npm - @brainervirus/workit-cli - Versions diffs - 8.11.0 → 8.12.1 - Mend

@brainervirus/workit-cli 8.11.0 → 8.12.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/index.js +1653 -721
package/package.json +4 -4

package/dist/index.js CHANGED Viewed

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.11.0",
+    version: "8.12.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.11.0",
-      "@brainervirus/workit-cursor": "^8.11.0",
-      "@brainervirus/workit-opencode": "^8.11.0",
+      "@brainervirus/workit-core": "^8.12.1",
+      "@brainervirus/workit-cursor": "^8.12.1",
+      "@brainervirus/workit-opencode": "^8.12.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -298,7 +298,7 @@ function loadCheckConfig(cwd) {
       gates[gate] = names;
     }
   }
-  return { source: CHECKS_FILE, root, checks, gates, error: null };
+  return { source: CHECKS_FILE, root, checks, gates, error: null, resources: parsed.resources };
 }
 function matchesNamedCheck(config, name, argv, cwd) {
   if (config.error || name === null || cwd !== ".")
@@ -9939,11 +9939,224 @@ var init_file_lock = __esm(() => {
   init_file_lock_sync();
 });
+// packages/workit-core/src/core/logger.ts
+import { appendFileSync, mkdirSync, readdirSync, unlinkSync } from "node:fs";
+import os from "node:os";
+import path4 from "node:path";
+var REDACTED = "[REDACTED]", DEFAULT_MAX_RATE = 20, DEFAULT_RATE_WINDOW_MS = 1000, DEFAULT_MAX_FIELD_LENGTH = 200, DEFAULT_MAX_STACK_LINES = 30, DAY_FILE, RETAINED_DAYS = 7, SECRET_VALUE, KEY_EQ_VALUE, URL_QUERY, splitKey = (key) => key.split(/[_-]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).map((word) => word.toLowerCase()), SENSITIVE_WORDS, STACK_WORDS, escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
+  const override = process.env.WORKFLOW_TOOLKIT_STATE;
+  if (override)
+    return override;
+  const home = os.homedir();
+  if (process.env.XDG_STATE_HOME)
+    return path4.join(process.env.XDG_STATE_HOME, "workit");
+  switch (os.platform()) {
+    case "darwin":
+      return path4.join(home, "Library", "Application Support", "workit");
+    case "win32":
+      return path4.join(process.env.LOCALAPPDATA ?? path4.join(home, "AppData", "Local"), "workit");
+    default:
+      return path4.join(process.env.HOME ?? home, ".local", "state", "workit");
+  }
+}, homePattern, applyPatterns = (value) => {
+  let out = value;
+  out = out.replace(SECRET_VALUE, REDACTED);
+  out = out.replace(KEY_EQ_VALUE, "$1$2[REDACTED]");
+  out = out.replace(URL_QUERY, "$1?[REDACTED]");
+  out = out.replace(homePattern, "~");
+  if (process.platform === "win32")
+    out = out.replace(/\\/g, "/");
+  return out;
+}, redactString = (value, options) => {
+  const out = applyPatterns(value);
+  if (out.length > options.maxFieldLength) {
+    return `${out.slice(0, options.maxFieldLength)}…`;
+  }
+  return out;
+}, boundStack = (value, options) => {
+  if (typeof value !== "string")
+    return redact(value, options);
+  const lines = value.split(`
+`);
+  const kept = lines.slice(0, options.maxStackLines).map(applyPatterns);
+  const dropped = lines.length - kept.length;
+  const body = dropped > 0 ? [...kept, `    ... ${dropped} more`] : kept;
+  return body.join(`
+`);
+}, redact = (value, options = DEFAULT_OPTIONS) => {
+  if (value === null || value === undefined)
+    return null;
+  if (typeof value === "boolean" || typeof value === "number")
+    return value;
+  if (typeof value === "string")
+    return redactString(value, options);
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Array.isArray(value))
+    return value.map((entry) => redact(entry, options));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      const words = splitKey(key);
+      if (words.some((word) => STACK_WORDS.has(word)))
+        out[key] = boundStack(entry, options);
+      else if (words.some((word) => SENSITIVE_WORDS.has(word)))
+        out[key] = REDACTED;
+      else
+        out[key] = redact(entry, options);
+    }
+    return out;
+  }
+  return null;
+}, DEFAULT_OPTIONS, dailyFileName = (date) => {
+  const y = date.getFullYear();
+  const m = String(date.getMonth() + 1).padStart(2, "0");
+  const d = String(date.getDate()).padStart(2, "0");
+  return `workit-${y}-${m}-${d}.jsonl`;
+}, pruneOldFiles = (dir) => {
+  try {
+    const files = readdirSync(dir).filter((name) => DAY_FILE.test(name)).toSorted().toReversed();
+    for (const file of files.slice(RETAINED_DAYS)) {
+      try {
+        unlinkSync(path4.join(dir, file));
+      } catch {}
+    }
+  } catch {}
+}, createLogger = (options = {}) => {
+  const stateDir = options.stateDir ?? resolveStateDir();
+  const logDir = path4.join(stateDir, "logs");
+  const now = options.now ?? (() => new Date);
+  const maxRate = options.maxRate ?? DEFAULT_MAX_RATE;
+  const rateWindowMs = options.rateWindowMs ?? DEFAULT_RATE_WINDOW_MS;
+  const redactOptions = {
+    maxFieldLength: options.maxFieldLength ?? DEFAULT_MAX_FIELD_LENGTH,
+    maxStackLines: options.maxStackLines ?? DEFAULT_MAX_STACK_LINES
+  };
+  let windowStart = 0;
+  const windowCounts = { debug: 0, info: 0, warn: 0, error: 0 };
+  const emit = (level, message, context) => {
+    const date = now();
+    const elapsed = date.getTime() - windowStart;
+    if (elapsed >= rateWindowMs || windowStart === 0) {
+      windowStart = date.getTime();
+      windowCounts.debug = 0;
+      windowCounts.info = 0;
+      windowCounts.warn = 0;
+      windowCounts.error = 0;
+    }
+    windowCounts[level] += 1;
+    if (windowCounts[level] > maxRate)
+      return;
+    let event = null;
+    try {
+      event = {
+        level,
+        time: date.toISOString(),
+        message: redactString(message, redactOptions),
+        context: redact(context ?? {}, redactOptions)
+      };
+      const line = `${JSON.stringify(event)}
+`;
+      mkdirSync(logDir, { recursive: true, mode: 448 });
+      appendFileSync(path4.join(logDir, dailyFileName(date)), line, { mode: 384 });
+      pruneOldFiles(logDir);
+    } catch {
+      try {
+        event = {
+          level,
+          time: date.toISOString(),
+          message: redactString(message, redactOptions),
+          context: { redaction_failed: true }
+        };
+        mkdirSync(logDir, { recursive: true, mode: 448 });
+        appendFileSync(path4.join(logDir, dailyFileName(date)), `${JSON.stringify(event)}
+`, {
+          mode: 384
+        });
+      } catch {}
+    }
+    for (const sink of [options.appLog, options.stderr]) {
+      if (!sink)
+        continue;
+      if (!event)
+        continue;
+      try {
+        sink(event);
+      } catch {}
+    }
+  };
+  return {
+    debug: (message, context) => emit("debug", message, context),
+    info: (message, context) => emit("info", message, context),
+    warn: (message, context) => emit("warn", message, context),
+    error: (message, context) => emit("error", message, context),
+    guard: (name, fn) => {
+      try {
+        return fn();
+      } catch (err) {
+        emit("warn", "detector_failed", {
+          detector: name,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        return;
+      }
+    }
+  };
+};
+var init_logger = __esm(() => {
+  DAY_FILE = /^workit-\d{4}-\d{2}-\d{2}\.jsonl$/;
+  SECRET_VALUE = /\b(?:Bearer|Basic|Digest|Token)\s+\S+/gi;
+  KEY_EQ_VALUE = /\b([A-Za-z0-9_-]*(?:token|secret|password|passwd|apikey|api[_-]?key|authorization|credential|bearer)[A-Za-z0-9_-]*)([:=]\s*).+/gi;
+  URL_QUERY = /(https?:\/\/[^?#\s]+)\?[^#\s]*/g;
+  SENSITIVE_WORDS = new Set([
+    "token",
+    "secret",
+    "password",
+    "passwd",
+    "authorization",
+    "credential",
+    "credentials",
+    "cookie",
+    "api",
+    "apikey",
+    "apitoken",
+    "accesstoken",
+    "clientsecret",
+    "refreshtoken",
+    "key",
+    "bearer",
+    "prompt",
+    "message",
+    "messages",
+    "content",
+    "body",
+    "args",
+    "argument",
+    "result",
+    "results",
+    "output",
+    "issue",
+    "description",
+    "summary",
+    "payload",
+    "script",
+    "command",
+    "text",
+    "query"
+  ]);
+  STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
+  homePattern = new RegExp(`${escapeRegExp(os.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
+  DEFAULT_OPTIONS = {
+    maxFieldLength: DEFAULT_MAX_FIELD_LENGTH,
+    maxStackLines: DEFAULT_MAX_STACK_LINES
+  };
+});
 // packages/workit-core/src/store/paths.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import fs5 from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 function fastGit(root) {
   if (DISCOVERY_ENV.some((name) => process.env[name]))
     return null;
@@ -9959,7 +10172,7 @@ function fastGit(root) {
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path4.join(dir, ".git");
+    const dotGit = path5.join(dir, ".git");
     let entry = null;
     try {
       entry = fs5.statSync(dotGit);
@@ -9980,19 +10193,19 @@ function fastGit(root) {
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path4.resolve(dir, match[1].trim());
+        gitDir = path5.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs5.existsSync(path4.join(gitDir, "HEAD")))
+      if (!fs5.existsSync(path5.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path4.resolve(gitDir, fs5.readFileSync(path4.join(gitDir, "commondir"), "utf8").trim());
+        common = path5.resolve(gitDir, fs5.readFileSync(path5.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs5.existsSync(path4.join(common, "objects")))
+      if (!fs5.existsSync(path5.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -10002,26 +10215,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path4.dirname(dir);
+    const parent = path5.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path4.resolve(root);
+  root = path5.resolve(root);
   let directory = false;
   try {
     directory = fs5.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path5.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path5.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path4.join(fast.common, "workit"),
+      dir: path5.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -10031,13 +10244,13 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path4.join(real(path4.resolve(root, common)), "workit"),
+      dir: path5.join(real(path5.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path5.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
@@ -10048,7 +10261,7 @@ function resolveTaskKey(root, location) {
   if (location.git && !location.git.reftable) {
     let head = "";
     try {
-      head = fs5.readFileSync(path4.join(location.git.gitDir, "HEAD"), "utf8").trim();
+      head = fs5.readFileSync(path5.join(location.git.gitDir, "HEAD"), "utf8").trim();
     } catch {}
     const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
     if (ref && ref[1] !== ".invalid")
@@ -10079,7 +10292,7 @@ function resolveTaskKey(root, location) {
   return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
 }
 function checkoutRootOf(root, location) {
-  const resolved = path4.resolve(root);
+  const resolved = path5.resolve(root);
   let canonical = resolved;
   try {
     canonical = fs5.realpathSync(resolved);
@@ -10110,13 +10323,13 @@ function branchRenames(location) {
     }
     for (const entry of entries)
       if (entry.isDirectory())
-        walk(path4.join(dir, entry.name));
+        walk(path5.join(dir, entry.name));
       else
-        files.push(path4.join(dir, entry.name));
+        files.push(path5.join(dir, entry.name));
   };
-  walk(path4.join(path4.dirname(location.dir), "logs", "refs", "heads"));
+  walk(path5.join(path5.dirname(location.dir), "logs", "refs", "heads"));
   if (location.git)
-    files.push(path4.join(location.git.gitDir, "logs", "HEAD"));
+    files.push(path5.join(location.git.gitDir, "logs", "HEAD"));
   const seen = new Set;
   const renames = [];
   for (const file of files) {
@@ -10177,20 +10390,20 @@ var NOT_A_REPO, gitRun = (cwd, args) => {
   }
 }, DISCOVERY_ENV, isGitDir = (dir) => {
   try {
-    return fs5.statSync(path4.join(dir, "HEAD")).isFile() && fs5.statSync(path4.join(dir, "objects")).isDirectory() && fs5.statSync(path4.join(dir, "refs")).isDirectory();
+    return fs5.statSync(path5.join(dir, "HEAD")).isFile() && fs5.statSync(path5.join(dir, "objects")).isDirectory() && fs5.statSync(path5.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 }, reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs5.readFileSync(path4.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs5.readFileSync(path5.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
 }, rebasingBranch = (gitDir) => {
   for (const state of ["rebase-merge", "rebase-apply"]) {
     try {
-      const ref = fs5.readFileSync(path4.join(gitDir, state, "head-name"), "utf8").trim();
+      const ref = fs5.readFileSync(path5.join(gitDir, state, "head-name"), "utf8").trim();
       const match = /^refs\/heads\/(.+)$/u.exec(ref);
       if (match)
         return match[1];
@@ -10201,7 +10414,7 @@ var NOT_A_REPO, gitRun = (cwd, args) => {
   let canonical = real(root);
   if (process.platform === "win32")
     canonical = canonical.toLowerCase();
-  const base = path4.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  const base = path5.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
   return `${base}-${shortHash(canonical)}`;
 };
 var init_paths = __esm(() => {
@@ -10218,7 +10431,7 @@ var init_paths = __esm(() => {
 // packages/workit-core/src/host-session.ts
 import { createHash as createHash3 } from "node:crypto";
 import fs6 from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 function hostSessionFromEnv(env) {
   const value = (key) => env[key]?.trim() || null;
   let inner = null;
@@ -10247,6 +10460,36 @@ function realHostSession(env) {
   const hosted = declared.host !== null && declared.host !== "cli";
   return { ...declared, kind: hosted ? "declared" : "none" };
 }
+function migrateRepoIssued(cwd) {
+  if (cwd === undefined)
+    return;
+  let old;
+  try {
+    const location = resolveStore(cwd);
+    if (location instanceof Error)
+      return;
+    old = path6.join(location.dir, "hooks", "issued");
+    if (!fs6.existsSync(old))
+      return;
+  } catch {
+    return;
+  }
+  for (const lead of safeList(old)) {
+    try {
+      const from = path6.join(old, lead);
+      if (!fs6.statSync(from).isDirectory())
+        continue;
+      const to = path6.join(userIssuedRoot(), lead);
+      fs6.mkdirSync(to, { recursive: true, mode: 448 });
+      for (const id of fs6.readdirSync(from)) {
+        fs6.copyFileSync(path6.join(from, id), path6.join(to, id));
+        fs6.rmSync(path6.join(from, id), { force: true });
+      }
+      removeIfEmpty(from);
+    } catch {}
+  }
+  removeIfEmpty(old);
+}
 function sessionClaimRefusal(env, claimed, cwd) {
   const real = realHostSession(env);
   const host = family(real.host);
@@ -10271,9 +10514,9 @@ function sessionClaimRefusal(env, claimed, cwd) {
     issuedClaim = true;
   }
   const error = `forged_session: ${claimed} is neither this shell's session (${real.session}) nor an id its host issued to a child of it`;
-  if (issuedClaim && noIssuedRecord(cwd) && host !== null && PLUGIN_UPDATE[host])
+  if (issuedClaim && noIssuedRecord(cwd, leadOf(claimed)) && host !== null && PLUGIN_UPDATE[host])
     return {
-      error: `${error}; no SubagentStart hook in this workspace has recorded an issued id`,
+      error: `${error}; no SubagentStart hook has recorded an issued id for this lead`,
       unblock: `the workit plugin hook is probably older than this CLI and does not record the ids it issues: update the plugin (${PLUGIN_UPDATE[host]}), then relaunch the verifier so its SubagentStart runs the new hook (workit doctor checks this as hook_issued_sessions)`
     };
   const ownChildShell = host !== null && OWN_CHILD_SHELL.has(host);
@@ -10282,32 +10525,35 @@ function sessionClaimRefusal(env, claimed, cwd) {
     unblock: ownChildShell ? `record the verdict from the verifier's own ${host === "pi" ? "Pi worker" : "OpenCode child session"} shell, where WORKIT_SESSION_ID is already set; never set WORKIT_SESSION_ID or --session by hand` : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session its SubagentStart context names, or pass --as verifier"
   };
 }
-var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), issuedRoot = (cwd) => {
-  const location = resolveStore(cwd);
-  return location instanceof Error ? null : path5.join(location.dir, "hooks", "issued");
-}, issuedDir = (cwd, lead) => {
-  const root = issuedRoot(cwd);
-  return root === null ? null : path5.join(root, hash(lead));
-}, noIssuedRecord = (cwd) => {
+var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path6.join(resolveStateDir(), "issued"), safeList = (dir) => {
+  try {
+    return fs6.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}, removeIfEmpty = (dir) => {
+  try {
+    fs6.rmdirSync(dir);
+  } catch {}
+}, noIssuedRecord = (cwd, lead) => {
   if (cwd === undefined)
     return false;
   try {
-    const root = issuedRoot(cwd);
-    return root !== null && !fs6.existsSync(root);
+    migrateRepoIssued(cwd);
+    return !fs6.existsSync(path6.join(userIssuedRoot(), hash(lead)));
   } catch {
     return false;
   }
 }, PLUGIN_UPDATE, wasIssued = (cwd, lead, claimed) => {
-  if (cwd === undefined)
-    return false;
+  migrateRepoIssued(cwd);
   try {
-    const dir = issuedDir(cwd, lead);
-    return dir !== null && fs6.existsSync(path5.join(dir, hash(claimed)));
+    return fs6.existsSync(path6.join(userIssuedRoot(), hash(lead), hash(claimed)));
   } catch {
     return false;
   }
 }, leadOf = (session) => session.slice(0, session.lastIndexOf(":")), OWN_CHILD_SHELL, HOST_SET_VARIABLE;
 var init_host_session = __esm(() => {
+  init_logger();
   init_paths();
   HOST_SESSION_VARS = [
     ["OPENCODE_SESSION_ID", () => "opencode"],
@@ -10331,19 +10577,19 @@ var init_host_session = __esm(() => {
 // packages/workit-core/src/core/package-root.ts
 import { existsSync } from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path6.dirname(fileURLToPath(import.meta.url));
+  let dir = path7.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path6.dirname(dir);
-    if (existsSync(path6.join(dir, "package.json")) || parent === dir)
+    const parent = path7.dirname(dir);
+    if (existsSync(path7.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
 }, assetRoot = () => {
   const root = packageRoot();
-  const assets = path6.join(root, "assets");
+  const assets = path7.join(root, "assets");
   return existsSync(assets) ? assets : root;
 };
 var init_package_root = () => {};
@@ -10352,7 +10598,7 @@ var init_package_root = () => {};
 import { spawnSync as spawnSync3 } from "node:child_process";
 import fs7 from "node:fs";
 import { hostname } from "node:os";
-import path7 from "node:path";
+import path8 from "node:path";
 var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, defaultLockTimeoutMs = 250, defaultLockTimeout = () => defaultLockTimeoutMs, setDefaultLockTimeout = (ms) => {
   defaultLockTimeoutMs = ms;
 }, parseMetadataLock = (raw) => {
@@ -10456,13 +10702,13 @@ var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, REC
     return null;
   }
 }, lockPathFor = (root) => {
-  let real = path7.resolve(root);
+  let real = path8.resolve(root);
   try {
     real = fs7.realpathSync(real);
   } catch {}
   const location = resolveStore(real);
-  const dir = location instanceof Error ? path7.join(real, ".workit") : location.dir;
-  return path7.join(dir, "checkouts", checkoutSlug(real), "metadata.lock");
+  const dir = location instanceof Error ? path8.join(real, ".workit") : location.dir;
+  return path8.join(dir, "checkouts", checkoutSlug(real), "metadata.lock");
 }, clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
   const guard = `${lockPath}.reclaim`;
   const age = ageOf(guard, nowMs);
@@ -10549,7 +10795,7 @@ var init_store_lock = __esm(() => {
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs8 from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 function readLog(file, from = 0, expectSeq = null) {
   let fd;
   try {
@@ -10622,7 +10868,7 @@ function appendEvent(file, event, validEnd) {
     fs8.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path8.dirname(file));
+    fsyncDirectory(path9.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
@@ -10638,7 +10884,7 @@ function replaceFile(file, bytes, durable) {
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path8.dirname(file));
+      fsyncDirectory(path9.dirname(file));
   } catch (error) {
     try {
       fs8.unlinkSync(temporary);
@@ -10948,7 +11194,7 @@ var init_notes = __esm(() => {
 // packages/workit-core/src/core/task-store.ts
 import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
 import * as fs9 from "node:fs";
-import path9 from "node:path";
+import path10 from "node:path";
 class TaskStore {
   root;
@@ -10960,7 +11206,7 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path9.resolve(root);
+    const resolved = path10.resolve(root);
     this.origin = fs9.existsSync(resolved) ? fs9.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
@@ -10969,7 +11215,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs9.existsSync(path9.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs9.existsSync(path10.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -11125,7 +11371,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path9.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path10.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -11185,14 +11431,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path9.dirname(location.data.dir);
-    const heads = path9.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path9.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path10.dirname(location.data.dir);
+    const heads = path10.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path10.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path9.join(heads, branch),
+      path10.join(heads, branch),
       headLog,
       heads,
-      path9.join(common, "packed-refs")
+      path10.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -11204,7 +11450,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path9.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path10.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -11442,13 +11688,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path9.join(this.root, ".workit", "recovery");
+    const recovery = path10.join(this.root, ".workit", "recovery");
     if (fs9.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
         for (const name of fs9.readdirSync(recovery)) {
-          const stat = fs9.lstatSync(path9.join(recovery, name));
+          const stat = fs9.lstatSync(path10.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -11501,7 +11747,7 @@ class TaskStore {
       if (fs9.existsSync(dirs.blobs))
         for (const name of fs9.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path9.join(dirs.blobs, name);
