@brainervirus/workit-cli 8.12.0 → 8.12.1

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.12.0",
+    version: "8.12.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.12.0",
-      "@brainervirus/workit-cursor": "^8.12.0",
-      "@brainervirus/workit-opencode": "^8.12.0",
+      "@brainervirus/workit-core": "^8.12.1",
+      "@brainervirus/workit-cursor": "^8.12.1",
+      "@brainervirus/workit-opencode": "^8.12.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -9939,11 +9939,224 @@ var init_file_lock = __esm(() => {
   init_file_lock_sync();
 });
 
+// packages/workit-core/src/core/logger.ts
+import { appendFileSync, mkdirSync, readdirSync, unlinkSync } from "node:fs";
+import os from "node:os";
+import path4 from "node:path";
+var REDACTED = "[REDACTED]", DEFAULT_MAX_RATE = 20, DEFAULT_RATE_WINDOW_MS = 1000, DEFAULT_MAX_FIELD_LENGTH = 200, DEFAULT_MAX_STACK_LINES = 30, DAY_FILE, RETAINED_DAYS = 7, SECRET_VALUE, KEY_EQ_VALUE, URL_QUERY, splitKey = (key) => key.split(/[_-]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).map((word) => word.toLowerCase()), SENSITIVE_WORDS, STACK_WORDS, escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
+  const override = process.env.WORKFLOW_TOOLKIT_STATE;
+  if (override)
+    return override;
+  const home = os.homedir();
+  if (process.env.XDG_STATE_HOME)
+    return path4.join(process.env.XDG_STATE_HOME, "workit");
+  switch (os.platform()) {
+    case "darwin":
+      return path4.join(home, "Library", "Application Support", "workit");
+    case "win32":
+      return path4.join(process.env.LOCALAPPDATA ?? path4.join(home, "AppData", "Local"), "workit");
+    default:
+      return path4.join(process.env.HOME ?? home, ".local", "state", "workit");
+  }
+}, homePattern, applyPatterns = (value) => {
+  let out = value;
+  out = out.replace(SECRET_VALUE, REDACTED);
+  out = out.replace(KEY_EQ_VALUE, "$1$2[REDACTED]");
+  out = out.replace(URL_QUERY, "$1?[REDACTED]");
+  out = out.replace(homePattern, "~");
+  if (process.platform === "win32")
+    out = out.replace(/\\/g, "/");
+  return out;
+}, redactString = (value, options) => {
+  const out = applyPatterns(value);
+  if (out.length > options.maxFieldLength) {
+    return `${out.slice(0, options.maxFieldLength)}…`;
+  }
+  return out;
+}, boundStack = (value, options) => {
+  if (typeof value !== "string")
+    return redact(value, options);
+  const lines = value.split(`
+`);
+  const kept = lines.slice(0, options.maxStackLines).map(applyPatterns);
+  const dropped = lines.length - kept.length;
+  const body = dropped > 0 ? [...kept, `    ... ${dropped} more`] : kept;
+  return body.join(`
+`);
+}, redact = (value, options = DEFAULT_OPTIONS) => {
+  if (value === null || value === undefined)
+    return null;
+  if (typeof value === "boolean" || typeof value === "number")
+    return value;
+  if (typeof value === "string")
+    return redactString(value, options);
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Array.isArray(value))
+    return value.map((entry) => redact(entry, options));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      const words = splitKey(key);
+      if (words.some((word) => STACK_WORDS.has(word)))
+        out[key] = boundStack(entry, options);
+      else if (words.some((word) => SENSITIVE_WORDS.has(word)))
+        out[key] = REDACTED;
+      else
+        out[key] = redact(entry, options);
+    }
+    return out;
+  }
+  return null;
+}, DEFAULT_OPTIONS, dailyFileName = (date) => {
+  const y = date.getFullYear();
+  const m = String(date.getMonth() + 1).padStart(2, "0");
+  const d = String(date.getDate()).padStart(2, "0");
+  return `workit-${y}-${m}-${d}.jsonl`;
+}, pruneOldFiles = (dir) => {
+  try {
+    const files = readdirSync(dir).filter((name) => DAY_FILE.test(name)).toSorted().toReversed();
+    for (const file of files.slice(RETAINED_DAYS)) {
+      try {
+        unlinkSync(path4.join(dir, file));
+      } catch {}
+    }
+  } catch {}
+}, createLogger = (options = {}) => {
+  const stateDir = options.stateDir ?? resolveStateDir();
+  const logDir = path4.join(stateDir, "logs");
+  const now = options.now ?? (() => new Date);
+  const maxRate = options.maxRate ?? DEFAULT_MAX_RATE;
+  const rateWindowMs = options.rateWindowMs ?? DEFAULT_RATE_WINDOW_MS;
+  const redactOptions = {
+    maxFieldLength: options.maxFieldLength ?? DEFAULT_MAX_FIELD_LENGTH,
+    maxStackLines: options.maxStackLines ?? DEFAULT_MAX_STACK_LINES
+  };
+  let windowStart = 0;
+  const windowCounts = { debug: 0, info: 0, warn: 0, error: 0 };
+  const emit = (level, message, context) => {
+    const date = now();
+    const elapsed = date.getTime() - windowStart;
+    if (elapsed >= rateWindowMs || windowStart === 0) {
+      windowStart = date.getTime();
+      windowCounts.debug = 0;
+      windowCounts.info = 0;
+      windowCounts.warn = 0;
+      windowCounts.error = 0;
+    }
+    windowCounts[level] += 1;
+    if (windowCounts[level] > maxRate)
+      return;
+    let event = null;
+    try {
+      event = {
+        level,
+        time: date.toISOString(),
+        message: redactString(message, redactOptions),
+        context: redact(context ?? {}, redactOptions)
+      };
+      const line = `${JSON.stringify(event)}
+`;
+      mkdirSync(logDir, { recursive: true, mode: 448 });
+      appendFileSync(path4.join(logDir, dailyFileName(date)), line, { mode: 384 });
+      pruneOldFiles(logDir);
+    } catch {
+      try {
+        event = {
+          level,
+          time: date.toISOString(),
+          message: redactString(message, redactOptions),
+          context: { redaction_failed: true }
+        };
+        mkdirSync(logDir, { recursive: true, mode: 448 });
+        appendFileSync(path4.join(logDir, dailyFileName(date)), `${JSON.stringify(event)}
+`, {
+          mode: 384
+        });
+      } catch {}
+    }
+    for (const sink of [options.appLog, options.stderr]) {
+      if (!sink)
+        continue;
+      if (!event)
+        continue;
+      try {
+        sink(event);
+      } catch {}
+    }
+  };
+  return {
+    debug: (message, context) => emit("debug", message, context),
+    info: (message, context) => emit("info", message, context),
+    warn: (message, context) => emit("warn", message, context),
+    error: (message, context) => emit("error", message, context),
+    guard: (name, fn) => {
+      try {
+        return fn();
+      } catch (err) {
+        emit("warn", "detector_failed", {
+          detector: name,
+          error: err instanceof Error ? err.message : String(err)
+        });
+        return;
+      }
+    }
+  };
+};
+var init_logger = __esm(() => {
+  DAY_FILE = /^workit-\d{4}-\d{2}-\d{2}\.jsonl$/;
+  SECRET_VALUE = /\b(?:Bearer|Basic|Digest|Token)\s+\S+/gi;
+  KEY_EQ_VALUE = /\b([A-Za-z0-9_-]*(?:token|secret|password|passwd|apikey|api[_-]?key|authorization|credential|bearer)[A-Za-z0-9_-]*)([:=]\s*).+/gi;
+  URL_QUERY = /(https?:\/\/[^?#\s]+)\?[^#\s]*/g;
+  SENSITIVE_WORDS = new Set([
+    "token",
+    "secret",
+    "password",
+    "passwd",
+    "authorization",
+    "credential",
+    "credentials",
+    "cookie",
+    "api",
+    "apikey",
+    "apitoken",
+    "accesstoken",
+    "clientsecret",
+    "refreshtoken",
+    "key",
+    "bearer",
+    "prompt",
+    "message",
+    "messages",
+    "content",
+    "body",
+    "args",
+    "argument",
+    "result",
+    "results",
+    "output",
+    "issue",
+    "description",
+    "summary",
+    "payload",
+    "script",
+    "command",
+    "text",
+    "query"
+  ]);
+  STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
+  homePattern = new RegExp(`${escapeRegExp(os.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
+  DEFAULT_OPTIONS = {
+    maxFieldLength: DEFAULT_MAX_FIELD_LENGTH,
+    maxStackLines: DEFAULT_MAX_STACK_LINES
+  };
+});
+
 // packages/workit-core/src/store/paths.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import fs5 from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 function fastGit(root) {
   if (DISCOVERY_ENV.some((name) => process.env[name]))
     return null;
@@ -9959,7 +10172,7 @@ function fastGit(root) {
     if (device !== null && stat.dev !== device)
       return { kind: "none" };
     device = stat.dev;
-    const dotGit = path4.join(dir, ".git");
+    const dotGit = path5.join(dir, ".git");
     let entry = null;
     try {
       entry = fs5.statSync(dotGit);
@@ -9980,19 +10193,19 @@ function fastGit(root) {
         const match = /^gitdir: (.+)$/mu.exec(text);
         if (!match)
           return null;
-        gitDir = path4.resolve(dir, match[1].trim());
+        gitDir = path5.resolve(dir, match[1].trim());
       } else
         return null;
-      if (!fs5.existsSync(path4.join(gitDir, "HEAD")))
+      if (!fs5.existsSync(path5.join(gitDir, "HEAD")))
         return null;
     } else if (isGitDir(dir))
       gitDir = dir;
     if (gitDir) {
       let common = gitDir;
       try {
-        common = path4.resolve(gitDir, fs5.readFileSync(path4.join(gitDir, "commondir"), "utf8").trim());
+        common = path5.resolve(gitDir, fs5.readFileSync(path5.join(gitDir, "commondir"), "utf8").trim());
       } catch {}
-      if (!fs5.existsSync(path4.join(common, "objects")))
+      if (!fs5.existsSync(path5.join(common, "objects")))
         return null;
       return {
         kind: "repo",
@@ -10002,26 +10215,26 @@ function fastGit(root) {
         reftable: reftableRefs(common)
       };
     }
-    const parent = path4.dirname(dir);
+    const parent = path5.dirname(dir);
     if (parent === dir)
       return { kind: "none" };
     dir = parent;
   }
 }
 function resolveStore(root) {
-  root = path4.resolve(root);
+  root = path5.resolve(root);
   let directory = false;
   try {
     directory = fs5.statSync(root).isDirectory();
   } catch {}
   if (!directory)
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path5.join(root, ".workit"), shared: false, top: null };
   const fast = fastGit(root);
   if (fast?.kind === "none")
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path5.join(root, ".workit"), shared: false, top: null };
   if (fast?.kind === "repo")
     return {
-      dir: path4.join(fast.common, "workit"),
+      dir: path5.join(fast.common, "workit"),
       shared: true,
       top: fast.top,
       git: { gitDir: fast.gitDir, top: fast.top, reftable: fast.reftable }
@@ -10031,13 +10244,13 @@ function resolveStore(root) {
   if (run.ok && common) {
     const top = gitRun(root, ["rev-parse", "--path-format=absolute", "--show-toplevel"]);
     return {
-      dir: path4.join(real(path4.resolve(root, common)), "workit"),
+      dir: path5.join(real(path5.resolve(root, common)), "workit"),
       shared: true,
       top: top.ok && top.stdout.trim() ? real(top.stdout.trim()) : null
     };
   }
   if (run.missing || !run.ok && NOT_A_REPO.test(run.stderr))
-    return { dir: path4.join(root, ".workit"), shared: false, top: null };
+    return { dir: path5.join(root, ".workit"), shared: false, top: null };
   return new Error(`cannot locate the workit store: git rev-parse failed (${run.stderr.trim().split(`
 `)[0] || "no output"}); fix the repository (git status should work here)`);
 }
@@ -10048,7 +10261,7 @@ function resolveTaskKey(root, location) {
   if (location.git && !location.git.reftable) {
     let head = "";
     try {
-      head = fs5.readFileSync(path4.join(location.git.gitDir, "HEAD"), "utf8").trim();
+      head = fs5.readFileSync(path5.join(location.git.gitDir, "HEAD"), "utf8").trim();
     } catch {}
     const ref = /^ref: refs\/heads\/(.+)$/u.exec(head);
     if (ref && ref[1] !== ".invalid")
@@ -10079,7 +10292,7 @@ function resolveTaskKey(root, location) {
   return { key: `detached-${shortHash(real(worktree))}`, kind: "detached", branch: null };
 }
 function checkoutRootOf(root, location) {
-  const resolved = path4.resolve(root);
+  const resolved = path5.resolve(root);
   let canonical = resolved;
   try {
     canonical = fs5.realpathSync(resolved);
@@ -10110,13 +10323,13 @@ function branchRenames(location) {
     }
     for (const entry of entries)
       if (entry.isDirectory())
-        walk(path4.join(dir, entry.name));
+        walk(path5.join(dir, entry.name));
       else
-        files.push(path4.join(dir, entry.name));
+        files.push(path5.join(dir, entry.name));
   };
-  walk(path4.join(path4.dirname(location.dir), "logs", "refs", "heads"));
+  walk(path5.join(path5.dirname(location.dir), "logs", "refs", "heads"));
   if (location.git)
-    files.push(path4.join(location.git.gitDir, "logs", "HEAD"));
+    files.push(path5.join(location.git.gitDir, "logs", "HEAD"));
   const seen = new Set;
   const renames = [];
   for (const file of files) {
@@ -10177,20 +10390,20 @@ var NOT_A_REPO, gitRun = (cwd, args) => {
   }
 }, DISCOVERY_ENV, isGitDir = (dir) => {
   try {
-    return fs5.statSync(path4.join(dir, "HEAD")).isFile() && fs5.statSync(path4.join(dir, "objects")).isDirectory() && fs5.statSync(path4.join(dir, "refs")).isDirectory();
+    return fs5.statSync(path5.join(dir, "HEAD")).isFile() && fs5.statSync(path5.join(dir, "objects")).isDirectory() && fs5.statSync(path5.join(dir, "refs")).isDirectory();
   } catch {
     return false;
   }
 }, reftableRefs = (common) => {
   try {
-    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs5.readFileSync(path4.join(common, "config"), "utf8"));
+    return /^\s*refstorage\s*=\s*reftable\s*$/imu.test(fs5.readFileSync(path5.join(common, "config"), "utf8"));
   } catch {
     return false;
   }
 }, rebasingBranch = (gitDir) => {
   for (const state of ["rebase-merge", "rebase-apply"]) {
     try {
-      const ref = fs5.readFileSync(path4.join(gitDir, state, "head-name"), "utf8").trim();
+      const ref = fs5.readFileSync(path5.join(gitDir, state, "head-name"), "utf8").trim();
       const match = /^refs\/heads\/(.+)$/u.exec(ref);
       if (match)
         return match[1];
@@ -10201,7 +10414,7 @@ var NOT_A_REPO, gitRun = (cwd, args) => {
   let canonical = real(root);
   if (process.platform === "win32")
     canonical = canonical.toLowerCase();
-  const base = path4.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
+  const base = path5.basename(canonical).replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40) || "root";
   return `${base}-${shortHash(canonical)}`;
 };
 var init_paths = __esm(() => {
@@ -10218,7 +10431,7 @@ var init_paths = __esm(() => {
 // packages/workit-core/src/host-session.ts
 import { createHash as createHash3 } from "node:crypto";
 import fs6 from "node:fs";
-import path5 from "node:path";
+import path6 from "node:path";
 function hostSessionFromEnv(env) {
   const value = (key) => env[key]?.trim() || null;
   let inner = null;
@@ -10247,6 +10460,36 @@ function realHostSession(env) {
   const hosted = declared.host !== null && declared.host !== "cli";
   return { ...declared, kind: hosted ? "declared" : "none" };
 }
+function migrateRepoIssued(cwd) {
+  if (cwd === undefined)
+    return;
+  let old;
+  try {
+    const location = resolveStore(cwd);
+    if (location instanceof Error)
+      return;
+    old = path6.join(location.dir, "hooks", "issued");
+    if (!fs6.existsSync(old))
+      return;
+  } catch {
+    return;
+  }
+  for (const lead of safeList(old)) {
+    try {
+      const from = path6.join(old, lead);
+      if (!fs6.statSync(from).isDirectory())
+        continue;
+      const to = path6.join(userIssuedRoot(), lead);
+      fs6.mkdirSync(to, { recursive: true, mode: 448 });
+      for (const id of fs6.readdirSync(from)) {
+        fs6.copyFileSync(path6.join(from, id), path6.join(to, id));
+        fs6.rmSync(path6.join(from, id), { force: true });
+      }
+      removeIfEmpty(from);
+    } catch {}
+  }
+  removeIfEmpty(old);
+}
 function sessionClaimRefusal(env, claimed, cwd) {
   const real = realHostSession(env);
   const host = family(real.host);
@@ -10271,9 +10514,9 @@ function sessionClaimRefusal(env, claimed, cwd) {
     issuedClaim = true;
   }
   const error = `forged_session: ${claimed} is neither this shell's session (${real.session}) nor an id its host issued to a child of it`;
-  if (issuedClaim && noIssuedRecord(cwd) && host !== null && PLUGIN_UPDATE[host])
+  if (issuedClaim && noIssuedRecord(cwd, leadOf(claimed)) && host !== null && PLUGIN_UPDATE[host])
     return {
-      error: `${error}; no SubagentStart hook in this workspace has recorded an issued id`,
+      error: `${error}; no SubagentStart hook has recorded an issued id for this lead`,
       unblock: `the workit plugin hook is probably older than this CLI and does not record the ids it issues: update the plugin (${PLUGIN_UPDATE[host]}), then relaunch the verifier so its SubagentStart runs the new hook (workit doctor checks this as hook_issued_sessions)`
     };
   const ownChildShell = host !== null && OWN_CHILD_SHELL.has(host);
@@ -10282,32 +10525,35 @@ function sessionClaimRefusal(env, claimed, cwd) {
     unblock: ownChildShell ? `record the verdict from the verifier's own ${host === "pi" ? "Pi worker" : "OpenCode child session"} shell, where WORKIT_SESSION_ID is already set; never set WORKIT_SESSION_ID or --session by hand` : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session its SubagentStart context names, or pass --as verifier"
   };
 }
-var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), issuedRoot = (cwd) => {
-  const location = resolveStore(cwd);
-  return location instanceof Error ? null : path5.join(location.dir, "hooks", "issued");
-}, issuedDir = (cwd, lead) => {
-  const root = issuedRoot(cwd);
-  return root === null ? null : path5.join(root, hash(lead));
-}, noIssuedRecord = (cwd) => {
+var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path6.join(resolveStateDir(), "issued"), safeList = (dir) => {
+  try {
+    return fs6.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}, removeIfEmpty = (dir) => {
+  try {
+    fs6.rmdirSync(dir);
+  } catch {}
+}, noIssuedRecord = (cwd, lead) => {
   if (cwd === undefined)
     return false;
   try {
-    const root = issuedRoot(cwd);
-    return root !== null && !fs6.existsSync(root);
+    migrateRepoIssued(cwd);
+    return !fs6.existsSync(path6.join(userIssuedRoot(), hash(lead)));
   } catch {
     return false;
   }
 }, PLUGIN_UPDATE, wasIssued = (cwd, lead, claimed) => {
-  if (cwd === undefined)
-    return false;
+  migrateRepoIssued(cwd);
   try {
-    const dir = issuedDir(cwd, lead);
-    return dir !== null && fs6.existsSync(path5.join(dir, hash(claimed)));
+    return fs6.existsSync(path6.join(userIssuedRoot(), hash(lead), hash(claimed)));
   } catch {
     return false;
   }
 }, leadOf = (session) => session.slice(0, session.lastIndexOf(":")), OWN_CHILD_SHELL, HOST_SET_VARIABLE;
 var init_host_session = __esm(() => {
+  init_logger();
   init_paths();
   HOST_SESSION_VARS = [
     ["OPENCODE_SESSION_ID", () => "opencode"],
@@ -10331,19 +10577,19 @@ var init_host_session = __esm(() => {
 
