@brainervirus/workit-cli 0.8.0 → 0.8.2

package/dist/index.js

@@ -42527,6 +42527,22 @@ var readConfigFromDir = (dir) => {
     throw new Error(result2.error);
   return result2.config ?? DEFAULTS;
 };
+var resolveBranchPolicy = (config, workspace) => {
+  const wp = workspace?.branchPolicy ?? {};
+  const preset = Object.hasOwn(PRESETS, wp.preset) ? wp.preset : config.branchPolicy?.preset ?? "gitflow";
+  const merged = mergePreset(preset, {
+    allowed: wp.allowed,
+    protectedNames: wp.protected
+  }, config);
+  const allowed = merged.allowed.map((p) => new RegExp(`^${p.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"));
+  return {
+    preset,
+    allowed,
+    protected: new Set(merged.protected.map((p) => p.toLowerCase())),
+    integration: wp.integration === "merge" ? "merge" : "pr",
+    defaultTargetBranch: preset === "github-flow" ? "main" : preset === "trunk-based" ? "master" : "develop"
+  };
+};
 
 // packages/workit-core/src/core/workspaces.ts
 import { readFileSync as readFileSync3, realpathSync } from "node:fs";
@@ -42650,6 +42666,7 @@ var resolveWorkspaceFrom = (cwd2, dir) => {
   }
   return null;
 };
+var resolveWorkspace = (cwd2) => resolveWorkspaceFrom(cwd2, configDir());
 
 // packages/workit-core/src/core/gitignore.ts
 var GITIGNORE_ENTRIES = [
@@ -42671,6 +42688,10 @@ var GITIGNORE_ENTRIES = [
 
 // packages/workit-core/src/core/hygiene.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
+import path5 from "node:path";
+
+// packages/workit-core/src/core/changelog.ts
+import fs3 from "node:fs";
 import path4 from "node:path";
 
 // packages/workit-core/src/core/package-root.ts
@@ -42695,26 +42716,49 @@ var assetRoot = () => {
 // packages/workit-core/src/core/scripts.ts
 var PLUGIN_ROOT = packageRoot();
 var ASSET_ROOT = assetRoot();
+var resolveWorkspaceRoot = (explicit) => explicit || process.cwd();
+
+// packages/workit-core/src/core/changelog.ts
+function changelogUnreleasedStats(workspace_root, changelogPath = "CHANGELOG.md") {
+  const cwd2 = resolveWorkspaceRoot(workspace_root);
+  const abs = path4.isAbsolute(changelogPath) ? changelogPath : path4.join(cwd2, changelogPath);
+  if (!fs3.existsSync(abs))
+    return { exists: false };
+  const text = fs3.readFileSync(abs, "utf8");
+  const m = text.match(/##\s+\[Unreleased\]([\s\S]*?)(?=\n##\s+\[|$)/i);
+  if (!m)
+    return { exists: true, has_unreleased: false };
+  const body = m[1];
+  const headings = [...body.matchAll(/^###\s+(\w+)\s*$/gim)].map((x) => x[1]);
+  const dupes = headings.filter((h, i) => headings.slice(0, i).some((p) => p.toLowerCase() === h.toLowerCase()));
+  return {
+    exists: true,
+    has_unreleased: true,
+    category_headings: headings,
+    duplicate_category_headings: dupes,
+    needs_normalize: dupes.length > 0
+  };
+}
 
 // packages/workit-core/src/core/hygiene.ts
 var repoRoot = assetRoot();
-var templatesDir = () => path4.join(repoRoot, "templates", "hygiene");
+var templatesDir = () => path5.join(repoRoot, "templates", "hygiene");
 var packageJson = (root) => {
-  if (!existsSync4(path4.join(root, "package.json")))
+  if (!existsSync4(path5.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync4(path4.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync4(path5.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
 };
 var isOpenSource = (root) => {
-  if (existsSync4(path4.join(root, "LICENSE")))
+  if (existsSync4(path5.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
     return true;
-  return path4.basename(root) === "workflow-toolkit";
+  return path5.basename(root) === "workflow-toolkit";
 };
 var licenseHolder = (root) => {
   const pkg = packageJson(root);
@@ -42730,6 +42774,34 @@ var licenseHolder = (root) => {
   }
   return "";
 };
+var hygieneFiles = (root) => {
+  const openSource = isOpenSource(root);
+  const state = {};
+  for (const file of [
+    "CHANGELOG.md",
+    "README.md",
+    ".editorconfig",
+    ".gitattributes",
+    "LICENSE",
+    "CONTRIBUTING.md"
+  ]) {
+    if (file === "LICENSE" || file === "CONTRIBUTING.md") {
+      state[file] = openSource ? existsSync4(path5.join(root, file)) ? "ok" : "missing" : "skip";
+      continue;
+    }
+    if (!existsSync4(path5.join(root, file))) {
+      state[file] = "missing";
+      continue;
+    }
+    if (file === "CHANGELOG.md") {
+      const stats = changelogUnreleasedStats(root);
+      state[file] = stats.exists && stats.has_unreleased ? "ok" : "invalid";
+      continue;
+    }
+    state[file] = "ok";
+  }
+  return { state, openSource };
+};
 var planHygieneFiles = (root, opts = {}) => {
   const openSource = opts.includeOpenSource ?? isOpenSource(root);
   const files = ["CHANGELOG.md", "README.md", ".editorconfig", ".gitattributes"];
@@ -42737,13 +42809,13 @@ var planHygieneFiles = (root, opts = {}) => {
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync4(path4.join(root, file)))
+    if (existsSync4(path5.join(root, file)))
       continue;
-    const tpl = path4.join(templatesDir(), file);
+    const tpl = path5.join(templatesDir(), file);
     if (!existsSync4(tpl))
       continue;
-    const content = readFileSync4(tpl, "utf8").replace(/<PROJECT>/g, path4.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
-    planned.push({ path: path4.join(root, file), content });
+    const content = readFileSync4(tpl, "utf8").replace(/<PROJECT>/g, path5.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    planned.push({ path: path5.join(root, file), content });
   }
   return planned;
 };
@@ -42776,7 +42848,7 @@ import {
   writeFileSync as writeFileSync5
 } from "node:fs";
 import os5 from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
 
 // packages/workit-core/src/core/branch-policy.ts
@@ -42841,9 +42913,9 @@ var detectBranchPolicy = (workspaceRoot) => {
 
 // packages/workit-core/src/core/setup-state.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 var classifySetupFile = (dir, name) => {
-  const file = path5.join(dir, name);
+  const file = path6.join(dir, name);
   let raw;
   try {
     raw = readFileSync5(file, "utf8");
@@ -42872,7 +42944,7 @@ var readSetupState = (dir = resolveConfigDir()) => ({
 });
 
 // packages/workit-core/src/core/registration.ts
-import path6 from "node:path";
+import path7 from "node:path";
 var isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 var named = (s, name) => s === name || s.startsWith(`${name}@`);
 function isWorkitPlugin(value) {
@@ -42918,11 +42990,11 @@ function mergeCursorEnabledPlugins(enabled) {
 }
 function mergeCursorPluginDirs(pluginDirs, pluginDir) {
   const strip = (p) => {
-    const j = path6.join(p);
-    return path6.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
+    const j = path7.join(p);
+    return path7.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
   };
   const normalized = strip(pluginDir);
-  const legacy = strip(path6.join(path6.dirname(pluginDir), "workflow-toolkit"));
+  const legacy = strip(path7.join(path7.dirname(pluginDir), "workflow-toolkit"));
   const prev = Array.isArray(pluginDirs) ? pluginDirs.map(String) : [];
   const kept = prev.filter((d) => strip(d) !== legacy);
   const exists = kept.some((d) => strip(d) === normalized);
@@ -42954,15 +43026,17 @@ function mergeCursorMcp(mcp, serverName, server) {
   base2.mcpServers = servers;
   return { config: base2, changed };
 }
+var CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@0.8.0";
 function cursorMcpServerEntry(_packageDir) {
   return {
     command: "npx",
-    args: [
-      "-y",
-      "--package=@brainervirus/workit-cursor@latest",
-      "workit-cursor-mcp",
-      "${workspaceFolder}"
-    ]
+    args: ["-y", `--package=${CURSOR_RUNTIME_PACKAGE}`, "workit-cursor-mcp", "${workspaceFolder}"]
+  };
+}
+function cursorHooksEntry(_packageDir) {
+  return {
+    command: `npx -y --package=${CURSOR_RUNTIME_PACKAGE} workit-cursor-session-start`,
+    args: []
   };
 }
 
@@ -42970,7 +43044,7 @@ function cursorMcpServerEntry(_packageDir) {
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync7, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync4 } from "node:fs";
 import os4 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // packages/workit-core/src/core/support-matrix.ts
 var SUPPORT_MATRIX = {
@@ -42982,7 +43056,7 @@ var SUPPORT_MATRIX = {
 
