@brainervirus/workit-cli 8.13.0 → 8.13.1

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.13.0",
+    version: "8.13.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,13 +103,14 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.13.0",
-      "@brainervirus/workit-cursor": "^8.13.0",
-      "@brainervirus/workit-opencode": "^8.13.0",
+      "@brainervirus/workit-cursor": "^8.13.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
+    devDependencies: {
+      "@brainervirus/workit-core": "^8.13.1"
+    },
     engines: {
       node: ">=24"
     }
@@ -10429,7 +10430,7 @@ var init_paths = __esm(() => {
 });
 
 // packages/workit-core/src/host-session.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 import fs6 from "node:fs";
 import path6 from "node:path";
 function hostSessionFromEnv(env) {
@@ -10482,7 +10483,12 @@ function migrateRepoIssued(cwd) {
       const to = path6.join(userIssuedRoot(), lead);
       fs6.mkdirSync(to, { recursive: true, mode: 448 });
       for (const id of fs6.readdirSync(from)) {
-        fs6.copyFileSync(path6.join(from, id), path6.join(to, id));
+        try {
+          fs6.copyFileSync(path6.join(from, id), path6.join(to, id), fs6.constants.COPYFILE_EXCL);
+        } catch (error) {
+          if (error.code !== "EEXIST")
+            throw error;
+        }
         fs6.rmSync(path6.join(from, id), { force: true });
       }
       removeIfEmpty(from);
@@ -10490,7 +10496,25 @@ function migrateRepoIssued(cwd) {
   }
   removeIfEmpty(old);
 }
-function sessionClaimRefusal(env, claimed, cwd) {
+function issuedBinding(cwd, claimed) {
+  const record = issuedRecord(cwd, claimed);
+  const { stored, leadBound } = issuedToken(claimed);
+  if (stored)
+    return "token";
+  if (record === null)
+    return null;
+  return leadBound ? "token" : "legacy";
+}
+function issuedTokenMatches(cwd, claimed, token) {
+  migrateRepoIssued(cwd);
+  const { stored } = issuedToken(claimed);
+  if (!stored || !token)
+    return false;
+  const given = Buffer.from(tokenHash(token.trim()));
+  const want = Buffer.from(stored);
+  return given.length === want.length && timingSafeEqual(given, want);
+}
+function sessionClaimRefusal(env, claimed, cwd, options = {}) {
   const real = realHostSession(env);
   const host = family(real.host);
   if (real.kind !== "derived" && host !== null && HOST_SET_VARIABLE[host])
@@ -10500,18 +10524,22 @@ function sessionClaimRefusal(env, claimed, cwd) {
     };
   if (real.kind === "none" || !real.session)
     return null;
-  let issuedClaim = false;
-  if (claimed === real.session) {
-    const declaredChild = real.kind === "declared" && host === "claude_code" && claimed.includes(":");
-    if (!declaredChild || wasIssued(cwd, leadOf(claimed), claimed))
-      return null;
-    issuedClaim = true;
-  } else if (real.kind === "derived" && claimed.endsWith(`:${real.session}`))
-    return null;
-  else if (claimed.startsWith(`${real.session}:`)) {
-    if (wasIssued(cwd, real.session, claimed))
+  const ownShell = claimed === real.session && !(real.kind === "declared" && claimed.includes(":")) || real.kind === "derived" && claimed.endsWith(`:${real.session}`);
+  if (ownShell)
+    return options.flag ? {
+      error: `session_flag: --session ${claimed} names this shell's own ${real.host} session; on a host only an issued subagent id is passed as --session`,
+      unblock: "drop --session: the shell's own session is already the acting one"
+    } : null;
+  const issuedClaim = claimed === real.session || claimed.startsWith(`${real.session}:`);
+  if (issuedClaim) {
+    const binding = issuedBinding(cwd, claimed);
+    if (binding === "legacy")
       return null;
-    issuedClaim = true;
+    if (binding === "token")
+      return issuedTokenMatches(cwd, claimed, options.token) ? null : {
+        error: `unbound_session: ${claimed} was issued to a subagent, and this call did not present the token its SubagentStart hook gave it`,
+        unblock: `only that subagent acts as ${claimed}: it passes --token exactly as its SubagentStart context names it (or WORKIT_SESSION_TOKEN); anyone else spawns their own verifier`
+      };
   }
   const error = `forged_session: ${claimed} is neither this shell's session (${real.session}) nor an id its host issued to a child of it`;
   if (issuedClaim && noIssuedRecord(cwd, leadOf(claimed)) && host !== null && PLUGIN_UPDATE[host])
@@ -10522,10 +10550,10 @@ function sessionClaimRefusal(env, claimed, cwd) {
   const ownChildShell = host !== null && OWN_CHILD_SHELL.has(host);
   return {
     error,
-    unblock: ownChildShell ? `record the verdict from the verifier's own ${host === "pi" ? "Pi worker" : "OpenCode child session"} shell, where WORKIT_SESSION_ID is already set; never set WORKIT_SESSION_ID or --session by hand` : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session its SubagentStart context names, or pass --as verifier"
+    unblock: ownChildShell ? `record the verdict from the verifier's own ${host === "pi" ? "Pi worker" : "OpenCode child session"} shell, where WORKIT_SESSION_ID is already set; never set WORKIT_SESSION_ID or --session by hand` : "never name a session yourself: spawn a verifier or reviewer subagent and pass exactly the --session and --token its SubagentStart context names, or pass --as verifier"
   };
 }
-var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path6.join(resolveStateDir(), "issued"), safeList = (dir) => {
+var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "") ?? null, hash = (value) => createHash3("sha256").update(value).digest("hex").slice(0, 32), userIssuedRoot = () => path6.join(resolveStateDir(), "issued"), userTokenRoot = () => path6.join(resolveStateDir(), "issued-tokens"), safeList = (dir) => {
   try {
     return fs6.readdirSync(dir);
   } catch {
@@ -10544,12 +10572,26 @@ var HOST_SESSION_VARS, family = (host) => host?.replace(/_(?:cli|desktop)$/, "")
   } catch {
     return false;
   }
-}, PLUGIN_UPDATE, wasIssued = (cwd, lead, claimed) => {
+}, PLUGIN_UPDATE, tokenHash = (token) => createHash3("sha256").update(token).digest("hex"), issuedRecord = (cwd, claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return null;
   migrateRepoIssued(cwd);
   try {
-    return fs6.existsSync(path6.join(userIssuedRoot(), hash(lead), hash(claimed)));
+    return fs6.readFileSync(path6.join(userIssuedRoot(), hash(claimed.slice(0, cut)), hash(claimed)), "utf8");
   } catch {
-    return false;
+    return null;
+  }
+}, TOKEN_HASH, issuedToken = (claimed) => {
+  const cut = claimed.lastIndexOf(":");
+  if (cut <= 0)
+    return { stored: null, leadBound: false };
+  const dir = path6.join(userTokenRoot(), hash(claimed.slice(0, cut)));
+  try {
+    const text = fs6.readFileSync(path6.join(dir, hash(claimed)), "utf8");
+    return { stored: TOKEN_HASH.exec(text)?.[1] ?? null, leadBound: true };
+  } catch {
+    return { stored: null, leadBound: safeList(dir).length > 0 };
   }
 }, leadOf = (session) => session.slice(0, session.lastIndexOf(":")), OWN_CHILD_SHELL, HOST_SET_VARIABLE;
 var init_host_session = __esm(() => {
@@ -10567,6 +10609,7 @@ var init_host_session = __esm(() => {
     claude_code: "claude plugin marketplace update workit && claude plugin update workit@workit",
     codex: "codex plugin remove workit@workit && codex plugin add workit@workit"
   };
+  TOKEN_HASH = /^([0-9a-f]{64})$/mu;
   OWN_CHILD_SHELL = new Set(["opencode", "pi"]);
   HOST_SET_VARIABLE = {
     opencode: "OPENCODE_SESSION_ID",
@@ -10599,7 +10642,7 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 import fs7 from "node:fs";
 import { hostname } from "node:os";
 import path8 from "node:path";
-var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, defaultLockTimeoutMs = 250, defaultLockTimeout = () => defaultLockTimeoutMs, setDefaultLockTimeout = (ms) => {
+var metadataLockSchema, FOREIGN_LOCK_TTL_MS, UNREADABLE_LOCK_TTL_MS = 30000, RECLAIM_GUARD_TTL_MS = 30000, IN_PROCESS_LOCK_TIMEOUT_MS = 250, defaultLockTimeoutMs, defaultLockTimeout = () => defaultLockTimeoutMs, hostAwareLockTimeout = (cliMs) => defaultLockTimeoutMs > IN_PROCESS_LOCK_TIMEOUT_MS ? cliMs : IN_PROCESS_LOCK_TIMEOUT_MS, setDefaultLockTimeout = (ms) => {
   defaultLockTimeoutMs = ms;
 }, parseMetadataLock = (raw) => {
   let value;
@@ -10789,6 +10832,7 @@ var init_store_lock = __esm(() => {