 // packages/workit-core/src/core/package-root.ts
 import { existsSync } from "node:fs";
-import path6 from "node:path";
+import path7 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
-  let dir = path6.dirname(fileURLToPath(import.meta.url));
+  let dir = path7.dirname(fileURLToPath(import.meta.url));
   while (true) {
-    const parent = path6.dirname(dir);
-    if (existsSync(path6.join(dir, "package.json")) || parent === dir)
+    const parent = path7.dirname(dir);
+    if (existsSync(path7.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
 }, assetRoot = () => {
   const root = packageRoot();
-  const assets = path6.join(root, "assets");
+  const assets = path7.join(root, "assets");
   return existsSync(assets) ? assets : root;
 };
 var init_package_root = () => {};
@@ -10352,7 +10598,7 @@ var init_package_root = () => {};
 import { spawnSync as spawnSync3 } from "node:child_process";
 import fs7 from "node:fs";
 import { hostname } from "node:os";
-import path7 from "node:path";
+import path8 from "node:path";
 var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, defaultLockTimeoutMs = 250, defaultLockTimeout = () => defaultLockTimeoutMs, setDefaultLockTimeout = (ms) => {
   defaultLockTimeoutMs = ms;
 }, parseMetadataLock = (raw) => {
@@ -10456,13 +10702,13 @@ var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, REC
     return null;
   }
 }, lockPathFor = (root) => {
-  let real = path7.resolve(root);
+  let real = path8.resolve(root);
   try {
     real = fs7.realpathSync(real);
   } catch {}
   const location = resolveStore(real);
-  const dir = location instanceof Error ? path7.join(real, ".workit") : location.dir;
-  return path7.join(dir, "checkouts", checkoutSlug(real), "metadata.lock");
+  const dir = location instanceof Error ? path8.join(real, ".workit") : location.dir;
+  return path8.join(dir, "checkouts", checkoutSlug(real), "metadata.lock");
 }, clearAbandonedReclaimGuard = (lockPath, nowMs = Date.now()) => {
   const guard = `${lockPath}.reclaim`;
   const age = ageOf(guard, nowMs);
@@ -10549,7 +10795,7 @@ var init_store_lock = __esm(() => {
 // packages/workit-core/src/store/event-log.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs8 from "node:fs";
-import path8 from "node:path";
+import path9 from "node:path";
 function readLog(file, from = 0, expectSeq = null) {
   let fd;
   try {
@@ -10622,7 +10868,7 @@ function appendEvent(file, event, validEnd) {
     fs8.closeSync(fd);
   }
   if (created)
-    fsyncDirectory(path8.dirname(file));
+    fsyncDirectory(path9.dirname(file));
   return validEnd;
 }
 function replaceFile(file, bytes, durable) {
@@ -10638,7 +10884,7 @@ function replaceFile(file, bytes, durable) {
     }
     renameWithRetry(temporary, file);
     if (durable)
-      fsyncDirectory(path8.dirname(file));
+      fsyncDirectory(path9.dirname(file));
   } catch (error) {
     try {
       fs8.unlinkSync(temporary);
@@ -10948,7 +11194,7 @@ var init_notes = __esm(() => {
 // packages/workit-core/src/core/task-store.ts
 import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
 import * as fs9 from "node:fs";
-import path9 from "node:path";
+import path10 from "node:path";
 