+          const file = path10.join(dirs.blobs, name);
           let stat;
           try {
             stat = fs9.lstatSync(file);
@@ -11519,7 +11765,7 @@ class TaskStore {
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path9.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path10.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -11527,7 +11773,7 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path9.join(dirs.tasks, name))
+      ...names.map((name) => path10.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
       if (!fs9.existsSync(directory))
@@ -11535,7 +11781,7 @@ class TaskStore {
       for (const name of fs9.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path9.join(directory, name);
+        const file = path10.join(directory, name);
         try {
           const stat = fs9.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
@@ -11552,30 +11798,30 @@ class TaskStore {
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path9.join(this.root, ".workit");
-    const checkout = path9.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path10.join(this.root, ".workit");
+    const checkout = path10.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path9.join(dir, "store.json"),
+      marker: path10.join(dir, "store.json"),
       checkout,
-      workspace: path9.join(checkout, "workspace.json"),
-      checkoutLock: path9.join(checkout, "metadata.lock"),
-      tasks: path9.join(dir, "tasks"),
-      index: path9.join(dir, "task-index.json"),
-      blobs: path9.join(dir, "blobs", "candidates"),
-      legacy: path9.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path9.join(this.root, ".workit")
+      workspace: path10.join(checkout, "workspace.json"),
+      checkoutLock: path10.join(checkout, "metadata.lock"),
+      tasks: path10.join(dir, "tasks"),
+      index: path10.join(dir, "task-index.json"),
+      blobs: path10.join(dir, "blobs", "candidates"),
+      legacy: path10.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path10.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path9.join(this.paths().tasks, taskId, "events.jsonl");
+    return path10.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path9.join(this.paths().tasks, taskId, "snapshot.json");
+    return path10.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path9.join(this.paths().tasks, taskId, "lock");
+    return path10.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -11614,13 +11860,13 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs9.readFileSync(path9.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs9.readFileSync(path10.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path9.join(dir, `${digest}.json`);
+        const file = path10.join(dir, `${digest}.json`);
         if (fs9.existsSync(file)) {
           const stamp = new Date;
           try {
@@ -11812,7 +12058,7 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path9.join(this.paths().tasks, record.id);
+    const dir = path10.join(this.paths().tasks, record.id);
     fs9.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
@@ -11905,7 +12151,7 @@ class TaskStore {
   }
   withKeyLock(key, operation) {
     const digest = createHash5("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path9.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    return this.withLock(path10.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -12046,7 +12292,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs9.mkdirSync(path9.dirname(file), { recursive: true });
+      fs9.mkdirSync(path10.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -12124,23 +12370,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path9.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path10.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path9.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path10.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path9.join(v2, "workspace.json");
-    const v2Tasks = path9.join(v2, "tasks");
-    const legacy = path9.join(dirs.dir, "legacy", checkoutSlug(path9.dirname(v2)), "v2");
+    const v2Workspace = path10.join(v2, "workspace.json");
+    const v2Tasks = path10.join(v2, "tasks");
+    const legacy = path10.join(dirs.dir, "legacy", checkoutSlug(path10.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path9.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path10.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -12149,7 +12395,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs9.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path9.join(v2Tasks, name)));
+        files = fs9.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path10.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -12167,21 +12413,21 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs9.mkdirSync(path9.join(legacy, "tasks"), { recursive: true });
+        fs9.mkdirSync(path10.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs9.existsSync(path9.join(v2, name)))
-            fs9.copyFileSync(path9.join(v2, name), path9.join(legacy, name));
+          if (fs9.existsSync(path10.join(v2, name)))
+            fs9.copyFileSync(path10.join(v2, name), path10.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path9.join(v2Tasks, name);
+          const file = path10.join(v2Tasks, name);
           const bytes = fs9.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs9.writeFileSync(path9.join(legacy, "tasks", name), bytes);
+          fs9.writeFileSync(path10.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path9.join(legacy, "tasks", name), digest };
+          const origin = { path: path10.join(legacy, "tasks", name), digest };
           if (!fs9.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
@@ -12217,7 +12463,7 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path9.join(v2Tasks, name);
+          const file = path10.join(v2Tasks, name);
           if (sha256(fs9.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
@@ -12228,7 +12474,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs9.rmSync(path9.join(v2, "index.json"), { force: true });
+        fs9.rmSync(path10.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -12248,7 +12494,7 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path9.join(dirs.v2, "store.json");
+    const marker = path10.join(dirs.v2, "store.json");
     if (!dirs.shared || !fs9.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
@@ -12258,7 +12504,7 @@ class TaskStore {
       try {
         const merge = (from, to) => {
           if (!fs9.existsSync(to)) {
-            fs9.mkdirSync(path9.dirname(to), { recursive: true });
+            fs9.mkdirSync(path10.dirname(to), { recursive: true });
             try {
               fs9.renameSync(from, to);
             } catch {
@@ -12269,24 +12515,24 @@ class TaskStore {
           }
           if (fs9.lstatSync(from).isDirectory() && fs9.lstatSync(to).isDirectory())
             for (const name of fs9.readdirSync(from))
-              merge(path9.join(from, name), path9.join(to, name));
+              merge(path10.join(from, name), path10.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path9.join(dirs.v2, sub);
+          const from = path10.join(dirs.v2, sub);
           if (!fs9.existsSync(from))
             continue;
           if (sub === "tasks") {
             for (const name of fs9.readdirSync(from))
-              if (validId(name) && !fs9.existsSync(path9.join(dirs.dir, sub, name)))
+              if (validId(name) && !fs9.existsSync(path10.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path9.join(dirs.dir, sub));
+          merge(from, path10.join(dirs.dir, sub));
         }
-        const ledger = path9.join(dirs.v2, "ledger");
-        if (fs9.existsSync(ledger) && !fs9.existsSync(path9.join(dirs.dir, "ledger")))
-          merge(ledger, path9.join(dirs.dir, "ledger"));
-        fs9.rmSync(path9.join(dirs.v2, "task-index.json"), { force: true });
-        fs9.renameSync(marker, path9.join(dirs.v2, "store.moved.json"));
+        const ledger = path10.join(dirs.v2, "ledger");
+        if (fs9.existsSync(ledger) && !fs9.existsSync(path10.join(dirs.dir, "ledger")))
+          merge(ledger, path10.join(dirs.dir, "ledger"));
+        fs9.rmSync(path10.join(dirs.v2, "task-index.json"), { force: true });
+        fs9.renameSync(marker, path10.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -12324,7 +12570,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path9.dirname(v2),
+      root: path10.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -12336,11 +12582,11 @@ class TaskStore {
       critical: ["store"]
     };
     fs9.mkdirSync(v2, { recursive: true });
-    const ignore = path9.join(v2, ".gitignore");
+    const ignore = path10.join(v2, ".gitignore");
     if (!fs9.existsSync(ignore))
       fs9.writeFileSync(ignore, `*
 `);
-    replaceFile(path9.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path10.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -12364,8 +12610,8 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path9.join(this.root, ".workit");
-      if (fs9.existsSync(path9.join(v2, "workspace.json")))
+      const v2 = path10.join(this.root, ".workit");
+      if (fs9.existsSync(path10.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
@@ -12382,7 +12628,7 @@ class TaskStore {
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path9.join(dirs.dir, ".gitignore");
+      const ignore = path10.join(dirs.dir, ".gitignore");
       let current = null;
       try {
         current = fs9.readFileSync(ignore, "utf8");
@@ -12442,7 +12688,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs9.mkdirSync(path9.dirname(lockPath), { recursive: true });
+      fs9.mkdirSync(path10.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -12505,7 +12751,7 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path9.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path10.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
@@ -12563,7 +12809,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
 }, now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"), oldestFirst = (left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id), cachedRuntimeVersion = null, runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs9.readFileSync(path9.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs9.readFileSync(path10.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -12590,7 +12836,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
     return "";
   }
 }, REFLOG_LINE, branchStart = (location, branch, aliases) => {
-  const first = readText(path9.join(path9.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path10.join(path10.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -12600,7 +12846,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path9.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path10.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -12609,12 +12855,12 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
       return moved[1];
   }
   return null;
-}, refExists = (common, ref) => fs9.existsSync(path9.join(common, ref)) || readText(path9.join(common, "packed-refs")).includes(` ${ref}
+}, refExists = (common, ref) => fs9.existsSync(path10.join(common, ref)) || readText(path10.join(common, "packed-refs")).includes(` ${ref}
 `), origins, sameDirectoryIdentity = (left, right) => {
-  if (!path9.isAbsolute(left) || !path9.isAbsolute(right))
+  if (!path10.isAbsolute(left) || !path10.isAbsolute(right))
     return false;
-  const normalizedLeft = path9.resolve(left);
-  const normalizedRight = path9.resolve(right);
+  const normalizedLeft = path10.resolve(left);
+  const normalizedRight = path10.resolve(right);
   try {
     const a = fs9.statSync(normalizedLeft, { bigint: true });
     const b = fs9.statSync(normalizedRight, { bigint: true });
@@ -12673,8 +12919,8 @@ var init_workers = __esm(() => {
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import fs10 from "node:fs";
-import os from "node:os";
-import path10 from "node:path";
+import os2 from "node:os";
+import path11 from "node:path";
 function networkGitInvocation(cwd, args, timeoutMs) {
   const seconds = Math.max(1, Math.ceil(timeoutMs / 1000));
   const env = {
@@ -12732,9 +12978,9 @@ function worktreeTree(cwd, options = {}) {
     return null;
   const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
   const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
-  const scratch = fs10.mkdtempSync(path10.join(os.tmpdir(), "workit-tree-"));
+  const scratch = fs10.mkdtempSync(path11.join(os2.tmpdir(), "workit-tree-"));
   try {
-    const tempIndex = path10.join(scratch, "index");
+    const tempIndex = path11.join(scratch, "index");
     if (fs10.existsSync(indexPath))
       seedIndex(indexPath, tempIndex);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
@@ -12747,7 +12993,7 @@ function worktreeTree(cwd, options = {}) {
     const skipped = [];
     for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
       try {
-        const stat = fs10.statSync(path10.join(top, file));
+        const stat = fs10.statSync(path11.join(top, file));
         if (stat.isFile() && stat.size > cap)
           skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
       } catch {}
@@ -12793,7 +13039,7 @@ function worktreeSignal(cwd, options = {}) {
     if (entry.length < 4)
       continue;
     const file = entry.slice(3);
-    const absolute = path10.join(top, file);
+    const absolute = path11.join(top, file);
     let stat = "-";
     try {
       const info = fs10.lstatSync(absolute, { bigint: true });
@@ -12972,15 +13218,15 @@ function parseRemoteUrl(raw) {
     path: cleanPath(decodeURIComponent(url.pathname))
   };
 }
-function readSshConfig(home = os.homedir()) {
+function readSshConfig(home = os2.homedir()) {
   try {
-    return { text: fs10.readFileSync(path10.join(home, ".ssh", "config"), "utf8"), home };
+    return { text: fs10.readFileSync(path11.join(home, ".ssh", "config"), "utf8"), home };
   } catch {
     return { text: "", home };
   }
 }
 function resolveSshHost(alias, sshConfig) {
-  const source = typeof sshConfig === "string" ? { text: sshConfig, home: os.homedir() } : sshConfig;
+  const source = typeof sshConfig === "string" ? { text: sshConfig, home: os2.homedir() } : sshConfig;
   let hostname = null;
   let port = null;
   const evaluate = (text, initiallyActive, neverMatch, depth) => {
@@ -13176,15 +13422,15 @@ child.on("exit", (code) => {
     return [];
   return [{ key: match[1].toLowerCase(), args: tokens(match[2]) }];
 }), includeFiles = (spec, home) => {
-  const expanded = spec.startsWith("~") ? path10.join(home, spec.slice(1)) : spec;
-  const absolute = path10.isAbsolute(expanded) ? expanded : path10.join(home, ".ssh", expanded);
-  const dir = path10.dirname(absolute);
-  const base = path10.basename(absolute);
+  const expanded = spec.startsWith("~") ? path11.join(home, spec.slice(1)) : spec;
+  const absolute = path11.isAbsolute(expanded) ? expanded : path11.join(home, ".ssh", expanded);
+  const dir = path11.dirname(absolute);
+  const base = path11.basename(absolute);
   if (!/[*?]/u.test(base))
     return [absolute];
   try {
     const pattern = globToRegExp(base);
-    return fs10.readdirSync(dir).filter((name) => pattern.test(name)).toSorted().map((name) => path10.join(dir, name));
+    return fs10.readdirSync(dir).filter((name) => pattern.test(name)).toSorted().map((name) => path11.join(dir, name));
   } catch {
     return [];
   }
@@ -13229,13 +13475,13 @@ import {
   copyFileSync as copyFileSync2,
   cpSync as cpSync2,
   existsSync as existsSync3,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync2,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import os2 from "node:os";
-import path11 from "node:path";
+import os3 from "node:os";
+import path12 from "node:path";
 var diagnosticLogger, setDiagnosticLogger = (logger) => {
   diagnosticLogger = logger;
 }, getDiagnosticLogger = () => diagnosticLogger, PRESETS, mergePreset = (preset, input = {}, current = {
@@ -13247,14 +13493,14 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
     allowed: preset === "custom" ? input.allowed ?? current.branchPolicy.allowed : [...defs.allowed],
     protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
   };
-}, resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path11.join(process.env.XDG_CONFIG_HOME || path11.join(os2.homedir(), ".config"), "workit"), migratedDir = null, migrationFailed = false, ensureConfigDir = (dir = resolveConfigDir()) => {
+}, resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path12.join(process.env.XDG_CONFIG_HOME || path12.join(os3.homedir(), ".config"), "workit"), migratedDir = null, migrationFailed = false, ensureConfigDir = (dir = resolveConfigDir()) => {
   if (migratedDir === dir)
     return dir;
   if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
     migratedDir = dir;
     return dir;
   }
-  const legacy = path11.join(process.env.XDG_CONFIG_HOME || path11.join(os2.homedir(), ".config"), "workflow-toolkit");
+  const legacy = path12.join(process.env.XDG_CONFIG_HOME || path12.join(os3.homedir(), ".config"), "workflow-toolkit");
   if (!existsSync3(legacy)) {
     migratedDir = dir;
     return dir;
@@ -13264,11 +13510,11 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
     return dir;
   }
   migrationFailed = false;
-  mkdirSync2(dir, { recursive: true });
+  mkdirSync3(dir, { recursive: true });
   diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
-  for (const entry of readdirSync2(legacy, { withFileTypes: true })) {
-    const src = path11.join(legacy, entry.name);
-    const dest = path11.join(dir, entry.name);
+  for (const entry of readdirSync3(legacy, { withFileTypes: true })) {
+    const src = path12.join(legacy, entry.name);
+    const dest = path12.join(dir, entry.name);
     if (existsSync3(dest))
       continue;
     try {
@@ -13323,7 +13569,7 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
     unchosenBranchPolicy.add(config);
   return { status: "valid", path: file, config };
 }, readConfigTyped = (dir) => {
-  const file = path11.join(dir ?? configDir(), "config.json");
+  const file = path12.join(dir ?? configDir(), "config.json");
   return parseConfigResult(readSafe(file), file);
 }, readConfig = () => {
   const result = readConfigTyped();
@@ -13335,7 +13581,7 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   if (result.status === "malformed")
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
-}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path11.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
+}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path12.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
   const wp = workspace?.branchPolicy ?? {};
   const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
   const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
@@ -13466,7 +13712,7 @@ var init_branch_policy = __esm(() => {
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 function workspaceDefaultTarget(cwd, globalDefault) {
   const ws = resolveRuntimeWorkspaceVcs(cwd);
   const wp = ws?.branchPolicy ?? {};
@@ -13511,7 +13757,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     document: parsed
   };
 }, readWorkspacesResult = (dir = configDir()) => {
-  const file = path12.join(dir, "workspaces.json");
+  const file = path13.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -13611,9 +13857,9 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   let main = null;
   const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
   const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path12.resolve(gitDir) !== path12.resolve(common)) {
+  if (gitDir && common && path13.resolve(gitDir) !== path13.resolve(common)) {
     const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path12.basename(common) === ".git" ? path12.dirname(common) : common);
+    main = listed?.trim() || (path13.basename(common) === ".git" ? path13.dirname(common) : common);
   }
   mainCheckouts.set(cwd, main);
   return main;
@@ -13690,8 +13936,8 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     profiles: record(nonBlank, profileSchema).optional()
   }).passthrough();
   return entrySchema;
-}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd) => {
-  const file = path12.join(configDir(), "workspaces.json");
+}, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd, dir = configDir()) => {
+  const file = path13.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -13720,10 +13966,27 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   const matches = matchingEntries(cwd, entries ?? []);
   const workspaceName = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
   const selected = selectWorkspaceMatch(matches, cwd, workspaceName);
-  return selected ? { file, selected } : null;
+  return selected ? { file, selected, matches } : null;
 }, resolveRuntimeReleaseTracks = (cwd) => {
   const matched = matchRuntimeWorkspace(cwd);
   return matched ? { workspace: matched.selected.name, releaseTracks: matched.selected.releaseTracks } : null;
+}, workspaceTrailers = (cwd, dir) => {
+  let matched;
+  try {
+    matched = matchRuntimeWorkspace(cwd, dir);
+  } catch {
+    return { enabled: true, workspace: null, from: null };
+  }
+  if (!matched)
+    return { enabled: true, workspace: null, from: null };
+  const { selected, matches } = matched;
+  const enclosing = matches.filter((entry) => entry !== selected).toSorted((a, b) => globSpecificity(b.glob) - globSpecificity(a.glob));
+  const source = [selected, ...enclosing].find((entry) => typeof entry.trailers === "boolean");
+  return {
+    enabled: source?.trailers !== false,
+    workspace: selected.name,
+    from: source?.name ?? null
+  };
 }, resolveRuntimeWorkspaceCandidate = (cwd, kind) => {
   const matched = matchRuntimeWorkspace(cwd);
   if (!matched)
@@ -13854,7 +14117,7 @@ var init_workspaces = __esm(() => {
         context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
       }
     }
-    if (track.versionSource?.kind === "package-json" && (path12.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+    if (track.versionSource?.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
       context.addIssue({
         code: "custom",
         path: ["versionSource", "path"],
@@ -13874,6 +14137,7 @@ var init_workspaces = __esm(() => {
     autoApprove: union([boolean2(), array(nonBlank)]).optional(),
     defaultEndpoint: unknown().optional(),
     verification: _enum(["self", "independent"]).optional(),
+    trailers: boolean2().optional(),
     autonomy: object(Object.fromEntries(["push", "pr", "merge", "release", "rerun"].map((kind) => [
       kind,
       union([boolean2(), literal("verified")]).optional()
@@ -14191,7 +14455,7 @@ function gitTrackProbe(cwd) {
       const created = own.at(-1);
       if (!created || created.subject !== "branch: Created from HEAD")