     externalAction: literal(true).optional()
   }).strict();
   FOREIGN_LOCK_TTL_MS = 10 * 60000;
+  defaultLockTimeoutMs = IN_PROCESS_LOCK_TIMEOUT_MS;
   TASK_STORE_LOCK = { reclaimUnverifiedAfterTtl: true };
 });
 
@@ -14789,7 +14833,7 @@ var init_vcs_config = __esm(() => {
 
 // packages/workit-core/src/ledger.ts
 import { spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash9, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes3 } from "node:crypto";
 import fs12 from "node:fs";
 import path15 from "node:path";
 function resolveCommit(cwd, ref) {
@@ -14878,7 +14922,7 @@ function actorFromEnv(env) {
     agentId: value("WORKIT_AGENT_ID")
   };
 }
-function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
+function withLedgerLock(file, fn, waitMs = hostAwareLockTimeout(LOCK_WAIT_MS)) {
   const lock = `${file}.lock`;
   const deadline = Date.now() + waitMs;
   let token = null;
@@ -14902,8 +14946,10 @@ function withLedgerLock(file, fn, waitMs = LOCK_WAIT_MS) {
 }
 function appendLine(file, build, options) {
   const write = () => {
-    const fd = fs12.openSync(file, "a+");
+    const fd = fs12.openSync(file, "a+", 384);
     try {
+      if (process.platform !== "win32")
+        tighten(fd);
       const size = fs12.fstatSync(fd).size;
       let fence = "";
       if (size > 0) {
@@ -14982,7 +15028,9 @@ function readLedger(cwd, options = {}) {
   if (!file.ok)
     return file;
   let text = "";
+  let stat = null;
   try {
+    stat = fs12.statSync(file.value);
     text = fs12.readFileSync(file.value, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
@@ -15002,6 +15050,7 @@ function readLedger(cwd, options = {}) {
   const integrity = { chained: 0, legacy: 0, unverified: [] };
   const earlier = new Set([null]);
   let chainStarted = false;
+  const ids = new Set;
   for (const raw of text.split(`
 `)) {
     const trimmed = raw.trim();
@@ -15035,6 +15084,10 @@ function readLedger(cwd, options = {}) {
       reason = "unsigned";
     else
       rowIntegrity = "legacy";
+    if (options.integrity && !reason && ids.has(parsed.id))
+      reason = "duplicate_id";
+    if (options.integrity)
+      ids.add(parsed.id);
     if (reason)
       rowIntegrity = "unverified";
     const pr = typeof parsed.pr === "number" && Number.isInteger(parsed.pr) ? parsed.pr : undefined;
@@ -15058,7 +15111,8 @@ function readLedger(cwd, options = {}) {
       seq: rows.length + 1,
       superseded: false,
       supersedeIgnored: false,
-      ...rowIntegrity ? { integrity: rowIntegrity } : {}
+      ...rowIntegrity ? { integrity: rowIntegrity } : {},
+      ...reason ? { integrityReason: reason } : {}
     };
     rows.push(row);
     if (!options.integrity)
@@ -15086,18 +15140,44 @@ function readLedger(cwd, options = {}) {
   const byId = new Map;
   for (const row of rows) {
     const target = row.supersedes ? byId.get(row.supersedes) : undefined;
-    if (target && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
+    if (target && row.integrity !== "unverified" && supersedeAllowed(row, target, renameAwareBranch(scopeOf, row.branch)) === null)
       target.superseded = true;
     else if (row.supersedes)
       row.supersedeIgnored = true;
     if (!byId.has(row.id))
       byId.set(row.id, row);
   }
+  if (options.integrity && stat && Buffer.byteLength(text) === stat.size)
+    tamperCache.set(file.value, {
+      size: stat.size,
+      stamp: fileStamp(stat),
+      breaks: integrity.unverified.filter((row) => TAMPER_REASONS.has(row.reason))
+    });
   return {
     ok: true,
     value: { path: file.value, rows, skipped, integrity: options.integrity ? integrity : null }
   };
 }
+function ledgerTampering(cwd) {
+  const file = ledgerPath(cwd);
+  if (!file.ok)
+    return [];
+  try {
+    const stat = fs12.statSync(file.value);
+    const cached = tamperCache.get(file.value);
+    if (cached && cached.size === stat.size && cached.stamp === fileStamp(stat))
+      return cached.breaks;
+  } catch {
+    return [];
+  }
+  const read = readLedger(cwd, { integrity: true });
+  return read.ok ? (read.value.integrity?.unverified ?? []).filter((row) => TAMPER_REASONS.has(row.reason)) : [];
+}
+function tamperedUnblock(cwd) {
+  const file = ledgerPath(cwd);
+  const where = file.ok ? file.value : "the ledger file";
+  return `workit ledger verify-integrity  # lists the edited or missing rows; if the edit is understood, move ${where} aside (mv ${where} ${where}.tampered-<date>) and record the verdicts again`;
+}
 function filterRows(rows, filter) {
   const matched = rows.filter((row) => (filter.branch === undefined || row.branch === filter.branch) && (filter.pr === undefined || row.pr === filter.pr) && (filter.type === undefined || row.type === filter.type));
   return filter.last === undefined ? matched : matched.slice(Math.max(0, matched.length - filter.last));
@@ -15213,15 +15293,51 @@ function authorSessions(cwd, rows, branch, range = { base: null, head: null }, s
     sessions.add(session);
   return sessions;
 }
-function effectiveOf(rows, authors, sameCode, isCurrent) {
+function sessionTrust(cwd, row) {
+  const session = row.actor.session;
+  if (!session || row.self === true)
+    return null;
+  const source = typeof row.sessionSource === "string" ? row.sessionSource : "env";
+  const host = row.actor.host;
+  const issuedOnly = source === "flag" ? host !== "cli" : source === "env" && session.includes(":") && !SHELL_VOUCHED_HOSTS.has(host);
+  if (!issuedOnly)
+    return null;
+  const binding = issuedBinding(cwd, session);
+  if (binding === null)
+    return "unissued_session";
+  return binding === "token" && row.sessionBound !== true ? "unbound_session" : null;
+}
+function trustReasons(cwd, row) {
+  if (row.integrity === "unverified")
+    return [row.integrityReason ?? "unsigned"];
+  if (row.integrity !== "verified")
+    return ["unsigned"];
+  const session = sessionTrust(cwd, row);
+  return session ? [session] : [];
+}
+function withIntegrity(cwd, rows) {
+  if (rows.every((row) => row.integrity !== undefined))
+    return rows;
+  const read = readLedger(cwd, { integrity: true });
+  const bySeq = new Map(read.ok ? read.value.rows.map((row) => [row.seq, row]) : []);
+  return rows.map((row) => {
+    if (row.integrity !== undefined)
+      return row;
+    const fresh = bySeq.get(row.seq);
+    return fresh && fresh.id === row.id && fresh.at === row.at ? fresh : row;
+  });
+}
+function effectiveOf(rows, reasonsOf, sameCode, isCurrent) {
   let effective = null;
   for (const row of rows) {
     if (!effective) {
       effective = row;
       continue;
     }
-    const rowIndependent = independenceReasons(row, authors).length === 0;
-    const effIndependent = independenceReasons(effective, authors).length === 0;
+    if (untrusted(reasonsOf(row)) && !untrusted(reasonsOf(effective)))
+      continue;
+    const rowIndependent = reasonsOf(row).length === 0;
+    const effIndependent = reasonsOf(effective).length === 0;
     if (effIndependent && !rowIndependent && isCurrent(effective))
       continue;
     if (effIndependent && FAILING.has(String(effective.result)) && row.actor.session === effective.actor.session && sameCode(effective, row))
@@ -15235,7 +15351,7 @@ function restackCarries(rows, branch, from, to) {
     return false;
   const edges = new Map;
   for (const row of rows)
-    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
+    if (row.type === "stack.restacked" && row.observer === "workit_cli" && row.integrity === "verified" && row.branch === branch && row.patchEqual === true && typeof row.fromHead === "string" && row.head)
       edges.set(row.fromHead, [...edges.get(row.fromHead) ?? [], row.head]);
   const seen = new Set([from]);
   const queue = [from];
@@ -15251,7 +15367,8 @@ function restackCarries(rows, branch, from, to) {
   }
   return false;
 }
-function checkVerdicts(cwd, branch, rows) {
+function checkVerdicts(cwd, branch, ledgerRows) {
+  const rows = withIntegrity(cwd, ledgerRows);
   const head = branchHead(cwd, branch);
   const fallbackBase = defaultBase(cwd);
   const scope = branchScope(cwd, branch);
@@ -15281,21 +15398,47 @@ function checkVerdicts(cwd, branch, rows) {
     return verdictBasis(failed, { head: row.head, ...keys }) !== "stale" || restackCarries(rows, branch, failed.head, row.head);
   };