 // packages/workit-core/src/core/skill-manifests.ts
 import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 var CANONICAL_SKILLS = {
   superpowers: [
     "brainstorming",
@@ -43015,7 +43089,7 @@ var CANONICAL_SKILLS = {
     "wk-verify"
   ]
 };
-var skillManifestNames = (root) => existsSync6(root) ? readdirSync2(root).filter((name) => existsSync6(path7.join(root, name, "SKILL.md"))).sort() : [];
+var skillManifestNames = (root) => existsSync6(root) ? readdirSync2(root).filter((name) => existsSync6(path8.join(root, name, "SKILL.md"))).sort() : [];
 var validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
   const missing = expected.filter((name) => !actual.includes(name));
@@ -43023,10 +43097,10 @@ var validateSkillManifests = (root, expected, label) => {
   return missing.length === 0 && extra.length === 0 ? null : `${label} mismatch at ${root} (missing: ${missing.join(", ") || "none"}; extra: ${extra.join(", ") || "none"})`;
 };
 var validateCursorSkills = (pluginDir) => {
-  const workit = validateSkillManifests(path7.join(pluginDir, "skills"), CANONICAL_SKILLS.workit, "Cursor Workit skills");
+  const workit = validateSkillManifests(path8.join(pluginDir, "skills"), CANONICAL_SKILLS.workit, "Cursor Workit skills");
   if (workit)
     return workit;
-  const vendor = path7.join(pluginDir, "vendor/superpowers/skills");
+  const vendor = path8.join(pluginDir, "vendor/superpowers/skills");
   const superpowers = validateSkillManifests(vendor, CANONICAL_SKILLS.superpowers, "Cursor Superpowers skills");
   if (superpowers)
     return superpowers;
@@ -43034,7 +43108,7 @@ var validateCursorSkills = (pluginDir) => {
   while (pending.length > 0) {
     const dir = pending.pop();
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-      const file = path7.join(dir, entry.name);
+      const file = path8.join(dir, entry.name);
       if (entry.isDirectory())
         pending.push(file);
       else if ((statSync(file).mode & 73) !== 0 || readFileSync6(file).subarray(0, 2).toString("latin1") === "#!") {
@@ -43049,11 +43123,11 @@ if (false) {}
 // packages/workit-core/src/core/doctor.ts
 var TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE";
 var findDevFromCwd = (cwd2) => {
-  let dir = path8.resolve(cwd2);
+  let dir = path9.resolve(cwd2);
   while (true) {
-    if (existsSync7(path8.join(dir, "packages", "workit-core", "package.json")))
+    if (existsSync7(path9.join(dir, "packages", "workit-core", "package.json")))
       return dir;
-    const parent = path8.dirname(dir);
+    const parent = path9.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -43062,8 +43136,8 @@ var findDevFromCwd = (cwd2) => {
 var resolve = (options) => {
   const env3 = options.env ?? process.env;
   const home = options.home ?? env3.HOME ?? os4.homedir();
-  const configDir2 = options.configDir ?? env3.WORKFLOW_TOOLKIT_CONFIG ?? env3.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path8.join(home, ".config", "workit");
-  const stateDir = options.stateDir ?? env3.WORKFLOW_TOOLKIT_STATE ?? path8.join(home, ".local", "state", "workit");
+  const configDir2 = options.configDir ?? env3.WORKFLOW_TOOLKIT_CONFIG ?? env3.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path9.join(home, ".config", "workit");
+  const stateDir = options.stateDir ?? env3.WORKFLOW_TOOLKIT_STATE ?? path9.join(home, ".local", "state", "workit");
   const cwd2 = options.cwd ?? process.cwd();
   const dev = options.dev ?? env3.WORKFLOW_TOOLKIT_DEV ?? findDevFromCwd(cwd2);
   return {
@@ -43073,10 +43147,10 @@ var resolve = (options) => {
     stateDir,
     cwd: cwd2,
     dev,
-    opencodeConfig: options.opencodeConfig ?? path8.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path8.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path8.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path8.join(home, ".cursor", "plugins", "local", "workit"),
+    opencodeConfig: options.opencodeConfig ?? path9.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path9.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path9.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path9.join(home, ".cursor", "plugins", "local", "workit"),
     env: env3,
     installer: options.installer ?? false
   };
@@ -43102,13 +43176,13 @@ var pluginEntries = (cfg) => {
   return list.map(String).filter(isWorkitPlugin);
 };
 var commandOnPath = (name, env3) => {
-  const dirs = (env3.PATH ?? process.env.PATH ?? "").split(path8.delimiter);
+  const dirs = (env3.PATH ?? process.env.PATH ?? "").split(path9.delimiter);
   const names = process.platform === "win32" ? [name, `${name}.exe`] : [name];
   for (const dir of dirs) {
     if (!dir)
       continue;
     for (const candidateName of names) {
-      const candidate = path8.join(dir, candidateName);
+      const candidate = path9.join(dir, candidateName);
       try {
         const st = statSync2(candidate);
         if (process.platform !== "win32" && (st.mode & 73) === 0)
@@ -43140,7 +43214,7 @@ var resolveBun = (env3) => {
   if (env3.BUN && existsSync7(env3.BUN))
     return env3.BUN;
   for (const candidate of [
-    path8.join(os4.homedir(), ".bun/bin/bun"),
+    path9.join(os4.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
@@ -43194,7 +43268,7 @@ var checkVersions = (res) => {
       detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping version parity"
     };
   }
-  const corePkg = readJson(path8.join(res.dev, "packages/workit-core/package.json"));
+  const corePkg = readJson(path9.join(res.dev, "packages/workit-core/package.json"));
   if (!corePkg) {
     return {
       id: "versions",
@@ -43204,7 +43278,7 @@ var checkVersions = (res) => {
   }
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
-    const pkg = readJson(path8.join(res.dev, "packages", name, "package.json"));
+    const pkg = readJson(path9.join(res.dev, "packages", name, "package.json"));
     const dep = pkg?.dependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
@@ -43220,7 +43294,7 @@ var checkVersions = (res) => {
   if (refs.size > 1) {
     problems.push(`adapters pin different core versions: ${[...refs].join(", ")}`);
   }
-  const opencodePkg = readJson(path8.join(res.dev, "packages/workit-opencode/package.json"));
+  const opencodePkg = readJson(path9.join(res.dev, "packages/workit-opencode/package.json"));
   const sdk = opencodePkg?.dependencies?.["@opencode-ai/plugin"];
   const sdkVersion = typeof sdk === "string" ? (sdk.match(/^\d+(?:\.\d+){0,2}/) ?? [])[0] : null;
   if (sdkVersion && !semverAtLeast(sdkVersion, SUPPORT_MATRIX.opencode.minimum)) {
@@ -43241,23 +43315,23 @@ var checkVersions = (res) => {
   };
 };
 var assetPathsFor = (host, dev) => {
-  const pkg = path8.join(dev, "packages", `workit-${host}`);
+  const pkg = path9.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
       return [
-        path8.join(pkg, "assets", "commands", "wk-init.md"),
-        path8.join(pkg, "assets", "skills", "wk-init", "SKILL.md"),
-        path8.join(pkg, "assets", "templates", "spec-template.md"),
-        path8.join(pkg, "assets", "vendor", "superpowers", "skills", "brainstorming", "SKILL.md")
+        path9.join(pkg, "assets", "commands", "wk-init.md"),
+        path9.join(pkg, "assets", "skills", "wk-init", "SKILL.md"),
+        path9.join(pkg, "assets", "templates", "spec-template.md"),
+        path9.join(pkg, "assets", "vendor", "superpowers", "skills", "brainstorming", "SKILL.md")
       ];
     case "cursor":
       return [
-        path8.join(pkg, "assets", "templates", "spec-template.md"),
-        path8.join(pkg, "mcp.json"),
-        path8.join(pkg, ".cursor-plugin")
+        path9.join(pkg, "assets", "templates", "spec-template.md"),
+        path9.join(pkg, "mcp.json"),
+        path9.join(pkg, ".cursor-plugin")
       ];
     case "cli":
-      return [path8.join(pkg, "assets", "templates", "spec-template.md")];
+      return [path9.join(pkg, "assets", "templates", "spec-template.md")];
   }
 };
 var hostsFor = (host) => host === "cli" ? ["opencode", "cursor", "cli"] : [host];
@@ -43291,17 +43365,17 @@ var checkAssets = (res) => {
   };
 };
 var launcherSlotsFor = (host, dev) => {
-  const pkg = path8.join(dev, "packages", `workit-${host}`);
+  const pkg = path9.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
-      return [[path8.join(pkg, "src", "plugin.ts"), path8.join(pkg, "dist", "plugin.js")]];
+      return [[path9.join(pkg, "src", "plugin.ts"), path9.join(pkg, "dist", "plugin.js")]];
     case "cursor":
       return [
-        [path8.join(pkg, "dist", "mcp-server.js")],
-        [path8.join(pkg, "dist", "cursor-session-start.js")]
+        [path9.join(pkg, "dist", "mcp-server.js")],
+        [path9.join(pkg, "dist", "cursor-session-start.js")]
       ];
     case "cli":
-      return [[path8.join(pkg, "src", "index.tsx"), path8.join(pkg, "dist", "index.js")]];
+      return [[path9.join(pkg, "src", "index.tsx"), path9.join(pkg, "dist", "index.js")]];
   }
 };
 var validNodeEntry = (entry, runtime, env3) => {
@@ -43330,11 +43404,11 @@ var registeredCursorLauncher = (res) => {
   if (typeof command !== "string" || !Array.isArray(args) || typeof args[0] !== "string") {
     return "invalid";
   }
-  const executable = path8.basename(command).toLowerCase();
+  const executable = path9.basename(command).toLowerCase();
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args[0] !== "-y")
       return "invalid";
-    if (args[1] !== "--package=@brainervirus/workit-cursor@latest")
+    if (args[1] !== `--package=${CURSOR_RUNTIME_PACKAGE}`)
       return "invalid";
     if (args[2] !== "workit-cursor-mcp")
       return "invalid";
@@ -43345,21 +43419,43 @@ var registeredCursorLauncher = (res) => {
   return {
     kind: "node",
     runtime: command,
-    entry: path8.isAbsolute(args[0]) ? args[0] : path8.resolve(path8.dirname(res.cursorMcp), args[0])
+    entry: path9.isAbsolute(args[0]) ? args[0] : path9.resolve(path9.dirname(res.cursorMcp), args[0])
   };
 };
+var canonicalCursorHook = cursorHooksEntry("").command;
+var registeredCursorHook = (res) => {
+  const hooksFile = path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  if (!existsSync7(hooksFile))
+    return "invalid";
+  const config = readJson(hooksFile);
+  if (!config)
+    return "invalid";
+  const sessionStart = config.hooks?.sessionStart;
+  if (!Array.isArray(sessionStart) || sessionStart.length !== 1)
+    return "invalid";
+  const entry = sessionStart[0];
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+    return "invalid";
+  return typeof entry.command === "string" ? entry.command : "invalid";
+};
 var checkLauncher = (res) => {
   const dev = res.dev;
   const hosts = hostsFor(res.host);
   const registered = hosts.includes("cursor") ? registeredCursorLauncher(res) : null;
   const runtime = registered && registered !== "invalid" && registered.kind === "node" ? registered.runtime : "node";
-  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path8.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
+  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path9.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
   if (hosts.includes("cursor")) {
     if (registered === "invalid") {
       missing.push(`cursor: canonical workit MCP launcher in ${res.cursorMcp}`);
     } else if (registered && registered.kind === "node" && !validNodeEntry(registered.entry, registered.runtime, res.env)) {
       missing.push(`cursor: registered ${registered.entry}`);
     }
+    const hook = registeredCursorHook(res);
+    if (hook === "invalid") {
+      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
+    } else if (hook !== null && hook !== canonicalCursorHook) {
+      missing.push(`cursor: canonical session-start hook in ${path9.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
+    }
   }
   if (dev) {
     missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync7(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
@@ -43499,7 +43595,7 @@ var checkDuplicateRegistration = (res) => {
 var checkMalformedConfig = (res) => {
   const files = [];
   for (const name of ["config.json", "youtrack.json", "vcs.json", "workspaces.json"]) {
-    const p = path8.join(res.configDir, name);
+    const p = path9.join(res.configDir, name);
     if (existsSync7(p))
       files.push(p);
   }
@@ -43522,7 +43618,7 @@ var checkMalformedConfig = (res) => {
   };
 };
 var checkWorkspaceMismatch = (res) => {
-  const file = path8.join(res.configDir, "workspaces.json");
+  const file = path9.join(res.configDir, "workspaces.json");
   if (!existsSync7(file))
     return { id: "workspace_mismatch", status: "pass", detail: "no workspaces configured" };
   const ws = readJson(file);
@@ -43552,20 +43648,20 @@ var isPlaceholder = (p) => {
 };
 var checkCredentialMetadata = (res) => {
   const tokenPaths = [];
-  const youtrackJson = readJson(path8.join(res.configDir, "youtrack.json"));
+  const youtrackJson = readJson(path9.join(res.configDir, "youtrack.json"));
   if (youtrackJson) {
-    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path8.join(res.configDir, "youtrack.token"));
-  } else if (existsSync7(path8.join(res.configDir, "youtrack.token"))) {
-    tokenPaths.push(path8.join(res.configDir, "youtrack.token"));
+    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path9.join(res.configDir, "youtrack.token"));
+  } else if (existsSync7(path9.join(res.configDir, "youtrack.token"))) {
+    tokenPaths.push(path9.join(res.configDir, "youtrack.token"));
   }
-  const vcsJson = readJson(path8.join(res.configDir, "vcs.json"));
+  const vcsJson = readJson(path9.join(res.configDir, "vcs.json"));
   for (const key of ["gitlab", "github"]) {
     const provider = vcsJson?.[key];
     if (provider && typeof provider === "object") {
       const tf = provider.tokenFile;
-      tokenPaths.push(typeof tf === "string" ? tf : path8.join(res.configDir, `${key}.token`));
-    } else if (!vcsJson && existsSync7(path8.join(res.configDir, `${key}.token`))) {
-      tokenPaths.push(path8.join(res.configDir, `${key}.token`));
+      tokenPaths.push(typeof tf === "string" ? tf : path9.join(res.configDir, `${key}.token`));
+    } else if (!vcsJson && existsSync7(path9.join(res.configDir, `${key}.token`))) {
+      tokenPaths.push(path9.join(res.configDir, `${key}.token`));
     }
   }
   if (tokenPaths.length === 0) {
@@ -43573,7 +43669,7 @@ var checkCredentialMetadata = (res) => {
   }
   const problems = [];
   for (const raw of tokenPaths) {
-    const p = path8.isAbsolute(raw) ? raw : path8.resolve(res.configDir, raw);
+    const p = path9.isAbsolute(raw) ? raw : path9.resolve(res.configDir, raw);
     if (!existsSync7(p)) {
       problems.push(`${p} is missing`);
       continue;
@@ -43601,8 +43697,8 @@ var checkCredentialMetadata = (res) => {
   };
 };
 var checkLogWritable = (res) => {
-  const logsDir = path8.join(res.stateDir, "logs");
-  const probe = path8.join(logsDir, "doctor-probe.tmp");
+  const logsDir = path9.join(res.stateDir, "logs");
+  const probe = path9.join(logsDir, "doctor-probe.tmp");
   try {
     mkdirSync2(logsDir, { recursive: true, mode: 448 });
     writeFileSync4(probe, `{"probe":true}
@@ -43790,7 +43886,7 @@ function buildSetupPreview(values2, opts = {}) {
     const current = readConfigFromDir(state.configDir);
     mutations.push({
       type: "merge-json",
-      path: path9.join(state.configDir, "config.json"),
+      path: path10.join(state.configDir, "config.json"),
       value: {
         locale: values2.locale,
         localeOptions: current.localeOptions,
@@ -43815,16 +43911,16 @@ function buildSetupPreview(values2, opts = {}) {
       if (blocked.length === 0) {
         mutations.push({
           type: "update-workspaces",
-          path: path9.join(state.configDir, "workspaces.json"),
+          path: path10.join(state.configDir, "workspaces.json"),
           entries: values2.workspaces
         });
       }
     }
     if (values2.baseUrl.trim()) {
-      const ytPath = path9.join(state.configDir, "youtrack.json");
+      const ytPath = path10.join(state.configDir, "youtrack.json");
       const ytExisting = readConfigRecord(ytPath);
       const ytConfigured = configuredTokenPath(ytExisting, "tokenFile");
-      const tokenPath = resolveTokenPath(ytConfigured, path9.join(state.configDir, "youtrack.token"), values2.tokenPaths?.youtrack);
+      const tokenPath = resolveTokenPath(ytConfigured, path10.join(state.configDir, "youtrack.token"), values2.tokenPaths?.youtrack);
       const draft = youtrackDraft(values2, tokenPath);
       if (ytConfigured !== null && tokenPath !== ytConfigured) {
         delete draft.tokenFile;
@@ -43852,12 +43948,12 @@ function buildSetupPreview(values2, opts = {}) {
         });
     }
     if (values2.vcsProvider !== "skip") {
-      const vcsPath = path9.join(state.configDir, "vcs.json");
+      const vcsPath = path10.join(state.configDir, "vcs.json");
       const vcsExisting = readConfigRecord(vcsPath);
       const glConfigured = configuredTokenPath(vcsExisting, "gitlab", "tokenFile");
       const ghConfigured = configuredTokenPath(vcsExisting, "github", "tokenFile");
-      const gitlabToken = resolveTokenPath(glConfigured, path9.join(state.configDir, "gitlab.token"), values2.tokenPaths?.gitlab);
-      const githubToken = resolveTokenPath(ghConfigured, path9.join(state.configDir, "github.token"), values2.tokenPaths?.github);
+      const gitlabToken = resolveTokenPath(glConfigured, path10.join(state.configDir, "gitlab.token"), values2.tokenPaths?.gitlab);
+      const githubToken = resolveTokenPath(ghConfigured, path10.join(state.configDir, "github.token"), values2.tokenPaths?.github);
       const draft = vcsDraft(values2.vcsProvider, gitlabToken, githubToken);
       for (const [configured, token, key] of [
         [glConfigured, gitlabToken, "gitlab.tokenFile"],
@@ -43904,8 +44000,8 @@ function buildSetupPreview(values2, opts = {}) {
       }
     }
     if (values2.applyProject) {
-      const root = path9.resolve(opts.cwd ?? process.cwd());
-      const gitignorePath = path9.join(root, ".gitignore");
+      const root = path10.resolve(opts.cwd ?? process.cwd());
+      const gitignorePath = path10.join(root, ".gitignore");
       const existing = existsSync8(gitignorePath) ? readFileSync8(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
@@ -43934,10 +44030,10 @@ var resolveSetupPaths = (options, configDir2) => {
     configDir: configDir2,
     cwd: options.cwd ?? process.cwd(),
     env: env3,
-    opencodeConfig: options.opencodeConfig ?? path9.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path9.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path9.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path9.join(home, ".cursor", "plugins", "local", "workit")
+    opencodeConfig: options.opencodeConfig ?? path10.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path10.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path10.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path10.join(home, ".cursor", "plugins", "local", "workit")
   };
 };
 function resolveApply(preview, options) {
@@ -43983,7 +44079,7 @@ var readFileSafe = (p) => {
   }
 };
 function applyMutation(m) {
-  const dir = path9.dirname(m.path);
+  const dir = path10.dirname(m.path);
   switch (m.type) {
     case "create-file": {
       mkdirSync3(dir, { recursive: true });
@@ -44087,7 +44183,7 @@ function applyMutation(m) {
           detail: "already configured"
         };
       }
-      mkdirSync3(path9.dirname(m.path), { recursive: true });
+      mkdirSync3(path10.dirname(m.path), { recursive: true });
       writeFileSync5(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
@@ -44096,7 +44192,7 @@ function applyMutation(m) {
 }
 var isAdapter = (root, platform2) => {
   try {
-    const pkg = JSON.parse(readFileSync8(path9.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync8(path10.join(root, "package.json"), "utf8"));
     return pkg.name === `@brainervirus/workit-${platform2}`;
   } catch {
     return false;
@@ -44105,19 +44201,19 @@ var isAdapter = (root, platform2) => {
 function adapterRoot(platform2, res) {
   const candidates = [];
   if (res.dev) {
-    candidates.push(path9.join(res.dev, "packages", `workit-${platform2}`));
+    candidates.push(path10.join(res.dev, "packages", `workit-${platform2}`));
   } else {
-    candidates.push(path9.join(packageRoot(), "..", `workit-${platform2}`));
-    let dir = path9.resolve(res.cwd);
+    candidates.push(path10.join(packageRoot(), "..", `workit-${platform2}`));
+    let dir = path10.resolve(res.cwd);
     while (true) {
-      candidates.push(path9.join(dir, "packages", `workit-${platform2}`));
-      const parent = path9.dirname(dir);
+      candidates.push(path10.join(dir, "packages", `workit-${platform2}`));
+      const parent = path10.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
     }
   }
-  candidates.push(path9.join(res.home, ".local", "share", "workflow-toolkit", "packages", `workit-${platform2}`));
+  candidates.push(path10.join(res.home, ".local", "share", "workflow-toolkit", "packages", `workit-${platform2}`));
   for (const candidate of candidates) {
     if (isAdapter(candidate, platform2))
       return candidate;
@@ -44126,7 +44222,7 @@ function adapterRoot(platform2, res) {
 }
 var opencodePin = (root) => {
   for (const rel of ["src/plugin.ts", "dist/plugin.js"]) {
-    const entry = path9.join(root, rel);
+    const entry = path10.join(root, rel);
     if (existsSync8(entry))
       return `file://${entry}`;
   }
@@ -44142,7 +44238,7 @@ function applyOpenCode(root, res) {
       detail: "workit-opencode package has no loadable plugin entry (src/plugin.ts or dist/plugin.js)"
     };
   }
-  mkdirSync3(path9.dirname(res.opencodeConfig), { recursive: true });
+  mkdirSync3(path10.dirname(res.opencodeConfig), { recursive: true });
   const existing = readExisting(res.opencodeConfig);
   if (existing.kind === "malformed") {
     return {
@@ -44180,19 +44276,19 @@ var samePluginContent = (src, dest, relative = "") => {
     for (const entry of readdirSync3(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
-      const source = path9.join(src, entry.name);
-      const installed = path9.join(dest, entry.name);
+      const source = path10.join(src, entry.name);
+      const installed = path10.join(dest, entry.name);
       if (entry.isDirectory()) {
-        if (!statSync3(installed).isDirectory() || !samePluginContent(source, installed, path9.join(relative, entry.name)))
+        if (!statSync3(installed).isDirectory() || !samePluginContent(source, installed, path10.join(relative, entry.name)))
           return false;
       } else if (!readFileSync8(source).equals(readFileSync8(installed))) {
         return false;
       }
     }
     for (const entry of readdirSync3(dest, { withFileTypes: true })) {
-      if (existsSync8(path9.join(src, entry.name)))
+      if (existsSync8(path10.join(src, entry.name)))
         continue;
-      const rel = path9.join(relative, entry.name);
+      const rel = path10.join(relative, entry.name);
       if (rel === ".workflow-toolkit-root")
         continue;
       if (relative === "rules" && entry.isFile() && entry.name.endsWith(".mdc"))
@@ -44206,41 +44302,41 @@ var samePluginContent = (src, dest, relative = "") => {
 };
 var preservedCursorRules = (src, dest) => {
   const preserved = new Map;
-  const sourceRules = path9.join(src, "rules");
-  const installedRules = path9.join(dest, "rules");
+  const sourceRules = path10.join(src, "rules");
+  const installedRules = path10.join(dest, "rules");
   try {
     for (const entry of readdirSync3(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
-      if (existsSync8(path9.join(sourceRules, entry.name)))
+      if (existsSync8(path10.join(sourceRules, entry.name)))
         continue;
-      preserved.set(entry.name, readFileSync8(path9.join(installedRules, entry.name)));
+      preserved.set(entry.name, readFileSync8(path10.join(installedRules, entry.name)));
     }
   } catch {}
   return preserved;
 };
 function copyPluginDir(src, dest) {
-  const marker = path9.join(dest, ".workflow-toolkit-root");
+  const marker = path10.join(dest, ".workflow-toolkit-root");
   const synced = readFileSafe(marker)?.trim() === src && samePluginContent(src, dest);
   if (synced)
     return "Skipped";
   const hadDir = existsSync8(dest);
   const rules = preservedCursorRules(src, dest);
-  const parent = path9.dirname(dest);
+  const parent = path10.dirname(dest);
   mkdirSync3(parent, { recursive: true });
-  const swap = mkdtempSync(path9.join(parent, `.${path9.basename(dest)}.swap-`));
-  const stage = path9.join(swap, "stage");
-  const backup = path9.join(swap, "backup");
+  const swap = mkdtempSync(path10.join(parent, `.${path10.basename(dest)}.swap-`));
+  const stage = path10.join(swap, "stage");
+  const backup = path10.join(swap, "backup");
   try {
     cpSync2(src, stage, {
       recursive: true,
-      filter: (entry) => !path9.relative(src, entry).split(path9.sep).includes("node_modules")
+      filter: (entry) => !path10.relative(src, entry).split(path10.sep).includes("node_modules")
     });
     for (const [name, content] of rules) {
-      mkdirSync3(path9.join(stage, "rules"), { recursive: true });
-      writeFileSync5(path9.join(stage, "rules", name), content);
+      mkdirSync3(path10.join(stage, "rules"), { recursive: true });
+      writeFileSync5(path10.join(stage, "rules", name), content);
     }
-    writeFileSync5(path9.join(stage, ".workflow-toolkit-root"), src + `
+    writeFileSync5(path10.join(stage, ".workflow-toolkit-root"), src + `
 `, "utf8");
     if (!samePluginContent(src, stage))
       throw new Error("staged adapter content is incomplete");
@@ -44260,26 +44356,26 @@ function copyPluginDir(src, dest) {
   return hadDir ? "Configured" : "Installed";
 }
 var removeLegacyCursorDir = (res) => {
-  const legacy = path9.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
+  const legacy = path10.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
   if (legacy === res.cursorPluginDir || !existsSync8(legacy))
     return;
-  const legacyRules = path9.join(legacy, "rules");
+  const legacyRules = path10.join(legacy, "rules");
   if (existsSync8(legacyRules)) {
     try {
-      mkdirSync3(path9.join(res.cursorPluginDir, "rules"), { recursive: true });
+      mkdirSync3(path10.join(res.cursorPluginDir, "rules"), { recursive: true });
       for (const entry of readdirSync3(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
-        const target = path9.join(res.cursorPluginDir, "rules", entry.name);
+        const target = path10.join(res.cursorPluginDir, "rules", entry.name);
         if (!existsSync8(target))
-          copyFileSync2(path9.join(legacyRules, entry.name), target);
+          copyFileSync2(path10.join(legacyRules, entry.name), target);
       }
     } catch {}
   }
   rmSync(legacy, { recursive: true, force: true });
 };
 function applyCursorSettings(root, res) {
-  mkdirSync3(path9.dirname(res.cursorSettings), { recursive: true });
+  mkdirSync3(path10.dirname(res.cursorSettings), { recursive: true });
   const settingsExisting = readExisting(res.cursorSettings);
   if (settingsExisting.kind === "malformed") {
     return {
@@ -44307,7 +44403,7 @@ function applyCursorSettings(root, res) {
   };
 }
 function applyCursorMcp(root, res) {
-  mkdirSync3(path9.dirname(res.cursorMcp), { recursive: true });
+  mkdirSync3(path10.dirname(res.cursorMcp), { recursive: true });
   const mcpExisting = readExisting(res.cursorMcp);
   if (mcpExisting.kind === "malformed") {
     return {
@@ -44496,12 +44592,12 @@ var setupCompletionGuidance = () => [
 ];
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env: env3 = process.env } = opts;
-  const dir = path9.join(env3.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path10.join(env3.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const { status, path: wsPath, entries } = readWorkspacesResult(dir);
   if (status === "malformed")
     return { ok: false, error: `malformed workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env3.WORKFLOW_BP_NAME ?? path9.basename(workspace_root));
+  const name = String(env3.WORKFLOW_BP_NAME ?? path10.basename(workspace_root));
   const integration = env3.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -44526,7 +44622,7 @@ function applyWorkspaceBranchPolicy(opts) {
     };
   }
   const next = existing ? entries.map((w, i) => i === idx ? { ...w, branchPolicy: policy } : w) : [...entries, { name, glob, branchPolicy: policy }];
-  mkdirSync3(path9.dirname(wsPath), { recursive: true });
+  mkdirSync3(path10.dirname(wsPath), { recursive: true });
   writeFileSync5(wsPath, JSON.stringify({ workspaces: next }, null, 2) + `
 `, "utf8");
   return {
@@ -44584,7 +44680,7 @@ function applyWizardBranchPolicy(branchPolicy, workspace_root, env3 = process.en
 