         return null;
-      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
+      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp2(branch)}$`, "u");
       const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
       return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
     },
@@ -14339,7 +14603,7 @@ var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER
   return run.status === 0 ? (run.stdout ?? "").trim() : null;
 }, recordedBaseKey = (branch) => `branch.${branch}.workitBase`, recordBranchBase = (cwd, branch, base) => {
   git3(cwd, ["config", recordedBaseKey(branch), base]);
-}, escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), reflog = (cwd, ref) => (git3(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
+}, escapeRegExp2 = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), reflog = (cwd, ref) => (git3(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
 `).map((line) => {
   const [sha = "", selector = "", ...subject] = line.split("\t");
   return {
@@ -14389,7 +14653,7 @@ var init_release_tracks = __esm(() => {
 // packages/workit-core/src/core/vcs-config.ts
 import fs11 from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 import { spawnSync as spawnSync8 } from "node:child_process";
 function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
@@ -14452,7 +14716,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const prov = cfg[provider] ?? {};
   const out = {
     ok: true,
-    configPath: path13.resolve(cfgPath),
+    configPath: path14.resolve(cfgPath),
     provider,
     defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
@@ -14472,7 +14736,7 @@ function vcsConfig(mode, cwd, options = {}) {
   }
   return out;
 }
-var workspacesPath = () => path13.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
+var workspacesPath = () => path14.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
   const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
@@ -14519,7 +14783,7 @@ var init_vcs_config = __esm(() => {
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
 import fs12 from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 function resolveCommit(cwd, ref) {
   if (!safeRef(ref))
     return null;
@@ -14585,14 +14849,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path14.resolve(cwd));
+  const location = resolveStore(path15.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path15.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 function actorFromEnv(env) {
   const value = (key) => {
@@ -14654,8 +14918,8 @@ function appendLine(file, build, options) {
     }
   };
   try {
-    fs12.mkdirSync(path14.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path14.dirname(file)))
+    fs12.mkdirSync(path15.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path15.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -15334,7 +15598,7 @@ function summarizeRow(row) {
   };
 }
 function stackPosition(root, branch) {
-  const dir = path14.join(root, "stacks");
+  const dir = path15.join(root, "stacks");
   let names = [];
   try {
     names = fs12.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -15344,7 +15608,7 @@ function stackPosition(root, branch) {
   for (const name of names.toSorted()) {
     let parsed;
     try {
-      parsed = JSON.parse(fs12.readFileSync(path14.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs12.readFileSync(path15.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -15489,12 +15753,12 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, VERDICT_RESULTS, PASSING, FAILING
   }
 }, LOCK_WAIT_MS = 5000, LOCK_STALE_MS = 30000, LOCK_OWNER = "owner", lockToken = (lock) => {
   try {
-    return fs12.readFileSync(path14.join(lock, LOCK_OWNER), "utf8");
+    return fs12.readFileSync(path15.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 }, lockAgeMs = (lock) => {
-  for (const target of [path14.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path15.join(lock, LOCK_OWNER), lock]) {
     try {
       return Date.now() - fs12.statSync(target).mtimeMs;
     } catch {}
@@ -15664,7 +15928,7 @@ var init_ledger = __esm(() => {
         throw error;
       }
       const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
-      fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
+      fs12.writeFileSync(path15.join(lock, LOCK_OWNER), token);
       return token;
     },
     release(lock, token) {
@@ -15717,7 +15981,7 @@ var init_ledger = __esm(() => {
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 function deriveRequirements(judgment, scope, constraints, verification = "self") {
   const out = [];
   const base = { scope, dependentAction: null };
@@ -15858,7 +16122,7 @@ var RULES, derived2 = (spec) => ({
     decisionIds: []
   };
 }, planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path15.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path16.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -15907,7 +16171,7 @@ var init_derive = __esm(() => {
 import { createHash as createHash10 } from "node:crypto";
 import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
@@ -15949,7 +16213,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path16.join(checkout, item);
+    const target = path17.join(checkout, item);
     try {
       const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -16322,12 +16586,12 @@ function evaluateClosure(requestedOutcome, view) {
     requirementIds: evaluations.map((item) => item.requirementId)
   });
 }
-var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path16.sep}`), relative = (root, candidate) => path16.relative(root, candidate).split(path16.sep).join("/") || ".", canonicalPath = (value) => {
+var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`), relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".", canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path16.posix.normalize(value);
+  const normalized = path17.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -16369,14 +16633,14 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 }, walk = (root, directory, output) => {
@@ -16390,7 +16654,7 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path16.join(directory, name);
+    const target = path17.join(directory, name);
     let stat;
     try {
       stat = fs13.lstatSync(target);
@@ -16407,12 +16671,12 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
 }, scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path16.resolve(root, item);
+    const target = path17.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs13.existsSync(ancestor) && ancestor !== root)
-      ancestor = path16.dirname(ancestor);
+      ancestor = path17.dirname(ancestor);
     try {
       if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -16476,23 +16740,23 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path16.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path16.sep}`))
+    const target = path17.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path16.relative(root, target);
+      const below = path17.relative(root, target);
       let current = root;
-      for (const segment of below.split(path16.sep)) {
+      for (const segment of below.split(path17.sep)) {
         if (!segment)
           continue;
-        current = path16.join(current, segment);
+        current = path17.join(current, segment);
         const stat = fs13.lstatSync(current);
         const real = fs13.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path16.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -16773,7 +17037,7 @@ var init_git = () => {};
 // packages/workit-core/src/core/branch.ts
 import { execFileSync } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
-import path17 from "node:path";
+import path18 from "node:path";
 function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
   const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
   const config = readConfig();
@@ -16972,7 +17236,7 @@ var withReleaseTracks = (workspaceRoot, policy) => {
   let raw;
   try {
     raw = execFileSync("git", ["status", "--porcelain=v1"], {
-      cwd: path17.resolve(workspaceRoot),
+      cwd: path18.resolve(workspaceRoot),
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -17210,13 +17474,13 @@ import {
   fchmodSync,
   fsyncSync,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
   renameSync as renameSync2,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 function writeFileExclusive(file, content, mode) {
   try {
     writeFileSync3(file, content, { encoding: "utf8", flag: "wx", mode });
@@ -17228,9 +17492,9 @@ function writeFileExclusive(file, content, mode) {
   }
 }
 function writeFileAtomic(file, content, mode) {
-  const absolute = path18.resolve(file);
-  let parent = path18.dirname(absolute);
-  const root = path18.parse(parent).root;
+  const absolute = path19.resolve(file);
+  let parent = path19.dirname(absolute);
+  const root = path19.parse(parent).root;
   for (;; ) {
     try {
       if (lstatSync3(parent).isSymbolicLink())
@@ -17239,13 +17503,13 @@ function writeFileAtomic(file, content, mode) {
       if (error.code !== "ENOENT")
         throw error;
     }
-    const next = path18.dirname(parent);
+    const next = path19.dirname(parent);
     if (parent === root || next === parent)
       break;
     parent = next;
   }
-  const directory = path18.dirname(absolute);
-  mkdirSync3(directory, { recursive: true });
+  const directory = path19.dirname(absolute);
+  mkdirSync4(directory, { recursive: true });
   let existing = null;
   try {
     existing = lstatSync3(absolute);
@@ -17274,7 +17538,7 @@ function writeFileAtomic(file, content, mode) {
       } catch {}
     }
     try {
-      unlinkSync(temporary);
+      unlinkSync2(temporary);
     } catch {}
     throw error;
   }
@@ -17283,8 +17547,8 @@ var init_safe_write = () => {};
 // packages/workit-core/src/autonomy.ts
 import { copyFileSync as copyFileSync3, existsSync as existsSync6 } from "node:fs";
-import os3 from "node:os";
-import path19 from "node:path";
+import os4 from "node:os";
+import path20 from "node:path";
 function endpointOf(entry) {
   const raw = entry?.defaultEndpoint;
   if (raw === undefined)
@@ -17523,13 +17787,13 @@ function listGrants(dir = grantsDir()) {
 }
 var accountHome = () => {
   try {
-    return os3.userInfo().homedir;
+    return os4.userInfo().homedir;
   } catch {
-    return os3.homedir();
+    return os4.homedir();
   }
-}, grantsHome, grantsDir = () => path19.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
-  const configured = path19.resolve(resolveConfigDir());
-  return configured === path19.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path19.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+}, grantsHome, grantsDir = () => path20.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
+  const configured = path20.resolve(resolveConfigDir());
+  return configured === path20.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path20.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 }, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINTS, DEFAULT_ENDPOINT = "commit", isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value), raisesEndpoint = (current, next) => DEFAULT_ENDPOINTS.indexOf(next) > DEFAULT_ENDPOINTS.indexOf(current), DEFAULT_VERIFICATION = "self", verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self", isGrantKind = (value) => typeof value === "string" && GRANT_KINDS.includes(value), isGrantValue = (value) => value === true || value === false || value === "verified", normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value, fromAutoApprove = (value) => {
   if (value === true)
     return { push: true, pr: true, merge: "verified" };
@@ -19273,12 +19537,12 @@ var init_pr_body = __esm(() => {
 });
 // packages/workit-core/src/core/pr-create.ts
-import path20 from "node:path";
+import path21 from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 var safePushUrl = (remote) => {
   const raw = remote.trim();
-  if (path20.isAbsolute(raw))
+  if (path21.isAbsolute(raw))
     return pathToFileURL(raw).href;
   if (!raw.includes("://")) {
     const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
@@ -19339,7 +19603,7 @@ var init_scripts = __esm(() => {
 // packages/workit-core/src/core/youtrack.ts
 import fs14 from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
   if (!fs14.existsSync(cfgPath)) {
@@ -19363,7 +19627,7 @@ function youTrackConfigLoad() {
   }
   const cfgPath = loaded.path;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path21.isAbsolute(tokenFile) ? path21.resolve(tokenFile) : path21.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path22.isAbsolute(tokenFile) ? path22.resolve(tokenFile) : path22.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs14.existsSync(tokenPath)) {
     return { error: "missing youtrack.token" };
   }
@@ -19377,8 +19641,8 @@ function youTrackConfigLoad() {
   const redacted = { ...loaded.config };
   delete redacted.tokenFile;
   redacted.tokenPresent = true;
-  redacted.configPath = path21.resolve(cfgPath);
-  redacted.tokenPath = path21.resolve(tokenPath);
+  redacted.configPath = path22.resolve(cfgPath);
+  redacted.tokenPath = path22.resolve(tokenPath);
   return { data: redacted };
 }
 function tzParts(date, tz) {
@@ -19701,7 +19965,7 @@ async function postUpdate({
   }
   return { ok: true, issueId, postedComment: true };
 }
-var ISSUE_RE, TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE", youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path21.join(configDir(), "youtrack.json"), youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path21.join(resolveConfigDir(), "youtrack.json"), youTrackTokenModeOk = (p) => {
+var ISSUE_RE, TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE", youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path22.join(configDir(), "youtrack.json"), youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path22.join(resolveConfigDir(), "youtrack.json"), youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
   const mode = fs14.statSync(p).mode & 511;
@@ -19737,7 +20001,7 @@ var ISSUE_RE, TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE", youTrackConfigPath = () =>
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path21.isAbsolute(tokenFile) ? path21.resolve(tokenFile) : path21.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path22.isAbsolute(tokenFile) ? path22.resolve(tokenFile) : path22.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs14.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
@@ -19842,18 +20106,18 @@ var init_context_read = __esm(() => {
 // packages/workit-core/src/core.ts
 import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path22.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path22.sep)) {
+  const target = path23.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path23.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync7(ancestor))
-    ancestor = path22.dirname(ancestor);
+    ancestor = path23.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path22.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path23.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
@@ -19879,7 +20143,7 @@ var init_core3 = __esm(() => {
 // packages/workit-cli/src/task.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 async function readInput(input) {
   if (typeof input === "string")
     return input;
@@ -20198,7 +20462,7 @@ var TASK_FAMILIES, workspaceRootFor = (deps = {}) => {
     return explicit;
   const cwd = deps.cwd ?? process.cwd();
   const top = checkRoot(cwd);
-  return sameDirectoryIdentity(top, path23.resolve(cwd)) ? cwd : top;
+  return sameDirectoryIdentity(top, path24.resolve(cwd)) ? cwd : top;
 }, TASK_ACTIONS, outOf = (deps) => deps.out ?? process.stdout, errOf = (deps) => deps.err ?? process.stderr, write = (stream, value) => stream.write(value.endsWith(`
 `) ? value : `${value}
 `), jsonResult = (stream, result) => write(stream, JSON.stringify(result)), usage = (message) => failure2("invalid_input", message), parseUsage = (message, json) => ({
@@ -21488,7 +21752,7 @@ var init_environment = __esm(() => {
 // node_modules/ansi-escapes/base.js
 import process2 from "node:process";
-import os4 from "node:os";
+import os5 from "node:os";
 var ESC = "\x1B[", SEP = ";", isTerminalApp, isWindows2, isTmux, cwdFunction, cursorTo = (x, y) => {
   if (typeof x !== "number") {
     throw new TypeError("The `x` argument is required");
@@ -21510,7 +21774,7 @@ var ESC = "\x1B[", SEP = ";", isTerminalApp, isWindows2, isTmux, cwdFunction, cu
   if (isBrowser || !isWindows2) {
     return false;
   }
-  const parts = os4.release().split(".");
+  const parts = os5.release().split(".");
   const major = Number(parts[0]);
   const build = Number(parts[2] ?? 0);
   if (major < 10) {
@@ -57173,7 +57437,7 @@ var init_ansi_styles2 = __esm(() => {
 // node_modules/chalk/source/vendor/supports-color/index.js
 import process5 from "node:process";
-import os5 from "node:os";
+import os6 from "node:os";
 import tty2 from "node:tty";
 function hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process5.argv) {
   const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
@@ -57231,7 +57495,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min;
   }
   if (process5.platform === "win32") {
-    const osRelease = os5.release().split(".");
+    const osRelease = os6.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -63060,7 +63324,7 @@ var init_gitignore = __esm(() => {
 // packages/workit-core/src/core/changelog.ts
 import fs17 from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 function normalizeBullet(text) {
   text = text.trim();
@@ -63220,7 +63484,7 @@ function applyChangelog(target, entries, normalizeOnly) {
   const rendered = renderChangelog(source.text, entries, normalizeOnly);
   if ("error" in rendered)
     return { error: rendered.error };
-  fs17.mkdirSync(path24.dirname(target), { recursive: true });
+  fs17.mkdirSync(path25.dirname(target), { recursive: true });
   fs17.writeFileSync(target, rendered.text, "utf8");
   return { ...rendered.result, path: target };
 }
@@ -63363,14 +63627,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 }, changelogTarget = (workspaceRoot, changelogPath) => {
   try {
     const cwd = fs17.realpathSync(resolveWorkspaceRoot(workspaceRoot));
-    const target = path24.resolve(cwd, changelogPath || "CHANGELOG.md");
-    if (target !== cwd && !target.startsWith(cwd + path24.sep))
+    const target = path25.resolve(cwd, changelogPath || "CHANGELOG.md");
+    if (target !== cwd && !target.startsWith(cwd + path25.sep))
       return { error: "changelog path must be inside workspace_root" };
     let ancestor = target;
     while (!fs17.existsSync(ancestor))
-      ancestor = path24.dirname(ancestor);
+      ancestor = path25.dirname(ancestor);
     const canonicalAncestor = fs17.realpathSync(ancestor);
-    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path24.sep))
+    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path25.sep))
       return { error: "changelog path must be inside workspace_root" };
     return { cwd, target: fs17.existsSync(target) ? fs17.realpathSync(target) : target };
   } catch {
@@ -63389,22 +63653,22 @@ var init_changelog = __esm(() => {
 // packages/workit-core/src/core/hygiene.ts
 import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
-import path25 from "node:path";
-var repoRoot2, templatesDir = () => path25.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
-  if (!existsSync9(path25.join(root, "package.json")))
+import path26 from "node:path";
+var repoRoot2, templatesDir = () => path26.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
+  if (!existsSync9(path26.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync9(path25.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync9(path26.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }, isOpenSource = (root) => {
-  if (existsSync9(path25.join(root, "LICENSE")))
+  if (existsSync9(path26.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
     return true;
-  return path25.basename(root) === "workflow-toolkit";
+  return path26.basename(root) === "workflow-toolkit";
 }, licenseHolder = (root) => {
   const pkg = packageJson(root);
   if (pkg) {
@@ -63425,13 +63689,13 @@ var repoRoot2, templatesDir = () => path25.join(repoRoot2, "templates", "hygiene
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync9(path25.join(root, file)))
+    if (existsSync9(path26.join(root, file)))
       continue;
-    const tpl = path25.join(templatesDir(), file);
+    const tpl = path26.join(templatesDir(), file);
     if (!existsSync9(tpl))
       continue;
-    const content = readFileSync9(tpl, "utf8").replace(/<PROJECT>/g, path25.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
-    planned.push({ path: path25.join(root, file), content });
+    const content = readFileSync9(tpl, "utf8").replace(/<PROJECT>/g, path26.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    planned.push({ path: path26.join(root, file), content });
   }
   return planned;
 };
@@ -63443,9 +63707,9 @@ var init_hygiene = __esm(() => {
 // packages/workit-cli/src/admin/setup-state.ts
 import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 var classifySetupFile = (dir, name) => {
-  const file = path26.join(dir, name);
+  const file = path27.join(dir, name);
   let raw;
   try {
     raw = readFileSync10(file, "utf8");
@@ -63483,7 +63747,7 @@ var init_setup_state = __esm(() => {
 });
 // packages/workit-cli/src/admin/registration.ts
-import path27 from "node:path";
+import path28 from "node:path";
 function isWorkitPlugin(value) {
   const s = String(value).replaceAll("\\", "/");
   const url = s.startsWith("file://") || s.startsWith("git+file://");
@@ -63516,11 +63780,11 @@ function mergeCursorEnabledPlugins(enabled) {
 }
 function mergeCursorPluginDirs(pluginDirs, pluginDir) {
   const strip = (p) => {
-    const j = path27.join(p);
-    return path27.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
+    const j = path28.join(p);
+    return path28.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
   };
   const normalized = strip(pluginDir);
-  const legacy = strip(path27.join(path27.dirname(pluginDir), "workflow-toolkit"));
+  const legacy = strip(path28.join(path28.dirname(pluginDir), "workflow-toolkit"));
   const prev = Array.isArray(pluginDirs) ? pluginDirs.map(String) : [];
   const kept = prev.filter((d) => strip(d) !== legacy);
   const exists = kept.some((d) => strip(d) === normalized);
@@ -63608,7 +63872,7 @@ function cursorMcpServerEntry(_packageDir) {
 function cursorHooksEntry(pluginDir) {
   return { command: `${cursorHookLauncher(pluginDir)} workit-cursor-session-start`, args: [] };
 }
