@brainervirus/workit-cli 2.2.2 → 2.4.0

package/dist/index.js

@@ -73016,15 +73016,1851 @@ var init_check = __esm(() => {
   run12 = notImplemented("check", "S9b");
 });
 
+// packages/workit-core/src/git/rev.ts
+import { spawnSync as spawnSync13 } from "node:child_process";
+import { createHash as createHash12 } from "node:crypto";
+import fs15 from "node:fs";
+import os12 from "node:os";
+import path34 from "node:path";
+function networkGitInvocation(cwd, args, timeoutMs) {
+  const seconds = Math.max(1, Math.ceil(timeoutMs / 1000));
+  const env = {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_ASKPASS: "",
+    SSH_ASKPASS: "",
+    SSH_ASKPASS_REQUIRE: "never",
+    GCM_INTERACTIVE: "never"
+  };
+  const base = process.env.GIT_SSH_COMMAND || line(git(cwd, ["config", "--get", "core.sshCommand"])) || (process.env.GIT_SSH ? null : "ssh");
+  if (base)
+    env.GIT_SSH_COMMAND = `${base} -o BatchMode=yes -o ConnectTimeout=${Math.min(10, seconds)}`;
+  return {
+    args: ["-c", "http.lowSpeedLimit=1", "-c", `http.lowSpeedTime=${seconds}`, ...args],
+    env
+  };
+}
+function redactRemote(raw) {
+  const value = raw.trim();
+  if (!value)
+    return UNPARSEABLE;
+  if (/^[A-Za-z][A-Za-z0-9+.-]*::/u.test(value))
+    return UNPARSEABLE;
+  if (/^[A-Za-z]:[\\/]/u.test(value) || value.startsWith("/") || value.startsWith("."))
+    return value;
+  if (!/[:@]/u.test(value))
+    return value;
+  if (!value.includes("://")) {
+    if (/^[^/@]*:[^/]*@/u.test(value))
+      return UNPARSEABLE;
+    const scp = /^(?:([^@\s/:]+)@)?([^:/\s]+):([^?#]+)/u.exec(value);
+    return scp ? `${scp[1] ? `${scp[1]}@` : ""}${scp[2]}:${scp[3]}` : UNPARSEABLE;
+  }
+  try {
+    const url = new URL(value);
+    const ssh = /^(?:ssh|git\+ssh|ssh\+git):$/u.test(url.protocol);
+    url.password = "";
+    if (!ssh)
+      url.username = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return UNPARSEABLE;
+  }
+}
+function headSha(cwd) {
+  return line(git(cwd, ["rev-parse", "--verify", "-q", "HEAD^{commit}"]));
+}
+function worktreeTree(cwd, options = {}) {
+  const top = line(git(cwd, ["rev-parse", "--show-toplevel"]));
+  const indexPath = line(git(cwd, ["rev-parse", "--path-format=absolute", "--git-path", "index"]));
+  if (!top || !indexPath)
+    return null;
+  const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
+  const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
+  const scratch = fs15.mkdtempSync(path34.join(os12.tmpdir(), "workit-tree-"));
+  try {
+    const tempIndex = path34.join(scratch, "index");
+    if (fs15.existsSync(indexPath))
+      seedIndex(indexPath, tempIndex);
+    const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
+    const untracked = git(top, ["ls-files", "--others", "--exclude-standard", "-z"], {
+      env,
+      timeoutMs
+    });
+    if (!untracked.ok)
+      return null;
+    const skipped = [];
+    for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
+      try {
+        const stat = fs15.statSync(path34.join(top, file));
+        if (stat.isFile() && stat.size > cap)
+          skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
+      } catch {}
+    }
+    skipped.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    const added = skipped.length ? git(top, ["add", "-A", "--pathspec-from-file=-", "--pathspec-file-nul"], {
+      env,
+      timeoutMs,
+      input: [".", ...skipped.map((file) => `:(exclude,literal)${file.path}`)].join("\x00")
+    }) : git(top, ["add", "-A"], { env, timeoutMs });
+    if (!added.ok)
+      return null;
+    const tree = line(git(top, ["write-tree"], { env, timeoutMs }));
+    if (!tree)
+      return null;
+    const base = line(git(top, ["rev-parse", "--verify", "-q", "HEAD^{tree}"])) ?? emptyTree(top);
+    const key = skipped.length ? `sha256:${createHash12("sha256").update(JSON.stringify({ tree, skipped })).digest("hex")}` : tree;
+    return { tree, key, dirty: tree !== base || skipped.length > 0, skipped };
+  } finally {
+    fs15.rmSync(scratch, { recursive: true, force: true });
+  }
+}
+function patchId(cwd, base, head) {
+  if (!safeArg(base) || !safeArg(head))
+    return null;
+  const diff = git(cwd, [
+    "diff",
+    "-U3",
+    "--diff-algorithm=myers",
+    "--indent-heuristic",
+    "--no-color",
+    "--no-ext-diff",
+    "--no-textconv",
+    "--no-renames",
+    "--full-index",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    `${base}...${head}`,
+    "--"
+  ]);
+  if (!diff.ok || !diff.stdout.trim())
+    return null;
+  const id = git(cwd, ["patch-id", "--stable"], { input: diff.stdout });
+  return line(id)?.split(/\s+/u)[0] ?? null;
+}
+function fetchRefs(cwd, remote, refspecs, options = {}) {
+  if (!safeArg(remote) || refspecs.length === 0 || !refspecs.every((spec) => safeArg(spec.replace(/^\+/u, ""))))
+    return { ok: false, code: "invalid_input", error: "remote and refspecs must not start with -" };
+  const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.network;
+  const fetched = gitNetwork(cwd, [
+    "fetch",
+    "--no-tags",
+    "--no-recurse-submodules",
+    "--no-write-fetch-head",
+    "--quiet",
+    remote,
+    ...refspecs
+  ], timeoutMs);
+  if (fetched.ok)
+    return { ok: true };
+  if (/\.lock'?:? File exists|unable to lock|another git process/iu.test(fetched.stderr))
+    return {
+      ok: false,
+      code: "busy",
+      error: `git fetch ${redactRemote(remote)}: the repository is locked by another git process`
+    };
+  return {
+    ok: false,
+    code: "unavailable",
+    error: fetched.timedOut ? `git fetch ${redactRemote(remote)} timed out after ${timeoutMs} ms` : `git fetch ${redactRemote(remote)} failed (unreachable, not authorized, or ref missing)`
+  };
+}
+function remoteNames(cwd) {
+  return (git(cwd, ["remote"]).stdout ?? "").split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+}
+function gitCommonDir(cwd) {
+  return line(git(cwd, ["rev-parse", "--path-format=absolute", "--git-common-dir"]));
+}
+function hasCommit(cwd, rev) {
+  if (!safeArg(rev))
+    return false;
+  return git(cwd, ["cat-file", "-e", `${rev}^{commit}`]).ok;
+}
+function resolveRef(cwd, ref) {
+  if (!safeArg(ref))
+    return null;
+  return line(git(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]));
+}
+function aheadBehind(cwd, base, head) {
+  if (!safeArg(base) || !safeArg(head))
+    return null;
+  const counted = line(git(cwd, ["rev-list", "--left-right", "--count", `${base}...${head}`]));
+  const match = counted ? /^(\d+)\s+(\d+)$/u.exec(counted) : null;
+  if (!match)
+    return null;
+  const upToDate = git(cwd, ["merge-base", "--is-ancestor", base, head]).ok;
+  return { behind: Number(match[1]), ahead: Number(match[2]), upToDate };
+}
+function currentBranch2(cwd) {
+  return line(git(cwd, ["symbolic-ref", "--short", "-q", "HEAD"]));
+}
+function pushRemoteName(cwd, branch) {
+  const name = branch ?? currentBranch2(cwd);
+  const remotes = remoteNames(cwd);
+  const candidates = [
+    name ? config2(cwd, `branch.${name}.pushRemote`) : null,
+    config2(cwd, "remote.pushDefault"),
+    name ? config2(cwd, `branch.${name}.remote`) : null
+  ];
+  for (const candidate of candidates)
+    if (candidate && candidate !== "." && remotes.includes(candidate))
+      return candidate;
+  if (remotes.includes("origin"))
+    return "origin";
+  return remotes.length === 1 ? remotes[0] : null;
+}
+function pushUrl(cwd, remote) {
+  if (!safeArg(remote))
+    return null;
+  const urls = git(cwd, ["remote", "get-url", "--push", "--all", remote]).stdout.split(/\r?\n/u).map((value) => value.trim()).filter(Boolean);
+  return urls.length === 1 ? urls[0] : null;
+}
+function parseRemoteUrl(raw) {
+  const value = raw.trim();
+  if (!value || /^[A-Za-z][A-Za-z0-9+.-]*::/u.test(value))
+    return null;
+  if (/^[A-Za-z]:[\\/]/u.test(value) || value.startsWith("/") || value.startsWith(".")) {
+    return { protocol: "file", user: null, host: "", port: null, path: value };
+  }
+  if (!value.includes("://")) {
+    if (/^[^/@]*:[^/]*@/u.test(value))
+      return null;
+    const scp = /^(?:([^@\s/:]+)@)?([^:/\s]+):(.+)$/u.exec(value);
+    if (!scp)
+      return null;
+    return {
+      protocol: "ssh",
+      user: scp[1] ?? null,
+      host: scp[2],
+      port: null,
+      path: cleanPath(scp[3])
+    };
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  const scheme = url.protocol.replace(/:$/u, "");
+  const protocol = scheme === "ssh" || scheme === "git+ssh" || scheme === "ssh+git" ? "ssh" : scheme === "https" || scheme === "http" || scheme === "git" || scheme === "file" ? scheme : null;
+  if (!protocol)
+    return null;
+  return {
+    protocol,
+    user: protocol === "ssh" && url.username ? decodeURIComponent(url.username) : null,
+    host: url.hostname.replace(/\.$/u, ""),
+    port: url.port || null,
+    path: cleanPath(decodeURIComponent(url.pathname))
+  };
+}
+function readSshConfig(home = os12.homedir()) {
+  try {
+    return { text: fs15.readFileSync(path34.join(home, ".ssh", "config"), "utf8"), home };
+  } catch {
+    return { text: "", home };
+  }
+}
+function resolveSshHost(alias, sshConfig) {
+  const source = typeof sshConfig === "string" ? { text: sshConfig, home: os12.homedir() } : sshConfig;
+  let hostname = null;
+  let port = null;
+  const evaluate = (text, initiallyActive, neverMatch, depth) => {
+    let active = initiallyActive;
+    for (const { key, args } of directives(text)) {
+      if (key === "host") {
+        active = !neverMatch && hostMatches(args, alias);
+        continue;
+      }
+      if (key === "match") {
+        active = false;
+        continue;
+      }
+      if (key === "include") {
+        if (depth >= 16)
+          continue;
+        for (const spec of args)
+          for (const file of includeFiles(spec, source.home)) {
+            let included;
+            try {
+              included = fs15.readFileSync(file, "utf8");
+            } catch {
+              continue;
+            }
+            evaluate(included, active, neverMatch || !active, depth + 1);
+          }
+        continue;
+      }
+      if (!active || args.length === 0)
+        continue;
+      if (key === "hostname" && hostname === null)
+        hostname = args[0].replace(/%(%|h)/gu, (_, token) => token === "h" ? alias : "%");
+      if (key === "port" && port === null)
+        port = args[0];
+    }
+  };
+  evaluate(source.text, true, false, 0);
+  return { hostname: (hostname ?? alias).replace(/\.$/u, ""), port };
+}
+function deriveForge(url, options = {}) {
+  const parsed = parseRemoteUrl(url);
+  if (!parsed || parsed.protocol === "file" || !parsed.host)
+    return null;
+  const segments = parsed.path.split("/").filter(Boolean);
+  if (segments.length < 2)
+    return null;
+  const hostname = (parsed.protocol === "ssh" ? resolveSshHost(parsed.host, options.sshConfig ?? readSshConfig()).hostname : parsed.host).toLowerCase();
+  const withPort = parsed.protocol !== "ssh" && parsed.port ? `${hostname}:${parsed.port}` : hostname;
+  const base = { host: parsed.host, hostname, repo: segments.join("/") };
+  const known = KNOWN_HOSTS[hostname];
+  if (known) {
+    if (known.kind === "github" && segments.length !== 2)
+      return null;
+    return { ...base, kind: known.kind, apiHost: known.apiHost, via: "known_host" };
+  }
+  for (const kind of ["github", "gitlab"]) {
+    const hosts = new Set((options.hosts?.[kind] ?? []).map(normalizeHost));
+    if (hosts.has(withPort) || hosts.has(hostname)) {
+      const apiHost = hosts.has(withPort) ? withPort : hostname;
+      return { ...base, kind, apiHost, via: "configured_host" };
+    }
+  }
+  const label = hostname.split(".")[0];
+  if ((label === "github" || label === "gitlab") && hostname.includes("."))
