@brainervirus/workit-claude-code 8.38.2 → 8.38.4

package/dist/workit.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.38.2",
+    version: "8.38.4",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.38.2",
+      "@brainervirus/workit-cursor": "^8.38.4",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.38.2"
+      "@brainervirus/workit-core": "^8.38.4"
     },
     engines: {
       node: ">=24"
@@ -16832,6 +16832,79 @@ var init_workers = __esm(() => {
   UNCERTAIN_WORKER_STATES = ["dispatching", "running", "cancelling", "unknown"];
 });
 
+// packages/workit-core/src/core/task-delivery.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
+function closeDeliveredTasks(store, now, options = {}) {
+  let closedCount = 0;
+  const index = store.listStoreIndex();
+  if (!index.ok)
+    return 0;
+  const open = index.data.filter((entry) => entry.status !== "closed" && entry.branch !== null);
+  if (open.length === 0)
+    return 0;
+  const file = options.cached ? ledgerPath(store.root) : null;
+  const signature = file?.ok ? `${fileSignature(file.value) ?? "-"}|${open.map((entry) => entry.id).join(",")}` : null;
+  const marker = file?.ok ? `${file.value}.delivery-sweep` : null;
+  if (signature && marker) {
+    try {
+      if (readFileSync6(marker, "utf8") === signature)
+        return 0;
+    } catch {}
+  }
+  const ledger = readLedger(store.root);
+  if (!ledger.ok)
+    return 0;
+  const rows = ledger.value.rows;
+  const after = (row, since) => Date.parse(row.at) >= Date.parse(since);
+  for (const entry of open) {
+    const merged = rows.findLast((row) => row.type === "pr.merged" && row.branch === entry.branch && typeof row.pr === "number" && after(row, entry.createdAt));
+    if (!merged)
+      continue;
+    const pr = merged.pr;
+    const verified = rows.findLast((row) => row.type === "delivery.verified" && row.expect === "merged" && row.branch === entry.branch && (row.pr === undefined || row.pr === pr));
+    if (!verified) {
+      const next = `PR #${pr} is merged but delivery is not verified: run \`workit verify-delivery merged\``;
+      if (entry.progress.nextAction !== next) {
+        store.mutateTask(entry.id, entry.revision, (task, context) => success(context.revision, null, {
+          ...task,
+          progress: { ...task.progress, nextAction: next }
+        }));
+      }
+      continue;
+    }
+    const task = store.readTask(entry.id);
+    if (!task.ok || task.data.status === "closed")
+      continue;
+    if (task.data.workers.some((worker) => workerBlocksTransition("close", worker.data.state)))
+      continue;
+    const closed = store.mutateTask(entry.id, task.data.revision, (value, context) => success(context.revision, null, {
+      ...value,
+      status: "closed",
+      closure: {
+        outcome: "verified",
+        at: context.now,
+        summary: `delivered: PR #${pr} merged (pr.merged ${String(merged.id)}) and delivery verified (delivery.verified ${String(verified.id)})`,
+        decisionIds: [],
+        evidenceIds: []
+      }
+    }), now);
+    if (closed.ok)
+      closedCount++;
+  }
+  if (signature && marker && closedCount === 0 && !racySignature(signature.split("|")[0] ?? "")) {
+    try {
+      writeFileSync4(marker, signature);
+    } catch {}
+  }
+  return closedCount;
+}
+var init_task_delivery = __esm(() => {
+  init_ledger();
+  init_task_store();
+  init_task_contract();
+  init_workers();
+});
+
 // packages/workit-core/src/core/task-evaluation.ts
 import { createHash as createHash11 } from "node:crypto";
 import * as fs14 from "node:fs";
@@ -18804,10 +18877,10 @@ var init_route_intent = __esm(() => {
 
 // packages/workit-core/src/core/runtime-identity.ts
 import { createHash as createHash12 } from "node:crypto";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 var sha256Hex = (bytes) => createHash12("sha256").update(bytes).digest("hex"), bundleHashOfFile = (file) => {
   try {
-    return sha256Hex(readFileSync7(file));
+    return sha256Hex(readFileSync8(file));
   } catch {
     return null;
   }
@@ -21199,7 +21272,7 @@ var init_core3 = __esm(() => {
 });
 
 // packages/workit-cli/src/task.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import path27 from "node:path";
 async function readInput(input) {
   if (typeof input === "string")
@@ -21216,7 +21289,7 @@ async function payloadValue(raw, deps) {
     return { ok: true, value: {} };
   let source;
   try {
-    source = raw === "-" ? await readInput(deps.stdin ?? process.stdin) : raw.startsWith("@") ? decodeUtf8(readFileSync8(raw.slice(1))) : raw;
+    source = raw === "-" ? await readInput(deps.stdin ?? process.stdin) : raw.startsWith("@") ? decodeUtf8(readFileSync9(raw.slice(1))) : raw;
   } catch (error) {
     return {
       ok: false,
@@ -21504,7 +21577,12 @@ async function runTaskCommand(argv, deps = {}) {
     return parsed.usage ? 2 : 1;
   }
   const root = workspaceRootFor(deps);
-  const core = new WorkitCore(new TaskStore(root), contextFor(root, parsed.parsed.actor !== undefined ? { ...deps, actor: parsed.parsed.actor } : deps));
+  const store = new TaskStore(root);
+  try {
+    const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+    closeDeliveredTasks(store, now, { cached: parsed.parsed.action !== "list" });
+  } catch {}
+  const core = new WorkitCore(store, contextFor(root, parsed.parsed.actor !== undefined ? { ...deps, actor: parsed.parsed.actor } : deps));
   let result;
   if (parsed.parsed.handoff) {
     const exported = dispatch(core, "state", parsed.parsed.request);
@@ -21600,6 +21678,7 @@ var init_task = __esm(() => {
   init_current_judgment();
   init_judgment();
   init_lane();
+  init_task_delivery();
   init_task_store();
   init_core3();
   init_task_contract();
@@ -65285,13 +65364,13 @@ var init_changelog = __esm(() => {
 
 // packages/workit-core/src/core/hygiene.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync10, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync11, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import path29 from "node:path";
 var repoRoot2, templatesDir = () => path29.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
   if (!existsSync10(path29.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync10(path29.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync11(path29.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -65344,7 +65423,7 @@ var repoRoot2, templatesDir = () => path29.join(repoRoot2, "templates", "hygiene
     const tpl = path29.join(templatesDir(), file);
     if (!existsSync10(tpl))
       continue;
-    const content = readFileSync10(tpl, "utf8").replace(/<PROJECT>/g, path29.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    const content = readFileSync11(tpl, "utf8").replace(/<PROJECT>/g, path29.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
     planned.push({ path: path29.join(root, file), content });
   }
   return planned;
@@ -65356,13 +65435,13 @@ var init_hygiene = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/setup-state.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "node:fs";
 import path30 from "node:path";
 var classifySetupFile = (dir, name) => {
   const file = path30.join(dir, name);
   let raw;
   try {
-    raw = readFileSync11(file, "utf8");
+    raw = readFileSync12(file, "utf8");
   } catch {
     if (existsSync11(file)) {
       return { file, status: "malformed", error: `${file} is not readable` };
@@ -65803,7 +65882,7 @@ import {
   accessSync,
   constants as constants2,
   existsSync as existsSync12,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   readdirSync as readdirSync6,
   realpathSync as realpathSync6,
   statSync as statSync2
@@ -66093,7 +66172,7 @@ function runHostCommand(step, context = {}) {
 }
 var resolveWindowsShimScript = (shim) => {
   try {
-    const contents = readFileSync12(shim, "utf8");
+    const contents = readFileSync13(shim, "utf8");
     return resolveWindowsShimEntry(contents, shim);
   } catch {
     return null;
@@ -66114,7 +66193,7 @@ var resolveWindowsShimScript = (shim) => {
 }, isPiWorkitInstalled = (home, env = process.env) => {
   const settings = path33.join(env.PI_CODING_AGENT_DIR ?? path33.join(home, ".pi", "agent"), "settings.json");
   try {
-    const document2 = JSON.parse(readFileSync12(settings, "utf8"));
+    const document2 = JSON.parse(readFileSync13(settings, "utf8"));
     return (document2.packages ?? []).some((entry) => {
       const source = entry && typeof entry === "object" && !Array.isArray(entry) ? entry.source : entry;
       const value = String(source).replaceAll("\\", "/").replace(/\/+$/, "");
@@ -66125,7 +66204,7 @@ var resolveWindowsShimScript = (shim) => {
   }
 }, OPENCODE_PLUGIN_SCOPE = "@brainervirus", OPENCODE_PLUGIN_NAME = "workit-opencode", packageVersionAt = (root, name) => {
   try {
-    const pkg = JSON.parse(readFileSync12(path33.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync13(path33.join(root, "package.json"), "utf8"));
     return pkg.name === name && typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -66163,7 +66242,7 @@ var resolveWindowsShimScript = (shim) => {
     path33.join(root, "package.json")
   ]) {
     try {
-      const manifest = JSON.parse(readFileSync12(file, "utf8"));
+      const manifest = JSON.parse(readFileSync13(file, "utf8"));
       const repository = typeof manifest.repository === "string" ? manifest.repository : manifest.repository?.url;
       if ((manifest.name === "workit" || manifest.name === "@brainervirus/workit-codex") && repository?.replace(/\.git$/, "").toLowerCase() === "https://github.com/brainervirus/workit")
         return true;
@@ -66204,7 +66283,7 @@ var resolveWindowsShimScript = (shim) => {
   return relative === "" || !relative.startsWith("..") && !path33.isAbsolute(relative);
 }, isCanonicalClaudePlugin = (root) => {
   try {
-    const manifest = JSON.parse(readFileSync12(path33.join(root, ".claude-plugin", "plugin.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync13(path33.join(root, ".claude-plugin", "plugin.json"), "utf8"));
     const repository = typeof manifest.repository === "string" ? manifest.repository : manifest.repository?.url;
     return manifest.name === "workit" && repository?.replace(/\.git$/, "").toLowerCase() === "https://github.com/brainervirus/workit";
   } catch {
@@ -66214,7 +66293,7 @@ var resolveWindowsShimScript = (shim) => {
   const file = path33.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json");
   let registry;
   try {
-    registry = JSON.parse(readFileSync12(file, "utf8"));
+    registry = JSON.parse(readFileSync13(file, "utf8"));
   } catch {
     return [];
   }
@@ -66263,7 +66342,7 @@ var init_host_install = __esm(() => {
 });
 
