL_ERRORS = 3, seconds = (ms) => `${Math.round(ms / 1000)}s`;
 var init_ci = __esm(() => {
-  init_report();
+  init_report2();
   init_ledger();
   init_autonomy();
   init_output();
@@ -86723,8 +86835,8 @@ var exports_git = {};
 __export(exports_git, {
   run: () => run17
 });
-import { readFileSync as readFileSync26 } from "node:fs";
-import path64 from "node:path";
+import { readFileSync as readFileSync27 } from "node:fs";
+import path67 from "node:path";
 function kindHint(cwd, kind) {
   let kinds = [...BRANCH_KINDS];
   try {
@@ -86828,7 +86940,7 @@ function commitMessage(parsed, io) {
 
 `);
   try {
-    return file === "-" ? readFileSync26(0, "utf8") : readFileSync26(path64.resolve(io.cwd, file), "utf8");
+    return file === "-" ? readFileSync27(0, "utf8") : readFileSync27(path67.resolve(io.cwd, file), "utf8");
   } catch (error) {
     return {
       error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
@@ -87242,7 +87354,7 @@ var init_verify = __esm(() => {
   init_exec();
   init_rev();
   init_ledger();
-  init_report();
+  init_report2();
   init_redact();
   NPM_NAME = /^(?:@[A-Za-z0-9~][A-Za-z0-9-._~]*\/)?[A-Za-z0-9~][A-Za-z0-9-._~]*$/u;
   SEMVER2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
@@ -88261,15 +88373,15 @@ var init_stack2 = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-brief.ts
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import fs35 from "node:fs";
-import path65 from "node:path";
+import path68 from "node:path";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
   const full = `${lead}-w-${slice}${tail}`;
   if (full.length <= SESSION_MAX)
     return full;
-  const digest = createHash19("sha256").update(slice).digest("hex").slice(0, 12);
+  const digest = createHash20("sha256").update(slice).digest("hex").slice(0, 12);
   return `${lead.slice(0, SESSION_MAX - 3 - digest.length - tail.length)}-w-${digest}${tail}`;
 }
 function renderBrief(cwd, plan, input) {
@@ -88345,7 +88457,7 @@ function renderBrief(cwd, plan, input) {
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
     exists ? `WORKTREE: ${planned}  (made by \`workit fanout worktree create ${slice.id}\`; yours alone)` : `WORKTREE: ${planned}  (not made yet: the lead runs \`workit fanout worktree create ${slice.id}\` before spawning, then renders this brief again)`,
-    ...exists && typeof made?.install === "string" && !fs35.existsSync(path65.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
+    ...exists && typeof made?.install === "string" && !fs35.existsSync(path68.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
     ...identityLines(identity, minted),
     ...rules(mode, branch, slice.base, exists ? planned : null)
   ];
@@ -89075,7 +89187,7 @@ var DEFAULT_STUCK_MS, isoOf = (seconds) => {
 }, newest = (...values) => values.filter((value) => Boolean(value) && !Number.isNaN(Date.parse(value ?? ""))).reduce((best, value) => best === null || Date.parse(value) > Date.parse(best) ? value : best, null);
 var init_fanout_status = __esm(() => {
   init_duration();
-  init_report();
+  init_report2();
   init_role_models();
   init_ledger();
   init_fanout_check();
@@ -89090,7 +89202,7 @@ __export(exports_fanout, {
   run: () => run21
 });
 import fs36 from "node:fs";
-import path66 from "node:path";
+import path69 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -89151,7 +89263,7 @@ function plan2(argv, io) {
     return usage4(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage4(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path66.resolve(io.cwd, flags.positionals[0]);
+  const file = path69.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
     raw = JSON.parse(fs36.readFileSync(file, "utf8"));
@@ -89527,6 +89639,8 @@ async function run22(argv, io) {
   if (rest.length !== 1)
     return usage5(io, `ledger verdict takes one result: ${VERDICT_RESULTS.join("|")}`);
   const claimed = values.self === true ? null : claimedSession(acting);
+  if (values.self !== true && claimed === null)
+    return emit(io, fail2("blocked", NO_SESSION_ERROR, { unblock: NO_SESSION_UNBLOCK }));
   const token = values.token ?? io.env.WORKIT_SESSION_TOKEN ?? null;
   const refusal = claimed === null ? null : sessionClaimRefusal(io.env, claimed, io.cwd, { token, flag: acting.source === "flag" });
   if (refusal)
@@ -89641,7 +89755,7 @@ var USAGE15 = "workit ledger decision|ruling|verdict|standing|list|check ... (wo
     };
   }
   return { actor, source: "env" };
-}, claimedSession = (acting) => acting.source === "as" ? acting.derivedFrom ?? null : acting.actor.session, positiveInt2 = (value, flag) => {
+}, NO_SESSION_ERROR = "no_session: this verdict cannot bind a host session (WORKIT_SESSION_ID is unset or empty and no --session was named), so it would be stored as a self verdict that no gate accepts; nothing was recorded", NO_SESSION_UNBLOCK = "a Claude Code verifier or reviewer passes exactly the `--session <lead>:<agent id> --token=<token>` its SubagentStart hook put in its context; none there means that hook did not bind it (check `workit doctor`: hook_runs lists SubagentStart, hook_issued_sessions passes), so the lead spawns a fresh workit:verifier or workit:reviewer. On Codex, OpenCode and Pi record from the agent's own shell, where the host sets its session. The author records `--self` instead (never accepted as independent)", claimedSession = (acting) => acting.source === "as" ? acting.derivedFrom ?? null : acting.actor.session, positiveInt2 = (value, flag) => {
   if (value === undefined)
     return;
   const parsed = Number(value);
@@ -104692,7 +104806,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path67 from "node:path";