 class TaskStore {
   root;
@@ -10960,7 +11206,7 @@ class TaskStore {
   migrationChecked = false;
   compactDue = new Set;
   constructor(root, options = {}) {
-    const resolved = path9.resolve(root);
+    const resolved = path10.resolve(root);
     this.origin = fs9.existsSync(resolved) ? fs9.realpathSync(resolved) : resolved;
     this.located = resolveStore(this.origin);
     this.root = checkoutRootOf(this.origin, this.located);
@@ -10969,7 +11215,7 @@ class TaskStore {
     this.migrateOnRead = options.migrateOnRead;
   }
   location() {
-    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs9.existsSync(path9.join(this.root, ".git"))) {
+    if (this.located !== undefined && !(this.located instanceof Error) && !this.located.shared && fs9.existsSync(path10.join(this.root, ".git"))) {
       this.located = undefined;
       this.migrationChecked = false;
     }
@@ -11125,7 +11371,7 @@ class TaskStore {
         const moved = this.bindLocked(again.data.id, key, input.now);
         return moved.ok ? success(moved.data.revision, null, { task: moved.data, created: false, key }) : moved;
       }
-      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path9.basename(this.root) || this.root;
+      const label = key.kind === "branch" ? `branch ${key.branch}` : key.kind === "detached" ? "a detached HEAD" : path10.basename(this.root) || this.root;
       const intent = {
         objective: input.objective?.trim() || `Work on ${label}`,
         scope: { description: `the checkout (${label})`, paths: ["."], exclusions: [] },
@@ -11185,14 +11431,14 @@ class TaskStore {
     const branch = key.ok ? key.data.branch : null;
     if (!branch || !location.ok)
       return success(null, null, null);
-    const common = path9.dirname(location.data.dir);
-    const heads = path9.join(common, "logs", "refs", "heads");
-    const headLog = location.data.git ? path9.join(location.data.git.gitDir, "logs", "HEAD") : "";
+    const common = path10.dirname(location.data.dir);
+    const heads = path10.join(common, "logs", "refs", "heads");
+    const headLog = location.data.git ? path10.join(location.data.git.gitDir, "logs", "HEAD") : "";
     const signatures = [
-      path9.join(heads, branch),
+      path10.join(heads, branch),
       headLog,
       heads,
-      path9.join(common, "packed-refs")
+      path10.join(common, "packed-refs")
     ].map((file) => fileSignature(file) ?? "-");
     const slot = `${location.data.dir}\x00${headLog}\x00${branch}`;
     let resolved = origins.get(slot);
@@ -11204,7 +11450,7 @@ class TaskStore {
           aliases.push(rename.from);
       const start = branchStart(location.data, branch, aliases);
       const slash = start?.indexOf("/") ?? -1;
-      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path9.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
+      const remote = slash > 0 && !refExists(common, `refs/heads/${start}`) && (refExists(common, `refs/remotes/${start}`) || readText(path10.join(common, "config")).includes(`[remote "${start.slice(0, slash)}"]`));
       const name = start && (remote ? start.slice(slash + 1) : start);
       resolved = {
         signature: signatures.join("|"),
@@ -11442,13 +11688,13 @@ class TaskStore {
     if (!ready.ok)
       return ready;
     const dirs = this.paths();
-    const recovery = path9.join(this.root, ".workit", "recovery");
+    const recovery = path10.join(this.root, ".workit", "recovery");
     if (fs9.existsSync(recovery)) {
       let files = 0;
       let bytes = 0;
       try {
         for (const name of fs9.readdirSync(recovery)) {
-          const stat = fs9.lstatSync(path9.join(recovery, name));
+          const stat = fs9.lstatSync(path10.join(recovery, name));
           if (!stat.isFile())
             continue;
           files += 1;
@@ -11501,7 +11747,7 @@ class TaskStore {
       if (fs9.existsSync(dirs.blobs))
         for (const name of fs9.readdirSync(dirs.blobs)) {
           const digest = name.replace(/\.json$/, "");
-          const file = path9.join(dirs.blobs, name);
+          const file = path10.join(dirs.blobs, name);
           let stat;
           try {
             stat = fs9.lstatSync(file);
@@ -11519,7 +11765,7 @@ class TaskStore {
         }
       return success(null, null, null);
     };
-    const swept = dryRun ? sweep() : this.withLock(path9.join(dirs.dir, "gc.lock"), sweep);
+    const swept = dryRun ? sweep() : this.withLock(path10.join(dirs.dir, "gc.lock"), sweep);
     if (!swept.ok)
       return swept;
     const temporaryDirs = [
@@ -11527,7 +11773,7 @@ class TaskStore {
       dirs.tasks,
       dirs.blobs,
       dirs.checkout,
-      ...names.map((name) => path9.join(dirs.tasks, name))
+      ...names.map((name) => path10.join(dirs.tasks, name))
     ];
     for (const directory of temporaryDirs) {
       if (!fs9.existsSync(directory))
@@ -11535,7 +11781,7 @@ class TaskStore {
       for (const name of fs9.readdirSync(directory)) {
         if (!name.endsWith(".tmp") && !name.endsWith(".probe"))
           continue;
-        const file = path9.join(directory, name);
+        const file = path10.join(directory, name);
         try {
           const stat = fs9.lstatSync(file);
           if (!stat.isFile() || nowMs - stat.mtimeMs <= STALE_TEMPORARY_MS)
@@ -11552,30 +11798,30 @@ class TaskStore {
   }
   paths() {
     const location = this.location();
-    const dir = location.ok ? location.data.dir : path9.join(this.root, ".workit");
-    const checkout = path9.join(dir, "checkouts", checkoutSlug(this.root));
+    const dir = location.ok ? location.data.dir : path10.join(this.root, ".workit");
+    const checkout = path10.join(dir, "checkouts", checkoutSlug(this.root));
     return {
       dir,
       shared: location.ok ? location.data.shared : false,
-      marker: path9.join(dir, "store.json"),
+      marker: path10.join(dir, "store.json"),
       checkout,
-      workspace: path9.join(checkout, "workspace.json"),
-      checkoutLock: path9.join(checkout, "metadata.lock"),
-      tasks: path9.join(dir, "tasks"),
-      index: path9.join(dir, "task-index.json"),
-      blobs: path9.join(dir, "blobs", "candidates"),
-      legacy: path9.join(dir, "legacy", checkoutSlug(this.root), "v2"),
-      v2: path9.join(this.root, ".workit")
+      workspace: path10.join(checkout, "workspace.json"),
+      checkoutLock: path10.join(checkout, "metadata.lock"),
+      tasks: path10.join(dir, "tasks"),
+      index: path10.join(dir, "task-index.json"),
+      blobs: path10.join(dir, "blobs", "candidates"),
+      legacy: path10.join(dir, "legacy", checkoutSlug(this.root), "v2"),
+      v2: path10.join(this.root, ".workit")
     };
   }
   eventsPath(taskId) {
-    return path9.join(this.paths().tasks, taskId, "events.jsonl");
+    return path10.join(this.paths().tasks, taskId, "events.jsonl");
   }
   snapshotPath(taskId) {
-    return path9.join(this.paths().tasks, taskId, "snapshot.json");
+    return path10.join(this.paths().tasks, taskId, "snapshot.json");
   }
   taskLockPath(taskId) {
-    return path9.join(this.paths().tasks, taskId, "lock");
+    return path10.join(this.paths().tasks, taskId, "lock");
   }
   ready(write = false) {
     const location = this.location();
@@ -11614,13 +11860,13 @@ class TaskStore {
     return {
       read: (digest) => {
         try {
-          return JSON.parse(fs9.readFileSync(path9.join(dir, `${digest}.json`), "utf8"));
+          return JSON.parse(fs9.readFileSync(path10.join(dir, `${digest}.json`), "utf8"));
         } catch (error) {
           throw new LogDamage(`stored candidate ${digest} is missing or unreadable: ${String(error)}`);
         }
       },
       write: (digest, value) => {
-        const file = path9.join(dir, `${digest}.json`);
+        const file = path10.join(dir, `${digest}.json`);
         if (fs9.existsSync(file)) {
           const stamp = new Date;
           try {
@@ -11812,7 +12058,7 @@ class TaskStore {
     }
   }
   openTask(record, type, key, legacy = null) {
-    const dir = path9.join(this.paths().tasks, record.id);
+    const dir = path10.join(this.paths().tasks, record.id);
     fs9.mkdirSync(dir, { recursive: true });
     const blobs = this.blobStore();
     const bound = key ? { ...key, boundAt: key.boundAt ?? new Date().toISOString() } : null;
@@ -11905,7 +12151,7 @@ class TaskStore {
   }
   withKeyLock(key, operation) {
     const digest = createHash5("sha256").update(key).digest("hex").slice(0, 32);
-    return this.withLock(path9.join(this.paths().dir, "keys", `${digest}.lock`), operation);
+    return this.withLock(path10.join(this.paths().dir, "keys", `${digest}.lock`), operation);
   }
   bindLocked(taskId, key, timestamp) {
     const current = this.readWorkspace();
@@ -12046,7 +12292,7 @@ class TaskStore {
   writeWorkspace(record) {
     const file = this.paths().workspace;
     try {
-      fs9.mkdirSync(path9.dirname(file), { recursive: true });
+      fs9.mkdirSync(path10.dirname(file), { recursive: true });
       replaceFile(file, `${canonicalJson(record)}
 `, true);
       return success(null, null, null);
@@ -12124,23 +12370,23 @@ class TaskStore {
     return failure2("revision_conflict", "workspace revision does not match; omit expectedWorkspaceRevision to use the current record", { expectedWorkspaceRevision: expected, actualWorkspaceRevision: actual });
   }
   v2Dirs() {
-    return [...new Set([this.root, this.origin])].map((dir) => path9.join(dir, ".workit"));
+    return [...new Set([this.root, this.origin])].map((dir) => path10.join(dir, ".workit"));
   }
   pendingMigrations() {
     return this.v2Dirs().filter((dir) => {
-      const raw = this.readV2Workspace(path9.join(dir, "workspace.json"));
+      const raw = this.readV2Workspace(path10.join(dir, "workspace.json"));
       return raw !== null && raw !== TOMBSTONE;
     });
   }
   migrateV2(v2) {
     const dirs = this.paths();
-    const v2Workspace = path9.join(v2, "workspace.json");
-    const v2Tasks = path9.join(v2, "tasks");
-    const legacy = path9.join(dirs.dir, "legacy", checkoutSlug(path9.dirname(v2)), "v2");
+    const v2Workspace = path10.join(v2, "workspace.json");
+    const v2Tasks = path10.join(v2, "tasks");
+    const legacy = path10.join(dirs.dir, "legacy", checkoutSlug(path10.dirname(v2)), "v2");
     const raw = this.readV2Workspace(v2Workspace);
     if (raw === null || raw === TOMBSTONE)
       return success(null, null, null);
-    return this.withLock(dirs.checkoutLock, () => this.withLock(path9.join(v2, "metadata.lock"), () => {
+    return this.withLock(dirs.checkoutLock, () => this.withLock(path10.join(v2, "metadata.lock"), () => {
       const workspace = this.readV2Workspace(v2Workspace);
       if (workspace === null || workspace === TOMBSTONE)
         return success(null, null, null);
@@ -12149,7 +12395,7 @@ class TaskStore {
         return failure2("recovery_required", `cannot migrate the 2.x store at ${v2}: ${parsedWorkspace.error}; move it aside to start fresh`, { path: v2Workspace });
       let files = [];
       try {
-        files = fs9.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path9.join(v2Tasks, name)));
+        files = fs9.readdirSync(v2Tasks).filter((name) => name.endsWith(".json") && validId(name.slice(0, -5))).filter((name) => !this.isStub(path10.join(v2Tasks, name)));
       } catch {}
       const current = this.readWorkspace();
       if (!current.ok)
@@ -12167,21 +12413,21 @@ class TaskStore {
       let skipped = 0;
       const done = new Map;
       try {
-        fs9.mkdirSync(path9.join(legacy, "tasks"), { recursive: true });
+        fs9.mkdirSync(path10.join(legacy, "tasks"), { recursive: true });
         for (const name of ["workspace.json", "index.json"])
-          if (fs9.existsSync(path9.join(v2, name)))
-            fs9.copyFileSync(path9.join(v2, name), path9.join(legacy, name));
+          if (fs9.existsSync(path10.join(v2, name)))
+            fs9.copyFileSync(path10.join(v2, name), path10.join(legacy, name));
         for (const name of files) {
           const id = name.slice(0, -5);
-          const file = path9.join(v2Tasks, name);
+          const file = path10.join(v2Tasks, name);
           const bytes = fs9.readFileSync(file, "utf8");
           const digest = sha256(bytes);
-          fs9.writeFileSync(path9.join(legacy, "tasks", name), bytes);
+          fs9.writeFileSync(path10.join(legacy, "tasks", name), bytes);
           const parsed = this.parseRecord(bytes, taskRecordSchema, "2.x task");
           if (!parsed.ok || parsed.data.id !== id)
             return failure2("recovery_required", `cannot migrate 2.x task ${id}: ${parsed.ok ? "file name and record ID differ" : parsed.error}; move ${file} aside to continue`, { path: file });
           const record = { ...parsed.data, workspaceId: target.id };
-          const origin = { path: path9.join(legacy, "tasks", name), digest };
+          const origin = { path: path10.join(legacy, "tasks", name), digest };
           if (!fs9.existsSync(this.eventsPath(id))) {
             this.openTask(record, "migrated.from_v2", null, origin);
             migrated += 1;
@@ -12217,7 +12463,7 @@ class TaskStore {
       try {
         let complete = true;
         for (const [name, digest] of done) {
-          const file = path9.join(v2Tasks, name);
+          const file = path10.join(v2Tasks, name);
           if (sha256(fs9.readFileSync(file, "utf8")) !== digest) {
             complete = false;
             continue;
@@ -12228,7 +12474,7 @@ class TaskStore {
           return failure2("busy", `the 2.x store at ${v2} changed during migration; retry`, {
             path: v2
           });
-        fs9.rmSync(path9.join(v2, "index.json"), { force: true });
+        fs9.rmSync(path10.join(v2, "index.json"), { force: true });
         this.writeTombstone(v2, target.id);
       } catch (error) {
         return failure2("storage_error", `cannot finish the 2.x migration: ${String(error)}`, {
@@ -12248,7 +12494,7 @@ class TaskStore {
   }
   adoptLocalStore() {
     const dirs = this.paths();
-    const marker = path9.join(dirs.v2, "store.json");
+    const marker = path10.join(dirs.v2, "store.json");
     if (!dirs.shared || !fs9.existsSync(marker))
       return success(null, null, null);
     return this.withLock(dirs.checkoutLock, () => {
@@ -12258,7 +12504,7 @@ class TaskStore {
       try {
         const merge = (from, to) => {
           if (!fs9.existsSync(to)) {
-            fs9.mkdirSync(path9.dirname(to), { recursive: true });
+            fs9.mkdirSync(path10.dirname(to), { recursive: true });
             try {
               fs9.renameSync(from, to);
             } catch {
@@ -12269,24 +12515,24 @@ class TaskStore {
           }
           if (fs9.lstatSync(from).isDirectory() && fs9.lstatSync(to).isDirectory())
             for (const name of fs9.readdirSync(from))
-              merge(path9.join(from, name), path9.join(to, name));
+              merge(path10.join(from, name), path10.join(to, name));
         };
         for (const sub of ["tasks", "checkouts", "blobs", "legacy"]) {
-          const from = path9.join(dirs.v2, sub);
+          const from = path10.join(dirs.v2, sub);
           if (!fs9.existsSync(from))
             continue;
           if (sub === "tasks") {
             for (const name of fs9.readdirSync(from))
-              if (validId(name) && !fs9.existsSync(path9.join(dirs.dir, sub, name)))
+              if (validId(name) && !fs9.existsSync(path10.join(dirs.dir, sub, name)))
                 tasks += 1;
           }
-          merge(from, path9.join(dirs.dir, sub));
+          merge(from, path10.join(dirs.dir, sub));
         }
-        const ledger = path9.join(dirs.v2, "ledger");
-        if (fs9.existsSync(ledger) && !fs9.existsSync(path9.join(dirs.dir, "ledger")))
-          merge(ledger, path9.join(dirs.dir, "ledger"));
-        fs9.rmSync(path9.join(dirs.v2, "task-index.json"), { force: true });
-        fs9.renameSync(marker, path9.join(dirs.v2, "store.moved.json"));
+        const ledger = path10.join(dirs.v2, "ledger");
+        if (fs9.existsSync(ledger) && !fs9.existsSync(path10.join(dirs.dir, "ledger")))
+          merge(ledger, path10.join(dirs.dir, "ledger"));
+        fs9.rmSync(path10.join(dirs.v2, "task-index.json"), { force: true });
+        fs9.renameSync(marker, path10.join(dirs.v2, "store.moved.json"));
       } catch (error) {
         return failure2("storage_error", `cannot move ${dirs.v2} into ${dirs.dir}: ${String(error)}`, {
           path: dirs.v2
@@ -12324,7 +12570,7 @@ class TaskStore {
       schemaVersion: SCHEMA_VERSION,
       id: workspaceId ?? newId(),
       revision: newRevision(),
-      root: path9.dirname(v2),
+      root: path10.dirname(v2),
       runtime: { createdWith: version, updatedWith: version },
       writer: null,
       store: {
@@ -12336,11 +12582,11 @@ class TaskStore {
       critical: ["store"]
     };
     fs9.mkdirSync(v2, { recursive: true });
-    const ignore = path9.join(v2, ".gitignore");
+    const ignore = path10.join(v2, ".gitignore");
     if (!fs9.existsSync(ignore))
       fs9.writeFileSync(ignore, `*
 `);
-    replaceFile(path9.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
+    replaceFile(path10.join(v2, "workspace.json"), `${JSON.stringify(marker, null, 2)}
 `, true);
   }
   stubFor(taskId) {
@@ -12364,8 +12610,8 @@ class TaskStore {
   }
   writeTombstoneIfMissing() {
     try {
-      const v2 = path9.join(this.root, ".workit");
-      if (fs9.existsSync(path9.join(v2, "workspace.json")))
+      const v2 = path10.join(this.root, ".workit");
+      if (fs9.existsSync(path10.join(v2, "workspace.json")))
         return;
       let id = null;
       try {
@@ -12382,7 +12628,7 @@ class TaskStore {
       replaceFile(dirs.marker, `${JSON.stringify({ format: "workit-store", version: STORE_FORMAT, createdWith: runtimeVersion() })}
 `, false);
     if (!dirs.shared) {
-      const ignore = path9.join(dirs.dir, ".gitignore");
+      const ignore = path10.join(dirs.dir, ".gitignore");
       let current = null;
       try {
         current = fs9.readFileSync(ignore, "utf8");
@@ -12442,7 +12688,7 @@ class TaskStore {
   withLock(lockPath, operation) {
     try {
       this.initializeStorage();
-      fs9.mkdirSync(path9.dirname(lockPath), { recursive: true });
+      fs9.mkdirSync(path10.dirname(lockPath), { recursive: true });
     } catch (error) {
       return failure2("storage_error", `unable to initialize store: ${String(error)}`, {
         path: this.paths().dir
@@ -12505,7 +12751,7 @@ class TaskStore {
     if (isTransientWindowsError(error) && !this.lockHolderPresent(lockPath) && !this.lockDirWritable(lockPath))
       return failure2("storage_error", `cannot create the workit lock (${code}); no other Workit call holds it`, {
         path: lockPath,
-        guidance: `Check permissions and the read-only attribute on ${path9.dirname(lockPath)}.`
+        guidance: `Check permissions and the read-only attribute on ${path10.dirname(lockPath)}.`
       });
     if (code === "EEXIST" || code === "file_lock_timeout" || code === "file_lock_stale" || isTransientWindowsError(error)) {
       let lock = null;
@@ -12563,7 +12809,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
 }, now = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"), oldestFirst = (left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id), cachedRuntimeVersion = null, runtimeVersion = () => {
   if (cachedRuntimeVersion === null) {
     try {
-      const pkg = JSON.parse(fs9.readFileSync(path9.join(packageRoot(), "package.json"), "utf8"));
+      const pkg = JSON.parse(fs9.readFileSync(path10.join(packageRoot(), "package.json"), "utf8"));
       cachedRuntimeVersion = typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
     } catch {
       cachedRuntimeVersion = "0.0.0";
@@ -12590,7 +12836,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
     return "";
   }
 }, REFLOG_LINE, branchStart = (location, branch, aliases) => {
-  const first = readText(path9.join(path9.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
+  const first = readText(path10.join(path10.dirname(location.dir), "logs", "refs", "heads", branch)).split(`
 `, 1)[0];
   const created = REFLOG_LINE.exec(first);
   const start = created && /^branch: Created from (\S+)$/u.exec(created[3])?.[1];
@@ -12600,7 +12846,7 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
     return start;
   if (!location.git)
     return null;
-  for (const line of readText(path9.join(location.git.gitDir, "logs", "HEAD")).split(`
+  for (const line of readText(path10.join(location.git.gitDir, "logs", "HEAD")).split(`
 `)) {
     const entry = REFLOG_LINE.exec(line);
     const moved = entry && /^checkout: moving from (\S+) to (\S+)$/u.exec(entry[3]);
@@ -12609,12 +12855,12 @@ var MIGRATION_PENDING = "workit migration pending", STORE_FORMAT = 3, STORE_MIN_
       return moved[1];
   }
   return null;
-}, refExists = (common, ref) => fs9.existsSync(path9.join(common, ref)) || readText(path9.join(common, "packed-refs")).includes(` ${ref}
+}, refExists = (common, ref) => fs9.existsSync(path10.join(common, ref)) || readText(path10.join(common, "packed-refs")).includes(` ${ref}
 `), origins, sameDirectoryIdentity = (left, right) => {
-  if (!path9.isAbsolute(left) || !path9.isAbsolute(right))
+  if (!path10.isAbsolute(left) || !path10.isAbsolute(right))
     return false;
-  const normalizedLeft = path9.resolve(left);
-  const normalizedRight = path9.resolve(right);
+  const normalizedLeft = path10.resolve(left);
+  const normalizedRight = path10.resolve(right);
   try {
     const a = fs9.statSync(normalizedLeft, { bigint: true });
     const b = fs9.statSync(normalizedRight, { bigint: true });
@@ -12673,8 +12919,8 @@ var init_workers = __esm(() => {
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import fs10 from "node:fs";
-import os from "node:os";
-import path10 from "node:path";
+import os2 from "node:os";
+import path11 from "node:path";
 function networkGitInvocation(cwd, args, timeoutMs) {
   const seconds = Math.max(1, Math.ceil(timeoutMs / 1000));
   const env = {
@@ -12732,9 +12978,9 @@ function worktreeTree(cwd, options = {}) {
     return null;
   const cap = options.maxUntrackedBytes ?? MAX_UNTRACKED_BYTES;
   const timeoutMs = options.timeoutMs ?? GIT_TIMEOUTS.worktree;
-  const scratch = fs10.mkdtempSync(path10.join(os.tmpdir(), "workit-tree-"));
+  const scratch = fs10.mkdtempSync(path11.join(os2.tmpdir(), "workit-tree-"));
   try {
-    const tempIndex = path10.join(scratch, "index");
+    const tempIndex = path11.join(scratch, "index");
     if (fs10.existsSync(indexPath))
       seedIndex(indexPath, tempIndex);
     const env = { ...process.env, GIT_INDEX_FILE: tempIndex };
@@ -12747,7 +12993,7 @@ function worktreeTree(cwd, options = {}) {
     const skipped = [];
     for (const file of untracked.stdout.split("\x00").filter(Boolean)) {
       try {
-        const stat = fs10.statSync(path10.join(top, file));
+        const stat = fs10.statSync(path11.join(top, file));
         if (stat.isFile() && stat.size > cap)
           skipped.push({ path: file, size: stat.size, mtimeMs: Math.trunc(stat.mtimeMs) });
       } catch {}
@@ -12793,7 +13039,7 @@ function worktreeSignal(cwd, options = {}) {
     if (entry.length < 4)
       continue;
     const file = entry.slice(3);
-    const absolute = path10.join(top, file);
+    const absolute = path11.join(top, file);
     let stat = "-";
     try {
       const info = fs10.lstatSync(absolute, { bigint: true });
@@ -12972,15 +13218,15 @@ function parseRemoteUrl(raw) {
     path: cleanPath(decodeURIComponent(url.pathname))
   };
 }
-function readSshConfig(home = os.homedir()) {
+function readSshConfig(home = os2.homedir()) {
   try {
-    return { text: fs10.readFileSync(path10.join(home, ".ssh", "config"), "utf8"), home };
+    return { text: fs10.readFileSync(path11.join(home, ".ssh", "config"), "utf8"), home };
   } catch {
     return { text: "", home };
   }
 }
 function resolveSshHost(alias, sshConfig) {
-  const source = typeof sshConfig === "string" ? { text: sshConfig, home: os.homedir() } : sshConfig;
+  const source = typeof sshConfig === "string" ? { text: sshConfig, home: os2.homedir() } : sshConfig;
   let hostname = null;
   let port = null;
   const evaluate = (text, initiallyActive, neverMatch, depth) => {
@@ -13176,15 +13422,15 @@ child.on("exit", (code) => {
     return [];
   return [{ key: match[1].toLowerCase(), args: tokens(match[2]) }];
 }), includeFiles = (spec, home) => {
-  const expanded = spec.startsWith("~") ? path10.join(home, spec.slice(1)) : spec;
-  const absolute = path10.isAbsolute(expanded) ? expanded : path10.join(home, ".ssh", expanded);
-  const dir = path10.dirname(absolute);
-  const base = path10.basename(absolute);
+  const expanded = spec.startsWith("~") ? path11.join(home, spec.slice(1)) : spec;
+  const absolute = path11.isAbsolute(expanded) ? expanded : path11.join(home, ".ssh", expanded);
+  const dir = path11.dirname(absolute);
+  const base = path11.basename(absolute);
   if (!/[*?]/u.test(base))
     return [absolute];
   try {
     const pattern = globToRegExp(base);
-    return fs10.readdirSync(dir).filter((name) => pattern.test(name)).toSorted().map((name) => path10.join(dir, name));
+    return fs10.readdirSync(dir).filter((name) => pattern.test(name)).toSorted().map((name) => path11.join(dir, name));
   } catch {
     return [];
   }
@@ -13229,13 +13475,13 @@ import {
   copyFileSync as copyFileSync2,
   cpSync as cpSync2,
   existsSync as existsSync3,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync2,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import os2 from "node:os";
-import path11 from "node:path";
+import os3 from "node:os";
+import path12 from "node:path";
 var diagnosticLogger, setDiagnosticLogger = (logger) => {
   diagnosticLogger = logger;
 }, getDiagnosticLogger = () => diagnosticLogger, PRESETS, mergePreset = (preset, input = {}, current = {
@@ -13247,14 +13493,14 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
     allowed: preset === "custom" ? input.allowed ?? current.branchPolicy.allowed : [...defs.allowed],
     protected: preset === "custom" ? input.protectedNames ?? current.branchPolicy.protected : [...defs.protected]
   };
-}, resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path11.join(process.env.XDG_CONFIG_HOME || path11.join(os2.homedir(), ".config"), "workit"), migratedDir = null, migrationFailed = false, ensureConfigDir = (dir = resolveConfigDir()) => {
+}, resolveConfigDir = () => process.env.WORKFLOW_TOOLKIT_CONFIG ?? process.env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path12.join(process.env.XDG_CONFIG_HOME || path12.join(os3.homedir(), ".config"), "workit"), migratedDir = null, migrationFailed = false, ensureConfigDir = (dir = resolveConfigDir()) => {
   if (migratedDir === dir)
     return dir;
   if (process.env.WORKFLOW_TOOLKIT_CONFIG || process.env.WORKFLOW_TOOLKIT_CONFIG_DIR) {
     migratedDir = dir;
     return dir;
   }
-  const legacy = path11.join(process.env.XDG_CONFIG_HOME || path11.join(os2.homedir(), ".config"), "workflow-toolkit");
+  const legacy = path12.join(process.env.XDG_CONFIG_HOME || path12.join(os3.homedir(), ".config"), "workflow-toolkit");
   if (!existsSync3(legacy)) {
     migratedDir = dir;
     return dir;
@@ -13264,11 +13510,11 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
     return dir;
   }
   migrationFailed = false;
-  mkdirSync2(dir, { recursive: true });
+  mkdirSync3(dir, { recursive: true });
   diagnosticLogger?.info(EVENT.migration, { from: legacy, to: dir });
-  for (const entry of readdirSync2(legacy, { withFileTypes: true })) {
-    const src = path11.join(legacy, entry.name);
-    const dest = path11.join(dir, entry.name);
+  for (const entry of readdirSync3(legacy, { withFileTypes: true })) {
+    const src = path12.join(legacy, entry.name);
+    const dest = path12.join(dir, entry.name);
     if (existsSync3(dest))
       continue;
     try {
@@ -13323,7 +13569,7 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
     unchosenBranchPolicy.add(config);
   return { status: "valid", path: file, config };
 }, readConfigTyped = (dir) => {
-  const file = path11.join(dir ?? configDir(), "config.json");
+  const file = path12.join(dir ?? configDir(), "config.json");
   return parseConfigResult(readSafe(file), file);
 }, readConfig = () => {
   const result = readConfigTyped();
@@ -13335,7 +13581,7 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   if (result.status === "malformed")
     throw new Error(result.error);
   return result.config ?? DEFAULTS;
-}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path11.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
+}, vcsConfigPath = () => process.env.WORKFLOW_VCS_CONFIG ?? path12.join(configDir(), "vcs.json"), branchGlobPattern = (glob) => new RegExp(`^${glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`, "i"), resolveBranchPolicy = (config, workspace, repoPreset) => {
   const wp = workspace?.branchPolicy ?? {};
   const workspacePreset = Object.hasOwn(PRESETS, wp.preset);
   const detected = !workspacePreset && unchosenBranchPolicy.has(config) ? repoPreset?.() ?? null : null;
@@ -13466,7 +13712,7 @@ var init_branch_policy = __esm(() => {
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
 import { readFileSync as readFileSync3, realpathSync as realpathSync2 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 function workspaceDefaultTarget(cwd, globalDefault) {
   const ws = resolveRuntimeWorkspaceVcs(cwd);
   const wp = ws?.branchPolicy ?? {};
@@ -13511,7 +13757,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     document: parsed
   };
 }, readWorkspacesResult = (dir = configDir()) => {
-  const file = path12.join(dir, "workspaces.json");
+  const file = path13.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -13611,9 +13857,9 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   let main = null;
   const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
   const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path12.resolve(gitDir) !== path12.resolve(common)) {
+  if (gitDir && common && path13.resolve(gitDir) !== path13.resolve(common)) {
     const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path12.basename(common) === ".git" ? path12.dirname(common) : common);
+    main = listed?.trim() || (path13.basename(common) === ".git" ? path13.dirname(common) : common);
   }
   mainCheckouts.set(cwd, main);
   return main;
@@ -13691,7 +13937,7 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
   }).passthrough();
   return entrySchema;
 }, resolveRuntimeWorkspaceVcs = (cwd) => resolveRuntimeWorkspaceCandidate(cwd, "vcs"), runtimeWorkspaceIndexSchema, matchRuntimeWorkspace = (cwd, dir = configDir()) => {
-  const file = path12.join(dir, "workspaces.json");
+  const file = path13.join(dir, "workspaces.json");
   let raw;
   try {
     raw = readFileSync3(file, "utf8");
@@ -13871,7 +14117,7 @@ var init_workspaces = __esm(() => {
         context.addIssue({ code: "custom", path: [field], message: "entries must be unique" });
       }
     }
-    if (track.versionSource?.kind === "package-json" && (path12.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
+    if (track.versionSource?.kind === "package-json" && (path13.posix.isAbsolute(track.versionSource.path.replaceAll("\\", "/")) || /^[A-Za-z]:\//u.test(track.versionSource.path.replaceAll("\\", "/")) || track.versionSource.path.replaceAll("\\", "/").split("/").includes(".."))) {
       context.addIssue({
         code: "custom",
         path: ["versionSource", "path"],
@@ -14209,7 +14455,7 @@ function gitTrackProbe(cwd) {
       const created = own.at(-1);
       if (!created || created.subject !== "branch: Created from HEAD")
         return null;
-      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp(branch)}$`, "u");
+      const pattern = new RegExp(`^checkout: moving from (\\S+) to ${escapeRegExp2(branch)}$`, "u");
       const entry = reflog(cwd, "HEAD").findLast((item) => item.time >= created.time && item.sha === created.sha && pattern.test(item.subject));
       return entry ? pattern.exec(entry.subject)?.[1] ?? null : null;
     },
@@ -14357,7 +14603,7 @@ var ReleaseTrackError, KNOWN_FIELDS, BRANCH_FIELDS, PLACEHOLDER, HAS_PLACEHOLDER
   return run.status === 0 ? (run.stdout ?? "").trim() : null;
 }, recordedBaseKey = (branch) => `branch.${branch}.workitBase`, recordBranchBase = (cwd, branch, base) => {
   git3(cwd, ["config", recordedBaseKey(branch), base]);
-}, escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), reflog = (cwd, ref) => (git3(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
+}, escapeRegExp2 = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"), reflog = (cwd, ref) => (git3(cwd, ["log", "-g", "--date=unix", "--format=%H%x09%gd%x09%gs", ref, "--"]) ?? "").split(`
 `).map((line) => {
   const [sha = "", selector = "", ...subject] = line.split("\t");
   return {
@@ -14407,7 +14653,7 @@ var init_release_tracks = __esm(() => {
 