 // packages/workit-core/src/core/skill-manifests.ts
-import { cpSync as cpSync3, existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { cpSync as cpSync3, existsSync as existsSync13, readFileSync as readFileSync14, readdirSync as readdirSync7, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import path34 from "node:path";
 var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync13(root) ? readdirSync7(root).filter((name) => existsSync13(path34.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
@@ -66281,7 +66360,7 @@ var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync13(root) ? re
       const file = path34.join(dir, entry.name);
       if (entry.isDirectory())
         pending.push(file);
-      else if ((statSync3(file).mode & 73) !== 0 || readFileSync13(file).subarray(0, 2).toString("latin1") === "#!") {
+      else if ((statSync3(file).mode & 73) !== 0 || readFileSync14(file).subarray(0, 2).toString("latin1") === "#!") {
         return `Cursor vendor contains active file: ${file}`;
       }
     }
@@ -66314,11 +66393,11 @@ import {
   existsSync as existsSync14,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   renameSync as renameSync3,
   rmSync as rmSync2,
   statSync as statSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import path35 from "node:path";
 function inspectSessionHook(cwd, env = process.env) {
@@ -66517,7 +66596,7 @@ exit 0
   return rel === "" || !rel.startsWith("..") && !path35.isAbsolute(rel);
 }, readText3 = (file) => {
   try {
-    return readFileSync14(file, "utf8");
+    return readFileSync15(file, "utf8");
   } catch {
     return null;
   }
@@ -66621,7 +66700,7 @@ exit 0
   mkdirSync5(path35.dirname(file), { recursive: true });
   const staged = `${file}.workit-new`;
   try {
-    writeFileSync6(staged, content, { mode: 493 });
+    writeFileSync7(staged, content, { mode: 493 });
     chmodSync(staged, 493);
     renameSync3(staged, file);
   } finally {
@@ -66684,7 +66763,7 @@ var init_heavy_words = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/hook-runs.ts
-import { mkdirSync as mkdirSync6, readdirSync as readdirSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync8, readFileSync as readFileSync16, writeFileSync as writeFileSync8 } from "node:fs";
 import path37 from "node:path";
 var HOOK_RUNS_DIR = "hook-runs", readHookRuns = (dir) => {
   const runs = [];
@@ -66696,7 +66775,7 @@ var HOOK_RUNS_DIR = "hook-runs", readHookRuns = (dir) => {
   }
   for (const name of names) {
     try {
-      const row = JSON.parse(readFileSync15(path37.join(dir, HOOK_RUNS_DIR, name), "utf8"));
+      const row = JSON.parse(readFileSync16(path37.join(dir, HOOK_RUNS_DIR, name), "utf8"));
       if (typeof row.host === "string" && typeof row.event === "string" && typeof row.at === "string" && typeof row.count === "number")
         runs.push({
           host: row.host,
@@ -66742,7 +66821,7 @@ import {
   existsSync as existsSync15,
   readdirSync as readdirSync9,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   realpathSync as realpathSync7,
   rmSync as rmSync3,
   statSync as statSync5
@@ -67170,7 +67249,7 @@ ${[...rules, ...lease, grant].join(`
 }, AGENT_SESSION_VARS, agentSessionVar = (env) => AGENT_SESSION_VARS.find((name) => (env[name] ?? "") !== "") ?? null, RECORD_FILE = "host-permissions.json", readOwnership = (options = {}) => {
   const { stateDir } = resolvePaths(options);
   try {
-    const value = JSON.parse(readFileSync16(path38.join(stateDir, RECORD_FILE), "utf8"));
+    const value = JSON.parse(readFileSync17(path38.join(stateDir, RECORD_FILE), "utf8"));
     if (isRecord5(value) && isRecord5(value.hosts))
       return { version: 1, hosts: value.hosts };
   } catch {}
@@ -67199,7 +67278,7 @@ ${[...rules, ...lease, grant].join(`
   writeOwnership(record, paths.stateDir);
 }, readText4 = (file) => {
   try {
-    return readFileSync16(file, "utf8");
+    return readFileSync17(file, "utf8");
   } catch {
     return null;
   }
@@ -67361,13 +67440,13 @@ import {
   mkdirSync as mkdirSync8,
   mkdtempSync,
   readdirSync as readdirSync10,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   readlinkSync as readlinkSync2,
   renameSync as renameSync4,
   rmSync as rmSync4,
   statSync as statSync6,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync9
 } from "node:fs";
 import os12 from "node:os";
 import path39 from "node:path";
@@ -67431,14 +67510,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, readJson = (p) => {
   try {
-    const parsed = JSON.parse(readFileSync17(p, "utf8"));
+    const parsed = JSON.parse(readFileSync18(p, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }, parsesAsConfigObject = (p) => {
   try {
-    return isConfigObject(JSON.parse(readFileSync17(p, "utf8")));
+    return isConfigObject(JSON.parse(readFileSync18(p, "utf8")));
   } catch {
     return false;
   }
@@ -67661,7 +67740,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const tables = new Map;
   let text;
   try {
-    text = readFileSync17(file, "utf8");
+    text = readFileSync18(file, "utf8");
   } catch {
     return tables;
   }
@@ -67832,7 +67911,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     let stale = false;
     for (const file of files) {
       const dest = path39.join(agentsDir, file);
-      const want = stampCodexAgent(readFileSync17(path39.join(source, file), "utf8"), version);
+      const want = stampCodexAgent(readFileSync18(path39.join(source, file), "utf8"), version);
       let link = false;
       try {
         link = lstatSync5(dest).isSymbolicLink();
@@ -67846,7 +67925,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       }
       let have = null;
       try {
-        have = readFileSync17(dest, "utf8");
+        have = readFileSync18(dest, "utf8");
       } catch {
         have = null;
       }
@@ -68095,7 +68174,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, validNodeEntry = (entry, runtime, env) => {
   try {
     const stat = statSync6(entry);
-    if (!stat.isFile() || stat.size === 0 || !readFileSync17(entry, "utf8").startsWith(`#!/usr/bin/env node
+    if (!stat.isFile() || stat.size === 0 || !readFileSync18(entry, "utf8").startsWith(`#!/usr/bin/env node
 `)) {
       return false;
     }
@@ -68951,7 +69030,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return { ...installSessionHook(res.cwd, res.env), workspace: workspace.name };
 }, isPlaceholder = (p) => {
   try {
-    return readFileSync17(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
+    return readFileSync18(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
   } catch {
     return false;
   }
@@ -69165,7 +69244,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const probe = path39.join(logsDir, "doctor-probe.tmp");
   try {
     mkdirSync8(logsDir, { recursive: true, mode: 448 });
-    writeFileSync8(probe, `{"probe":true}
+    writeFileSync9(probe, `{"probe":true}
 `, { mode: 384 });
     return {
       id: "log_writable",
@@ -69244,7 +69323,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const counts = { skip: 0, late: 0 };
   let text = "";
   try {
-    text = readFileSync17(path39.join(stateDir, HOOK_SKIPS_FILE), "utf8");
+    text = readFileSync18(path39.join(stateDir, HOOK_SKIPS_FILE), "utf8");
   } catch {
     return counts;
   }
@@ -69435,7 +69514,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   return files.some((file) => {
     try {
-      return readFileSync17(path39.join(root, "dist", file), "utf8").includes(HOOK_ISSUED_MARKER);
+      return readFileSync18(path39.join(root, "dist", file), "utf8").includes(HOOK_ISSUED_MARKER);
     } catch {
       return false;
     }
@@ -69779,13 +69858,13 @@ import {
   lstatSync as lstatSync6,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readdirSync as readdirSync11,
   realpathSync as realpathSync8,
   renameSync as renameSync5,
   rmSync as rmSync5,
   statSync as statSync7,
-  writeFileSync as writeFileSync9
+  writeFileSync as writeFileSync10
 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import os13 from "node:os";
@@ -69953,7 +70032,7 @@ function buildSetupPreview(values, opts = {}) {
     if (target?.ok) {
       const root = target.root;
       const gitignorePath = path40.join(root, ".gitignore");
-      const existing = existsSync17(gitignorePath) ? readFileSync18(gitignorePath, "utf8") : "";
+      const existing = existsSync17(gitignorePath) ? readFileSync19(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
       const entries = GITIGNORE_ENTRIES.filter((e) => e.trim() !== "" && !existingLines.has(e.trim()));
@@ -70017,7 +70096,7 @@ function applyMutation(m) {
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
       }
       mkdirSync9(dir, { recursive: true });
-      writeFileSync9(m.path, JSON.stringify(merged, null, 2) + `
+      writeFileSync10(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -70061,7 +70140,7 @@ function applyMutation(m) {
       mkdirSync9(dir, { recursive: true });
       const tmp = `${m.path}.${process.pid}.tmp`;
       try {
-        writeFileSync9(tmp, next, "utf8");
+        writeFileSync10(tmp, next, "utf8");
         if (workspacesRevision(readFileSafe(m.path)) !== m.expectedRevision) {
           rmSync5(tmp, { force: true });
           return {
@@ -70100,7 +70179,7 @@ function applyMutation(m) {
       const separator = existing && !existing.endsWith(`
 `) ? `
 ` : "";
-      writeFileSync9(m.path, existing + separator + (existing ? `
+      writeFileSync10(m.path, existing + separator + (existing ? `
 ` : "") + add.join(`
 `) + `
 `, "utf8");
@@ -70140,7 +70219,7 @@ function applyMutation(m) {
         };
       }
       mkdirSync9(path40.dirname(m.path), { recursive: true });
-      writeFileSync9(m.path, JSON.stringify(merged, null, 2) + `
+      writeFileSync10(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -70212,7 +70291,7 @@ function applyOpenCode(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync9(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
+  writeFileSync10(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
 `, "utf8");
   return existing.kind === "record" ? {
     platform: "opencode",
@@ -70247,12 +70326,12 @@ function copyPluginDir(src, dest) {
     });
     const stagedHooks = path40.join(stage, CURSOR_HOOKS_FILE);
     if (existsSync17(stagedHooks))
-      writeFileSync9(stagedHooks, localizedCursorHooks(readFileSync18(stagedHooks), dest));
+      writeFileSync10(stagedHooks, localizedCursorHooks(readFileSync19(stagedHooks), dest));
     for (const [name, content] of rules) {
       mkdirSync9(path40.join(stage, "rules"), { recursive: true });
-      writeFileSync9(path40.join(stage, "rules", name), content);
+      writeFileSync10(path40.join(stage, "rules", name), content);
     }
-    writeFileSync9(path40.join(stage, ".workit-root"), realSrc + `
+    writeFileSync10(path40.join(stage, ".workit-root"), realSrc + `
 `, "utf8");
     if (!samePluginContent(realSrc, stage, dest))
       throw new Error("staged adapter content is incomplete");
@@ -70294,7 +70373,7 @@ function applyCursorSettings(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync9(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
+  writeFileSync10(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -70333,7 +70412,7 @@ function applyCursorMcp(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync9(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
+  writeFileSync10(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -70602,7 +70681,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return configured ?? fallback;
 }, readConfigRecord = (file) => {
   try {
-    const value = JSON.parse(readFileSync18(file, "utf8"));
+    const value = JSON.parse(readFileSync19(file, "utf8"));
     return isRecord6(value) ? value : null;
   } catch {
     return null;
@@ -70623,7 +70702,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
 }, isRecord6 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readExisting = (p) => {
   let raw;
   try {
-    raw = readFileSync18(p, "utf8");
+    raw = readFileSync19(p, "utf8");
   } catch {
     if (existsSync17(p))
       return { kind: "malformed", error: `${p} is not readable` };
@@ -70640,7 +70719,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return { kind: "malformed", error: `${p} is not a JSON object` };
 }, readFileSafe = (p) => {
   try {
-    return readFileSync18(p, "utf8");
+    return readFileSync19(p, "utf8");
   } catch {
     return null;
   }
@@ -70655,7 +70734,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, isAdapter = (root, platform) => {
   try {
-    const pkg = JSON.parse(readFileSync18(path40.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync19(path40.join(root, "package.json"), "utf8"));
     return pkg.name === `@brainervirus/workit-${platform}`;
   } catch {
     return false;
@@ -70704,8 +70783,8 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
         if (!statSync7(installed).isDirectory() || !samePluginContent(source, installed, pluginDir, rel))
           return false;
       } else {
-        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync18(source), pluginDir) : readFileSync18(source);
-        if (!expected.equals(readFileSync18(installed)))
+        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync19(source), pluginDir) : readFileSync19(source);
+        if (!expected.equals(readFileSync19(installed)))
           return false;
       }
     }
@@ -70733,7 +70812,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
         continue;
       if (existsSync17(path40.join(sourceRules, entry.name)))
         continue;
-      preserved.set(entry.name, readFileSync18(path40.join(installedRules, entry.name)));
+      preserved.set(entry.name, readFileSync19(path40.join(installedRules, entry.name)));
     }
   } catch {}
   return preserved;
@@ -70788,7 +70867,7 @@ var init_setup = __esm(() => {
 });
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync19, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync20, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "node:fs";
 import path41 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 function applyWorkspaceBranchPolicy(opts) {
@@ -70857,7 +70936,7 @@ function applyWorkspaceBranchPolicy(opts) {
   mkdirSync10(path41.dirname(wsPath), { recursive: true });
   const tmp = `${wsPath}.${process.pid}.tmp`;
   try {
-    writeFileSync10(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
+    writeFileSync11(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
 `, "utf8");
     if (workspacesRevision(readFileSafe2(wsPath)) !== revision) {
       rmSync6(tmp, { force: true });
@@ -70886,7 +70965,7 @@ function applyWorkspaceBranchPolicy(opts) {
 }
 var readFileSafe2 = (p) => {
   try {
-    return readFileSync19(p, "utf8");
+    return readFileSync20(p, "utf8");
   } catch {
     return null;
   }
@@ -71726,7 +71805,7 @@ var init_wizard_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/uninstall.ts
-import { existsSync as existsSync19, readFileSync as readFileSync20, realpathSync as realpathSync9, rmSync as rmSync7, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync21, realpathSync as realpathSync9, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "node:fs";
 import os14 from "node:os";
 import path43 from "node:path";
 function cleanCursorSettings(settings, pluginDir) {
@@ -71988,7 +72067,7 @@ var resolveUninstallPaths = (options = {}) => {
 }, isRecord7 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readJsonRecord = (file) => {
   let raw;
   try {
-    raw = readFileSync20(file, "utf8");
+    raw = readFileSync21(file, "utf8");
   } catch {
     if (existsSync19(file))
       return { kind: "malformed", error: `${file} is not readable` };
@@ -72053,7 +72132,7 @@ var resolveUninstallPaths = (options = {}) => {
 `;
   let current;
   try {
-    current = readFileSync20(target, "utf8");
+    current = readFileSync21(target, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -72064,7 +72143,7 @@ var resolveUninstallPaths = (options = {}) => {
     return { status: "skipped", detail: "already clean" };
   }
   try {
-    writeFileSync11(target, serialized, "utf8");
+    writeFileSync12(target, serialized, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -74838,171 +74917,156 @@ var init_setup2 = __esm(() => {
   ALL_HOSTS = ["claude-code", "codex", "cursor", "opencode", "pi"];
 });
 
-// packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
-import {
-  existsSync as existsSync20,
-  mkdtempSync as mkdtempSync3,
-  rmSync as rmSync8,
-  readFileSync as readFileSync21,
-  readdirSync as readdirSync12,
-  mkdirSync as mkdirSync11,
-  copyFileSync as copyFileSync6,
-  chmodSync as chmodSync2,
-  cpSync as cpSync5,
-  lstatSync as lstatSync7
-} from "node:fs";
+// packages/workit-cli/src/upgrade/shared.ts
+import { existsSync as existsSync20, readFileSync as readFileSync22 } from "node:fs";
 import path44 from "node:path";
 import os16 from "node:os";
 import { createHash as createHash15 } from "node:crypto";
-function previewUpgrade(hosts = HOSTS2, deps = {}) {
-  const paths = upgradePaths(deps);
-  const { home, configDir } = paths;
-  const run = runner(deps);
-  const state = readSetupState(configDir);
-  const plan = {
-    ok: true,
-    blocked: [],
-    failed: [],
-    skipped: [],
-    entries: [],
-    configDigests: {},
-    migrations: []
+var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-opencode", OPENCODE_UPDATE, CODEX_MARKETPLACE = "workflow-toolkit", CLI_FIX = "npm install --global @brainervirus/workit-cli@latest", fixFor = (host, selector = "") => host === "pi" ? `pi update --extension ${selector || "npm:@brainervirus/workit-pi"}` : host === "codex" ? `codex plugin marketplace upgrade ${CODEX_MARKETPLACE} && codex plugin add workit@${CODEX_MARKETPLACE}` : host === "claude-code" ? "claude plugin marketplace update workit && claude plugin update workit@workit" : host === "opencode" ? OPENCODE_UPDATE : host === "cursor" ? "workit upgrade --hosts=cursor" : CLI_FIX, upgradePaths = (deps) => {
+  const home = deps.home ?? deps.env?.HOME ?? os16.homedir();
+  const env = {
+    ...process.env,
+    ...deps.home || deps.env?.HOME ? {
+      HOME: home,
+      CODEX_HOME: path44.join(home, ".codex"),
+      CLAUDE_CONFIG_DIR: path44.join(home, ".claude"),
+      PI_CODING_AGENT_DIR: path44.join(home, ".pi/agent"),
+      XDG_CONFIG_HOME: path44.join(home, ".config"),
+      WORKFLOW_TOOLKIT_CONFIG: undefined,
+      WORKFLOW_TOOLKIT_CONFIG_DIR: undefined
+    } : {},
+    ...deps.env,
+    HOME: home
   };
-  for (const file of [state.config, state.workspaces, state.youtrack, state.vcs]) {
-    if (file.status === "malformed")
-      plan.blocked.push(file.error ?? file.file);
-    plan.configDigests[file.file] = digest2(file.file);
+  const xdg = env.XDG_CONFIG_HOME || path44.join(home, ".config");
+  const codexHome = env.CODEX_HOME ?? path44.join(home, ".codex");
+  return {
+    home,
+    env,
+    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path44.join(xdg, "workit"),
+    opencodeConfig: path44.join(xdg, "opencode/opencode.json"),
+    piSettings: path44.join(env.PI_CODING_AGENT_DIR ?? path44.join(home, ".pi/agent"), "settings.json"),
+    codexHome,
+    codexConfig: path44.join(codexHome, "config.toml"),
+    cursorRoot: path44.join(home, ".cursor/plugins/local/workit")
+  };
+}, object2 = (file) => {
+  if (!existsSync20(file))
+    return null;
+  let data;
+  try {
+    data = JSON.parse(readFileSync22(file, "utf8"));
+  } catch {
+    throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
   }
-  for (const file of [
-    paths.opencodeConfig,
-    paths.opencodeConfig + "c",
-    path44.join(home, ".cursor/settings.json"),
-    path44.join(home, ".cursor/mcp.json"),
-    path44.join(paths.cursorRoot, "package.json"),
-    paths.codexConfig,
-    paths.piSettings
-  ])
-    plan.configDigests[file] = digest2(file);
+  if (!data || typeof data !== "object" || Array.isArray(data))
+    throw new Error(`${file} is not a configuration object`);
+  return data;
+}, objectOrNull = (file) => {
   try {
-    const config = object2(state.config.file);
-    if (config && Object.hasOwn(config, "trustedPaths"))
-      plan.migrations.push({
-        id: "2.0-remove-ignored-trusted-paths",
-        file: state.config.file,
-        description: "Remove ignored Workit trustedPaths; native host permissions remain unchanged"
-      });
-  } catch (error) {
-    plan.blocked.push(errorText(error));
+    return object2(file);
+  } catch {
+    return null;
   }
-  const installedSources = sources(paths, run, hosts, plan.failed);
-  let opencodeHelp;
-  if (installedSources.some((source) => source.host === "opencode")) {
-    const probe = opencodeProbe(deps, ["--version"]);
-    const installed = probe.status === 0 ? probe.stdout.match(/\d+\.\d+\.\d+/)?.[0] : undefined;
-    if (installed && !versionAtLeast(installed, SUPPORT_MATRIX.opencode.minimum))
-      (plan.warnings ??= []).push(`opencode ${installed}: ${OPENCODE_V1_FIX}`);
+}, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync22(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+  const { home, env } = upgradePaths(deps);
+  let step;
+  try {
+    step = hostCommand(command, args, { home, env });
+  } catch {
+    return { status: 1, stdout: "" };
   }
-  for (const host of ["opencode", "pi"]) {
-    if (new Set(installedSources.filter((source) => source.host === host).map((source) => source.selector)).size > 1)
-      plan.failed.push({
-        host,
-        status: "failed",
-        reason: "conflicting Workit registrations; reconcile them in the native host before upgrading"
-      });
+  const result = runHostCommand(step, { home, env });
+  return { status: result.exitCode, stdout: result.stdout };
+}), errorText = (error) => error instanceof Error ? error.message : "installed source could not be read", piInstalledVersion = (listing, selector) => {
+  const lines = listing.split(/\r?\n/).map((line) => line.trim());
+  const index = lines.indexOf(selector);
+  if (index < 0 || !lines[index + 1] || !path44.isAbsolute(lines[index + 1]))
+    return;
+  const found = objectOrNull(path44.join(lines[index + 1], "package.json"));
+  return found?.name === "@brainervirus/workit-pi" ? found.version : undefined;
+}, versionAtLeast = (installed, latest) => {
+  if (!/^\d+\.\d+\.\d+$/.test(installed))
+    return false;
+  const current = installed.split(".").map(Number);
+  const target = latest.split(".").map(Number);
+  for (let index = 0;index < 3; index++) {
+    if (current[index] !== target[index])
+      return current[index] > target[index];
   }
-  const conflicted = new Set(plan.failed.map((entry) => entry.host));
-  for (const source of installedSources.filter((candidate, index, list) => !conflicted.has(candidate.host) && list.findIndex((entry) => entry.host === candidate.host && entry.selector === candidate.selector) === index)) {
-    if (source.kind === "pinned" || source.kind === "local") {
-      plan.skipped.push({
-        host: source.host,
-        reason: `${source.kind} source preserved; change its source explicitly to upgrade`
-      });
-      continue;
-    }
-    if (source.host === "claude-code") {
-      const [market] = source.selector.split("@").slice(1);
-      plan.entries.push({
-        host: "claude-code",
-        selector: source.selector,
-        latest: "",
-        installedVersion: source.installedVersion,
-        commands: [
-          {
-            command: "claude",
-            args: ["plugin", "marketplace", "update", market ?? "workit"]
-          },
-          { command: "claude", args: ["plugin", "update", source.selector] }
-        ],
-        fix: `claude plugin marketplace update ${market ?? "workit"} && claude plugin update ${source.selector}`
-      });
-      continue;
-    }
-    if (source.host === "opencode") {
-      opencodeHelp ??= opencodeProbe(deps, ["plugin", "--help"]).stdout;
-      if (!/^\s*(?:opencode\s+plugin\s+)?update\b/m.test(opencodeHelp)) {
-        plan.skipped.push({
-          host: "opencode",
-          reason: "this OpenCode has no `opencode plugin update`; upgrade OpenCode, then run the fix. Workit never updates unrelated plugins",
-          fix: OPENCODE_UPDATE
-        });
-        continue;
-      }
-      plan.entries.push({
-        host: "opencode",
-        selector: source.selector,
-        latest: "",
-        commands: [{ command: "opencode", args: ["plugin", "update", OPENCODE_PACKAGE] }],
-        fix: OPENCODE_UPDATE
-      });
-      continue;
-    }
-    const latest = registryVersion(run, `@brainervirus/workit-${source.host}`);
-    if (!latest) {
-      plan.failed.push({
-        host: source.host,
-        status: "failed",
-        reason: "registry version unavailable; existing installation preserved",
-        fix: fixFor(source.host, source.selector)
-      });
-      continue;
-    }
-    if (source.installedVersion && versionAtLeast(source.installedVersion, latest)) {
-      plan.skipped.push({
-        host: source.host,
-        reason: `already current (${source.installedVersion})`
-      });
-      continue;
-    }
-    const commands = source.host === "pi" ? [{ command: "pi", args: ["update", "--extension", source.selector] }] : source.host === "codex" ? [
-      {
-        command: "codex",
-        args: ["plugin", "marketplace", "upgrade", CODEX_MARKETPLACE]
-      },
-      {
-        command: "codex",
-        args: ["plugin", "add", `workit@${CODEX_MARKETPLACE}`, "--json"]
-      }
-    ] : planHostInstall("cursor", {
-      home,
-      env: deps.env,
-      cwd: home,
-      packageVersion: latest,
-      targetDir: paths.cursorRoot
-    });
-    plan.entries.push({
-      host: source.host,
-      selector: source.selector,
-      latest,
-      commands,
-      installedVersion: source.installedVersion,
-      ...source.kind === "repair" ? { repair: true } : {},
-      fix: fixFor(source.host, source.selector)
+  return true;
+}, registryVersion = (run, name) => {
+  const latest = run("npm", ["view", name, "version"]);
+  const version = latest.stdout.trim();
+  return latest.status === 0 && /^\d+\.\d+\.\d+$/.test(version) ? version : undefined;
+};
+var init_shared = __esm(() => {
+  init_host_install();
+  LAUNCH_HOSTS = ["opencode", "cursor", "codex", "pi"];
+  HOSTS2 = [...LAUNCH_HOSTS, "claude-code"];
+  LIVE_HOSTS = new Set(["opencode", "claude-code"]);
+  OPENCODE_UPDATE = `opencode plugin update ${OPENCODE_PACKAGE}`;
+});
+
+// packages/workit-cli/src/upgrade/processes.ts
+import path45 from "node:path";
+var PROCESS_HOSTS, SCRIPT_RUNTIMES, classifyProcess = (proc) => {
+  if (proc.state.startsWith("Z") || proc.args.includes("<defunct>"))
+    return null;
+  const argv0 = proc.args.trim().split(/\s+/)[0] ?? "";
+  const baseName = (value) => path45.basename(value.replaceAll("\\", "/")).replace(/^\[|\]$/g, "").replace(/\.exe$/i, "").toLowerCase();
+  let host = PROCESS_HOSTS[baseName(argv0)];
+  if (!host && SCRIPT_RUNTIMES.has(baseName(argv0))) {
+    const script = proc.args.trim().split(/\s+/).slice(1).find((arg) => !arg.startsWith("-"));
+    if (script)
+      host = PROCESS_HOSTS[baseName(script).replace(/\.(?:[cm]?js|ts)$/, "")];
+  }
+  if (!host)
+    return null;
+  if (host === "codex" && /\bapp-server\b/.test(proc.args))
+    return /\bdaemon\s+pid-update-loop\b/.test(proc.args) ? null : { ...proc, host, kind: "daemon" };
+  if (host === "opencode" && /\bserve\b/.test(proc.args))
+    return { ...proc, host, kind: "daemon" };
+  return { ...proc, host, kind: "session" };
+}, listProcesses = (deps) => {
+  if (deps.processes)
+    return deps.processes();
+  if (deps.activeHosts)
+    return deps.activeHosts().map((host) => ({ pid: 0, state: "S", args: host }));
+  const run = runner(deps);
+  if (process.platform === "win32") {
+    const list = run("tasklist", ["/fo", "csv", "/nh"]);
+    if (list.status !== 0)
+      return null;
+    return list.stdout.split(/\r?\n/).flatMap((line) => {
+      const [image, pid] = line.split('","').map((cell) => cell.replaceAll('"', ""));
+      return image && /^\d+$/.test(pid ?? "") ? [{ pid: Number(pid), state: "R", args: image }] : [];
     });
   }
-  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
-  return plan;
-}
+  const list = run("ps", ["-eo", "pid=,stat=,args="]);
+  if (list.status !== 0)
+    return null;
+  return list.stdout.split(/\r?\n/).flatMap((line) => {
+    const match = /^\s*(\d+)\s+(\S+)\s+(.+)$/.exec(line);
+    return match ? [{ pid: Number(match[1]), state: match[2], args: match[3] }] : [];
+  });
+}, describe2 = (proc) => `pid ${proc.pid}: ${proc.args.length > 120 ? `${proc.args.slice(0, 117)}...` : proc.args}`;
+var init_processes = __esm(() => {
+  init_shared();
+  PROCESS_HOSTS = {
+    claude: "claude-code",
+    codex: "codex",
+    cursor: "cursor",
+    opencode: "opencode",
+    pi: "pi"
+  };
+  SCRIPT_RUNTIMES = new Set(["node", "nodejs", "bun"]);
+});
+
+// packages/workit-cli/src/upgrade/apply.ts
+import { existsSync as existsSync21, readdirSync as readdirSync12, mkdirSync as mkdirSync11, copyFileSync as copyFileSync6, chmodSync as chmodSync2, cpSync as cpSync5 } from "node:fs";
+import path46 from "node:path";
+import { createHash as createHash16 } from "node:crypto";
 function applyUpgrade(plan, deps = {}) {
   const hosts = [...plan.failed];
   const done = (backup) => {
@@ -75036,11 +75100,11 @@ function applyUpgrade(plan, deps = {}) {
       };
   const paths = upgradePaths(deps);
   const { home, configDir } = paths;
-  const backup = path44.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
+  const backup = path46.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
   mkdirSync11(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
-    if (existsSync20(file)) {
-      const target = path44.join(backup, createHash15("sha256").update(file).digest("hex").slice(0, 12) + "-" + path44.basename(file));
+    if (existsSync21(file)) {
+      const target = path46.join(backup, createHash16("sha256").update(file).digest("hex").slice(0, 12) + "-" + path46.basename(file));
       copyFileSync6(file, target);
       chmodSync2(target, 384);
     }
@@ -75059,9 +75123,11 @@ function applyUpgrade(plan, deps = {}) {
   }
   const run = runner(deps);
   let cursorBackupError = null;
-  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync20(paths.cursorRoot))
+  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync21(paths.cursorRoot))
     try {
-      cpSync5(paths.cursorRoot, path44.join(backup, "cursor-package"), { recursive: true });
+      cpSync5(paths.cursorRoot, path46.join(backup, "cursor-package"), {
+        recursive: true
+      });
     } catch (error) {
       cursorBackupError = `could not back up the Cursor plugin: ${errorText(error)}`;
     }
@@ -75069,7 +75135,12 @@ function applyUpgrade(plan, deps = {}) {
   const running = (listed ?? []).flatMap((entry) => classifyProcess(entry) ?? []);
   for (const entry of plan.entries) {
     if (entry.host === "cursor" && cursorBackupError) {
-      hosts.push({ host: "cursor", status: "failed", reason: cursorBackupError, fix: entry.fix });
+      hosts.push({
+        host: "cursor",
+        status: "failed",
+        reason: cursorBackupError,
+        fix: entry.fix
+      });
       continue;
     }
     if (!LIVE_HOSTS.has(entry.host)) {
@@ -75178,238 +75249,356 @@ function applyUpgrade(plan, deps = {}) {
     try {
       hosts.push(applyCli(plan.cli, run, backup));
     } catch (error) {
-      hosts.push({ host: "cli", status: "failed", reason: errorText(error), fix: CLI_FIX });
+      hosts.push({
+        host: "cli",
+        status: "failed",
+        reason: errorText(error),
+        fix: CLI_FIX
+      });
     }
   return done(backup);
 }
-async function runUpgradeCommand(argv, deps = {}) {
-  const out = deps.out ?? process.stdout;
-  const flags = new Set(argv);
-  const unknown = argv.filter((arg) => !["--apply", "--confirm", "--json", "--cli", "--preview", "--yes"].includes(arg) && !arg.startsWith("--hosts="));
-  const hostFlag = argv.find((arg) => arg.startsWith("--hosts="))?.slice(8);
-  const raw = hostFlag === "none" ? [] : hostFlag?.split(",") ?? HOSTS2;
-  if (unknown.length || raw.some((host) => !HOSTS2.includes(host)) || flags.has("--preview") && (flags.has("--apply") || flags.has("--yes"))) {
-    out.write(USAGE3);
-    return 2;
+var codexPluginRoot = (codexHome) => {
+  const dir = path46.join(codexHome, "plugins", "cache", CODEX_MARKETPLACE, "workit");
+  let versions = [];
+  try {
+    versions = readdirSync12(dir).filter((version) => /^\d+\.\d+\.\d+$/.test(version));
+  } catch {
+    return null;
   }
-  if (flags.has("--apply") && !flags.has("--confirm")) {
-    out.write(`Apply requires --confirm after reviewing the upgrade preview.
-`);
-    return 2;
+  const newest = versions.reduce((best, version) => best && versionAtLeast(best, version) ? best : version, null);
+  return newest ? path46.join(dir, newest) : null;
+}, opencodeVersion = (run) => {
+  const listing = run("opencode", ["plugin", "list"]);
+  if (listing.status !== 0)
+    return;
+  for (const line of listing.stdout.split(/\r?\n/)) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 3)
+      continue;
+    const source = fields[fields.length - 1].replace(/^file:\/\//, "");
+    const version = fields[fields.length - 2];
+    if (/^(?:npm:)?@brainervirus\/workit-opencode(?:@[^/\s]+)?$/.test(source) && /^\d+\.\d+\.\d+$/.test(version))
+      return version;
   }
-  const legacy = flags.has("--apply");
-  const json = flags.has("--json") || legacy;
-  const run = runner(deps);
-  const plan = previewUpgrade(raw, deps);
-  if (hostFlag === undefined || flags.has("--cli"))
-    planCli(plan, run);
-  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
-  const { home, env } = upgradePaths(deps);
-  const permissions = planHostPermissions({
-    hosts: raw,
-    refreshOnly: true,
-    shell: false,
-    home,
-    env
+  return;
+}, applyEntry = (entry, context) => {
+  const { run, paths, configDir } = context;
+  const { home, env } = paths;
+  const fail = (reason) => ({
+    host: entry.host,
+    status: "failed",
+    reason,
+    fix: entry.fix
   });
-  const permissionPreview = {
-    changes: permissions.changes.map((c) => ({
-      host: c.host,
-      file: c.file,
-      diff: permissionDiff(c)
-    })),
-    ...permissions.refused ? { refused: permissions.refused } : {}
-  };
-  const withPermissions = (value) => permissions.changes.length ? { ...value, permissions: permissionPreview } : value;
-  const applyCommand = `workit upgrade ${[...hostFlag === undefined ? [] : [`--hosts=${hostFlag}`], ...flags.has("--cli") ? ["--cli"] : [], "--yes"].join(" ")}`;
-  const nothingChanged = `preview only; nothing changed. Apply with: ${applyCommand}
-`;
-  if (json && !legacy && !flags.has("--yes")) {
-    out.write(JSON.stringify(withPermissions(plan), null, 2) + `
-`);
-    return plan.blocked.length ? 1 : 0;
+  if (entry.host === "cursor") {
+    const preview = {
+      ok: true,
+      blocked: [],
+      preserved: [],
+      overrides: [],
+      platforms: ["cursor"],
+      state: readSetupState(configDir),
+      mutations: [
+        {
+          type: "install-host",
+          platform: "cursor",
+          path: path46.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
+          commands: entry.commands.map((command) => ({
+            ...command,
+            purpose: command.purpose ?? "Upgrade Cursor"
+          }))
+        },
+        { type: "install-adapter", platform: "cursor", path: paths.cursorRoot }
+      ]
+    };
+    const result = applySetupPreview(preview, {
+      home,
+      env,
+      cwd: home,
+      preferInstalledAdapter: true,
+      runHostCommand: (command) => {
+        const outcome = run(command.command, command.args);
+        return {
+          exitCode: outcome.status ?? 1,
+          stdout: outcome.stdout,
+          stderr: ""
+        };
+      }
+    });
+    const installed = objectOrNull(path46.join(paths.cursorRoot, "package.json"));
+    if (!result.ok || installed?.version !== entry.latest)
+      return fail("Cursor install did not verify the requested package version; inspect the installer before retrying");
+    return {
+      host: "cursor",
+      status: "updated",
+      reason: entry.repair ? `reinstalled missing plugin files (${entry.latest})` : `${entry.installedVersion ?? "?"} -> ${entry.latest}`
+    };
   }
-  if (!json)
-    out.write(summary(plan, permissions.changes));
-  if (flags.has("--preview")) {
-    out.write(nothingChanged);
-    return plan.blocked.length ? 1 : 0;
+  const before = entry.host === "opencode" ? opencodeVersion(run) : undefined;
+  for (const command of entry.commands)
+    if (run(command.command, command.args).status !== 0)
+      return fail(`\`${command.command} ${command.args.join(" ")}\` failed`);
+  if (entry.host === "opencode") {
+    const after = opencodeVersion(run);
+    if (before && after)
+      return after === before ? {
+        host: "opencode",
+        status: "current",
+        reason: `already current (${after})`
+      } : {
+        host: "opencode",
+        status: "updated",
+        reason: `${before} -> ${after}; OpenCode V2 loads it live`
+      };
+    return {
+      host: "opencode",
+      status: "updated",
+      reason: "scoped update ran; OpenCode V2 loads it live"
+    };
   }
-  if (plan.blocked.length) {
-    out.write(`Upgrade blocked: ${plan.blocked.join("; ")}
-Nothing changed.
-`);
-    return 1;
+  if (entry.host === "claude-code") {
+    const after = claudeWorkitInstalls(home, env, null).find((install) => install.id === entry.selector)?.version;
+    return after && after === entry.installedVersion ? {
+      host: "claude-code",
+      status: "current",
+      reason: `already current (${after})`
+    } : {
+      host: "claude-code",
+      status: "updated",
+      reason: `${entry.installedVersion ?? "?"} -> ${after ?? "?"}; new sessions load it`
+    };
   }
-  const work = plan.entries.length + plan.migrations.length + (plan.cli ? 1 : 0) + permissions.changes.length;
-  if (work > 0 && !flags.has("--yes") && !legacy) {
-    const confirmed = await (deps.confirm ?? ((q) => askConfirm(q, out)))("Apply this upgrade? [y/N] ");
-    if (!confirmed) {
-      out.write(nothingChanged);
-      return 0;
-    }
+  const verify = entry.host === "codex" ? run("codex", ["plugin", "list", "--json"]) : run("pi", ["list"]);
+  if (verify.status !== 0)
+    return fail("update verification failed");
+  if (entry.host === "codex") {
+    let installed = [];
+    try {
+      installed = JSON.parse(verify.stdout).installed ?? [];
+    } catch {}
+    if (!installed.some((plugin) => plugin.name === "workit" && plugin.marketplaceName === CODEX_MARKETPLACE && plugin.version === entry.latest))
+      return fail("Codex did not report the requested Workit version");
   }
-  if (json)
-    for (const warning of plan.warnings ?? [])
-      out.write(`warning: ${warning}
-`);
-  const result = applyUpgrade(plan, deps);
-  let permissionsOk = true;
-  let written;
-  if (permissions.changes.length && !permissions.refused && !result.error?.startsWith("configuration changed")) {
-    written = applyHostPermissions(permissions, { home, env });
-    permissionsOk = written.every((entry) => entry.status === "written");
-    for (const entry of written)
-      result.hosts.push({
-        host: entry.host,
-        status: entry.status === "written" ? "updated" : "failed",
-        reason: `permission block ${entry.status === "written" ? "refreshed" : entry.status} in ${entry.file}`,
-        ...entry.status === "written" ? {} : { fix: `workit setup --hosts=${entry.host}` }
+  if (entry.host === "pi" && piInstalledVersion(verify.stdout, entry.selector) !== entry.latest)
+    return fail("Pi did not report the requested Workit package version");
+  return {
+    host: entry.host,
+    status: "updated",
+    reason: entry.repair ? `reinstalled missing plugin files (${entry.latest})` : `${entry.installedVersion ?? "?"} -> ${entry.latest}`
+  };
+}, refreshCodexAgents = (run, codexHome) => {
+  const root = codexPluginRoot(codexHome);
+  const launcher = root && path46.join(root, "dist", "launch-mcp.js");
+  if (!launcher || !existsSync21(launcher))
+    return { ok: true, note: "" };
+  const fix = `node ${JSON.stringify(launcher)} --install-agents`;
+  return run("node", [launcher, "--install-agents"]).status === 0 ? { ok: true, note: "agents refreshed" } : { ok: false, note: "agent refresh failed", fix };
+}, applyCli = (cli, run, backup) => {
+  const fail = (reason) => ({
+    host: "cli",
+    status: "failed",
+    reason,
+    fix: CLI_FIX
+  });
+  const currentRoot = run("npm", ["root", "--global"]);
+  if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== cli.root)
+    return fail("Global npm location changed; preview again");
+  const cliBackup = path46.join(backup, "cli-package");
+  cpSync5(path46.join(cli.root, "@brainervirus/workit-cli"), cliBackup, {
+    recursive: true
+  });
+  if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${cli.latest}`]).status !== 0)
+    return fail(`CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path46.join(cliBackup, "dist/index.js")}`);
+  const installed = objectOrNull(path46.join(cli.root, "@brainervirus/workit-cli/package.json"));
+  if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== cli.latest)
+    return fail(`CLI update did not verify the requested version; preserved package at ${cliBackup}`);
+  return {
+    host: "cli",
+    status: "updated",
+    reason: `${cli.installed} -> ${cli.latest}`
+  };
+};
+var init_apply = __esm(() => {
+  init_host_install();
+  init_setup_state();
+  init_setup();
+  init_safe_write();
+  init_processes();
+  init_shared();
+});
+
+// packages/workit-cli/src/upgrade/plan.ts
+import { existsSync as existsSync22, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync7, readFileSync as readFileSync23 } from "node:fs";
+import path47 from "node:path";
+import os17 from "node:os";
+function previewUpgrade(hosts = HOSTS2, deps = {}) {
+  const paths = upgradePaths(deps);
+  const { home, configDir } = paths;
+  const run = runner(deps);
+  const state = readSetupState(configDir);
+  const plan = {
+    ok: true,
+    blocked: [],
+    failed: [],
+    skipped: [],
+    entries: [],
+    configDigests: {},
+    migrations: []
+  };
+  for (const file of [state.config, state.workspaces, state.youtrack, state.vcs]) {
+    if (file.status === "malformed")
+      plan.blocked.push(file.error ?? file.file);
+    plan.configDigests[file.file] = digest2(file.file);
+  }
+  for (const file of [
+    paths.opencodeConfig,
+    paths.opencodeConfig + "c",
+    path47.join(home, ".cursor/settings.json"),
+    path47.join(home, ".cursor/mcp.json"),
+    path47.join(paths.cursorRoot, "package.json"),
+    paths.codexConfig,
+    paths.piSettings
+  ])
+    plan.configDigests[file] = digest2(file);
+  try {
+    const config = object2(state.config.file);
+    if (config && Object.hasOwn(config, "trustedPaths"))
+      plan.migrations.push({
+        id: "2.0-remove-ignored-trusted-paths",
+        file: state.config.file,
+        description: "Remove ignored Workit trustedPaths; native host permissions remain unchanged"
       });
+  } catch (error) {
+    plan.blocked.push(errorText(error));
   }
-  const failed = !result.ok || !permissionsOk;
-  const cliVersion = result.hosts.some((h) => h.host === "cli" && h.status === "updated") ? plan.cli.latest : package_default.version;
-  const report = (deps.doctor ?? ((version) => runDoctor({ home, env, cliVersion: version, only: "upgrade" })))(cliVersion);
-  const left = report.checks.filter((check) => check.status === "warn" || check.status === "fail");
-  if (json) {
-    out.write(JSON.stringify({
-      ...result,
-      ok: !failed,
-      ...written ? { permissions: { changes: permissionPreview.changes, written } } : permissions.refused ? { permissions: permissionPreview } : {},
-      doctor: { clean: left.length === 0, left }
-    }, null, 2) + `
-`);
-    return failed ? 1 : 0;
+  const installedSources = sources(paths, run, hosts, plan.failed);
+  let opencodeHelp;
+  if (installedSources.some((source) => source.host === "opencode")) {
+    const probe = opencodeProbe(deps, ["--version"]);
+    const installed = probe.status === 0 ? probe.stdout.match(/\d+\.\d+\.\d+/)?.[0] : undefined;
+    if (installed && !versionAtLeast(installed, SUPPORT_MATRIX.opencode.minimum))
+      (plan.warnings ??= []).push(`opencode ${installed}: ${OPENCODE_V1_FIX}`);
   }
-  if (result.error && result.hosts.every((h) => h.status !== "failed"))
-    out.write(`Upgrade stopped: ${result.error}
-`);
-  out.write(table(result.hosts));
-  if (permissions.refused)
-    out.write(`permissions: not refreshed: ${permissions.refused}
-`);
-  if (result.backup)
-    out.write(`Backup: ${result.backup}
-`);
-  out.write(left.length === 0 ? `Verified: workit doctor is clean for versions, assets, agents and permissions.
-` : `Left after upgrade (workit doctor):
-${left.map((check) => `  ${check.id}: ${check.detail}${check.fix ? `
-    fix: ${check.fix}` : ""}`).join(`
-`)}
-`);
-  return failed ? 1 : 0;
-}
-async function runLaunchCommand(argv, deps = {}) {
-  const [host, ...args] = argv;
-  if (!LAUNCH_HOSTS.includes(host)) {
-    (deps.out ?? process.stdout).write(`Usage: workit launch <opencode|cursor|codex|pi> [--auto-upgrade] [-- host arguments]
-`);
-    return 2;
+  for (const host of ["opencode", "pi"]) {
+    if (new Set(installedSources.filter((source) => source.host === host).map((source) => source.selector)).size > 1)
+      plan.failed.push({
+        host,
+        status: "failed",
+        reason: "conflicting Workit registrations; reconcile them in the native host before upgrading"
+      });
   }
-  const auto = args[0] === "--auto-upgrade";
-  const rest = auto ? args.slice(1) : args;
-  const hostArgs = rest[0] === "--" ? rest.slice(1) : rest;
-  const { home, env } = upgradePaths(deps);
-  let launch;
-  if (!deps.run) {
-    try {
-      launch = hostCommand(host, hostArgs, { home, env });
-    } catch (error) {
-      (deps.out ?? process.stderr).write(`${error instanceof Error ? error.message : "Host executable unavailable"}
-`);
-      return 1;
+  const conflicted = new Set(plan.failed.map((entry) => entry.host));
+  for (const source of installedSources.filter((candidate, index, list) => !conflicted.has(candidate.host) && list.findIndex((entry) => entry.host === candidate.host && entry.selector === candidate.selector) === index)) {
+    if (source.kind === "pinned" || source.kind === "local") {
+      plan.skipped.push({
+        host: source.host,
+        reason: `${source.kind} source preserved; change its source explicitly to upgrade`
+      });
+      continue;
     }
-  }
-  if (auto) {
-    const plan = previewUpgrade([host], deps);
-    const reasons = [...plan.blocked, ...plan.failed.map((entry) => entry.reason)];
-    if (plan.ok) {
-      for (const skipped of plan.skipped)
-        (deps.out ?? process.stderr).write(`${skipped.host}: ${skipped.reason}${skipped.fix ? ` (run: ${skipped.fix})` : ""}
-`);
-      const result = applyUpgrade(plan, deps);
-      if (!result.ok) {
-        (deps.out ?? process.stdout).write(`${result.error}
-`);
-        return 1;
+    if (source.host === "claude-code") {
+      const [market] = source.selector.split("@").slice(1);
+      plan.entries.push({
+        host: "claude-code",
+        selector: source.selector,
+        latest: "",
+        installedVersion: source.installedVersion,
+        commands: [
+          {
+            command: "claude",
+            args: ["plugin", "marketplace", "update", market ?? "workit"]
+          },
+          { command: "claude", args: ["plugin", "update", source.selector] }
+        ],
+        fix: `claude plugin marketplace update ${market ?? "workit"} && claude plugin update ${source.selector}`
+      });
+      continue;
+    }
+    if (source.host === "opencode") {
+      opencodeHelp ??= opencodeProbe(deps, ["plugin", "--help"]).stdout;
+      if (!/^\s*(?:opencode\s+plugin\s+)?update\b/m.test(opencodeHelp)) {
+        plan.skipped.push({
+          host: "opencode",
+          reason: "this OpenCode has no `opencode plugin update`; upgrade OpenCode, then run the fix. Workit never updates unrelated plugins",
+          fix: OPENCODE_UPDATE
+        });
+        continue;
       }
-    } else if (plan.blocked.length === 0 && reasons.every((reason) => reason.includes("registry version unavailable"))) {
-      (deps.out ?? process.stderr).write(`Upgrade unavailable: ${reasons.join("; ")}. Starting the unchanged host.
-`);
-    } else {
-      (deps.out ?? process.stderr).write(`Upgrade blocked: ${reasons.join("; ")}
-`);
-      return 1;
+      plan.entries.push({
+        host: "opencode",
+        selector: source.selector,
+        latest: "",
+        commands: [{ command: "opencode", args: ["plugin", "update", OPENCODE_PACKAGE] }],
+        fix: OPENCODE_UPDATE
+      });
+      continue;
     }
+    const latest = registryVersion(run, `@brainervirus/workit-${source.host}`);
+    if (!latest) {
+      plan.failed.push({
+        host: source.host,
+        status: "failed",
+        reason: "registry version unavailable; existing installation preserved",
+        fix: fixFor(source.host, source.selector)
+      });
+      continue;
+    }
+    if (source.installedVersion && versionAtLeast(source.installedVersion, latest)) {
+      plan.skipped.push({
+        host: source.host,
+        reason: `already current (${source.installedVersion})`
+      });
+      continue;
+    }
+    const commands = source.host === "pi" ? [{ command: "pi", args: ["update", "--extension", source.selector] }] : source.host === "codex" ? [
+      {
+        command: "codex",
+        args: ["plugin", "marketplace", "upgrade", CODEX_MARKETPLACE]
+      },
+      {
+        command: "codex",
+        args: ["plugin", "add", `workit@${CODEX_MARKETPLACE}`, "--json"]
+      }
+    ] : planHostInstall("cursor", {
+      home,
+      env: deps.env,
+      cwd: home,
+      packageVersion: latest,
+      targetDir: paths.cursorRoot
+    });
+    plan.entries.push({
+      host: source.host,
+      selector: source.selector,
+      latest,
+      commands,
+      installedVersion: source.installedVersion,
+      ...source.kind === "repair" ? { repair: true } : {},
+      fix: fixFor(source.host, source.selector)
+    });
   }
-  if (deps.run)
-    return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync17(launch.command, launch.args, {
-    stdio: "inherit",
-    env
-  }).status ?? 1;
+  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
+  return plan;
 }
-var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-opencode", OPENCODE_UPDATE, CODEX_MARKETPLACE = "workflow-toolkit", CLI_FIX = "npm install --global @brainervirus/workit-cli@latest", fixFor = (host, selector = "") => host === "pi" ? `pi update --extension ${selector || "npm:@brainervirus/workit-pi"}` : host === "codex" ? `codex plugin marketplace upgrade ${CODEX_MARKETPLACE} && codex plugin add workit@${CODEX_MARKETPLACE}` : host === "claude-code" ? "claude plugin marketplace update workit && claude plugin update workit@workit" : host === "opencode" ? OPENCODE_UPDATE : host === "cursor" ? "workit upgrade --hosts=cursor" : CLI_FIX, upgradePaths = (deps) => {
-  const home = deps.home ?? deps.env?.HOME ?? os16.homedir();
-  const env = {
-    ...process.env,
-    ...deps.home || deps.env?.HOME ? {
-      HOME: home,
-      CODEX_HOME: path44.join(home, ".codex"),
-      CLAUDE_CONFIG_DIR: path44.join(home, ".claude"),
-      PI_CODING_AGENT_DIR: path44.join(home, ".pi/agent"),
-      XDG_CONFIG_HOME: path44.join(home, ".config"),
-      WORKFLOW_TOOLKIT_CONFIG: undefined,
-      WORKFLOW_TOOLKIT_CONFIG_DIR: undefined
-    } : {},
-    ...deps.env,
-    HOME: home
-  };
-  const xdg = env.XDG_CONFIG_HOME || path44.join(home, ".config");
-  const codexHome = env.CODEX_HOME ?? path44.join(home, ".codex");
-  return {
-    home,
-    env,
-    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path44.join(xdg, "workit"),
-    opencodeConfig: path44.join(xdg, "opencode/opencode.json"),
-    piSettings: path44.join(env.PI_CODING_AGENT_DIR ?? path44.join(home, ".pi/agent"), "settings.json"),
-    codexHome,
-    codexConfig: path44.join(codexHome, "config.toml"),
-    cursorRoot: path44.join(home, ".cursor/plugins/local/workit")
-  };
-}, object2 = (file) => {
-  if (!existsSync20(file))
-    return null;
-  let data;
-  try {
-    data = JSON.parse(readFileSync21(file, "utf8"));
-  } catch {
-    throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
-  }
-  if (!data || typeof data !== "object" || Array.isArray(data))
-    throw new Error(`${file} is not a configuration object`);
-  return data;
-}, objectOrNull = (file) => {
-  try {
-    return object2(file);
-  } catch {
-    return null;
-  }
-}, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync21(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
-  const { home, env } = upgradePaths(deps);
-  let step;
+var codexRegistered = (configFile) => {
+  let text;
   try {
-    step = hostCommand(command, args, { home, env });
+    text = readFileSync23(configFile, "utf8");
   } catch {
-    return { status: 1, stdout: "" };
+    return false;
   }
-  const result = runHostCommand(step, { home, env });
-  return { status: result.exitCode, stdout: result.stdout };
-}), classify = (host, selector) => ({
+  const header = `[plugins."workit@${CODEX_MARKETPLACE}"]`;
+  const start = text.split(/\r?\n/).findIndex((line) => line.trim() === header);
+  if (start < 0)
+    return false;
+  const body = text.split(/\r?\n/).slice(start + 1).join(`
+`).split(/^\s*\[/m)[0];
+  return !/^\s*enabled\s*=\s*false\b/m.test(body);
+}, classify = (host, selector) => ({
   host,
   selector,
   kind: selector === `@brainervirus/workit-${host}` || selector === `@brainervirus/workit-${host}@latest` || selector === `npm:@brainervirus/workit-${host}` || selector === `npm:@brainervirus/workit-${host}@latest` ? "floating" : new RegExp(`^(?:npm:)?@brainervirus/workit-${host}@[^/]+$`).test(selector) ? "pinned" : "local"
-}), errorText = (error) => error instanceof Error ? error.message : "installed source could not be read", sources = (paths, run, hosts, failed) => {
+}), sources = (paths, run, hosts, failed) => {
   const { home } = paths;
   const result = [];
   const guard = (host, read) => {
@@ -75427,7 +75616,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
     }
   };
   guard("opencode", () => {
-    if (existsSync20(paths.opencodeConfig + "c"))
+    if (existsSync22(paths.opencodeConfig + "c"))
       throw new Error("OpenCode JSONC config is present; inspect effective native configuration before updating");
     const oc = object2(paths.opencodeConfig);
     if (oc && [oc.plugins, oc.plugin].some((value) => value !== undefined && !Array.isArray(value)))
@@ -75437,8 +75626,8 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
         result.push(classify("opencode", pin));
   });
   guard("cursor", () => {
-    const cursor = objectOrNull(path44.join(paths.cursorRoot, "package.json"));
-    const mcp = objectOrNull(path44.join(home, ".cursor/mcp.json"));
+    const cursor = objectOrNull(path47.join(paths.cursorRoot, "package.json"));
+    const mcp = objectOrNull(path47.join(home, ".cursor/mcp.json"));
     const args = mcp?.mcpServers?.workit?.args ?? [];
     const arg = args.find((value) => typeof value === "string" && value.startsWith("--package="));
     const selector = typeof arg === "string" ? arg.slice(10) : "local";
@@ -75449,7 +75638,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       });
       return;
     }
-    const settings = objectOrNull(path44.join(home, ".cursor/settings.json"));
+    const settings = objectOrNull(path47.join(home, ".cursor/settings.json"));
     const dirs = Array.isArray(settings?.plugin_dirs) ? settings.plugin_dirs : [];
     const registered = mcp?.mcpServers?.workit !== undefined || dirs.some((dir) => String(dir).replaceAll("\\", "/").replace(/\/+$/, "").endsWith("local/workit"));
     if (registered)
@@ -75464,7 +75653,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       if (typeof source !== "string")
         continue;
       const npm = /^(?:npm:)?@brainervirus\/workit-pi(?:@[^/]+)?$/.test(source);
-      const local = path44.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path44.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
+      const local = path47.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path47.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
       if (!npm && !local)
         continue;
       const found = classify("pi", source);
@@ -75484,7 +75673,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
         hostCommand("codex", [], { home, env: paths.env });
         available = true;
       } catch {}
-      if (available || existsSync20(paths.codexConfig))
+      if (available || existsSync22(paths.codexConfig))
         throw new Error("Codex plugin inventory failed; inspect the native host before upgrading");
       return;
     }
@@ -75506,6 +75695,12 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
         installedVersion: plugin.version
       });
     }
+    if (!result.some((found) => found.host === "codex") && codexRegistered(paths.codexConfig))
+      result.push({
+        host: "codex",
+        selector: "@brainervirus/workit-codex",
+        kind: "repair"
+      });
   });
   guard("claude-code", () => {
     for (const install of claudeWorkitInstalls(home, paths.env, null))
@@ -75517,213 +75712,24 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       });
   });
   return result;
-}, piInstalledVersion = (listing, selector) => {
-  const lines = listing.split(/\r?\n/).map((line) => line.trim());
-  const index = lines.indexOf(selector);
-  if (index < 0 || !lines[index + 1] || !path44.isAbsolute(lines[index + 1]))
-    return;
-  const found = objectOrNull(path44.join(lines[index + 1], "package.json"));
-  return found?.name === "@brainervirus/workit-pi" ? found.version : undefined;
-}, versionAtLeast = (installed, latest) => {
-  if (!/^\d+\.\d+\.\d+$/.test(installed))
-    return false;
-  const current = installed.split(".").map(Number);
-  const target = latest.split(".").map(Number);
-  for (let index = 0;index < 3; index++) {
-    if (current[index] !== target[index])
-      return current[index] > target[index];
-  }
-  return true;
 }, opencodeProbe = (deps, args) => {
-  const scratch = mkdtempSync3(path44.join(os16.tmpdir(), "workit-upgrade-opencode-"));
+  const scratch = mkdtempSync3(path47.join(os17.tmpdir(), "workit-upgrade-opencode-"));
   try {
     return runner({
       ...deps,
       env: {
         ...deps.env,
-        XDG_DATA_HOME: path44.join(scratch, "data"),
-        XDG_STATE_HOME: path44.join(scratch, "state"),
-        XDG_CACHE_HOME: path44.join(scratch, "cache")
+        XDG_DATA_HOME: path47.join(scratch, "data"),
+        XDG_STATE_HOME: path47.join(scratch, "state"),
+        XDG_CACHE_HOME: path47.join(scratch, "cache")
       }
     })("opencode", args);
   } finally {
     rmSync8(scratch, { recursive: true, force: true });
   }
-}, registryVersion = (run, name) => {
-  const latest = run("npm", ["view", name, "version"]);
-  const version = latest.stdout.trim();
-  return latest.status === 0 && /^\d+\.\d+\.\d+$/.test(version) ? version : undefined;
-}, PROCESS_HOSTS, classifyProcess = (proc) => {
-  if (proc.state.startsWith("Z") || proc.args.includes("<defunct>"))
-    return null;
-  const argv0 = proc.args.trim().split(/\s+/)[0] ?? "";
-  const name = path44.basename(argv0.replaceAll("\\", "/")).replace(/^\[|\]$/g, "").replace(/\.exe$/i, "").toLowerCase();
-  const host = PROCESS_HOSTS[name];
-  if (!host)
-    return null;
-  if (host === "codex" && /\bapp-server\b/.test(proc.args))
-    return /\bdaemon\s+pid-update-loop\b/.test(proc.args) ? null : { ...proc, host, kind: "daemon" };
-  if (host === "opencode" && /\bserve\b/.test(proc.args))
-    return { ...proc, host, kind: "daemon" };
-  return { ...proc, host, kind: "session" };
-}, listProcesses = (deps) => {
-  if (deps.processes)
-    return deps.processes();
-  if (deps.activeHosts)
-    return deps.activeHosts().map((host) => ({ pid: 0, state: "S", args: host }));
-  const run = runner(deps);
-  if (process.platform === "win32") {
-    const list = run("tasklist", ["/fo", "csv", "/nh"]);
-    if (list.status !== 0)
-      return null;
-    return list.stdout.split(/\r?\n/).flatMap((line) => {
-      const [image, pid] = line.split('","').map((cell) => cell.replaceAll('"', ""));
-      return image && /^\d+$/.test(pid ?? "") ? [{ pid: Number(pid), state: "R", args: image }] : [];
-    });
-  }
-  const list = run("ps", ["-eo", "pid=,stat=,args="]);
-  if (list.status !== 0)
-    return null;
-  return list.stdout.split(/\r?\n/).flatMap((line) => {
-    const match = /^\s*(\d+)\s+(\S+)\s+(.+)$/.exec(line);
-    return match ? [{ pid: Number(match[1]), state: match[2], args: match[3] }] : [];
-  });
-}, describe2 = (proc) => `pid ${proc.pid}: ${proc.args.length > 120 ? `${proc.args.slice(0, 117)}...` : proc.args}`, codexPluginRoot = (codexHome) => {
-  const dir = path44.join(codexHome, "plugins", "cache", CODEX_MARKETPLACE, "workit");
-  let versions = [];
-  try {
-    versions = readdirSync12(dir).filter((version) => /^\d+\.\d+\.\d+$/.test(version));
-  } catch {
-    return null;
-  }
-  const newest = versions.reduce((best, version) => best && versionAtLeast(best, version) ? best : version, null);
-  return newest ? path44.join(dir, newest) : null;
-}, applyEntry = (entry, context) => {
-  const { run, paths, configDir } = context;
-  const { home, env } = paths;
-  const fail = (reason) => ({
-    host: entry.host,
-    status: "failed",
-    reason,
-    fix: entry.fix
-  });
-  if (entry.host === "cursor") {
-    const preview = {
-      ok: true,
-      blocked: [],
-      preserved: [],
-      overrides: [],
-      platforms: ["cursor"],
-      state: readSetupState(configDir),
-      mutations: [
-        {
-          type: "install-host",
-          platform: "cursor",
-          path: path44.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
-          commands: entry.commands.map((command) => ({
-            ...command,
-            purpose: command.purpose ?? "Upgrade Cursor"
-          }))
-        },
-        { type: "install-adapter", platform: "cursor", path: paths.cursorRoot }
-      ]
-    };
-    const result = applySetupPreview(preview, {
-      home,
-      env,
-      cwd: home,
-      preferInstalledAdapter: true,
-      runHostCommand: (command) => {
-        const outcome = run(command.command, command.args);
-        return {
-          exitCode: outcome.status ?? 1,
-          stdout: outcome.stdout,
-          stderr: ""
-        };
-      }
-    });
-    const installed = objectOrNull(path44.join(paths.cursorRoot, "package.json"));
-    if (!result.ok || installed?.version !== entry.latest)
-      return fail("Cursor install did not verify the requested package version; inspect the installer before retrying");
-    return {
-      host: "cursor",
-      status: "updated",
-      reason: entry.repair ? `reinstalled missing plugin files (${entry.latest})` : `${entry.installedVersion ?? "?"} -> ${entry.latest}`
-    };
-  }
-  for (const command of entry.commands)
-    if (run(command.command, command.args).status !== 0)
-      return fail(`\`${command.command} ${command.args.join(" ")}\` failed`);
-  if (entry.host === "opencode")
-    return {
-      host: "opencode",
-      status: "updated",
-      reason: "scoped update ran; OpenCode V2 loads it live"
-    };
-  if (entry.host === "claude-code") {
-    const after = claudeWorkitInstalls(home, env, null).find((install) => install.id === entry.selector)?.version;
-    return after && after === entry.installedVersion ? {
-      host: "claude-code",
-      status: "current",
-      reason: `already current (${after})`
-    } : {
-      host: "claude-code",
-      status: "updated",
-      reason: `${entry.installedVersion ?? "?"} -> ${after ?? "?"}; new sessions load it`
-    };
-  }
-  const verify = entry.host === "codex" ? run("codex", ["plugin", "list", "--json"]) : run("pi", ["list"]);
-  if (verify.status !== 0)
-    return fail("update verification failed");
-  if (entry.host === "codex") {
-    let installed = [];
-    try {
-      installed = JSON.parse(verify.stdout).installed ?? [];
-    } catch {}
-    if (!installed.some((plugin) => plugin.name === "workit" && plugin.marketplaceName === CODEX_MARKETPLACE && plugin.version === entry.latest))
-      return fail("Codex did not report the requested Workit version");
-  }
-  if (entry.host === "pi" && piInstalledVersion(verify.stdout, entry.selector) !== entry.latest)
-    return fail("Pi did not report the requested Workit package version");
-  return {
-    host: entry.host,
-    status: "updated",
-    reason: `${entry.installedVersion ?? "?"} -> ${entry.latest}`
-  };
-}, refreshCodexAgents = (run, codexHome) => {
-  const root = codexPluginRoot(codexHome);
-  const launcher = root && path44.join(root, "dist", "launch-mcp.js");
-  if (!launcher || !existsSync20(launcher))
-    return { ok: true, note: "" };
-  const fix = `node ${JSON.stringify(launcher)} --install-agents`;
-  return run("node", [launcher, "--install-agents"]).status === 0 ? { ok: true, note: "agents refreshed" } : { ok: false, note: "agent refresh failed", fix };
-}, applyCli = (cli, run, backup) => {
-  const fail = (reason) => ({
-    host: "cli",
-    status: "failed",
-    reason,
-    fix: CLI_FIX
-  });
-  const currentRoot = run("npm", ["root", "--global"]);
-  if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== cli.root)
-    return fail("Global npm location changed; preview again");
-  const cliBackup = path44.join(backup, "cli-package");
-  cpSync5(path44.join(cli.root, "@brainervirus/workit-cli"), cliBackup, {
-    recursive: true
-  });
-  if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${cli.latest}`]).status !== 0)
-    return fail(`CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path44.join(cliBackup, "dist/index.js")}`);
-  const installed = objectOrNull(path44.join(cli.root, "@brainervirus/workit-cli/package.json"));
-  if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== cli.latest)
-    return fail(`CLI update did not verify the requested version; preserved package at ${cliBackup}`);
-  return {
-    host: "cli",
-    status: "updated",
-    reason: `${cli.installed} -> ${cli.latest}`
-  };
 }, planCli = (plan, run) => {
   const root = run("npm", ["root", "--global"]);
-  if (root.status !== 0 || !path44.isAbsolute(root.stdout.trim())) {
+  if (root.status !== 0 || !path47.isAbsolute(root.stdout.trim())) {
     plan.skipped.push({
       host: "cli",
       reason: "global npm location could not be verified",
@@ -75731,9 +75737,9 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
     });
     return;
   }
-  const packageFile = path44.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
+  const packageFile = path47.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
   const installed = objectOrNull(packageFile);
-  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync7(path44.dirname(packageFile)).isSymbolicLink()) {
+  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync7(path47.dirname(packageFile)).isSymbolicLink()) {
     plan.skipped.push({
       host: "cli",
       reason: "no managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
@@ -75760,7 +75766,18 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
       host: "cli",
       reason: `already current (${installed.version})`
     });
-}, pad2 = (text) => text.padEnd(12), summary = (plan, permissions) => {
+};
+var init_plan = __esm(() => {
+  init_registration();
+  init_setup_state();
+  init_host_install();
+  init_doctor();
+  init_support_matrix();
+  init_shared();
+});
+
+// packages/workit-cli/src/upgrade/report.ts
+var pad2 = (text) => text.padEnd(12), summary = (plan, permissions) => {
   const lines = ["Workit upgrade plan:"];
   if (plan.cli)
     lines.push(`  ${pad2("cli")}update ${plan.cli.installed} -> ${plan.cli.latest}`);
@@ -75797,29 +75814,8 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
   }
   await Promise.resolve().then(() => init_prompt());
   return /^y(?:es)?$/i.test((await askLine(question)).trim());
-}, USAGE3 = `Usage: workit upgrade [--hosts=opencode,cursor,codex,pi,claude-code|none] [--cli] [--preview | --yes | --apply --confirm] [--json]
-`;
-var init_upgrade = __esm(() => {
-  init_package();
-  init_registration();
-  init_setup_state();
-  init_host_install();
-  init_setup();
-  init_doctor();
-  init_support_matrix();
-  init_safe_write();
-  init_host_permissions();
-  LAUNCH_HOSTS = ["opencode", "cursor", "codex", "pi"];
-  HOSTS2 = [...LAUNCH_HOSTS, "claude-code"];
-  LIVE_HOSTS = new Set(["opencode", "claude-code"]);
-  OPENCODE_UPDATE = `opencode plugin update ${OPENCODE_PACKAGE}`;
-  PROCESS_HOSTS = {
-    claude: "claude-code",
-    codex: "codex",
-    cursor: "cursor",
-    opencode: "opencode",
-    pi: "pi"
-  };
+};
+var init_report = __esm(() => {
   LABEL = {
     updated: "updated",
     current: "already current",
@@ -75828,6 +75824,191 @@ var init_upgrade = __esm(() => {
   };
 });
 