+    return { ...base, kind: label, apiHost: withPort, via: "host_name" };
+  return null;
+}
+function pushForge(cwd, options = {}) {
+  const remote = pushRemoteName(cwd, options.branch);
+  if (!remote)
+    return {
+      ok: false,
+      code: "not_found",
+      error: "no push remote is configured for this branch",
+      unblock: "git remote add origin <url>"
+    };
+  const url = pushUrl(cwd, remote);
+  if (!url)
+    return {
+      ok: false,
+      code: "unavailable",
+      error: `remote "${remote}" has no single push URL`,
+      unblock: `git remote get-url --push --all ${remote}  # keep exactly one push URL`
+    };
+  const forge = deriveForge(url, options);
+  if (!forge) {
+    const host = parseRemoteUrl(url)?.host || null;
+    return {
+      ok: false,
+      code: "unavailable",
+      error: host ? `cannot tell whether push host "${host}" is GitHub or GitLab` : `push URL ${redactRemote(url)} of remote "${remote}" is not a GitHub/GitLab URL`,
+      unblock: host ? `map the alias in ~/.ssh/config (Host ${host} / HostName github.com|gitlab.com) or set github.host / gitlab.host in ~/.config/workit/vcs.json` : `git remote set-url --push ${remote} <ssh-or-https-url>`
+    };
+  }
+  return { ok: true, remote, url: redactRemote(url), forge };
+}
+function forgeConflict(derived, configuredProvider) {
+  const configured = configuredProvider?.trim().toLowerCase();
+  if (!configured || configured === derived.kind)
+    return null;
+  return {
+    code: "blocked",
+    error: `forge_mismatch: push remote ${derived.host} is ${derived.kind} but the workspace vcs.provider is ${configured}`,
+    unblock: `set vcs.provider to "${derived.kind}" for this repo in ~/.config/workit/workspaces.json (workit-github-override), or push to a ${configured} remote`
+  };
+}
+var MAX_BUFFER, GIT_TIMEOUTS, git = (cwd, args, options = {}) => {
+  const result = spawnSync13("git", args, {
+    cwd,
+    encoding: "utf8",
+    env: options.env ?? process.env,
+    input: options.input,
+    maxBuffer: MAX_BUFFER,
+    timeout: options.timeoutMs ?? GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const error = result.error;
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    timedOut: error?.code === "ETIMEDOUT"
+  };
+}, line = (run) => {
+  if (!run.ok)
+    return null;
+  const value = run.stdout.trim();
+  return value ? value : null;
+}, safeArg = (value) => value.length > 0 && !value.startsWith("-"), WATCHDOG = `
+const cp = require("node:child_process");
+const { ms, args } = JSON.parse(process.env.WORKIT_GIT_WATCHDOG);
+delete process.env.WORKIT_GIT_WATCHDOG;
+const win = process.platform === "win32";
+const child = cp.spawn("git", args, { stdio: "inherit", detached: !win, windowsHide: true });
+const killTree = () => {
+  if (!child.pid) return;
+  if (win) cp.spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+  else try { process.kill(-child.pid, "SIGKILL"); } catch {}
+};
+let timedOut = false;
+const timer = setTimeout(() => { timedOut = true; killTree(); }, ms);
+child.on("error", () => { clearTimeout(timer); process.exit(127); });
+child.on("exit", (code) => {
+  clearTimeout(timer);
+  if (!win) killTree();
+  process.exit(timedOut ? 124 : code ?? 1);
+});
+`, WATCHDOG_TIMEOUT_EXIT = 124, gitNetwork = (cwd, args, timeoutMs) => {
+  const invocation = networkGitInvocation(cwd, args, timeoutMs);
+  const result = spawnSync13(process.execPath, ["-e", WATCHDOG], {
+    cwd,
+    encoding: "utf8",
+    env: {
+      ...invocation.env,
+      WORKIT_GIT_WATCHDOG: JSON.stringify({ ms: timeoutMs, args: invocation.args })
+    },
+    maxBuffer: MAX_BUFFER,
+    timeout: timeoutMs + 1e4,
+    killSignal: "SIGKILL",
+    windowsHide: true
+  });
+  const error = result.error;
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    timedOut: result.status === WATCHDOG_TIMEOUT_EXIT || error?.code === "ETIMEDOUT"
+  };
+}, UNPARSEABLE = "<unparseable remote>", emptyTree = (cwd) => line(git(cwd, ["mktree"], { input: "" })), MAX_UNTRACKED_BYTES, seedIndex = (from, to) => {
+  fs15.copyFileSync(from, to);
+  const { atimeNs, mtimeNs } = fs15.statSync(from, { bigint: true });
+  const seconds = (ns) => (Number(ns / 1000n) - 1) / 1e6;
+  fs15.utimesSync(to, seconds(atimeNs), seconds(mtimeNs));
+}, config2 = (cwd, key) => line(git(cwd, ["config", "--get", key])), cleanPath = (value) => value.replace(/^\/+/u, "").replace(/\/+$/u, "").replace(/\.git$/u, ""), globToRegExp2 = (pattern) => new RegExp(`^${pattern.split("").map((char) => char === "*" ? ".*" : char === "?" ? "." : char.replace(/[.+^${}()|[\]\\]/gu, "\\$&")).join("")}$`, "iu"), hostMatches = (patterns, host) => {
+  let matched = false;
+  for (const pattern of patterns) {
+    const negated = pattern.startsWith("!");
+    if (globToRegExp2(negated ? pattern.slice(1) : pattern).test(host)) {
+      if (negated)
+        return false;
+      matched = true;
+    }
+  }
+  return matched;
+}, tokens = (rest) => [...rest.matchAll(/"([^"]*)"|(\S+)/gu)].map((match) => match[1] ?? match[2]), directives = (text) => text.split(/\r?\n/u).flatMap((raw) => {
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed.startsWith("#"))
+    return [];
+  const match = /^(\S+?)(?:\s*=\s*|\s+)(.*)$/u.exec(trimmed);
+  if (!match)
+    return [];
+  return [{ key: match[1].toLowerCase(), args: tokens(match[2]) }];
+}), includeFiles = (spec, home) => {
+  const expanded = spec.startsWith("~") ? path34.join(home, spec.slice(1)) : spec;
+  const absolute = path34.isAbsolute(expanded) ? expanded : path34.join(home, ".ssh", expanded);
+  const dir = path34.dirname(absolute);
+  const base = path34.basename(absolute);
+  if (!/[*?]/u.test(base))
+    return [absolute];
+  try {
+    const pattern = globToRegExp2(base);
+    return fs15.readdirSync(dir).filter((name) => pattern.test(name)).toSorted().map((name) => path34.join(dir, name));
+  } catch {
+    return [];
+  }
+}, KNOWN_HOSTS, normalizeHost = (value) => value.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "").replace(/\.$/u, "");
+var init_rev = __esm(() => {
+  MAX_BUFFER = 256 * 1024 * 1024;
+  GIT_TIMEOUTS = { local: 20000, worktree: 120000, network: 15000 };
+  MAX_UNTRACKED_BYTES = 5 * 1024 * 1024;
+  KNOWN_HOSTS = {
+    "github.com": { kind: "github", apiHost: "github.com" },
+    "ssh.github.com": { kind: "github", apiHost: "github.com" },
+    "gitlab.com": { kind: "gitlab", apiHost: "gitlab.com" },
+    "altssh.gitlab.com": { kind: "gitlab", apiHost: "gitlab.com" }
+  };
+});
+
+// packages/workit-core/src/forge/reruns.ts
+import fs16 from "node:fs";
+import path35 from "node:path";
+function rerunLogPath(cwd) {
+  const common = gitCommonDir(cwd);
+  return common ? path35.join(common, "workit", "ci-reruns.jsonl") : null;
+}
+function rerunCounts(cwd, key) {
+  const counts = new Map;
+  const file = rerunLogPath(cwd);
+  if (!file)
+    return counts;
+  let text;
+  try {
+    text = fs16.readFileSync(file, "utf8");
+  } catch {
+    return counts;
+  }
+  for (const raw of text.split(`
+`)) {
+    if (!raw.trim())
+      continue;
+    let row;
+    try {
+      row = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (isRow(row) && row.repo === key.repo && row.pr === key.pr && row.head === key.head)
+      counts.set(row.check, (counts.get(row.check) ?? 0) + 1);
+  }
+  return counts;
+}
+function recordReruns(cwd, rows) {
+  if (rows.length === 0)
+    return true;
+  const file = rerunLogPath(cwd);
+  if (!file)
+    return false;
+  try {
+    fs16.mkdirSync(path35.dirname(file), { recursive: true });
+    fs16.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
+`).join(""));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function withRerunLock(cwd, fn) {
+  const file = rerunLogPath(cwd);
+  if (!file)
+    return fn();
+  const lock = `${file.slice(0, -".jsonl".length)}.lock`;
+  fs16.mkdirSync(path35.dirname(lock), { recursive: true });
+  const until = Date.now() + LOCK_WAIT_MS;
+  for (;; ) {
+    try {
+      fs16.closeSync(fs16.openSync(lock, "wx"));
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      try {
+        if (Date.now() - fs16.statSync(lock).mtimeMs > LOCK_STALE_MS) {
+          fs16.rmSync(lock, { force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() >= until)
+        return null;
+      pause(50);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    fs16.rmSync(lock, { force: true });
+  }
+}
+var isRow = (value) => {
+  const row = value;
+  return !!row && row.type === "ci.rerun" && typeof row.pr === "number" && typeof row.head === "string" && typeof row.check === "string" && typeof row.repo === "string";
+}, LOCK_WAIT_MS = 2000, LOCK_STALE_MS = 60000, pause = (ms) => {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+};
+var init_reruns = __esm(() => {
+  init_rev();
+});
+
+// packages/workit-core/src/forge/types.ts
+var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
+
+// packages/workit-core/src/forge/report.ts
+function gatingChecks(status) {
+  const required = status.checks.filter((check) => check.required === true);
+  const protectionNamesChecks = (status.requiredContexts?.length ?? 0) > 0;
+  return required.length > 0 || protectionNamesChecks ? { checks: required, protected: true } : { checks: status.checks, protected: false };
+}
+function missingRequired(status) {
+  if (status.requiredContexts === null)
+    return null;
+  const seen = new Set(status.checks.map((check) => check.context));
+  return status.requiredContexts.filter((context) => !seen.has(context));
+}
+function checksState(checks, missing = []) {
+  if (checks.some((check) => check.state === "failing"))
+    return "failing";
+  if (checks.some((check) => check.state === "pending") || (missing?.length ?? 0) > 0)
+    return "pending";
+  return checks.length > 0 ? "passing" : "none";
+}
+function blockersOf(input) {
+  if (input.state === "merged")
+    return [{ next: "MERGED", reason: "merged" }];
+  if (input.state === "closed")
+    return [{ next: "CLOSED", reason: "closed" }];
+  const out = [];
+  const ms = input.mergeState ?? "";
+  if (input.conflicts)
+    out.push({ next: "RESOLVE_CONFLICTS", reason: "conflicts" });
+  if (input.rebaseRequired)
+    out.push({ next: "REBASE", reason: "behind_base_required" });
+  if (input.threads > 0 || ms === "discussions_not_resolved")
+    out.push({ next: "RESOLVE_THREADS", reason: "unresolved_threads" });
+  if (input.checks === "failing")
+    out.push({
+      next: "FIX_CI",
+      reason: input.checksRequired ? "required_checks_failing" : "checks_failing"
+    });
+  else if (input.checks === "pending" || ms === "ci_still_running" || ms === "ci_must_pass" && input.checks !== "passing")
+    out.push({ next: "WAITING_CI", reason: "checks_pending" });
+  if (input.reviewDecision === "changes_requested" || ms === "requested_changes")
+    out.push({ next: "ADDRESS_REVIEW", reason: "changes_requested" });
+  else if (input.reviewDecision === "review_required" || ms === "not_approved")
+    out.push({ next: "REVIEW", reason: "review_required" });
+  if (input.draft || ms === "draft" || ms === "draft_status")
+    out.push({ next: "MARK_READY", reason: "draft" });
+  if (input.inMergeQueue)
+    out.push({ next: "IN_MERGE_QUEUE", reason: "in_merge_queue" });
+  if (out.length === 0) {
+    const allowed = input.forge === "github" ? GITHUB_MERGEABLE.has(ms) : GITLAB_MERGEABLE.has(ms);
+    if (input.mergeable === "unknown")
+      out.push({ next: "NOT_MERGEABLE", reason: "mergeability_unknown" });
+    else if (!allowed)
+      out.push({ next: "NOT_MERGEABLE", reason: `merge_state_${ms || "unknown"}` });
+  }
+  return out;
+}
+function computeBehindBase(cwd, remotes, baseSha, headSha_, options = {}) {
+  const empty = { behind: null, ahead: null, upToDate: null };
+  if (!baseSha)
+    return success2({ ...empty, baseSha: null, error: "the forge reported no base tip" });
+  for (const [sha, remote] of [
+    [baseSha, remotes.base],
+    [headSha_, remotes.head]
+  ]) {
+    if (hasCommit(cwd, sha))
+      continue;
+    const fetched = fetchRefs(cwd, remote, [sha], options);
+    if (!fetched.ok && remote !== remotes.base)
+      fetchRefs(cwd, remotes.base, [sha], options);
+    if (!hasCommit(cwd, sha))
+      return success2({
+        ...empty,
+        baseSha,
+        error: fetched.ok ? `${sha.slice(0, 12)} is not available locally` : fetched.error
+      });
+  }
+  const counts = aheadBehind(cwd, baseSha, headSha_);
+  return success2(counts ? { ...counts, baseSha } : { ...empty, baseSha, error: "ahead/behind did not resolve" });
+}
+function selectPr(cwd, resolved, options) {
+  if (options.pr)
+    return success2(options.pr);
+  const branch = options.branch ?? currentBranch2(cwd);
+  if (!branch)
+    return failure3("invalid_input", "HEAD is detached; pass --pr <n> or --branch <name>");
+  const localSha = resolveRef(cwd, `refs/heads/${branch}`);
+  const found = resolved.forge.findPr(branch, {
+    owner: resolved.headRepo.split("/")[0] ?? null,
+    projectId: resolved.headProjectId,
+    sha: localSha
+  });
+  if (!found.ok)
+    return found;
+  if (!found.data) {
+    const noun = resolved.forge.kind === "github" ? "pull request" : "merge request";
+    return failure3("not_found", `no ${noun} for branch ${branch} from ${resolved.headRepo} in ${resolved.forge.repo}`, "push the branch and open one (workit pr create, S11), or pass --pr <n>");
+  }
+  return success2(found.data.number);
+}
+function buildStatusDoc(cwd, resolved, status, options) {
+  const { forge } = resolved;
+  const reruns = rerunCounts(cwd, { repo: forge.repo, pr: status.number, head: status.head.sha });
+  const gating = gatingChecks(status);
+  const missing = missingRequired(status);
+  const failing = status.checks.filter((check) => check.state === "failing");
+  const failingDocs = failing.map((check, index) => {
+    const doc = {
+      name: check.name,
+      url: check.url,
+      runId: check.runId,
+      jobId: check.jobId,
+      conclusion: check.conclusion,
+      required: check.required,
+      logTail: [],
+      rerunsOnHead: reruns.get(check.name) ?? 0
+    };
+    if (check.jobId !== null && options.logLines > 0 && index < MAX_LOG_TAILS) {
+      const tail = forge.jobLogTail({ jobId: check.jobId, scope: check.scope }, options.logLines);
+      if (tail.ok)
+        doc.logTail = tail.data;
+      else
+        doc.logError = tail.error;
+    }
+    return doc;
+  });
+  const local = currentBranch2(cwd) === status.head.branch ? headSha(cwd) : resolveRef(cwd, `refs/heads/${status.head.branch}`);
+  let behindBase = null;
+  if (options.behind && status.state === "open") {
+    const counted = computeBehindBase(cwd, { base: resolved.baseRemote, head: resolved.remote }, status.baseSha, status.head.sha, options.behindTimeoutMs === undefined ? {} : { timeoutMs: options.behindTimeoutMs });
+    if (!counted.ok)
+      return counted;
+    behindBase = counted.data;
+  }
+  const state = checksState(gating.checks, missing);
+  const blockers = blockersOf({
+    forge: forge.kind,
+    state: status.state,
+    draft: status.draft,
+    conflicts: status.conflicts,
+    rebaseRequired: status.rebaseRequired,
+    mergeable: status.mergeable,
+    mergeState: status.mergeState,
+    inMergeQueue: status.inMergeQueue,
+    reviewDecision: status.reviewDecision,
+    threads: status.threads.length,
+    checks: state,
+    checksRequired: gating.protected
+  });
+  return success2({
+    forge: forge.kind,
+    repo: forge.repo,
+    headRepo: resolved.fork ? resolved.headRepo : null,
+    number: status.number,
+    url: status.url,
+    state: status.state,
+    draft: status.draft,
+    base: status.base,
+    head: {
+      branch: status.head.branch,
+      sha: status.head.sha,
+      localSha: local,
+      pushed: local === null ? null : local === status.head.sha
+    },
+    mergeable: status.mergeable,
+    mergeState: status.mergeState,
+    conflicts: status.conflicts,
+    rebaseRequired: status.rebaseRequired,
+    inMergeQueue: status.inMergeQueue,
+    behindBase,
+    checks: {
+      state,
+      failing: failingDocs,
+      pending: status.checks.filter((check) => check.state === "pending").map((check) => check.name),
+      passing: status.checks.filter((check) => check.state === "passing").length,
+      missingRequired: missing
+    },
+    reviews: { decision: status.reviewDecision, unresolvedThreads: status.threads },
+    blockers: status.state === "open" ? blockers.map((blocker) => blocker.reason) : [],
+    identity: options.identity ?? null,
+    truncated: status.truncated,
+    next: blockers[0]?.next ?? "READY"
+  });
+}
+function prStatusReport(cwd, resolved, options = {}) {
+  const number = selectPr(cwd, resolved, options);
+  if (!number.ok)
+    return number;
+  const status = resolved.forge.prStatus(number.data);
+  if (!status.ok)
+    return status;