 // packages/workit-core/src/core/vcs-config.ts
 import fs11 from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 import { spawnSync as spawnSync8 } from "node:child_process";
 function vcsConfig(mode, cwd, options = {}) {
   const ws = resolveRuntimeWorkspaceVcs(vcsCwd(cwd));
@@ -14470,7 +14716,7 @@ function vcsConfig(mode, cwd, options = {}) {
   const prov = cfg[provider] ?? {};
   const out = {
     ok: true,
-    configPath: path13.resolve(cfgPath),
+    configPath: path14.resolve(cfgPath),
     provider,
     defaultTargetBranch: workspaceDefault,
     pr: cfg.pr ?? {},
@@ -14490,7 +14736,7 @@ function vcsConfig(mode, cwd, options = {}) {
   }
   return out;
 }
-var workspacesPath = () => path13.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
+var workspacesPath = () => path14.join(configDir(), "workspaces.json"), vcsCwd = (cwd) => cwd ?? process.env.WORKFLOW_WORKSPACE_ROOT ?? process.cwd(), remoteProvider = (cwd) => {
   const r = spawnSync8("git", ["remote", "get-url", "origin"], { cwd, encoding: "utf8" });
   if (r.status !== 0)
     return null;
@@ -14537,7 +14783,7 @@ var init_vcs_config = __esm(() => {
 import { spawnSync as spawnSync9 } from "node:child_process";
 import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
 import fs12 from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 function resolveCommit(cwd, ref) {
   if (!safeRef(ref))
     return null;
@@ -14603,14 +14849,14 @@ function diffHash(cwd, base, head) {
   return `sha256:${hash.digest("hex")}`;
 }
 function storeRoot(cwd) {
-  const location = resolveStore(path14.resolve(cwd));
+  const location = resolveStore(path15.resolve(cwd));
   if (location instanceof Error)
     return err("unavailable", location.message.replace(/; fix the repository.*$/u, ""), "fix the repository (git status should work here) or run from a non-git directory");
   return { ok: true, value: { root: location.dir, shared: location.shared } };
 }
 function ledgerPath(cwd) {
   const root = storeRoot(cwd);
-  return root.ok ? { ok: true, value: path14.join(root.value.root, "ledger", "ledger.jsonl") } : root;
+  return root.ok ? { ok: true, value: path15.join(root.value.root, "ledger", "ledger.jsonl") } : root;
 }
 function actorFromEnv(env) {
   const value = (key) => {
@@ -14672,8 +14918,8 @@ function appendLine(file, build, options) {
     }
   };
   try {
-    fs12.mkdirSync(path14.dirname(file), { recursive: true });
-    if (!options.forceLock && !onNetworkFs(path14.dirname(file)))
+    fs12.mkdirSync(path15.dirname(file), { recursive: true });
+    if (!options.forceLock && !onNetworkFs(path15.dirname(file)))
       return write();
     const locked = withLedgerLock(file, write);
     return locked ?? err("busy", `ledger lock ${file}.lock is held`, "retry; remove the .lock directory if no workit process is running");
@@ -15352,7 +15598,7 @@ function summarizeRow(row) {
   };
 }
 function stackPosition(root, branch) {
-  const dir = path14.join(root, "stacks");
+  const dir = path15.join(root, "stacks");
   let names = [];
   try {
     names = fs12.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -15362,7 +15608,7 @@ function stackPosition(root, branch) {
   for (const name of names.toSorted()) {
     let parsed;
     try {
-      parsed = JSON.parse(fs12.readFileSync(path14.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs12.readFileSync(path15.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -15507,12 +15753,12 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, VERDICT_RESULTS, PASSING, FAILING
   }
 }, LOCK_WAIT_MS = 5000, LOCK_STALE_MS = 30000, LOCK_OWNER = "owner", lockToken = (lock) => {
   try {
-    return fs12.readFileSync(path14.join(lock, LOCK_OWNER), "utf8");
+    return fs12.readFileSync(path15.join(lock, LOCK_OWNER), "utf8");
   } catch {
     return null;
   }
 }, lockAgeMs = (lock) => {
-  for (const target of [path14.join(lock, LOCK_OWNER), lock]) {
+  for (const target of [path15.join(lock, LOCK_OWNER), lock]) {
     try {
       return Date.now() - fs12.statSync(target).mtimeMs;
     } catch {}
@@ -15682,7 +15928,7 @@ var init_ledger = __esm(() => {
         throw error;
       }
       const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
-      fs12.writeFileSync(path14.join(lock, LOCK_OWNER), token);
+      fs12.writeFileSync(path15.join(lock, LOCK_OWNER), token);
       return token;
     },
     release(lock, token) {
@@ -15735,7 +15981,7 @@ var init_ledger = __esm(() => {
 