+// packages/workit-cli/src/upgrade.ts
+import { spawnSync as spawnSync17 } from "node:child_process";
+async function runUpgradeCommand(argv, deps = {}) {
+  const out = deps.out ?? process.stdout;
+  const flags = new Set(argv);
+  const unknown = argv.filter((arg) => !["--apply", "--confirm", "--json", "--cli", "--preview", "--yes"].includes(arg) && !arg.startsWith("--hosts="));
+  const hostFlag = argv.find((arg) => arg.startsWith("--hosts="))?.slice(8);
+  const raw = hostFlag === "none" ? [] : hostFlag?.split(",") ?? HOSTS2;
+  if (unknown.length || raw.some((host) => !HOSTS2.includes(host)) || flags.has("--preview") && (flags.has("--apply") || flags.has("--yes"))) {
+    out.write(USAGE3);
+    return 2;
+  }
+  if (flags.has("--apply") && !flags.has("--confirm")) {
+    out.write(`Apply requires --confirm after reviewing the upgrade preview.
+`);
+    return 2;
+  }
+  const legacy = flags.has("--apply");
+  const json = flags.has("--json") || legacy;
+  const run = runner(deps);
+  const plan = previewUpgrade(raw, deps);
+  if (hostFlag === undefined || flags.has("--cli"))
+    planCli(plan, run);
+  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
+  const { home, env } = upgradePaths(deps);
+  const permissions = planHostPermissions({
+    hosts: raw,
+    refreshOnly: true,
+    shell: false,
+    home,
+    env
+  });
+  const permissionPreview = {
+    changes: permissions.changes.map((c) => ({
+      host: c.host,
+      file: c.file,
+      diff: permissionDiff(c)
+    })),
+    ...permissions.refused ? { refused: permissions.refused } : {}
+  };
+  const withPermissions = (value) => permissions.changes.length ? { ...value, permissions: permissionPreview } : value;
+  const applyCommand = `workit upgrade ${[...hostFlag === undefined ? [] : [`--hosts=${hostFlag}`], ...flags.has("--cli") ? ["--cli"] : [], "--yes"].join(" ")}`;
+  const nothingChanged = `preview only; nothing changed. Apply with: ${applyCommand}
+`;
+  if (json && !legacy && !flags.has("--yes")) {
+    out.write(JSON.stringify(withPermissions(plan), null, 2) + `
+`);
+    return plan.blocked.length ? 1 : 0;
+  }
+  if (!json)
+    out.write(summary(plan, permissions.changes));
+  if (flags.has("--preview")) {
+    out.write(nothingChanged);
+    return plan.blocked.length ? 1 : 0;
+  }
+  if (plan.blocked.length) {
+    out.write(`Upgrade blocked: ${plan.blocked.join("; ")}
+Nothing changed.
+`);
+    return 1;
+  }
+  const work = plan.entries.length + plan.migrations.length + (plan.cli ? 1 : 0) + permissions.changes.length;
+  if (work > 0 && !flags.has("--yes") && !legacy) {
+    const confirmed = await (deps.confirm ?? ((q) => askConfirm(q, out)))("Apply this upgrade? [y/N] ");
+    if (!confirmed) {
+      out.write(nothingChanged);
+      return 0;
+    }
+  }
+  if (json)
+    for (const warning of plan.warnings ?? [])
+      out.write(`warning: ${warning}
+`);
+  const result = applyUpgrade(plan, deps);
+  let permissionsOk = true;
+  let written;
+  if (permissions.changes.length && !permissions.refused && !result.error?.startsWith("configuration changed")) {
+    written = applyHostPermissions(permissions, { home, env });
+    permissionsOk = written.every((entry) => entry.status === "written");
+    for (const entry of written)
+      result.hosts.push({
+        host: entry.host,
+        status: entry.status === "written" ? "updated" : "failed",
+        reason: `permission block ${entry.status === "written" ? "refreshed" : entry.status} in ${entry.file}`,
+        ...entry.status === "written" ? {} : { fix: `workit setup --hosts=${entry.host}` }
+      });
+  }
+  const failed = !result.ok || !permissionsOk;
+  const cliVersion = result.hosts.some((h) => h.host === "cli" && h.status === "updated") ? plan.cli.latest : package_default.version;
+  const report = (deps.doctor ?? ((version) => runDoctor({ home, env, cliVersion: version, only: "upgrade" })))(cliVersion);
+  const left = report.checks.filter((check) => check.status === "warn" || check.status === "fail");
+  if (json) {
+    out.write(JSON.stringify({
+      ...result,
+      ok: !failed,
+      ...written ? { permissions: { changes: permissionPreview.changes, written } } : permissions.refused ? { permissions: permissionPreview } : {},
+      doctor: { clean: left.length === 0, left }
+    }, null, 2) + `
+`);
+    return failed ? 1 : 0;
+  }
+  if (result.error && result.hosts.every((h) => h.status !== "failed"))
+    out.write(`Upgrade stopped: ${result.error}
+`);
+  out.write(table(result.hosts));
+  if (permissions.refused)
+    out.write(`permissions: not refreshed: ${permissions.refused}
+`);
+  if (result.backup)
+    out.write(`Backup: ${result.backup}
+`);
+  out.write(left.length === 0 ? `Verified: workit doctor is clean for versions, assets, agents and permissions.
+` : `Left after upgrade (workit doctor):
+${left.map((check) => `  ${check.id}: ${check.detail}${check.fix ? `
+    fix: ${check.fix}` : ""}`).join(`
+`)}
+`);
+  return failed ? 1 : 0;
+}
+async function runLaunchCommand(argv, deps = {}) {
+  const [host, ...args] = argv;
+  if (!LAUNCH_HOSTS.includes(host)) {
+    (deps.out ?? process.stdout).write(`Usage: workit launch <opencode|cursor|codex|pi> [--auto-upgrade] [-- host arguments]
+`);
+    return 2;
+  }
+  const auto = args[0] === "--auto-upgrade";
+  const rest = auto ? args.slice(1) : args;
+  const hostArgs = rest[0] === "--" ? rest.slice(1) : rest;
+  const { home, env } = upgradePaths(deps);
+  let launch;
+  if (!deps.run) {
+    try {
+      launch = hostCommand(host, hostArgs, { home, env });
+    } catch (error) {
+      (deps.out ?? process.stderr).write(`${error instanceof Error ? error.message : "Host executable unavailable"}
+`);
+      return 1;
+    }
+  }
+  if (auto) {
+    const plan = previewUpgrade([host], deps);
+    const reasons = [...plan.blocked, ...plan.failed.map((entry) => entry.reason)];
+    if (plan.ok) {
+      for (const skipped of plan.skipped)
+        (deps.out ?? process.stderr).write(`${skipped.host}: ${skipped.reason}${skipped.fix ? ` (run: ${skipped.fix})` : ""}
+`);
+      const result = applyUpgrade(plan, deps);
+      if (!result.ok) {
+        (deps.out ?? process.stdout).write(`${result.error}
+`);
+        return 1;
+      }
+    } else if (plan.blocked.length === 0 && reasons.every((reason) => reason.includes("registry version unavailable"))) {
+      (deps.out ?? process.stderr).write(`Upgrade unavailable: ${reasons.join("; ")}. Starting the unchanged host.
+`);
+    } else {
+      (deps.out ?? process.stderr).write(`Upgrade blocked: ${reasons.join("; ")}
+`);
+      return 1;
+    }
+  }
+  if (deps.run)
+    return deps.run(host, hostArgs).status ?? 1;
+  return spawnSync17(launch.command, launch.args, {
+    stdio: "inherit",
+    env
+  }).status ?? 1;
+}
+var USAGE3 = `Usage: workit upgrade [--hosts=opencode,cursor,codex,pi,claude-code|none] [--cli] [--preview | --yes | --apply --confirm] [--json]
+`;
+var init_upgrade = __esm(() => {
+  init_package();
+  init_host_install();
+  init_doctor();
+  init_host_permissions();
+  init_apply();
+  init_plan();
+  init_report();
+  init_shared();
+  init_apply();
+  init_plan();
+  init_processes();
+});
+
 // packages/workit-cli/src/verbs/upgrade.ts
 var exports_upgrade = {};
 __export(exports_upgrade, {
@@ -75851,7 +76032,7 @@ var init_launch = __esm(() => {
 // packages/workit-core/src/knowledge.ts
 import { spawnSync as spawnSync18 } from "node:child_process";
 import fs20 from "node:fs";
-import path45 from "node:path";
+import path48 from "node:path";
 function lintKnowledge(root) {
   const seen = new Set;
   const unreadable = [];
@@ -75955,7 +76136,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   const end = lines.indexOf("---", 1);
   return end === -1 ? lines : [...lines.slice(0, end + 1).map(() => ""), ...lines.slice(end + 1)];
 }, read = (root, file) => {
-  const full = path45.join(root, file);
+  const full = path48.join(root, file);
   try {
     fs20.lstatSync(full);
   } catch {
@@ -75996,7 +76177,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   }
 }, brokenLinks = (root, doc, tracked) => {
   const findings = [];
-  const base = path45.dirname(path45.join(root, doc.file));
+  const base = path48.dirname(path48.join(root, doc.file));
   const missing = (target, line, how) => findings.push({
     rule: "broken-link",
     file: doc.file,
@@ -76015,7 +76196,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
       const local = localTarget(target);
       if (!local)
         continue;
-      const resolved = local.startsWith("/") ? path45.join(root, local) : path45.resolve(base, local);
+      const resolved = local.startsWith("/") ? path48.join(root, local) : path48.resolve(base, local);
       if (!exists2(resolved))
         missing(target, index + 1, "link");
     }
@@ -76025,9 +76206,9 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
         continue;
       const relative = /^\.\.?\//.test(candidate);
       const first = candidate.split("/")[0];
-      if (!relative && !(tracked ? tracked.has(first) : exists2(path45.join(root, first))))
+      if (!relative && !(tracked ? tracked.has(first) : exists2(path48.join(root, first))))
         continue;
-      const resolved = relative ? path45.resolve(base, candidate) : path45.join(root, candidate);
+      const resolved = relative ? path48.resolve(base, candidate) : path48.join(root, candidate);
       if (!exists2(resolved))
         missing(span, index + 1, "pointer");
     }
@@ -76350,10 +76531,10 @@ var init_redact = __esm(() => {
 