+  const doc = buildStatusDoc(cwd, resolved, status.data, {
+    logLines: options.logLines ?? 60,
+    behind: options.behind ?? true,
+    identity: options.identity
+  });
+  if (!doc.ok)
+    return doc;
+  return success2({ doc: doc.data, raw: status.data });
+}
+function waitVerdict(doc, options) {
+  if (doc.state !== "open")
+    return {
+      state: "blocked",
+      reason: `pr_${doc.state}`,
+      unblock: `the ${doc.forge === "github" ? "PR" : "MR"} is ${doc.state}; nothing to wait for`
+    };
+  if (options.head && !doc.head.sha.startsWith(options.head))
+    return { state: "waiting", reason: "head_mismatch" };
+  const checks = doc.checks.state;
+  if (checks === "failing")
+    return { state: "failed", reason: "checks_failing" };
+  if (checks === "pending")
+    return { state: "waiting", reason: "checks_pending" };
+  if (checks === "passing")
+    return { state: "ready", reason: "checks_passing" };
+  if (doc.conflicts)
+    return {
+      state: "blocked",
+      reason: "conflicts",
+      unblock: `rebase onto ${doc.base} and push; CI does not run on a conflicting PR`
+    };
+  const ciRequired = doc.checks.missingRequired === null || doc.mergeState === "ci_must_pass" || doc.mergeState === "ci_still_running";
+  if (ciRequired)
+    return { state: "waiting", reason: "no_checks_yet" };
+  if (options.elapsedMs < (options.noChecksGraceMs ?? NO_CHECKS_GRACE_MS))
+    return { state: "waiting", reason: "no_checks_yet" };
+  return { state: "ready", reason: "no_checks" };
+}
+function pollDelay(intervalMs, poll) {
+  const cap = Math.max(intervalMs, 120000);
+  return Math.min(cap, Math.round(intervalMs * 1.5 ** poll));
+}
+function planRerun(status, selection) {
+  let checks;
+  if (selection.names.length > 0) {
+    const unknown = selection.names.filter((name) => !status.checks.some((check) => check.name === name));
+    if (unknown.length)
+      return failure3("invalid_input", `unknown check ${unknown.map((name) => JSON.stringify(name)).join(", ")}; known: ${status.checks.map((check) => check.name).join(", ") || "none"}`);
+    checks = status.checks.filter((check) => selection.names.includes(check.name));
+    const running = checks.filter((check) => check.state === "pending");
+    if (running.length)
+      return failure3("busy", `still running: ${running.map((check) => check.name).join(", ")}`, "workit ci wait");
+  } else {
+    checks = status.checks.filter((check) => check.state === "failing");
+  }
+  if (checks.length === 0)
+    return failure3("not_found", `no failing checks on head ${status.head.sha.slice(0, 12)}`);
+  const rerunnable = checks.filter((check) => check.jobId !== null && check.runId !== null);
+  const skipped = checks.filter((check) => !rerunnable.includes(check)).map((check) => check.name);
+  const targets = [];
+  if (selection.names.length === 0) {
+    const busy = status.checks.filter((check) => check.state === "pending" && check.runId !== null && rerunnable.some((failing) => failing.runId === check.runId));
+    if (busy.length)
+      return failure3("busy", `the failed jobs' run is still in progress (${busy.map((check) => check.name).join(", ")})`, "workit ci wait, then rerun");
+    const seen = new Set;
+    for (const check of rerunnable)
+      if (!seen.has(check.runId)) {
+        seen.add(check.runId);
+        targets.push({ kind: "failed_in_run", runId: check.runId, scope: check.scope });
+      }
+  } else {
+    for (const check of rerunnable)
+      targets.push({ kind: "job", jobId: check.jobId, scope: check.scope });
+  }
+  if (targets.length === 0)
+    return failure3("unavailable", `${skipped.join(", ")} cannot be rerun from here (not a CI job); rerun it on the forge`);
+  return success2({ checks: rerunnable, targets, skipped });
+}
+function executeRerun(cwd, resolved, status, options) {
+  if (status.state !== "open")
+    return failure3("blocked", `${status.state} PR: CI cannot be rerun`, "nothing to do");
+  const plan = planRerun(status, options);
+  if (!plan.ok)
+    return plan;
+  const locked = withRerunLock(cwd, () => rerunLocked(cwd, resolved, status, plan.data, options));
+  return locked ?? failure3("busy", "another ci rerun is in progress for this repository", "retry in a moment");
+}
+function rerunLocked(cwd, resolved, status, plan, options) {
+  const { forge } = resolved;
+  const counts = rerunCounts(cwd, { repo: forge.repo, pr: status.number, head: status.head.sha });
+  const repeated = plan.checks.filter((check) => (counts.get(check.name) ?? 0) > 0);
+  if (repeated.length && !options.force)
+    return failure3("blocked", `rerun_limit: ${repeated.map((check) => check.name).join(", ")} already rerun once on head ${status.head.sha.slice(0, 12)}`, "treat it as a real failure and fix it; if it is a confirmed flake, rerun with --force");
+  const accepted = [];
+  for (const target of plan.targets) {
+    const done = forge.rerun(target);
+    if (!done.ok) {
+      recordAccepted(cwd, resolved, status, accepted, options);
+      return failure3(done.code, accepted.length ? `${done.error} (already rerun: ${accepted.map((check) => check.name).join(", ")})` : done.error, done.unblock);
+    }
+    accepted.push(...plan.checks.filter((check) => target.kind === "failed_in_run" ? check.runId === target.runId : check.jobId === target.jobId));
+  }
+  const recorded = recordAccepted(cwd, resolved, status, accepted, options);
+  return success2({
+    pr: status.number,
+    head: status.head.sha,
+    reason: options.reason,
+    forced: options.force,
+    rerun: accepted.map((check) => ({ name: check.name, runId: check.runId, jobId: check.jobId })),
+    skipped: plan.skipped,
+    recorded
+  });
+}
+function recordAccepted(cwd, resolved, status, accepted, options) {
+  const at = new Date().toISOString();
+  const rows = accepted.map((check) => ({
+    v: 1,
+    at,
+    type: "ci.rerun",
+    forge: resolved.forge.kind,
+    repo: resolved.forge.repo,
+    pr: status.number,
+    head: status.head.sha,
+    check: check.name,
+    reason: options.reason,
+    forced: options.force
+  }));
+  return recordReruns(cwd, rows);
+}
+var MAX_LOG_TAILS = 5, GITLAB_MERGEABLE, GITHUB_MERGEABLE, NO_CHECKS_GRACE_MS = 90000;
+var init_report = __esm(() => {
+  init_rev();
+  init_reruns();
+  GITLAB_MERGEABLE = new Set(["mergeable"]);
+  GITHUB_MERGEABLE = new Set(["clean", "unstable", "has_hooks"]);
+});
+
+// packages/workit-core/src/forge/redact.ts
+function redactText(value) {
+  let out = stripAnsi2(value).replace(PRIVATE_KEY, "[REDACTED PRIVATE KEY]");
+  out = out.replace(WEBHOOK, `$1/${R}`);
+  out = out.replace(URL_USERINFO, `$1${R}@`);
+  for (const pattern of TOKEN_PATTERNS)
+    out = out.replace(pattern, R);
+  out = out.replace(CURL_USER, `$1$2${R}$2`);
+  out = out.replace(BEARER, `$1${R}`);
+  out = out.replace(QUOTED_ASSIGNMENT, (match, lead, quote, secret) => secret.startsWith(R) ? match : `${lead}${quote}${R}${quote}`);
+  out = out.replace(NETRC, `$1${R}`);
+  for (const pattern of FLAG_SECRETS)
+    out = out.replace(pattern, `$1${R}`);
+  out = out.replace(QUERY_SECRET, `$1${R}`);
+  out = out.replace(ASSIGNMENT, (match, lead, scheme, secret) => secret.startsWith(R) ? match : `${lead}${scheme ?? ""}${R}`);
+  return out.split(`
+`).map((line) => line.replace(BASE64, (blob) => /\bbase64\b/iu.test(line) || decodesToSecret(blob) ? R : blob)).join(`
+`);
+}
+function logTail(text, lines) {
+  if (lines <= 0)
+    return [];
+  const cleaned = text.replace(GITLAB_SECTION, "").split(/\r?\n/u).map((raw) => stripAnsi2(raw).split("\r").findLast((part) => part.trim()) ?? "").map((raw) => raw.replace(LINE_NOISE, ""));
+  const all = redactText(cleaned.join(`
+`)).split(`
+`);
+  let end = all.length;
+  for (let index = all.length - 1;index >= 0; index -= 1)
+    if (FAILURE_END.some((pattern) => pattern.test(all[index]))) {
+      end = index + 1;
+      break;
+    }
+  const kept = all.slice(0, end);
+  while (kept.length > 0 && !kept[kept.length - 1].trim())
+    kept.pop();
+  const cap = (value) => value.length > MAX_LINE ? `${value.slice(0, MAX_LINE)}…` : value;
+  const tailStart = Math.max(0, kept.length - lines);
+  const find = (pattern) => kept.findIndex((value) => pattern.test(value) && !NOT_FIRST_ERROR.test(value));
+  const strong = find(STRONG_ERROR);
+  const first = strong >= 0 ? strong : find(WEAK_ERROR);
+  if (first < 0 || first >= tailStart || lines < 8)
+    return kept.slice(tailStart).map(cap);
+  const headCount = Math.ceil((lines - 1) * (2 / 3));
+  const from = Math.max(0, first - LEAD);
+  const head = kept.slice(from, from + headCount);
+  const tailCount = lines - 1 - head.length;
+  const tailFrom = Math.max(from + head.length, kept.length - tailCount);
+  const tail = kept.slice(tailFrom);
+  return [...head, ...tailFrom > from + head.length ? ["…"] : [], ...tail].map(cap);
+}
+function shortBody(value, max = 300) {
+  const flat = redactText(value).replace(/\s+/gu, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
+var R = "[REDACTED]", TOKEN_PATTERNS, WEBHOOK, URL_USERINFO, CURL_USER, KEY, ASSIGNMENT, BEARER, QUOTED_ASSIGNMENT, NETRC, FLAG_SECRETS, QUERY_SECRET, PRIVATE_KEY, BASE64, ANSI, stripAnsi2 = (value) => value.replace(ANSI, ""), decodesToSecret = (blob) => {
+  if (/^[0-9a-f]+$/iu.test(blob))
+    return false;
+  let decoded;
+  try {
+    decoded = Buffer.from(blob, "base64").toString("utf8");
+  } catch {
+    return false;
+  }
+  if (!/^[\x20-\x7e\s]+$/u.test(decoded))
+    return false;
+  return TOKEN_PATTERNS.some((pattern) => new RegExp(pattern.source, "u").test(decoded)) || /^[^\s:]{1,64}:[^\s]{6,}$/u.test(decoded.trim());
+}, LINE_NOISE, GITLAB_SECTION, FAILURE_END, MAX_LINE = 400, STRONG_ERROR, WEAK_ERROR, NOT_FIRST_ERROR, LEAD = 3;
+var init_redact = __esm(() => {
+  TOKEN_PATTERNS = [
+    /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/gu,
+    /\bgl[a-z]{1,8}-[A-Za-z0-9_-]{16,}/gu,
+    /\bnpm_[A-Za-z0-9]{30,}/gu,
+    /\bxox[abposr]-[A-Za-z0-9-]{10,}/gu,
+    /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,
+    /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}/gu,
+    /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/gu,
+    /\bAIza[0-9A-Za-z_-]{35}/gu,
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/gu
+  ];
+  WEBHOOK = /\b(https?:\/\/(?:hooks\.slack\.com\/(?:services|workflows|triggers)|discord(?:app)?\.com\/api\/webhooks))\/[^\s"'<>]+/giu;
+  URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/giu;
+  CURL_USER = /(\s(?:-u|--user)(?:\s+|=))(["']?)[^\s"':]+:[^\s"']+\2/gu;
+  KEY = String.raw`[A-Za-z0-9_.-]*?(?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|account[_-]?key|private[_-]?key|client[_-]?secret|credentials?|authorization|cookie|signature)[A-Za-z0-9_.-]*`;
+  ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*["']?)((?:bearer|basic|token|digest)\s+)?([^\s"',;&]+)`, "giu");
+  BEARER = /\b(bearer\s+)[A-Za-z0-9._~+/-]{12,}=*/giu;
+  QUOTED_ASSIGNMENT = new RegExp(String.raw`(?<![A-Za-z0-9])(["']?${KEY}["']?\s*[:=]\s*)(["'])([^"'\n]*[^\s"'][^"'\n]*)\2`, "giu");
+  NETRC = /\b((?:machine|login)\s+\S+\s+(?:login\s+\S+\s+)?password\s+)\S+/giu;
+  FLAG_SECRETS = [
+    /\b(sshpass\s+-p\s*)\S+/gu,
+    /\b(mysql(?:dump|admin|import|show)?\b[^\n]*?\s-p)(?!\s|$)\S+/gu
+  ];
+  QUERY_SECRET = /([?&;](?:sig|signature|token|access_token|api_key|apikey|key|password|secret|client_secret|X-Amz-Signature|X-Goog-Signature)=)[^&\s#"']+/giu;
+  PRIVATE_KEY = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|$)/gu;
+  BASE64 = /[A-Za-z0-9+/]{32,}={0,2}/gu;
+  ANSI = new RegExp(String.raw`\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007]*\u0007`, "gu");
+  LINE_NOISE = /^(?:\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\s?)?(?:\d{2}[A-Z]\s)?/u;
+  GITLAB_SECTION = /section_(?:start|end):\d+:[A-Za-z0-9_.-]+(?:\[[^\]]*\])?\r?/gu;
+  FAILURE_END = [/##\[error\]Process completed with exit code/u, /^ERROR: Job failed\b/u];
+  STRONG_ERROR = /^\s*(?:\(fail\)|FAIL\b|✗|✕|×|error(?:\[[A-Z0-9]+\])?:|[A-Za-z]*Error\b:|AssertionError|Traceback|panic:|Exception\b)/u;
+  WEAK_ERROR = /\berror\b[:[]|\bERROR\b|\bFAIL(?:ED)?\b|\bfailed\b|\bassert/u;
+  NOT_FIRST_ERROR = /^\s*(?:\(pass\)|\(skip\)|\(todo\)|✓|✔|ok\b|PASS\b)|^\s*\d+ fail\b|##\[error\]Process completed|^\s*0 (?:errors?|fail)/u;
+});
+
+// packages/workit-core/src/forge/exec.ts
+import { spawnSync as spawnSync14 } from "node:child_process";
+import fs17 from "node:fs";
+import path36 from "node:path";
+function findExecutable(bin, env) {
+  const dirs = (env.PATH ?? env.Path ?? "").split(path36.delimiter).filter(Boolean);
+  const exts = process.platform === "win32" ? [".exe"] : [""];
+  for (const dir of dirs)
+    for (const ext of exts) {
+      const candidate = path36.join(dir, `${bin}${ext}`);
+      try {
+        const stat = fs17.statSync(candidate);
+        if (stat.isFile())
+          return candidate;
+      } catch {}
+    }
+  return null;
+}
+function systemRunner(kind, apiHost, env = process.env) {
+  const childEnv = {
+    ...env,
+    ...kind === "github" ? { GH_HOST: apiHost } : { GITLAB_HOST: apiHost },
+    GH_PROMPT_DISABLED: "1",
+    GH_NO_UPDATE_NOTIFIER: "1",
+    GLAB_CHECK_UPDATE: "false",
+    NO_PROMPT: "1",
+    NO_COLOR: "1",
+    GH_PAGER: "",
+    GLAB_PAGER: "",
+    PAGER: ""
+  };
+  return (bin, args, options) => {
+    const exe = findExecutable(bin, env);
+    if (!exe)
+      return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
+    const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
+    const result = spawnSync14(exe, [...args], {
+      encoding: "utf8",
+      env: { ...childEnv, ...token },
+      maxBuffer: MAX_BUFFER2,
+      timeout: options.timeoutMs,
+      killSignal: "SIGKILL",
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const error = result.error;
+    return {
+      status: result.status,
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? "",
+      timedOut: error?.code === "ETIMEDOUT",
+      missing: error?.code === "ENOENT"
+    };
+  };
+}
+function cliFailure(bin, apiHost, run, what, timeoutMs) {
+  if (run.missing)
+    return failure3("unavailable", `${bin} is not installed`, installHint(bin));
+  if (run.timedOut)
+    return failure3("unavailable", `${bin} api ${what} timed out after ${timeoutMs} ms`);
+  const stderr = redactText(run.stderr).trim();
+  if (/auth login|not logged in|no token|authentication required|bad credentials|\b401\b|unauthorized/iu.test(stderr))
+    return failure3("unavailable", `${bin} is not authenticated for ${apiHost}`, loginHint(bin, apiHost));
+  if (/\b404\b|not found/iu.test(stderr))
+    return failure3("not_found", `${what} was not found`);
+  const first = stderr.split(/\r?\n/u).find((value) => value.trim()) ?? `exit ${run.status}`;
+  return failure3("failed", `${bin} api ${what} failed: ${first.slice(0, 200)}`);
+}
+function apiJson(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.api, options = {}) {
+  const run = runner(bin, args, { timeoutMs });
+  if (run.status !== 0) {
+    if (options.graphql && !run.missing && !run.timedOut)
+      try {
+        const body = JSON.parse(run.stdout);
+        if (Array.isArray(body.errors))
+          return { ok: true, data: body };
+      } catch {}
+    return cliFailure(bin, apiHost, run, what, timeoutMs);
+  }
+  try {
+    return { ok: true, data: JSON.parse(run.stdout) };
+  } catch {
+    return failure3("failed", `${bin} api ${what} returned invalid JSON`);
+  }
+}
+function apiText(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.log) {
+  const run = runner(bin, args, { timeoutMs });
+  if (run.status !== 0)
+    return cliFailure(bin, apiHost, run, what, timeoutMs);
+  return { ok: true, data: run.stdout };
+}
+var FORGE_TIMEOUTS, MAX_BUFFER2, installHint = (bin) => bin === "gh" ? "install the GitHub CLI (https://cli.github.com) and run: gh auth login" : "install glab (https://gitlab.com/gitlab-org/cli) and run: glab auth login", loginHint = (bin, apiHost) => `${bin} auth login --hostname ${apiHost}`;
+var init_exec = __esm(() => {
+  init_redact();
+  FORGE_TIMEOUTS = { api: 20000, log: 30000 };
+  MAX_BUFFER2 = 64 * 1024 * 1024;
+});
+
+// packages/workit-core/src/forge/github.ts
+function checkFromContext(node) {
+  const required = node.isRequired ?? null;
+  if (node.__typename === "StatusContext") {
+    const state = node.state.toUpperCase();
+    return {
+      name: node.context,
+      context: node.context,
+      state: state === "SUCCESS" ? "passing" : state === "FAILURE" || state === "ERROR" ? "failing" : "pending",
+      conclusion: state.toLowerCase(),
+      url: safeUrl(node.targetUrl),
+      runId: null,
+      jobId: null,
+      scope: null,
+      required
+    };
+  }
+  if (node.conclusion === "STALE")
+    return null;
+  const run = node.checkSuite?.workflowRun ?? null;
+  const workflow = run?.workflow?.name;