-var OPENCODE_NPM_PIN = "@brainervirus/workit-opencode", isRecord4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest", cursorHookLauncher = (pluginDir) => pluginDir ? `node "${shellQuotedPath(path27.join(pluginDir, "hooks", "launch.mjs"))}"` : 'node "${CURSOR_PLUGIN_ROOT}/hooks/launch.mjs"', shellQuotedPath = (file) => path27.sep === "\\" ? file : file.replace(/([$`"\\])/g, "\\$1"), CURSOR_HOOK_RUN_COMMAND, CURSOR_PRETOOLUSE_MATCHER = "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch", CURSOR_HOOK_EVENTS, canonicalHookEntry = (event, pluginDir) => {
+var OPENCODE_NPM_PIN = "@brainervirus/workit-opencode", isRecord4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest", cursorHookLauncher = (pluginDir) => pluginDir ? `node "${shellQuotedPath(path28.join(pluginDir, "hooks", "launch.mjs"))}"` : 'node "${CURSOR_PLUGIN_ROOT}/hooks/launch.mjs"', shellQuotedPath = (file) => path28.sep === "\\" ? file : file.replace(/([$`"\\])/g, "\\$1"), CURSOR_HOOK_RUN_COMMAND, CURSOR_PRETOOLUSE_MATCHER = "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch", CURSOR_HOOK_EVENTS, canonicalHookEntry = (event, pluginDir) => {
   const command = `${cursorHookLauncher(pluginDir)} workit-cursor-hook`;
   if (event === "preToolUse")
     return { command, matcher: CURSOR_PRETOOLUSE_MATCHER, failClosed: false };
@@ -63641,219 +63905,6 @@ var init_support_matrix = __esm(() => {
   };
 });
-// packages/workit-core/src/core/logger.ts
-import { appendFileSync, mkdirSync as mkdirSync4, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
-import os6 from "node:os";
-import path28 from "node:path";
-var REDACTED = "[REDACTED]", DEFAULT_MAX_RATE = 20, DEFAULT_RATE_WINDOW_MS = 1000, DEFAULT_MAX_FIELD_LENGTH = 200, DEFAULT_MAX_STACK_LINES = 30, DAY_FILE, RETAINED_DAYS = 7, SECRET_VALUE, KEY_EQ_VALUE, URL_QUERY, splitKey = (key) => key.split(/[_-]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).map((word) => word.toLowerCase()), SENSITIVE_WORDS, STACK_WORDS, escapeRegExp3 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
-  const override = process.env.WORKFLOW_TOOLKIT_STATE;
-  if (override)
-    return override;
-  const home = os6.homedir();
-  if (process.env.XDG_STATE_HOME)
-    return path28.join(process.env.XDG_STATE_HOME, "workit");
-  switch (os6.platform()) {
-    case "darwin":
-      return path28.join(home, "Library", "Application Support", "workit");
-    case "win32":
-      return path28.join(process.env.LOCALAPPDATA ?? path28.join(home, "AppData", "Local"), "workit");
-    default:
-      return path28.join(process.env.HOME ?? home, ".local", "state", "workit");
-  }
-}, homePattern, applyPatterns = (value) => {
-  let out = value;
-  out = out.replace(SECRET_VALUE, REDACTED);
-  out = out.replace(KEY_EQ_VALUE, "$1$2[REDACTED]");
-  out = out.replace(URL_QUERY, "$1?[REDACTED]");
-  out = out.replace(homePattern, "~");
-  if (process.platform === "win32")
-    out = out.replace(/\\/g, "/");
-  return out;
-}, redactString = (value, options) => {
-  const out = applyPatterns(value);
-  if (out.length > options.maxFieldLength) {
-    return `${out.slice(0, options.maxFieldLength)}…`;
-  }
-  return out;
-}, boundStack = (value, options) => {
-  if (typeof value !== "string")
-    return redact(value, options);
-  const lines = value.split(`
-`);
-  const kept = lines.slice(0, options.maxStackLines).map(applyPatterns);
-  const dropped = lines.length - kept.length;
-  const body = dropped > 0 ? [...kept, `    ... ${dropped} more`] : kept;
-  return body.join(`
-`);
-}, redact = (value, options = DEFAULT_OPTIONS) => {
-  if (value === null || value === undefined)
-    return null;
-  if (typeof value === "boolean" || typeof value === "number")
-    return value;
-  if (typeof value === "string")
-    return redactString(value, options);
-  if (value instanceof Date)
-    return value.toISOString();
-  if (Array.isArray(value))
-    return value.map((entry) => redact(entry, options));
-  if (typeof value === "object") {
-    const out = {};
-    for (const [key, entry] of Object.entries(value)) {
-      const words = splitKey(key);
-      if (words.some((word) => STACK_WORDS.has(word)))
-        out[key] = boundStack(entry, options);
-      else if (words.some((word) => SENSITIVE_WORDS.has(word)))
-        out[key] = REDACTED;
-      else
-        out[key] = redact(entry, options);
-    }
-    return out;
-  }
-  return null;
-}, DEFAULT_OPTIONS, dailyFileName = (date) => {
-  const y = date.getFullYear();
-  const m = String(date.getMonth() + 1).padStart(2, "0");
-  const d = String(date.getDate()).padStart(2, "0");
-  return `workit-${y}-${m}-${d}.jsonl`;
-}, pruneOldFiles = (dir) => {
-  try {
-    const files = readdirSync4(dir).filter((name) => DAY_FILE.test(name)).toSorted().toReversed();
-    for (const file of files.slice(RETAINED_DAYS)) {
-      try {
-        unlinkSync2(path28.join(dir, file));
-      } catch {}
-    }
-  } catch {}
-}, createLogger = (options = {}) => {
-  const stateDir = options.stateDir ?? resolveStateDir();
-  const logDir = path28.join(stateDir, "logs");
-  const now = options.now ?? (() => new Date);
-  const maxRate = options.maxRate ?? DEFAULT_MAX_RATE;
-  const rateWindowMs = options.rateWindowMs ?? DEFAULT_RATE_WINDOW_MS;
-  const redactOptions = {
-    maxFieldLength: options.maxFieldLength ?? DEFAULT_MAX_FIELD_LENGTH,
-    maxStackLines: options.maxStackLines ?? DEFAULT_MAX_STACK_LINES
-  };
-  let windowStart = 0;
-  const windowCounts = { debug: 0, info: 0, warn: 0, error: 0 };
-  const emit = (level, message, context) => {
-    const date = now();
-    const elapsed = date.getTime() - windowStart;
-    if (elapsed >= rateWindowMs || windowStart === 0) {
-      windowStart = date.getTime();
-      windowCounts.debug = 0;
-      windowCounts.info = 0;
-      windowCounts.warn = 0;
-      windowCounts.error = 0;
-    }
-    windowCounts[level] += 1;
-    if (windowCounts[level] > maxRate)
-      return;
-    let event = null;
-    try {
-      event = {
-        level,
-        time: date.toISOString(),
-        message: redactString(message, redactOptions),
-        context: redact(context ?? {}, redactOptions)
-      };
-      const line = `${JSON.stringify(event)}
-`;
-      mkdirSync4(logDir, { recursive: true, mode: 448 });
-      appendFileSync(path28.join(logDir, dailyFileName(date)), line, { mode: 384 });
-      pruneOldFiles(logDir);
-    } catch {
-      try {
-        event = {
-          level,
-          time: date.toISOString(),
-          message: redactString(message, redactOptions),
-          context: { redaction_failed: true }
-        };
-        mkdirSync4(logDir, { recursive: true, mode: 448 });
-        appendFileSync(path28.join(logDir, dailyFileName(date)), `${JSON.stringify(event)}
-`, {
-          mode: 384
-        });
-      } catch {}
-    }
-    for (const sink of [options.appLog, options.stderr]) {
-      if (!sink)
-        continue;
-      if (!event)
-        continue;
-      try {
-        sink(event);
-      } catch {}
-    }
-  };
-  return {
-    debug: (message, context) => emit("debug", message, context),
-    info: (message, context) => emit("info", message, context),
-    warn: (message, context) => emit("warn", message, context),
-    error: (message, context) => emit("error", message, context),
-    guard: (name, fn) => {
-      try {
-        return fn();
-      } catch (err) {
-        emit("warn", "detector_failed", {
-          detector: name,
-          error: err instanceof Error ? err.message : String(err)
-        });
-        return;
-      }
-    }
-  };
-};
-var init_logger = __esm(() => {
-  DAY_FILE = /^workit-\d{4}-\d{2}-\d{2}\.jsonl$/;
-  SECRET_VALUE = /\b(?:Bearer|Basic|Digest|Token)\s+\S+/gi;
-  KEY_EQ_VALUE = /\b([A-Za-z0-9_-]*(?:token|secret|password|passwd|apikey|api[_-]?key|authorization|credential|bearer)[A-Za-z0-9_-]*)([:=]\s*).+/gi;
-  URL_QUERY = /(https?:\/\/[^?#\s]+)\?[^#\s]*/g;
-  SENSITIVE_WORDS = new Set([
-    "token",
-    "secret",
-    "password",
-    "passwd",
-    "authorization",
-    "credential",
-    "credentials",
-    "cookie",
-    "api",
-    "apikey",
-    "apitoken",
-    "accesstoken",
-    "clientsecret",
-    "refreshtoken",
-    "key",
-    "bearer",
-    "prompt",
-    "message",
-    "messages",
-    "content",
-    "body",
-    "args",
-    "argument",
-    "result",
-    "results",
-    "output",
-    "issue",
-    "description",
-    "summary",
-    "payload",
-    "script",
-    "command",
-    "text",
-    "query"
-  ]);
-  STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
-  homePattern = new RegExp(`${escapeRegExp3(os6.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
-  DEFAULT_OPTIONS = {
-    maxFieldLength: DEFAULT_MAX_FIELD_LENGTH,
-    maxStackLines: DEFAULT_MAX_STACK_LINES
-  };
-});
 // packages/workit-cli/src/admin/host-install.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
 import {
@@ -64447,6 +64498,26 @@ function installSessionHook(cwd, env = process.env) {
     detail: `${verb} the Workit ${SESSION_HOOK_NAME} hook at ${status.hookPath}${helper}`
   };
 }
+function removeSessionHook(cwd, env = process.env) {
+  const status = inspectSessionHook(cwd, env);
+  if (status.state === "not_git")
+    return { action: "skipped", removed: [], status, detail: "not inside a git work tree" };
+  const removed = [];
+  if (workitHookIn(status)) {
+    rmSync2(status.hookPath, { force: true });
+    removed.push(status.hookPath);
+  }
+  if (helperIn(status)) {
+    rmSync2(status.helperPath, { force: true });
+    removed.push(status.helperPath);
+  }
+  return {
+    action: removed.length ? "removed" : "unchanged",
+    removed,
+    status: inspectSessionHook(cwd, env),
+    detail: removed.length ? `removed ${removed.join(" and ")}` : "no Workit session hook or helper to remove"
+  };
+}
 var SESSION_HOOK_NAME = "prepare-commit-msg", SESSION_HOOK_MARKER = "# workit-session-trailer-hook", HELPER, LEGACY_CHAINED = "commit-msg.workit-chained", SESSION_TRAILER_SCRIPT = `#!/bin/sh
 # Workit (https://github.com/BrainerVirus/workit) wrote this file with
 # \`workit doctor --fix\`. A prepare-commit-msg hook runs it with its own
@@ -64474,6 +64545,19 @@ fi
 [ -n "$session" ] || exit 0
 [ \${#session} -le 128 ] || exit 0
 case "$session" in *[!A-Za-z0-9_.:@/+-]*) exit 0 ;; esac
+# A workspace with \`trailers: false\` keeps authorship in the ledger only.
+# \`workit git commit\` decides it already (WORKIT_TRAILERS); otherwise ask
+# workit, bounded, and add the trailer when it cannot answer.
+case "\${WORKIT_TRAILERS-}" in
+  off) exit 0 ;;
+  on) ;;
+  *)
+    if command -v workit >/dev/null 2>&1; then
+      t=; ! command -v timeout >/dev/null 2>&1 || t="timeout 5"
+      [ "$($t workit git trailers 2>/dev/null)" != off ] || exit 0
+    fi
+    ;;
+esac
 add_trailer() {
   [ -f "$1" ] && [ -r "$1" ] || return 0
   body=$(sed '/^# -\\{24\\} >8 -\\{24\\}$/,$d' "$1" | git stripspace --strip-comments)
@@ -64617,7 +64701,7 @@ exit 0
   } finally {
     rmSync2(staged, { force: true });
   }
-};
+}, workitHookIn = (status) => status.hookPath !== null && (readText2(status.hookPath)?.includes(SESSION_HOOK_MARKER) ?? false), helperIn = (status) => status.helperPath !== null && exists(status.helperPath);
 var init_session_hook = __esm(() => {
   init_rev();
   HELPER = ["workit", "session-trailer.sh"];
@@ -66052,12 +66136,34 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       };
   }
 }, checkSessionHook = (res) => {
-  if (!matchedWorkspace(res))
+  const workspace = matchedWorkspace(res);
+  if (!workspace)
     return {
       id: "session_hook",
       status: "pass",
       detail: `not in a Workit workspace — skipping the ${SESSION_HOOK_NAME} session hook`
     };
+  const trailers = workspaceTrailers(res.cwd, res.configDir);
+  if (!trailers.enabled) {
+    const setting = `workspace ${trailers.from ?? workspace.name} sets trailers: false`;
+    const left = inspectSessionHook(res.cwd, res.env);
+    const files = [
+      ...workitHookIn(left) ? [left.hookPath] : [],
+      ...helperIn(left) ? [left.helperPath] : []
+    ];
+    if (files.length)
+      return {
+        id: "session_hook",
+        status: "warn",
+        detail: `${setting}, but Workit's ${files.join(" and ")} ${files.length > 1 ? "are" : "is"} still installed: plain git commits still get a Workit-Session trailer whenever the helper cannot ask workit (it fails open)`,
+        fix: SESSION_HOOK_FIX
+      };
+    return {
+      id: "session_hook",
+      status: "pass",
+      detail: `${setting} (authorship in the ledger only) — no ${SESSION_HOOK_NAME} session hook needed`
+    };
+  }
   const hook = inspectSessionHook(res.cwd, res.env);
   const finding = sessionHookFinding(hook);
   if (!hook.leftover)
@@ -66077,6 +66183,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `${res.cwd} is not in a Workit workspace; no hook installed`,
       workspace: null
     };
+  if (!workspaceTrailers(res.cwd, res.configDir).enabled) {
+    const removal = removeSessionHook(res.cwd, res.env);
+    return {
+      ...removal,
+      detail: `trailers: false; no hook installed (${removal.detail})`,
+      workspace: workspace.name
+    };
+  }
   return { ...installSessionHook(res.cwd, res.env), workspace: workspace.name };
 }, isPlaceholder = (p) => {
   try {
@@ -66359,7 +66473,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: repair,
     registryProbed
   };
-}, HOOK_ISSUED_MARKER = "workit-issued-sessions/1", hookRecordsIssued = (root) => {
+}, HOOK_ISSUED_MARKER = "workit-issued-sessions/2", hookRecordsIssued = (root) => {
   let files;
   try {
     files = readdirSync7(path32.join(root, "dist")).filter((f) => f.endsWith(".js"));
@@ -72515,7 +72629,10 @@ function runCheckCommand(argv, options) {
   const buffer = new TailBuffer(MAX_LOG_BYTES);
   const redactor = new StreamRedactor((text) => buffer.push(text));
   const env = options.env ?? process.env;
-  const plan = planSpawn(argv, { platform, env, cwd: options.cwd, shell: options.shell });
+  const wrapped = Boolean(options.wrapper?.length) && platform !== "win32";
+  const command = wrapped ? [...options.wrapper, ...options.shell ? ["/bin/sh", "-c", argv[0]] : argv] : argv;
+  const shell = wrapped ? false : options.shell;
+  const plan = planSpawn(command, { platform, env, cwd: options.cwd, shell });
   return new Promise((resolve) => {
     let settled = false;
     let timedOut = false;
@@ -72578,6 +72695,8 @@ function runCheckCommand(argv, options) {
       finish(null, null, error.code ?? error.message);
       return;
     }
+    if (child.pid)
+      options.onSpawn?.(child.pid);
     if (!windows)
       for (const name of FORWARDED_SIGNALS) {
         const handler = () => {
@@ -72915,18 +73034,503 @@ var init_grant = __esm(() => {
   };
 });
+// packages/workit-core/src/core/resources.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
+import fs20 from "node:fs";
+import os14 from "node:os";
+import path40 from "node:path";
+function memoryValue(value, host) {
+  const text = typeof value === "number" ? String(value) : typeof value === "string" ? value : "";
+  const percent = PERCENT.exec(text.trim());
+  if (percent) {
+    const share = Number(percent[1]);
+    if (share <= 0 || share > 100)
+      return new Error(`memoryMax ${text} must be 1-100%`);
+    return Math.floor(host.totalMemBytes * share / 100);
+  }
+  const size = SIZE.exec(text.trim());
+  if (size && Number(size[1]) > 0)
+    return Math.floor(Number(size[1]) * UNITS[size[2].toUpperCase()]);
+  return new Error(`memoryMax must be a percent of RAM ("40%") or a size ("8G"), got ${text}`);
+}
+function cpuValue(value, host) {
+  if (typeof value === "number" && value > 0)
+    return Math.round(value * 100);
+  const percent = typeof value === "string" ? PERCENT.exec(value.trim()) : null;
+  if (percent) {
+    const share = Number(percent[1]);
+    if (share <= 0 || share > 100)
+      return new Error(`cpuQuota ${percent[0]} must be 1-100%`);
+    return Math.max(1, Math.round(host.cpus * share));
+  }
+  return new Error(`cpuQuota must be a percent of the machine ("70%") or a CPU count, got ${String(value)}`);
+}
+function resolveResourceSettings(sources, host = hostShape()) {
+  let memory = Math.floor(host.totalMemBytes * DEFAULT_MEMORY_SHARE);
+  let cpu = Math.max(1, Math.round(host.cpus * DEFAULT_CPU_SHARE * 100));
+  const settings = {
+    slots: DEFAULT_SLOTS,
+    heavy: [...DEFAULT_HEAVY_CHECKS],
+    memoryMax: "",
+    cpuQuota: "",
+    waitMs: DEFAULT_WAIT_S * 1000,
+    scope: true
+  };
+  const warnings = [];
+  const ordered = [
+    ...sources.filter((source) => source.trust === "machine"),
+    ...sources.filter((source) => source.trust === "repo")
+  ];
+  for (const { label, trust, value } of ordered) {
+    if (value === undefined || value === null)
+      continue;
+    if (!isRecord7(value)) {
+      warnings.push(`${label}: resources must be an object`);
+      continue;
+    }
+    const repo = trust === "repo";
+    const warn = (field, message) => warnings.push(`${label}: ${field}: ${message}`);
+    const machineOnly = (field) => warn(field, "is machine-wide; set it in your workspaces.json, not in the repo");
+    if (value.slots !== undefined) {
+      const slots = value.slots;
+      if (repo)
+        machineOnly("slots");
+      else if (typeof slots === "number" && Number.isInteger(slots) && slots >= 1 && slots <= MAX_SLOTS)
+        settings.slots = slots;
+      else
+        warn("slots", `must be an integer 1-${MAX_SLOTS}`);
+    }
+    if (value.scope !== undefined) {
+      if (repo)
+        machineOnly("scope");
+      else if (typeof value.scope === "boolean")
+        settings.scope = value.scope;
+      else
+        warn("scope", "must be true or false");
+    }
+    if (value.heavy !== undefined) {
+      const heavy = isRecord7(value.heavy) ? Object.keys(value.heavy) : value.heavy;
+      if (!Array.isArray(heavy) || !heavy.every((item) => typeof item === "string"))
+        warn("heavy", "must be a list of check names");
+      else
+        settings.heavy = repo ? [...new Set([...settings.heavy, ...heavy])] : heavy;
+    }
+    if (value.memoryMax !== undefined) {
+      const next = memoryValue(value.memoryMax, host);
+      if (next instanceof Error)
+        warn("memoryMax", next.message);
+      else if (repo && next > memory)
+        warn("memoryMax", "a repo can only lower it");
+      else
+        memory = next;
+    }
+    if (value.cpuQuota !== undefined) {
+      const next = cpuValue(value.cpuQuota, host);
+      if (next instanceof Error)
+        warn("cpuQuota", next.message);
+      else if (repo && next > cpu)
+        warn("cpuQuota", "a repo can only lower it");
+      else
+        cpu = next;
+    }
+    if (value.wait !== undefined) {
+      if (typeof value.wait === "number" && value.wait >= 0)
+        settings.waitMs = value.wait * 1000;
+      else
+        warn("wait", "must be a number of seconds");
+    }
+  }
+  settings.memoryMax = String(memory);
+  settings.cpuQuota = `${cpu}%`;
+  return { settings, warnings };
+}
+function stateDir(env, platform = process.platform) {
+  if (env.WORKFLOW_TOOLKIT_STATE)
+    return env.WORKFLOW_TOOLKIT_STATE;
+  if (env.XDG_STATE_HOME)
+    return path40.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os14.homedir();
+  if (platform === "darwin")
+    return path40.join(home, "Library", "Application Support", "workit");
+  if (platform === "win32")
+    return path40.join(env.LOCALAPPDATA ?? path40.join(home, "AppData", "Local"), "workit");
+  return path40.join(home, ".local", "state", "workit");
+}
+function scopeBusy(unit) {
+  if (process.platform !== "linux" || !SCOPE_UNIT.test(unit))
+    return false;
+  const uid = process.getuid?.() ?? 0;
+  const manager = `/sys/fs/cgroup/user.slice/user-${uid}.slice/user@${uid}.service`;
+  return [`${manager}/app.slice/${unit}`, `${manager}/${unit}`].some((dir) => (readText3(`${dir}/cgroup.procs`) ?? "").trim() !== "");
+}
+function isAncestor(pid) {
+  if (process.platform !== "linux")
+    return true;
+  let current = process.pid;
+  for (let step = 0;step < 128 && current > 1; step += 1) {
+    if (current === pid)
+      return true;
+    const ppid = Number(statFields(current)?.[1]);
+    if (!Number.isInteger(ppid) || ppid <= 0)
+      return false;
+    current = ppid;
+  }
+  return current === pid;
+}
+function staleReason(lease, probe = {}) {
+  const boot = probe.boot === undefined ? bootId() : probe.boot;
+  if (lease.bootId && boot) {
+    if (lease.bootId !== boot)
+      return "taken before a reboot";
+  } else if (typeof lease.bootTime === "number") {
+    const now = probe.bootTime === undefined ? bootTime() : probe.bootTime;
+    if (now !== null && Math.abs(now - lease.bootTime) > BOOT_SLACK_MS)
+      return "taken before a reboot";
+  }
+  const start = lease.processStart ? (probe.start ?? processStart)(lease.pid) : null;
+  const age = (probe.now ?? Date.now()) - Date.parse(lease.startedAt);
+  if (!start && typeof lease.maxAgeMs === "number" && age > lease.maxAgeMs)
+    return `older than its ${Math.round(lease.maxAgeMs / 1000)} s bound`;
+  const holder = !(probe.alive ?? pidAlive2)(lease.pid) ? `holder pid ${lease.pid} is gone` : start && start !== lease.processStart ? `pid ${lease.pid} now belongs to another process` : null;
+  if (!holder)
+    return null;
+  if (typeof lease.pgid === "number" && lease.pgid > 0 && (probe.group ?? groupAlive)(lease.pgid))
+    return null;
+  if (lease.scope && (probe.scope ?? scopeBusy)(lease.scope))
+    return null;
+  return holder;
+}
+function reclaim(file, stale) {
+  const guard = `${file}.reclaim`;
+  try {
+    fs20.mkdirSync(guard);
+  } catch {
+    try {
+      if (Date.now() - fs20.statSync(guard).mtimeMs > GUARD_TTL_MS)
+        fs20.rmSync(guard, { force: true, recursive: true });
+    } catch {}
+    return false;
+  }
+  try {
+    let ageMs = 0;
+    try {
+      ageMs = Date.now() - fs20.statSync(file).mtimeMs;
+    } catch {
+      return true;
+    }
+    if (!stale(parseLease(readText3(file)), ageMs))
+      return false;
+    fs20.rmSync(file, { force: true });
+    return true;
+  } finally {
+    fs20.rmSync(guard, { force: true, recursive: true });
+  }
+}
+function tryOnce(options, record, reclaimed) {
+  const holders = [];
+  const text = `${JSON.stringify(record)}
+`;
+  for (let slot = 0;slot < options.slots; slot += 1) {
+    const file = path40.join(options.dir, `slot-${slot}.json`);
+    for (let attempt = 0;attempt < 2; attempt += 1) {
+      try {
+        const fd = fs20.openSync(file, "wx", 384);
+        try {
+          fs20.writeSync(fd, text);
+        } finally {
+          fs20.closeSync(fd);
+        }
+        return { slot, file };
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+      const lease = parseLease(readText3(file));
+      let reason = null;
+      const removed = reclaim(file, (current, ageMs) => {
+        reason = current ? staleReason(current, options.probe) : ageMs > UNREADABLE_TTL_MS ? "unreadable" : null;
+        return reason !== null;
+      });
+      if (removed) {
+        if (lease && reason)
+          reclaimed.push({ ...holderOf(lease), reason });