+import path70 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -105185,12 +105299,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path67.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path70.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path67.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path70.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -105579,8 +105693,8 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync10 } from "node:fs";
-import path68 from "node:path";
+import { existsSync as existsSync26, readdirSync as readdirSync14, readFileSync as readFileSync28, statSync as statSync10 } from "node:fs";
+import path71 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
@@ -105593,7 +105707,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync14(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path68.join(dir, entry.name);
+    const full = path71.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -105605,8 +105719,8 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path68.resolve(cwd, input);
-    if (!existsSync24(full))
+    const full = path71.resolve(cwd, input);
+    if (!existsSync26(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
       walkTests(full, files);
@@ -105642,11 +105756,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path68.join(root, file), lines);
+    changed.set(path71.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path68.join(root, file), "all");
+    changed.set(path71.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -105659,7 +105773,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync27(file, "utf8"), file);
+      parsed = parseSource(readFileSync28(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -105708,7 +105822,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path68.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path71.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -105722,12 +105836,12 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync25,
+  existsSync as existsSync27,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync15,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync29,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync10,
   renameSync as renameSync7,
@@ -105737,8 +105851,8 @@ import {
   writeFileSync as writeFileSync12,
   copyFileSync as copyFileSync8
 } from "node:fs";
-import os22 from "node:os";
-import path69 from "node:path";
+import os23 from "node:os";
+import path72 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -105811,7 +105925,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path69.posix.join(path69.posix.dirname(file), spec)) === target)
+        if (stripExt(path72.posix.join(path72.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -105819,7 +105933,7 @@ function relatedTests(source, testFiles) {
     return false;
   }).map((entry) => entry.file);
 }
-function removeStaleCopies(tmp = os22.tmpdir()) {
+function removeStaleCopies(tmp = os23.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
@@ -105831,12 +105945,12 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path69.join(tmp, name);
+    const dir = path72.join(tmp, name);
     try {
       const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync28(path69.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync29(path72.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -105853,8 +105967,8 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync12(target, { recursive: true });
   for (const entry of readdirSync15(origin, { withFileTypes: true })) {
-    const from = path69.join(origin, entry.name);
-    const to = path69.join(target, entry.name);
+    const from = path72.join(origin, entry.name);
+    const to = path72.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -105870,9 +105984,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path69.relative(repo, real);
-      if (!relative.startsWith("..") && !path69.isAbsolute(relative) && !relative.split(path69.sep).includes("node_modules")) {
-        symlinkSync(path69.join(copy, relative), to, "junction");
+      const relative = path72.relative(repo, real);
+      if (!relative.startsWith("..") && !path72.isAbsolute(relative) && !relative.split(path72.sep).includes("node_modules")) {
+        symlinkSync(path72.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -105888,7 +106002,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync10(repo);
   if (real && inside5(realRepo, real)) {
-    symlinkSync(path69.relative(path69.dirname(to), path69.join(tree, path69.relative(realRepo, real))), to);
+    symlinkSync(path72.relative(path72.dirname(to), path72.join(tree, path72.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync11(real).isFile())
@@ -105897,10 +106011,10 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path69.join(copy, file);
+  const target = path72.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path69.dirname(target))))
+    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path72.dirname(target))))
       return false;
   } catch {
     return false;
@@ -105911,9 +106025,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path69.join(os22.tmpdir(), TEMP_PREFIX));
-  writeFileSync12(path69.join(dir, PID_FILE), String(process.pid));
-  const tree = path69.join(dir, "tree");
+  const dir = mkdtempSync4(path72.join(os23.tmpdir(), TEMP_PREFIX));
+  writeFileSync12(path72.join(dir, PID_FILE), String(process.pid));
+  const tree = path72.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -105930,29 +106044,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path69.join(repo, relative);
+    const from = path72.join(repo, relative);
     let stat;
     try {
       stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path69.join(tree, relative);
-    mkdirSync12(path69.dirname(to), { recursive: true });
+    const to = path72.join(tree, relative);
+    mkdirSync12(path72.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync8(from, to);
-    let parent = path69.dirname(relative);