 // packages/workit-core/src/core/policy/derive.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 function deriveRequirements(judgment, scope, constraints, verification = "self") {
   const out = [];
   const base = { scope, dependentAction: null };
@@ -15876,7 +16122,7 @@ var RULES, derived2 = (spec) => ({
     decisionIds: []
   };
 }, planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path15.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync4(path16.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -15925,7 +16171,7 @@ var init_derive = __esm(() => {
 import { createHash as createHash10 } from "node:crypto";
 import * as fs13 from "node:fs";
 import { spawnSync as spawnSync10 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 function captureCandidate(root, scope, environment = []) {
   let checkout;
   try {
@@ -15967,7 +16213,7 @@ function captureCandidate(root, scope, environment = []) {
   for (const item of [...names].toSorted()) {
     if (!scopeMatches(item, normalizedScope))
       continue;
-    const target = path16.join(checkout, item);
+    const target = path17.join(checkout, item);
     try {
       const stat = fs13.lstatSync(target);
       if (stat.isSymbolicLink()) {
@@ -16340,12 +16586,12 @@ function evaluateClosure(requestedOutcome, view) {
     requirementIds: evaluations.map((item) => item.requirementId)
   });
 }
-var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path16.sep}`), relative = (root, candidate) => path16.relative(root, candidate).split(path16.sep).join("/") || ".", canonicalPath = (value) => {
+var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"), inside = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path17.sep}`), relative = (root, candidate) => path17.relative(root, candidate).split(path17.sep).join("/") || ".", canonicalPath = (value) => {
   if (typeof value !== "string" || !value)
     return null;
   if (value.includes("\\") || value.split("/").includes(".."))
     return null;
-  const normalized = path16.posix.normalize(value);
+  const normalized = path17.posix.normalize(value);
   if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
     return null;
   return normalized === "." ? "." : normalized.replace(/\/$/, "");
@@ -16387,14 +16633,14 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
       git: !/not a git repository/i.test(stderr)
     };
   }
-  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")) : [];
+  const paths = result.stdout ? result.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")) : [];
   const stagedDeleted = spawnSync10("git", ["diff", "--cached", "--name-only", "--diff-filter=D", "-z"], { cwd: root, encoding: "buffer" });
   if (stagedDeleted.status !== 0) {
     const stderr = stagedDeleted.stderr?.toString("utf8") ?? "";
     if (!/not a git repository/i.test(stderr))
       return { paths, uncertain: true, git: true };
   } else if (stagedDeleted.stdout) {
-    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path16.sep).join("/")));
+    paths.push(...stagedDeleted.stdout.toString("utf8").split("\x00").filter(Boolean).map((item) => item.split(path17.sep).join("/")));
   }
   return { paths: [...new Set(paths)], uncertain: false, git: true };
 }, walk = (root, directory, output) => {
@@ -16408,7 +16654,7 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
   for (const name of names) {
     if (name === ".git" || name === ".workit")
       continue;
-    const target = path16.join(directory, name);
+    const target = path17.join(directory, name);
     let stat;
     try {
       stat = fs13.lstatSync(target);
@@ -16425,12 +16671,12 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
 }, scopeRoots = (root, scope) => {
   const roots = [];
   for (const item of scope.paths.length ? scope.paths : ["."]) {
-    const target = path16.resolve(root, item);
+    const target = path17.resolve(root, item);
     if (!inside(root, target))
       return failure2("invalid_input", `candidate scope escapes checkout: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} is outside the checkout` }] });
     let ancestor = target;
     while (!fs13.existsSync(ancestor) && ancestor !== root)
-      ancestor = path16.dirname(ancestor);
+      ancestor = path17.dirname(ancestor);
     try {
       if (!inside(root, fs13.realpathSync(ancestor)))
         return failure2("invalid_input", `candidate scope escapes checkout through a symlink: ${item} — keep one task per repository and coordinate a separate linked task in the other checkout`, { fields: [{ path: "scope.paths", reason: `${item} resolves outside the checkout` }] });
@@ -16494,23 +16740,23 @@ var digestBytes = (value) => createHash10("sha256").update(value).digest("hex"),
       continue;
     if (!reference.digest)
       return failure2("invalid_input", "document references require a byte digest");
-    const target = path16.resolve(root, reference.path);
-    if (target !== root && !target.startsWith(`${root}${path16.sep}`))
+    const target = path17.resolve(root, reference.path);
+    if (target !== root && !target.startsWith(`${root}${path17.sep}`))
       return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
         fields: [
           { path: "contentRefs.path", reason: `${reference.path} is outside the checkout` }
         ]
       });
     try {
-      const below = path16.relative(root, target);
+      const below = path17.relative(root, target);
       let current = root;
-      for (const segment of below.split(path16.sep)) {
+      for (const segment of below.split(path17.sep)) {
         if (!segment)
           continue;
-        current = path16.join(current, segment);
+        current = path17.join(current, segment);
         const stat = fs13.lstatSync(current);
         const real = fs13.realpathSync(current);
-        if (real !== root && !real.startsWith(`${root}${path16.sep}`))
+        if (real !== root && !real.startsWith(`${root}${path17.sep}`))
           return failure2("invalid_input", "document reference escapes checkout; cite it as an external file:// reference instead", {
             fields: [
               {
@@ -16791,7 +17037,7 @@ var init_git = () => {};
 // packages/workit-core/src/core/branch.ts
 import { execFileSync } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
-import path17 from "node:path";
+import path18 from "node:path";
 function effectiveWorkspacePolicy(workspaceRoot, kind, profileName) {
   const selected = resolveRuntimeWorkspacePolicy(workspaceRoot, kind, profileName?.trim() || process.env.WORKFLOW_PROFILE?.trim() || undefined);
   const config = readConfig();
@@ -16990,7 +17236,7 @@ var withReleaseTracks = (workspaceRoot, policy) => {
   let raw;
   try {
     raw = execFileSync("git", ["status", "--porcelain=v1"], {
-      cwd: path17.resolve(workspaceRoot),
+      cwd: path18.resolve(workspaceRoot),
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -17228,13 +17474,13 @@ import {
   fchmodSync,
   fsyncSync,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
   renameSync as renameSync2,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 function writeFileExclusive(file, content, mode) {
   try {
     writeFileSync3(file, content, { encoding: "utf8", flag: "wx", mode });
@@ -17246,9 +17492,9 @@ function writeFileExclusive(file, content, mode) {
   }
 }
 function writeFileAtomic(file, content, mode) {
-  const absolute = path18.resolve(file);
-  let parent = path18.dirname(absolute);
-  const root = path18.parse(parent).root;
+  const absolute = path19.resolve(file);
+  let parent = path19.dirname(absolute);
+  const root = path19.parse(parent).root;
   for (;; ) {
     try {
       if (lstatSync3(parent).isSymbolicLink())
@@ -17257,13 +17503,13 @@ function writeFileAtomic(file, content, mode) {
       if (error.code !== "ENOENT")
         throw error;
     }
-    const next = path18.dirname(parent);
+    const next = path19.dirname(parent);
     if (parent === root || next === parent)
       break;
     parent = next;
   }
-  const directory = path18.dirname(absolute);
-  mkdirSync3(directory, { recursive: true });
+  const directory = path19.dirname(absolute);
+  mkdirSync4(directory, { recursive: true });
   let existing = null;
   try {
     existing = lstatSync3(absolute);
@@ -17292,7 +17538,7 @@ function writeFileAtomic(file, content, mode) {
       } catch {}
     }
     try {
-      unlinkSync(temporary);
+      unlinkSync2(temporary);
     } catch {}
     throw error;
   }
@@ -17301,8 +17547,8 @@ var init_safe_write = () => {};
 