   const authors = authorSessions(cwd, rows, branch, { base: fallbackBase, head }, scope);
+  const failureAuthorCache = new Map;
+  const failureAuthors = (row) => {
+    let set = failureAuthorCache.get(row.seq);
+    if (!set) {
+      set = authorSessions(cwd, rows.filter((other) => other.integrity === "verified" && other.seq < row.seq), branch, { base: null, head: null }, scope);
+      failureAuthorCache.set(row.seq, set);
+    }
+    return set;
+  };
+  const reasonCache = new Map;
+  const reasonsOf = (row) => {
+    let reasons = reasonCache.get(row);
+    if (!reasons) {
+      const failing = FAILING.has(String(row.result));
+      reasons = [
+        ...trustReasons(cwd, row),
+        ...independenceReasons(row, failing ? failureAuthors(row) : authors)
+      ];
+      reasonCache.set(row, reasons);
+    }
+    return reasons;
+  };
+  const retired = new Set;
+  for (const row of rows)
+    if (row.type === "verdict" && row.supersedes && !row.supersedeIgnored && trustReasons(cwd, row).length === 0)
+      retired.add(row.supersedes);
   const byKind = new Map;
   for (const row of rows)
-    if (isLiveVerdict(row) && scope(row)) {
+    if (isLiveVerdict(row, retired) && scope(row)) {
       const kind = typeof row.kind === "string" ? row.kind : "review";
       byKind.set(kind, [...byKind.get(kind) ?? [], row]);
     }
   const verdicts = [];
   const warnings = [];
   for (const [kind, list] of byKind) {
-    const row = effectiveOf(list, authors, sameCode, (candidate) => basisOf(candidate) !== "stale");
+    const row = effectiveOf(list, reasonsOf, sameCode, (candidate) => basisOf(candidate) !== "stale");
     if (!row)
       continue;
     const basis = basisOf(row);
     const current = basis !== "stale";
-    const independence = independenceReasons(row, authors);
+    const independence = reasonsOf(row);
     const reasons = [
       ...current ? [] : ["stale"],
       ...PASSING.has(String(row.result)) ? [] : ["not_passing"],
@@ -15312,23 +15455,31 @@ function checkVerdicts(cwd, branch, rows) {
     });
     if (reasons.length === 0) {
       for (const later of list)
-        if (later.seq > row.seq && independenceReasons(later, authors).length > 0 && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
+        if (later.seq > row.seq && reasonsOf(later).length > 0 && !untrusted(reasonsOf(later)) && FAILING.has(String(later.result)) && basisOf(later) !== "stale")
           warnings.push(`the author's own (self) ${String(later.result)} ${kind} verdict ${later.id} by ${later.actor.session ?? "no session"} on the current code is newer than the accepted pass ${row.id}: read it before merging`);
     }
   }
   for (const row of rows)
     if (row.integrity === "unverified" && scope(row))
       warnings.push(`ledger row ${row.id} (${row.type}) on ${row.branch ?? branch} is unverified: the workit CLI did not write it or it changed afterwards (workit ledger verify-integrity)`);
+  const tampered = ledgerTampering(cwd);
+  if (tampered.length) {
+    warnings.push(tamperedWarning(cwd, tampered));
+    for (const entry of verdicts) {
+      entry.accepted = false;
+      entry.reasons = [...entry.reasons, "ledger_tampered"];
+    }
+  }
   verdicts.sort((a, b) => a.verdict.seq - b.verdict.seq);
   const newestCurrent = verdicts.findLast((entry) => entry.current) ?? verdicts.at(-1) ?? null;
   const failing = verdicts.find((entry) => entry.current && entry.independent && FAILING.has(String(entry.verdict.result)));
   const newestAccepted = verdicts.findLast((entry) => entry.accepted && STRONG_RESULTS.has(String(entry.verdict.result))) ?? null;
-  const accepted = newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
+  const accepted = tampered.length ? { accepted: false, verdict: null, reasons: ["ledger_tampered"] } : newestAccepted && !failing ? { accepted: true, verdict: newestAccepted.verdict, reasons: [] } : {
     accepted: false,
     verdict: failing?.verdict ?? null,
     reasons: failing ? ["failing_verdict"] : !newestCurrent ? ["no_verdict"] : newestCurrent.reasons.length ? newestCurrent.reasons : ["type_check_only"]
   };
-  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && STRONG_RESULTS.has(String(entry.verdict.result)));
+  const selfEntry = failing ? undefined : verdicts.findLast((entry) => entry.current && !entry.independent && !untrusted(entry.reasons) && STRONG_RESULTS.has(String(entry.verdict.result)));
   return {
     branch,
     head,
@@ -15523,6 +15674,7 @@ function recordVerdict(context, input) {
     self: self2,
     selfReason,
     sessionSource: context.sessionSource ?? "env",
+    ...context.sessionBound === true ? { sessionBound: true } : {},
     evidenceRefs: input.evidenceRefs ?? []
   }, { now: context.now });
 }
@@ -15751,7 +15903,7 @@ var LEDGER_VERSION = 1, MAX_LINE_BYTES = 4096, VERDICT_RESULTS, PASSING, FAILING
   } catch {
     return null;
   }
-}, newId2 = () => `${Date.now().toString(36)}-${randomBytes2(6).toString("hex")}`, NETWORK_FS_TYPES, isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0), onNetworkFs = (dir) => {
+}, newId2 = () => `${Date.now().toString(36)}-${randomBytes3(6).toString("hex")}`, NETWORK_FS_TYPES, isNetworkFsType = (type) => NETWORK_FS_TYPES.has(type >>> 0), onNetworkFs = (dir) => {
   if (process.platform !== "linux")
     return false;
   try {
@@ -15804,6 +15956,11 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
       return text || null;
   }
   return null;
+}, tighten = (fd) => {
+  try {
+    if ((fs12.fstatSync(fd).mode & 63) !== 0)
+      fs12.fchmodSync(fd, 384);
+  } catch {}
 }, sealed = (row, id, at, previous) => {
   const { prevHash: _prev, rowHash: _row, ...fields } = row;
   const prevHash = previous === null ? null : sha2562(previous);
@@ -15818,7 +15975,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
     session: str2(actor.session),
     agentId: str2(actor.agentId)
   };
-}, isLiveVerdict = (row) => row.type === "verdict" && typeof row.result === "string" && !row.superseded, RENAMED, renameAwareBranch = (scopeOf, branch) => {
+}, TAMPER_REASONS, tamperCache, fileStamp = (stat) => `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}`, tamperedWarning = (cwd, breaks) => `the ledger was edited, or a row was removed or moved (${breaks.slice(0, 3).map((row) => `${row.reason} at row ${row.seq}`).join(", ")}${breaks.length > 3 ? ", …" : ""}): no verdict is accepted until it is repaired. ${tamperedUnblock(cwd)}`, isLiveVerdict = (row, retired) => row.type === "verdict" && typeof row.result === "string" && !retired.has(row.id), RENAMED, renameAwareBranch = (scopeOf, branch) => {
   return (target) => {
     const own = typeof branch === "string" ? branch : null;
     const theirs = typeof target.branch === "string" ? target.branch : null;
@@ -15835,7 +15992,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
     if (derivesFrom(author, session) || derivesFrom(session, author))
       return true;
   return false;
-}, independenceReasons = (row, authors) => {
+}, TRUST_REASONS, SHELL_VOUCHED_HOSTS, untrusted = (reasons) => reasons.some((reason) => TRUST_REASONS.has(reason)), independenceReasons = (row, authors) => {
   const reasons = [];
   if (!row.actor.session)
     reasons.push("no_session");
@@ -15897,6 +16054,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
   return brief.pr === null ? "workit pr create" : `workit pr status --pr ${brief.pr}`;
 };
 var init_ledger = __esm(() => {
+  init_store_lock();
   init_vcs_config();
   init_rev();
   init_host_session();
@@ -15935,14 +16093,14 @@ var init_ledger = __esm(() => {
           return null;
         throw error;
       }
-      const token = `${process.pid}-${randomBytes2(8).toString("hex")}`;
+      const token = `${process.pid}-${randomBytes3(8).toString("hex")}`;
       fs12.writeFileSync(path15.join(lock, LOCK_OWNER), token);
       return token;
     },
     release(lock, token) {
       if (lockToken(lock) !== token)
         return false;
-      const tomb = `${lock}.release-${randomBytes2(6).toString("hex")}`;
+      const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
       try {
         fs12.renameSync(lock, tomb);
       } catch {
@@ -15959,7 +16117,7 @@ var init_ledger = __esm(() => {
     },
     token: lockToken,
     reap(lock, observed) {
-      const tomb = `${lock}.reap-${randomBytes2(6).toString("hex")}`;