+        continue;
+      }
+      if (lease)
+        holders.push(holderOf(lease));
+      break;
+    }
+  }
+  return { holders };
+}
+function removeOwn(file, id) {
+  if (parseLease(readText3(file))?.id === id)
+    fs20.rmSync(file, { force: true });
+}
+async function acquireLease(options) {
+  const pid = options.pid ?? process.pid;
+  const boot = bootId();
+  const record = {
+    id: randomUUID5(),
+    pid,
+    processStart: processStart(pid),
+    bootId: boot,
+    bootTime: boot ? null : bootTime(),
+    pgid: null,
+    maxAgeMs: options.maxAgeMs ?? null,
+    check: options.check,
+    cwd: options.cwd,
+    session: options.session,
+    startedAt: new Date().toISOString(),
+    scope: null
+  };
+  try {
+    fs20.mkdirSync(options.dir, { recursive: true, mode: 448 });
+  } catch (error) {
+    return { ok: false, reason: "unavailable", error: error.message };
+  }
+  const started = Date.now();
+  const reclaimed = [];
+  let waitedOn = [];
+  for (;; ) {
+    let outcome;
+    try {
+      outcome = tryOnce(options, record, reclaimed);
+    } catch (error) {
+      return { ok: false, reason: "unavailable", error: error.message };
+    }
+    if ("slot" in outcome) {
+      const { file, slot } = outcome;
+      let released = false;
+      const release = () => {
+        if (released)
+          return;
+        released = true;
+        process.off("exit", release);
+        removeOwn(file, record.id);
+      };
+      process.on("exit", release);
+      return {
+        ok: true,
+        lease: {
+          record,
+          slot,
+          file,
+          waitedOn,
+          waitedMs: waitedOn.length ? Date.now() - started : 0,
+          reclaimed,
+          release
+        }
+      };
+    }
+    const waited = Date.now() - started;
+    if (!waitedOn.length) {
+      waitedOn = outcome.holders;
+      options.onWait?.(outcome.holders);
+    }
+    if (waited >= options.waitMs)
+      return { ok: false, reason: "timeout", holders: outcome.holders, waitedMs: waited };
+    await sleep(Math.min(options.pollMs ?? 2000, Math.max(1, options.waitMs - waited)));
+  }
+}
+function updateLease(lease, patch) {
+  Object.assign(lease.record, patch);
+  try {
+    if (parseLease(readText3(lease.file))?.id !== lease.record.id)
+      return;
+    const temp = `${lease.file}.${process.pid}.tmp`;
+    fs20.writeFileSync(temp, `${JSON.stringify(lease.record)}
+`, { mode: 384 });
+    fs20.renameSync(temp, lease.file);
+  } catch {}
+}
+function heldLease(dir, id, options = {}) {
+  if (!id || !/^[0-9a-f-]{36}$/u.test(id))
+    return null;
+  let names;
+  try {
+    names = fs20.readdirSync(dir);
+  } catch {
+    return null;
+  }
+  for (const name of names) {
+    if (!/^slot-\d+\.json$/u.test(name))
+      continue;
+    const lease = parseLease(readText3(path40.join(dir, name)));
+    if (lease?.id === id && !staleReason(lease, options.probe) && (options.ancestor ?? isAncestor)(lease.pid))
+      return lease;
+  }
+  return null;
+}
+function describeHolder(holder, now = Date.now()) {
+  const seconds = Math.max(0, Math.round((now - Date.parse(holder.startedAt)) / 1000));
+  const age = seconds >= 60 ? `${Math.floor(seconds / 60)}m ${seconds % 60}s` : `${seconds}s`;
+  return `${holder.check}, pid ${holder.pid}${holder.session ? `, session ${holder.session}` : ""}, ${age}, ${holder.cwd}`;
+}
+function scopeSupport(env, platform = process.platform, read = readText3) {
+  if (platform !== "linux")
+    return { ok: false, reason: `no systemd scopes on ${platform}` };
+  if (!onPath("systemd-run", env))
+    return { ok: false, reason: "systemd-run is not on PATH" };
+  const uid = process.getuid?.() ?? 0;
+  const runtime = env.XDG_RUNTIME_DIR || `/run/user/${uid}`;
+  if (!fs20.existsSync(path40.join(runtime, "systemd", "private")))
+    return { ok: false, reason: "no user systemd manager is running" };
+  const controllers = read(`/sys/fs/cgroup/user.slice/user-${uid}.slice/user@${uid}.service/cgroup.controllers`);
+  if (controllers === null)
+    return { ok: false, reason: "cgroup v2 is not mounted for the user manager" };
+  const missing = ["memory", "cpu"].filter((name) => !controllers.split(/\s+/u).includes(name));
+  if (missing.length)
+    return { ok: false, reason: `the user manager is not delegated ${missing.join(" and ")}` };
+  return { ok: true };
+}
+function scopePrefix(unit, settings) {
+  return [
+    "systemd-run",
+    "--user",
+    "--scope",
+    "--quiet",
+    "--collect",
+    `--unit=${unit}`,
+    "-p",
+    `MemoryMax=${settings.memoryMax}`,
+    "-p",
+    `CPUQuota=${settings.cpuQuota}`,
+    "--"
+  ];
+}
+async function runScoped(run, wrapper, sinks) {
+  if (!wrapper)
+    return { result: await run(null, sinks), fallback: null };
+  let state = "deciding";
+  let firstLine = "";
+  const held = [];
+  const flush = () => {
+    state = "passing";
+    for (const [sink, text] of held.splice(0))
+      sinks[sink](text);
+  };
+  const result = await run(wrapper, {
+    onStdout: (text) => {
+      if (state === "passing")
+        return sinks.onStdout(text);
+      held.push(["onStdout", text]);
+      if (state === "deciding")
+        flush();
+    },
+    onStderr: (text) => {
+      if (state === "passing")
+        return sinks.onStderr(text);
+      held.push(["onStderr", text]);
+      if (state === "held")
+        return;
+      firstLine += text;
+      const newline = firstLine.indexOf(`
+`);
+      if (newline < 0 && firstLine.length < 4096)
+        return;
+      if (SCOPE_START_FAILURE.test(firstLine.slice(0, newline < 0 ? undefined : newline)))
+        state = "held";
+      else
+        flush();
+    }
+  });
+  const lines = tailLines(result.log, 2);
+  if (state !== "passing" && result.exitCode !== 0 && lines.length === 1 && SCOPE_START_FAILURE.test(lines[0]))
+    return { result: await run(null, sinks), fallback: lines[0] };
+  flush();
+  return { result, fallback: null };
+}
+function firstNotice(env, session, key, now = Date.now()) {
+  const id = (session ?? `ppid-${process.ppid}`).replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 120);
+  const dir = path40.join(stateDir(env), "notices");
+  try {
+    fs20.mkdirSync(dir, { recursive: true, mode: 448 });
+    fs20.writeFileSync(path40.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
+`, {
+      flag: "wx",
+      mode: 384
+    });
+  } catch (error) {
+    return error.code !== "EEXIST";
+  }
+  try {
+    for (const name of fs20.readdirSync(dir)) {
+      const file = path40.join(dir, name);
+      if (now - fs20.statSync(file).mtimeMs > NOTICE_TTL_MS)
+        fs20.rmSync(file, { force: true });
+    }
+  } catch {}
+  return true;
+}
+var DEFAULT_HEAVY_CHECKS, DEFAULT_SLOTS = 1, DEFAULT_WAIT_S = 600, DEFAULT_MEMORY_SHARE = 0.4, DEFAULT_CPU_SHARE = 0.7, MAX_SLOTS = 64, UNREADABLE_TTL_MS = 30000, GUARD_TTL_MS = 30000, hostShape = () => ({
+  totalMemBytes: os14.totalmem(),
+  cpus: Math.max(1, os14.availableParallelism?.() ?? os14.cpus().length)
+}), isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path40.join(stateDir(env), "leases"), readText3 = (file) => {
+  try {
+    return fs20.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}, bootId = () => readText3("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os14.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
+  const stat = readText3(`/proc/${pid}/stat`);
+  return stat ? stat.slice(stat.lastIndexOf(")") + 2).split(" ") : null;
+}, processStart = (pid) => statFields(pid)?.[19] ?? null, pidAlive2 = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}, groupAlive = (pgid) => process.platform === "win32" ? pidAlive2(pgid) : pidAlive2(-pgid), SCOPE_UNIT, parseLease = (text) => {
+  if (!text)
+    return null;
+  try {
+    const value = JSON.parse(text);
+    return isRecord7(value) && typeof value.id === "string" && typeof value.pid === "number" ? value : null;
+  } catch {
+    return null;
+  }
+}, holderOf = (lease) => ({
+  pid: lease.pid,
+  check: lease.check,
+  cwd: lease.cwd,
+  session: lease.session,
+  startedAt: lease.startedAt
+}), sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), onPath = (command, env) => (env.PATH ?? "").split(path40.delimiter).filter(Boolean).some((dir) => {
+  try {
+    fs20.accessSync(path40.join(dir, command), fs20.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}), SCOPE_START_FAILURE, NOTICE_TTL_MS;
+var init_resources = __esm(() => {
+  init_checks3();
+  DEFAULT_HEAVY_CHECKS = ["test", "build", "typecheck"];
+  SIZE = /^(\d+(?:\.\d+)?)([KMGT]?)$/iu;
+  PERCENT = /^(\d+(?:\.\d+)?)%$/u;
+  UNITS = { "": 1, K: 1024, M: 1024 ** 2, G: 1024 ** 3, T: 1024 ** 4 };
+  SCOPE_UNIT = /^[\w.@-]+\.scope$/u;
+  SCOPE_START_FAILURE = /^Failed to (?:connect to bus|create bus connection|start transient scope unit|parse \S+?=)/u;
+  NOTICE_TTL_MS = 7 * 86400000;
+});
 // packages/workit-cli/src/verbs/check.ts
 var exports_check = {};
 __export(exports_check, {
   run: () => run10
 });
-import path40 from "node:path";
+import os15 from "node:os";
+import path41 from "node:path";
 function parse5(argv) {
   const split = argv.indexOf("--");
   const head = split >= 0 ? argv.slice(0, split) : [...argv];
   const options = {
     name: null,
     shell: false,
+    heavy: false,
+    noLease: false,
     timeoutMs: 0,
     task: null,
     base: null,
@@ -72946,6 +73550,13 @@ function parse5(argv) {
       options.shell = true;
       continue;
     }
+    if (flag === "--heavy" || flag === "--no-lease") {
+      if (flag === "--heavy")
+        options.heavy = true;
+      else
+        options.noLease = true;
+      continue;
+    }
     if (flag === "--name" || flag === "--task" || flag === "--base" || flag === "--timeout") {
       const got = value();
       if (got instanceof Error)
@@ -73069,6 +73680,90 @@ function boundedArgv(argv) {
   const truncated = cut.length !== argv.length || cut.some((item, index) => item !== argv[index]);
   return { argv: cut, truncated };
 }
+async function workspaceResources(io) {
+  const env = io.env;
+  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path41.join(env.XDG_CONFIG_HOME || path41.join(env.HOME || os15.homedir(), ".config"), "workit");
+  try {
+    await Promise.resolve().then(() => init_workspaces());
+    const workspace = resolveWorkspaceFrom(io.cwd, dir, env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
+    return { value: workspace?.resources, warning: null };
+  } catch (error) {
+    return { value: undefined, warning: `workspaces.json: ${error.message}` };
+  }
+}
+async function prepareHeavy(io, settings, label, runCwd, timeoutMs) {
+  const session = hostSessionFromEnv(io.env).session;
+  const dir = leaseDir(io.env);
+  const outer = heldLease(dir, io.env.WORKIT_LEASE);
+  if (outer)
+    return {
+      lease: null,
+      leaseReport: { slot: null, waitedMs: 0, holder: null, reclaimed: [], inherited: true },
+      scope: { unit: outer.scope, reason: "inherited from the outer heavy check" },
+      wrapper: null,
+      env: io.env
+    };
+  const acquired = await acquireLease({
+    dir,
+    slots: settings.slots,
+    check: label,
+    cwd: runCwd,
+    session,
+    waitMs: settings.waitMs,
+    pollMs: 1000,
+    maxAgeMs: (timeoutMs || MAX_UNVERIFIED_RUN_MS) + 60000,
+    onWait: (holders) => io.stderr(`workit: waiting for the heavy-check lease (${settings.slots} slot${settings.slots === 1 ? "" : "s"}): held by ${holders.map((holder) => describeHolder(holder)).join("; ")}
+`)
+  });
+  if (!acquired.ok && acquired.reason === "timeout") {
+    const holders = acquired.holders.map((holder) => describeHolder(holder)).join("; ");
+    emit(io, fail("busy", `the heavy-check lease stayed busy for ${Math.round(acquired.waitedMs / 1000)} s`, {
+      data: { lease: { waitedMs: acquired.waitedMs, holders: acquired.holders } },
+      unblock: `wait for ${holders || "the holders"} to finish, then run it again`
+    }));
+    return 4;
+  }
+  let lease = null;
+  if (acquired.ok)
+    lease = acquired.lease;
+  else
+    io.stderr(`workit: running without the heavy-check lease: ${acquired.error}
+`);
+  for (const stale of lease?.reclaimed ?? [])
+    io.stderr(`workit: reclaimed a stale heavy-check lease (${stale.reason}): ${describeHolder(stale)}
+`);
+  const leaseReport = lease ? {
+    slot: lease.slot,
+    waitedMs: lease.waitedMs,
+    holder: lease.waitedOn[0] ?? null,
+    reclaimed: lease.reclaimed,
+    inherited: false
+  } : null;
+  const env = lease ? { ...io.env, WORKIT_LEASE: lease.record.id } : io.env;
+  const support = settings.scope ? scopeSupport(io.env) : { ok: false, reason: "resources.scope is false" };
+  if (!support.ok) {
+    if (settings.scope && firstNotice(io.env, session, "no-scope"))
+      io.stderr(`workit: heavy checks run without a memory/CPU limit here: ${support.reason} (said once per session)
+`);
+    return {
+      lease,
+      leaseReport,
+      scope: { unit: null, reason: support.reason },
+      wrapper: null,
+      env
+    };
+  }
+  const unit = `workit-check-${(lease?.record.id ?? "nolease0").slice(0, 8)}-${process.pid}`;
+  if (lease)
+    updateLease(lease, { scope: `${unit}.scope` });
+  return {
+    lease,
+    leaseReport,
+    scope: { unit: `${unit}.scope`, memoryMax: settings.memoryMax, cpuQuota: settings.cpuQuota },
+    wrapper: scopePrefix(unit, settings),
+    env
+  };
+}
 async function run10(argv, io) {
   const options = parse5(argv);
   if (options instanceof Error)
@@ -73103,21 +73798,52 @@ async function run10(argv, io) {
     if (options.shell && command.length !== 1)
       return emit(io, fail("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
-  const relCwd = posix(path40.relative(top, runCwd));
+  const relCwd = posix(path41.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
   const actor = actorFromEnv(io.env);
   const branchKey = codeKey(io.cwd, { base: options.base });
   const detached = branchKey.tree === null ? worktreeTree(io.cwd) : null;
   const key = detached ? { ...branchKey, tree: detached.key, dirty: detached.dirty } : branchKey;
   const signal = key.tree === null ? null : worktreeSignal(io.cwd);
-  const result = await runCheckCommand(command, {
-    cwd: runCwd,
-    shell: options.shell,
-    timeoutMs: options.timeoutMs,
-    env: io.env,
-    onStdout: io.json ? io.stderr : io.stdout,
-    onStderr: io.stderr
-  });
+  let heavy = null;
+  if (!options.noLease && (options.heavy || options.command === null)) {
+    const workspace = await workspaceResources(io);
+    const { settings, warnings } = resolveResourceSettings([
+      { label: "workspaces.json", trust: "machine", value: workspace.value },
+      { label: CHECKS_FILE, trust: "repo", value: config.resources }
+    ]);
+    for (const warning of [workspace.warning, ...warnings])
+      if (warning)
+        io.stderr(`workit: resources: ${warning}
+`);
+    if (options.heavy || name !== null && settings.heavy.includes(name)) {
+      const prepared = await prepareHeavy(io, settings, name ?? command.join(" "), runCwd, options.timeoutMs);
+      if (typeof prepared === "number")
+        return prepared;
+      heavy = prepared;
+    }
+  }
+  const lease = heavy?.lease ?? null;
+  let result;
+  try {
+    const scoped = await runScoped((wrapper, sinks) => runCheckCommand(command, {
+      cwd: runCwd,
+      shell: options.shell,
+      timeoutMs: options.timeoutMs,
+      env: heavy?.env ?? io.env,
+      ...sinks,
+      ...wrapper ? { wrapper } : {},
+      ...lease ? { onSpawn: (pid) => updateLease(lease, { pgid: pid }) } : {}
+    }), heavy?.wrapper ?? null, { onStdout: io.json ? io.stderr : io.stdout, onStderr: io.stderr });
+    result = scoped.result;
+    if (heavy && scoped.fallback) {
+      io.stderr(`workit: the memory/CPU scope could not start (${scoped.fallback}); ran without it
+`);
+      heavy.scope = { unit: null, reason: `systemd-run failed: ${scoped.fallback}` };
+    }
+  } finally {
+    lease?.release();
+  }
   const treeAfter = key.tree === null ? null : worktreeTree(io.cwd)?.key ?? null;
   const modifiedWorktree = key.tree !== null && treeAfter !== key.tree;
   const store = storeRoot(io.cwd);
@@ -73198,6 +73924,8 @@ async function run10(argv, io) {
     outputBytes: result.outputBytes,
     logTruncated: result.truncated,
     task: task.task,
+    lease: heavy?.leaseReport ?? null,
+    scope: heavy?.scope ?? null,
     ...task.note ? { taskNote: task.note } : {},
     satisfies: task.satisfies,
     stillUnsatisfied: task.stillUnsatisfied,
@@ -73227,7 +73955,7 @@ async function run10(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE3 = "workit check <name> | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--json] -- <cmd…>", RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path40.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS;
+var USAGE3 = "workit check <name> [--no-lease] | workit check [--name <n>] [--shell] [--heavy] [--timeout <s>] [--task <id>] [--json] -- <cmd…>", MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path41.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -73236,6 +73964,8 @@ var init_check = __esm(() => {
   init_ledger();
   init_output();
   init_host_session();
+  init_resources();
+  MAX_UNVERIFIED_RUN_MS = 6 * 3600000;
   ENGINE_CODES2 = {
     busy: "busy",
     not_found: "not_found",
@@ -73251,7 +73981,7 @@ var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock)
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync18 } from "node:child_process";
 import { existsSync as existsSync19, readFileSync as readFileSync19 } from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
     ["rebase-merge", "rebase"],
@@ -73264,18 +73994,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path41.resolve(cwd, line.trim()));
+`).map((line) => path42.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
     if (!marker || !existsSync19(marker))
       continue;
-    if (index === 1 && existsSync19(path41.join(marker, "applying")))
+    if (index === 1 && existsSync19(path42.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync19(path41.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync19(path42.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync19(path41.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync19(path42.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -73425,6 +74155,40 @@ function lintCommitMessage(cwd, message) {
     correction: `use a ${detected} commit subject`
   };
 }
+function stripSessionTrailers(text, options) {
+  const end = text.length - (/\s*$/u.exec(text)?.[0].length ?? 0);
+  const lines = text.slice(0, end).split(`
+`);
+  let start = lines.length;
+  while (start > 0 && lines[start - 1]?.trim() !== "")
+    start -= 1;
+  if (start === 0 && options.subject)
+    return text;
+  const block = lines.slice(start);
+  if (!block.length || !TRAILER_LINE.test(block[0] ?? ""))
+    return text;
+  if (!block.every((line) => TRAILER_LINE.test(line) || /^\s+\S/u.test(line)))
+    return text;
+  const kept = [];
+  let dropping = false;
+  for (const line of block) {
+    if (TRAILER_LINE.test(line))
+      dropping = SESSION_KEY.test(line);
+    if (!dropping)
+      kept.push(line);
+  }
+  if (kept.length === block.length)
+    return text;
+  let head = lines.slice(0, start);
+  if (!kept.length) {
+    let cut = head.length;
+    while (cut > 0 && head[cut - 1]?.trim() === "")
+      cut -= 1;
+    head = head.slice(0, cut);
+  }
+  return [...head, ...kept].join(`
+`) + text.slice(end);
+}
 function messageTrailers(cwd, message) {
   const run = git5(cwd, [...TRAILER_CONFIG, "interpret-trailers", "--parse", "--no-divider"], {
     input: `${message}
@@ -73484,6 +74248,12 @@ function gitCommit(cwd, input) {
   const given = input.message?.trim() ?? "";
   if (!given && !input.amend)
     return failure3("invalid_input", "a commit message is required (-m <msg> or -F <file>)");
+  const extra = (input.trailers ?? []).map((trailer) => trailer.trim());
+  const malformed = extra.find((trailer) => !EXTRA_TRAILER.test(trailer));
+  if (malformed !== undefined)
+    return failure3("invalid_input", `--trailer ${JSON.stringify(malformed)} is not one "Key: value" line`, `workit git commit -m '<msg>' --trailer "Co-Authored-By: Name <email>"`);
+  if (extra.some((trailer) => /^workit-session:/iu.test(trailer)))
+    return failure3("invalid_input", "--trailer cannot set Workit-Session: workit writes it from the acting session");
   const paths = input.paths ?? [];
   if (input.all && paths.length)
     return failure3("invalid_input", "pass --all or paths, not both");
@@ -73505,6 +74275,7 @@ function gitCommit(cwd, input) {
   }
   let message = given;
   let carried = [];
+  let previousTrailers = [];
   if (given) {
     const lint = lintCommitMessage(cwd, given);
     if (!lint.ok)
@@ -73514,8 +74285,9 @@ function gitCommit(cwd, input) {
     const kept = git5(cwd, ["log", "-1", "--format=%B", previous]);
     if (!kept.ok)
       return failure3("failed", `could not read the message of ${branch}: ${gitError(kept)}`);
+    previousTrailers = messageTrailers(cwd, kept.stdout.trim());
     if (given)
-      carried = messageTrailers(cwd, kept.stdout.trim());
+      carried = previousTrailers;
     else
       message = kept.stdout.trim();
   }
@@ -73529,12 +74301,31 @@ function gitCommit(cwd, input) {
     args.push("--amend");
   if (input.allowEmpty || emptyAmend)
     args.push("--allow-empty");
-  args.push("-m", withTrailers(cwd, message, [...carried, ...session ? [`Workit-Session: ${session}`] : []]));
+  const trailersOn = workspaceTrailers(cwd).enabled;
+  const sessionTrailer = Boolean(session) && trailersOn;
+  if (!trailersOn) {
+    carried = carried.filter((trailer) => !SESSION_KEY.test(trailer));
+    if (!given)
+      message = stripSessionTrailers(message, { subject: true });
+  }
+  const finalMessage = withTrailers(cwd, message, [
+    ...carried,
+    ...extra,
+    ...sessionTrailer ? [`Workit-Session: ${session}`] : []
+  ]);
+  const allowed = new Set([
+    ...trailersOn ? sessionValues(previousTrailers) : [],
+    ...sessionTrailer && session ? [session] : []
+  ]);
+  const forged = sessionValues(messageTrailers(cwd, finalMessage)).find((value) => !allowed.has(value));
+  if (forged !== undefined)
+    return failure3("invalid_input", `forged_session_trailer: the message would carry "Workit-Session: ${forged}", which workit did not add; workit writes that trailer itself`, "drop the Workit-Session line (or the trailer.<alias>.key config that expands into it)");
+  args.push("-m", finalMessage);
   if (paths.length) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync19(path41.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync19(path42.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -73560,7 +74351,7 @@ function gitCommit(cwd, input) {
   }
   const committed = git5(cwd, args, {
     timeoutMs: COMMIT_TIMEOUT_MS,
-    env: input.env