 // packages/workit-cli/src/wizard-state.ts
 import { existsSync as existsSync9 } from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 var NEXT = {
   platforms: "locale",
@@ -44629,7 +44725,7 @@ var PREV = {
   exit: null
 };
 var skipsCustomBranch = (screen, preset) => (screen === "branchAllowed" || screen === "branchProtected") && preset !== "custom";
-var skipsBranchPolicy = (screen) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync9(path10.join(process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), ".git"));
+var skipsBranchPolicy = (screen) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync9(path11.join(process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), ".git"));
 function nextScreen(screen, preset) {
   let next = NEXT[screen];
   while (next && (skipsCustomBranch(next, preset) || skipsBranchPolicy(next)))
@@ -45935,7 +46031,7 @@ function Screen({ draft, dispatch }) {
 // packages/workit-core/src/core/logger.ts
 import { appendFileSync, mkdirSync as mkdirSync4, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
 import os6 from "node:os";
-import path11 from "node:path";
+import path12 from "node:path";
 var REDACTED = "[REDACTED]";
 var DEFAULT_MAX_RATE = 20;
 var DEFAULT_RATE_WINDOW_MS = 1000;
@@ -45991,14 +46087,14 @@ var resolveStateDir = () => {
     return override;
   const home = os6.homedir();
   if (process.env.XDG_STATE_HOME)
-    return path11.join(process.env.XDG_STATE_HOME, "workit");
+    return path12.join(process.env.XDG_STATE_HOME, "workit");
   switch (os6.platform()) {
     case "darwin":
-      return path11.join(home, "Library", "Application Support", "workit");
+      return path12.join(home, "Library", "Application Support", "workit");
     case "win32":
-      return path11.join(process.env.LOCALAPPDATA ?? path11.join(home, "AppData", "Local"), "workit");
+      return path12.join(process.env.LOCALAPPDATA ?? path12.join(home, "AppData", "Local"), "workit");
     default:
-      return path11.join(process.env.HOME ?? home, ".local", "state", "workit");
+      return path12.join(process.env.HOME ?? home, ".local", "state", "workit");
   }
 };
 var homePattern = new RegExp(`${escapeRegExp2(os6.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
@@ -46071,14 +46167,14 @@ var pruneOldFiles = (dir) => {
     const files = readdirSync4(dir).filter((name) => DAY_FILE.test(name)).sort().reverse();
     for (const file of files.slice(RETAINED_DAYS)) {
       try {
-        unlinkSync2(path11.join(dir, file));
+        unlinkSync2(path12.join(dir, file));
       } catch {}
     }
   } catch {}
 };
 var createLogger = (options = {}) => {
   const stateDir = options.stateDir ?? resolveStateDir();
-  const logDir = path11.join(stateDir, "logs");
+  const logDir = path12.join(stateDir, "logs");
   const now2 = options.now ?? (() => new Date);
   const maxRate = options.maxRate ?? DEFAULT_MAX_RATE;
   const rateWindowMs = options.rateWindowMs ?? DEFAULT_RATE_WINDOW_MS;
@@ -46112,7 +46208,7 @@ var createLogger = (options = {}) => {
       const line = `${JSON.stringify(event)}
 `;
       mkdirSync4(logDir, { recursive: true, mode: 448 });
-      appendFileSync(path11.join(logDir, dailyFileName(date)), line, { mode: 384 });
+      appendFileSync(path12.join(logDir, dailyFileName(date)), line, { mode: 384 });
       pruneOldFiles(logDir);
     } catch {
       try {
@@ -46123,7 +46219,7 @@ var createLogger = (options = {}) => {
           context: { redaction_failed: true }
         };
         mkdirSync4(logDir, { recursive: true, mode: 448 });
-        appendFileSync(path11.join(logDir, dailyFileName(date)), `${JSON.stringify(event)}
+        appendFileSync(path12.join(logDir, dailyFileName(date)), `${JSON.stringify(event)}
 `, {
           mode: 384
         });
@@ -46158,21 +46254,2152 @@ var createLogger = (options = {}) => {
   };
 };
 