+      const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
       try {
         fs12.renameSync(lock, tomb);
       } catch {
@@ -15978,7 +16136,24 @@ var init_ledger = __esm(() => {
     }
   };
   TAIL_BYTES = 64 * 1024;
+  TAMPER_REASONS = new Set(["hash_mismatch", "broken_link"]);
+  tamperCache = new Map;
   RENAMED = /^branch: renamed refs\/heads\/(.+) to refs\/heads\/(.+)$/iu;
+  TRUST_REASONS = new Set([
+    "unsigned",
+    "hash_mismatch",
+    "broken_link",
+    "duplicate_id",
+    "unissued_session",
+    "unbound_session"
+  ]);
+  SHELL_VOUCHED_HOSTS = new Set([
+    "cli",
+    "opencode",
+    "pi",
+    "codex_cli",
+    "codex_desktop"
+  ]);
   OBSERVED_ONLY = new Set([
     "check",
     "merge.unverified",
@@ -63713,7 +63888,8 @@ var init_changelog = __esm(() => {
 });
 
 // packages/workit-core/src/core/hygiene.ts
-import { existsSync as existsSync9, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import { spawnSync as spawnSync12 } from "node:child_process";
+import { existsSync as existsSync9, readFileSync as readFileSync9, readdirSync as readdirSync5, writeFileSync as writeFileSync4 } from "node:fs";
 import path26 from "node:path";
 var repoRoot2, templatesDir = () => path26.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
   if (!existsSync9(path26.join(root, "package.json")))
@@ -63743,6 +63919,23 @@ var repoRoot2, templatesDir = () => path26.join(repoRoot2, "templates", "hygiene
     }
   }
   return "";
+}, projectTarget = (dir) => {
+  const start = path26.resolve(dir);
+  const top = spawnSync12("git", ["rev-parse", "--show-toplevel"], { cwd: start, encoding: "utf8" });
+  const root = top.status === 0 ? (top.stdout ?? "").trim() : "";
+  if (root)
+    return { ok: true, root: path26.resolve(root) };
+  let children = [];
+  try {
+    children = readdirSync5(start, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync9(path26.join(start, entry.name, ".git"))).map((entry) => path26.join(start, entry.name)).toSorted();
+  } catch {
+    children = [];
+  }
+  const where = children.length > 0 ? `run it inside one of its repositories: ${children.slice(0, 5).map((child) => `cd ${child}`).join(", ")}${children.length > 5 ? ` (+${children.length - 5} more)` : ""}` : "cd <repo> (or git init here) and run workit init again";
+  return {
+    ok: false,
+    refused: `${start} is not a git repository, so no project files were added there; ${where}`
+  };
 }, planHygieneFiles = (root, opts = {}) => {
   const openSource = opts.includeOpenSource ?? isOpenSource(root);
   const files = ["CHANGELOG.md", "README.md", ".editorconfig", ".gitattributes"];
@@ -63967,13 +64160,13 @@ var init_support_matrix = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/host-install.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 import {
   accessSync,
   constants as constants2,
   existsSync as existsSync11,
   readFileSync as readFileSync11,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync6,
   realpathSync as realpathSync6,
   statSync as statSync2
 } from "node:fs";
@@ -64016,7 +64209,7 @@ function findHostExecutable(name, options = {}) {
     [path29.join(home, ".nvm", "versions", "node"), "bin"]
   ]) {
     try {
-      for (const entry of readdirSync5(base, { withFileTypes: true })) {
+      for (const entry of readdirSync6(base, { withFileTypes: true })) {
         if (entry.isDirectory())
           dirs.push(path29.join(base, entry.name, tail));
       }
@@ -64238,7 +64431,7 @@ function runHostCommand(step, context = {}) {
       stderr: `Cannot safely execute batch shim ${step.command}; resolve its Node.js CLI entrypoint and retry`
     };
   }
-  const result = spawnSync12(step.command, step.args, {
+  const result = spawnSync13(step.command, step.args, {
     cwd: step.cwd,
     env: (() => {
       const home = context.home ?? context.env?.HOME ?? os7.homedir();
@@ -64292,6 +64485,40 @@ var resolveWindowsShimScript = (shim) => {
   } catch {
     return false;
   }
+}, OPENCODE_PLUGIN_SCOPE = "@brainervirus", OPENCODE_PLUGIN_NAME = "workit-opencode", packageVersionAt = (root, name) => {
+  try {
+    const pkg = JSON.parse(readFileSync11(path29.join(root, "package.json"), "utf8"));
+    return pkg.name === name && typeof pkg.version === "string" ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}, compareVersions = (a, b) => {
+  const pa = a.split(/[.+-]/).map((n) => Number(n) || 0);
+  const pb = b.split(/[.+-]/).map((n) => Number(n) || 0);
+  for (let i = 0;i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0)
+      return d;
+  }
+  return 0;
+}, openCodeCacheDir = (home, env = process.env) => path29.join(env.XDG_CACHE_HOME || path29.join(home, ".cache"), "opencode"), subdirs = (dir) => {
+  try {
+    return readdirSync6(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path29.join(dir, entry.name));
+  } catch {
+    return [];
+  }
+}, openCodeInstalledPlugin = (home, env = process.env) => {
+  const name = `${OPENCODE_PLUGIN_SCOPE}/${OPENCODE_PLUGIN_NAME}`;
+  const cache = openCodeCacheDir(home, env);
+  const specDirs = (layout) => subdirs(path29.join(cache, layout, OPENCODE_PLUGIN_SCOPE)).filter((dir) => path29.basename(dir) === `${OPENCODE_PLUGIN_NAME}@latest`);
+  const installs = [...specDirs("npm").flatMap(subdirs), ...specDirs("packages")].map((dir) => path29.join(dir, "node_modules", OPENCODE_PLUGIN_SCOPE, OPENCODE_PLUGIN_NAME));
+  let best = null;
+  for (const root of installs) {
+    const version = packageVersionAt(root, name);
+    if (version && (!best || compareVersions(version, best.version) > 0))
+      best = { root, version };
+  }
+  return best;
 }, isCanonicalCodexPackage = (root) => {
   for (const file of [
     path29.join(root, ".codex-plugin", "plugin.json"),
@@ -64311,7 +64538,7 @@ var resolveWindowsShimScript = (shim) => {
     if (isCanonicalCodexPackage(root))
       return true;
     try {
-      return readdirSync5(root, { withFileTypes: true }).some((entry) => entry.isDirectory() && isCanonicalCodexPackage(path29.join(root, entry.name)));
+      return readdirSync6(root, { withFileTypes: true }).some((entry) => entry.isDirectory() && isCanonicalCodexPackage(path29.join(root, entry.name)));
     } catch {
       return false;
     }
@@ -64320,7 +64547,7 @@ var resolveWindowsShimScript = (shim) => {
     return true;
   const root = path29.join(codexHome, "plugins", "cache");
   try {
-    for (const marketplace of readdirSync5(root, { withFileTypes: true })) {
+    for (const marketplace of readdirSync6(root, { withFileTypes: true })) {
       if (!marketplace.isDirectory())
         continue;
       if (isPackageOrVersionDirectory(path29.join(root, marketplace.name, "workit")))
@@ -64398,9 +64625,9 @@ var init_host_install = __esm(() => {
 });
 
 // packages/workit-core/src/core/skill-manifests.ts
-import { cpSync as cpSync3, existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { cpSync as cpSync3, existsSync as existsSync12, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import path30 from "node:path";
-var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? readdirSync6(root).filter((name) => existsSync12(path30.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
+var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? readdirSync7(root).filter((name) => existsSync12(path30.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
   const missing = expected.filter((name) => !actual.includes(name));
   const extra = actual.filter((name) => !expected.includes(name));
@@ -64412,7 +64639,7 @@ var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? re
   const pending = [path30.join(pluginDir, "skills")];
   while (pending.length > 0) {
     const dir = pending.pop();
-    for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync7(dir, { withFileTypes: true })) {
       const file = path30.join(dir, entry.name);
       if (entry.isDirectory())
         pending.push(file);
@@ -64443,7 +64670,7 @@ var init_skill_manifests = __esm(() => {
 });
 
 // packages/workit-core/src/git/session-hook.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
+import { spawnSync as spawnSync14 } from "node:child_process";
 import {
   chmodSync,
   existsSync as existsSync13,
@@ -64638,7 +64865,7 @@ add_trailer "$(git rev-parse --git-path COMMIT_EDITMSG)"