 // packages/workit-core/src/autonomy.ts
 import { copyFileSync as copyFileSync3, existsSync as existsSync6 } from "node:fs";
-import os3 from "node:os";
-import path19 from "node:path";
+import os4 from "node:os";
+import path20 from "node:path";
 function endpointOf(entry) {
   const raw = entry?.defaultEndpoint;
   if (raw === undefined)
@@ -17541,13 +17787,13 @@ function listGrants(dir = grantsDir()) {
 }
 var accountHome = () => {
   try {
-    return os3.userInfo().homedir;
+    return os4.userInfo().homedir;
   } catch {
-    return os3.homedir();
+    return os4.homedir();
   }
-}, grantsHome, grantsDir = () => path19.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
-  const configured = path19.resolve(resolveConfigDir());
-  return configured === path19.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path19.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
+}, grantsHome, grantsDir = () => path20.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
+  const configured = path20.resolve(resolveConfigDir());
+  return configured === path20.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path20.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
 }, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINTS, DEFAULT_ENDPOINT = "commit", isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value), raisesEndpoint = (current, next) => DEFAULT_ENDPOINTS.indexOf(next) > DEFAULT_ENDPOINTS.indexOf(current), DEFAULT_VERIFICATION = "self", verificationOf = (entry) => entry?.verification === "independent" ? "independent" : "self", isGrantKind = (value) => typeof value === "string" && GRANT_KINDS.includes(value), isGrantValue = (value) => value === true || value === false || value === "verified", normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value, fromAutoApprove = (value) => {
   if (value === true)
     return { push: true, pr: true, merge: "verified" };
@@ -19291,12 +19537,12 @@ var init_pr_body = __esm(() => {
 });
 