 // packages/workit-core/src/checks.ts
 import { spawn, spawnSync as spawnSync19 } from "node:child_process";
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import fs21 from "node:fs";
-import os17 from "node:os";
-import path46 from "node:path";
+import os18 from "node:os";
+import path49 from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function tailLines(text, lines = TAIL_LINES) {
   const all = text.replace(/\r\n?/gu, `
@@ -76473,7 +76654,7 @@ function planSpawn(argv, options) {
     return { file: argv[0], args: [], verbatim: false, shell: true };
   if (options.platform !== "win32")
     return { file: argv[0], args: argv.slice(1), verbatim: false, shell: false };
-  const win = path46.win32;
+  const win = path49.win32;
   const isFile = options.isFile ?? ((file) => {
     try {
       return fs21.statSync(file).isFile();
@@ -76558,7 +76739,7 @@ function runCheckCommand(argv, options) {
 `);
       redactor.end();
       resolve({
-        exitCode: spawnError ? 127 : code !== null ? code : 128 + (signal ? os17.constants.signals[signal] ?? 1 : 1),
+        exitCode: spawnError ? 127 : code !== null ? code : 128 + (signal ? os18.constants.signals[signal] ?? 1 : 1),
         signal: signal ?? null,
         timedOut,
         durationMs: Date.now() - started,
@@ -76635,10 +76816,10 @@ function runCheckCommand(argv, options) {
 function storeLog(storeRoot, log) {
   const digest = logDigest(log);
   const ref = `blobs/logs/${digest.slice("sha256:".length)}.log`;
-  const file = path46.join(storeRoot, ref);
+  const file = path49.join(storeRoot, ref);
   try {
     if (!fs21.existsSync(file)) {
-      fs21.mkdirSync(path46.dirname(file), { recursive: true });
+      fs21.mkdirSync(path49.dirname(file), { recursive: true });
       const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
       fs21.writeFileSync(temp, log, { mode: 384 });
       fs21.renameSync(temp, file);
@@ -76651,7 +76832,7 @@ function storeLog(storeRoot, log) {
 function pruneCheckLogs(storeRoot, options = {}) {
   const limits = { ...LOG_RETENTION, ...options.retention };
   const now = options.now ?? Date.now();
-  const dir = path46.join(storeRoot, "blobs", "logs");
+  const dir = path49.join(storeRoot, "blobs", "logs");
   const report = { removed: 0, removedBytes: 0, kept: 0 };
   let names;
   try {
@@ -76661,7 +76842,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   const files = names.flatMap((name) => {
     try {
-      const stat = fs21.statSync(path46.join(dir, name));
+      const stat = fs21.statSync(path49.join(dir, name));
       return stat.isFile() ? [{ name, size: stat.size, mtimeMs: stat.mtimeMs }] : [];
     } catch {
       return [];
@@ -76680,7 +76861,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
       continue;
     if (!options.dryRun)
       try {
-        fs21.rmSync(path46.join(dir, file.name), { force: true });
+        fs21.rmSync(path49.join(dir, file.name), { force: true });
       } catch {
         continue;
       }
@@ -76689,7 +76870,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   return report;
 }
-var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash16("sha256").update(log).digest("hex")}`, LOG_RETENTION;
+var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash17("sha256").update(log).digest("hex")}`, LOG_RETENTION;
 var init_checks3 = __esm(() => {
   init_redact();
   MAX_LOG_BYTES = 2 * 1024 * 1024;
@@ -76953,7 +77134,7 @@ __export(exports_workspace, {
   run: () => run11,
   runWorkspace: () => runWorkspace
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync21 } from "node:fs";
+import { copyFileSync as copyFileSync7, existsSync as existsSync23 } from "node:fs";
 function list2(argv, io) {
   if (argv.length)
     return usage3(io, `unexpected argument ${argv[0]}`);
@@ -77163,7 +77344,7 @@ usage: ${USAGE5}`)), load = (io) => {
     return { ok: false, error: `${current.path} changed; retry` };
   let backup = null;
   try {
-    if (existsSync21(current.path)) {
+    if (existsSync23(current.path)) {
       backup = `${current.path}.bak`;
       copyFileSync7(current.path, backup);
     }
@@ -77231,12 +77412,12 @@ var init_workspace = __esm(() => {
 