-// packages/workit-cli/src/index.tsx
-var jsx_dev_runtime2 = __toESM(require_jsx_dev_runtime(), 1);
-var logger = createLogger({
-  stderr: (event) => {
-    if (event.level === "debug" || event.level === "info")
-      return;
-    process.stderr.write(`${JSON.stringify(event)}
-`);
+// packages/workit-cli/src/flow.ts
+import { createInterface } from "node:readline/promises";
+import path21 from "node:path";
+
+// packages/workit-core/src/core/flow-state.ts
+import {
+  closeSync,
+  existsSync as existsSync14,
+  fstatSync,
+  fsyncSync,
+  mkdirSync as mkdirSync8,
+  openSync,
+  readFileSync as readFileSync13,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync as statSync7,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync8
+} from "node:fs";
+import { createHash } from "node:crypto";
+import path18 from "node:path";
+
+// packages/workit-core/src/core/docs-validate.ts
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "node:fs";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import path14 from "node:path";
+
+// packages/workit-core/src/core/docs-layout.ts
+import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync5, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import path13 from "node:path";
+var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var LEGACY_SLUG = "superpowers";
+var posix = (p) => p.split(path13.sep).join("/");
+var canonicalize = (base2, candidate) => {
+  const abs = path13.resolve(base2, candidate);
+  let ancestor = abs;
+  while (!existsSync10(ancestor))
+    ancestor = path13.dirname(ancestor);
+  let real;
+  try {
+    real = realpathSync2(ancestor);
+  } catch (error) {
+    if (error.code === "EACCES" && !lstatSync(ancestor).isSymbolicLink()) {
+      real = path13.join(realpathSync2(path13.dirname(ancestor)), path13.basename(ancestor));
+    } else {
+      throw error;
+    }
+  }
+  if (real !== base2 && !real.startsWith(base2 + path13.sep)) {
+    throw new Error(`path must stay inside repository root: ${candidate}`);
+  }
+  return path13.join(real, path13.relative(ancestor, abs));
+};
+var buildLayout = (workspace, slug) => {
+  const docs = canonicalize(workspace, "docs");
+  const dir = canonicalize(workspace, path13.join(docs, slug));
+  return {
+    workspace,
+    slug,
+    docs,
+    dir,
+    spec: path13.join(dir, "spec.md"),
+    plan: path13.join(dir, "plan.md"),
+    sdd: path13.join(dir, "sdd")
+  };
+};
+var resolveCanonicalLayout = (input) => {
+  const { workspace_root, slug, spec_path, plan_path } = input;
+  if (!workspace_root)
+    return { ok: false, error: "workspace_root required" };
+  let workspace;
+  try {
+    workspace = realpathSync2(path13.resolve(workspace_root));
+  } catch {
+    return { ok: false, error: `workspace root not found: ${workspace_root}` };
+  }
+  let derived = null;
+  for (const [candidate, kind] of [
+    [spec_path, "spec"],
+    [plan_path, "plan"]
+  ]) {
+    if (!candidate)
+      continue;
+    if (path13.isAbsolute(candidate)) {
+      return { ok: false, error: `absolute path not allowed: ${candidate}` };
+    }
+    const spelling = posix(candidate);
+    const match = spelling.match(/^docs\/([^/]+)\/(spec|plan)\.md$/);
+    if (!match) {
+      return {
+        ok: false,
+        error: `path must be docs/<slug>/(spec|plan).md inside workspace_root: ${candidate}`
+      };
+    }
+    const pathSlug = match[1];
+    if (pathSlug === LEGACY_SLUG) {
+      return { ok: false, error: `legacy path not allowed: ${candidate}` };
+    }
+    if (!SLUG_RE.test(pathSlug)) {
+      return { ok: false, error: `invalid slug derived from path: ${JSON.stringify(pathSlug)}` };
+    }
+    if (match[2] !== kind) {
+      return {
+        ok: false,
+        error: `wrong basename for ${kind}: expected ${kind}.md, got ${path13.basename(candidate)}`
+      };
+    }
+    if (derived && derived !== pathSlug) {
+      return {
+        ok: false,
+        error: "cross-slug pair: spec_path and plan_path must share the same docs/<slug>/"
+      };
+    }
+    derived = pathSlug;
+    let abs;
+    try {
+      abs = canonicalize(workspace, candidate);
+    } catch (error) {
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+    if (posix(path13.relative(workspace, abs)) !== spelling) {
+      return {
+        ok: false,
+        error: `path must resolve to ${JSON.stringify(spelling)}: ${candidate}`
+      };
+    }
+  }
+  let resolvedSlug = slug;
+  if (resolvedSlug !== undefined) {
+    if (!SLUG_RE.test(resolvedSlug)) {
+      return { ok: false, error: `invalid slug: ${JSON.stringify(resolvedSlug)}` };
+    }
+    if (resolvedSlug === LEGACY_SLUG) {
+      return { ok: false, error: `reserved slug: ${LEGACY_SLUG}` };
+    }
+    if (derived && derived !== resolvedSlug) {
+      return {
+        ok: false,
+        error: `slug ${JSON.stringify(resolvedSlug)} does not match docs path ${JSON.stringify(derived)}`
+      };
+    }
+  } else if (derived) {
+    resolvedSlug = derived;
+  } else {
+    return { ok: false, error: "slug or spec_path/plan_path required" };
+  }
+  try {
+    return { ok: true, layout: buildLayout(workspace, resolvedSlug) };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+  }
+};
+var resolveDocsPath = (input) => {
+  if (path13.isAbsolute(input.path)) {
+    return { ok: false, error: `absolute path not allowed: ${input.path}` };
+  }
+  let workspace;
+  try {
+    workspace = realpathSync2(path13.resolve(input.workspace_root));
+  } catch {
+    return { ok: false, error: `workspace root not found: ${input.workspace_root}` };
+  }
+  try {
+    const abs = canonicalize(workspace, input.path);
+    const relative = posix(path13.relative(workspace, abs));
+    if (!relative.startsWith("docs/") || relative === `docs/${LEGACY_SLUG}` || relative.startsWith(`docs/${LEGACY_SLUG}/`)) {
+      return {
+        ok: false,
+        error: `path must live under docs/ and not under docs/${LEGACY_SLUG}/: ${input.path}`
+      };
+    }
+    return { ok: true, path: abs, relative, base: workspace };
+  } catch (error) {
+    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+  }
+};
+
+// packages/workit-core/src/core/docs-validate.ts
+var BRANCH_RE = /^\s*\*+Branch:\*+\s*`?([^`\s|]+)`?\s*$/im;
+var SPEC_LINK_RE = /^\s*\*+Spec:\*+\s*(?:`([^`]+)`|(\S+))\s*$/im;
+var TASK_RE = /^###\s+Task\s+(\d+):\s*(.*)$/i;
+var err = (code, message, path15) => {
+  const item = { code, message };
+  if (path15)
+    item.path = path15;
+  return item;
+};
+var failValidate = (errors) => ({
+  ok: false,
+  errors,
+  error: errors.map((e) => e.message).filter(Boolean).join("; ") || "docs validation failed"
+});
+var readBranch = (text, label) => {
+  const match = text.match(BRANCH_RE);
+  if (!match)
+    return [null, err("missing_branch", `**Branch:** feature/* or bugfix/* required in ${label}`)];
+  return [match[1].trim().replace(/`/g, ""), null];
+};
+var scanTaskHeadings = (planText) => {
+  const ids = [];
+  const titles = [];
+  let inFence = false;
+  for (const line of planText.split(`
+`)) {
+    if (line.startsWith("```")) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence)
+      continue;
+    const match = line.match(TASK_RE);
+    if (match) {
+      ids.push(Number(match[1]));
+      titles.push(match[2].trim());
+    }
+  }
+  if (ids.length === 0)
+    return [ids, titles, err("task_order", "no ### Task N sections found outside fences")];
+  const expected = ids.map((_, i) => i + 1);
+  const sorted = [...ids].sort((a, b) => a - b);
+  if (JSON.stringify(sorted) !== JSON.stringify(expected) || new Set(ids).size !== ids.length) {
+    return [
+      ids,
+      titles,
+      err("task_order", `task headings must be contiguous from 1..${ids.length}; found ${ids}`)
+    ];
+  }
+  return [ids, titles, null];
+};
+var parseTasksFromPlan = (planText) => {
+  const tasks = [];
+  let current = null;
+  let inFence = false;
+  for (const line of planText.split(`
+`)) {
+    if (line.startsWith("```")) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence)
+      continue;
+    const match = line.match(TASK_RE);
+    if (match) {
+      if (current)
+        tasks.push({ id: current.id, title: current.title, section_text: current.body.join(`
+`) });
+      current = { id: Number(match[1]), title: match[2].trim(), body: [] };
+    } else if (current) {
+      current.body.push(line);
+    }
+  }
+  if (current)
+    tasks.push({ id: current.id, title: current.title, section_text: current.body.join(`
+`) });
+  return tasks;
+};
+var docsValidate = ({
+  spec_path,
+  plan_path,
+  workspace_root
+}) => {
+  const resolved = resolveCanonicalLayout({ workspace_root, spec_path, plan_path });
+  if (!resolved.ok)
+    return failValidate([err("path_contract", resolved.error)]);
+  const cwd2 = resolved.layout.workspace;
+  const specAbs = resolved.layout.spec;
+  const planAbs = resolved.layout.plan;
+  const slug = resolved.layout.slug;
+  const errors = [];
+  const read = (p) => {
+    try {
+      return readFileSync9(p, "utf8");
+    } catch {
+      return null;
+    }
+  };
+  const specText = read(specAbs);
+  const planText = read(planAbs);
+  if (specText === null)
+    errors.push(err("missing_file", `spec not found: ${spec_path}`, spec_path));
+  if (planText === null)
+    errors.push(err("missing_file", `plan not found: ${plan_path}`, plan_path));
+  if (errors.length)
+    return failValidate(errors);
+  const [specBranch, specErr] = readBranch(specText, "spec");
+  if (specErr)
+    errors.push(specErr);
+  const [planBranch, planErr] = readBranch(planText, "plan");
+  if (planErr)
+    errors.push(planErr);
+  const linkMatch = planText.match(SPEC_LINK_RE);
+  if (!linkMatch) {
+    errors.push(err("missing_spec_link", "**Spec:** link required in plan", plan_path));
+  } else {
+    const linked = (linkMatch[1] ?? linkMatch[2] ?? "").trim();
+    const linkedResolved = resolveDocsPath({ workspace_root: cwd2, path: linked });
+    if (!linkedResolved.ok) {
+      errors.push(err("spec_link_escape", `plan **Spec:** ${linked} is not a contained docs path`, plan_path));
+    } else if (linkedResolved.path !== specAbs) {
+      errors.push(err("spec_mismatch", `plan **Spec:** ${linked} does not match spec_path ${spec_path}`, plan_path));
+    }
+  }
+  if (specBranch && planBranch && specBranch !== planBranch) {
+    errors.push(err("branch_mismatch", `spec branch ${JSON.stringify(specBranch)} != plan branch ${JSON.stringify(planBranch)}`, plan_path));
+  }
+  const [, , taskErr] = scanTaskHeadings(planText);
+  if (taskErr)
+    errors.push(taskErr);
+  if (errors.length)
+    return failValidate(errors);
+  const tasks = parseTasksFromPlan(planText);
+  const [headingIds, headingTitles, headingErr] = scanTaskHeadings(planText);
+  if (headingErr)
+    return failValidate([headingErr]);
+  if (tasks.length !== headingIds.length) {
+    return failValidate([
+      err("task_order", `parse count ${tasks.length} != heading count ${headingIds.length}`, plan_path)
+    ]);
+  }
+  for (let i = 0;i < tasks.length; i++) {
+    if (String(tasks[i].id) !== String(headingIds[i]) || tasks[i].title.trim() !== headingTitles[i]) {
+      return failValidate([err("task_order", `task mismatch at position ${i + 1}`, plan_path)]);
+    }
+  }
+  const relSpec = path14.isAbsolute(spec_path) ? path14.relative(cwd2, specAbs) : spec_path;
+  const relPlan = path14.isAbsolute(plan_path) ? path14.relative(cwd2, planAbs) : plan_path;
+  const quality = qualitySpec(specText);
+  if (!sddIgnored(cwd2, slug)) {
+    quality.push({
+      code: "sdd_not_ignored",
+      message: `docs/${slug}/sdd/ exists but is not gitignored — add 'docs/*/sdd/' to .gitignore (or run wk-init)`,
+      severity: "hard"
+    });
   }
+  const hygiene = hygieneFiles(cwd2);
+  const hyState = hygiene.state;
+  if (hyState["CHANGELOG.md"] === "missing")
+    quality.push({
+      code: "changelog_missing",
+      message: "CHANGELOG.md missing — create it with Keep a Changelog format (run wk-init hygiene)",
+      severity: "warning"
+    });
+  if (hyState["CHANGELOG.md"] === "invalid")
+    quality.push({
+      code: "changelog_invalid_format",
+      message: "CHANGELOG.md lacks ## [Unreleased] — Keep a Changelog format required",
+      severity: "warning"
+    });
+  if (hyState["README.md"] === "missing")
+    quality.push({ code: "readme_missing", message: "README.md missing", severity: "warning" });
+  if (hyState[".editorconfig"] === "missing")
+    quality.push({
+      code: "editorconfig_missing",
+      message: ".editorconfig missing",
+      severity: "warning"
+    });
+  if (hyState[".gitattributes"] === "missing")
+    quality.push({
+      code: "gitattributes_missing",
+      message: ".gitattributes missing",
+      severity: "warning"
+    });
+  if (hygiene.openSource && hyState.LICENSE === "missing")
+    quality.push({
+      code: "license_missing",
+      message: "LICENSE missing (open-source repo)",
+      severity: "warning"
+    });
+  if (hygiene.openSource && hyState["CONTRIBUTING.md"] === "missing")
+    quality.push({
+      code: "contributing_missing",
+      message: "CONTRIBUTING.md missing (open-source repo)",
+      severity: "warning"
+    });
+  return {
+    ok: true,
+    spec: relSpec,
+    plan: relPlan,
+    branch: specBranch,
+    task_count: tasks.length,
+    quality
+  };
+};
+var REQUIRED_SECTIONS = [
+  "## Context",
+  "## Goals",
+  "## Non-goals",
+  "## Architecture",
+  "## Acceptance criteria"
+];
+var UI_KEYWORDS = [
+  /\bui\b/,
+  /\binterface\b/,
+  /\bscreen\b/,
+  /\bmodal\b/,
+  /\bform\b/,
+  /\bcomponent\b/
+];
+var FLOW_KEYWORDS = [/\bflow\b/, /\bpipeline\b/, /\bsequence\b/, /\bdiagram\b/];
+var GLOSSARY_KEYWORDS = [/\bglossary\b/, /\bcontracts?\b/, /\bscope\b/];
+var finding = (code, message, severity) => ({
+  code,
+  message,
+  severity
 });
+var stripFences = (text) => {
+  const lines = text.split(`
+`);
+  const out = [];
+  let inFence = false;
+  for (const line of lines) {
+    if (line.startsWith("```")) {
+      if (!inFence)
+        out.push(line);
+      inFence = !inFence;
+      continue;
+    }
+    if (!inFence)
+      out.push(line);
+  }
+  return out.join(`
+`);
+};
+var qualitySpec = (text) => {
+  const findings = [];
+  const body = stripFences(text);
+  const lower = body.toLowerCase();
+  for (const section of REQUIRED_SECTIONS) {
+    if (!body.includes(section)) {
+      findings.push(finding("missing_section", `required section ${section} missing`, "hard"));
+    }
+  }
+  const hasCa = /^\s*(?:- CA-\d+|CA-\d+[.:])/m.test(body);
+  if (!hasCa) {
+    findings.push(finding("missing_acceptance_criteria", "no enumerable CA-XX acceptance criteria found", "hard"));
+  }
+  const hasAsciiFence = /```(?:text|ascii)/.test(body);
+  const mentionsUi = UI_KEYWORDS.some((k) => k.test(lower));
+  if (mentionsUi && !hasAsciiFence) {
+    findings.push(finding("missing_ascii_for_ui", "spec mentions UI but has no ASCII wireframe fence", "warning"));
+  }
+  const hasMermaid = /```mermaid/.test(body);
+  const explicitlyNoFlow = /\bno (?:flow|pipeline|sequence|diagram)\b/.test(lower);
+  const mentionsFlow = FLOW_KEYWORDS.some((k) => k.test(lower));
+  if (mentionsFlow && !hasMermaid && !explicitlyNoFlow) {
+    findings.push(finding("missing_mermaid_for_flow", "spec describes a flow/pipeline/sequence but has no mermaid fence", "warning"));
+  }
+  const hasTable = /^\s*\|.+\|.+\|/m.test(body);
+  const mentionsGlossary = GLOSSARY_KEYWORDS.some((k) => k.test(lower));
+  const onlyOutOfScope = /\bout of scope\b/.test(lower) && !/\bglossary\b/.test(lower) && !/\bcontracts?\b/.test(lower);
+  if (mentionsGlossary && !hasTable && !onlyOutOfScope) {
+    findings.push(finding("missing_table", "spec has glossary/contract/scope content but no markdown table", "warning"));
+  }
+  return findings;
+};
+var sddIgnored = (cwd2, slug) => {
+  const sddDir = path14.join(cwd2, "docs", slug, "sdd");
+  if (!existsSync11(sddDir))
+    return true;
+  try {
+    execFileSync2("git", ["-C", cwd2, "rev-parse", "--is-inside-work-tree"], { stdio: "pipe" });
+  } catch {
+    return true;
+  }
+  try {
+    execFileSync2("git", ["-C", cwd2, "check-ignore", path14.posix.join("docs", slug, "sdd", "progress.md")], { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// packages/workit-core/src/core/sdd.ts
+import {
+  appendFileSync as appendFileSync2,
+  existsSync as existsSync12,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync10,
+  statSync as statSync5,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import path15 from "node:path";
+function ledgerCompletion(root, slug) {
+  let started = false;
+  const completed = [];
+  const absProgress = path15.join(root, "docs", slug, "sdd", "progress.md");
+  if (existsSync12(absProgress)) {
+    try {
+      for (const line of readFileSync10(absProgress, "utf8").split(`
+`)) {
+        const match = /^Task\s+(\d+):/i.exec(line);
+        if (match) {
+          started = true;
+          if (/^Task\s+\d+:\s*complete\b/i.test(line))
+            completed.push(Number(match[1]));
+        }
+      }
+    } catch {}
+  }
+  const required = [];
+  try {
+    const absPlan = path15.join(root, "docs", slug, "plan.md");
+    if (existsSync12(absPlan)) {
+      for (const task of parseTasksFromPlan(readFileSync10(absPlan, "utf8")))
+        required.push(task.id);
+    }
+  } catch {}
+  const completedSet = new Set(completed);
+  const missing = required.filter((id) => !completedSet.has(id));
+  return {
+    started,
+    complete: required.length > 0 && missing.length === 0,
+    required,
+    completed,
+    missing
+  };
+}
+
+// packages/workit-core/src/core/verify-project.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync13, readFileSync as readFileSync12, statSync as statSync6 } from "node:fs";
+import path17 from "node:path";
+
+// packages/workit-core/src/core/repo-context.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+
+// packages/workit-core/src/core/branch.ts
+import { readFileSync as readFileSync11, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import path16 from "node:path";
+
+// packages/workit-core/src/core/git.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+var run = (cwd2, args) => {
+  try {
+    const stdout = execFileSync3("git", args, {
+      cwd: cwd2,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return { stdout: stdout.trimEnd(), stderr: "", exitCode: 0 };
+  } catch (error) {
+    const e = error;
+    return {
+      stdout: (e.stdout ?? "").trimEnd(),