 // packages/workit-core/src/core/pr-create.ts
-import path20 from "node:path";
+import path21 from "node:path";
 import { spawnSync as spawnSync11 } from "node:child_process";
 import { pathToFileURL } from "node:url";
 var safePushUrl = (remote) => {
   const raw = remote.trim();
-  if (path20.isAbsolute(raw))
+  if (path21.isAbsolute(raw))
     return pathToFileURL(raw).href;
   if (!raw.includes("://")) {
     const scp = /^(?:([^@\s]+)@)?([^:]+):(.+)$/u.exec(raw);
@@ -19357,7 +19603,7 @@ var init_scripts = __esm(() => {
 
 // packages/workit-core/src/core/youtrack.ts
 import fs14 from "node:fs";
-import path21 from "node:path";
+import path22 from "node:path";
 function readYouTrackConfig(required) {
   const cfgPath = youTrackConfigPath();
   if (!fs14.existsSync(cfgPath)) {
@@ -19381,7 +19627,7 @@ function youTrackConfigLoad() {
   }
   const cfgPath = loaded.path;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path21.isAbsolute(tokenFile) ? path21.resolve(tokenFile) : path21.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path22.isAbsolute(tokenFile) ? path22.resolve(tokenFile) : path22.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs14.existsSync(tokenPath)) {
     return { error: "missing youtrack.token" };
   }
@@ -19395,8 +19641,8 @@ function youTrackConfigLoad() {
   const redacted = { ...loaded.config };
   delete redacted.tokenFile;
   redacted.tokenPresent = true;
-  redacted.configPath = path21.resolve(cfgPath);
-  redacted.tokenPath = path21.resolve(tokenPath);
+  redacted.configPath = path22.resolve(cfgPath);
+  redacted.tokenPath = path22.resolve(tokenPath);
   return { data: redacted };
 }
 function tzParts(date, tz) {
@@ -19719,7 +19965,7 @@ async function postUpdate({
   }
   return { ok: true, issueId, postedComment: true };
 }
-var ISSUE_RE, TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE", youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path21.join(configDir(), "youtrack.json"), youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path21.join(resolveConfigDir(), "youtrack.json"), youTrackTokenModeOk = (p) => {
+var ISSUE_RE, TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE", youTrackConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path22.join(configDir(), "youtrack.json"), youTrackReadOnlyConfigPath = () => process.env.WORKFLOW_YOUTRACK_CONFIG ?? path22.join(resolveConfigDir(), "youtrack.json"), youTrackTokenModeOk = (p) => {
   if (process.platform === "win32")
     return true;
   const mode = fs14.statSync(p).mode & 511;
@@ -19755,7 +20001,7 @@ var ISSUE_RE, TOKEN_PLACEHOLDER = "YOUR_TOKEN_HERE", youTrackConfigPath = () =>
   if ("error" in loaded)
     return loaded;
   const tokenFile = String(loaded.config.tokenFile ?? "");
-  const tokenPath = tokenFile ? path21.isAbsolute(tokenFile) ? path21.resolve(tokenFile) : path21.resolve(process.cwd(), tokenFile) : "";
+  const tokenPath = tokenFile ? path22.isAbsolute(tokenFile) ? path22.resolve(tokenFile) : path22.resolve(process.cwd(), tokenFile) : "";
   if (!tokenPath || !fs14.existsSync(tokenPath))
     return { error: "missing youtrack.token" };
   if (!youTrackTokenModeOk(tokenPath))
@@ -19860,18 +20106,18 @@ var init_context_read = __esm(() => {
 
 // packages/workit-core/src/core.ts
 import { existsSync as existsSync7, realpathSync as realpathSync5 } from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 function resolveInside(root, candidate) {
   const base = realpathSync5(root);
-  const target = path22.resolve(base, candidate);
-  if (target !== base && !target.startsWith(base + path22.sep)) {
+  const target = path23.resolve(base, candidate);
+  if (target !== base && !target.startsWith(base + path23.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
   while (!existsSync7(ancestor))
-    ancestor = path22.dirname(ancestor);
+    ancestor = path23.dirname(ancestor);
   const canonicalAncestor = realpathSync5(ancestor);
-  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path22.sep)) {
+  if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path23.sep)) {
     throw new Error("path must stay inside repository root");
   }
   return target;
@@ -19897,7 +20143,7 @@ var init_core3 = __esm(() => {
 
 // packages/workit-cli/src/task.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 async function readInput(input) {
   if (typeof input === "string")
     return input;
@@ -20216,7 +20462,7 @@ var TASK_FAMILIES, workspaceRootFor = (deps = {}) => {
     return explicit;
   const cwd = deps.cwd ?? process.cwd();
   const top = checkRoot(cwd);
-  return sameDirectoryIdentity(top, path23.resolve(cwd)) ? cwd : top;
+  return sameDirectoryIdentity(top, path24.resolve(cwd)) ? cwd : top;
 }, TASK_ACTIONS, outOf = (deps) => deps.out ?? process.stdout, errOf = (deps) => deps.err ?? process.stderr, write = (stream, value) => stream.write(value.endsWith(`
 `) ? value : `${value}
 `), jsonResult = (stream, result) => write(stream, JSON.stringify(result)), usage = (message) => failure2("invalid_input", message), parseUsage = (message, json) => ({
@@ -21506,7 +21752,7 @@ var init_environment = __esm(() => {
 
 // node_modules/ansi-escapes/base.js
 import process2 from "node:process";
-import os4 from "node:os";
+import os5 from "node:os";
 var ESC = "\x1B[", SEP = ";", isTerminalApp, isWindows2, isTmux, cwdFunction, cursorTo = (x, y) => {
   if (typeof x !== "number") {
     throw new TypeError("The `x` argument is required");
@@ -21528,7 +21774,7 @@ var ESC = "\x1B[", SEP = ";", isTerminalApp, isWindows2, isTmux, cwdFunction, cu
   if (isBrowser || !isWindows2) {
     return false;
   }
-  const parts = os4.release().split(".");
+  const parts = os5.release().split(".");
   const major = Number(parts[0]);
   const build = Number(parts[2] ?? 0);
   if (major < 10) {
@@ -57191,7 +57437,7 @@ var init_ansi_styles2 = __esm(() => {
 
 // node_modules/chalk/source/vendor/supports-color/index.js
 import process5 from "node:process";
-import os5 from "node:os";
+import os6 from "node:os";
 import tty2 from "node:tty";
 function hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process5.argv) {
   const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
@@ -57249,7 +57495,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min;
   }
   if (process5.platform === "win32") {
-    const osRelease = os5.release().split(".");
+    const osRelease = os6.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -63078,7 +63324,7 @@ var init_gitignore = __esm(() => {
 
 // packages/workit-core/src/core/changelog.ts
 import fs17 from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 import { createHash as createHash13 } from "node:crypto";
 function normalizeBullet(text) {
   text = text.trim();
@@ -63238,7 +63484,7 @@ function applyChangelog(target, entries, normalizeOnly) {
   const rendered = renderChangelog(source.text, entries, normalizeOnly);
   if ("error" in rendered)
     return { error: rendered.error };
-  fs17.mkdirSync(path24.dirname(target), { recursive: true });
+  fs17.mkdirSync(path25.dirname(target), { recursive: true });
   fs17.writeFileSync(target, rendered.text, "utf8");
   return { ...rendered.result, path: target };
 }
@@ -63381,14 +63627,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 }, changelogTarget = (workspaceRoot, changelogPath) => {
   try {
     const cwd = fs17.realpathSync(resolveWorkspaceRoot(workspaceRoot));
-    const target = path24.resolve(cwd, changelogPath || "CHANGELOG.md");
-    if (target !== cwd && !target.startsWith(cwd + path24.sep))
+    const target = path25.resolve(cwd, changelogPath || "CHANGELOG.md");
+    if (target !== cwd && !target.startsWith(cwd + path25.sep))
       return { error: "changelog path must be inside workspace_root" };
     let ancestor = target;
     while (!fs17.existsSync(ancestor))
-      ancestor = path24.dirname(ancestor);
+      ancestor = path25.dirname(ancestor);
     const canonicalAncestor = fs17.realpathSync(ancestor);
-    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path24.sep))
+    if (canonicalAncestor !== cwd && !canonicalAncestor.startsWith(cwd + path25.sep))
       return { error: "changelog path must be inside workspace_root" };
     return { cwd, target: fs17.existsSync(target) ? fs17.realpathSync(target) : target };
   } catch {
@@ -63407,22 +63653,22 @@ var init_changelog = __esm(() => {
 
 // packages/workit-core/src/core/hygiene.ts
 import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
-import path25 from "node:path";
-var repoRoot2, templatesDir = () => path25.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
-  if (!existsSync9(path25.join(root, "package.json")))
+import path26 from "node:path";
+var repoRoot2, templatesDir = () => path26.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
+  if (!existsSync9(path26.join(root, "package.json")))
     return null;
   try {
-    return JSON.parse(readFileSync9(path25.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync9(path26.join(root, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }, isOpenSource = (root) => {
-  if (existsSync9(path25.join(root, "LICENSE")))
+  if (existsSync9(path26.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
     return true;
-  return path25.basename(root) === "workflow-toolkit";
+  return path26.basename(root) === "workflow-toolkit";
 }, licenseHolder = (root) => {
   const pkg = packageJson(root);
   if (pkg) {
@@ -63443,13 +63689,13 @@ var repoRoot2, templatesDir = () => path25.join(repoRoot2, "templates", "hygiene
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync9(path25.join(root, file)))
+    if (existsSync9(path26.join(root, file)))
       continue;
-    const tpl = path25.join(templatesDir(), file);
+    const tpl = path26.join(templatesDir(), file);
     if (!existsSync9(tpl))
       continue;
-    const content = readFileSync9(tpl, "utf8").replace(/<PROJECT>/g, path25.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
-    planned.push({ path: path25.join(root, file), content });
+    const content = readFileSync9(tpl, "utf8").replace(/<PROJECT>/g, path26.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
+    planned.push({ path: path26.join(root, file), content });
   }
   return planned;
 };
@@ -63461,9 +63707,9 @@ var init_hygiene = __esm(() => {
 