 // packages/workit-core/src/core/heavy-rules.ts
 import fs22 from "node:fs";
-import path47 from "node:path";
+import path50 from "node:path";
 function gitTop(cwd) {
-  for (let dir = path47.resolve(cwd);; dir = path47.dirname(dir)) {
-    if (fs22.existsSync(path47.join(dir, ".git")))
+  for (let dir = path50.resolve(cwd);; dir = path50.dirname(dir)) {
+    if (fs22.existsSync(path50.join(dir, ".git")))
       return dir;
-    if (path47.dirname(dir) === dir)
+    if (path50.dirname(dir) === dir)
       return null;
   }
 }
@@ -77277,19 +77458,19 @@ var init_heavy_rules = () => {};
 
 // packages/workit-core/src/core/heavy.ts
 import fs23 from "node:fs";
-import os18 from "node:os";
-import path48 from "node:path";
+import os19 from "node:os";
+import path51 from "node:path";
 function stateDir2(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path48.join(env.XDG_STATE_HOME, "workit");
-  const home = env.HOME || os18.homedir();
+    return path51.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os19.homedir();
   if (platform === "darwin")
-    return path48.join(home, "Library", "Application Support", "workit");
+    return path51.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path48.join(env.LOCALAPPDATA ?? path48.join(home, "AppData", "Local"), "workit");
-  return path48.join(home, ".local", "state", "workit");
+    return path51.join(env.LOCALAPPDATA ?? path51.join(home, "AppData", "Local"), "workit");
+  return path51.join(home, ".local", "state", "workit");
 }
 function positional(words, from, values = PM_VALUES) {
   let index = from;
@@ -77429,7 +77610,7 @@ function machinePatterns(env) {
   return isRecord8(value) ? stringList2(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path48.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path51.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -77508,7 +77689,7 @@ function leaseRewrite(command) {
     return null;
   return `${prefix}workit check --heavy -- ${rest}`;
 }
-var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path48.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
+var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path51.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
   try {
     return JSON.parse(fs23.readFileSync(file, "utf8"));
   } catch {
@@ -77654,8 +77835,8 @@ var init_heavy = __esm(() => {
 // packages/workit-core/src/core/resources.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import fs24 from "node:fs";
-import os19 from "node:os";
-import path49 from "node:path";
+import os20 from "node:os";
+import path52 from "node:path";
 function memoryValue(value, host) {
   const text = typeof value === "number" ? String(value) : typeof value === "string" ? value : "";
   const percent = PERCENT.exec(text.trim());
@@ -77836,7 +78017,7 @@ function tryOnce(options, record, reclaimed) {
   const text = `${JSON.stringify(record)}
 `;
   for (let slot = 0;slot < options.slots; slot += 1) {
-    const file = path49.join(options.dir, `slot-${slot}.json`);
+    const file = path52.join(options.dir, `slot-${slot}.json`);
     for (let attempt = 0;attempt < 2; attempt += 1) {
       try {
         const fd = fs24.openSync(file, "wx", 384);
@@ -77961,7 +78142,7 @@ function heldLease(dir, id, options = {}) {
   for (const name of names) {
     if (!/^slot-\d+\.json$/u.test(name))
       continue;
-    const lease = parseLease(readText5(path49.join(dir, name)));
+    const lease = parseLease(readText5(path52.join(dir, name)));
     if (lease?.id === id && !staleReason(lease, options.probe) && (options.ancestor ?? isAncestor)(lease.pid))
       return lease;
   }
@@ -78016,10 +78197,10 @@ async function runScoped(run, wrapper, sinks) {
 }
 function firstNotice(env, session, key, now = Date.now()) {
   const id = (session ?? `ppid-${process.ppid}`).replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 120);
-  const dir = path49.join(stateDir2(env), "notices");
+  const dir = path52.join(stateDir2(env), "notices");
   try {
     fs24.mkdirSync(dir, { recursive: true, mode: 448 });
-    fs24.writeFileSync(path49.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
+    fs24.writeFileSync(path52.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
 `, {
       flag: "wx",
       mode: 384
@@ -78029,7 +78210,7 @@ function firstNotice(env, session, key, now = Date.now()) {
   }
   try {
     for (const name of fs24.readdirSync(dir)) {
-      const file = path49.join(dir, name);
+      const file = path52.join(dir, name);
       if (now - fs24.statSync(file).mtimeMs > NOTICE_TTL_MS)
         fs24.rmSync(file, { force: true });
     }
@@ -78039,7 +78220,7 @@ function firstNotice(env, session, key, now = Date.now()) {
 function leaseSlots(dir, slots, probe = {}) {
   const states = [];
   for (let slot = 0;slot < slots; slot += 1) {
-    const lease = parseLease(readText5(path49.join(dir, `slot-${slot}.json`)));
+    const lease = parseLease(readText5(path52.join(dir, `slot-${slot}.json`)));
     states.push({
       slot,
       holder: lease ? holderOf(lease) : null,
@@ -78049,15 +78230,15 @@ function leaseSlots(dir, slots, probe = {}) {
   return states;
 }
 var DEFAULT_HEAVY_CHECKS, DEFAULT_SLOTS = 1, DEFAULT_WAIT_S = 600, DEFAULT_MEMORY_SHARE = 0.4, DEFAULT_CPU_SHARE = 0.7, MAX_SLOTS = 64, UNREADABLE_TTL_MS = 30000, GUARD_TTL_MS = 30000, hostShape = () => ({
-  totalMemBytes: os19.totalmem(),
-  cpus: Math.max(1, os19.availableParallelism?.() ?? os19.cpus().length)
-}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path49.join(stateDir2(env), "leases"), readText5 = (file) => {
+  totalMemBytes: os20.totalmem(),
+  cpus: Math.max(1, os20.availableParallelism?.() ?? os20.cpus().length)
+}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path52.join(stateDir2(env), "leases"), readText5 = (file) => {
   try {
     return fs24.readFileSync(file, "utf8");
   } catch {
     return null;
   }
-}, bootId = () => readText5("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os19.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
+}, bootId = () => readText5("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os20.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
   const stat = readText5(`/proc/${pid}/stat`);
   return stat ? stat.slice(stat.lastIndexOf(")") + 2).split(" ") : null;
 }, processStart = (pid) => statFields(pid)?.[19] ?? null, pidAlive2 = (pid) => {
@@ -78106,8 +78287,8 @@ __export(exports_check, {
   run: () => run12,
   workspaceResources: () => workspaceResources
 });
-import os20 from "node:os";
-import path50 from "node:path";
+import os21 from "node:os";
+import path53 from "node:path";
 function parse6(argv) {
   const split = argv.indexOf("--");
   const head = split >= 0 ? argv.slice(0, split) : [...argv];
@@ -78309,7 +78490,7 @@ function hostToolWaitCapMs(env) {
 }
 async function workspaceResources(io) {
   const env = io.env;
-  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path50.join(env.XDG_CONFIG_HOME || path50.join(env.HOME || os20.homedir(), ".config"), "workit");
+  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path53.join(env.XDG_CONFIG_HOME || path53.join(env.HOME || os21.homedir(), ".config"), "workit");
   try {
     await Promise.resolve().then(() => init_workspaces());
     const workspace = resolveWorkspaceFrom(io.cwd, dir, env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
@@ -78428,7 +78609,7 @@ async function run12(argv, io) {
     if (options.shell && command.length !== 1)
       return emit(io, fail2("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
-  const relCwd = posix(path50.relative(top, runCwd));
+  const relCwd = posix(path53.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
   const shadowed = !configured && name !== null ? config.checks.find((item) => item.name === name) : undefined;
   if (shadowed)
@@ -78490,7 +78671,7 @@ async function run12(argv, io) {
   const modifiedWorktree = key.tree !== null && treeAfter !== key.tree;
   const store = storeRoot(io.cwd);
   const blob = store.ok ? storeLog(store.value.root, result.log) : null;
-  const logPath = store.ok && blob ? path50.join(store.value.root, blob.ref) : null;
+  const logPath = store.ok && blob ? path53.join(store.value.root, blob.ref) : null;
   const tail = tailLines(result.log, TAIL_LINES);
   const passed = result.exitCode === 0 && !result.timedOut;
   const bounded = boundedArgv(command);
@@ -78605,7 +78786,7 @@ async function run12(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE6 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path50.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, HOST_TOOL_WAIT_CAP_MS = 1e5;
+var USAGE6 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path53.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, HOST_TOOL_WAIT_CAP_MS = 1e5;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -78634,7 +78815,7 @@ __export(exports_lock, {
   run: () => run13
 });
 import fs25 from "node:fs";
-import path51 from "node:path";
+import path54 from "node:path";
 async function settingsFor(io) {
   const workspace = await workspaceResources(io);
   const config = loadCheckConfig(io.cwd);
@@ -78716,7 +78897,7 @@ function readPatterns(file) {
   return { patterns: [] };
 }
 function writePatterns(file, value) {
-  fs25.mkdirSync(path51.dirname(file), { recursive: true, mode: 448 });
+  fs25.mkdirSync(path54.dirname(file), { recursive: true, mode: 448 });
   const temp = `${file}.${process.pid}.tmp`;
   fs25.writeFileSync(temp, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -78802,9 +78983,9 @@ var exports_models = {};
 __export(exports_models, {
   run: () => run14
 });
-import { existsSync as existsSync22, readdirSync as readdirSync13, readFileSync as readFileSync22, statSync as statSync9 } from "node:fs";
-import os21 from "node:os";
-import path52 from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync13, readFileSync as readFileSync24, statSync as statSync9 } from "node:fs";
+import os22 from "node:os";
+import path55 from "node:path";
 async function run14(argv, io) {
   const [sub, ...args] = argv.filter((arg) => arg !== "--json");
   if (sub !== "show")
@@ -78865,7 +79046,7 @@ var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
   const found = new Set;
   let text = "";
   try {
-    text = readFileSync22(file, "utf8");
+    text = readFileSync24(file, "utf8");
   } catch {
     return found;
   }
@@ -78879,26 +79060,26 @@ var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
       } catch {}
   return found;
 }, matches3 = (ran, configured) => ran.toLowerCase().includes(configured.toLowerCase()), usageReport = (cwd, env, days) => {
-  const projects = path52.join(env.CLAUDE_CONFIG_DIR || path52.join(env.HOME || os21.homedir(), ".claude"), "projects");
+  const projects = path55.join(env.CLAUDE_CONFIG_DIR || path55.join(env.HOME || os22.homedir(), ".claude"), "projects");
   const since = Date.now() - days * 86400000;
   const types = {};
   let agents = 0;
   const dirs = (dir) => {
     try {
-      return readdirSync13(dir).map((name) => path52.join(dir, name));
+      return readdirSync13(dir).map((name) => path55.join(dir, name));
     } catch {
       return [];
     }
   };
   for (const project of dirs(projects))
     for (const session of dirs(project))
-      for (const meta of dirs(path52.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
+      for (const meta of dirs(path55.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
         try {
           if (statSync9(meta).mtimeMs < since)
             continue;
-          const agentType = JSON.parse(readFileSync22(meta, "utf8")).agentType;
+          const agentType = JSON.parse(readFileSync24(meta, "utf8")).agentType;
           const transcript = meta.replace(/\.meta\.json$/, ".jsonl");
-          if (typeof agentType !== "string" || !existsSync22(transcript))
+          if (typeof agentType !== "string" || !existsSync24(transcript))
             continue;
           const ran = modelsOf(transcript);
           if (!ran.size)
@@ -79037,8 +79218,8 @@ var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock)
 