+    let parent = path72.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path69.dirname(parent);
+      parent = path72.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path69.join(repo, parent, "node_modules");
-    if (existsSync25(modules) && !existsSync25(path69.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path69.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path72.join(repo, parent, "node_modules");
+    if (existsSync27(modules) && !existsSync27(path72.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path72.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -105991,20 +106105,20 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync28(path69.join(repo, file), "utf8") };
+      return { file, text: readFileSync29(path72.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path69.relative(repo, absolute));
+    const relative = toPosix(path72.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync25(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync27(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync28(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync29(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -106012,9 +106126,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path69.relative(repo, options.cwd);
+  const cwdRelative = path72.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path69.relative(cwdRelative, file));
+    const relative = toPosix(path72.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -106050,7 +106164,7 @@ async function runMutation(options) {
     return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path69.join(copy, cwdRelative);
+  const copyCwd = path72.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -106085,7 +106199,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync28(path69.join(copy, mutant.file), "utf8");
+      const original = readFileSync29(path72.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -106142,8 +106256,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside5 = (root, file) => {
-  const relative = path69.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path69.isAbsolute(relative);
+  const relative = path72.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path72.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -106191,8 +106305,8 @@ var exports_test_audit = {};
 __export(exports_test_audit, {
   run: () => run23
 });
-import { existsSync as existsSync26 } from "node:fs";
-import path70 from "node:path";
+import { existsSync as existsSync28 } from "node:fs";
+import path73 from "node:path";
 function parse8(argv) {
   const options = {
     paths: [],
@@ -106297,8 +106411,8 @@ async function run23(argv, io) {
     return emit(io, fail2("invalid_input", `${options}
 usage: ${USAGE16}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path70.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path70.relative(io.cwd, file) || file);
+  const repo = top.ok ? path73.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path73.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -106315,7 +106429,7 @@ usage: ${USAGE16}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync26(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync28(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -106436,8 +106550,8 @@ var exports_youtrack = {};
 __export(exports_youtrack, {
   run: () => run25
 });
-import { readFileSync as readFileSync29 } from "node:fs";
-import path71 from "node:path";
+import { readFileSync as readFileSync30 } from "node:fs";
+import path74 from "node:path";
 async function run25(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -106483,7 +106597,7 @@ async function run25(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync29(path71.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync30(path74.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage4(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE18);
       }
@@ -106551,8 +106665,8 @@ var exports_changelog = {};
 __export(exports_changelog, {
   run: () => run26
 });
-import { readFileSync as readFileSync30 } from "node:fs";
-import path72 from "node:path";
+import { readFileSync as readFileSync31 } from "node:fs";
+import path75 from "node:path";
 async function run26(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -106598,7 +106712,7 @@ async function run26(argv, io) {
   ]);
 }
 var USAGE19 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync30(0, "utf8") : raw.startsWith("@") ? readFileSync30(path72.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync31(0, "utf8") : raw.startsWith("@") ? readFileSync31(path75.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -106614,7 +106728,7 @@ __export(exports_handoff, {
   run: () => run27
 });
 import fs37 from "node:fs";
-import path73 from "node:path";
+import path76 from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 function render3(brief) {
   const lines = [
@@ -106654,9 +106768,9 @@ function bounded(brief, cwd) {
   let file = null;
   if (store.ok)
     try {
-      const dir = path73.join(store.value.root, "handoff");
+      const dir = path76.join(store.value.root, "handoff");
       fs37.mkdirSync(dir, { recursive: true });
-      file = path73.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
+      file = path76.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
       fs37.writeFileSync(file, `${[...body, ...tail].join(`
 `)}
 `, {
@@ -106733,7 +106847,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_host_session();
 init_package();
-import path74 from "node:path";
+import path77 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -107645,7 +107759,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path74.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path77.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail2("invalid_input", parsed.error));