 [ "$2" != merge ] || add_trailer "$(git rev-parse --git-path MERGE_MSG)"
 exit 0
 `, manualTrailerLine = () => `h="$(git rev-parse --git-common-dir 2>/dev/null)/${HELPER.join("/")}"; [ ! -f "$h" ] || sh "$h" "$@" || true`, lefthookTrailerRun = () => `set -f; IFS=; h=$(git rev-parse --git-common-dir 2>/dev/null)/${HELPER.join("/")}; [ ! -f $h ] || sh $h '' {2} {3} || true`, HELPER_REF, SESSION_HOOK_SCRIPT, run2 = (cwd, args, env) => {
-  const r = spawnSync13("git", args, {
+  const r = spawnSync14("git", args, {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -64799,14 +65026,14 @@ ${manualTrailerLine()}
 });
 
 // packages/workit-cli/src/admin/doctor.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
+import { spawnSync as spawnSync15 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import {
   existsSync as existsSync14,
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync6,
   mkdtempSync,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync8,
   readFileSync as readFileSync14,
   readlinkSync as readlinkSync2,
   rmSync as rmSync3,
@@ -64832,7 +65059,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path32.join(home, ".config", "workit");
   const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path32.join(home, ".local", "state", "workit");
   const cwd = options.cwd ?? process.cwd();
-  const dev = options.dev ?? env.WORKFLOW_TOOLKIT_DEV ?? findDevFromCwd(cwd);
+  const dev = options.dev?.trim() || env.WORKFLOW_TOOLKIT_DEV?.trim() || findDevFromCwd(cwd);
   return {
     host: options.host ?? "cli",
     home,
@@ -64842,7 +65069,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     workspaceRoot: options.workspaceRoot ?? env.WORKFLOW_WORKSPACE_ROOT ?? cwd,
     dev,
     opencodeConfig: options.opencodeConfig ?? path32.join(home, ".config", "opencode", "opencode.json"),
-    opencodePackageCacheDir: options.opencodePackageCacheDir ?? path32.join(home, ".cache", "opencode", "packages", "@brainervirus", "workit-opencode@latest"),
+    opencodePackageCacheDir: options.opencodePackageCacheDir ?? null,
     cursorSettings: options.cursorSettings ?? path32.join(home, ".cursor", "settings.json"),
     cursorMcp: options.cursorMcp ?? path32.join(home, ".cursor", "mcp.json"),
     cursorPluginDir: options.cursorPluginDir ?? path32.join(home, ".cursor", "plugins", "local", "workit"),
@@ -64888,7 +65115,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return null;
 }, versionOf = (bin, env, timeout) => {
-  const r = spawnSync14(bin, ["--version"], { encoding: "utf8", env, timeout });
+  const r = spawnSync15(bin, ["--version"], { encoding: "utf8", env, timeout });
   if (r.error)
     return null;
   return (r.stdout ?? "").trim();
@@ -64906,7 +65133,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (env.BUN && existsSync14(env.BUN))
     return env.BUN;
   for (const candidate of [
-    path32.join(os8.homedir(), ".bun/bin/bun"),
+    path32.join(env.HOME || os8.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
@@ -64915,47 +65142,50 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return commandOnPath("bun", env) ? "bun" : null;
 }, checkRuntime = (res) => {
-  const node = versionOf("node", res.env);
-  const nodeOk = node !== null && semverAtLeast(node, SUPPORT_MATRIX.node.minimum);
+  const running = `v${process.versions.node}`;
+  const runningOk = semverAtLeast(running, SUPPORT_MATRIX.node.minimum);
+  const pathNode = versionOf("node", res.env);
   const bun = resolveBun(res.env);
   const bunVersion = bun ? versionOf(bun, res.env) : null;
   const bunOk = bunVersion !== null;
   const needsBun = res.dev !== null;
-  if (!nodeOk) {
+  if (!runningOk) {
     return {
       id: "runtime",
       status: "fail",
-      detail: `node ${SUPPORT_MATRIX.node.minimum}+ required (found ${node ?? "none on PATH"})`,
+      detail: `node ${SUPPORT_MATRIX.node.minimum}+ required (workit runs under ${running} at ${process.execPath})`,
       fix: `Install Node ${SUPPORT_MATRIX.node.minimum}+ (declared support: ${SUPPORT_MATRIX.node.minimum}/current)`
     };
   }
-  if (!bunOk && needsBun) {
+  const pathNote = pathNode !== null && pathNode !== running ? `; node on PATH is ${pathNode}${semverAtLeast(pathNode, SUPPORT_MATRIX.node.minimum) ? "" : ` (below ${SUPPORT_MATRIX.node.minimum}; it does not run this CLI)`}` : "";
+  if (pathNode === null) {
     return {
       id: "runtime",
-      status: "fail",
-      detail: `bun not found on PATH (dev checkout requires the pinned toolchain ${SUPPORT_MATRIX.bun})`,
-      fix: `Install bun ${SUPPORT_MATRIX.bun} (curl -fsSL https://bun.sh/install | bash)`
+      status: "warn",
+      detail: `workit runs under node ${running}, but no node is on PATH for host hooks`,
+      fix: `Put Node ${SUPPORT_MATRIX.node.minimum}+ on PATH (host hooks launch \`node\`)`
     };
   }
-  if (!bunOk) {
+  if (!bunOk && needsBun) {
     return {
       id: "runtime",
-      status: "warn",
-      detail: "bun not found on PATH — not required for published artifacts",
-      fix: "Install bun for development/installer use"
+      status: "fail",
+      detail: `bun not found on PATH (dev checkout requires the pinned toolchain ${SUPPORT_MATRIX.bun})`,
+      fix: `Install bun ${SUPPORT_MATRIX.bun} (curl -fsSL https://bun.sh/install | bash)`
     };
   }
+  const pathOld = !semverAtLeast(pathNode, SUPPORT_MATRIX.node.minimum);
   return {
     id: "runtime",
-    status: "pass",
-    detail: `node ${node} (>=${SUPPORT_MATRIX.node.minimum}), bun ${bunVersion ?? "n/a"}`
+    status: bunOk && !pathOld ? "pass" : "info",
+    detail: `node ${running} (>=${SUPPORT_MATRIX.node.minimum})${pathNote}, ${bunOk ? `bun ${bunVersion}` : "no bun (needed only for a dev checkout)"}`
   };
 }, checkVersions = (res) => {
   if (!res.dev) {
     return {
       id: "versions",
-      status: "warn",
-      detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping version parity"
+      status: "info",
+      detail: "installed package, not a dev checkout — version parity applies to checkouts only"
     };
   }
   const corePkg = readJson(path32.join(res.dev, "packages/workit-core/package.json"));
@@ -64969,7 +65199,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
     const pkg = readJson(path32.join(res.dev, "packages", name, "package.json"));
-    const dep = pkg?.dependencies?.["@brainervirus/workit-core"];
+    const dep = pkg?.dependencies?.["@brainervirus/workit-core"] ?? pkg?.devDependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
   }
@@ -65066,10 +65296,16 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: `codex CLI ${installed} matches the qualified pin`
     };
+  if (semverAtLeast(installed, qualified))
+    return {
+      id: "codex_pin",
+      status: "info",
+      detail: `codex CLI ${installed} is newer than the qualified ${qualified}`
+    };
   return {
     id: "codex_pin",
     status: "warn",
-    detail: `codex CLI ${installed} differs from the qualified ${qualified}`,
+    detail: `codex CLI ${installed} is older than the qualified ${qualified}`,
     fix: `Reinstall the qualified Codex CLI ${qualified} or record fresh qualification evidence`
   };
 }, readTomlTables = (file) => {
@@ -65126,7 +65362,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     const dir = path32.join(codexHome, "plugins", "cache", marketplace, "workit");
     let versions = [];
     try {
-      versions = readdirSync7(dir).filter((v) => existsSync14(path32.join(dir, v, ".codex-plugin")));
+      versions = readdirSync8(dir).filter((v) => existsSync14(path32.join(dir, v, ".codex-plugin")));
     } catch {
       versions = [];
     }
@@ -65235,7 +65471,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const installed = [];
   for (const install of installs) {
     const source = install.root ? path32.join(install.root, "agents") : null;
-    const files = source && existsSync14(source) ? readdirSync7(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
+    const files = source && existsSync14(source) ? readdirSync8(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
     if (files.length === 0) {
       problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
       fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
@@ -65463,8 +65699,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     if (!dev && res.host === "opencode") {