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync23 } from "node:fs";
-import path53 from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync25 } from "node:fs";
+import path56 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
     ["rebase-merge", "rebase"],
@@ -79051,18 +79232,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path53.resolve(cwd, line.trim()));
+`).map((line) => path56.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
-    if (!marker || !existsSync23(marker))
+    if (!marker || !existsSync25(marker))
       continue;
-    if (index === 1 && existsSync23(path53.join(marker, "applying")))
+    if (index === 1 && existsSync25(path56.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync23(path53.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync25(path56.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync23(path53.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync25(path56.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -79390,7 +79571,7 @@ function gitCommit(cwd, input) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync23(path53.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync25(path56.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -79929,12 +80110,12 @@ var init_ops = __esm(() => {
 
 // packages/workit-core/src/verdict-cover.ts
 import fs26 from "node:fs";
-import path54 from "node:path";
+import path57 from "node:path";
 function chainsAbove(cwd, branch) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return [];
-  const dir = path54.join(root.value.root, "stacks");
+  const dir = path57.join(root.value.root, "stacks");
   let names = [];
   try {
     names = fs26.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -79945,7 +80126,7 @@ function chainsAbove(cwd, branch) {
   for (const name of names.toSorted()) {
     let parsed;
     try {
-      parsed = JSON.parse(fs26.readFileSync(path54.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs26.readFileSync(path57.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -80040,10 +80221,10 @@ var init_pr_lane = __esm(() => {
 
 // packages/workit-core/src/forge/reruns.ts
 import fs27 from "node:fs";
-import path55 from "node:path";
+import path58 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path55.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path58.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -80078,7 +80259,7 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs27.mkdirSync(path55.dirname(file), { recursive: true });
+    fs27.mkdirSync(path58.dirname(file), { recursive: true });
     fs27.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
@@ -80091,7 +80272,7 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs27.mkdirSync(path55.dirname(lock), { recursive: true });
+  fs27.mkdirSync(path58.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
@@ -80508,7 +80689,7 @@ function recordAccepted(cwd, resolved, status, accepted, options) {
   return recordReruns(cwd, rows);
 }
 var MAX_LOG_TAILS = 5, GITLAB_MERGEABLE, GITHUB_MERGEABLE, NO_CHECKS_GRACE_MS = 90000;
-var init_report = __esm(() => {
+var init_report2 = __esm(() => {
   init_rev();
   init_ledger();
   init_reruns();
@@ -81057,7 +81238,7 @@ var init_pr_ops = __esm(() => {
   init_ledger();
   init_verdict_cover();
   init_pr_lane();
-  init_report();
+  init_report2();
   VERIFY_DELAYS_MS = [1000, 2000, 4000];
   AFTER_REVIEW = {
     commit: "stop here; review comes when the user asks",
@@ -81070,9 +81251,9 @@ var init_pr_ops = __esm(() => {
 
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync22 } from "node:child_process";
-import { createHash as createHash17, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash18, randomBytes as randomBytes4 } from "node:crypto";
 import fs28 from "node:fs";
-import path56 from "node:path";
+import path59 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -81121,7 +81302,7 @@ function gitRestack(cwd, input) {
         error: "no store root"
       };
     fs28.mkdirSync(scratch, { recursive: true });
-    dir = path56.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    dir = path59.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return {
@@ -81177,7 +81358,7 @@ function pruneScratch(cwd) {
   if (!scratch || !fs28.existsSync(scratch))
     return;
   for (const name of fs28.readdirSync(scratch)) {
-    const dir = path56.join(scratch, name);
+    const dir = path59.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -81187,7 +81368,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path56.join(root.value.root, "stacks") };
+  return { ok: true, data: path59.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
   if (!isRecord12(raw) || !Array.isArray(raw.branches))
@@ -81239,7 +81420,7 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path56.join(dir.data, fileFor(name));
+  const file = path59.join(dir.data, fileFor(name));
   let text;
   try {
     text = fs28.readFileSync(file, "utf8");
@@ -81260,7 +81441,7 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path56.join(dir.data, fileFor(stack.name));
+  const file = path59.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
@@ -81288,7 +81469,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs28.readFileSync(path56.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs28.readFileSync(path59.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -81350,7 +81531,7 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes4(8).toString("hex")
   };
-  fs28.writeFileSync(path56.join(lock, OWNER), JSON.stringify(owner));
+  fs28.writeFileSync(path59.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
@@ -81387,7 +81568,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path56.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path59.join(dir.data, `${fileFor(name)}.lock`);
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
@@ -81417,7 +81598,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs28.utimesSync(path56.join(lock, OWNER), now, now);
+      fs28.utimesSync(path59.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -82318,10 +82499,10 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path56.join(dir.data, "worktrees") : null;
+  return dir.ok ? path59.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
-`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash17("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash18("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
   if (name.length === 0 || name.length > 200)
     return false;
   for (let index = 0;index < name.length; index += 1) {
@@ -82333,12 +82514,12 @@ ${run.stdout}`.split(`
 }, isRecord12 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs28.readFileSync(path56.join(lock, OWNER), "utf8");
+    raw = fs28.readFileSync(path59.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path56.join(lock, OWNER), lock])
+  for (const target of [path59.join(lock, OWNER), lock])
     try {
       age = Date.now() - fs28.statSync(target).mtimeMs;
       break;
@@ -82362,7 +82543,7 @@ var init_stack = __esm(() => {
   init_autonomy();
   init_store_lock();
   init_pr_ops();
-  init_report();
+  init_report2();
   init_ops();
   init_rev();
   init_ledger();
@@ -82379,9 +82560,9 @@ var init_stack = __esm(() => {
 
 // packages/workit-core/src/fanout.ts
 import { spawnSync as spawnSync23 } from "node:child_process";
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 import fs29 from "node:fs";
-import path57 from "node:path";
+import path60 from "node:path";
 function expandBraces2(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -82627,7 +82808,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path57.resolve(defaults.root, optional("worktree") ?? path57.join(defaults.worktreeRoot, id)),
+      worktree: path60.resolve(defaults.root, optional("worktree") ?? path60.join(defaults.worktreeRoot, id)),
       tier,
       reason,
       dependsOn: [...new Set(dependsOn ?? [])],
@@ -82756,12 +82937,12 @@ function regeneratedFiles(root, tracked) {
   const found = new Map;
   let scripts;
   try {
-    const manifest = JSON.parse(fs29.readFileSync(path57.join(root, "package.json"), "utf8"));
+    const manifest = JSON.parse(fs29.readFileSync(path60.join(root, "package.json"), "utf8"));
     scripts = manifest.scripts ?? {};
   } catch {
     return found;
   }
-  const runner = fs29.existsSync(path57.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path57.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path57.join(root, "yarn.lock")) ? "yarn run" : "npm run";
+  const runner = fs29.existsSync(path60.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path60.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path60.join(root, "yarn.lock")) ? "yarn run" : "npm run";
   const outputs = tracked.filter((file) => !CODE.test(file));
   for (const [name, command] of Object.entries(scripts)) {
     if (!name.startsWith("write:") || typeof command !== "string")
@@ -82769,7 +82950,7 @@ function regeneratedFiles(root, tracked) {
     for (const file of command.match(/[\w./-]+\.[cm]?[jt]s\b/gu) ?? []) {
       let source;
       try {
-        source = fs29.readFileSync(path57.join(root, file), "utf8");
+        source = fs29.readFileSync(path60.join(root, file), "utf8");
       } catch {
         continue;
       }
@@ -82891,11 +83072,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path57.basename(common) === ".git" ? path57.dirname(common) : path57.resolve(cwd);
+  return common && path60.basename(common) === ".git" ? path60.dirname(common) : path60.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path57.join(path57.dirname(main), `${path57.basename(main)}-wt`);
+  return path60.join(path60.dirname(main), `${path60.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -82909,13 +83090,13 @@ function sliceHash(slice) {
     issues: _issues,
     ...definition
   } = slice;
-  return createHash18("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
+  return createHash19("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
 }
 function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path57.join(root.value.root, "fanouts") };
+  return { ok: true, data: path60.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord13(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -82983,7 +83164,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path57.join(dir.data, stackFileName(name));
+  const file = path60.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs29.readFileSync(file, "utf8")));
@@ -83008,7 +83189,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs29.readFileSync(path57.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs29.readFileSync(path60.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -83047,7 +83228,7 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path57.join(dir.data, stackFileName(plan.name));
+  const file = path60.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs29.mkdirSync(dir.data, { recursive: true });
@@ -83258,13 +83439,13 @@ var init_fanout = __esm(() => {
 // packages/workit-core/src/forge/exec.ts
 import { spawnSync as spawnSync24 } from "node:child_process";
 import fs30 from "node:fs";
-import path58 from "node:path";
+import path61 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path58.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path61.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path58.join(dir, `${bin}${ext}`);
+      const candidate = path61.join(dir, `${bin}${ext}`);
       try {
         const stat = fs30.statSync(candidate);
         if (stat.isFile())
@@ -84807,7 +84988,7 @@ var init_pr_edit = __esm(() => {
   init_rev();
   init_stack();
   init_pr_ops();
-  init_report();
+  init_report2();
 });
 
 // packages/workit-core/src/core/live-session.ts
@@ -84827,7 +85008,7 @@ var init_live_session = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/write-gate.ts
-import path59 from "node:path";
+import path62 from "node:path";
 var CASE_INSENSITIVE, PREFIXES2, SCRIPT_SHELLS, cache3, MUTATING_GIT, DRY_N, MUTATING_WORKIT_GIT, CD2, PUSHD2, POPD2, UNKNOWN_DIR;
 var init_write_gate = __esm(() => {
   init_task_store();
@@ -84867,7 +85048,7 @@ var init_write_gate = __esm(() => {
   CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
   PUSHD2 = new Set(["pushd", "push-location"]);
   POPD2 = new Set(["popd", "pop-location"]);
-  UNKNOWN_DIR = path59.resolve(path59.parse(process.cwd()).root, ".workit-unknown-dir");
+  UNKNOWN_DIR = path62.resolve(path62.parse(process.cwd()).root, ".workit-unknown-dir");
 });
 
 // packages/workit-core/src/hooks/worktree-confine.ts
@@ -84892,20 +85073,20 @@ var init_worktree_confine = __esm(() => {
 
 // packages/workit-core/src/worktree-deps.ts
 import fs31 from "node:fs";
-import path60 from "node:path";
+import path63 from "node:path";
 function moduleDirs(main) {
   const out = [];
   const walk = (relative, depth) => {
     let entries;
     try {
-      entries = fs31.readdirSync(path60.join(main, relative), { withFileTypes: true });
+      entries = fs31.readdirSync(path63.join(main, relative), { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const child = path60.join(relative, entry.name);
+      const child = path63.join(relative, entry.name);
       if (entry.name === MODULES)
         out.push(child);
       else if (depth < MAX_DEPTH2 && !entry.name.startsWith("."))
@@ -84919,8 +85100,8 @@ function linkEntry(main, worktree, source, target) {
   const stat = fs31.lstatSync(source);
   if (stat.isSymbolicLink()) {
     const link = fs31.readlinkSync(source);
-    const outside = path60.isAbsolute(link) && within(link, main) && !path60.relative(main, link).split(path60.sep).includes(MODULES);
-    const to = outside ? path60.join(worktree, path60.relative(main, link)) : link;
+    const outside = path63.isAbsolute(link) && within(link, main) && !path63.relative(main, link).split(path63.sep).includes(MODULES);
+    const to = outside ? path63.join(worktree, path63.relative(main, link)) : link;
     fs31.symlinkSync(to, target, process.platform === "win32" ? "junction" : undefined);
     return;
   }
@@ -84930,8 +85111,8 @@ function mirror(main, worktree, source, target, top) {
   fs31.mkdirSync(target);
   let count = 0;
   for (const entry of fs31.readdirSync(source, { withFileTypes: true })) {
-    const from = path60.join(source, entry.name);
-    const to = path60.join(target, entry.name);
+    const from = path63.join(source, entry.name);
+    const to = path63.join(target, entry.name);
     if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin"))
       count += mirror(main, worktree, from, to, false);
     else {
@@ -84947,16 +85128,16 @@ function linkWorktreeDependencies(main, worktree) {
   const dirs = [];
   let entries = 0;
   for (const relative of moduleDirs(main)) {
-    const target = path60.join(worktree, relative);
-    if (!fs31.existsSync(path60.dirname(target)) || fs31.existsSync(target))
+    const target = path63.join(worktree, relative);
+    if (!fs31.existsSync(path63.dirname(target)) || fs31.existsSync(target))
       continue;
-    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path60.sep).join("/")}/`]).ok) {
-      notes.push(`${relative.split(path60.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
+    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path63.sep).join("/")}/`]).ok) {
+      notes.push(`${relative.split(path63.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
       continue;
     }
     try {
-      entries += mirror(main, worktree, path60.join(main, relative), target, true);
-      dirs.push(relative.split(path60.sep).join("/"));
+      entries += mirror(main, worktree, path63.join(main, relative), target, true);
+      dirs.push(relative.split(path63.sep).join("/"));
     } catch (error) {
       fs31.rmSync(target, { recursive: true, force: true });
       notes.push(`could not link ${relative} from ${main} (${error.message}); install dependencies in the worktree yourself`);
@@ -84969,8 +85150,8 @@ function linkWorktreeDependencies(main, worktree) {
   return { linked: { from: main, dirs, entries, ms }, notes };
 }
 var MODULES = "node_modules", MAX_DEPTH2 = 2, within = (child, parent) => {
-  const relative = path60.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path60.isAbsolute(relative);
+  const relative = path63.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path63.isAbsolute(relative);
 };
 var init_worktree_deps = __esm(() => {
   init_fanout();
@@ -84979,7 +85160,7 @@ var init_worktree_deps = __esm(() => {
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
 import fs32 from "node:fs";
-import path61 from "node:path";
+import path64 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -85039,7 +85220,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs32.readFileSync(path61.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
+    token = fs32.readFileSync(path64.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -85047,7 +85228,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path61.basename(file),
+      id: path64.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -85063,7 +85244,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes5(16).toString("hex");
   try {
-    fs32.writeFileSync(path61.join(admin.path, FANOUT_TOKEN_FILE), `${token}
+    fs32.writeFileSync(path64.join(admin.path, FANOUT_TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -85078,7 +85259,7 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path61.join(common, "info", "exclude");
+  const file = path64.join(common, "info", "exclude");
   let text = "";
   try {
     text = fs32.readFileSync(file, "utf8");
@@ -85087,7 +85268,7 @@ function excludeScratch(cwd) {
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs32.mkdirSync(path61.dirname(file), { recursive: true });
+  fs32.mkdirSync(path64.dirname(file), { recursive: true });
   fs32.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
@@ -85096,13 +85277,13 @@ ${EXCLUDE_LINE}
 }
 function worktreeDependencies(main, worktree) {
   for (const [name, install] of LOCKFILES2) {
-    const ours = readBytes(path61.join(main, name));
-    const theirs = readBytes(path61.join(worktree, name));
+    const ours = readBytes(path64.join(main, name));
+    const theirs = readBytes(path64.join(worktree, name));
     if (ours === null && theirs === null)
       continue;
     if (ours !== null && theirs !== null && ours.equals(theirs))
       continue;
-    if (fs32.existsSync(path61.join(worktree, "node_modules")))
+    if (fs32.existsSync(path64.join(worktree, "node_modules")))
       break;
     const command = install(worktree);
     return {
@@ -85116,7 +85297,7 @@ function worktreeDependencies(main, worktree) {
   return { ...linkWorktreeDependencies(main, worktree), install: null };
 }
 function ensureScratch(worktree) {
-  const scratch = path61.join(worktree, SCRATCH_DIR);
+  const scratch = path64.join(worktree, SCRATCH_DIR);
   fs32.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
@@ -85355,7 +85536,7 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path61.join(worktree, SCRATCH_DIR);
+  const scratch = path64.join(worktree, SCRATCH_DIR);
   let stat;
   try {
     stat = fs32.lstatSync(scratch);
@@ -85371,16 +85552,16 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
   try {
     return fs32.realpathSync.native(target);
   } catch {
-    return path61.resolve(target);
+    return path64.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside3 = (child, parent) => {
-  const relative = path61.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path61.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path61.isAbsolute(slice.worktree) ? slice.worktree : path61.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
+  const relative = path64.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path64.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path64.isAbsolute(slice.worktree) ? slice.worktree : path64.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
   try {
     return fs32.readFileSync(file);
   } catch {
@@ -85411,7 +85592,7 @@ var init_fanout_worktree = __esm(() => {
 