 // packages/workit-cli/src/admin/setup-state.ts
 import { existsSync as existsSync10, readFileSync as readFileSync10 } from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 var classifySetupFile = (dir, name) => {
-  const file = path26.join(dir, name);
+  const file = path27.join(dir, name);
   let raw;
   try {
     raw = readFileSync10(file, "utf8");
@@ -63501,7 +63747,7 @@ var init_setup_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/registration.ts
-import path27 from "node:path";
+import path28 from "node:path";
 function isWorkitPlugin(value) {
   const s = String(value).replaceAll("\\", "/");
   const url = s.startsWith("file://") || s.startsWith("git+file://");
@@ -63534,11 +63780,11 @@ function mergeCursorEnabledPlugins(enabled) {
 }
 function mergeCursorPluginDirs(pluginDirs, pluginDir) {
   const strip = (p) => {
-    const j = path27.join(p);
-    return path27.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
+    const j = path28.join(p);
+    return path28.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
   };
   const normalized = strip(pluginDir);
-  const legacy = strip(path27.join(path27.dirname(pluginDir), "workflow-toolkit"));
+  const legacy = strip(path28.join(path28.dirname(pluginDir), "workflow-toolkit"));
   const prev = Array.isArray(pluginDirs) ? pluginDirs.map(String) : [];
   const kept = prev.filter((d) => strip(d) !== legacy);
   const exists = kept.some((d) => strip(d) === normalized);
@@ -63626,7 +63872,7 @@ function cursorMcpServerEntry(_packageDir) {
 function cursorHooksEntry(pluginDir) {
   return { command: `${cursorHookLauncher(pluginDir)} workit-cursor-session-start`, args: [] };
 }
-var OPENCODE_NPM_PIN = "@brainervirus/workit-opencode", isRecord4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest", cursorHookLauncher = (pluginDir) => pluginDir ? `node "${shellQuotedPath(path27.join(pluginDir, "hooks", "launch.mjs"))}"` : 'node "${CURSOR_PLUGIN_ROOT}/hooks/launch.mjs"', shellQuotedPath = (file) => path27.sep === "\\" ? file : file.replace(/([$`"\\])/g, "\\$1"), CURSOR_HOOK_RUN_COMMAND, CURSOR_PRETOOLUSE_MATCHER = "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch", CURSOR_HOOK_EVENTS, canonicalHookEntry = (event, pluginDir) => {
+var OPENCODE_NPM_PIN = "@brainervirus/workit-opencode", isRecord4 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), named = (s, name) => s === name || s.startsWith(`${name}@`), CURSOR_RUNTIME_PACKAGE = "@brainervirus/workit-cursor@latest", cursorHookLauncher = (pluginDir) => pluginDir ? `node "${shellQuotedPath(path28.join(pluginDir, "hooks", "launch.mjs"))}"` : 'node "${CURSOR_PLUGIN_ROOT}/hooks/launch.mjs"', shellQuotedPath = (file) => path28.sep === "\\" ? file : file.replace(/([$`"\\])/g, "\\$1"), CURSOR_HOOK_RUN_COMMAND, CURSOR_PRETOOLUSE_MATCHER = "Write|Edit|Delete|Shell|Remove|ApplyPatch|Apply_Patch|Patch|Rename|Mkdir|Mv|Cp|Touch", CURSOR_HOOK_EVENTS, canonicalHookEntry = (event, pluginDir) => {
   const command = `${cursorHookLauncher(pluginDir)} workit-cursor-hook`;
   if (event === "preToolUse")
     return { command, matcher: CURSOR_PRETOOLUSE_MATCHER, failClosed: false };
@@ -63659,219 +63905,6 @@ var init_support_matrix = __esm(() => {
   };
 });
 
-// packages/workit-core/src/core/logger.ts
-import { appendFileSync, mkdirSync as mkdirSync4, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "node:fs";
-import os6 from "node:os";
-import path28 from "node:path";
-var REDACTED = "[REDACTED]", DEFAULT_MAX_RATE = 20, DEFAULT_RATE_WINDOW_MS = 1000, DEFAULT_MAX_FIELD_LENGTH = 200, DEFAULT_MAX_STACK_LINES = 30, DAY_FILE, RETAINED_DAYS = 7, SECRET_VALUE, KEY_EQ_VALUE, URL_QUERY, splitKey = (key) => key.split(/[_-]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).map((word) => word.toLowerCase()), SENSITIVE_WORDS, STACK_WORDS, escapeRegExp3 = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), resolveStateDir = () => {
-  const override = process.env.WORKFLOW_TOOLKIT_STATE;
-  if (override)
-    return override;
-  const home = os6.homedir();
-  if (process.env.XDG_STATE_HOME)
-    return path28.join(process.env.XDG_STATE_HOME, "workit");
-  switch (os6.platform()) {
-    case "darwin":
-      return path28.join(home, "Library", "Application Support", "workit");
-    case "win32":
-      return path28.join(process.env.LOCALAPPDATA ?? path28.join(home, "AppData", "Local"), "workit");
-    default:
-      return path28.join(process.env.HOME ?? home, ".local", "state", "workit");
-  }
-}, homePattern, applyPatterns = (value) => {
-  let out = value;
-  out = out.replace(SECRET_VALUE, REDACTED);
-  out = out.replace(KEY_EQ_VALUE, "$1$2[REDACTED]");
-  out = out.replace(URL_QUERY, "$1?[REDACTED]");
-  out = out.replace(homePattern, "~");
-  if (process.platform === "win32")
-    out = out.replace(/\\/g, "/");
-  return out;
-}, redactString = (value, options) => {
-  const out = applyPatterns(value);
-  if (out.length > options.maxFieldLength) {
-    return `${out.slice(0, options.maxFieldLength)}…`;
-  }
-  return out;
-}, boundStack = (value, options) => {
-  if (typeof value !== "string")
-    return redact(value, options);
-  const lines = value.split(`
-`);
-  const kept = lines.slice(0, options.maxStackLines).map(applyPatterns);
-  const dropped = lines.length - kept.length;
-  const body = dropped > 0 ? [...kept, `    ... ${dropped} more`] : kept;
-  return body.join(`
-`);
-}, redact = (value, options = DEFAULT_OPTIONS) => {
-  if (value === null || value === undefined)
-    return null;
-  if (typeof value === "boolean" || typeof value === "number")
-    return value;
-  if (typeof value === "string")
-    return redactString(value, options);
-  if (value instanceof Date)
-    return value.toISOString();
-  if (Array.isArray(value))
-    return value.map((entry) => redact(entry, options));
-  if (typeof value === "object") {
-    const out = {};
-    for (const [key, entry] of Object.entries(value)) {
-      const words = splitKey(key);
-      if (words.some((word) => STACK_WORDS.has(word)))
-        out[key] = boundStack(entry, options);
-      else if (words.some((word) => SENSITIVE_WORDS.has(word)))
-        out[key] = REDACTED;
-      else
-        out[key] = redact(entry, options);
-    }
-    return out;
-  }
-  return null;
-}, DEFAULT_OPTIONS, dailyFileName = (date) => {
-  const y = date.getFullYear();
-  const m = String(date.getMonth() + 1).padStart(2, "0");
-  const d = String(date.getDate()).padStart(2, "0");
-  return `workit-${y}-${m}-${d}.jsonl`;
-}, pruneOldFiles = (dir) => {
-  try {
-    const files = readdirSync4(dir).filter((name) => DAY_FILE.test(name)).toSorted().toReversed();
-    for (const file of files.slice(RETAINED_DAYS)) {
-      try {
-        unlinkSync2(path28.join(dir, file));
-      } catch {}
-    }
-  } catch {}
-}, createLogger = (options = {}) => {
-  const stateDir = options.stateDir ?? resolveStateDir();
-  const logDir = path28.join(stateDir, "logs");
-  const now = options.now ?? (() => new Date);
-  const maxRate = options.maxRate ?? DEFAULT_MAX_RATE;
-  const rateWindowMs = options.rateWindowMs ?? DEFAULT_RATE_WINDOW_MS;
-  const redactOptions = {
-    maxFieldLength: options.maxFieldLength ?? DEFAULT_MAX_FIELD_LENGTH,
-    maxStackLines: options.maxStackLines ?? DEFAULT_MAX_STACK_LINES
-  };
-  let windowStart = 0;
-  const windowCounts = { debug: 0, info: 0, warn: 0, error: 0 };
-  const emit = (level, message, context) => {
-    const date = now();
-    const elapsed = date.getTime() - windowStart;
-    if (elapsed >= rateWindowMs || windowStart === 0) {
-      windowStart = date.getTime();
-      windowCounts.debug = 0;
-      windowCounts.info = 0;
-      windowCounts.warn = 0;
-      windowCounts.error = 0;
-    }
-    windowCounts[level] += 1;
-    if (windowCounts[level] > maxRate)
-      return;
-    let event = null;
-    try {
-      event = {
-        level,
-        time: date.toISOString(),
-        message: redactString(message, redactOptions),
-        context: redact(context ?? {}, redactOptions)
-      };
-      const line = `${JSON.stringify(event)}
-`;
-      mkdirSync4(logDir, { recursive: true, mode: 448 });
-      appendFileSync(path28.join(logDir, dailyFileName(date)), line, { mode: 384 });
-      pruneOldFiles(logDir);
-    } catch {
-      try {
-        event = {
-          level,
-          time: date.toISOString(),
-          message: redactString(message, redactOptions),
-          context: { redaction_failed: true }
-        };
-        mkdirSync4(logDir, { recursive: true, mode: 448 });
-        appendFileSync(path28.join(logDir, dailyFileName(date)), `${JSON.stringify(event)}
-`, {
-          mode: 384
-        });
-      } catch {}
-    }
-    for (const sink of [options.appLog, options.stderr]) {
-      if (!sink)
-        continue;
-      if (!event)
-        continue;
-      try {
-        sink(event);
-      } catch {}
-    }
-  };
-  return {
-    debug: (message, context) => emit("debug", message, context),
-    info: (message, context) => emit("info", message, context),
-    warn: (message, context) => emit("warn", message, context),
-    error: (message, context) => emit("error", message, context),
-    guard: (name, fn) => {
-      try {
-        return fn();
-      } catch (err) {
-        emit("warn", "detector_failed", {
-          detector: name,
-          error: err instanceof Error ? err.message : String(err)
-        });
-        return;
-      }
-    }
-  };
-};
-var init_logger = __esm(() => {
-  DAY_FILE = /^workit-\d{4}-\d{2}-\d{2}\.jsonl$/;
-  SECRET_VALUE = /\b(?:Bearer|Basic|Digest|Token)\s+\S+/gi;
-  KEY_EQ_VALUE = /\b([A-Za-z0-9_-]*(?:token|secret|password|passwd|apikey|api[_-]?key|authorization|credential|bearer)[A-Za-z0-9_-]*)([:=]\s*).+/gi;
-  URL_QUERY = /(https?:\/\/[^?#\s]+)\?[^#\s]*/g;
-  SENSITIVE_WORDS = new Set([
-    "token",
-    "secret",
-    "password",
-    "passwd",
-    "authorization",
-    "credential",
-    "credentials",
-    "cookie",
-    "api",
-    "apikey",
-    "apitoken",
-    "accesstoken",
-    "clientsecret",
-    "refreshtoken",
-    "key",
-    "bearer",
-    "prompt",
-    "message",
-    "messages",
-    "content",
-    "body",
-    "args",
-    "argument",
-    "result",
-    "results",
-    "output",
-    "issue",
-    "description",
-    "summary",
-    "payload",
-    "script",
-    "command",
-    "text",
-    "query"
-  ]);
-  STACK_WORDS = new Set(["stack", "stacktrace", "trace"]);
-  homePattern = new RegExp(`${escapeRegExp3(os6.homedir())}(?=[/\\\\]|$)|\\$HOME(?=[/\\\\]|$)`, "g");
-  DEFAULT_OPTIONS = {
-    maxFieldLength: DEFAULT_MAX_FIELD_LENGTH,
-    maxStackLines: DEFAULT_MAX_STACK_LINES
-  };
-});
-
 // packages/workit-cli/src/admin/host-install.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
 import {
@@ -66440,7 +66473,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: repair,
     registryProbed
   };
-}, HOOK_ISSUED_MARKER = "workit-issued-sessions/1", hookRecordsIssued = (root) => {
+}, HOOK_ISSUED_MARKER = "workit-issued-sessions/2", hookRecordsIssued = (root) => {
   let files;
   try {
     files = readdirSync7(path32.join(root, "dist")).filter((f) => f.endsWith(".js"));