       return {
         id: "assets",
-        status: "warn",
-        detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping asset check"
+        status: "info",
+        detail: "installed package — OpenCode loads the published assets, no checkout to compare"
       };
     }
     return {
@@ -65499,7 +65735,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 `)) {
       return false;
     }
-    return spawnSync14(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
+    return spawnSync15(runtime, ["--check", entry], { encoding: "utf8", env }).status === 0;
   } catch {
     return false;
   }
@@ -65589,8 +65825,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!dev && res.host !== "cursor") {
     return {
       id: "launcher",
-      status: "warn",
-      detail: "no dev checkout found (WORKFLOW_TOOLKIT_DEV) — skipping non-Cursor launcher checks"
+      status: "info",
+      detail: "installed package — non-Cursor launchers ship inside each host plugin, no checkout to check"
     };
   }
   return {
@@ -65630,7 +65866,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh (or `workit init` with Cursor) to rewrite the hook entries"
     };
   const started = performance.now();
-  const probe = spawnSync14("node", [launcher, "--probe", "workit-cursor-hook"], {
+  const probe = spawnSync15("node", [launcher, "--probe", "workit-cursor-hook"], {
     encoding: "utf8",
     env: { ...res.env, WORKIT_CURSOR_HOOK_NPX_OFFLINE: "1" },
     timeout: 40000,
@@ -65699,18 +65935,18 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Install git and ensure it is on PATH"
     };
   }
-  if (process.platform !== "win32" && !commandOnPath("flock", res.env)) {
+  if (res.dev && process.platform !== "win32" && !commandOnPath("flock", res.env)) {
     return {
       id: "utility",
       status: "warn",
-      detail: "flock (util-linux) not found — sync-runtime requires it for locking",
-      fix: "Install util-linux (flock)"
+      detail: "flock not found — the dev checkout's sync-runtime requires it for locking",
+      fix: process.platform === "darwin" ? "brew install flock (Homebrew's util-linux is keg-only and leaves flock off PATH)" : "Install util-linux (flock)"
     };
   }
   return {
     id: "utility",
     status: "pass",
-    detail: "git (and flock where required) on PATH"
+    detail: res.dev ? "git and flock on PATH" : "git on PATH"
   };
 }, isFragileCachePin = (entry) => {
   const n = entry.replaceAll("\\", "/").toLowerCase();
@@ -65804,7 +66040,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!cmd)
     return null;
   try {
-    const r = spawnSync14(cmd, ["view", pkgName, "version"], {
+    const r = spawnSync15(cmd, ["view", pkgName, "version"], {
       encoding: "utf8",
       timeout: 20000,
       env: res.env
@@ -65817,9 +66053,18 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, installedPluginVersion = (res) => {
   const pkg = readJson(path32.join(res.cursorPluginDir, "package.json"));
   return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
-}, installedOpenCodeCacheVersion = (res) => {
-  const pkg = readJson(path32.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
-  return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
+}, installedOpenCodeCache = (res) => {
+  if (res.opencodePackageCacheDir !== null) {
+    const pkg = readJson(path32.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
+    return typeof pkg?.version === "string" && pkg.version ? { version: pkg.version, dir: res.opencodePackageCacheDir } : null;
+  }
+  const found = openCodeInstalledPlugin(res.home, res.env);
+  if (!found)
+    return null;
+  let dir = path32.dirname(path32.dirname(path32.dirname(found.root)));
+  if (path32.basename(dir) !== "workit-opencode@latest")
+    dir = path32.dirname(dir);
+  return { version: found.version, dir };
 }, checkOpenCodePackageCache = (res) => {
   if (!existsSync14(res.opencodeConfig)) {
     return {
@@ -65851,8 +66096,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `opencode pin ${pin} is an exact version — not compared to registry latest`
     };
   }
-  const installed = installedOpenCodeCacheVersion(res);
-  if (installed === null) {
+  const cache = installedOpenCodeCache(res);
+  const installed = cache?.version ?? null;
+  if (cache === null || installed === null) {
     return {
       id: "stale_install",
       status: "pass",
@@ -65866,7 +66112,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "warn",
       registryProbed: true,
       detail: "registry_unreachable: cannot compare OpenCode @latest cache against published workit-opencode",
-      fix: `Retry when npm is reachable, or remove ${res.opencodePackageCacheDir} and restart OpenCode to re-resolve`
+      fix: `Retry when npm is reachable, or remove ${cache.dir} and restart OpenCode to re-resolve`
     };
   }
   if (!semverAtLeast(installed, expected)) {
@@ -65875,7 +66121,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "fail",
       registryProbed: true,
       detail: `stale_install: OpenCode @latest cache has workit-opencode ${installed} behind published ${expected}`,
-      fix: `Remove ${res.opencodePackageCacheDir} and restart OpenCode — it re-resolves @latest on the next launch`
+      fix: `Remove ${cache.dir} and restart OpenCode — it re-resolves @latest on the next launch`
     };
   }
   return {
@@ -66344,7 +66590,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, defaultIdentityProbes = (env) => ({
   origin: (cwd) => {
     try {
-      const out = spawnSync14("git", ["remote", "get-url", "origin"], {
+      const out = spawnSync15("git", ["remote", "get-url", "origin"], {
         cwd,
         encoding: "utf8",
         env
@@ -66356,7 +66602,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync14("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync15("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -66365,7 +66611,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   glabLogin: (e) => {
     try {
-      const out = spawnSync14("glab", ["api", "user", "--jq", ".username"], {
+      const out = spawnSync15("glab", ["api", "user", "--jq", ".username"], {
         encoding: "utf8",
         env: e
       });
@@ -66377,7 +66623,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   sshLogin: (host) => {
     try {
-      const out = spawnSync14("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
+      const out = spawnSync15("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "-T", `git@${host}`], {
         encoding: "utf8",
         env
       });
@@ -66534,10 +66780,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: repair,
     registryProbed
   };
-}, HOOK_ISSUED_MARKER = "workit-issued-sessions/2", hookRecordsIssued = (root) => {
+}, HOOK_ISSUED_MARKER = "workit-issued-sessions/3", hookRecordsIssued = (root) => {
   let files;
   try {
-    files = readdirSync7(path32.join(root, "dist")).filter((f) => f.endsWith(".js"));
+    files = readdirSync8(path32.join(root, "dist")).filter((f) => f.endsWith(".js"));
   } catch {
     return null;
   }
@@ -66596,12 +66842,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (cached)
     return cached;
   const viaShell = process.platform === "win32" && /\.(?:cmd|bat)$/i.test(bin);
-  const r = viaShell ? spawnSync14(`"${bin}" --version`, {
+  const r = viaShell ? spawnSync15(`"${bin}" --version`, {
     encoding: "utf8",
     env,
     timeout: WORKIT_PROBE_TIMEOUT_MS,
     shell: true
-  }) : spawnSync14(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
+  }) : spawnSync15(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
   const timedOut = r.error !== undefined && "code" in r.error && r.error.code === "ETIMEDOUT";
   const version = r.status === 0 ? (r.stdout ?? "").match(SEMVER)?.[0] ?? null : null;
   const probe = { version: timedOut ? null : version, timedOut };
@@ -66614,7 +66860,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       version: i.version
     })),
     { label: "Cursor plugin", version: installedPluginVersion(res) },
-    { label: "OpenCode plugin", version: installedOpenCodeCacheVersion(res) }
+    { label: "OpenCode plugin", version: installedOpenCodeCache(res)?.version ?? null }
   ].filter((p) => p.version !== null);
   const newest = plugins.reduce((best, p) => best && semverAtLeast(best.version, p.version) ? best : p, null);