+  const completed = node.status === "COMPLETED";
+  const conclusion = node.conclusion?.toUpperCase() ?? null;
+  return {
+    name: workflow ? `${workflow} / ${node.name}` : node.name,
+    context: node.name,
+    state: !completed ? "pending" : conclusion && FAILING.has(conclusion) ? "failing" : conclusion === "SKIPPED" || conclusion === "NEUTRAL" ? "skipped" : "passing",
+    conclusion: completed ? conclusion?.toLowerCase() ?? null : node.status.toLowerCase(),
+    url: safeUrl(node.detailsUrl),
+    runId: run?.databaseId ?? null,
+    jobId: run ? node.databaseId ?? null : null,
+    scope: null,
+    required
+  };
+}
+function latestPerName(checks) {
+  const byName = new Map;
+  for (const check of checks) {
+    const seen = byName.get(check.name);
+    if (!seen || (check.jobId ?? 0) >= (seen.jobId ?? 0))
+      byName.set(check.name, check);
+  }
+  return [...byName.values()];
+}
+function threadFrom(node) {
+  const first = node.comments.nodes[0];
+  return {
+    id: node.id,
+    path: node.path,
+    line: node.line,
+    author: first?.author?.login ?? null,
+    isBot: first?.author?.__typename === "Bot",
+    outdated: node.isOutdated,
+    url: safeUrl(first?.url ?? null),
+    body: shortBody(first?.body ?? "")
+  };
+}
+function createGitHubForge(options) {
+  const { apiHost, repo, runner } = options;
+  const maxPages = options.maxPages ?? GITHUB_MAX_PAGES;
+  const [owner, name] = repo.split("/");
+  const rest = (endpoint, what) => apiJson(runner, "gh", apiHost, ["api", endpoint], what);
+  const graphql = (query, variables, what) => {
+    const args = ["api", "graphql", "-f", `query=${query}`];
+    for (const [key, value] of Object.entries(variables)) {
+      if (value === null)
+        continue;
+      args.push(typeof value === "number" ? "-F" : "-f", `${key}=${value}`);
+    }
+    const response = apiJson(runner, "gh", apiHost, args, what, FORGE_TIMEOUTS.api, { graphql: true });
+    if (!response.ok)
+      return response;
+    if (response.data.errors?.length) {
+      const message = redactText(response.data.errors[0]?.message ?? "GraphQL error").slice(0, 300);
+      return /could not resolve to a (pullrequest|repository)/iu.test(message) ? failure3("not_found", `${what}: ${message}`) : failure3("failed", `${what}: ${message}`);
+    }
+    if (!response.data.data)
+      return failure3("failed", `${what}: empty GraphQL response`);
+    return success2(response.data.data);
+  };
+  const fetchPr = (number, cursors) => {
+    const data = graphql(PR_STATUS_QUERY, { owner, name, number, threads: cursors.threads, contexts: cursors.contexts }, `pull request #${number}`);
+    if (!data.ok)
+      return data;
+    const pr = data.data.repository?.pullRequest;
+    return pr ? success2(pr) : failure3("not_found", `pull request #${number} was not found`);
+  };
+  const requiredContexts = (base) => {
+    const branch = rest(`repos/${repo}/branches/${encodeRef(base)}`, `branch ${base}`);
+    const rules = rest(`repos/${repo}/rules/branches/${encodeRef(base)}`, `rules for ${base}`);
+    if (!branch.ok || !rules.ok || !Array.isArray(rules.data))
+      return null;
+    const contexts = new Set;
+    const classic = branch.data.protection?.required_status_checks;
+    for (const context of classic?.contexts ?? [])
+      contexts.add(context);
+    for (const check of classic?.checks ?? [])
+      if (check.context)
+        contexts.add(check.context);
+    for (const rule of rules.data)
+      if (rule.type === "required_status_checks") {
+        const listed = rule.parameters?.required_status_checks;
+        if (Array.isArray(listed)) {
+          for (const item of listed)
+            if (typeof item.context === "string")
+              contexts.add(item.context);
+        }
+      }
+    return [...contexts];
+  };
+  return {
+    kind: "github",
+    apiHost,
+    repo,
+    identity(expected) {
+      const run = runner("gh", ["api", "user"], { timeoutMs: FORGE_TIMEOUTS.api });
+      if (run.status !== 0) {
+        if (/HTTP 403|resource not accessible by integration/iu.test(run.stderr))
+          return success2({
+            login: null,
+            expected,
+            matches: null,
+            note: "the credential cannot read /user (app or Actions token); identity not checked"
+          });
+        return cliFailure("gh", apiHost, run, "user", FORGE_TIMEOUTS.api);
+      }
+      let login = "";
+      try {
+        const user = JSON.parse(run.stdout);
+        login = typeof user.login === "string" ? user.login : "";
+      } catch {}
+      if (!login)
+        return failure3("failed", "gh api user returned no login");
+      return success2({
+        login,
+        expected,
+        matches: expected ? login.toLowerCase() === expected.toLowerCase() : null
+      });
+    },
+    repoInfo(target) {
+      const info = rest(`repos/${target}`, `repository ${target}`);
+      if (!info.ok)
+        return info;
+      return success2({
+        id: typeof info.data.id === "number" ? info.data.id : null,
+        parent: info.data.fork && info.data.parent?.full_name ? info.data.parent.full_name : null
+      });
+    },
+    findPr(head, match) {
+      const data = graphql(FIND_PR_QUERY, { owner, name, head }, `pull requests for ${head}`);
+      if (!data.ok)
+        return data;
+      const nodes = data.data.repository?.pullRequests.nodes ?? [];
+      const ours = nodes.filter((node) => node.headRefName === head && (match.owner !== null && node.headRepositoryOwner?.login.toLowerCase() === match.owner.toLowerCase() || match.sha !== null && node.headRefOid === match.sha));
+      const pick = ours.find((node) => node.state === "OPEN") ?? ours[0];
+      if (!pick)
+        return success2(null);
+      const ref = {
+        number: pick.number,
+        url: pick.url,
+        state: prState(pick.state),
+        headBranch: pick.headRefName,
+        headSha: pick.headRefOid
+      };
+      return success2(ref);
+    },
+    prStatus(number) {
+      const first = fetchPr(number, { threads: null, contexts: null });
+      if (!first.ok)
+        return first;
+      const pr = first.data;
+      const threads = [...pr.reviewThreads.nodes];
+      const rollup = pr.commits.nodes[0]?.commit.statusCheckRollup ?? null;
+      const contexts = [...rollup?.contexts.nodes ?? []];
+      let threadPage = pr.reviewThreads.pageInfo;
+      let contextPage = rollup?.contexts.pageInfo ?? { hasNextPage: false, endCursor: null };
+      let pages = 1;
+      while ((threadPage.hasNextPage || contextPage.hasNextPage) && pages < maxPages) {
+        pages += 1;
+        const next = fetchPr(number, {
+          threads: threadPage.hasNextPage ? threadPage.endCursor : null,
+          contexts: contextPage.hasNextPage ? contextPage.endCursor : null
+        });
+        if (!next.ok)
+          return next;
+        if (next.data.headRefOid !== pr.headRefOid)
+          return failure3("failed", `pull request #${number} head moved while paging; retry`);
+        if (threadPage.hasNextPage) {
+          threads.push(...next.data.reviewThreads.nodes);
+          threadPage = next.data.reviewThreads.pageInfo;
+        }
+        const nextRollup = next.data.commits.nodes[0]?.commit.statusCheckRollup;
+        if (contextPage.hasNextPage && nextRollup) {
+          contexts.push(...nextRollup.contexts.nodes);
+          contextPage = nextRollup.contexts.pageInfo;
+        }
+      }
+      const checks = latestPerName(contexts.map(checkFromContext).filter((check) => check !== null));
+      const open = pr.state === "OPEN";
+      const status = {
+        number: pr.number,
+        url: pr.url,
+        state: prState(pr.state),
+        draft: pr.isDraft,
+        base: pr.baseRefName,
+        baseSha: pr.baseRef?.target?.oid ?? pr.baseRefOid,
+        head: { branch: pr.headRefName, sha: pr.headRefOid },
+        mergeable: pr.mergeable === "MERGEABLE" ? "yes" : pr.mergeable === "CONFLICTING" ? "no" : "unknown",
+        conflicts: pr.mergeable === "CONFLICTING" || pr.mergeStateStatus === "DIRTY",
+        rebaseRequired: pr.mergeStateStatus === "BEHIND",
+        reviewDecision: pr.reviewDecision?.toLowerCase() ?? null,
+        mergeState: pr.mergeStateStatus?.toLowerCase() ?? null,
+        inMergeQueue: pr.isInMergeQueue === true,
+        checks,
+        requiredContexts: open ? requiredContexts(pr.baseRefName) : null,
+        threads: threads.filter((node) => !node.isResolved).map(threadFrom),
+        truncated: threadPage.hasNextPage || contextPage.hasNextPage
+      };
+      return success2(status);
+    },
+    jobLogTail(job, lines) {
+      const text = apiText(runner, "gh", apiHost, ["api", `repos/${repo}/actions/jobs/${job.jobId}/logs`], `job ${job.jobId} log`, FORGE_TIMEOUTS.log);
+      return text.ok ? success2(logTail(text.data, lines)) : text;
+    },
+    rerun(target) {
+      const endpoint = target.kind === "failed_in_run" ? `repos/${repo}/actions/runs/${target.runId}/rerun-failed-jobs` : `repos/${repo}/actions/jobs/${target.jobId}/rerun`;
+      const what = target.kind === "failed_in_run" ? `rerun of run ${target.runId}` : `rerun of job ${target.jobId}`;
+      const run = apiText(runner, "gh", apiHost, ["api", "-X", "POST", endpoint], what, FORGE_TIMEOUTS.api);
+      return run.ok ? success2(undefined) : run;
+    }
+  };
+}
+var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state headRefName headRefOid headRepositoryOwner { login } } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
+var init_github = __esm(() => {
+  init_exec();
+  init_redact();
+  PR_STATUS_QUERY = `query($owner: String!, $name: String!, $number: Int!, $threads: String, $contexts: String) { repository(owner: $owner, name: $name) { pullRequest(number: $number) { ${PR_FIELDS} ${THREADS} commits(last: 1) { nodes { commit { oid statusCheckRollup { state ${CONTEXTS} } } } } } } }`;
+  FAILING = new Set([
+    "FAILURE",
+    "TIMED_OUT",
+    "CANCELLED",
+    "ACTION_REQUIRED",
+    "STARTUP_FAILURE"
+  ]);
+});
+
+// packages/workit-core/src/forge/gitlab.ts
+function checkFromBridge(bridge, pipelineId, scope) {
+  const status = bridge.downstream_pipeline?.status ?? bridge.status;
+  const allow = bridge.allow_failure === true;
+  const failed = status === "failed" || status === "canceled";
+  return {
+    name: `${bridge.stage} / ${bridge.name}`,
+    context: bridge.name,
+    state: stateOf(status, allow),
+    conclusion: failed && allow ? "allowed_failure" : `downstream_${status}`,
+    url: safeUrl2(bridge.downstream_pipeline?.web_url ?? bridge.web_url ?? null),
+    runId: pipelineId,
+    jobId: null,
+    scope,
+    required: !allow
+  };
+}
+function checkFromJob(job, pipelineId, scope) {
+  const failed = job.status === "failed" || job.status === "canceled";
+  return {
+    name: `${job.stage} / ${job.name}`,
+    context: job.name,
+    state: stateOf(job.status, job.allow_failure === true),
+    conclusion: failed && job.allow_failure ? "allowed_failure" : job.status,
+    url: safeUrl2(job.web_url ?? null),
+    runId: pipelineId,
+    jobId: job.id,
+    scope,
+    required: job.allow_failure !== true
+  };
+}
+function createGitLabForge(options) {
+  const { apiHost, repo, runner } = options;
+  const maxPages = options.maxPages ?? GITLAB_MAX_PAGES;
+  const project = `projects/${encodeURIComponent(repo)}`;
+  const api = (endpoint) => ["api", endpoint];
+  const pages = (endpoint, what) => {
+    const items = [];
+    const sep = endpoint.includes("?") ? "&" : "?";
+    for (let page = 1;page <= maxPages; page += 1) {
+      const chunk = apiJson(runner, "glab", apiHost, api(`${endpoint}${sep}per_page=${PER_PAGE}&page=${page}`), what);
+      if (!chunk.ok)
+        return chunk;
+      if (!Array.isArray(chunk.data))
+        return failure3("failed", `${what}: expected a list`);
+      items.push(...chunk.data);
+      if (chunk.data.length < PER_PAGE)
+        return success2({ items, truncated: false });
+    }
+    return success2({ items, truncated: true });
+  };
+  const mergeCommitTests = (scope, sha, head) => {
+    const commit = apiJson(runner, "glab", apiHost, api(`projects/${scope}/repository/commits/${sha}`), `commit ${sha.slice(0, 12)}`);
+    return commit.ok && Array.isArray(commit.data.parent_ids) && commit.data.parent_ids.includes(head);
+  };
+  const baseTip = (branch) => {
+    const tip = apiJson(runner, "glab", apiHost, api(`${project}/repository/branches/${encodeURIComponent(branch)}`), `branch ${branch}`);
+    return tip.ok && typeof tip.data.commit?.id === "string" ? tip.data.commit.id : null;
+  };
+  return {
+    kind: "gitlab",
+    apiHost,
+    repo,
+    identity(expected) {
+      const user = apiJson(runner, "glab", apiHost, api("user"), "user");
+      if (!user.ok && user.code === "failed" && /\b403\b|forbidden/iu.test(user.error))
+        return success2({
+          login: null,
+          expected,
+          matches: null,
+          note: "the credential cannot read /user (job or project token); identity not checked"
+        });
+      if (!user.ok)
+        return user;
+      const login = typeof user.data.username === "string" ? user.data.username : "";
+      if (!login)
+        return failure3("failed", "glab api user returned no username");
+      return success2({
+        login,
+        expected,
+        matches: expected ? login.toLowerCase() === expected.toLowerCase() : null
+      });
+    },
+    repoInfo(target) {
+      const info = apiJson(runner, "glab", apiHost, api(`projects/${encodeURIComponent(target)}`), `project ${target}`);
+      if (!info.ok)
+        return info;
+      return success2({
+        id: typeof info.data.id === "number" ? info.data.id : null,
+        parent: info.data.forked_from_project?.path_with_namespace ?? null
+      });
+    },
+    findPr(head, match) {
+      const list = apiJson(runner, "glab", apiHost, api(`${project}/merge_requests?source_branch=${encodeURIComponent(head)}&order_by=created_at&sort=desc&per_page=20`), `merge requests for ${head}`);
+      if (!list.ok)
+        return list;
+      if (!Array.isArray(list.data))
+        return failure3("failed", "merge request list is not a list");
+      const matches = list.data.filter((mr) => mr.source_branch === head && (match.projectId !== null && mr.source_project_id === match.projectId || match.sha !== null && mr.sha === match.sha));
+      const pick = matches.find((mr) => mr.state === "opened") ?? matches[0];
+      return success2(pick ? {
+        number: pick.iid,
+        url: pick.web_url,
+        state: mrState(pick.state),
+        headBranch: pick.source_branch,
+        headSha: pick.sha ?? null
+      } : null);
+    },
+    prStatus(iid) {
+      const mr = apiJson(runner, "glab", apiHost, api(`${project}/merge_requests/${iid}`), `merge request !${iid}`);
+      if (!mr.ok)
+        return mr;
+      const value = mr.data;
+      let truncated = false;
+      let checks = [];
+      const pipeline = value.head_pipeline ?? null;
+      const open = value.state === "opened";
+      const current = pipeline !== null && (pipeline.sha === value.sha || pipeline.source_sha === value.sha || !pipeline.source_sha && new RegExp(`^refs/merge-requests/${value.iid}/(?:merge|train)$`, "u").test(pipeline.ref ?? "") && mergeCommitTests(pipeline.project_id, pipeline.sha, value.sha));
+      if (pipeline && current) {
+        const scope = String(pipeline.project_id);
+        const jobs = pages(`projects/${scope}/pipelines/${pipeline.id}/jobs`, `pipeline ${pipeline.id} jobs`);
+        if (!jobs.ok)
+          return jobs;
+        const bridges = pages(`projects/${scope}/pipelines/${pipeline.id}/bridges`, `pipeline ${pipeline.id} bridges`);
+        if (!bridges.ok)
+          return bridges;
+        truncated ||= jobs.data.truncated || bridges.data.truncated;
+        checks = [
+          ...jobs.data.items.map((job) => checkFromJob(job, pipeline.id, scope)),
+          ...bridges.data.items.map((bridge) => checkFromBridge(bridge, pipeline.id, scope))
+        ];
+        const pipelineState = stateOf(pipeline.status, false);
+        if (pipelineState === "failing" && !checks.some((check) => check.state === "failing"))
+          checks.push(pipelineCheck("failing", pipeline.status, pipeline));
+        if (pipelineState === "pending" && !checks.some((check) => check.state === "pending"))
+          checks.push(pipelineCheck("pending", pipeline.status, pipeline));
+      } else if (open && pipeline) {
+        checks = [pipelineCheck("pending", "awaiting_pipeline_for_head", null)];
+      }
+      const discussions = pages(`${project}/merge_requests/${iid}/discussions`, `merge request !${iid} discussions`);
+      if (!discussions.ok)
+        return discussions;
+      truncated ||= discussions.data.truncated;