+      stderr: (e.stderr ?? "").trimEnd(),
+      exitCode: e.status ?? 1
+    };
+  }
+};
+var gitContext = (workspaceRoot, paths = []) => {
+  const cwd2 = workspaceRoot;
+  let failure;
+  const runHere = (args) => {
+    const result2 = run(cwd2, args);
+    if (!failure && result2.exitCode !== 0) {
+      failure = { stderr: result2.stderr, exitCode: result2.exitCode };
+    }
+    return result2.stdout;
+  };
+  const branch = runHere(["rev-parse", "--abbrev-ref", "HEAD"]) || "unknown";
+  const status_short = runHere(["status", "--porcelain"]);
+  const staged = [];
+  const unstaged = [];
+  const untracked = [];
+  for (const line of status_short.split(`
+`).filter(Boolean)) {
+    const code = line.slice(0, 2);
+    const file = line.slice(3);
+    if (code === "??") {
+      untracked.push(file);
+    } else {
+      if (code[0] !== " " && code[0] !== "?")
+        staged.push(file);
+      if (code[1] !== " " && code[1] !== "?")
+        unstaged.push(file);
+    }
+  }
+  const pathArgs = paths.length ? ["--", ...paths] : [];
+  const diff_stat = runHere(["diff", "--stat", ...pathArgs]);
+  const cached_stat = runHere(["diff", "--cached", "--stat", ...pathArgs]);
+  const stagedSet = new Set(staged);
+  const unstagedSet = new Set(unstaged);
+  const partial_staged = [...stagedSet].filter((f) => unstagedSet.has(f));
+  return {
+    workspace_root: cwd2,
+    branch,
+    status_short,
+    staged,
+    unstaged,
+    untracked,
+    diff_stat: [diff_stat, cached_stat].filter(Boolean).join(`
+`),
+    partial_staged: partial_staged.length > 0,
+    partial_staged_files: partial_staged,
+    ...failure ? { stderr: failure.stderr, exitCode: failure.exitCode } : {}
+  };
+};
+
+// packages/workit-core/src/core/branch.ts
+var resolveBranchPolicyFor = (workspaceRoot) => resolveBranchPolicy(readConfig(), resolveWorkspace(workspaceRoot));
+var policy = (root) => resolveBranchPolicyFor(root);
+var allowedBranch = (root, name) => policy(root).allowed.some((r) => r.test(name));
+var isProtected = (root, name) => policy(root).protected.has(name.toLowerCase());
+var DECLARE_RE = /^\s*\*+Branch:\*+\s*`?([^`\s|]+)`?\s*$/gim;
+var USE_CURRENT_RE = /^\s*\*+Branch:\*+\s*use-current\s*$/im;
+var readSafe2 = (p) => {
+  try {
+    return readFileSync11(p, "utf8");
+  } catch {
+    return null;
+  }
+};
+var normalizeBranch = (root, name) => {
+  const n = name.trim().replace(/`/g, "").replace(/\.+$/, "");
+  if (isProtected(root, n))
+    return null;
+  if (!allowedBranch(root, n))
+    return null;
+  const parts = n.toLowerCase().split("/").map((p) => p.replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-"));
+  if (parts.some((p) => !p))
+    return null;
+  return parts.join("/");
+};
+var deriveSlug = (planPath) => {
+  const dirName = path16.basename(path16.dirname(planPath));
+  return dirName === "." || dirName === "/" || dirName === "" ? "" : dirName;
+};
+var deriveKind = (planPath, fallback = "feature") => {
+  const slug = deriveSlug(planPath);
+  const text = readSafe2(planPath) ?? "";
+  let kind = fallback;
+  if (/\bbugfix\b/i.test(slug) || /^fix-/i.test(slug)) {
+    kind = "bugfix";
+  } else {
+    const goal = text.split(`
+`).find((line) => line.startsWith("**Goal:**"))?.toLowerCase() ?? "";
+    if (/\b(bugfix|bug fix)\b/.test(goal) && !/\b(feat|feature|upgrade|add)\b/.test(goal)) {
+      kind = "bugfix";
+    }
+  }
+  return kind;
+};
+var resolveBranch = ({
+  spec_path,
+  plan_path,
+  workspace_root
+}) => {
+  const cwd2 = path16.resolve(workspace_root);
+  const abs = (p) => path16.isAbsolute(p) ? p : path16.join(cwd2, p);
+  const spec = abs(spec_path);
+  const plan = abs(plan_path);
+  const git = gitContext(cwd2);
+  const current = git.branch;
+  const finish = (branch, source) => ({
+    branch,
+    source,
+    current_branch: current,
+    dirty: Boolean(git.status_short.trim()),
+    needs_checkout: current !== branch
+  });
+  for (const file of [spec, plan]) {
+    const text = readSafe2(file);
+    if (!text)
+      continue;
+    if (USE_CURRENT_RE.test(text)) {
+      if (!current || !allowedBranch(cwd2, current) || isProtected(cwd2, current)) {
+        return { error: `use-current but HEAD ${current} is not an allowed branch` };
+      }
+      return finish(current, "use-current");
+    }
+  }
+  if (current && allowedBranch(cwd2, current) && !isProtected(cwd2, current))
+    return finish(current, "keep-current");
+  let declaredButInvalid = null;
+  for (const file of [spec, plan]) {
+    const text = readSafe2(file);
+    if (!text)
+      continue;
+    for (const match of text.matchAll(DECLARE_RE)) {
+      const normalized = normalizeBranch(cwd2, match[1]);
+      if (normalized)
+        return finish(normalized, file === spec ? "spec" : "plan");
+      declaredButInvalid ??= match[1];
+    }
+  }
+  if (declaredButInvalid) {
+    return {
+      error: `declared branch ${JSON.stringify(declaredButInvalid)} is not allowed by the branch policy`
+    };
+  }
+  const slug = deriveSlug(plan);
+  if (!slug)
+    return { error: `cannot derive branch slug from plan ${plan}` };
+  const kind = deriveKind(plan);
+  return finish(`${kind}/${slug}`, "derived");
+};
+
+// packages/workit-core/src/core/repo-context.ts
+var runGit = (cwd2, args) => {
+  const result2 = spawnSync3("git", args, { cwd: cwd2, encoding: "utf8" });
+  return {
+    stdout: (result2.stdout ?? "").trimEnd(),
+    stderr: (result2.stderr ?? "").trimEnd(),
+    exitCode: result2.status ?? 1
+  };
+};
+var repoRoot2 = (cwd2) => {
+  const r = runGit(cwd2, ["rev-parse", "--show-toplevel"]);
+  return r.exitCode === 0 && r.stdout ? r.stdout : cwd2;
+};
+
+// packages/workit-core/src/core/verify-project.ts
+var commandOnPath2 = (name) => {
+  const dirs = (process.env.PATH ?? "").split(path17.delimiter);
+  const names = process.platform === "win32" ? [name, `${name}.exe`] : [name];
+  for (const dir of dirs) {
+    if (!dir)
+      continue;
+    for (const candidateName of names) {
+      const candidate = path17.join(dir, candidateName);
+      try {
+        statSync6(candidate);
+        if (process.platform !== "win32") {
+          const mode = statSync6(candidate).mode & 73;
+          if (mode === 0)
+            continue;
+        }
+        return true;
+      } catch {}
+    }
+  }
+  return false;
+};
+var hasScript = (cwd2, name) => {
+  const pkgPath = path17.join(cwd2, "package.json");
+  if (!existsSync13(pkgPath))
+    return false;
+  try {
+    const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
+    return Boolean(pkg.scripts && typeof pkg.scripts[name] === "string");
+  } catch {
+    return false;
+  }
+};
+var packageRunner = (cwd2) => {
+  if (existsSync13(path17.join(cwd2, "pnpm-lock.yaml")))
+    return "pnpm";
+  const pkgPath = path17.join(cwd2, "package.json");
+  if (existsSync13(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
+      if (typeof pkg.packageManager === "string" && pkg.packageManager.startsWith("pnpm")) {
+        return "pnpm";
+      }
+    } catch {}
+  }
+  if (existsSync13(path17.join(cwd2, "yarn.lock")))
+    return "yarn";
+  return "npm";
+};
+function runVerifyProject(root, dryRun = false) {
+  const cwd2 = repoRoot2(root);
+  let passed = 0;
+  let failed = 0;
+  let skipped = 0;
+  const lines = [];
+  const stderrParts = [];
+  const runCheck = (label, cmd, args) => {
+    lines.push(`
+## ${label}
+
+`);
+    lines.push(`command: ${[cmd, ...args].join(" ")}
+
+`);
+    if (dryRun) {
+      lines.push(`status: skipped (dry run)
+`);
+      skipped += 1;
+      return;
+    }
+    const r = spawnSync4(cmd, args, { cwd: cwd2, encoding: "utf8" });
+    const so = (r.stdout ?? "").trimEnd();
+    if (so)
+      lines.push(so + `
+`);
+    const se = (r.stderr ?? "").trimEnd();
+    if (se)
+      stderrParts.push(se);
+    if (r.status === 0) {
+      lines.push(`
+status: pass
+`);
+      passed += 1;
+    } else {
+      lines.push(`
+status: fail (exit ${r.status})
+`);
+      failed += 1;
+    }
+  };
+  const skipCheck = (label, reason) => {
+    lines.push(`
+## ${label}
+
+status: skipped (${reason})
+`);
+    skipped += 1;
+  };
+  lines.push(`# Verification Context
+`);
+  lines.push(`
+root: ${cwd2}
+`);
+  lines.push(`dry_run: ${String(dryRun)}
+`);
+  const pkgPath = path17.join(cwd2, "package.json");
+  if (existsSync13(pkgPath)) {
+    const runner = packageRunner(cwd2);
+    for (const script of ["lint", "format:check", "test", "build"]) {
+      if (hasScript(cwd2, script)) {
+        if (runner === "npm")
+          runCheck(script, "npm", ["run", script]);
+        else
+          runCheck(script, runner, [script]);
+      } else {
+        skipCheck(script, `package.json has no ${script} script`);
+      }
+    }
+  } else {
+    skipCheck("javascript", "package.json not found");
+  }
+  const cargoManifest = existsSync13(path17.join(cwd2, "Cargo.toml")) ? "Cargo.toml" : existsSync13(path17.join(cwd2, "src-tauri/Cargo.toml")) ? "src-tauri/Cargo.toml" : "";
+  if (cargoManifest) {
+    runCheck("cargo fmt", "cargo", ["fmt", "--manifest-path", cargoManifest, "--", "--check"]);
+    runCheck("cargo clippy", "cargo", [
+      "clippy",
+      "--manifest-path",
+      cargoManifest,
+      "--all-targets",
+      "--",
+      "-D",
+      "warnings"
+    ]);
+    runCheck("cargo test", "cargo", ["test", "--manifest-path", cargoManifest, "--all-targets"]);
+  } else {
+    skipCheck("rust", "Cargo.toml not found");
+  }
+  if (existsSync13(path17.join(cwd2, "pyproject.toml")) || existsSync13(path17.join(cwd2, "pytest.ini")) || existsSync13(path17.join(cwd2, "tests"))) {
+    if (commandOnPath2("pytest"))
+      runCheck("pytest", "pytest", []);
+    else
+      skipCheck("pytest", "pytest not available");
+    if (commandOnPath2("ruff"))
+      runCheck("ruff check", "ruff", ["check", "."]);
+    else
+      skipCheck("ruff check", "ruff not available");
+  }
+  lines.push(`
+## CHANGELOG.md format
+
+`);
+  lines.push(`command: grep -qi "## [Unreleased]" CHANGELOG.md
+
+`);
+  const changelogPath = path17.join(cwd2, "CHANGELOG.md");
+  if (dryRun) {
+    lines.push(`status: skipped (dry run)
+`);
+    skipped += 1;
+  } else if (existsSync13(changelogPath)) {
+    if (/## \[Unreleased\]/i.test(readFileSync12(changelogPath, "utf8"))) {
+      lines.push(`status: pass
+`);
+      passed += 1;
+    } else {
+      lines.push(`status: fail (missing ## [Unreleased])
+`);
+      failed += 1;
+    }
+  } else {
+    lines.push(`status: fail (missing CHANGELOG.md)
+`);
+    failed += 1;
+  }
+  lines.push(`
+# Summary
+
+`);
+  lines.push(`passed: ${passed}
+`);
+  lines.push(`failed: ${failed}
+`);
+  lines.push(`skipped: ${skipped}
+`);
+  return {
+    stdout: lines.join(""),
+    stderr: stderrParts.join(`
+`),
+    exitCode: failed > 0 ? 1 : 0,
+    cwd: cwd2
+  };
+}
+
+// packages/workit-core/src/core/flow-state.ts
+var COORDINATOR_RECOVERY_TEXT = "A subagent-driven plan is active: coordinator product edits are blocked. " + "Delegate product mutations (task briefs, progress, review packages) to an " + "authenticated delegated worker via `task` / `wk-implement` instead of " + "editing in the coordinator session.";
+var CURSOR_SUBAGENT_UNSUPPORTED_TEXT = "Cursor cannot execute subagent-driven plans: the MCP has no child-session " + "support. Choose Inline, Handoff, or a review option in this session, or " + "run the plan in OpenCode with `wk-implement`.";
+var MENU_CHOICES = [
+  "subagent-driven",
+  "inline",
+  "handoff",
+  "review-spec",
+  "review-plan"
+];
+var err2 = (code, error, details) => ({
+  ok: false,
+  code,
+  error,
+  ...details ? { details } : {}
+});
+var SLUG_RE2 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var flowPath = (root, slug) => {
+  if (!SLUG_RE2.test(slug))
+    throw new Error(`invalid slug: ${JSON.stringify(slug)}`);
+  return path18.join(root, "docs", slug, "sdd", "flow.json");
+};
+var resolveDoc = (root, slug, docPath, kind) => {
+  const resolved = resolveCanonicalLayout({
+    workspace_root: root,
+    ...slug ? { slug } : {},
+    [kind === "spec" ? "spec_path" : "plan_path"]: docPath
+  });
+  if (!resolved.ok)
+    return { ok: false, error: resolved.error };
+  return { ok: true, path: resolved.layout[kind === "spec" ? "spec" : "plan"] };
+};
+var HEX64_RE = /^[0-9a-f]{64}$/;
+var FLOW_STATUSES = ["draft", "self_reviewed", "approved"];
+var EXECUTION_STATUSES = ["pending", "active", "paused", "completed"];
+var isRecord3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var validateEvidenceValue = (v, allowCli) => {
+  if (v === null)
+    return true;
+  if (!isRecord3(v))
+    return false;
+  if (v.host === "opencode") {
+    return v.attested === true && typeof v.callID === "string" && typeof v.selectedLabel === "string" && typeof v.recordedAt === "number";
+  }
+  if (v.host === "cursor")
+    return v.attested === false && v.confirmation === "contract";
+  if (allowCli && v.host === "cli") {
+    return v.attested === false && (v.confirmation === "flag" || v.confirmation === "tty");
+  }
+  return false;
+};
+var validateState = (parsed, slug) => {
+  if (!isRecord3(parsed))
+    return { ok: false, error: "flow state must be a JSON object" };
+  if (parsed.slug !== undefined && (typeof parsed.slug !== "string" || parsed.slug !== slug)) {
+    return { ok: false, error: `flow state slug must be ${JSON.stringify(slug)}` };
+  }
+  if (parsed.activated !== undefined && typeof parsed.activated !== "boolean") {
+    return { ok: false, error: "flow state activated must be a boolean" };
+  }
+  if (parsed.handoff_destination !== undefined && typeof parsed.handoff_destination !== "boolean") {
+    return { ok: false, error: "flow state handoff_destination must be a boolean" };
+  }
+  if (parsed.updated_at !== undefined && (typeof parsed.updated_at !== "number" || !Number.isFinite(parsed.updated_at))) {
+    return { ok: false, error: "flow state updated_at must be a finite number" };
+  }
+  const doc = (value, name) => {
+    const p = isRecord3(value) ? value : {};
+    if (!isRecord3(value) && value !== undefined) {
+      return `flow state ${name} must be an object`;
+    }
+    if (p.status !== undefined && !FLOW_STATUSES.includes(p.status)) {
+      return `flow state ${name}.status must be draft, self_reviewed, or approved`;
+    }
+    if (p.path !== undefined && typeof p.path !== "string") {
+      return `flow state ${name}.path must be a string`;
+    }
+    if (p.approved_digest !== undefined && p.approved_digest !== null && (typeof p.approved_digest !== "string" || !HEX64_RE.test(p.approved_digest))) {
+      return `flow state ${name}.approved_digest must be 64-char lowercase hex or null`;
+    }
+    if (p.evidence !== undefined && !validateEvidenceValue(p.evidence, false)) {
+      return `flow state ${name}.evidence has an unsupported shape`;
+    }
+    return {
+      path: p.path ?? "",
+      status: p.status ?? "draft",
+      evidence: p.evidence ?? null,
+      approved_digest: p.approved_digest ?? null
+    };
+  };
+  const spec = doc(parsed.spec, "spec");
+  if (typeof spec === "string")
+    return { ok: false, error: spec };
+  const plan = doc(parsed.plan, "plan");
+  if (typeof plan === "string")
+    return { ok: false, error: plan };
+  const menuRaw = isRecord3(parsed.menu) ? parsed.menu : undefined;
+  if (parsed.menu !== undefined && !isRecord3(parsed.menu)) {
+    return { ok: false, error: "flow state menu must be an object" };
+  }
+  if (menuRaw?.presented !== undefined && typeof menuRaw.presented !== "boolean") {
+    return { ok: false, error: "flow state menu.presented must be a boolean" };
+  }
+  if (menuRaw?.chosen !== undefined && typeof menuRaw.chosen !== "string") {
+    return { ok: false, error: "flow state menu.chosen must be a string" };
+  }
+  if (menuRaw?.chosen !== undefined && menuRaw.chosen !== "" && !MENU_CHOICES.includes(menuRaw.chosen)) {
+    return {
+      ok: false,
+      error: `flow state menu.chosen must be one of: ${MENU_CHOICES.join(", ")} (or an empty string when the menu is unpresented)`
+    };
+  }
+  if (menuRaw?.evidence !== undefined && !validateEvidenceValue(menuRaw.evidence, false)) {
+    return { ok: false, error: "flow state menu.evidence has an unsupported shape" };
+  }
+  const execRaw = isRecord3(parsed.execution) ? parsed.execution : undefined;
+  if (parsed.execution !== undefined && !isRecord3(parsed.execution)) {
+    return { ok: false, error: "flow state execution must be an object" };
+  }
+  if (execRaw?.status !== undefined && !EXECUTION_STATUSES.includes(execRaw.status)) {
+    return {
+      ok: false,
+      error: "flow state execution.status must be pending, active, paused, or completed"
+    };
+  }
+  if (execRaw?.mode !== undefined && execRaw.mode !== null && execRaw.mode !== "subagent-driven" && execRaw.mode !== "inline") {
+    return {
+      ok: false,
+      error: "flow state execution.mode must be subagent-driven, inline, or null"
+    };
+  }
+  if (execRaw?.evidence !== undefined && !validateEvidenceValue(execRaw.evidence, true)) {
+    return { ok: false, error: "flow state execution.evidence has an unsupported shape" };
+  }
+  return {
+    ok: true,
+    state: {
+      slug,
+      activated: parsed.activated ?? true,
+      spec,
+      plan,
+      menu: {
+        presented: menuRaw?.presented ?? false,
+        chosen: menuRaw?.chosen ?? "",
+        evidence: menuRaw?.evidence ?? null
+      },
+      execution: {
+        status: execRaw?.status ?? "pending",
+        mode: execRaw?.mode ?? null,
+        evidence: execRaw?.evidence ?? null
+      },
+      handoff_destination: parsed.handoff_destination ?? false,
+      updated_at: parsed.updated_at ?? Date.now()
+    }
+  };
+};
+var readFlowStrict = (root, slug) => {
+  const file = flowPath(root, slug);
+  const rel = path18.posix.join("docs", slug, "sdd", "flow.json");
+  if (!existsSync14(file)) {
+    return err2("flow_not_activated", `flow not activated for ${slug} — run workflow_flow_status first`);
+  }
+  let text;
+  try {
+    text = readFileSync13(file, "utf8");
+  } catch (error) {
+    return err2("flow_io_error", `cannot read flow state at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    return err2("flow_state_invalid", `invalid flow state at ${file}: ${error instanceof Error ? error.message : String(error)}`, { path: rel, original_bytes_preserved: true });
+  }
+  const validated = validateState(parsed, slug);
+  if (!validated.ok) {
+    return err2("flow_state_invalid", `invalid flow state at ${file}: ${validated.error}`, {