   const target = newest?.version ?? "latest";
@@ -66655,7 +66901,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   } : c) : raw;
   const failed = checks.filter((c) => c.status === "fail").length;
   const warned = checks.filter((c) => c.status === "warn").length;
-  const passed = checks.filter((c) => c.status === "pass").length;
+  const passed = checks.filter((c) => c.status === "pass" || c.status === "info").length;
   const exitCode = failed > 0 ? 1 : 0;
   const offline = !raw.some((c) => ("registryProbed" in c) && c.registryProbed);
   const report = {
@@ -66746,13 +66992,14 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync15,
-  readdirSync as readdirSync8,
+  readdirSync as readdirSync9,
   realpathSync as realpathSync7,
   renameSync as renameSync4,
   rmSync as rmSync4,
   statSync as statSync6,
   writeFileSync as writeFileSync8
 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
 import os9 from "node:os";
 import path33 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
@@ -66789,6 +67036,7 @@ function buildSetupPreview(values, opts = {}) {
   const blocked = [];
   const mutations = [];
   const preserved = [];
+  let projectRefused;
   const overrides = activeSetupOverrides(env);
   for (const entry of [state.config, state.youtrack, state.vcs, state.workspaces]) {
     if (entry.status === "malformed")
@@ -66911,8 +67159,11 @@ function buildSetupPreview(values, opts = {}) {
         }
       }
     }
-    if (values.applyProject) {
-      const root = path33.resolve(opts.cwd ?? process.cwd());
+    const target = values.applyProject ? projectTarget(opts.cwd ?? process.cwd()) : null;
+    if (target && !target.ok)
+      projectRefused = target.refused;
+    if (target?.ok) {
+      const root = target.root;
       const gitignorePath = path33.join(root, ".gitignore");
       const existing = existsSync15(gitignorePath) ? readFileSync15(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
@@ -66931,7 +67182,8 @@ function buildSetupPreview(values, opts = {}) {
     overrides,
     preserved,
     platforms: values.platforms ?? [],
-    state
+    state,
+    ...projectRefused === undefined ? {} : { projectRefused }
   };
 }
 function resolveApply(preview, options) {
@@ -67114,7 +67366,14 @@ function adapterRoot(platform, res, preferInstalledAdapter = false) {
   if (res.dev) {
     candidates.push(path33.join(res.dev, "packages", `workit-${platform}`));
   } else {
-    candidates.push(path33.join(packageRoot(), "..", `workit-${platform}`));
+    candidates.push(...nodeResolvedAdapters(platform));
+    if (platform === "cursor")
+      candidates.push(stagedCursor);
+    if (platform === "opencode") {
+      const cached = openCodeInstalledPlugin(res.home, res.env);
+      if (cached)
+        candidates.push(cached.root);
+    }
     let dir = path33.resolve(res.cwd);
     while (true) {
       candidates.push(path33.join(dir, "packages", `workit-${platform}`));
@@ -67124,17 +67383,14 @@ function adapterRoot(platform, res, preferInstalledAdapter = false) {
       dir = parent;
     }
   }
-  candidates.push(path33.join(res.home, ".local", "share", "workit", "packages", `workit-${platform}`));
-  if (platform === "cursor")
-    candidates.push(stagedCursor);
   for (const candidate of candidates) {
     if (isAdapter(candidate, platform))
-      return candidate;
+      return realRoot(candidate);
   }
   return null;
 }
 function applyOpenCode(root, res) {
-  const resolvedPin = opencodePin(root, res);
+  const resolvedPin = root === null ? OPENCODE_NPM_PIN : opencodePin(root, res);
   if (!resolvedPin) {
     return {
       platform: "opencode",
@@ -67433,6 +67689,10 @@ function applySetupPreview(preview, options = {}) {
       root = adapterRoot(platform, res, options.preferInstalledAdapter);
       rootFor.set(platform, root);
     }
+    if (root === null && registersNpmPin(platform, res)) {
+      entries.push(applyOpenCode(null, res));
+      continue;
+    }
     if (root === null) {
       entries.push({
         platform,
@@ -67474,12 +67734,20 @@ function applySetupPreview(preview, options = {}) {
       detail: "existing credential preserved"
     });
   }
+  if (preview.projectRefused) {
+    entries.push({
+      platform: "core",
+      file: path33.resolve(res.cwd),
+      status: "Skipped",
+      detail: preview.projectRefused
+    });
+  }
   const doctor = [];
   for (const platform of preview.platforms) {
     if (platform !== "opencode" && platform !== "cursor")
       continue;
     const root = rootFor.get(platform);
-    if (root === null || root === undefined)
+    if (root === undefined || root === null && !registersNpmPin(platform, res))
       continue;
     if (!entries.some((e) => e.platform === platform && e.status !== "Failed"))
       continue;
@@ -67608,6 +67876,16 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   } catch {
     return false;
   }
+}, nodeResolvedAdapters = (platform) => {
+  const name = `@brainervirus/workit-${platform}`;
+  const require2 = createRequire2(path33.join(packageRoot(), "package.json"));
+  return (require2.resolve.paths(name) ?? []).map((dir) => path33.join(dir, name));
+}, realRoot = (root) => {
+  try {
+    return realpathSync7(root);
+  } catch {
+    return root;
+  }
 }, isDevOpenCodeAdapterRoot = (root, dev) => {
   if (dev)
     return true;
@@ -67622,7 +67900,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
       return `file://${entry}`;
   }
   return null;
-}, opencodePin = (root, res) => resolveOpenCodePin(root, { dev: res.dev }), CURSOR_HOOKS_FILE, localizedCursorHooks = (shipped, pluginDir) => {
+}, opencodePin = (root, res) => resolveOpenCodePin(root, { dev: res.dev }), registersNpmPin = (platform, res) => platform === "opencode" && !res.dev, CURSOR_HOOKS_FILE, localizedCursorHooks = (shipped, pluginDir) => {
   try {
     const merged = mergeCursorHooks(JSON.parse(shipped.toString("utf8")), { command: cursorHooksEntry(pluginDir).command }, pluginDir);
     return Buffer.from(`${JSON.stringify(merged.config, null, 2)}
@@ -67632,7 +67910,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, samePluginContent = (src, dest, pluginDir, relative = "") => {
   try {
-    for (const entry of readdirSync8(src, { withFileTypes: true })) {
+    for (const entry of readdirSync9(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
       const source = path33.join(src, entry.name);
@@ -67647,7 +67925,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
           return false;
       }
     }
-    for (const entry of readdirSync8(dest, { withFileTypes: true })) {
+    for (const entry of readdirSync9(dest, { withFileTypes: true })) {
       if (existsSync15(path33.join(src, entry.name)))
         continue;
       const rel = path33.join(relative, entry.name);
@@ -67666,7 +67944,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   const sourceRules = path33.join(src, "rules");
   const installedRules = path33.join(dest, "rules");
   try {
-    for (const entry of readdirSync8(installedRules, { withFileTypes: true })) {
+    for (const entry of readdirSync9(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
       if (existsSync15(path33.join(sourceRules, entry.name)))
@@ -67683,7 +67961,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   if (existsSync15(legacyRules)) {
     try {
       mkdirSync7(path33.join(res.cursorPluginDir, "rules"), { recursive: true });
-      for (const entry of readdirSync8(legacyRules, { withFileTypes: true })) {
+      for (const entry of readdirSync9(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
         const target = path33.join(res.cursorPluginDir, "rules", entry.name);
@@ -67693,7 +67971,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     } catch {}
   }
   rmSync4(legacy, { recursive: true, force: true });
-}, failedDetail = (report) => report.checks.filter((c) => c.status === "fail").map((c) => `${c.id}: ${c.detail}`).join("; "), setupCompletionGuidance = () => [
+}, failedDetail = (report) => report.checks.filter((c) => c.status === "fail").map((c) => c.detail.startsWith(`${c.id}:`) ? c.detail : `${c.id}: ${c.detail}`).join("; "), setupCompletionGuidance = () => [
   "Run `workit doctor` to verify your installation.",
   "Run /wk-status in OpenCode to review token setup steps."