+      const threads = discussions.data.items.filter((discussion) => discussion.notes.some((note) => note.resolvable === true && note.resolved !== true)).map((discussion) => {
+        const note = discussion.notes[0];
+        return {
+          id: discussion.id,
+          path: note.position?.new_path ?? note.position?.old_path ?? null,
+          line: note.position?.new_line ?? null,
+          author: note.author?.username ?? null,
+          isBot: isBot(note.author),
+          outdated: false,
+          url: safeUrl2(`${value.web_url}#note_${note.id}`),
+          body: shortBody(note.body ?? "")
+        };
+      });
+      const detailed = value.detailed_merge_status ?? "unchecked";
+      const conflicts = value.has_conflicts === true || detailed === "conflict";
+      const status = {
+        number: value.iid,
+        url: value.web_url,
+        state: mrState(value.state),
+        draft: value.draft ?? value.work_in_progress ?? false,
+        base: value.target_branch,
+        baseSha: open ? baseTip(value.target_branch) : null,
+        head: { branch: value.source_branch, sha: value.sha },
+        mergeable: conflicts ? "no" : UNSETTLED.has(detailed) ? "unknown" : "yes",
+        conflicts,
+        rebaseRequired: detailed === "need_rebase",
+        reviewDecision: detailed === "not_approved" ? "review_required" : detailed === "requested_changes" ? "changes_requested" : null,
+        mergeState: detailed,
+        inMergeQueue: false,
+        checks,
+        requiredContexts: [],
+        threads,
+        truncated
+      };
+      return success2(status);
+    },
+    jobLogTail(job, lines) {
+      const scope = job.scope ?? encodeURIComponent(repo);
+      const text = apiText(runner, "glab", apiHost, ["api", `projects/${scope}/jobs/${job.jobId}/trace`], `job ${job.jobId} trace`, FORGE_TIMEOUTS.log);
+      return text.ok ? success2(logTail(text.data, lines)) : text;
+    },
+    rerun(target) {
+      const scope = target.scope ?? encodeURIComponent(repo);
+      const endpoint = target.kind === "failed_in_run" ? `projects/${scope}/pipelines/${target.runId}/retry` : `projects/${scope}/jobs/${target.jobId}/retry`;
+      const what = target.kind === "failed_in_run" ? `retry of pipeline ${target.runId}` : `retry of job ${target.jobId}`;
+      const run = apiText(runner, "glab", apiHost, ["api", "-X", "POST", endpoint], what, FORGE_TIMEOUTS.api);
+      return run.ok ? success2(undefined) : run;
+    }
+  };
+}
+var GITLAB_MAX_PAGES = 10, PER_PAGE = 100, mrState = (value) => value === "merged" ? "merged" : value === "opened" ? "open" : "closed", PENDING, stateOf = (status, allowFailure) => {
+  const failed = status === "failed" || status === "canceled";
+  return PENDING.has(status) ? "pending" : failed ? allowFailure ? "passing" : "failing" : status === "success" ? "passing" : "skipped";
+}, pipelineCheck = (state, conclusion, pipeline) => ({
+  name: "pipeline",
+  context: "pipeline",
+  state,
+  conclusion,
+  url: safeUrl2(pipeline?.web_url ?? null),
+  runId: pipeline?.id ?? null,
+  jobId: null,
+  scope: pipeline ? String(pipeline.project_id) : null,
+  required: true
+}), safeUrl2 = (value) => value ? redactText(value) : null, isBot = (author) => author?.bot === true || /(?:^project_\d+_bot|bot$|\[bot\]$)/iu.test(author?.username ?? ""), UNSETTLED;
+var init_gitlab = __esm(() => {
+  init_exec();
+  init_redact();
+  PENDING = new Set([
+    "created",
+    "pending",
+    "running",
+    "waiting_for_resource",
+    "waiting_for_callback",
+    "preparing",
+    "scheduled"
+  ]);
+  UNSETTLED = new Set(["checking", "unchecked", "preparing", "approvals_syncing"]);
+});
+
+// packages/workit-core/src/forge/resolve.ts
+import fs18 from "node:fs";
+function resolveForge(cwd, options = {}) {
+  let workspace;
+  try {
+    workspace = resolveRuntimeWorkspaceVcs(cwd);
+  } catch (error) {
+    return failure3("blocked", error instanceof Error ? error.message : String(error), "fix ~/.config/workit/workspaces.json (workit init → Workspaces)");
+  }
+  const hosts = configuredHosts();
+  const pushed = pushForge(cwd, { branch: options.branch, hosts, sshConfig: options.sshConfig });
+  if (!pushed.ok)
+    return failure3(pushed.code, pushed.error, pushed.unblock);
+  const conflict = forgeConflict(pushed.forge, workspace?.vcs?.provider);
+  if (conflict)
+    return failure3("blocked", conflict.error, conflict.unblock);
+  const derived = pushed.forge;
+  const { kind, apiHost } = derived;
+  const base = options.runner ?? systemRunner(kind, apiHost, options.env ?? process.env);
+  const now = options.now ?? Date.now;
+  const expectedAccount = workspace?.vcs?.account ?? null;
+  let token;
+  let credential = "cli_login";
+  const tokenFile = workspace?.vcs?.tokenFile;
+  if (typeof tokenFile === "string" && tokenFile.trim()) {
+    const workspaceHost = workspace?.vcs?.host;
+    const explicit = typeof workspaceHost === "string" && workspaceHost.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "") === apiHost;
+    if (derived.via === "host_name" && !explicit)
+      return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
+    try {
+      token = fs18.readFileSync(tokenFile.trim(), "utf8").trim();
+    } catch {
+      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
+    }
+    if (!token)
+      return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile is empty`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
+    credential = "workspace_token_file";
+  } else if (expectedAccount && kind === "github") {
+    const issued = base("gh", ["auth", "token", "--hostname", apiHost, "--user", expectedAccount], {
+      timeoutMs: FORGE_TIMEOUTS.api
+    });
+    if (issued.missing)
+      return failure3("unavailable", "gh is not installed", "install the GitHub CLI (https://cli.github.com) and run: gh auth login");
+    token = issued.status === 0 ? issued.stdout.trim() : "";
+    if (!token)
+      return failure3("blocked", `identity_unavailable: gh has no login for ${expectedAccount} on ${apiHost} (workspace ${workspace?.name ?? "?"})`, `gh auth login --hostname ${apiHost}  # sign in as ${expectedAccount}; workit passes that account's token per call and never switches the active account`);
+    credential = "gh_account_token";
+  }
+  const limits = { deadline: null };
+  const runner = (bin, args, callOptions) => {
+    let timeoutMs = callOptions.timeoutMs;
+    if (limits.deadline !== null) {
+      const remaining = limits.deadline - now();
+      if (remaining <= 0)
+        return { status: null, stdout: "", stderr: "", timedOut: true, missing: false };
+      timeoutMs = Math.min(timeoutMs, remaining);
+    }
+    return base(bin, args, { ...callOptions, timeoutMs, ...token ? { token } : {} });
+  };
+  const headRepo = derived.repo;
+  const probe = createForge(derived, headRepo, runner);
+  const info = probe.repoInfo(headRepo);
+  if (!info.ok && info.code !== "not_found")
+    return info;
+  const headProjectId = info.ok ? info.data.id : null;
+  const remotes = remoteNames(cwd);
+  const repoOfRemote = (name) => {
+    const url = pushUrl(cwd, name);
+    const other = url ? deriveForge(url, { hosts, sshConfig: options.sshConfig }) : null;
+    return other && other.kind === kind && other.apiHost === apiHost ? other.repo : null;
+  };
+  const upstream = pushed.remote !== "upstream" && remotes.includes("upstream") ? repoOfRemote("upstream") : null;
+  const baseRepo = upstream && upstream !== headRepo ? upstream : info.ok && info.data.parent ? info.data.parent : headRepo;
+  const baseRemote = baseRepo === headRepo ? pushed.remote : remotes.find((name) => repoOfRemote(name) === baseRepo) ?? pushed.remote;
+  return success2({
+    forge: baseRepo === headRepo ? probe : createForge(derived, baseRepo, runner),
+    remote: pushed.remote,
+    url: pushed.url,
+    derived,
+    workspace: workspace?.name ?? null,
+    expectedAccount,
+    credential,
+    headRepo,
+    headProjectId,
+    fork: baseRepo !== headRepo,
+    baseRemote,
+    limits
+  });
+}
+function checkIdentity(resolved) {
+  const { forge, expectedAccount } = resolved;
+  const identity = forge.identity(expectedAccount);
+  if (!identity.ok)
+    return identity;
+  if (identity.data.matches === false) {
+    const bin = forge.kind === "github" ? "gh" : "glab";
+    const where = `workspace ${resolved.workspace ?? "?"}`;
+    return failure3("blocked", `identity_mismatch: the ${resolved.credential === "workspace_token_file" ? "vcs.tokenFile token" : `${bin} login`} is ${identity.data.login} but ${where} expects ${expectedAccount}`, resolved.credential === "workspace_token_file" ? `put a token for ${expectedAccount} in the ${where} vcs.tokenFile` : `${bin} auth login --hostname ${forge.apiHost}  # sign in as ${expectedAccount}`);
+  }
+  return identity;
+}
+var configuredHosts = () => {
+  const vcs = readVcsConfig();
+  if (vcs.status !== "valid")
+    return {};
+  const host = (kind) => {
+    const value = vcs.config[kind]?.host;
+    return typeof value === "string" && value.trim() ? [value.trim()] : [];
+  };
+  return { github: host("github"), gitlab: host("gitlab") };
+}, createForge = (derived, repo, runner) => derived.kind === "github" ? createGitHubForge({ apiHost: derived.apiHost, repo, runner }) : createGitLabForge({ apiHost: derived.apiHost, repo, runner });
+var init_resolve = __esm(() => {
+  init_vcs_config();
+  init_workspaces();
+  init_rev();
+  init_exec();
+  init_github();
+  init_gitlab();
+});
+
+// packages/workit-cli/src/verbs/forge-common.ts
+function parseFlags(argv, spec) {
+  const parsed = { values: {}, booleans: new Set, lists: {}, positionals: [] };
+  for (let index = 0;index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--json")
+      continue;
+    if (!arg.startsWith("--")) {
+      parsed.positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const name = arg.slice(2, eq < 0 ? undefined : eq);
+    const kind = spec[name];
+    if (!kind)
+      return `unknown option --${name}`;
+    if (kind === "boolean") {
+      if (eq >= 0)
+        return `--${name} takes no value`;
+      parsed.booleans.add(name);
+      continue;
+    }
+    const value = eq >= 0 ? arg.slice(eq + 1) : argv[++index];
+    if (value === undefined || value === "" || eq < 0 && value.startsWith("--"))
+      return `--${name} requires a value`;
+    if (kind === "list")
+      (parsed.lists[name] ??= []).push(value);
+    else
+      parsed.values[name] = value;
+  }
+  return parsed;
+}
+function positiveInt(value, flag) {
+  if (value === undefined)
+    return null;
+  return /^[1-9]\d{0,8}$/u.test(value) ? Number(value) : `${flag} must be a positive integer`;
+}
+function parseDuration2(value) {
+  const match = /^(\d+(?:\.\d+)?)(ms|s|m|h)?$/u.exec(value.trim());
+  if (!match)
+    return null;
+  const unit = match[2] ?? "s";
+  const factor = unit === "ms" ? 1 : unit === "s" ? 1000 : unit === "m" ? 60000 : 3600000;
+  return Math.round(Number(match[1]) * factor);
+}
+function connect(io, branch) {
+  const resolved = resolveForge(io.cwd, {
+    branch,
+    env: io.env,
+    runner: forgeDeps.runner,
+    now: forgeDeps.now
+  });
+  if (!resolved.ok)
+    return resolved;
+  const identity = checkIdentity(resolved.data);
+  if (!identity.ok)
+    return identity;
+  return {
+    ok: true,
+    data: {
+      ...resolved.data,
+      identity: {
+        login: identity.data.login,
+        credential: resolved.data.credential,
+        ...identity.data.note ? { note: identity.data.note } : {}
+      }
+    }
+  };
+}
+function renderStatus(doc) {
+  const noun = doc.forge === "github" ? `PR #${doc.number}` : `MR !${doc.number}`;
+  const lines = [
+    `${noun} ${doc.state}${doc.draft ? " (draft)" : ""}: ${doc.headRepo ? `${doc.headRepo}:` : ""}${doc.head.branch} -> ${doc.base}  ${doc.url}`
+  ];
+  const local = doc.head.localSha === null ? "not checked out" : doc.head.pushed ? "local matches" : `local ${short(doc.head.localSha)} differs`;
+  lines.push(`head ${short(doc.head.sha)} (${local})`);
+  const behind = doc.behindBase;
+  const behindText = !behind ? "" : behind.behind === null ? ` · behind ${doc.base}: unknown (${behind.error ?? "unavailable"})` : ` · behind ${doc.base}: ${behind.behind}, ahead ${behind.ahead}`;
+  lines.push(`mergeable ${doc.mergeable} · conflicts ${doc.conflicts ? "yes" : "no"}${doc.rebaseRequired ? " · rebase required" : ""}${behindText}`);
+  const checks = doc.checks;
+  lines.push(`checks ${checks.state}: ${checks.failing.length} failing, ${checks.pending.length} pending, ${checks.passing} passing`);
+  for (const check of checks.failing) {
+    lines.push(`  x ${check.name} (${check.conclusion ?? "failed"}${check.required === false ? ", optional" : ""})${check.rerunsOnHead ? ` [rerun ${check.rerunsOnHead}x on this head]` : ""}${check.url ? `  ${check.url}` : ""}`);
+    for (const value of check.logTail)
+      lines.push(`      ${value}`);
+    if (check.logError)
+      lines.push(`      (log unavailable: ${check.logError})`);
+  }
+  if (checks.pending.length)
+    lines.push(`  pending: ${checks.pending.join(", ")}`);
+  if (checks.missingRequired === null)
+    lines.push("  required checks: unknown (branch protection not readable)");
+  else if (checks.missingRequired.length)
+    lines.push(`  required, not reported yet: ${checks.missingRequired.join(", ")}`);
+  const threads = doc.reviews.unresolvedThreads;
+  lines.push(`reviews ${doc.reviews.decision ?? "none"} · ${threads.length} unresolved thread${threads.length === 1 ? "" : "s"}`);
+  for (const thread of threads)
+    lines.push(`  - ${thread.path ? `${thread.path}${thread.line ? `:${thread.line}` : ""} ` : ""}@${thread.author ?? "?"}${thread.isBot ? " (bot)" : ""}: ${thread.body}`);
+  if (doc.truncated)
+    lines.push("(lists truncated at the page cap)");
+  if (doc.blockers.length)
+    lines.push(`blockers: ${doc.blockers.join(", ")}`);
+  if (doc.identity?.note)
+    lines.push(`identity: ${doc.identity.note}`);
+  lines.push(`next: ${doc.next}`);
+  return lines;
+}
+var forgeDeps, usage3 = (io, message, line) => emit(io, fail("invalid_input", message, { unblock: line })), forgeFail = (io, result, data) => emit(io, fail(result.code, result.error, { data, unblock: result.unblock })), short = (sha) => sha ? sha.slice(0, 7) : "?";
+var init_forge_common = __esm(() => {
+  init_resolve();
+  init_output();
+  forgeDeps = {
+    runner: undefined,
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    now: () => Date.now()
+  };
+});
+
 // packages/workit-cli/src/verbs/pr.ts
 var exports_pr = {};
 __export(exports_pr, {
   run: () => run13
 });
-var run13;
+async function status(argv, io) {
+  const flags = parseFlags(argv, { pr: "value", branch: "value", "log-lines": "value" });
+  if (typeof flags === "string")
+    return usage3(io, flags, STATUS_USAGE);
+  if (flags.positionals.length)
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE);
+  const pr = positiveInt(flags.values.pr, "--pr");
+  if (typeof pr === "string")
+    return usage3(io, pr, STATUS_USAGE);
+  if (pr && flags.values.branch)
+    return usage3(io, "pass --pr or --branch, not both", STATUS_USAGE);
+  const logLines = flags.values["log-lines"] === "0" ? 0 : positiveInt(flags.values["log-lines"], "--log-lines");
+  if (typeof logLines === "string")
+    return usage3(io, logLines, STATUS_USAGE);
+  if (logLines !== null && logLines > 500)
+    return usage3(io, "--log-lines is capped at 500", STATUS_USAGE);
+  const connected = connect(io, flags.values.branch);
+  if (!connected.ok)
+    return forgeFail(io, connected);
+  const report = prStatusReport(io.cwd, connected.data, {
+    pr,
+    branch: flags.values.branch ?? null,
+    logLines: logLines ?? 60,
+    identity: connected.data.identity
+  });
+  if (!report.ok)
+    return forgeFail(io, report);
+  return emit(io, ok(report.data.doc), renderStatus);
+}
+async function run13(argv, io) {
+  const [sub, ...rest] = argv;
+  if (sub === "status")
+    return status(rest, io);
+  if (sub === "create" || sub === "merge")
+    return later(argv, io);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", STATUS_USAGE);
+}
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", later;
 var init_pr = __esm(() => {
+  init_report();
+  init_output();
+  init_forge_common();
   init_stub();
-  run13 = notImplemented("pr", "S10/S11");
+  later = notImplemented("pr", "S11");
 });
 
 // packages/workit-cli/src/verbs/ci.ts
@@ -73032,10 +74868,181 @@ var exports_ci = {};
 __export(exports_ci, {
   run: () => run14
 });
-var run14;
+async function wait(argv, io) {
+  const flags = parseFlags(argv, {
+    pr: "value",
+    branch: "value",
+    head: "value",
+    timeout: "value",
+    interval: "value"
+  });
+  if (typeof flags === "string")
+    return usage3(io, flags, WAIT_USAGE);
+  if (flags.positionals.length)
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, WAIT_USAGE);