+      path: rel,
+      original_bytes_preserved: true
+    });
+  }
+  return { ok: true, state: validated.state, raw: parsed };
+};
+var uniqueTempPath = (file) => `${file}.${process.pid}-${Math.random().toString(36).slice(2)}.tmp`;
+var writeFlowFileAtomic = (file, state) => {
+  const text = JSON.stringify(state, null, 2) + `
+`;
+  const tmp = uniqueTempPath(file);
+  mkdirSync8(path18.dirname(file), { recursive: true });
+  let fd = null;
+  try {
+    fd = openSync(tmp, "w");
+    writeFileSync8(fd, text, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    renameSync2(tmp, file);
+  } finally {
+    try {
+      if (fd !== null)
+        closeSync(fd);
+    } catch {}
+    try {
+      if (existsSync14(tmp))
+        rmSync2(tmp, { force: true });
+    } catch {}
+  }
+};
+var MAX_WRITE_ATTEMPTS = 5;
+var STALE_LOCK_MS = 1000;
+var lockMtimeMs = (lock) => {
+  try {
+    return statSync7(lock).mtimeMs;
+  } catch {
+    return null;
+  }
+};
+var lockOwnedBy = (fd, lock) => {
+  try {
+    return fstatSync(fd).ino === statSync7(lock).ino;
+  } catch {
+    return false;
+  }
+};
+var writeFlowStateIfCurrent = (root, expected, next) => {
+  const file = flowPath(root, next.slug);
+  const expectedText = JSON.stringify(expected, null, 2) + `
+`;
+  const nextText = JSON.stringify(next, null, 2) + `
+`;
+  if (expectedText === nextText)
+    return { ok: true };
+  const tmp = uniqueTempPath(file);
+  let fd = null;
+  try {
+    const currentText = existsSync14(file) ? readFileSync13(file, "utf8") : null;
+    if (currentText !== expectedText)
+      return { ok: false, conflict: true };
+    mkdirSync8(path18.dirname(file), { recursive: true });
+    fd = openSync(tmp, "w");
+    writeFileSync8(fd, nextText, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    const reRead = existsSync14(file) ? readFileSync13(file, "utf8") : null;
+    if (reRead !== expectedText)
+      return { ok: false, conflict: true };
+    renameSync2(tmp, file);
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, io_error: error instanceof Error ? error.message : String(error) };
+  } finally {
+    try {
+      if (fd !== null)
+        closeSync(fd);
+    } catch {}
+    try {
+      if (existsSync14(tmp))
+        rmSync2(tmp, { force: true });
+    } catch {}
+  }
+};
+var readCanonicalDigest = (root, rel) => {
+  const abs = path18.join(root, ...rel.split("/"));
+  let bytes;
+  try {
+    bytes = readFileSync13(abs);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { ok: false, code: "document_missing" };
+    }
+    return { ok: false, code: "document_unreadable" };
+  }
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return { ok: false, code: "document_unreadable" };
+  }
+  return { ok: true, text, digest: createHash("sha256").update(bytes).digest("hex") };
+};
+var resetForSpecDrift = (state) => ({
+  ...state,
+  spec: { ...state.spec, status: "draft", evidence: null, approved_digest: null },
+  plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
+  menu: { presented: false, chosen: "", evidence: null },
+  execution: { status: "pending", mode: null, evidence: null },
+  handoff_destination: false,
+  updated_at: Date.now()
+});
+var resetForPlanDrift = (state) => ({
+  ...state,
+  plan: { ...state.plan, status: "draft", evidence: null, approved_digest: null },
+  menu: { presented: false, chosen: "", evidence: null },
+  execution: { status: "pending", mode: null, evidence: null },
+  handoff_destination: false,
+  updated_at: Date.now()
+});
+var driftCodeFor = (root, relPath, storedDigest) => {
+  if (storedDigest === null)
+    return "digest_missing";
+  const current = readCanonicalDigest(root, relPath);
+  if (!current.ok)
+    return current.code;
+  return current.digest !== storedDigest ? "digest_mismatch" : null;
+};
+var reconcileState = (root, slug, state) => {
+  const specPath = path18.posix.join("docs", slug, "spec.md");
+  const planPath = path18.posix.join("docs", slug, "plan.md");
+  if (state.spec.status === "approved") {
+    const code = driftCodeFor(root, specPath, state.spec.approved_digest);
+    if (code) {
+      return {
+        state: resetForSpecDrift(state),
+        drift: [{ document: "spec", code, path: specPath }]
+      };
+    }
+  }
+  if (state.plan.status === "approved") {
+    const code = driftCodeFor(root, planPath, state.plan.approved_digest);
+    if (code) {
+      return {
+        state: resetForPlanDrift(state),
+        drift: [{ document: "plan", code, path: planPath }]
+      };
+    }
+  }
+  return { state, drift: [] };
+};
+var deriveLegacyExecution = (root, slug, state) => {
+  const ledger = ledgerCompletion(root, slug);
+  if (state.plan.status === "approved" && state.menu.chosen === "subagent-driven" && ledger.started && !ledger.complete) {
+    return { status: "active", mode: "subagent-driven", evidence: null };
+  }
+  return { status: "pending", mode: null, evidence: null };
+};
+var normalizeCompatibility = (root, slug, parsed, state) => {
+  if (!isRecord3(parsed) || !("execution" in parsed)) {
+    const derived = deriveLegacyExecution(root, slug, state);
+    const current = state.execution;
+    if (derived.status !== current.status || derived.mode !== current.mode) {
+      return { state: { ...state, execution: derived, updated_at: Date.now() }, changed: true };
+    }
+  }
+  return { state, changed: false };
+};
+var withFlowLock = (file, fn) => {
+  const lock = `${file}.lock`;
+  if (!existsSync14(path18.dirname(file)))
+    return { locked: true, value: fn() };
+  try {
+    if (existsSync14(`${lock}.stale`))
+      rmSync2(`${lock}.stale`, { force: true });
+  } catch {}
+  const wait = new Int32Array(new SharedArrayBuffer(4));
+  let fd = null;
+  for (let attempt2 = 0;attempt2 < MAX_WRITE_ATTEMPTS; attempt2++) {
+    try {
+      fd = openSync(lock, "wx");
+      break;
+    } catch (error) {
+      const code = error.code;
+      if (code !== "EEXIST") {
+        return {
+          locked: false,
+          error: err2("flow_io_error", `flow lock failed for ${file}: ${error instanceof Error ? error.message : String(error)}`)
+        };
+      }
+      const mtime = lockMtimeMs(lock);
+      if (mtime !== null && Date.now() - mtime > STALE_LOCK_MS) {
+        try {
+          renameSync2(lock, `${lock}.stale`);
+          unlinkSync3(`${lock}.stale`);
+        } catch {}
+        try {
+          fd = openSync(lock, "wx");
+          break;
+        } catch (innerError) {
+          const innerCode = innerError.code;
+          if (innerCode !== "EEXIST") {
+            return {
+              locked: false,
+              error: err2("flow_io_error", `flow lock failed for ${file}: ${innerError instanceof Error ? innerError.message : String(innerError)}`)
+            };
+          }
+        }
+      }
+      if (attempt2 === MAX_WRITE_ATTEMPTS - 1) {
+        return {
+          locked: false,
+          error: err2("flow_concurrent_conflict", `concurrent flow update detected for ${path18.dirname(file)}: re-read the flow state and retry the transition`)
+        };
+      }
+      Atomics.wait(wait, 0, 0, 10);
+    }
+  }
+  if (fd === null) {
+    return {
+      locked: false,
+      error: err2("flow_concurrent_conflict", `concurrent flow update detected for ${path18.dirname(file)}: re-read the flow state and retry the transition`)
+    };
+  }
+  try {
+    return { locked: true, value: fn() };
+  } finally {
+    try {
+      if (fd !== null && lockOwnedBy(fd, lock))
+        rmSync2(lock, { force: true });
+    } catch {}
+    try {
+      if (fd !== null)
+        closeSync(fd);
+    } catch {}
+  }
+};
+var readEffectiveFlowState = (root, slug) => {
+  const file = flowPath(root, slug);
+  const rel = path18.posix.join("docs", slug, "sdd", "flow.json");
+  const locked = withFlowLock(file, () => {
+    const strict = readFlowStrict(root, slug);
+    if (!strict.ok)
+      return strict;
+    const normalized = normalizeCompatibility(root, slug, strict.raw, strict.state);
+    const { state, drift } = reconcileState(root, slug, normalized.state);
+    if (normalized.changed || drift.length > 0) {
+      try {
+        writeFlowFileAtomic(file, state);
+      } catch (error) {
+        return err2("flow_io_error", `cannot persist reconciled flow state at ${file}: ${error instanceof Error ? error.message : String(error)}`, { path: rel, original_bytes_preserved: true });
+      }
+    }
+    return { ok: true, state, drift };
+  });
+  if (!locked.locked)
+    return locked.error;
+  return locked.value;
+};
+var readModifyWrite = (root, slug, mutate) => {
+  const file = flowPath(root, slug);
+  const locked = withFlowLock(file, () => {
+    for (let attempt2 = 0;attempt2 < MAX_WRITE_ATTEMPTS; attempt2++) {
+      const strict = readFlowStrict(root, slug);
+      if (!strict.ok)
+        return strict;
+      const normalized = normalizeCompatibility(root, slug, strict.raw, strict.state);
+      const reconciled = reconcileState(root, slug, normalized.state);
+      const result2 = mutate(reconciled.state);
+      if (!result2.ok)
+        return result2;
+      let baseline = strict.state;
+      if (normalized.changed) {
+        try {
+          writeFlowFileAtomic(file, normalized.state);
+        } catch (error) {
+          return err2("flow_io_error", `cannot persist normalized flow state at ${file}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        baseline = normalized.state;
+      }
+      const commit = writeFlowStateIfCurrent(root, baseline, result2.next);
+      if (commit.ok)
+        return { ok: true };
+      if ("io_error" in commit) {
+        return err2("flow_io_error", `flow state write failed for ${slug}: ${commit.io_error}`);
+      }
+    }
+    return err2("flow_concurrent_conflict", `concurrent flow update detected for ${slug}: re-read the flow state and retry the transition`);
+  });
+  if (!locked.locked)
+    return locked.error;
+  return locked.value;
+};
+var assertMutationWorkspace = (root, ctx) => {
+  if (ctx && ctx.hostWorkspace !== root) {
+    return err2("workspace_mismatch", `mutation context workspace ${JSON.stringify(ctx.hostWorkspace)} does not match flow workspace ${JSON.stringify(root)}`);
+  }
+  return { ok: true };
+};
+var MAX_CLOCK_SKEW_MS = 60000;
+var MAX_RECEIPTS_PER_SESSION = 10;
+var RECEIPT_FRESHNESS_MS = 10 * 60 * 1000;
+var EVIDENCE_WINDOW_MS = 24 * 60 * 60 * 1000;
+var NEGATIVE_ANSWER_LABELS = [
+  "no",
+  "nope",
+  "nah",
+  "reject",
+  "cancel",
+  "decline",
+  "not now",
+  "not yet",
+  "skip",
+  "back",
+  "deny"
+];
+var isNegativeLabel = (label) => {
+  const normalized = label.trim().toLowerCase();
+  return NEGATIVE_ANSWER_LABELS.some((entry) => {
+    const firstWord = normalized.split(/\s+/)[0] ?? "";
+    if (entry.includes(" ")) {
+      const plain = normalized.replace(/[^a-z ]/g, "");
+      return plain === entry || plain.startsWith(`${entry} `);
+    }
+    return firstWord.replace(/[^a-z]/g, "") === entry;
+  });
+};
+
+class HostReceiptStore {
+  #bySession = new Map;
+  record(sessionId, callID, selectedLabel, recordedAt = Date.now(), question) {
+    const label = selectedLabel.trim();
+    if (!label)
+      return;
+    if (recordedAt > Date.now() + MAX_CLOCK_SKEW_MS)
+      return;
+    const queue = this.#bySession.get(sessionId) ?? [];
+    if (queue.length >= MAX_RECEIPTS_PER_SESSION)
+      queue.shift();
+    queue.push({ sessionId, callID, selectedLabel: label, recordedAt, question });
+    this.#bySession.set(sessionId, queue);
+  }
+  count(sessionId) {
+    return this.#bySession.get(sessionId)?.length ?? 0;
+  }
+  peek(sessionId, opts = {}) {
+    return this.#take(sessionId, opts, false);
+  }
+  consume(sessionId, opts = {}) {
+    return this.#take(sessionId, opts, true);
+  }
+  #take(sessionId, opts, remove2) {
+    const queue = this.#bySession.get(sessionId);
+    if (!queue || queue.length === 0) {
+      return err2("receipt_missing", "no host-observed native-question receipt for this session — ask the native " + "`question` tool and have the user answer before calling this tool");
+    }
+    const index = queue.length - 1;
+    const receipt = queue[index];
+    if (isNegativeLabel(receipt.selectedLabel)) {
+      this.#bySession.delete(sessionId);
+      return err2("receipt_rejected", `the user's most recent answer (${JSON.stringify(receipt.selectedLabel)}) is a ` + "negative answer — it cannot authorize an approval; ask the native question again");
+    }
+    if (opts.label !== undefined && !sameChoiceLabel(receipt.selectedLabel, opts.label)) {
+      return err2("evidence_mismatch", `receipt selectedLabel does not match ${JSON.stringify(opts.label)} — fabricated menu choice rejected`);
+    }
+    if (Date.now() - receipt.recordedAt > RECEIPT_FRESHNESS_MS) {
+      if (remove2) {
+        queue.splice(index, 1);
+        if (queue.length === 0)
+          this.#bySession.delete(sessionId);
+      }
+      return err2("receipt_stale", "the question receipt is too old — ask the native question again and re-answer");
+    }
+    if (remove2) {
+      queue.splice(index, 1);
+      if (queue.length === 0)
+        this.#bySession.delete(sessionId);
+    }
+    return { ok: true, receipt };
+  }
+}
+var sameChoiceLabel = (a, b) => a.toLowerCase() === b.toLowerCase();
+var CURSOR_KEYS = ["attested", "confirmation", "host"];
+var assertEvidenceShape = (input) => {
+  if (typeof input !== "object" || input === null) {
+    return {
+      ok: false,
+      error: "native choice evidence required — bare booleans and other primitives are not approval evidence"
+    };
+  }
+  const record = input;
+  if (record.host === "cursor") {
+    if (record.attested !== false || record.confirmation !== "contract") {
+      return {
+        ok: false,
+        error: 'cursor confirmations are policy-only: exactly { host: "cursor", attested: false, confirmation: "contract" } — Cursor cannot attest a host-observed answer'
+      };
+    }
+    const keys2 = Object.keys(record).sort();
+    if (keys2.length !== CURSOR_KEYS.length || !CURSOR_KEYS.every((key) => keys2.includes(key))) {
+      return {
+        ok: false,
+        error: "cursor confirmations carry no caller-supplied question data — the attested: false constant only"
+      };
+    }
+    return { ok: true, evidence: { host: "cursor", attested: false, confirmation: "contract" } };
+  }
+  if (record.host !== "opencode") {
+    return {
+      ok: false,
+      error: `evidence host must be 'opencode' or 'cursor', got ${JSON.stringify(record.host)}`
+    };
+  }
+  if (record.attested !== true) {
+    return {
+      ok: false,
+      error: "opencode evidence requires host attestation (attested: true) — only host-observed question receipts are accepted"
+    };
+  }
+  const { callID, selectedLabel, recordedAt } = record;
+  if (typeof callID !== "string" || callID.trim() === "") {
+    return {
+      ok: false,
+      error: "opencode evidence callID must be a non-empty string (host question tool call)"
+    };
+  }
+  if (typeof selectedLabel !== "string" || selectedLabel.trim() === "") {
+    return {
+      ok: false,
+      error: "opencode evidence selectedLabel must be the exact label the user selected on the native question"
+    };
+  }
+  if (typeof recordedAt !== "number" || !Number.isFinite(recordedAt) || recordedAt <= 0) {
+    return {
+      ok: false,
+      error: "opencode evidence recordedAt must be a positive epoch-ms timestamp"
+    };
+  }
+  const now2 = Date.now();
+  if (recordedAt > now2 + MAX_CLOCK_SKEW_MS) {
+    return {
+      ok: false,
+      error: "opencode evidence recordedAt is in the future — forged evidence is rejected"
+    };
+  }
+  if (now2 - recordedAt > EVIDENCE_WINDOW_MS) {
+    return {
+      ok: false,
+      error: "opencode evidence recordedAt is too old — ask the native question again and re-record the answer"
+    };
+  }
+  return {
+    ok: true,
+    evidence: {
+      host: "opencode",
+      attested: true,
+      callID: callID.trim(),
+      selectedLabel: selectedLabel.trim(),
+      recordedAt
+    }
+  };
+};
+var markHandoffDestination = (root, slug, planPath) => {
+  const doc = resolveDoc(root, slug, planPath, "plan");
+  if (!doc.ok)
+    return err2("path_invalid", doc.error);
+  return readModifyWrite(root, slug, (state) => {
+    if (state.spec.status !== "approved")
+      return err2("spec_not_approved", "spec must be approved before marking a handoff destination");
+    if (state.plan.status !== "approved")
+      return err2("plan_not_approved", "plan must be approved before marking a handoff destination");
+    if (state.handoff_destination) {
+      return err2("recursive_handoff", "this flow is already a handoff destination — a second handoff is rejected");
+    }
+    if (state.menu.chosen !== "handoff") {
+      return err2("handoff_not_chosen", `source menu choice must be "handoff" to mark a handoff destination (chosen: ${JSON.stringify(state.menu.chosen)})`);
+    }
+    return {
+      ok: true,
+      next: {
+        ...state,
+        handoff_destination: true,
+        menu: { presented: false, chosen: "", evidence: null },
+        updated_at: Date.now()
+      }
+    };
+  });
+};
+var CLI_CONFIRMATION_KEYS = ["attested", "confirmation", "host"];
+var validateLifecycleEvidence = (input) => {
+  if (typeof input !== "object" || input === null) {
+    return {
+      ok: false,
+      error: "lifecycle evidence required — native choice evidence or an exact CLI confirmation"
+    };
+  }
+  const record = input;
+  if (record.host === "cli") {
+    const validValue = record.attested === false && (record.confirmation === "flag" || record.confirmation === "tty");
+    const keys2 = Object.keys(record).sort();
+    const exactShape = keys2.length === CLI_CONFIRMATION_KEYS.length && CLI_CONFIRMATION_KEYS.every((key) => keys2.includes(key));
+    if (validValue && exactShape) {
+      return {
+        ok: true,
+        evidence: {
+          host: "cli",
+          attested: false,
+          confirmation: record.confirmation
+        }
+      };
+    }
+    return {
+      ok: false,
+      error: 'cli confirmations accept only the exact { host: "cli", attested: false, confirmation: "flag" | "tty" } shape'
+    };
+  }
+  return assertEvidenceShape(input);
+};
+var errPendingFlow = (action) => err2("flow_not_active", `cannot ${action} a pending flow — the execution menu has not started it`);
+var errCompletedFlow = (action) => err2("flow_already_completed", `cannot ${action} a completed flow`);