+    env: { ...input.env ?? process.env, WORKIT_TRAILERS: trailersOn ? "on" : "off" }
   });
   if (!committed.ok)
     return failure3("failed", `git commit failed (a hook or git refused it):
@@ -73604,6 +74395,7 @@ ${gitOutput(committed)}`);
     files,
     leftDirty,
     session,
+    sessionTrailer,
     amended: previous,
     notes,
     recorded: row.ok ? { id: String(row.value.id) } : { error: row.error }
@@ -73967,18 +74759,22 @@ ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((va
     ...lines.slice(-half)
   ].join(`
 `);
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, RELEASE_TAG;
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, EXTRA_TRAILER, SESSION_KEY, TRAILER_LINE, sessionValues = (trailers) => trailers.filter((trailer) => SESSION_KEY.test(trailer)).map((trailer) => trailer.slice(trailer.indexOf(":") + 1).trim()), TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX, RELEASE_TAG;
 var init_ops = __esm(() => {
   init_branch();
   init_commit_flavors();
   init_pr_create();
   init_release_tracks();
   init_vcs_config();
+  init_workspaces();
   init_redact();
   init_ledger();
   init_rev();
   COMMIT_TIMEOUT_MS = 10 * 60000;
   SESSION_SAFE = /^[\w.:@/+-]{1,128}$/u;
+  EXTRA_TRAILER = /^[A-Za-z0-9][A-Za-z0-9-]*: *\S[^\n\r]*$/u;
+  SESSION_KEY = /^workit-session\s*:/iu;
+  TRAILER_LINE = /^[A-Za-z0-9][A-Za-z0-9-]*\s*:/u;
   TRAILER_CONFIG = ["-c", "trailer.separators=:", "-c", "trailer.where=end"];
   SHA = /^[0-9a-f]{40,64}$/u;
   SHA_PREFIX = /^[0-9a-f]{7,39}$/u;
@@ -73986,11 +74782,11 @@ var init_ops = __esm(() => {
 });
 // packages/workit-core/src/forge/reruns.ts
-import fs20 from "node:fs";
-import path42 from "node:path";
+import fs21 from "node:fs";
+import path43 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path42.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path43.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -73999,7 +74795,7 @@ function rerunCounts(cwd, key) {
     return counts;
   let text;
   try {
-    text = fs20.readFileSync(file, "utf8");
+    text = fs21.readFileSync(file, "utf8");
   } catch {
     return counts;
   }
@@ -74025,8 +74821,8 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs20.mkdirSync(path42.dirname(file), { recursive: true });
-    fs20.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
+    fs21.mkdirSync(path43.dirname(file), { recursive: true });
+    fs21.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
   } catch {
@@ -74038,18 +74834,18 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs20.mkdirSync(path42.dirname(lock), { recursive: true });
+  fs21.mkdirSync(path43.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
-      fs20.closeSync(fs20.openSync(lock, "wx"));
+      fs21.closeSync(fs21.openSync(lock, "wx"));
       break;
     } catch (error) {
       if (error.code !== "EEXIST")
         throw error;
       try {
-        if (Date.now() - fs20.statSync(lock).mtimeMs > LOCK_STALE_MS2) {
-          fs20.rmSync(lock, { force: true });
+        if (Date.now() - fs21.statSync(lock).mtimeMs > LOCK_STALE_MS2) {
+          fs21.rmSync(lock, { force: true });
           continue;
         }
       } catch {
@@ -74063,7 +74859,7 @@ function withRerunLock(cwd, fn) {
   try {
     return fn();
   } finally {
-    fs20.rmSync(lock, { force: true });
+    fs21.rmSync(lock, { force: true });
   }
 }
 var isRow = (value) => {
@@ -74647,6 +75443,56 @@ function nextHint(next, number) {
       return null;
   }
 }
+function squashMessageFor(cwd, resolved, input, doc) {
+  if (input.method !== "squash")
+    return null;
+  if (input.subject === undefined && input.body === undefined && workspaceTrailers(cwd).enabled)
+    return null;
+  let subject = input.subject?.trim() ?? "";
+  if (!subject) {
+    const meta = resolved.forge.prMeta(doc.number);
+    if (!meta.ok)
+      return meta;
+    subject = resolved.forge.kind === "github" ? `${meta.data.title} (#${doc.number})` : meta.data.title;
+  }
+  const body = input.body === undefined ? squashCommitList(cwd, resolved, doc.base, doc.head.sha) : stripSessionTrailers(input.body, { subject: false });
+  return success2({ subject, body });
+}
+function squashCommitList(cwd, resolved, base, head) {
+  const from = resolveRef(cwd, `refs/remotes/${resolved.baseRemote}/${base}`) ?? resolveRef(cwd, `refs/heads/${base}`);
+  if (!from)
+    return "";
+  const log = spawnSync19("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
+    cwd,
+    encoding: "utf8",
+    timeout: GIT_TIMEOUTS.local,
+    killSignal: "SIGKILL",
+    maxBuffer: 64 * 1024 * 1024
+  });
+  if (log.status !== 0)
+    return "";
+  const entries = log.stdout.split("\x1E").map((message) => stripSessionTrailers(message.replace(/^\n+/u, ""), { subject: true })).filter((message) => message.trim()).map((message) => {
+    const [subject = "", ...rest] = message.trimEnd().split(`
+`);
+    const body = rest.join(`
+`).replace(/^\n+/u, "");
+    return body ? `* ${subject}
+${body}` : `* ${subject}`;
+  });
+  const listed = [];
+  let size = 0;
+  for (const entry of entries) {
+    if (listed.length >= SQUASH_LIST_MAX_COMMITS || size + entry.length > SQUASH_LIST_MAX_CHARS)
+      break;
+    listed.push(entry);
+    size += entry.length + 2;
+  }
+  const more = entries.length - listed.length;
+  return [...listed, ...more ? [`… and ${more} more commit${more === 1 ? "" : "s"}`] : []].join(`
+`);
+}
 async function mergePullRequest(cwd, resolved, input, sleep) {
   const grant = requireGrant(cwd, "merge");
   if (!grant.allowed)
@@ -74723,7 +75569,14 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return refuse(`head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`, `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`, { reason: "head_mismatch", verdict: summary });
   else if (!covered)
     return refuse(`NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`, `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${grant.allowUnverified ? `; or, only if the user asks to merge unverified: workit pr merge --unverified --reason "<why>"` : ""}`, { reason: "needs_verdict", verdict: summary });
-  const merged = resolved.forge.merge(doc.number, { sha: head, method: input.method });
+  const squashMessage = squashMessageFor(cwd, resolved, input, doc);
+  if (squashMessage && !squashMessage.ok)
+    return squashMessage;
+  const merged = resolved.forge.merge(doc.number, {
+    sha: head,
+    method: input.method,
+    ...squashMessage ? { squashMessage: squashMessage.data } : {}
+  });
   if (!merged.ok)
     return merged;
   let state = "open";
@@ -74813,11 +75666,12 @@ var VERIFY_DELAYS_MS, noun = (resolved) => resolved.forge.kind === "github" ? "p
   error,
   unblock,
   refusal
-});
+}), SQUASH_LIST_MAX_COMMITS = 100, SQUASH_LIST_MAX_CHARS = 60000;
 var init_pr_ops = __esm(() => {
   init_autonomy();
   init_branch();
   init_vcs_config();
+  init_workspaces();
   init_release_tracks();
   init_ops();
   init_rev();
@@ -74836,8 +75690,8 @@ var init_pr_ops = __esm(() => {
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
 import { createHash as createHash17, randomBytes as randomBytes3 } from "node:crypto";
-import fs21 from "node:fs";
-import path43 from "node:path";
+import fs22 from "node:fs";
+import path44 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -74860,7 +75714,7 @@ function rebasingBranch2(dir) {
     if (!found.ok)
       continue;
     try {
-      return fs21.readFileSync(found.stdout.trim(), "utf8").trim();
+      return fs22.readFileSync(found.stdout.trim(), "utf8").trim();
     } catch {}
   }
   return null;
@@ -74868,7 +75722,7 @@ function rebasingBranch2(dir) {
 function rebaseInProgress(dir) {
   for (const name of ["rebase-merge", "rebase-apply"]) {
     const found = gitRun3(dir, ["rev-parse", "--path-format=absolute", "--git-path", name]);
-    if (found.ok && fs21.existsSync(found.stdout.trim()))
+    if (found.ok && fs22.existsSync(found.stdout.trim()))
       return true;
   }
   return false;
@@ -74880,8 +75734,8 @@ function gitRestack(cwd, input) {
     const scratch = scratchDir(cwd);
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
-    fs21.mkdirSync(scratch, { recursive: true });
-    dir = path43.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    fs22.mkdirSync(scratch, { recursive: true });
+    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -74919,10 +75773,10 @@ function gitRestack(cwd, input) {
 }
 function pruneScratch(cwd) {
   const scratch = scratchDir(cwd);
-  if (!scratch || !fs21.existsSync(scratch))
+  if (!scratch || !fs22.existsSync(scratch))
     return;
-  for (const name of fs21.readdirSync(scratch)) {
-    const dir = path43.join(scratch, name);
+  for (const name of fs22.readdirSync(scratch)) {
+    const dir = path44.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -74932,10 +75786,10 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path43.join(root.value.root, "stacks") };
+  return { ok: true, data: path44.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
-  if (!isRecord7(raw) || !Array.isArray(raw.branches))
+  if (!isRecord8(raw) || !Array.isArray(raw.branches))
     return null;
   const name = str3(raw.name);
   const trunk = str3(raw.trunk);
@@ -74943,12 +75797,12 @@ function parseStack(raw) {
     return null;
   const branches = [];
   for (const item of raw.branches) {
-    if (!isRecord7(item))
+    if (!isRecord8(item))
       return null;
     const branch = str3(item.branch);
     if (!branch)
       return null;
-    const merged = isRecord7(item.merged) ? {
+    const merged = isRecord8(item.merged) ? {
       pr: typeof item.merged.pr === "number" ? item.merged.pr : null,
       mergeSha: str3(item.merged.mergeSha),
       at: str3(item.merged.at) ?? ""
@@ -74961,7 +75815,7 @@ function parseStack(raw) {
       lastParentHead: str3(item.lastParentHead),
       patchId: str3(item.patchId),
       merged,
-      ...isRecord7(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
+      ...isRecord8(item.pendingRestack) && str3(item.pendingRestack.from) && str3(item.pendingRestack.tip) && str3(item.pendingRestack.onto) ? {
         pendingRestack: {
           from: str3(item.pendingRestack.from),
           tip: str3(item.pendingRestack.tip),
@@ -74984,10 +75838,10 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, fileFor(name));
+  const file = path44.join(dir.data, fileFor(name));
   let text;
   try {
-    text = fs21.readFileSync(file, "utf8");
+    text = fs22.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return { ok: true, data: null };
@@ -75005,17 +75859,17 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path43.join(dir.data, fileFor(stack.name));
+  const file = path44.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
-    fs21.mkdirSync(dir.data, { recursive: true });
+    fs22.mkdirSync(dir.data, { recursive: true });
     stack.updatedAt = now.toISOString();
-    fs21.writeFileSync(temp, `${JSON.stringify(stack, null, 2)}
+    fs22.writeFileSync(temp, `${JSON.stringify(stack, null, 2)}
 `);
-    fs21.renameSync(temp, file);
+    fs22.renameSync(temp, file);
     return { ok: true, data: undefined };
   } catch (error) {
-    fs21.rmSync(temp, { force: true });
+    fs22.rmSync(temp, { force: true });
     return stackFail("unavailable", `cannot write ${file}: ${error.message}`);
   }
 }
@@ -75025,7 +75879,7 @@ function listStacks(cwd) {
     return dir;
   let names = [];
   try {
-    names = fs21.readdirSync(dir.data).filter((name) => name.endsWith(".json"));
+    names = fs22.readdirSync(dir.data).filter((name) => name.endsWith(".json"));
   } catch {
     return { ok: true, data: [] };
   }
@@ -75033,7 +75887,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs21.readFileSync(path43.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs22.readFileSync(path44.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -75080,7 +75934,7 @@ function stackLockStale(raw, age) {
 }
 function takeLock(lock) {
   try {
-    fs21.mkdirSync(lock);
+    fs22.mkdirSync(lock);
   } catch (error) {
     if (error.code === "EEXIST")
       return null;
@@ -75092,24 +75946,24 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes3(8).toString("hex")
   };
-  fs21.writeFileSync(path43.join(lock, OWNER), JSON.stringify(owner));
+  fs22.writeFileSync(path44.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
   const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
   try {
-    fs21.renameSync(lock, tomb);
+    fs22.renameSync(lock, tomb);
   } catch {
     return false;
   }
   if (readOwner(tomb).raw === observed) {
-    fs21.rmSync(tomb, { recursive: true, force: true });
+    fs22.rmSync(tomb, { recursive: true, force: true });
     return true;
   }
   try {
-    fs21.renameSync(tomb, lock);
+    fs22.renameSync(tomb, lock);
   } catch {
-    fs21.rmSync(tomb, { recursive: true, force: true });
+    fs22.rmSync(tomb, { recursive: true, force: true });
   }
   return false;
 }
@@ -75119,8 +75973,8 @@ function releaseLock(lock, owner) {
     return;
   const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
   try {
-    fs21.renameSync(lock, tomb);
-    fs21.rmSync(tomb, { recursive: true, force: true });
+    fs22.renameSync(lock, tomb);
+    fs22.rmSync(tomb, { recursive: true, force: true });
   } catch {}
 }
 async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
@@ -75129,9 +75983,9 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path43.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path44.join(dir.data, `${fileFor(name)}.lock`);
   try {
-    fs21.mkdirSync(dir.data, { recursive: true });
+    fs22.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
     return stackFail("unavailable", `cannot create ${dir.data}: ${error.message}`);
   }
@@ -75159,7 +76013,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs21.utimesSync(path43.join(lock, OWNER), now, now);
+      fs22.utimesSync(path44.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -75192,7 +76046,7 @@ function deriveChain(cwd, trunk, base) {
     const [name, sha] = line.trim().split(" ");
     if (!name || !sha || name === branch || name === trunk)
       continue;
-    if (sha === head || isAncestor(cwd, sha, base) || !isAncestor(cwd, sha, head))
+    if (sha === head || isAncestor2(cwd, sha, base) || !isAncestor2(cwd, sha, head))
       continue;
     const count = gitRun3(cwd, ["rev-list", "--count", `${base}..${sha}`]);
     below.push({ branch: name, depth: Number(count.stdout.trim()) || 0 });
@@ -75238,17 +76092,17 @@ function planStack(cwd, resolved, input, existing) {
         const status = resolved.forge.prStatus(before.pr);
         still = status.ok && status.data.state === "merged";
       } else
-        still = hasOwnCommits(cwd, tip, before.lastParentHead) && isAncestor(cwd, tip, trunkSha);
+        still = hasOwnCommits(cwd, tip, before.lastParentHead) && isAncestor2(cwd, tip, trunkSha);
       if (still) {
         entries.push(before);
         continue;
       }
       notes.push(`${branch} was recorded as merged but is not; it is back in the stack`);
     }
-    const onParent = isAncestor(cwd, parentSha, tip);
+    const onParent = isAncestor2(cwd, parentSha, tip);
     let builtOn = parentSha;
     if (!onParent) {
-      if (before?.lastParentHead && isAncestor(cwd, before.lastParentHead, tip))
+      if (before?.lastParentHead && isAncestor2(cwd, before.lastParentHead, tip))
         builtOn = before.lastParentHead;
       else {
         const old = oldParentVersion(cwd, parent, parentSha, tip) ?? oldParentLookalike(cwd, parentSha, tip);
@@ -75323,7 +76177,7 @@ function planStack(cwd, resolved, input, existing) {
 function hasOwnCommits(cwd, tip, base) {
   if (!base)
     return false;
-  return tip !== base && !isAncestor(cwd, tip, base);
+  return tip !== base && !isAncestor2(cwd, tip, base);
 }
 function oldParentVersion(cwd, parent, parentSha, child) {
   if (!safeRef2(parent))
@@ -75335,7 +76189,7 @@ function oldParentVersion(cwd, parent, parentSha, child) {
 `).map((line) => line.trim())) {
     if (!sha || sha === parentSha)
       continue;
-    if (isAncestor(cwd, sha, child) && !isAncestor(cwd, sha, parentSha))
+    if (isAncestor2(cwd, sha, child) && !isAncestor2(cwd, sha, parentSha))
       return sha;
   }
   return null;
@@ -75469,7 +76323,7 @@ function stackStatus(ctx, stack) {
       pr: entry.pr,
       merged,
       head,
-      onParent: merged || !head || !parentSha ? null : isAncestor(ctx.cwd, parentSha, head),
+      onParent: merged || !head || !parentSha ? null : isAncestor2(ctx.cwd, parentSha, head),
       prState: doc?.state ?? null,
       prBase: doc?.base ?? null,
       baseMatches: doc && !merged ? doc.base === parentName : null,
@@ -75532,7 +76386,7 @@ function detectMerged(ctx, cwd, stack, trunkSha, state) {
       merged = read.data.state === "merged";
     } else {
       const tip = branchTip(cwd, entry.branch);
-      merged = tip !== null && hasOwnCommits(cwd, tip, entry.lastParentHead) && isAncestor(cwd, tip, trunkSha);
+      merged = tip !== null && hasOwnCommits(cwd, tip, entry.lastParentHead) && isAncestor2(cwd, tip, trunkSha);
     }
     if (merged) {
       entry.merged = { pr: entry.pr, mergeSha: null, at: new Date().toISOString() };
@@ -75553,7 +76407,7 @@ function pushBranch(cwd, actor, branch, priorTip) {
   const grant = requireGrant(cwd, "push", { forge: !plan.data.local });
   if (!grant.allowed)
     return stackFail("blocked", grant.error, grant.unblock, { reason: grant.reason });
-  const force = remote.sha !== null && !isAncestor(cwd, remote.sha, plan.data.sha);
+  const force = remote.sha !== null && !isAncestor2(cwd, remote.sha, plan.data.sha);
   const expect = !force ? null : remote.sha === priorTip ? priorTip : recordedRemoteTip(cwd, plan.data) ?? null;
   const pushed = executePush(cwd, plan.data, { forceWithLease: force, expect, actor });
   if (!pushed.ok)
@@ -75630,9 +76484,9 @@ function syncStack(cwd, ctx, stack, options, actor) {
         carried: null
       };
       newTip = null;
-    } else if (!isAncestor(cwd, parentTip, tip)) {
+    } else if (!isAncestor2(cwd, parentTip, tip)) {
       const pending = entry.pendingRestack ?? null;
-      const from = pending && isAncestor(cwd, pending.onto, tip) ? pending.onto : entry.lastParentHead && isAncestor(cwd, entry.lastParentHead, tip) ? entry.lastParentHead : mergeBase(cwd, entry.lastParentHead ?? parentTip, tip) ?? parentTip;
+      const from = pending && isAncestor2(cwd, pending.onto, tip) ? pending.onto : entry.lastParentHead && isAncestor2(cwd, entry.lastParentHead, tip) ? entry.lastParentHead : mergeBase(cwd, entry.lastParentHead ?? parentTip, tip) ?? parentTip;
       if (options.dryRun) {
         step.restack = { from, onto: parentTip, head: null, carried: null };
         newTip = null;
@@ -75680,7 +76534,7 @@ function syncStack(cwd, ctx, stack, options, actor) {
       }
     }
     if (!options.dryRun && newTip) {
-      const check = entry.pendingRestack && parentTip && isAncestor(cwd, parentTip, newTip) ? entry.pendingRestack : null;
+      const check = entry.pendingRestack && parentTip && isAncestor2(cwd, parentTip, newTip) ? entry.pendingRestack : null;
       let forced = false;
       if (check && parentTip) {
         const before = {
@@ -75994,12 +76848,12 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
     stderr: run.error ? String(run.error.message) : run.stderr ?? "",
     timedOut: failure?.code === "ETIMEDOUT"
   };
-}, safeRef2 = (value) => value.length > 0 && !value.startsWith("-"), isAncestor = (cwd, ancestor, descendant) => safeRef2(ancestor) && safeRef2(descendant) && gitRun3(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok, branchTip = (cwd, branch) => resolveRef(cwd, `refs/heads/${branch}`), trackedDirt = (dir) => {
+}, safeRef2 = (value) => value.length > 0 && !value.startsWith("-"), isAncestor2 = (cwd, ancestor, descendant) => safeRef2(ancestor) && safeRef2(descendant) && gitRun3(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]).ok, branchTip = (cwd, branch) => resolveRef(cwd, `refs/heads/${branch}`), trackedDirt = (dir) => {
   const status = gitRun3(dir, ["status", "--porcelain", "--untracked-files=no"]);
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path43.join(dir.data, "worktrees") : null;
+  return dir.ok ? path44.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash17("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
@@ -76011,17 +76865,17 @@ ${run.stdout}`.split(`
       return false;
   }
   return true;
-}, isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
+}, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs21.readFileSync(path43.join(lock, OWNER), "utf8");
+    raw = fs22.readFileSync(path44.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path43.join(lock, OWNER), lock])
+  for (const target of [path44.join(lock, OWNER), lock])
     try {
-      age = Date.now() - fs21.statSync(target).mtimeMs;
+      age = Date.now() - fs22.statSync(target).mtimeMs;
       break;
     } catch {}
   return { raw, age };
@@ -76238,16 +77092,16 @@ var init_pr_edit = __esm(() => {
 // packages/workit-core/src/forge/exec.ts
 import { spawnSync as spawnSync22 } from "node:child_process";
-import fs22 from "node:fs";
-import path44 from "node:path";
+import fs23 from "node:fs";
+import path45 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path44.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path45.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path44.join(dir, `${bin}${ext}`);
+      const candidate = path45.join(dir, `${bin}${ext}`);
       try {
-        const stat = fs22.statSync(candidate);
+        const stat = fs23.statSync(candidate);
         if (stat.isFile())
           return candidate;
       } catch {}
@@ -76279,7 +77133,7 @@ function systemRunner(kind, apiHost, env = process.env) {
       timeout: options.timeoutMs,
       killSignal: "SIGKILL",
       windowsHide: true,
-      stdio: ["ignore", "pipe", "pipe"]
+      ...options.input === undefined ? { stdio: ["ignore", "pipe", "pipe"] } : { input: options.input, stdio: ["pipe", "pipe", "pipe"] }
     });
     const error = result.error;
     return {
@@ -76355,8 +77209,8 @@ function apiText(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.lo
     return cliFailure(bin, apiHost, run, what, timeoutMs);
   return { ok: true, data: run.stdout };
 }
-function apiWrite(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.api) {
-  const run = runner(bin, args, { timeoutMs });
+function apiWrite(runner, bin, apiHost, args, what, timeoutMs = FORGE_TIMEOUTS.api, input) {
+  const run = runner(bin, args, input === undefined ? { timeoutMs } : { timeoutMs, input });
   if (run.status !== 0) {
     const text = redactText(`${run.stderr}
 ${run.stdout}`).trim();
@@ -76658,16 +77512,19 @@ function createGitHubForge(options) {
       });
     },
     merge(number, mergeOptions) {
+      const squash = mergeOptions.method === "squash" ? mergeOptions.squashMessage : undefined;