+  const pr = positiveInt(flags.values.pr, "--pr");
+  if (typeof pr === "string")
+    return usage3(io, pr, WAIT_USAGE);
+  const timeoutMs = parseDuration2(flags.values.timeout ?? "20m");
+  const intervalMs = parseDuration2(flags.values.interval ?? "30s");
+  if (timeoutMs === null || timeoutMs > 6 * 3600000)
+    return usage3(io, "--timeout must be a duration up to 6h (20m, 90s)", WAIT_USAGE);
+  if (intervalMs === null || intervalMs < 1000 || intervalMs > 600000)
+    return usage3(io, "--interval must be between 1s and 10m", WAIT_USAGE);
+  if (pr && flags.values.branch)
+    return usage3(io, "pass --pr or --branch, not both", WAIT_USAGE);
+  const head = flags.values.head ?? null;
+  if (head !== null && !/^[0-9a-f]{7,64}$/u.test(head))
+    return usage3(io, "--head must be a commit sha (7-64 hex chars)", WAIT_USAGE);
+  const connected = connect(io, flags.values.branch);
+  if (!connected.ok)
+    return forgeFail(io, connected);
+  const resolved = connected.data;
+  const number = selectPr(io.cwd, resolved, { pr, branch: flags.values.branch ?? null });
+  if (!number.ok)
+    return forgeFail(io, number);
+  const started = forgeDeps.now();
+  const deadline = started + timeoutMs;
+  resolved.limits.deadline = started + Math.max(timeoutMs, ONE_POLL_MS);
+  let polls = 0;
+  let errors = 0;
+  let status = null;
+  let verdict = { state: "waiting", reason: "not_polled" };
+  for (;; ) {
+    const read = resolved.forge.prStatus(number.data);
+    polls += 1;
+    const elapsedMs = forgeDeps.now() - started;
+    if (read.ok) {
+      errors = 0;
+      status = read.data;
+      const doc = buildStatusDoc(io.cwd, resolved, status, { logLines: 0, behind: false });
+      if (!doc.ok)
+        return forgeFail(io, doc);
+      verdict = waitVerdict(doc.data, { head, elapsedMs });
+      if (verdict.state !== "waiting")
+        break;
+    } else {
+      errors += 1;
+      if (read.code !== "unavailable" && read.code !== "failed")
+        return forgeFail(io, read);
+      if (errors >= MAX_POLL_ERRORS)
+        return forgeFail(io, read, { polls });
+    }
+    const remaining = deadline - forgeDeps.now();
+    if (remaining <= 0)
+      break;
+    await forgeDeps.sleep(Math.min(pollDelay(intervalMs, polls - 1), remaining));
+  }
+  const elapsedMs = forgeDeps.now() - started;
+  if (!status)
+    return emit(io, fail("unavailable", "no successful poll before the timeout", { data: { polls } }));
+  const left = deadline - forgeDeps.now();
+  const built = buildStatusDoc(io.cwd, resolved, status, {
+    logLines: verdict.state === "failed" && left > 0 ? 60 : 0,
+    behind: left >= 1000,
+    behindTimeoutMs: Math.max(1000, Math.min(15000, left)),
+    identity: resolved.identity
+  });
+  if (!built.ok)
+    return forgeFail(io, built);
+  const doc = built.data;
+  const data = {
+    state: verdict.state,
+    reason: verdict.reason,
+    polls,
+    elapsedMs,
+    timeoutMs,
+    status: doc
+  };
+  if (!io.json && verdict.state !== "ready")
+    for (const value of renderStatus(doc))
+      io.stdout(`${value}
+`);
+  if (verdict.state === "ready")
+    return emit(io, ok(data), () => [
+      `CI ready (${verdict.reason}) after ${polls} poll${polls === 1 ? "" : "s"}, ${seconds(elapsedMs)}`,
+      ...renderStatus(doc)
+    ]);
+  if (verdict.state === "failed")
+    return emit(io, fail("failed", `CI failed: ${doc.checks.failing.map((check) => check.name).join(", ")}`, {
+      data,
+      unblock: "fix the failure, or if it is a flake: workit ci rerun --failed --reason flake"
+    }));
+  if (verdict.state === "blocked")
+    return emit(io, fail("blocked", `CI wait blocked: ${verdict.reason}`, { data, unblock: verdict.unblock }));
+  return emit(io, fail("pending", `CI still ${verdict.reason.replaceAll("_", " ")} after ${seconds(elapsedMs)}`, {
+    data,
+    unblock: `workit ci wait --pr ${doc.number}${head ? ` --head ${head}` : ""}`
+  }));
+}
+async function rerun(argv, io) {
+  const flags = parseFlags(argv, {
+    pr: "value",
+    branch: "value",
+    check: "list",
+    failed: "boolean",
+    reason: "value",
+    force: "boolean"
+  });
+  if (typeof flags === "string")
+    return usage3(io, flags, RERUN_USAGE);
+  if (flags.positionals.length)
+    return usage3(io, `unexpected argument ${flags.positionals[0]}`, RERUN_USAGE);
+  const pr = positiveInt(flags.values.pr, "--pr");
+  if (typeof pr === "string")
+    return usage3(io, pr, RERUN_USAGE);
+  const names = flags.lists.check ?? [];
+  if (pr && flags.values.branch)
+    return usage3(io, "pass --pr or --branch, not both", RERUN_USAGE);
+  if (names.length && flags.booleans.has("failed"))
+    return usage3(io, "pass --check or --failed, not both", RERUN_USAGE);
+  const reason = flags.values.reason;
+  if (reason !== "flake" && reason !== "infra")
+    return usage3(io, "--reason flake|infra is required: rerun only what you judged a flake or an infrastructure failure", RERUN_USAGE);
+  const connected = connect(io, flags.values.branch);
+  if (!connected.ok)
+    return forgeFail(io, connected);
+  const resolved = connected.data;
+  if (resolved.expectedAccount && resolved.identity.login === null)
+    return emit(io, fail("blocked", `identity_unverified: the credential cannot prove it is ${resolved.expectedAccount} (${resolved.identity.note ?? "no /user access"})`, {
+      unblock: `use a credential for ${resolved.expectedAccount} that can read /user (vcs.tokenFile or ${resolved.forge.kind === "github" ? "gh" : "glab"} auth login --hostname ${resolved.forge.apiHost})`
+    }));
+  const number = selectPr(io.cwd, resolved, { pr, branch: flags.values.branch ?? null });
+  if (!number.ok)
+    return forgeFail(io, number);
+  const status = resolved.forge.prStatus(number.data);
+  if (!status.ok)
+    return forgeFail(io, status);
+  const done = executeRerun(io.cwd, resolved, status.data, {
+    failed: names.length === 0,
+    names,
+    reason,
+    force: flags.booleans.has("force")
+  });
+  if (!done.ok)
+    return forgeFail(io, done);
+  const outcome = done.data;
+  return emit(io, ok(outcome), () => [
+    `rerun requested on #${outcome.pr} head ${outcome.head.slice(0, 7)} (${outcome.reason}${outcome.forced ? ", forced" : ""}): ${outcome.rerun.map((check) => check.name).join(", ")}`,
+    ...outcome.skipped.length ? [`not rerunnable here: ${outcome.skipped.join(", ")}`] : [],
+    ...outcome.recorded ? [] : ["warning: the rerun could not be recorded; the once-per-head guard will not see it"],
+    "next: workit ci wait"
+  ]);
+}
+async function run14(argv, io) {
+  const [sub, ...rest] = argv;
+  if (sub === "wait")
+    return wait(rest, io);
+  if (sub === "rerun")
+    return rerun(rest, io);
+  return usage3(io, sub && !sub.startsWith("-") ? `unknown ci subcommand "${sub}"` : "missing ci subcommand", `${WAIT_USAGE}
+       ${RERUN_USAGE}`);
+}
+var WAIT_USAGE = "workit ci wait [--pr <n> | --branch <b>] [--head <sha>] [--timeout 20m] [--interval 30s] [--json]", RERUN_USAGE = "workit ci rerun [--pr <n> | --branch <b>] [--check <name>… | --failed] --reason flake|infra [--force] [--json]", ONE_POLL_MS = 20000, MAX_POLL_ERRORS = 3, seconds = (ms) => `${Math.round(ms / 1000)}s`;
 var init_ci = __esm(() => {
-  init_stub();
-  run14 = notImplemented("ci", "S10");
+  init_report();
+  init_output();
+  init_forge_common();
 });
 
 // packages/workit-cli/src/verbs/git.ts
@@ -73071,15 +75078,991 @@ var init_stack = __esm(() => {
   run17 = notImplemented("stack", "S12");
 });
 
+// packages/workit-core/src/ledger.ts
+import { spawnSync as spawnSync15 } from "node:child_process";
+import { createHash as createHash13, randomBytes as randomBytes2 } from "node:crypto";
+import fs19 from "node:fs";
+import path37 from "node:path";
+function resolveCommit(cwd, ref) {
+  if (!safeRef(ref))
+    return null;
+  return git2(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]);
+}
+function branchHead(cwd, branch) {
+  if (!safeRef(branch))
+    return null;
+  return resolveCommit(cwd, `refs/heads/${branch}`) ?? resolveCommit(cwd, `refs/remotes/origin/${branch}`);
+}
+function defaultBase2(cwd) {
+  const originHead = git2(cwd, ["symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD"]);
+  if (originHead && resolveCommit(cwd, originHead))
+    return originHead;
+  for (const candidate of ["origin/main", "origin/master", "main", "master"])
+    if (resolveCommit(cwd, candidate))
+      return candidate;
+  return null;
+}
+function diffHash(cwd, base, head) {
+  if (!safeRef(base) || !safeRef(head))
+    return null;
+  const diff = gitRun(cwd, [
+    "diff",
+    "-U3",
+    "--diff-algorithm=myers",
+    "--indent-heuristic",
+    "--no-color",
+    "--no-ext-diff",
+    "--no-textconv",
+    "--no-renames",
+    "--full-index",
+    "--binary",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    `${base}...${head}`,
+    "--"
+  ], GIT_TIMEOUTS.worktree);
+  if (!diff.ok || !diff.stdout)
+    return null;
+  const hash = createHash13("sha256");
+  for (const line of diff.stdout.split(`
+`)) {
+    if (line.startsWith("index "))
+      continue;
+    hash.update(line.startsWith("@@ ") ? "@@" : line);
+    hash.update(`
+`);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+function storeRoot(cwd) {
+  const run = gitRun(cwd, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  const common = run.stdout.trim();
+  if (run.ok && common)
+    return {
+      ok: true,
+      value: { root: path37.join(path37.resolve(cwd, common), "workit"), shared: true }
+    };
+  if (!run.ok && NOT_A_REPO.test(run.stderr))
+    return { ok: true, value: { root: path37.join(path37.resolve(cwd), ".workit"), shared: false } };
+  return err("unavailable", `cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
+`)[0] || "no output"})`, "fix the repository (git status should work here) or run from a non-git directory");
+}
+function ledgerPath(cwd) {
+  const root = storeRoot(cwd);
+  return root.ok ? { ok: true, value: path37.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+}
+function actorFromEnv(env) {
+  const value = (key) => {
+    const raw = env[key]?.trim();
+    return raw ? raw : null;
+  };
+  return {
+    host: value("WORKIT_HOST") ?? "cli",
+    session: value("WORKIT_SESSION_ID"),
+    agentId: value("WORKIT_AGENT_ID")
+  };
+}
+function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS2) {
+  const lock = `${file}.lock`;
+  const deadline = Date.now() + waitMs;
+  let token = null;
+  for (;; ) {
+    token = ledgerLock.acquire(lock);
+    if (token)
+      break;
+    const observed = lockToken(lock);
+    const age = lockAgeMs(lock);
+    if (age !== null && age > LOCK_STALE_MS2 && ledgerLock.reap(lock, observed))
+      continue;
+    if (Date.now() >= deadline)
+      return null;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+  }
+  try {
+    return fn();
+  } finally {
+    ledgerLock.release(lock, token);
+  }
+}
+function appendLine(file, line, options) {
+  const write = () => {
+    const fd = fs19.openSync(file, "a+");
+    try {
+      const size = fs19.fstatSync(fd).size;
+      let fence = "";
+      if (size > 0) {
+        const last = Buffer.alloc(1);
+        fs19.readSync(fd, last, 0, 1, size - 1);
+        if (last[0] !== 10)
+          fence = `
+`;
+      }
+      const bytes = Buffer.from(fence + line);
+      const written = fs19.writeSync(fd, bytes);
+      if (written !== bytes.length)
+        return err("unavailable", `short write to ${file}: ${written} of ${bytes.length} bytes; the row is torn and will be skipped`);
+      return { ok: true, value: undefined };
+    } finally {
+      fs19.closeSync(fd);
+    }
+  };
+  try {
+    fs19.mkdirSync(path37.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path37.dirname(file)))
+      return write();
+    const locked = withLedgerLock(file, write);
+    return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
+  } catch (error) {
+    return err("unavailable", `cannot append to ${file}: ${error.message}`);
+  }
+}
+function appendRaw(cwd, row, options) {
+  const { full, line } = serialize(row, options.now ?? new Date);
+  const bytes = Buffer.byteLength(line);
+  if (bytes > MAX_LINE_BYTES)
+    return err("invalid_input", `ledger row is ${bytes} bytes; the limit is ${MAX_LINE_BYTES}. Shorten the text and pass details by --ref <path|url>`);
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return file;
+  const written = appendLine(file.value, line, options);
+  return written.ok ? { ok: true, value: full } : written;
+}
+function appendRow(cwd, row, options = {}) {
+  if (row.observer === "workit_cli")
+    return err("invalid_input", 'observer "workit_cli" is reserved for appendObserved');
+  return appendRaw(cwd, row, options);
+}
+function supersedeAllowed(by, target) {
+  if (by.type !== target.type)
+    return `a ${by.type} row cannot supersede a ${target.type} row`;
+  if (!by.actor.session || by.actor.session !== target.actor.session)
+    return "only the session that wrote a row can supersede it";
+  if (by.type === "verdict" && by.self === true && target.self !== true)
+    return "a self verdict cannot replace an independent verdict";
+  return null;
+}
+function readLedger(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return file;
+  let text = "";
+  try {
+    text = fs19.readFileSync(file.value, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { ok: true, value: { path: file.value, rows: [], skipped: 0 } };
+    return err("unavailable", `cannot read ${file.value}: ${error.message}`);
+  }
+  const rows = [];
+  let skipped = 0;
+  for (const raw of text.split(`
+`)) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+      continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      skipped += 1;
+      continue;
+    }
+    if (!isRecord5(parsed) || !str(parsed.id) || !str(parsed.type) || !str(parsed.at)) {
+      skipped += 1;
+      continue;
+    }
+    const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
+    rows.push({
+      ...parsed,
+      v: typeof parsed.v === "number" ? parsed.v : LEDGER_VERSION,
+      id: parsed.id,
+      at: parsed.at,
+      type: parsed.type,
+      actor: normalizeActor(parsed.actor),
+      branch: str(parsed.branch),
+      head: str(parsed.head),
+      base: str(parsed.base),
+      baseSha: str(parsed.baseSha),
+      patchId: str(parsed.patchId),
+      diffHash: str(parsed.diffHash),
+      tree: str(parsed.tree),
+      dirty: typeof parsed.dirty === "boolean" ? parsed.dirty : null,
+      ...pr === undefined ? {} : { pr },
+      ...str(parsed.supersedes) ? { supersedes: parsed.supersedes } : {},
+      seq: rows.length + 1,
+      superseded: false,
+      supersedeIgnored: false
+    });
+  }
+  const byId = new Map;
+  for (const row of rows) {
+    const target = row.supersedes ? byId.get(row.supersedes) : undefined;
+    if (target && supersedeAllowed(row, target) === null)
+      target.superseded = true;
+    else if (row.supersedes)
+      row.supersedeIgnored = true;
+    if (!byId.has(row.id))
+      byId.set(row.id, row);
+  }
+  return { ok: true, value: { path: file.value, rows, skipped } };
+}
+function filterRows(rows, filter) {
+  const matched = rows.filter((row) => (filter.branch === undefined || row.branch === filter.branch) && (filter.pr === undefined || row.pr === filter.pr) && (filter.type === undefined || row.type === filter.type));
+  return filter.last === undefined ? matched : matched.slice(Math.max(0, matched.length - filter.last));
+}
+function branchForPr(cwd, rows, pr) {
+  for (let index = rows.length - 1;index >= 0; index -= 1) {
+    const row = rows[index];
+    if (row.pr === pr && row.branch && PR_ROW_TYPES.has(row.type) && row.observer === "workit_cli")
+      return { ok: true, branch: row.branch, source: "pr_row" };
+  }
+  const tips = git2(cwd, [
+    "for-each-ref",
+    "--format=%(objectname)",
+    `refs/pull/${pr}/head`,
+    `refs/merge-requests/${pr}/head`,
+    `refs/remotes/*/pull/${pr}/head`,
+    `refs/remotes/*/merge-requests/${pr}/head`
+  ]);
+  const shas = [...new Set((tips ?? "").split(`
+`).filter(Boolean))];
+  if (shas.length === 0)
+    return { ok: false, reason: "unknown", candidates: [] };
+  if (shas.length > 1)
+    return { ok: false, reason: "ambiguous", candidates: shas };
+  const branches = (git2(cwd, ["for-each-ref", "--format=%(refname:short)", "--points-at", shas[0], "refs/heads"]) ?? "").split(`
+`).filter(Boolean);
+  if (branches.length === 1)
+    return { ok: true, branch: branches[0], source: "forge_ref" };
+  return branches.length === 0 ? { ok: false, reason: "unknown", candidates: [] } : { ok: false, reason: "ambiguous", candidates: branches };
+}
+function codeKey(cwd, options = {}) {
+  const checkedOut = currentBranch2(cwd);
+  const branch = options.branch ?? checkedOut;