 // packages/workit-core/src/forge/merge-cleanup.ts
 import fs33 from "node:fs";
-import path62 from "node:path";
+import path65 from "node:path";
 function cleanupMergedBranch(cwd, branch, mergedHead) {
   const out = { branchDeleted: false, worktreeRemoved: null, notes: [] };
   if (!branch || branch.startsWith("-"))
@@ -85471,13 +85652,13 @@ var SLOW2, isFanoutWorktree = (worktree) => {
   if (!dir.ok)
     return false;
   try {
-    return fs33.readFileSync(path62.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
+    return fs33.readFileSync(path65.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
   } catch {
     return false;
   }
 }, inside4 = (child, parent) => {
-  const relative = path62.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
-  return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
+  const relative = path65.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
+  return relative === "" || !relative.startsWith("..") && !path65.isAbsolute(relative);
 };
 var init_merge_cleanup = __esm(() => {
   init_fanout();
@@ -85758,7 +85939,7 @@ var init_duration = __esm(() => {
 });
 
 // packages/workit-cli/src/verbs/forge-common.ts
-import { readFileSync as readFileSync24 } from "node:fs";
+import { readFileSync as readFileSync26 } from "node:fs";
 function parseFlags(argv, spec) {
   const parsed = { values: {}, booleans: new Set, lists: {}, positionals: [] };
   for (let index = 0;index < argv.length; index += 1) {
@@ -85913,7 +86094,7 @@ var init_forge_common = __esm(() => {
   forgeDeps = {
     runner: undefined,
     npm: undefined,
-    readStdin: () => readFileSync24(0, "utf8"),
+    readStdin: () => readFileSync26(0, "utf8"),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     now: () => Date.now()
   };
@@ -85924,12 +86105,12 @@ var exports_pr = {};
 __export(exports_pr, {
   run: () => run15
 });
-import { readFileSync as readFileSync25 } from "node:fs";
-import path63 from "node:path";
+import { readFileSync as readFileSync27 } from "node:fs";
+import path66 from "node:path";
 function readBodyFile(io, file) {
   try {
     return {
-      body: file === "-" ? forgeDeps.readStdin() : readFileSync25(path63.resolve(io.cwd, file), "utf8")
+      body: file === "-" ? forgeDeps.readStdin() : readFileSync27(path66.resolve(io.cwd, file), "utf8")
     };
   } catch {
     return `cannot read --body-file ${file}`;
@@ -86440,7 +86621,7 @@ var init_pr = __esm(() => {
   init_issue_link();
   init_pr_edit();
   init_pr_ops();
-  init_report();
+  init_report2();
   init_rev();
   init_workspaces();
   init_merge_cleanup();
@@ -86694,7 +86875,7 @@ async function run16(argv, io) {
 }
 var WAIT_USAGE = "workit ci wait [--pr <n> | --branch <b>] [--head <sha>] [--timeout 20m] [--interval 30s] [--json]", RERUN_USAGE = "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force] [--json]", LOGS_USAGE = "workit ci logs --failed [--pr <n> | --branch <b>] [--json]", LOG_LINES = 60, ONE_POLL_MS = 20000, MAX_POLL_ERRORS = 3, seconds = (ms) => `${Math.round(ms / 1000)}s`;
 var init_ci = __esm(() => {
-  init_report();
+  init_report2();
   init_ledger();
   init_autonomy();
   init_output();
@@ -86733,8 +86914,8 @@ var exports_git = {};
 __export(exports_git, {
   run: () => run17
 });
-import { readFileSync as readFileSync26 } from "node:fs";
-import path64 from "node:path";
+import { readFileSync as readFileSync28 } from "node:fs";
+import path67 from "node:path";
 function kindHint(cwd, kind) {
   let kinds = [...BRANCH_KINDS];
   try {
@@ -86838,7 +87019,7 @@ function commitMessage(parsed, io) {
 
 `);
   try {
-    return file === "-" ? readFileSync26(0, "utf8") : readFileSync26(path64.resolve(io.cwd, file), "utf8");
+    return file === "-" ? readFileSync28(0, "utf8") : readFileSync28(path67.resolve(io.cwd, file), "utf8");
   } catch (error) {
     return {
       error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
@@ -87252,7 +87433,7 @@ var init_verify = __esm(() => {
   init_exec();
   init_rev();
   init_ledger();
-  init_report();
+  init_report2();
   init_redact();
   NPM_NAME = /^(?:@[A-Za-z0-9~][A-Za-z0-9-._~]*\/)?[A-Za-z0-9~][A-Za-z0-9-._~]*$/u;
   SEMVER2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
@@ -87999,6 +88180,11 @@ async function run19(argv, io) {
   if (!result.ok)
     return forgeFail(io, result);
   const report = result.data;
+  if (report.delivered && expect === "merged") {
+    try {
+      closeDeliveredTasks(new TaskStore(io.cwd), new Date().toISOString().replace(/\.\d{3}Z$/, "Z"));
+    } catch {}
+  }
   if (report.delivered)
     return emit(io, ok2(report), render2);
   const failed = report.observations.filter((entry) => !entry.ok);
@@ -88017,6 +88203,8 @@ var USAGE12 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|p
 ];
 var init_verify_delivery = __esm(() => {
   init_verify();
+  init_task_store();
+  init_task_delivery();
   init_ledger();
   init_output();
   init_forge_common();
@@ -88271,15 +88459,15 @@ var init_stack2 = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-brief.ts
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import fs35 from "node:fs";
-import path65 from "node:path";
+import path68 from "node:path";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
   const full = `${lead}-w-${slice}${tail}`;
   if (full.length <= SESSION_MAX)
     return full;
-  const digest = createHash19("sha256").update(slice).digest("hex").slice(0, 12);
+  const digest = createHash20("sha256").update(slice).digest("hex").slice(0, 12);
   return `${lead.slice(0, SESSION_MAX - 3 - digest.length - tail.length)}-w-${digest}${tail}`;
 }
 function renderBrief(cwd, plan, input) {
@@ -88355,7 +88543,7 @@ function renderBrief(cwd, plan, input) {
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
     exists ? `WORKTREE: ${planned}  (made by \`workit fanout worktree create ${slice.id}\`; yours alone)` : `WORKTREE: ${planned}  (not made yet: the lead runs \`workit fanout worktree create ${slice.id}\` before spawning, then renders this brief again)`,
-    ...exists && typeof made?.install === "string" && !fs35.existsSync(path65.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
+    ...exists && typeof made?.install === "string" && !fs35.existsSync(path68.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
     ...identityLines(identity, minted),
     ...rules(mode, branch, slice.base, exists ? planned : null)
   ];
@@ -89085,7 +89273,7 @@ var DEFAULT_STUCK_MS, isoOf = (seconds) => {
 }, newest = (...values) => values.filter((value) => Boolean(value) && !Number.isNaN(Date.parse(value ?? ""))).reduce((best, value) => best === null || Date.parse(value) > Date.parse(best) ? value : best, null);
 var init_fanout_status = __esm(() => {
   init_duration();
-  init_report();
+  init_report2();
   init_role_models();
   init_ledger();
   init_fanout_check();
@@ -89100,7 +89288,7 @@ __export(exports_fanout, {
   run: () => run21
 });
 import fs36 from "node:fs";
-import path66 from "node:path";
+import path69 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -89161,7 +89349,7 @@ function plan2(argv, io) {
     return usage4(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage4(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path66.resolve(io.cwd, flags.positionals[0]);
+  const file = path69.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
     raw = JSON.parse(fs36.readFileSync(file, "utf8"));
@@ -104704,7 +104892,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path67 from "node:path";
+import path70 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -105197,12 +105385,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path67.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path70.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path67.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path70.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -105591,8 +105779,8 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync10 } from "node:fs";
-import path68 from "node:path";
+import { existsSync as existsSync26, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
+import path71 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
@@ -105605,7 +105793,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync14(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path68.join(dir, entry.name);
+    const full = path71.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -105617,8 +105805,8 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path68.resolve(cwd, input);
-    if (!existsSync24(full))
+    const full = path71.resolve(cwd, input);
+    if (!existsSync26(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
       walkTests(full, files);
@@ -105654,11 +105842,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path68.join(root, file), lines);
+    changed.set(path71.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path68.join(root, file), "all");
+    changed.set(path71.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -105671,7 +105859,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync27(file, "utf8"), file);
+      parsed = parseSource(readFileSync29(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -105720,7 +105908,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path68.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path71.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -105734,23 +105922,23 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync25,
+  existsSync as existsSync27,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync15,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync30,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync10,
   renameSync as renameSync7,
   rmSync as rmSync9,
   statSync as statSync11,
   symlinkSync,
-  writeFileSync as writeFileSync12,
+  writeFileSync as writeFileSync13,
   copyFileSync as copyFileSync8
 } from "node:fs";
-import os22 from "node:os";
-import path69 from "node:path";
+import os23 from "node:os";
+import path72 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -105823,7 +106011,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path69.posix.join(path69.posix.dirname(file), spec)) === target)
+        if (stripExt(path72.posix.join(path72.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -105831,7 +106019,7 @@ function relatedTests(source, testFiles) {
     return false;
   }).map((entry) => entry.file);
 }
-function removeStaleCopies(tmp = os22.tmpdir()) {
+function removeStaleCopies(tmp = os23.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
@@ -105843,12 +106031,12 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path69.join(tmp, name);
+    const dir = path72.join(tmp, name);
     try {
       const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync28(path69.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync30(path72.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -105865,8 +106053,8 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync12(target, { recursive: true });
   for (const entry of readdirSync15(origin, { withFileTypes: true })) {
-    const from = path69.join(origin, entry.name);
-    const to = path69.join(target, entry.name);
+    const from = path72.join(origin, entry.name);
+    const to = path72.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -105882,9 +106070,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path69.relative(repo, real);
-      if (!relative.startsWith("..") && !path69.isAbsolute(relative) && !relative.split(path69.sep).includes("node_modules")) {
-        symlinkSync(path69.join(copy, relative), to, "junction");
+      const relative = path72.relative(repo, real);
+      if (!relative.startsWith("..") && !path72.isAbsolute(relative) && !relative.split(path72.sep).includes("node_modules")) {
+        symlinkSync(path72.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -105900,7 +106088,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync10(repo);
   if (real && inside5(realRepo, real)) {
-    symlinkSync(path69.relative(path69.dirname(to), path69.join(tree, path69.relative(realRepo, real))), to);
+    symlinkSync(path72.relative(path72.dirname(to), path72.join(tree, path72.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync11(real).isFile())
@@ -105909,23 +106097,23 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path69.join(copy, file);
+  const target = path72.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path69.dirname(target))))
+    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path72.dirname(target))))
       return false;
   } catch {
     return false;
   }
   const temp = `${target}.workit-mutant-${process.pid}`;
-  writeFileSync12(temp, content);
+  writeFileSync13(temp, content);
   renameSync7(temp, target);
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path69.join(os22.tmpdir(), TEMP_PREFIX));
-  writeFileSync12(path69.join(dir, PID_FILE), String(process.pid));
-  const tree = path69.join(dir, "tree");
+  const dir = mkdtempSync4(path72.join(os23.tmpdir(), TEMP_PREFIX));
+  writeFileSync13(path72.join(dir, PID_FILE), String(process.pid));
+  const tree = path72.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -105942,29 +106130,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path69.join(repo, relative);
+    const from = path72.join(repo, relative);
     let stat;
     try {
       stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path69.join(tree, relative);
-    mkdirSync12(path69.dirname(to), { recursive: true });
+    const to = path72.join(tree, relative);
+    mkdirSync12(path72.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync8(from, to);
-    let parent = path69.dirname(relative);
+    let parent = path72.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path69.dirname(parent);
+      parent = path72.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path69.join(repo, parent, "node_modules");
-    if (existsSync25(modules) && !existsSync25(path69.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path69.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path72.join(repo, parent, "node_modules");
+    if (existsSync27(modules) && !existsSync27(path72.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path72.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -106003,20 +106191,20 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync28(path69.join(repo, file), "utf8") };
+      return { file, text: readFileSync30(path72.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path69.relative(repo, absolute));
+    const relative = toPosix(path72.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync25(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync27(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync28(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync30(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -106024,9 +106212,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path69.relative(repo, options.cwd);
+  const cwdRelative = path72.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path69.relative(cwdRelative, file));
+    const relative = toPosix(path72.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -106062,7 +106250,7 @@ async function runMutation(options) {
     return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path69.join(copy, cwdRelative);
+  const copyCwd = path72.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -106097,7 +106285,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync28(path69.join(copy, mutant.file), "utf8");
+      const original = readFileSync30(path72.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -106154,8 +106342,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside5 = (root, file) => {
-  const relative = path69.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path69.isAbsolute(relative);
+  const relative = path72.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path72.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -106203,8 +106391,8 @@ var exports_test_audit = {};
 __export(exports_test_audit, {
   run: () => run23
 });
-import { existsSync as existsSync26 } from "node:fs";
-import path70 from "node:path";
+import { existsSync as existsSync28 } from "node:fs";
+import path73 from "node:path";
 function parse8(argv) {
   const options = {
     paths: [],
@@ -106309,8 +106497,8 @@ async function run23(argv, io) {
     return emit(io, fail2("invalid_input", `${options}
 usage: ${USAGE16}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path70.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path70.relative(io.cwd, file) || file);
+  const repo = top.ok ? path73.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path73.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -106327,7 +106515,7 @@ usage: ${USAGE16}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync26(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync28(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -106448,8 +106636,8 @@ var exports_youtrack = {};
 __export(exports_youtrack, {
   run: () => run25
 });
-import { readFileSync as readFileSync29 } from "node:fs";
-import path71 from "node:path";
+import { readFileSync as readFileSync31 } from "node:fs";
+import path74 from "node:path";
 async function run25(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -106495,7 +106683,7 @@ async function run25(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync29(path71.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync31(path74.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage4(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE18);
       }
@@ -106563,8 +106751,8 @@ var exports_changelog = {};
 __export(exports_changelog, {
   run: () => run26
 });
-import { readFileSync as readFileSync30 } from "node:fs";
-import path72 from "node:path";
+import { readFileSync as readFileSync32 } from "node:fs";
+import path75 from "node:path";
 async function run26(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -106610,7 +106798,7 @@ async function run26(argv, io) {
   ]);
 }
 var USAGE19 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync30(0, "utf8") : raw.startsWith("@") ? readFileSync30(path72.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync32(0, "utf8") : raw.startsWith("@") ? readFileSync32(path75.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -106626,7 +106814,7 @@ __export(exports_handoff, {
   run: () => run27
 });
 import fs37 from "node:fs";
-import path73 from "node:path";
+import path76 from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 function render3(brief) {
   const lines = [
@@ -106666,9 +106854,9 @@ function bounded(brief, cwd) {
   let file = null;
   if (store.ok)
     try {
-      const dir = path73.join(store.value.root, "handoff");
+      const dir = path76.join(store.value.root, "handoff");
       fs37.mkdirSync(dir, { recursive: true });
-      file = path73.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
+      file = path76.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
       fs37.writeFileSync(file, `${[...body, ...tail].join(`
 `)}
 `, {
@@ -106745,7 +106933,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_host_session();
 init_package();
-import path74 from "node:path";
+import path77 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -107657,7 +107845,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path74.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path77.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail2("invalid_input", parsed.error));