       const merged = apiWrite(runner, "gh", apiHost, [
         "api",
         "-X",
         "PUT",
         `repos/${repo}/pulls/${number}/merge`,
-        "-f",
-        `sha=${mergeOptions.sha}`,
-        "-f",
-        `merge_method=${mergeOptions.method}`
-      ], `merge of pull request #${number}`);
+        ...squash ? ["--input", "-"] : ["-f", `sha=${mergeOptions.sha}`, "-f", `merge_method=${mergeOptions.method}`]
+      ], `merge of pull request #${number}`, undefined, squash ? JSON.stringify({
+        sha: mergeOptions.sha,
+        merge_method: mergeOptions.method,
+        commit_title: squash.subject,
+        commit_message: squash.body
+      }) : undefined);
       if (!merged.ok)
         return merged;
       if (merged.data.merged === false)
@@ -77025,6 +77882,7 @@ function createGitLabForge(options) {
       });
     },
     merge(iid, mergeOptions) {
+      const squash = mergeOptions.method === "squash" ? mergeOptions.squashMessage : undefined;
       if (mergeOptions.method === "rebase")
         return failure3("invalid_input", "GitLab merges with the project's merge method; pass --method squash or merge");
       const merged = apiWrite(runner, "glab", apiHost, [
@@ -77032,11 +77890,19 @@ function createGitLabForge(options) {
         "-X",
         "PUT",
         `${project}/merge_requests/${iid}/merge`,
-        "-f",
-        `sha=${mergeOptions.sha}`,
-        "-F",
-        `squash=${mergeOptions.method === "squash" ? "true" : "false"}`
-      ], `merge of merge request !${iid}`);
+        ...squash ? ["--input", "-"] : [
+          "-f",
+          `sha=${mergeOptions.sha}`,
+          "-F",
+          `squash=${mergeOptions.method === "squash" ? "true" : "false"}`
+        ]
+      ], `merge of merge request !${iid}`, undefined, squash ? JSON.stringify({
+        sha: mergeOptions.sha,
+        squash: true,
+        squash_commit_message: squash.body ? `${squash.subject}
+${squash.body}` : squash.subject
+      }) : undefined);
       if (!merged.ok)
         return merged;
       const value = merged.data;
@@ -77181,7 +78047,7 @@ var init_gitlab = __esm(() => {
 });
 // packages/workit-core/src/forge/resolve.ts
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 function memo4(scope, key, compute, now = Date.now) {
   let entries = memoScopes.get(scope.owner);
   if (!entries)
@@ -77226,7 +78092,7 @@ function resolveCredential(workspace, derived, run, scope) {
       return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
     let token = "";
     try {
-      token = fs23.readFileSync(tokenFile.trim(), "utf8").trim();
+      token = fs24.readFileSync(tokenFile.trim(), "utf8").trim();
     } catch {
       return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile cannot be read`, "fix vcs.tokenFile in ~/.config/workit/workspaces.json");
     }
@@ -77424,16 +78290,16 @@ function parseDuration2(value) {
     return null;
   let total = 0;
   for (const [, amount, unit] of parts) {
-    const factor = UNITS.find(([pattern]) => pattern.test(unit))?.[1];
+    const factor = UNITS2.find(([pattern]) => pattern.test(unit))?.[1];
     if (factor === undefined)
       return null;
     total += Number(amount) * factor;
   }
   return Math.round(total);
 }
-var UNITS;
+var UNITS2;
 var init_duration = __esm(() => {
-  UNITS = [
+  UNITS2 = [
     [/^(?:ms|milliseconds?)$/u, 1],
     [/^(?:s|secs?|seconds?)$/u, 1000],
     [/^(?:m|mins?|minutes?)$/u, 60000],
@@ -77598,11 +78464,11 @@ __export(exports_pr, {
   run: () => run11
 });
 import { readFileSync as readFileSync21 } from "node:fs";
-import path45 from "node:path";
+import path46 from "node:path";
 function readBodyFile(io, file) {
   try {
     return {
-      body: file === "-" ? forgeDeps.readStdin() : readFileSync21(path45.resolve(io.cwd, file), "utf8")
+      body: file === "-" ? forgeDeps.readStdin() : readFileSync21(path46.resolve(io.cwd, file), "utf8")
     };
   } catch {
     return `cannot read --body-file ${file}`;
@@ -77780,7 +78646,10 @@ async function merge3(argv, io) {
     method: "value",
     "delete-branch": "boolean",
     unverified: "boolean",
-    reason: "value"
+    reason: "value",
+    subject: "value",
+    body: "value",
+    "body-file": "value"
   });
   if (typeof flags === "string")
     return usage3(io, flags, MERGE_USAGE);
@@ -77795,6 +78664,21 @@ async function merge3(argv, io) {
   const method = flags.values.method ?? "squash";
   if (!METHODS2.has(method))
     return usage3(io, "--method must be squash, merge or rebase", MERGE_USAGE);
+  const { subject } = flags.values;
+  if (flags.values.body !== undefined && flags.values["body-file"] !== undefined)
+    return usage3(io, "pass --body or --body-file, not both", MERGE_USAGE);
+  let body = flags.values.body;
+  if (flags.values["body-file"] !== undefined) {
+    const read = readBodyFile(io, flags.values["body-file"]);
+    if (typeof read === "string")
+      return usage3(io, read, MERGE_USAGE);
+    body = read.body;
+  }
+  if ((subject !== undefined || body !== undefined) && method !== "squash")
+    return usage3(io, "--subject and --body set a squash message; use --method squash", MERGE_USAGE);
+  if (subject !== undefined && (!subject.trim() || subject.includes(`
+`)))
+    return usage3(io, "--subject must be one non-empty line", MERGE_USAGE);
   const connected = connect(io);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -77803,7 +78687,9 @@ async function merge3(argv, io) {
     method,
     deleteBranch: flags.booleans.has("delete-branch"),
     actor: actorFromEnv(io.env),
-    ...unverified ? { unverified } : {}
+    ...unverified ? { unverified } : {},
+    ...subject !== undefined ? { subject } : {},
+    ...body !== undefined ? { body } : {}
   }, forgeDeps.sleep);
   if (!result.ok)
     return emit(io, fail(result.code, result.error, {
@@ -77967,7 +78853,7 @@ async function run11(argv, io) {
     return reply(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE4);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}`, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}`, METHODS2;
 var init_pr = __esm(() => {
   init_pr_body();
   init_pr_edit();
@@ -78205,7 +79091,7 @@ __export(exports_git, {
   run: () => run13
 });
 import { readFileSync as readFileSync22 } from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 function kindHint(cwd, kind) {
   let kinds = [...BRANCH_KINDS];
   try {
@@ -78256,6 +79142,7 @@ function parseCommit(argv) {
   const out = {
     messages: [],
     files: [],
+    trailers: [],
     all: false,
     amend: false,
     noEdit: false,
@@ -78277,14 +79164,15 @@ function parseCommit(argv) {
     }
     const valued = [
       ["-m", "--message", out.messages],
-      ["-F", "--file", out.files]
-    ].find(([shortName, longName]) => arg === shortName || arg === longName || arg.startsWith(`${longName}=`) || arg.startsWith(shortName) && arg.length > 2);
+      ["-F", "--file", out.files],
+      [null, "--trailer", out.trailers]
+    ].find(([shortName, longName]) => arg === shortName || arg === longName || arg.startsWith(`${longName}=`) || shortName !== null && arg.startsWith(shortName) && arg.length > 2);
     if (valued) {
       const [shortName, longName, into] = valued;
       if (arg === shortName || arg === longName) {
         const value = argv[++index];
         if (value === undefined)
-          return `${arg} requires a ${shortName === "-m" ? "message" : "file"}`;
+          return `${arg} requires a ${shortName === "-m" ? "message" : shortName === "-F" ? "file" : "Key: value trailer"}`;
         into.push(value);
       } else
         into.push(arg.startsWith(`${longName}=`) ? arg.slice(longName.length + 1) : arg.slice(2));
@@ -78307,7 +79195,7 @@ function commitMessage(parsed, io) {
 `);
   try {
-    return file === "-" ? readFileSync22(0, "utf8") : readFileSync22(path46.resolve(io.cwd, file), "utf8");
+    return file === "-" ? readFileSync22(0, "utf8") : readFileSync22(path47.resolve(io.cwd, file), "utf8");
   } catch (error) {
     return {
       error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
@@ -78338,6 +79226,7 @@ async function commit(argv, io) {
     paths: parsed.paths,
     amend: parsed.amend,
     allowEmpty: parsed.allowEmpty,
+    trailers: parsed.trailers,
     actor: actorFromEnv(io.env),
     env: io.env
   });
@@ -78450,6 +79339,13 @@ async function releasePush(names, io) {
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
   ]);
 }
+function trailers(argv, io) {
+  const extra = argv.find((arg) => arg !== "--json");
+  if (extra !== undefined)
+    return usage3(io, `unexpected argument ${extra}`, "workit git trailers");
+  const state = workspaceTrailers(io.cwd);
+  return emit(io, ok(state), (data) => data.enabled ? "on" : "off");
+}
 async function run13(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "branch")
@@ -78458,13 +79354,16 @@ async function run13(argv, io) {
     return commit(rest, io);
   if (sub === "push")
     return push(rest, io);
+  if (sub === "trailers")
+    return trailers(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE5);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE5 = "workit git branch|commit|push ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE5 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
 var init_git2 = __esm(() => {
   init_autonomy();
   init_branch();
   init_ops();
+  init_workspaces();
   init_ledger();
   init_implicit_task();
   init_output();
@@ -79015,8 +79914,8 @@ var init_stack2 = __esm(() => {
 // packages/workit-core/src/fanout.ts
 import { spawnSync as spawnSync24 } from "node:child_process";
 import { createHash as createHash18 } from "node:crypto";
-import fs24 from "node:fs";
-import path47 from "node:path";
+import fs25 from "node:fs";
+import path48 from "node:path";
 function expandBraces(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -79162,7 +80061,7 @@ function inScope(plan, slice, file) {
 }
 function parsePlan(raw, defaults, name) {
   const problems = [];
-  if (!isRecord8(raw))
+  if (!isRecord9(raw))
     return { ok: false, problems: ["the plan must be a JSON object"] };
   const planName = name ?? (typeof raw.name === "string" ? raw.name.trim() : "");
   if (!planName || planName.length > 200 || /\p{Cc}/u.test(planName))
@@ -79185,8 +80084,8 @@ function parsePlan(raw, defaults, name) {
   const seenIds = new Set;
   const seenBranches = new Map;
   raw.slices.forEach((item, index) => {
-    const where = isRecord8(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
-    if (!isRecord8(item)) {
+    const where = isRecord9(item) && typeof item.id === "string" ? `slice ${item.id}` : `slice #${index + 1}`;
+    if (!isRecord9(item)) {
       problems.push(`${where}: must be an object`);
       return;
     }
@@ -79250,7 +80149,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path47.resolve(defaults.root, optional("worktree") ?? path47.join(defaults.worktreeRoot, id)),
+      worktree: path48.resolve(defaults.root, optional("worktree") ?? path48.join(defaults.worktreeRoot, id)),
       tier,
       dependsOn: [...new Set(dependsOn ?? [])],
       scope,
@@ -79479,11 +80378,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path47.basename(common) === ".git" ? path47.dirname(common) : path47.resolve(cwd);
+  return common && path48.basename(common) === ".git" ? path48.dirname(common) : path48.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path47.join(path47.dirname(main), `${path47.basename(main)}-wt`);
+  return path48.join(path48.dirname(main), `${path48.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -79501,10 +80400,10 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path47.join(root.value.root, "fanouts") };
+  return { ok: true, data: path48.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
-  if (!isRecord8(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
+  if (!isRecord9(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
     return null;
   if (!Array.isArray(raw.slices))
     return null;
@@ -79521,7 +80420,7 @@ function parseStored(raw) {
   });
   const slices = [];
   for (const item of raw.slices) {
-    if (!isRecord8(item) || typeof item.id !== "string" || typeof item.branch !== "string")
+    if (!isRecord9(item) || typeof item.id !== "string" || typeof item.branch !== "string")
       return null;
     slices.push({
       id: item.id,
@@ -79567,10 +80466,10 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path47.join(dir.data, stackFileName(name));
+  const file = path48.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
-    parsed = parseStored(JSON.parse(fs24.readFileSync(file, "utf8")));
+    parsed = parseStored(JSON.parse(fs25.readFileSync(file, "utf8")));
   } catch (error) {
     if (error.code === "ENOENT")
       return { ok: true, data: null };
@@ -79584,7 +80483,7 @@ function listFanouts(cwd) {
     return dir;
   let names = [];
   try {
-    names = fs24.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
+    names = fs25.readdirSync(dir.data).filter((entry) => entry.endsWith(".json"));
   } catch {
     return { ok: true, data: [] };
   }
@@ -79592,7 +80491,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs24.readFileSync(path47.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs25.readFileSync(path48.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -79622,16 +80521,16 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path47.join(dir.data, stackFileName(plan.name));
+  const file = path48.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
-    fs24.mkdirSync(dir.data, { recursive: true });
-    fs24.writeFileSync(temp, `${JSON.stringify(plan, null, 2)}
+    fs25.mkdirSync(dir.data, { recursive: true });
+    fs25.writeFileSync(temp, `${JSON.stringify(plan, null, 2)}
 `);
-    fs24.renameSync(temp, file);
+    fs25.renameSync(temp, file);
     return { ok: true, data: file };
   } catch (error) {
-    fs24.rmSync(temp, { force: true });
+    fs25.rmSync(temp, { force: true });
     return fanoutFail("unavailable", `cannot write ${file}: ${error.message}`);
   }
 }
@@ -79644,7 +80543,7 @@ function planFanout(cwd, input, now = new Date) {
     return fanoutFail("blocked", "--take-lead needs a session: WORKIT_SESSION_ID is not set", "export WORKIT_SESSION_ID=<your session id>, then plan again with --take-lead");
   if (input.takeLead && isDelegateSession(session))
     return fanoutFail("blocked", `session ${session} is a worker or verifier id; only a lead takes the lead`, "run --take-lead from the lead's own session");
-  const parsed = parsePlan(input.trunk && isRecord8(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
+  const parsed = parsePlan(input.trunk && isRecord9(input.raw) ? { ...input.raw, trunk: input.trunk } : input.raw, {
     trunk: input.trunk ?? defaultTrunk(cwd),
     root: mainCheckout(cwd),
     worktreeRoot: worktreeRoot(cwd)
@@ -79767,7 +80666,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
   error,
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
-}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER3, filled = (text) => text.trim() !== "" && !PLACEHOLDER3.test(text.trim()), textList = (value) => {
+}), DEFAULT_SHARED, escapeRegExp4 = (text) => text.replace(/[.+^$()|[\]\\{}*?]/gu, "\\$&"), unescape2 = (pattern) => pattern.replace(/\\(.)/gu, "$1"), hasWildcard = (pattern) => /[*?{]/u.test(pattern.replace(/\\./gu, "")), compiled, matchesAny = (patterns, file) => patterns.some((pattern) => matchesScope(pattern, file)), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), PLACEHOLDER3, filled = (text) => text.trim() !== "" && !PLACEHOLDER3.test(text.trim()), textList = (value) => {
   if (typeof value === "string")
     return [value];
   if (Array.isArray(value) && value.every((item) => typeof item === "string"))
@@ -79825,8 +80724,8 @@ var init_fanout = __esm(() => {
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
-import fs25 from "node:fs";
-import path48 from "node:path";
+import fs26 from "node:fs";
+import path49 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -79886,7 +80785,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs25.readFileSync(path48.join(file, TOKEN_FILE), "utf8").trim() || null;
+    token = fs26.readFileSync(path49.join(file, TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -79894,7 +80793,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path48.basename(file),
+      id: path49.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -79910,7 +80809,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes4(16).toString("hex");
   try {
-    fs25.writeFileSync(path48.join(admin.path, TOKEN_FILE), `${token}
+    fs26.writeFileSync(path49.join(admin.path, TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -79925,25 +80824,25 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path48.join(common, "info", "exclude");
+  const file = path49.join(common, "info", "exclude");
   let text = "";
   try {
-    text = fs25.readFileSync(file, "utf8");
+    text = fs26.readFileSync(file, "utf8");
   } catch {
     text = "";
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs25.mkdirSync(path48.dirname(file), { recursive: true });
-  fs25.appendFileSync(file, `${text && !text.endsWith(`
+  fs26.mkdirSync(path49.dirname(file), { recursive: true });
+  fs26.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
 ${EXCLUDE_LINE}
 `);
 }
 function ensureScratch(worktree) {
-  const scratch = path48.join(worktree, SCRATCH_DIR);
-  fs25.mkdirSync(scratch, { recursive: true });
+  const scratch = path49.join(worktree, SCRATCH_DIR);
+  fs26.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
 function createSliceWorktree(cwd, plan, input) {
@@ -79987,8 +80886,8 @@ function createSliceWorktree(cwd, plan, input) {
     return fanoutFail("blocked", `${slice.branch} is checked out at ${elsewhere.path}: never two live workers on one branch`, `stop that worker, then workit fanout worktree release ${slice.id} (or git worktree remove ${elsewhere.path})`);
   let dirExisted = false;
   try {
-    const stat = fs25.statSync(target);
-    if (!stat.isDirectory() || fs25.readdirSync(target).length > 0)
+    const stat = fs26.statSync(target);
+    if (!stat.isDirectory() || fs26.readdirSync(target).length > 0)
       return fanoutFail("blocked", `${target} exists and is ${stat.isDirectory() ? "not empty" : "not a directory"} (not a worktree of this repository)`, `move it away, or set slice ${slice.id}'s worktree to another path`);
     dirExisted = true;
   } catch (error) {
@@ -80070,7 +80969,7 @@ function releaseSliceWorktree(cwd, plan, input) {
     notes: []
   };
   if (index < 0) {
-    if (fs25.existsSync(target))
+    if (fs26.existsSync(target))
       return fanoutFail("blocked", `${target} is not a worktree of this repository; nothing was removed`, "remove it yourself once you know what it holds");
     out.notes.push(`no worktree at ${target}; nothing to release`);
     return { ok: true, data: out };
@@ -80132,7 +81031,7 @@ function releaseSliceWorktree(cwd, plan, input) {
 `)[0]}`, entry.locked ? `git worktree unlock ${entry.path}, then release again` : undefined, { ...out });
   out.removed = true;
   if (made.dirExisted === true)
-    fs25.mkdirSync(entry.path, { recursive: true });
+    fs26.mkdirSync(entry.path, { recursive: true });
   if (out.unpushed)
     out.notes.push(`${slice.branch} is kept with ${out.unpushed} commit(s) not on the remote`);
   return { ok: true, data: out };
@@ -80160,32 +81059,32 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path48.join(worktree, SCRATCH_DIR);
+  const scratch = path49.join(worktree, SCRATCH_DIR);
   let stat;
   try {
-    stat = fs25.lstatSync(scratch);
+    stat = fs26.lstatSync(scratch);
   } catch {
     return;
   }
   if (stat.isSymbolicLink() || !stat.isDirectory())
-    fs25.unlinkSync(scratch);
+    fs26.unlinkSync(scratch);
   else
-    fs25.rmSync(scratch, { recursive: true, force: true, maxRetries: 2 });
+    fs26.rmSync(scratch, { recursive: true, force: true, maxRetries: 2 });
 }
 var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000, canonical2 = (target) => {
   try {
-    return fs25.realpathSync.native(target);
+    return fs26.realpathSync.native(target);
   } catch {
-    return path48.resolve(target);
+    return path49.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside3 = (child, parent) => {
-  const relative = path48.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path48.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path48.isAbsolute(slice.worktree) ? slice.worktree : path48.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
+  const relative = path49.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path49.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path49.isAbsolute(slice.worktree) ? slice.worktree : path49.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
 `)[0] || "unknown error"}`);
 var init_fanout_worktree = __esm(() => {
   init_ops();
@@ -80195,7 +81094,7 @@ var init_fanout_worktree = __esm(() => {
   SLOW = GIT_TIMEOUTS.worktree;
   EXCLUDE_LINE = `/${SCRATCH_DIR}/`;
   worktreeDeps = {
-    stat: (file) => fs25.statSync(file, { bigint: true })
+    stat: (file) => fs26.statSync(file, { bigint: true })
   };
 });
@@ -80236,7 +81135,9 @@ function renderBrief(cwd, plan, input) {
     id: row.id,
     what: String(row.what)
   }));
-  const session = workerSession(sessionSafe(input.actor.session), slice.id, input.attempt);
+  const identity = identityOf(input.actor.host);
+  const minted = workerSession(sessionSafe(input.actor.session), slice.id, input.attempt);
+  const session = identity === "declared" ? minted : null;
   const fanIn = plan.fanIn === "integration" ? [
     `FAN-IN: integration branch ${plan.trunk}. Before you report, merge its tip into your branch`,
     `  (\`git merge --no-edit ${plan.trunk}\`), resolve conflicts inside SCOPE and re-run VERIFY, so the`,
@@ -80265,8 +81166,8 @@ function renderBrief(cwd, plan, input) {
     ...REPORT,
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
-    `  export WORKIT_SESSION_ID=${session}`,
-    ...rules(mode, branch, slice.base)
+    ...identityLines(identity, minted),
+    ...rules(identity, mode, branch, slice.base)
   ];
   return {
     ok: true,
@@ -80287,13 +81188,38 @@ function renderBrief(cwd, plan, input) {
     }
   };
 }
-var DEFAULT_TIMEBOX = "30 minutes", REPORT, rules = (mode, branch, base) => [
-  "RULES:",
-  mode === "new" ? `  1. First command: \`workit git branch ${branch} --base ${base}\` (your worktree may start on another name).` : `  1. First command: \`git switch ${branch}\`, then continue from its head.`,
-  '  2. Decide ambiguities yourself: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`; stop only for an irreversible, security-sensitive or out-of-worktree action.',
-  "  3. Commit with `workit git commit -m <msg> -- <paths in SCOPE>`; push only if this brief says so.",
-  "  4. Never record a verdict on your own work."