+  const head = branch ? branchHead(cwd, branch) : headSha(cwd);
+  const base = options.base ?? defaultBase2(cwd);
+  const baseSha = base ? resolveCommit(cwd, base) : null;
+  const onTree = branch !== null && branch === checkedOut;
+  const tree = onTree ? worktreeTree(cwd) : null;
+  return {
+    branch,
+    head,
+    base,
+    baseSha,
+    patchId: base && head ? patchId(cwd, base, head) : null,
+    diffHash: base && head ? diffHash(cwd, base, head) : null,
+    tree: tree?.key ?? null,
+    dirty: tree ? tree.dirty : null
+  };
+}
+function verdictBasis(verdict, current) {
+  if (verdict.head && verdict.head === current.head)
+    return "fresh";
+  if (verdict.patchId && verdict.patchId === current.patchId && verdict.diffHash && verdict.diffHash === current.diffHash)
+    return "carried";
+  return "stale";
+}
+function trailerSessions(cwd, base, head) {
+  if (!base || !head || !safeRef(base) || !safeRef(head))
+    return [];
+  const out = git2(cwd, [
+    "log",
+    "--format=%(trailers:key=Workit-Session,valueonly,separator=%x00)",
+    `${base}..${head}`
+  ]);
+  return (out ?? "").split(/[\0\n]/u).map((value) => value.trim()).filter(Boolean);
+}
+function authorSessions(cwd, rows, branch, range = { base: null, head: null }) {
+  const sessions = new Set;
+  for (const row of rows) {
+    if (row.branch !== branch || row.type !== "commit.recorded" && row.type !== "task.opened")
+      continue;
+    const session = str(row.session) ?? row.actor.session;
+    if (session)
+      sessions.add(session);
+  }
+  for (const session of trailerSessions(cwd, range.base, range.head))
+    sessions.add(session);
+  return sessions;
+}
+function effectiveOf(rows, authors) {
+  let effective = null;
+  for (const row of rows) {
+    if (!effective) {
+      effective = row;
+      continue;
+    }
+    const rowIndependent = independenceReasons(row, authors).length === 0;
+    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (effIndependent && !rowIndependent)
+      continue;
+    if (effIndependent && FAILING2.has(String(effective.result)) && row.actor.session === effective.actor.session)
+      continue;
+    effective = row;
+  }
+  return effective;
+}
+function checkVerdicts(cwd, branch, rows) {
+  const head = branchHead(cwd, branch);
+  const fallbackBase = defaultBase2(cwd);
+  const keyCache = new Map;
+  const keyFor = (base) => {
+    if (!base || !head)
+      return { patchId: null, diffHash: null };
+    let key = keyCache.get(base);
+    if (!key) {
+      key = { patchId: patchId(cwd, base, head), diffHash: diffHash(cwd, base, head) };
+      keyCache.set(base, key);
+    }
+    return key;
+  };
+  const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head });
+  const byKind = new Map;
+  for (const row of rows)
+    if (row.branch === branch && isLiveVerdict(row)) {
+      const kind = typeof row.kind === "string" ? row.kind : "review";
+      byKind.set(kind, [...byKind.get(kind) ?? [], row]);
+    }
+  const verdicts = [];
+  for (const [kind, list] of byKind) {
+    const row = effectiveOf(list, authors);
+    if (!row)
+      continue;
+    const basis = verdictBasis(row, { head, ...keyFor(row.base ?? fallbackBase) });
+    const current = basis !== "stale";
+    const independence = independenceReasons(row, authors);
+    const reasons = [
+      ...current ? [] : ["stale"],
+      ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
+      ...independence
+    ];
+    verdicts.push({
+      kind,
+      basis,
+      current,
+      independent: independence.length === 0,
+      accepted: reasons.length === 0,
+      reasons,
+      verdict: row
+    });
+  }
+  verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
+  const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
+  const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING2.has(String(entry.verdict.result)));
+  const newestAccepted = verdicts.findLast((entry) => entry.accepted) ?? null;
+  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+    accepted: false,
+    verdict: failing?.verdict ?? null,
+    reasons: failing ? ["failing_verdict"] : newestCurrent?.reasons ?? ["no_verdict"]
+  };
+  return {
+    branch,
+    head,
+    base: newestCurrent?.verdict.base ?? fallbackBase,
+    patchId: keyFor(newestCurrent?.verdict.base ?? fallbackBase).patchId,
+    current: { basis: newestCurrent?.basis ?? "none", verdict: newestCurrent?.verdict ?? null },
+    accepted,
+    verdicts,
+    authors: [...authors].toSorted()
+  };
+}
+function checkSupersede(context, type, self2) {
+  if (!context.supersedes)
+    return { ok: true, value: undefined };
+  const ledger = readLedger(context.cwd);
+  if (!ledger.ok)
+    return ledger;
+  const target = ledger.value.rows.find((row) => row.id === context.supersedes);
+  if (!target)
+    return err("not_found", `no ledger row ${context.supersedes} to supersede`);
+  const problem = supersedeAllowed({ type, actor: context.actor, self: self2 }, target);
+  return problem ? err("invalid_input", `--supersedes: ${problem}`) : { ok: true, value: undefined };
+}
+function recordDecision(context, input) {
+  const what = required2(input.what, "<what>");
+  if (!what.ok)
+    return what;
+  const why = required2(input.why, "--why");
+  if (!why.ok)
+    return why;
+  const link = checkSupersede(context, "decision");
+  if (!link.ok)
+    return link;
+  return appendRow(context.cwd, {
+    ...common2(context, noteKey(context)),
+    type: "decision",
+    what: what.value,
+    why: why.value,
+    refs: input.refs ?? []
+  }, { now: context.now });
+}
+function recordRuling(context, input) {
+  const what = required2(input.what, "<what>");
+  if (!what.ok)
+    return what;
+  const why = required2(input.why, "--why");
+  if (!why.ok)
+    return why;
+  const cost = required2(input.costIfWrong, "--cost-if-wrong");
+  if (!cost.ok)
+    return cost;
+  const link = checkSupersede(context, "ruling");
+  if (!link.ok)
+    return link;
+  return appendRow(context.cwd, {
+    ...common2(context, noteKey(context)),
+    type: "ruling",
+    what: what.value,
+    why: why.value,
+    costIfWrong: cost.value,
+    refs: input.refs ?? []
+  }, { now: context.now });
+}
+function recordVerdict(context, input) {
+  if (!VERDICT_RESULTS.includes(input.result))
+    return err("invalid_input", `unknown verdict "${input.result}"; expected ${VERDICT_RESULTS.join("|")}`);
+  const kind = input.kind ?? "review";
+  if (!VERDICT_KINDS.includes(kind))
+    return err("invalid_input", `--kind must be ${VERDICT_KINDS.join("|")}`);
+  const surface = input.surface ?? null;
+  if (surface !== null && !VERDICT_SURFACES.includes(surface))
+    return err("invalid_input", `--surface must be ${VERDICT_SURFACES.join("|")}`);
+  const how = required2(input.how, "--how");
+  if (!how.ok)
+    return how;
+  const branch = context.branch ?? currentBranch2(context.cwd);
+  if (!branch)
+    return err("invalid_input", "HEAD is detached; name the branch the verdict is for", "pass --branch <branch>");
+  const ledger = readLedger(context.cwd);
+  if (!ledger.ok)
+    return ledger;
+  const key = codeKey(context.cwd, { branch, base: context.base });
+  if (!key.head)
+    return err("not_found", `branch "${branch}" has no commit to judge`);
+  if (key.dirty === true)
+    return err("blocked", `dirty_worktree: ${branch} has uncommitted changes, so its head is not what was judged`, "commit or stash the changes, re-check, then record the verdict");
+  const session = context.actor.session;
+  const selfReason = input.self === true ? "flag" : session ? null : "no_session";
+  const self2 = selfReason !== null;
+  if (!self2 && session && authorSessions(context.cwd, ledger.value.rows, branch, { base: key.base, head: key.head }).has(session))
+    return err("blocked", `author_verdict: session ${session} authored ${branch}; a verdict must come from a different session`, 'have a non-author session record the verdict, or pass --self (a self verdict is never accepted by merge:"verified")');
+  const link = checkSupersede(context, "verdict", self2);
+  if (!link.ok)
+    return link;
+  return appendRow(context.cwd, {
+    ...common2(context, key),
+    type: "verdict",
+    kind,
+    result: input.result,
+    how: how.value,
+    surface,
+    observer: "agent_asserted",
+    self: self2,
+    selfReason,
+    evidenceRefs: input.evidenceRefs ?? []
+  }, { now: context.now });
+}
+function recordHandoff(context, input) {
+  return appendRow(context.cwd, { ...common2(context, noteKey(context)), type: "handoff", note: input.note, next: input.next }, { now: context.now });
+}
+function rowLabels(row) {
+  const labels = [];
+  if (row.superseded)
+    labels.push("superseded");
+  if (row.supersedeIgnored || OBSERVED_ONLY.has(row.type) && row.observer !== "workit_cli")
+    labels.push("ignored");
+  if (row.type === "verdict" && row.self === true)
+    labels.push("self");
+  return labels;
+}
+function summarizeRow(row) {
+  const text = (key) => str(row[key]) ?? "";
+  let summary;
+  switch (row.type) {
+    case "decision":
+      summary = `${text("what")} (why: ${text("why")})`;
+      break;
+    case "ruling":
+      summary = `${text("what")} (why: ${text("why")}; cost if wrong: ${text("costIfWrong")})`;
+      break;
+    case "verdict":
+      summary = `${text("result")} [${text("kind") || "review"}] at ${(row.head ?? "?").slice(0, 12)}${row.self === true ? ` (self${text("selfReason") === "no_session" ? ": no session" : ""})` : ""}: ${text("how")}`;
+      break;
+    case "handoff":
+      summary = `next: ${text("next")}${text("note") ? ` (note: ${text("note")})` : ""}`;
+      break;
+    default:
+      summary = text("what") || text("name") || row.type;
+  }
+  return {
+    seq: row.seq,
+    id: row.id,
+    at: row.at,
+    type: row.type,
+    branch: row.branch,
+    summary,
+    labels: rowLabels(row)
+  };
+}
+function stackPosition(root, branch) {
+  const dir = path37.join(root, "stacks");
+  let names = [];
+  try {
+    names = fs19.readdirSync(dir).filter((name) => name.endsWith(".json"));
+  } catch {
+    return null;
+  }
+  for (const name of names.toSorted()) {
+    let parsed;
+    try {
+      parsed = JSON.parse(fs19.readFileSync(path37.join(dir, name), "utf8"));
+    } catch {
+      continue;
+    }
+    if (!isRecord5(parsed) || !Array.isArray(parsed.branches))
+      continue;
+    const branches = parsed.branches.filter(isRecord5);
+    const index = branches.findIndex((entry) => entry.branch === branch);
+    if (index < 0)
+      continue;
+    const entry = branches[index];
+    return {
+      name: str(parsed.name) ?? name.replace(/\.json$/u, ""),
+      index: index + 1,
+      size: branches.length,
+      parent: str(entry.parent),
+      pr: typeof entry.pr === "number" ? entry.pr : null
+    };
+  }
+  return null;
+}
+function buildHandoff(cwd, options = {}) {
+  const store = storeRoot(cwd);
+  if (!store.ok)
+    return store;
+  const read = readLedger(cwd);
+  if (!read.ok)
+    return read;
+  const ledger = read.value;
+  const branch = currentBranch2(cwd);
+  const head = headSha(cwd);
+  const base = defaultBase2(cwd);
+  let ahead = null;
+  let behind = null;
+  if (base && head) {
+    const counts = git2(cwd, ["rev-list", "--left-right", "--count", `${base}...HEAD`]);
+    const [left, right] = (counts ?? "").split(/\s+/u).map(Number);
+    if (Number.isFinite(left) && Number.isFinite(right)) {
+      behind = left;
+      ahead = right;
+    }
+  }
+  const mine = branch ? filterRows(ledger.rows, { branch }) : [];
+  const stack = branch ? stackPosition(store.value.root, branch) : null;
+  const pr = stack?.pr ?? mine.findLast((row) => row.pr !== undefined && PR_ROW_TYPES.has(row.type) && row.observer === "workit_cli")?.pr ?? null;
+  const check = branch ? checkVerdicts(cwd, branch, ledger.rows) : null;
+  const checkRows = mine.filter((row) => row.type === "check" && row.observer === "workit_cli" && str(row.name));
+  const latestChecks = new Map;
+  for (const row of checkRows)
+    latestChecks.set(str(row.name), row);
+  const tree = latestChecks.size ? worktreeTree(cwd)?.key ?? null : null;
+  const checks = [...latestChecks.entries()].map(([name, row]) => ({
+    name,
+    result: str(row.result),
+    fresh: tree !== null && row.tree === tree,
+    at: row.at
+  }));
+  const lastHandoffRow = mine.findLast((row) => row.type === "handoff");
+  const partial = {
+    store: { root: store.value.root, shared: store.value.shared, ledger: ledger.path },
+    branch,
+    head,
+    subject: head ? git2(cwd, ["log", "-1", "--format=%s", head]) : null,
+    base,
+    ahead,
+    behind,
+    dirty: dirtyState(cwd),
+    pr,
+    stack,
+    verdict: {
+      current: check?.current.basis ?? "none",
+      accepted: check?.accepted.accepted ?? false,
+      reasons: check?.accepted.reasons ?? ["no_verdict"],
+      verdicts: (check?.verdicts ?? []).map(({ verdict: row, ...rest }) => ({
+        ...rest,
+        summary: summarizeRow(row).summary
+      }))
+    },
+    checks,
+    rulings: mine.filter((row) => row.type === "ruling" && !row.superseded).slice(-5).map(summarizeRow),
+    recent: ledger.rows.slice(-(options.last ?? 10)).map(summarizeRow),
+    lastHandoff: lastHandoffRow ? {
+      at: lastHandoffRow.at,
+      note: str(lastHandoffRow.note),
+      next: str(lastHandoffRow.next) ?? ""
+    } : null,
+    note: options.note?.trim() || null,
+    skippedRows: ledger.skipped
+  };
+  const nextCommand = nextCommandFor(partial);
+  return {
+    ok: true,
+    value: { ...partial, nextCommand, next: options.next?.trim() || nextCommand }
+  };
+}
+var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, VERDICT_RESULTS, PASSING, FAILING2, VERDICT_KINDS, VERDICT_SURFACES, PR_ROW_TYPES, err = (code, error, unblock) => ({
+  ok: false,
+  code,
+  error,
+  ...unblock ? { unblock } : {}
+}), gitRun = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
+  const run = spawnSync15("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    windowsHide: true,
+    maxBuffer: 256 * 1024 * 1024,
+    env: {
+      ...process.env,
+      GIT_TERMINAL_PROMPT: "0",
+      GIT_OPTIONAL_LOCKS: "0",
+      LC_ALL: "C",
+      LANGUAGE: "C"
+    }
+  });
+  return {
+    ok: run.status === 0,
+    stdout: run.stdout ?? "",
+    stderr: run.error ? String(run.error.message) : run.stderr ?? ""
+  };
+}, git2 = (cwd, args) => {
+  const run = gitRun(cwd, args);
+  const value = run.ok ? run.stdout.trim() : "";
+  return value ? value : null;
+}, safeRef = (value) => value.length > 0 && !value.startsWith("-"), NOT_A_REPO, newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`, NETWORK_FS_TYPES, isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0), onNetworkFs = (dir) => {
+  if (process.platform !== "linux")
+    return false;
+  try {
+    return isNetworkFsType(fs19.statfsSync(dir).type);
+  } catch {
+    return false;
+  }
+}, LOCK_WAIT_MS2 = 5000, LOCK_STALE_MS2 = 30000, LOCK_OWNER = "owner", lockToken = (lock) => {
+  try {
+    return fs19.readFileSync(path37.join(lock, LOCK_OWNER), "utf8");
+  } catch {
+    return null;
+  }
+}, lockAgeMs = (lock) => {
+  for (const target of [path37.join(lock, LOCK_OWNER), lock]) {
+    try {
+      return Date.now() - fs19.statSync(target).mtimeMs;
+    } catch {}
+  }
+  return null;
+}, ledgerLock, serialize = (row, now) => {
+  const full = { v: LEDGER_VERSION, id: newId2(), at: now.toISOString(), ...row };
+  return { full, line: `${JSON.stringify(full)}
+` };
+}, isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str = (value) => typeof value === "string" ? value : null, normalizeActor = (value) => {
+  const actor = isRecord5(value) ? value : {};
+  return {
+    host: str(actor.host) ?? "unknown",
+    session: str(actor.session),
+    agentId: str(actor.agentId)
+  };
+}, isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded, independenceReasons = (row, authors) => {
+  const reasons = [];
+  if (!row.actor.session)
+    reasons.push("no_session");
+  else if (authors.has(row.actor.session))
+    reasons.push("author_session");
+  if (row.self === true && !reasons.includes("no_session"))
+    reasons.push("self");
+  return reasons;
+}, common2 = (context, key) => ({
+  ...key,
+  actor: context.actor,
+  ...context.pr === undefined ? {} : { pr: context.pr },
+  ...context.supersedes ? { supersedes: context.supersedes } : {}
+}), noteKey = (context) => {
+  const branch = context.branch ?? currentBranch2(context.cwd);
+  return {
+    branch,
+    head: branch ? branchHead(context.cwd, branch) : headSha(context.cwd),
+    base: null,
+    baseSha: null,
+    patchId: null,
+    diffHash: null,
+    tree: null,
+    dirty: null
+  };
+}, required2 = (value, flag) => {
+  const text = value?.trim();
+  return text ? { ok: true, value: text } : err("invalid_input", `${flag} is required`);