+var completeExecution = (root, slug, deps) => {
+  const file = flowPath(root, slug);
+  const captured = readEffectiveFlowState(root, slug);
+  if (!captured.ok)
+    return captured;
+  const exec3 = captured.state.execution;
+  if (exec3.status === "pending")
+    return errPendingFlow("complete");
+  if (exec3.status === "completed")
+    return errCompletedFlow("complete");
+  const ledger = ledgerCompletion(root, slug);
+  if (!ledger.complete) {
+    return err2("execution_incomplete", `execution ledger incomplete for ${slug}: missing tasks ${ledger.missing.join(", ")}`, { required: ledger.required, completed: ledger.completed, missing: ledger.missing });
+  }
+  const verifier = deps?.verifyProject ?? runVerifyProject;
+  const verify = verifier(root, false);
+  if (verify.exitCode !== 0) {
+    return err2("verification_failed", `repository verification failed for ${slug} (exit ${verify.exitCode}) — see the verification output`, { exitCode: verify.exitCode });
+  }
+  const locked = withFlowLock(file, () => {
+    const strict = readFlowStrict(root, slug);
+    if (!strict.ok)
+      return strict;
+    const reconciled = reconcileState(root, slug, strict.state);
+    const currentExec = reconciled.state.execution;
+    if (currentExec.status !== exec3.status || currentExec.mode !== exec3.mode) {
+      return err2("flow_concurrent_conflict", `concurrent execution state change detected for ${slug}: re-read the flow state and retry completion`);
+    }
+    const next = {
+      ...reconciled.state,
+      execution: { ...exec3, status: "completed" },
+      handoff_destination: false,
+      updated_at: Date.now()
+    };
+    const commit = writeFlowStateIfCurrent(root, captured.state, next);
+    if (commit.ok)
+      return { ok: true };
+    if ("io_error" in commit) {
+      return err2("flow_io_error", `flow state write failed for ${slug}: ${commit.io_error}`);
+    }
+    return err2("flow_concurrent_conflict", `concurrent flow update detected for ${slug}: re-read the flow state and retry completion`);
+  });
+  if (!locked.locked)
+    return locked.error;
+  return locked.value;
+};
+var transitionExecution = (root, slug, planPath, action, evidence, ctx, deps) => {
+  const bound = assertMutationWorkspace(root, ctx);
+  if (!bound.ok)
+    return bound;
+  const validated = validateLifecycleEvidence(evidence);
+  if (!validated.ok)
+    return err2("evidence_invalid", validated.error);
+  const doc = resolveDoc(root, slug, planPath, "plan");
+  if (!doc.ok)
+    return err2("path_invalid", doc.error);
+  if (action === "complete")
+    return completeExecution(root, slug, deps);
+  if (action === "pause") {
+    return readModifyWrite(root, slug, (state) => {
+      const exec3 = state.execution;
+      if (exec3.status === "pending")
+        return errPendingFlow("pause");
+      if (exec3.status === "completed")
+        return errCompletedFlow("pause");
+      if (exec3.status === "paused")
+        return err2("flow_already_paused", "flow is already paused");
+      return {
+        ok: true,
+        next: { ...state, execution: { ...exec3, status: "paused" }, updated_at: Date.now() }
+      };
+    });
+  }
+  return readModifyWrite(root, slug, (state) => {
+    const exec3 = state.execution;
+    if (exec3.status === "completed")
+      return errCompletedFlow("resume");
+    if (exec3.status !== "paused") {
+      return err2("flow_not_paused", exec3.status === "active" ? "flow is already active — cannot resume" : "cannot resume a pending flow — the execution menu has not started it");
+    }
+    return {
+      ok: true,
+      next: { ...state, execution: { ...exec3, status: "active" }, updated_at: Date.now() }
+    };
+  });
+};
+var slugFromPath = (p) => {
+  const dirName = path18.basename(path18.dirname(p));
+  return dirName === "." || dirName === "/" || dirName === "" ? "" : dirName;
+};
+var BASH_READ_TOKENS = new Set([
+  "cat",
+  "head",
+  "tail",
+  "less",
+  "more",
+  "grep",
+  "rg",
+  "ag",
+  "find",
+  "ls",
+  "stat",
+  "wc",
+  "file",
+  "diff",
+  "sort",
+  "uniq",
+  "cut",
+  "tr",
+  "fold",
+  "printf",
+  "echo",
+  "pwd",
+  "date",
+  "which",
+  "type",
+  "du",
+  "df",
+  "tree",
+  "jq",
+  "basename",
+  "dirname",
+  "realpath",
+  "readlink",
+  "rev",
+  "comm",
+  "paste",
+  "nl",
+  "od",
+  "xxd",
+  "awk",
+  "gawk",
+  "mawk",
+  "test",
+  "["
+]);
+var BASH_GIT_READ_SUBCOMMANDS = new Set([
+  "status",
+  "log",
+  "diff",
+  "show",
+  "branch",
+  "rev-parse",
+  "merge-base",
+  "remote",
+  "ls-files",
+  "blame",
+  "shortlog",
+  "describe",
+  "check-ignore",
+  "name-rev",
+  "stash",
+  "grep",
+  "tag"
+]);
+var BASH_GIT_MUTABLE_SUBCOMMANDS = new Set(["branch", "remote", "tag"]);
+var BASH_GIT_READ_FLAGS = {
+  branch: new Set([
+    "-a",
+    "--all",
+    "-r",
+    "--remotes",
+    "-v",
+    "--verbose",
+    "-vv",
+    "--show-current",
+    "-l",
+    "--list",
+    "--merged",
+    "--no-merged",
+    "--contains",
+    "--points-at",
+    "--format",
+    "--sort"
+  ]),
+  tag: new Set([
+    "-l",
+    "--list",
+    "--sort",
+    "--contains",
+    "--points-at",
+    "--merged",
+    "--no-merged",
+    "--format",
+    "--column"
+  ]),
+  remote: new Set(["-v", "--verbose"])
+};
+var BASH_FIND_DENIED_FLAGS = new Set(["-delete", "-exec", "-execdir", "-ok", "-okdir"]);
+var BASH_TEST_VERBS = new Set([
+  "test",
+  "check",
+  "lint",
+  "typecheck",
+  "verify",
+  "validate",
+  "vitest",
+  "jest",
+  "mocha"
+]);
+var BASH_DENIED_HEADS = new Set(["curl", "sudo", "tee", "wget"]);
+var BASH_OUTPUT_FLAG_VERBS = new Set(["sort", "tree", "comm", "diff", "jq"]);
+var BASH_PAREN_EXEMPT_HEADS = new Set(["echo", "printf", "jq"]);
+var BASH_GIT_VALUE_FLAGS = new Set([
+  "--contains",
+  "--points-at",
+  "--merged",
+  "--no-merged",
+  "--sort",
+  "--format"
+]);
+var COORDINATOR_SHELL_DENIED_TEXT = "Coordinator shell commands are restricted while a subagent-driven plan is " + "active: only bounded read/test/review commands are allowed (the exact " + "allowlist is in flow-state.ts, isCoordinatorBashAllowed). " + COORDINATOR_RECOVERY_TEXT;
+
+// packages/workit-core/src/core/handoff-tools.ts
+import path20 from "node:path";
+
+// packages/workit-core/src/core/handoff-context.ts
+import { existsSync as existsSync15, readFileSync as readFileSync14, readdirSync as readdirSync5, statSync as statSync8 } from "node:fs";
+import path19 from "node:path";
+var DOC_RE = /docs\/([A-Za-z0-9][A-Za-z0-9._-]*)\/(spec|plan)\.md/g;
+var listMd = (dir) => {
+  try {
+    return readdirSync5(dir).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    return [];
+  }
+};
+var extractMessagePaths = (message) => [...new Set(message.match(DOC_RE) ?? [])].sort();
+var resolveFromMessagePaths = (root, message) => {
+  const paths = extractMessagePaths(message);
+  if (paths.length === 0)
+    return { error: "no paths" };
+  const slugs = [...new Set(paths.map((p) => p.split("/")[1]))];
+  if (slugs.length !== 1)
+    return { error: "multiple features in message — use exactly one docs/<slug>/ pair" };
+  const slug = slugs[0];
+  const plan = `docs/${slug}/plan.md`;
+  const spec = `docs/${slug}/spec.md`;
+  if (!existsSync15(path19.join(root, plan)) || !existsSync15(path19.join(root, spec))) {
+    return { error: `docs/${slug}/ must contain both plan.md and spec.md` };
+  }
+  return { spec, plan, source: "message_paths" };
+};
+var resolveActivePair = (root) => {
+  const docsDir = path19.join(root, "docs");
+  let best = null;
+  let entries = [];
+  try {
+    entries = readdirSync5(docsDir);
+  } catch {
+    return { error: "no pair" };
+  }
+  for (const slug of entries) {
+    if (slug.startsWith("."))
+      continue;
+    const plan = path19.join("docs", slug, "plan.md");
+    const spec = path19.join("docs", slug, "spec.md");
+    if (!existsSync15(path19.join(root, plan)) || !existsSync15(path19.join(root, spec)))
+      continue;
+    const score = Math.max(statSync8(path19.join(root, spec)).mtimeMs, statSync8(path19.join(root, plan)).mtimeMs);
+    if (best === null || score > best.score || score === best.score && slug < best.spec.split("/")[1]) {
+      best = { score, spec, plan, source: "active_pair" };
+    }
+  }
+  if (best === null)
+    return { error: "no pair" };
+  return { spec: best.spec, plan: best.plan, source: best.source };
+};
+var resolveWorkflowPaths = (root, message) => {
+  const fromMessage = resolveFromMessagePaths(root, message);
+  if (!("error" in fromMessage))
+    return fromMessage;
+  if (fromMessage.error !== "no paths")
+    return fromMessage;
+  const active = resolveActivePair(root);
+  if (!("error" in active))
+    return active;
+  const docsDir = path19.join(root, "docs");
+  if (!existsSync15(docsDir) || listMd(docsDir).length === 0) {
+    return { error: "no docs/<slug>/ features found under docs/" };
+  }
+  return {
+    error: "could not resolve spec and plan — mention docs/<slug>/plan.md or create docs/<slug>/{spec.md,plan.md}"
+  };
+};
+var buildHandoffContract = ({
+  root,
+  spec,
+  plan,
+  templatePath
+}) => {
+  const validated = docsValidate({ spec_path: spec, plan_path: plan, workspace_root: root });
+  if (validated.ok === false) {
+    return {
+      error: `docs validation failed
+${JSON.stringify({ ok: false, errors: validated.errors })}`
+    };
+  }
+  const branchResolved = resolveBranch({ spec_path: spec, plan_path: plan, workspace_root: root });
+  if ("error" in branchResolved)
+    return { error: branchResolved.error };
+  const branch = branchResolved.branch;
+  const slug = path19.basename(path19.dirname(plan));
+  const sddDir = `docs/${slug}/sdd`;
+  const planText = readFileSync14(path19.join(root, plan), "utf8");
+  const tasks = parseTasksFromPlan(planText);
+  const taskList = tasks.map((t) => `- Task ${t.id}: ${t.title}`).join(`
+`);
+  let contract;
+  try {
+    contract = readFileSync14(templatePath, "utf8");
+  } catch {
+    return { error: "missing template templates/execution-contract.md" };
+  }
+  contract = contract.replace(/<SPEC_PATH>/g, spec).replace(/<PLAN_PATH>/g, plan).replace(/<BRANCH>/g, branch).replace(/<SLUG>/g, slug).replace(/<SDD_DIR>/g, sddDir).replace(/<TASK_LIST>/g, taskList);
+  if (!/^<workflow-handoff-destination>true<\/workflow-handoff-destination>$/m.test(contract)) {
+    return { error: "handoff destination contract missing its destination marker" };
+  }
+  return { prompt: contract };
+};
+
+// packages/workit-core/src/core/handoff-tools.ts
+var buildHandoffPrompt = (root, message) => {
+  const resolved = resolveWorkflowPaths(root, message);
+  if ("error" in resolved)
+    return { error: resolved.error };
+  const templatePath = path20.join(assetRoot(), "templates", "execution-contract.md");
+  const contract = buildHandoffContract({
+    root,
+    spec: resolved.spec,
+    plan: resolved.plan,
+    templatePath
+  });
+  if ("error" in contract)
+    return { error: contract.error };
+  const sdd = `docs/${path20.basename(path20.dirname(resolved.plan))}/sdd`;
+  return { prompt: contract.prompt, spec: resolved.spec, plan: resolved.plan, sdd };
+};
+
+// packages/workit-cli/src/flow.ts
+var FLOW_ACTIONS = ["status", "pause", "resume", "complete"];
+var COMMANDS = {
+  status: "workit flow status --plan <path>",
+  pause: "workit flow pause --plan <path> [--confirm]",
+  resume: "workit flow resume --plan <path> [--confirm]",
+  complete: "workit flow complete --plan <path> [--confirm]",
+  handoff: "workit handoff --message <text>"
+};
+var FLOW_COMMANDS = {
+  status: COMMANDS.status,
+  pause: COMMANDS.pause,
+  resume: COMMANDS.resume,
+  complete: COMMANDS.complete
+};
+var CLI_FLAG_EVIDENCE = { host: "cli", attested: false, confirmation: "flag" };
+var CLI_TTY_EVIDENCE = { host: "cli", attested: false, confirmation: "tty" };
+var defaultIsTTY = () => process.stdin.isTTY === true;
+var defaultConfirm = async (out) => {
+  const rl = createInterface({
+    input: process.stdin,
+    output: out ?? process.stdout
+  });
+  try {
+    const answer = await rl.question("Proceed? [y/N] ");
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+};
+var outStream = (deps) => deps.out ?? process.stdout;
+var errStream = (deps) => deps.err ?? process.stderr;
+var write = (stream, text) => stream.write(text.endsWith(`
+`) ? text : `${text}
+`);
+var writeJSON = (stream, value) => write(stream, JSON.stringify(value, null, 2));
+var isTTY = (deps) => deps.stdinIsTTY === undefined ? defaultIsTTY() : deps.stdinIsTTY();
+var workspaceRoot = (deps) => process.env.WORKFLOW_WORKSPACE_ROOT ?? deps.cwd ?? process.cwd();
+var domainFail = (err3, code, error, details) => {
+  writeJSON(err3, { ok: false, error, code, ...details ? { details } : {} });
+  return 1;
+};
+var usage = (err3, text) => {
+  write(err3, text);
+  return 2;
+};
+function parseFlowFlags(action, argv, err3) {
+  let plan;
+  let confirm = false;
+  for (let i = 0;i < argv.length; i++) {
+    const token = argv[i];
+    if (token === "--plan") {
+      if (plan !== undefined) {
+        usage(err3, `usage: ${FLOW_COMMANDS[action]} — duplicate --plan flag`);
+        return { ok: false };
+      }
+      const value = argv[i + 1];
+      if (value === undefined || value.trim() === "") {
+        usage(err3, `usage: ${FLOW_COMMANDS[action]} — --plan requires a non-empty path`);
+        return { ok: false };
+      }
+      if (value.startsWith("--")) {
+        usage(err3, `usage: ${FLOW_COMMANDS[action]} — unknown flag: ${value}`);
+        return { ok: false };
+      }
+      plan = value;
+      i += 1;
+    } else if (token === "--confirm") {
+      if (action === "status") {
+        usage(err3, `usage: ${FLOW_COMMANDS[action]} — status is read-only and accepts no --confirm`);
+        return { ok: false };
+      }
+      if (confirm) {
+        usage(err3, `usage: ${FLOW_COMMANDS[action]} — duplicate --confirm flag`);
+        return { ok: false };
+      }
+      confirm = true;
+    } else {
+      usage(err3, `usage: ${FLOW_COMMANDS[action]} — unknown flag: ${token}`);
+      return { ok: false };
+    }
+  }
+  if (plan === undefined) {
+    usage(err3, `usage: ${FLOW_COMMANDS[action]} — --plan <path> required`);
+    return { ok: false };
+  }
+  return { ok: true, parsed: { plan, confirm } };
+}
+async function resolveConfirmation(deps, confirmFlag, out, err3) {
+  if (confirmFlag)
+    return CLI_FLAG_EVIDENCE;
+  if (!isTTY(deps)) {
+    usage(err3, "--confirm required when stdin is not a TTY");
+    return null;
+  }
+  const answered = deps.confirm ? await deps.confirm() : await defaultConfirm(out);
+  if (!answered) {
+    usage(err3, "cancelled — no confirmation");
+    return null;
+  }
+  return CLI_TTY_EVIDENCE;
+}
+function statusCommand(root, plan, out, err3) {
+  const resolved = resolveCanonicalLayout({ workspace_root: root, plan_path: plan });
+  if (!resolved.ok)
+    return domainFail(err3, "path_invalid", resolved.error);
+  const effective = readEffectiveFlowState(root, resolved.layout.slug);
+  if (!effective.ok)
+    return domainFail(err3, effective.code, effective.error, effective.details);
+  const { state, drift } = effective;
+  writeJSON(out, {
+    ok: true,
+    slug: state.slug,
+    spec: state.spec,
+    plan: state.plan,
+    menu: state.menu,
+    execution: state.execution,
+    handoff_destination: state.handoff_destination,
+    drift,
+    flow_path: path21.posix.join("docs", state.slug, "sdd", "flow.json")
+  });
+  return 0;
+}
+function mutateCommand(root, plan, action, evidence, deps, out, err3) {
+  const resolved = resolveCanonicalLayout({ workspace_root: root, plan_path: plan });
+  if (!resolved.ok)
+    return domainFail(err3, "path_invalid", resolved.error);
+  const result2 = transitionExecution(root, resolved.layout.slug, plan, action, evidence, undefined, deps.verifyProject ? { verifyProject: deps.verifyProject } : undefined);
+  if (!result2.ok)
+    return domainFail(err3, result2.code, result2.error, result2.details);
+  const effective = readEffectiveFlowState(root, resolved.layout.slug);
+  if (!effective.ok)
+    return domainFail(err3, effective.code, effective.error, effective.details);
+  writeJSON(out, {
+    ok: true,
+    plan,
+    execution: effective.state.execution,
+    drift: effective.drift
+  });
+  return 0;
+}
+async function runFlowCommand(argv, deps = {}) {
+  const out = outStream(deps);
+  const err3 = errStream(deps);
+  const [action, ...rest2] = argv;
+  if (!action || !FLOW_ACTIONS.includes(action)) {
+    return usage(err3, "usage: workit flow <status|pause|resume|complete> --plan <path> [--confirm]");
+  }
+  const flowAction = action;
+  const parsed = parseFlowFlags(flowAction, rest2, err3);
+  if (!parsed.ok)
+    return 2;
+  const root = workspaceRoot(deps);
+  if (flowAction === "status") {
+    return statusCommand(root, parsed.parsed.plan, out, err3);
+  }
+  const evidence = await resolveConfirmation(deps, parsed.parsed.confirm, out, err3);
+  if (evidence === null)
+    return 2;
+  return mutateCommand(root, parsed.parsed.plan, flowAction, evidence, deps, out, err3);
+}
+async function runHandoffCommand(argv, deps = {}) {
+  const out = outStream(deps);
+  const err3 = errStream(deps);
+  const [flag, value, ...rest2] = argv;
+  if (flag !== "--message" || value === undefined || value.trim() === "" || rest2.length > 0) {
+    return usage(err3, `usage: ${COMMANDS.handoff}`);
+  }
+  const root = workspaceRoot(deps);
+  const built = buildHandoffPrompt(root, value.trim());
+  if ("error" in built) {
+    writeJSON(err3, { ok: false, error: built.error, code: "handoff_build_failed" });
+    return 1;
+  }
+  const marked = markHandoffDestination(root, slugFromPath(built.plan), built.plan);
+  if (!marked.ok)
+    return domainFail(err3, marked.code, marked.error, marked.details);
+  write(out, built.prompt);
+  return 0;
+}
+
+// packages/workit-cli/src/index.tsx
+var jsx_dev_runtime2 = __toESM(require_jsx_dev_runtime(), 1);
+var logger = createLogger({
+  stderr: (event) => {
+    if (event.level === "debug" || event.level === "info")
+      return;
+    process.stderr.write(`${JSON.stringify(event)}
+`);
+  }
+});
+var COMMAND_DESCRIPTIONS = [
+  [COMMANDS.status, "Read the effective flow state for a plan"],
+  [COMMANDS.pause, "Pause an active plan"],
+  [COMMANDS.resume, "Resume a paused plan"],
+  [COMMANDS.complete, "Complete a plan (ledger and verification gated)"],
+  [COMMANDS.handoff, "Emit the destination handoff prompt for a plan"]
+];
 var HELP = `workit — workflow rails for agentic coding
 