-], sessionSafe = (text) => text.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-"), SESSION_MAX = 128;
+var DEFAULT_TIMEBOX = "30 minutes", REPORT, identityOf = (host) => {
+  const family = host?.replace(/_(?:cli|desktop)$/, "") ?? "";
+  if (family === "claude_code")
+    return "issued";
+  if (family === "opencode" || family === "pi" || family === "codex")
+    return "derived";
+  return "declared";
+}, identityLines = (identity, session) => {
+  if (identity === "issued")
+    return [
+      "  Session: your env already has WORKIT_SESSION_ID (the lead's id; SubagentStart issues ids only to verifiers and reviewers). Use it as is, in your Workit-Session trailer and workit commands; never export or hand-mint one."
+    ];
+  if (identity === "derived")
+    return [
+      "  Session: your host already sets WORKIT_SESSION_ID in your shell; export nothing and never hand-mint one."
+    ];
+  return [`  export WORKIT_SESSION_ID=${session}`];
+}, rules = (identity, mode, branch, base) => {
+  const plain = identity === "issued";
+  let first = `  1. First command: \`workit git branch ${branch} --base ${base}\` (your worktree may start on another name).`;
+  if (mode === "resume")
+    first = `  1. First command: \`git switch ${branch}\`, then continue from its head.`;
+  else if (plain)
+    first = `  1. First command: \`git fetch origin && git switch -c ${branch} origin/${base}\` (plain git: worktree isolation refuses every \`workit git\` form).`;
+  return [
+    "RULES:",
+    first,
+    '  2. Decide ambiguities yourself: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`; stop only for an irreversible, security-sensitive or out-of-worktree action.',
+    plain ? '  3. Commit with plain `git commit -m <msg> --trailer "Workit-Session: <the WORKIT_SESSION_ID in your env>" --trailer "<your host attribution trailer>" -- <paths in SCOPE>`; push only if this brief says so.' : "  3. Commit with `workit git commit -m <msg> -- <paths in SCOPE>`; push only if this brief says so.",
+    "  4. Never record a verdict on your own work."
+  ];
+}, sessionSafe = (text) => text.replace(/[^A-Za-z0-9_.:@/+-]/gu, "-"), SESSION_MAX = 128;
 var init_fanout_brief = __esm(() => {
   init_ledger();
   init_fanout();
@@ -80349,9 +81275,9 @@ function hasOwnCommits2(cwd, branch, start, head) {
     const onto = /^rebase(?: -i)? \(finish\): \S+ onto ([0-9a-f]+)/u.exec(subject)?.[1];
     if (!made && !(onto && !sha.startsWith(onto) && !onto.startsWith(sha)))
       continue;
-    if (sha !== head && !isAncestor2(cwd, sha, head))
+    if (sha !== head && !isAncestor3(cwd, sha, head))
       continue;
-    if (start && (sha === start || isAncestor2(cwd, sha, start)))
+    if (start && (sha === start || isAncestor3(cwd, sha, start)))
       continue;
     return true;
   }
@@ -80361,7 +81287,7 @@ function reverted(cwd, trunk, landedHead, start) {
   const fork = mergeBase(cwd, landedHead, trunk);
   if (fork && fork !== landedHead)
     return unchangedSince(cwd, fork, landedHead, trunk);
-  const before = start && start !== landedHead && isAncestor2(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
+  const before = start && start !== landedHead && isAncestor3(cwd, start, landedHead) ? start : gitRun4(cwd, ["rev-parse", "--verify", "-q", `${landedHead}^1`]).stdout.trim();
   return before ? unchangedSince(cwd, before, landedHead, trunk) : false;
 }
 function unchangedSince(cwd, before, after, trunk) {
@@ -80469,9 +81395,9 @@ function detectLanding(ctx, slice, input) {
           }
           return merged ? landed("pr_merged", merged) : { ...out, landed: true, how: "pr_merged" };
         }
-        if (!merged || head === merged || isAncestor2(ctx.cwd, head, merged))
+        if (!merged || head === merged || isAncestor3(ctx.cwd, head, merged))
           return landed("pr_merged", merged ?? head);
-        out.note = isAncestor2(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
+        out.note = isAncestor3(ctx.cwd, merged, head) ? `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} is ahead of it with newer commits` : `${label} merged at ${merged.slice(0, 12)}; ${slice.branch} has diverged from it (rewritten after the merge)`;
         return out;
       }
     }
@@ -80488,7 +81414,7 @@ function detectLanding(ctx, slice, input) {
   if (trunkIds.size === 0)
     return out;
   const froms = [fork];
-  if (input.parentHead && input.parentHead !== head && isAncestor2(ctx.cwd, input.parentHead, head))
+  if (input.parentHead && input.parentHead !== head && isAncestor3(ctx.cwd, input.parentHead, head))
     froms.push(input.parentHead);
   for (const from of froms) {
     const id = patchId(ctx.cwd, from, head);
@@ -80504,7 +81430,7 @@ function sliceStart(cwd, rows, fanout, slice) {
   const row = rows.findLast((candidate) => candidate.type === "fanout.worktree.created" && candidate.fanout === fanout && candidate.slice === slice.id && typeof candidate.baseSha === "string" && inSliceRun(candidate, slice));
   return row?.baseSha ?? null;
 }
-var isAncestor2 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
+var isAncestor3 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, TRUNK_SCAN = 500;
 var init_fanout_landed = __esm(() => {
   init_rev();
   init_fanout();
@@ -80561,7 +81487,7 @@ function checkFanout(cwd, plan, options = {}) {
       const b = tips.get(second);
       if (landings.get(first)?.landed || landings.get(second)?.landed)
         continue;
-      if (!a || !b || isAncestor3(cwd, a, b) || isAncestor3(cwd, b, a))
+      if (!a || !b || isAncestor4(cwd, a, b) || isAncestor4(cwd, b, a))
         continue;
       const check = checks.get(second);
       const theirs = new Map((changedBy.get(first) ?? []).map((file) => [file.toLowerCase(), file]));
@@ -80741,7 +81667,7 @@ function unblockFor(check, plan) {
     return `unblock ${check.waitsFor.join(", ")} first`;
   return check.reasons[0] ?? "workit fanout check";
 }
-var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor3 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
+var SAFE = (value) => Boolean(value) && !value?.startsWith("-"), isAncestor4 = (cwd, a, b) => gitRun4(cwd, ["merge-base", "--is-ancestor", a, b]).ok, resolves = (cwd, ref) => gitRun4(cwd, ["rev-parse", "--verify", "-q", `${ref}^{commit}`]).ok, blank2 = (slice, head) => ({
   id: slice.id,
   branch: slice.branch,
   head,
@@ -80960,8 +81886,8 @@ var exports_fanout = {};
 __export(exports_fanout, {
   run: () => run16
 });
-import fs26 from "node:fs";
-import path49 from "node:path";
+import fs27 from "node:fs";
+import path50 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -81022,10 +81948,10 @@ function plan2(argv, io) {
     return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path49.resolve(io.cwd, flags.positionals[0]);
+  const file = path50.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
-    raw = JSON.parse(fs26.readFileSync(file, "utf8"));
+    raw = JSON.parse(fs27.readFileSync(file, "utf8"));
   } catch (error) {
     return usage3(io, `cannot read ${file} as JSON: ${error.message}`, PLAN_USAGE2);
   }
@@ -96510,7 +97436,7 @@ var init_ast = __esm(() => {
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path50 from "node:path";
+import path51 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -97003,12 +97929,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path50.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path51.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path50.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path51.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -97398,7 +98324,7 @@ var init_rules = __esm(() => {
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync26 } from "node:child_process";
 import { existsSync as existsSync20, readdirSync as readdirSync9, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
-import path51 from "node:path";
+import path52 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync26("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
@@ -97411,7 +98337,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync9(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path51.join(dir, entry.name);
+    const full = path52.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -97423,7 +98349,7 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path51.resolve(cwd, input);
+    const full = path52.resolve(cwd, input);
     if (!existsSync20(full))
       missing.push(input);
     else if (statSync8(full).isDirectory())
@@ -97460,11 +98386,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path51.join(root, file), lines);
+    changed.set(path52.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path51.join(root, file), "all");
+    changed.set(path52.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -97526,7 +98452,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path51.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path52.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -97555,8 +98481,8 @@ import {
   writeFileSync as writeFileSync11,
   copyFileSync as copyFileSync6
 } from "node:fs";
-import os14 from "node:os";
-import path52 from "node:path";
+import os16 from "node:os";
+import path53 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -97629,7 +98555,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path52.posix.join(path52.posix.dirname(file), spec)) === target)
+        if (stripExt(path53.posix.join(path53.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -97637,7 +98563,7 @@ function relatedTests(source, testFiles) {
     return false;
   }).map((entry) => entry.file);
 }
-function removeStaleCopies(tmp = os14.tmpdir()) {
+function removeStaleCopies(tmp = os16.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
@@ -97649,12 +98575,12 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path52.join(tmp, name);
+    const dir = path53.join(tmp, name);
     try {
       const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync24(path52.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync24(path53.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -97671,8 +98597,8 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync10(target, { recursive: true });
   for (const entry of readdirSync10(origin, { withFileTypes: true })) {
-    const from = path52.join(origin, entry.name);
-    const to = path52.join(target, entry.name);
+    const from = path53.join(origin, entry.name);
+    const to = path53.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -97688,9 +98614,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path52.relative(repo, real);
-      if (!relative.startsWith("..") && !path52.isAbsolute(relative) && !relative.split(path52.sep).includes("node_modules")) {
-        symlinkSync(path52.join(copy, relative), to, "junction");
+      const relative = path53.relative(repo, real);
+      if (!relative.startsWith("..") && !path53.isAbsolute(relative) && !relative.split(path53.sep).includes("node_modules")) {
+        symlinkSync(path53.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -97706,7 +98632,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync9(repo);
   if (real && inside4(realRepo, real)) {
-    symlinkSync(path52.relative(path52.dirname(to), path52.join(tree, path52.relative(realRepo, real))), to);
+    symlinkSync(path53.relative(path53.dirname(to), path53.join(tree, path53.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync9(real).isFile())
@@ -97715,10 +98641,10 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path52.join(copy, file);
+  const target = path53.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside4(realpathSync9(copy), realpathSync9(path52.dirname(target))))
+    if (!stat.isFile() || !inside4(realpathSync9(copy), realpathSync9(path53.dirname(target))))
       return false;
   } catch {
     return false;
@@ -97729,9 +98655,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path52.join(os14.tmpdir(), TEMP_PREFIX));
-  writeFileSync11(path52.join(dir, PID_FILE), String(process.pid));
-  const tree = path52.join(dir, "tree");
+  const dir = mkdtempSync4(path53.join(os16.tmpdir(), TEMP_PREFIX));
+  writeFileSync11(path53.join(dir, PID_FILE), String(process.pid));
+  const tree = path53.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -97748,29 +98674,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path52.join(repo, relative);
+    const from = path53.join(repo, relative);
     let stat;
     try {
       stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path52.join(tree, relative);
-    mkdirSync10(path52.dirname(to), { recursive: true });
+    const to = path53.join(tree, relative);
+    mkdirSync10(path53.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync6(from, to);
-    let parent = path52.dirname(relative);
+    let parent = path53.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path52.dirname(parent);
+      parent = path53.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path52.join(repo, parent, "node_modules");
-    if (existsSync21(modules) && !existsSync21(path52.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path52.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path53.join(repo, parent, "node_modules");
+    if (existsSync21(modules) && !existsSync21(path53.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path53.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -97809,14 +98735,14 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync24(path52.join(repo, file), "utf8") };
+      return { file, text: readFileSync24(path53.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path52.relative(repo, absolute));
+    const relative = toPosix(path53.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
     if (NOT_SOURCE.test(relative) || !existsSync21(absolute))
@@ -97830,9 +98756,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path52.relative(repo, options.cwd);
+  const cwdRelative = path53.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path52.relative(cwdRelative, file));
+    const relative = toPosix(path53.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -97867,7 +98793,7 @@ async function runMutation(options) {
     return finish2(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path52.join(copy, cwdRelative);
+  const copyCwd = path53.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -97902,7 +98828,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync24(path52.join(copy, mutant.file), "utf8");
+      const original = readFileSync24(path53.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -97959,8 +98885,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside4 = (root, file) => {
-  const relative = path52.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path52.isAbsolute(relative);
+  const relative = path53.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path53.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -98009,7 +98935,7 @@ __export(exports_test_audit, {
   run: () => run18
 });
 import { existsSync as existsSync22 } from "node:fs";
-import path53 from "node:path";
+import path54 from "node:path";
 function parse7(argv) {
   const options = {
     paths: [],
@@ -98113,8 +99039,8 @@ async function run18(argv, io) {
     return emit(io, fail("invalid_input", `${options}
 usage: ${USAGE10}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path53.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path53.relative(io.cwd, file) || file);
+  const repo = top.ok ? path54.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path54.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -98357,7 +99283,7 @@ __export(exports_youtrack, {
   run: () => run20
 });
 import { readFileSync as readFileSync25 } from "node:fs";
-import path54 from "node:path";
+import path55 from "node:path";
 async function run20(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -98403,7 +99329,7 @@ async function run20(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync25(path54.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync25(path55.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE12);
       }
@@ -98472,7 +99398,7 @@ __export(exports_changelog, {
   run: () => run21
 });
 import { readFileSync as readFileSync26 } from "node:fs";
-import path55 from "node:path";
+import path56 from "node:path";
 async function run21(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -98518,7 +99444,7 @@ async function run21(argv, io) {
   ]);
 }
 var USAGE13 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path55.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path56.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -98614,7 +99540,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_package();
-import path56 from "node:path";
+import path57 from "node:path";
 // packages/workit-cli/src/help.ts
 var HELP_FLAGS = new Set(["--help", "-h"]);
@@ -98879,7 +99805,7 @@ var VERBS = [
   {
     name: "check",
     group: "delivery",
-    usage: "workit check <name> [--task <id>] [--base <ref>] | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--base <ref>] -- <cmd…>",
+    usage: "workit check <name> [--task <id>] [--base <ref>] [--no-lease] | workit check [--name <n>] [--shell] [--timeout <s>] [--task <id>] [--base <ref>] [--heavy] [--no-lease] -- <cmd…>",
     summary: "Run a configured or ad-hoc check and record CLI-observed evidence (exit = the command's)",
     examples: ["workit check test", "workit check --name unit -- bun test test/unit"],
     load: () => Promise.resolve().then(() => (init_check(), exports_check))
@@ -98921,8 +99847,8 @@ var VERBS = [
       },
       {
         name: "merge",
-        usage: "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--delete-branch] [--unverified --reason <why>]",
-        summary: "Merge when READY, verified by a non-author and granted"
+        usage: "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>]",
+        summary: "Merge when READY, verified by a non-author and granted; --subject/--body set the squash message"
       }
     ],
     examples: [
@@ -98962,18 +99888,24 @@ var VERBS = [
       },
       {
         name: "commit",
-        usage: "workit git commit -m|--message <msg>… | -F|--file <file|-> [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>]",
-        summary: "Commit (or --amend) with a linted Conventional Commit message and the session trailer"
+        usage: "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>]",
+        summary: "Commit (or --amend) with a linted Conventional Commit message, the session trailer (unless the workspace sets trailers: false) and any --trailer"
       },
       {
         name: "push",
         usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…]",
         summary: "Push the current branch and verify the remote tip (never a blind --force); --release finishes a git-flow release"
+      },
+      {
+        name: "trailers",
+        usage: "workit git trailers",
+        summary: "Print on or off: whether commits in this workspace get the Workit-Session trailer"
       }
     ],
     examples: [
       "workit git branch --kind feature --slug help-everywhere",
       'workit git commit -m "fix(cli): answer help flags first" --all',
+      'workit git commit -m "feat: x" --trailer "Co-Authored-By: Name <email>" --all',
       "workit git commit --amend --no-edit -- src/forgotten.ts",
       "workit git push --set-upstream"
     ],
@@ -99260,7 +100192,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path56.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path57.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail("invalid_input", parsed.error));