+}, OBSERVED_ONLY, MAX_DIRTY_PATHS = 10, dirtyState = (cwd) => {
+  const run = gitRun(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], GIT_TIMEOUTS.worktree);
+  if (!run.ok)
+    return { dirty: false, files: 0, paths: [] };
+  const paths = [];
+  const entries = run.stdout.split("\x00");
+  for (let index = 0;index < entries.length; index += 1) {
+    const entry = entries[index];
+    if (entry.length < 4)
+      continue;
+    paths.push(entry.slice(3));
+    if (entry[0] === "R" || entry[0] === "C")
+      index += 1;
+  }
+  return { dirty: paths.length > 0, files: paths.length, paths: paths.slice(0, MAX_DIRTY_PATHS) };
+}, nextCommandFor = (brief) => {
+  const branchFlag = brief.branch ? ` --branch ${brief.branch}` : "";
+  const verify = `workit ledger verdict verified${branchFlag} --how "<method and evidence>"  (from a session that did not author the branch, with WORKIT_SESSION_ID set)`;
+  if (!brief.head)
+    return "make the first commit on this branch, then: workit handoff";
+  if (brief.dirty.dirty)
+    return `commit or stash the ${brief.dirty.files} changed file(s), then: workit handoff`;
+  const stale = brief.checks.find((check) => !check.fresh);
+  if (stale)
+    return `workit check ${stale.name}`;
+  const { verdict } = brief;
+  if (verdict.reasons.includes("failing_verdict"))
+    return `fix what the failing verdict found, then get a new independent verdict: ${verify}`;
+  if (!verdict.accepted)
+    return verify;
+  return brief.pr === null ? "workit pr create" : `workit pr status --pr ${brief.pr}`;
+};
+var init_ledger = __esm(() => {
+  init_rev();
+  VERDICT_RESULTS = [
+    "verified",
+    "tests-verified",
+    "type-check-only",
+    "blocked",
+    "failed"
+  ];
+  PASSING = new Set(["verified", "tests-verified", "type-check-only"]);
+  FAILING2 = new Set(["failed", "blocked"]);
+  VERDICT_KINDS = ["unit", "live", "perf", "review"];
+  VERDICT_SURFACES = ["ui", "cli", "api"];
+  PR_ROW_TYPES = new Set(["pr.created", "pr.status"]);
+  NOT_A_REPO = /not a git repository \(or any (of the parent directories|parent up to)/u;
+  NETWORK_FS_TYPES = new Set([
+    26985,
+    20859,
+    4266872130,
+    4283649346,
+    1702057286,
+    1397113167,
+    12805120,
+    16914839,
+    1196443219,
+    198183888
+  ]);
+  ledgerLock = {
+    acquire(lock) {
+      try {
+        fs19.mkdirSync(lock);
+      } catch (error) {
+        if (error.code === "EEXIST")
+          return null;
+        throw error;
+      }
+      const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
+      fs19.writeFileSync(path37.join(lock, LOCK_OWNER), token);
+      return token;
+    },
+    release(lock, token) {
+      if (lockToken(lock) !== token)
+        return false;
+      const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
+      try {
+        fs19.renameSync(lock, tomb);
+      } catch {
+        return false;
+      }
+      if (lockToken(tomb) !== token) {
+        try {
+          fs19.renameSync(tomb, lock);
+        } catch {}
+        return false;
+      }
+      fs19.rmSync(tomb, { recursive: true, force: true });
+      return true;
+    },
+    token: lockToken,
+    reap(lock, observed) {
+      const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
+      try {
+        fs19.renameSync(lock, tomb);
+      } catch {
+        return false;
+      }
+      if (lockToken(tomb) === observed) {
+        fs19.rmSync(tomb, { recursive: true, force: true });
+        return true;
+      }
+      try {
+        fs19.renameSync(tomb, lock);
+      } catch {
+        fs19.rmSync(tomb, { recursive: true, force: true });
+      }
+      return false;
+    }
+  };
+  OBSERVED_ONLY = new Set(["check", ...PR_ROW_TYPES]);
+});
+
 // packages/workit-cli/src/verbs/ledger.ts
 var exports_ledger = {};
 __export(exports_ledger, {
   run: () => run18
 });
-var run18;
-var init_ledger = __esm(() => {
-  init_stub();
-  run18 = notImplemented("ledger", "S13");
+import { parseArgs } from "node:util";
+function targetBranch(io, rows, branch, pr) {
+  if (pr !== undefined) {
+    const resolved = branchForPr(io.cwd, rows, pr);
+    if (!resolved.ok)
+      return {
+        ok: false,
+        code: "invalid_input",
+        error: resolved.reason === "ambiguous" ? `cannot resolve PR ${pr} to a branch: ambiguous (${resolved.candidates.join(", ")})` : `cannot resolve PR ${pr} to a branch: no workit pr row records it and no fetched forge ref (refs/pull/${pr}/head) points at a local branch tip`,
+        unblock: "pass --branch <branch> instead, or fetch the PR ref"
+      };
+    if (branch !== undefined && branch !== resolved.branch)
+      return {
+        ok: false,
+        code: "invalid_input",
+        error: `PR ${pr} is branch ${resolved.branch}, not ${branch}`
+      };
+    return { ok: true, value: resolved.branch };
+  }
+  return { ok: true, value: branch ?? null };
+}
+async function run18(argv, io) {
+  let parsed;
+  try {
+    parsed = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
+  } catch (error) {
+    return usage4(io, error.message);
+  }
+  const { values } = parsed;
+  let positionals = parsed.positionals;
+  if (positionals[0] === "add") {
+    positionals = positionals.slice(1);
+    if (!["decision", "ruling", "verdict"].includes(positionals[0] ?? ""))
+      return usage4(io, "ledger add takes decision|ruling|verdict");
+  }
+  const [sub, ...rest] = positionals;
+  const pr = positiveInt2(values.pr, "--pr");
+  if (pr instanceof Error)
+    return usage4(io, pr.message);
+  const last = positiveInt2(values.last, "--last");
+  if (last instanceof Error)
+    return usage4(io, last.message);
+  const text = rest.join(" ");
+  if (sub === undefined)
+    return usage4(io, "missing subcommand");
+  if (!["decision", "ruling", "verdict", "list", "show", "check"].includes(sub))
+    return usage4(io, `unknown ledger subcommand "${sub}"`);
+  const ledger = readLedger(io.cwd);
+  if (!ledger.ok)
+    return failed(io, ledger);
+  const { rows } = ledger.value;
+  if (sub === "list" || sub === "show") {
+    if (rest.length)
+      return usage4(io, `unexpected argument: ${rest[0]}`);
+    const listed = filterRows(rows, {
+      branch: values.branch,
+      pr,
+      type: values.type,
+      last: last ?? 50
+    });
+    return emit(io, ok({ path: ledger.value.path, skipped: ledger.value.skipped, rows: listed }), (data) => data.rows.length ? data.rows.map((row) => {
+      const line = summarizeRow(row);
+      return `#${line.seq} ${line.at} ${line.type}${line.branch ? ` [${line.branch}]` : ""}${line.labels.length ? ` (${line.labels.join(", ")})` : ""}  ${line.summary}`;
+    }) : "ledger is empty");
+  }
+  const isRead = sub === "check" || sub === "verdict" && values.how === undefined && !VERDICT_RESULTS.includes(rest[0] ?? "");
+  if (isRead) {
+    if (rest.length > (sub === "verdict" ? 1 : 0))
+      return usage4(io, `unexpected argument: ${rest.at(-1)}`);
+    const target = targetBranch(io, rows, rest[0] ?? values.branch, pr);
+    if (!target.ok)
+      return failed(io, target);
+    const branch = target.value ?? currentBranch2(io.cwd);
+    if (!branch)
+      return emit(io, fail("invalid_input", "HEAD is detached; name the branch", {
+        unblock: "pass --branch <branch>"
+      }));
+    return emit(io, ok(checkVerdicts(io.cwd, branch, rows)), verdictLines);
+  }
+  const target = targetBranch(io, rows, values.branch, pr);
+  if (!target.ok)
+    return failed(io, target);
+  const context = {
+    cwd: io.cwd,
+    actor: actorFromEnv(io.env),
+    branch: target.value,
+    base: values.base ?? null,
+    ...pr === undefined ? {} : { pr },
+    ...values.supersedes ? { supersedes: values.supersedes } : {}
+  };
+  if (sub === "decision")
+    return fromResult(io, recordDecision(context, { what: text, why: values.why, refs: values.ref }), (row) => `recorded decision ${row.id}`);
+  if (sub === "ruling")
+    return fromResult(io, recordRuling(context, {
+      what: text,
+      why: values.why,
+      costIfWrong: values["cost-if-wrong"],
+      refs: values.ref
+    }), (row) => `recorded ruling ${row.id}`);
+  if (rest.length !== 1)
+    return usage4(io, `ledger verdict takes one result: ${VERDICT_RESULTS.join("|")}`);
+  return fromResult(io, recordVerdict(context, {
+    result: rest[0],
+    kind: values.kind,
+    how: values.how,
+    surface: values.surface ?? null,
+    self: values.self === true,
+    evidenceRefs: values.evidence
+  }), (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
+}
+var USAGE = "workit ledger decision|ruling|verdict|list|check ... (workit help ledger for the grammar)", OPTIONS, positiveInt2 = (value, flag) => {
+  if (value === undefined)
+    return;
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : new Error(`${flag} must be a positive integer`);
+}, failed = (io, result) => emit(io, fail(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok(result.value), human) : failed(io, result), usage4 = (io, error) => emit(io, fail("invalid_input", error, { unblock: USAGE })), verdictLines = (check) => {
+  const lines = [
+    `${check.branch} @ ${(check.head ?? "no commit").slice(0, 12)}: current: ${check.current.basis}${typeof check.current.verdict?.result === "string" ? ` (${check.current.verdict.result})` : ""}; ${check.accepted.accepted ? "accepted" : `not accepted (${check.accepted.reasons.join(", ")})`}`
+  ];
+  for (const entry of check.verdicts)
+    lines.push(`  ${entry.kind}: ${entry.basis}${entry.accepted ? ", accepted" : ` (${entry.reasons.join(", ")})`}  ${summarizeRow(entry.verdict).summary}`);
+  return lines;
+};
+var init_ledger2 = __esm(() => {
+  init_ledger();
+  init_rev();
+  init_output();
+  OPTIONS = {
+    why: { type: "string" },
+    "cost-if-wrong": { type: "string" },
+    ref: { type: "string", multiple: true },
+    how: { type: "string" },
+    kind: { type: "string" },
+    surface: { type: "string" },
+    evidence: { type: "string", multiple: true },
+    self: { type: "boolean" },
+    branch: { type: "string" },
+    base: { type: "string" },
+    pr: { type: "string" },
+    type: { type: "string" },
+    last: { type: "string" },
+    supersedes: { type: "string" },
+    json: { type: "boolean" }
+  };
 });
 
 // packages/workit-cli/src/verbs/handoff.ts
@@ -73087,24 +76070,92 @@ var exports_handoff = {};
 __export(exports_handoff, {
   run: () => run19
 });
+import { parseArgs as parseArgs2 } from "node:util";
+function human(brief) {
+  const lines = [
+    `branch: ${brief.branch ?? "(detached)"} @ ${short2(brief.head)}${brief.subject ? ` ${brief.subject}` : ""}`
+  ];
+  if (brief.base)
+    lines.push(`base:   ${brief.base}${brief.ahead === null ? "" : ` (ahead ${brief.ahead}, behind ${brief.behind})`}`);
+  lines.push(brief.dirty.dirty ? `dirty:  ${brief.dirty.files} file(s): ${brief.dirty.paths.join(", ")}${brief.dirty.files > brief.dirty.paths.length ? ", …" : ""}` : "dirty:  clean");
+  if (brief.stack)
+    lines.push(`stack:  ${brief.stack.name} ${brief.stack.index}/${brief.stack.size}${brief.stack.parent ? ` on ${brief.stack.parent}` : ""}`);
+  if (brief.pr !== null)
+    lines.push(`pr:     #${brief.pr}`);
+  lines.push(`verdict: current ${brief.verdict.current}; ${brief.verdict.accepted ? "accepted" : `not accepted (${brief.verdict.reasons.join(", ")})`}`, ...brief.verdict.verdicts.map((entry) => `  ${entry.kind}: ${entry.basis}${entry.accepted ? ", accepted" : ` (${entry.reasons.join(", ")})`}  ${entry.summary}`));
+  if (brief.checks.length)
+    lines.push("checks:", ...brief.checks.map((check) => `  ${check.name}: ${check.result ?? "?"} (${check.fresh ? "fresh" : "stale"})`));
+  if (brief.rulings.length)
+    lines.push("rulings:", ...brief.rulings.map((row) => `  #${row.seq} ${row.summary}`));
+  if (brief.lastHandoff)
+    lines.push(`last handoff (${brief.lastHandoff.at}): ${brief.lastHandoff.next}${brief.lastHandoff.note ? ` (note: ${brief.lastHandoff.note})` : ""}`);
+  if (brief.recent.length)
+    lines.push("recent ledger:", ...brief.recent.map((row) => `  #${row.seq} ${row.type}${row.branch ? ` [${row.branch}]` : ""}${row.labels.length ? ` (${row.labels.join(", ")})` : ""}  ${row.summary}`));
+  if (brief.note)
+    lines.push(`note:   ${brief.note}`);
+  lines.push(`next:   ${brief.next}`);
+  if (brief.next !== brief.nextCommand)
+    lines.push(`next command: ${brief.nextCommand}`);
+  if (brief.recorded)
+    lines.push(`recorded handoff ${brief.recorded}`);
+  return lines;
+}
+async function resumeBrief(argv, io) {
+  let values;
+  try {
+    ({ values } = parseArgs2({
+      args: argv,
+      options: {
+        note: { type: "string" },
+        next: { type: "string" },
+        record: { type: "boolean" },
+        last: { type: "string" },
+        json: { type: "boolean" }
+      },
+      allowPositionals: false,
+      strict: true
+    }));
+  } catch (error) {
+    return emit(io, fail("invalid_input", error.message, { unblock: USAGE2 }));
+  }
+  const last = values.last === undefined ? 10 : Number(values.last);
+  if (!Number.isInteger(last) || last < 1)
+    return emit(io, fail("invalid_input", "--last must be a positive integer", { unblock: USAGE2 }));
+  const built = buildHandoff(io.cwd, {
+    last,
+    note: values.note ?? null,
+    next: values.next ?? null
+  });
+  if (!built.ok)
+    return emit(io, fail(built.code, built.error, built.unblock ? { unblock: built.unblock } : {}));
+  const data = built.value;
+  let recorded = null;
+  if (values.record) {
+    const row = recordHandoff({ cwd: io.cwd, actor: actorFromEnv(io.env), branch: data.branch }, { note: data.note, next: data.next });
+    if (!row.ok)
+      return emit(io, fail(row.code, row.error, { data: { ...data, recorded } }));
+    recorded = row.value.id;
+  }
+  return emit(io, ok({ ...data, recorded }), human);
+}
 async function run19(argv, io) {
   if (!argv.includes("--task"))
-    return brief(argv, io);
+    return resumeBrief(argv, io);
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
 }
-var brief;
+var USAGE2 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", short2 = (sha) => sha ? sha.slice(0, 12) : "no commit";
 var init_handoff = __esm(() => {
-  init_stub();
-  brief = notImplemented("handoff", "S13");
+  init_ledger();
+  init_output();
 });
 
 // packages/workit-cli/src/main.ts
-import path34 from "node:path";
+import path38 from "node:path";
 // packages/workit-cli/package.json
 var package_default = {
   name: "@brainervirus/workit-cli",
-  version: "2.2.1",
+  version: "2.3.0",
   private: false,
   description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   keywords: [
@@ -73243,17 +76294,15 @@ var VERBS = [
   {
     name: "pr",
     group: "delivery",
-    usage: "workit pr status|create|merge [--pr <n>] [--json]",
-    summary: "Read PR/MR state (checks, threads, behind-base, next) or create/merge it",
-    planned: "S10/S11",
+    usage: "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]",
+    summary: "Read PR/MR state: checks with failing log tails, unresolved threads, behind-base, next action",
     load: () => Promise.resolve().then(() => (init_pr(), exports_pr))
   },
   {
     name: "ci",
     group: "delivery",
-    usage: "workit ci wait|rerun [--pr <n>] [--json]",
-    summary: "Wait for CI on the current head or rerun failed jobs once",
-    planned: "S10",
+    usage: "workit ci wait [--pr <n>] [--head <sha>] [--timeout 20m] | ci rerun [--failed | --check <name>…] --reason flake|infra [--force]",
+    summary: "Wait for CI on the PR head (exit 0/1/3/4), or rerun failed jobs once per head",
     load: () => Promise.resolve().then(() => (init_ci(), exports_ci))
   },
   {
@@ -73284,15 +76333,14 @@ var VERBS = [
     name: "ledger",
     group: "delivery",
     usage: "workit ledger decision|ruling|verdict|list|check ...",
-    summary: "Record and query decisions, rulings and verdicts",
-    planned: "S13",
-    load: () => Promise.resolve().then(() => (init_ledger(), exports_ledger))
+    summary: "Record and query decisions, rulings and SHA-keyed verdicts (patch-id carry-over across rebases)",
+    load: () => Promise.resolve().then(() => (init_ledger2(), exports_ledger))
   },
   {
     name: "handoff",
     group: "delivery",
-    usage: "workit handoff --task <id>",
-    summary: "Export task state and compact destination context",
+    usage: "workit handoff [--note <t>] [--next <t>] [--record] | workit handoff --task <id>",
+    summary: "Print a resume brief (branch, HEAD, dirty state, verdict, rulings, next command); --task exports v1 task state",
     load: () => Promise.resolve().then(() => (init_handoff(), exports_handoff))
   }
 ];
@@ -73378,7 +76426,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path34.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path38.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail("invalid_input", parsed.error));