 Usage:
   workit init      Run the interactive setup wizard
   workit doctor    Verify the offline installation health (add --json for a machine-readable report)
+${COMMAND_DESCRIPTIONS.map(([cmd, desc]) => `  ${cmd.padEnd(49)}${desc}`).join(`
+`)}
   workit           Show this help
 
 Run \`npx workit init\` to configure platforms, YouTrack, VCS and project hygiene.
@@ -46268,14 +48495,18 @@ if (__require.main == __require.module) {
   setDiagnosticLogger(logger);
   logger.info(EVENT.initialization, { host: "cli", command: subcommand });
   process.on("unhandledRejection", (reason) => logger.error(EVENT.uncaughtFailure, { phase: "unhandledRejection", ...errorDetail(reason) }));
-  process.on("uncaughtException", (err) => {
-    logger.error(EVENT.uncaughtFailure, { phase: "uncaughtException", ...errorDetail(err) });
+  process.on("uncaughtException", (err3) => {
+    logger.error(EVENT.uncaughtFailure, { phase: "uncaughtException", ...errorDetail(err3) });
     process.exit(1);
   });
   if (subcommand === "init") {
     await runInit();
   } else if (subcommand === "doctor") {
     runDoctorCommand(args);
+  } else if (subcommand === "flow") {
+    process.exit(await runFlowCommand(args.slice(1)));
+  } else if (subcommand === "handoff") {
+    process.exit(await runHandoffCommand(args.slice(1)));
   } else {
     console.log(HELP);
     process.exit(0);