 ];
@@ -70762,7 +71040,43 @@ function Screen({
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this);
-    case "project":
+    case "project": {
+      const target = projectTargetFor(resolveBasePath(draft.values));
+      if (!target.ok) {
+        return /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Box_default, {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              bold: true,
+              children: "Step 6 — Project setup"
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              color: "yellow",
+              children: [
+                "Skipped: ",
+                target.refused
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(ConfirmInput, {
+              defaultChoice: "confirm",
+              submitOnEnter: false,
+              onConfirm: () => {
+                dispatch({ type: "set", field: "applyProject", value: true });
+                dispatch({ type: "next" });
+              },
+              onCancel: () => {
+                dispatch({ type: "set", field: "applyProject", value: false });
+                dispatch({ type: "next" });
+              }
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              dimColor: true,
+              children: "y to keep this note in the summary · n to skip it · either adds no project files · b Back · Esc Cancel"
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this);
+      }
       return /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Box_default, {
         flexDirection: "column",
         gap: 1,
@@ -70775,7 +71089,7 @@ function Screen({
             dimColor: true,
             children: [
               "Apply gitignore + hygiene in ",
-              resolveBasePath(draft.values),
+              target.root,
               "? (Existing files are never overwritten.)"
             ]
           }, undefined, true, undefined, this),
@@ -70797,6 +71111,7 @@ function Screen({
           }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this);
+    }
     case "summary": {
       const policy = effectivePolicy(draft.values);
       const preview = buildSetupPreview(draft.values, { cwd: resolveBasePath(draft.values) });
@@ -70938,8 +71253,15 @@ function Screen({
           }, undefined, true, undefined, this),
           /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
             children: [
-              "Project hygiene: ",
-              /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+              "Project hygiene:",
+              " ",
+              preview.projectRefused ? /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
+                color: "yellow",
+                children: [
+                  "skipped — ",
+                  preview.projectRefused
+                ]
+              }, undefined, true, undefined, this) : /* @__PURE__ */ jsx_dev_runtime2.jsxDEV(Text, {
                 color: "green",
                 children: draft.values.applyProject ? "yes" : "no"
               }, undefined, false, undefined, this)
@@ -71028,7 +71350,11 @@ function Screen({
       }, undefined, false, undefined, this);
   }
 }
-var import_react66, jsx_dev_runtime2, PLATFORM_LABELS, BRANCH_PRESETS, BRANCH_PRESET_DESCRIPTIONS, SCREEN_PLACEHOLDERS, VCS_PROVIDERS, LOCALE_PICKER_OPTIONS, ISSUE_TRACKERS, WORKSPACE_ADVANCED_FIELDS, PROFILE_FIELDS, TRACK_FIELDS, enumFieldOptions = (field) => {
+var import_react66, jsx_dev_runtime2, lastProjectTarget = null, projectTargetFor = (base) => {
+  if (lastProjectTarget?.base !== base)
+    lastProjectTarget = { base, target: projectTarget(base) };
+  return lastProjectTarget.target;
+}, PLATFORM_LABELS, BRANCH_PRESETS, BRANCH_PRESET_DESCRIPTIONS, SCREEN_PLACEHOLDERS, VCS_PROVIDERS, LOCALE_PICKER_OPTIONS, ISSUE_TRACKERS, WORKSPACE_ADVANCED_FIELDS, PROFILE_FIELDS, TRACK_FIELDS, enumFieldOptions = (field) => {
   if (field === "commitPolicy.preset")
     return [{ label: "Inherit global", value: "inherit" }, ...commitPresetOptions];
   if (field === "branchPolicy.preset")
@@ -71070,6 +71396,7 @@ var init_steps = __esm(async () => {
   init_logic();
   init_workspaces();
   init_branch_policy();
+  init_hygiene();
   init_wizard_state();
   init_detect_hosts();
   await __promiseAll([
@@ -71461,7 +71788,7 @@ var init_init = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
+import { spawnSync as spawnSync16 } from "node:child_process";
 import {
   existsSync as existsSync18,
   mkdtempSync as mkdtempSync3,
@@ -71817,7 +72144,7 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (deps.run)
     return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync15(launch.command, launch.args, {
+  return spawnSync16(launch.command, launch.args, {
     stdio: "inherit",
     env
   }).status ?? 1;
@@ -71999,7 +72326,7 @@ var init_launch = __esm(() => {
 });
 
 // packages/workit-core/src/knowledge.ts
-import { spawnSync as spawnSync16 } from "node:child_process";
+import { spawnSync as spawnSync17 } from "node:child_process";
 import fs18 from "node:fs";
 import path38 from "node:path";
 function lintKnowledge(root) {
@@ -72120,7 +72447,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
     return "unreadable";
   }
 }, trackedTopLevel = (root) => {
-  const run = spawnSync16("git", ["ls-files", "-z", "--cached"], {
+  const run = spawnSync17("git", ["ls-files", "-z", "--cached"], {
     cwd: root,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -72488,7 +72815,8 @@ var R = "[REDACTED]", TOKEN_PATTERNS, WEBHOOK, URL_USERINFO, CURL_USER, KEY, ASS
 var init_redact = __esm(() => {
   TOKEN_PATTERNS = [
     /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/gu,
-    /\bgl[a-z]{1,8}-[A-Za-z0-9_-]{16,}/gu,
+    /\b(?:glpat|gloas|gldt|glrtr|glrt|glcbt|glptt|glft|glimt|glagent|glwt|glsoat|glffct)-[A-Za-z0-9_-]{20,}/gu,
+    /\b_gitlab_session=[A-Za-z0-9%_-]{16,}/gu,
     /\bnpm_[A-Za-z0-9]{30,}/gu,
     /\bxox[abposr]-[A-Za-z0-9-]{10,}/gu,
     /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/gu,
@@ -72522,7 +72850,7 @@ var init_redact = __esm(() => {
 });
 
 // packages/workit-core/src/checks.ts
-import { spawn, spawnSync as spawnSync17 } from "node:child_process";
+import { spawn, spawnSync as spawnSync18 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
 import fs19 from "node:fs";
 import os13 from "node:os";
@@ -72704,7 +73032,7 @@ function runCheckCommand(argv, options) {
       if (!child?.pid)
         return;
       if (windows)
-        spawnSync17("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        spawnSync18("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -74040,7 +74368,7 @@ var init_check = __esm(() => {
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
 // packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 import { existsSync as existsSync19, readFileSync as readFileSync19 } from "node:fs";
 import path42 from "node:path";
 function operationInProgress(cwd) {
@@ -74355,6 +74683,14 @@ function gitCommit(cwd, input) {
   const session = input.actor.session;
   if (session && !SESSION_SAFE.test(session))
     return failure3("invalid_input", "WORKIT_SESSION_ID must be 1-128 characters of [A-Za-z0-9_.:@/+-]");
+  if (session) {
+    const env = input.env ?? process.env;
+    if (issuedBinding(cwd, session) !== null)
+      return failure3("blocked", `judge_session: ${session} was issued to a verifier or reviewer subagent; it records verdicts and never authors commits`, "commit from the implementer's or the lead's own session (unset WORKIT_SESSION_ID back to the shell's)");
+    const refusal = sessionClaimRefusal(env, session, cwd);
+    if (refusal)
+      return failure3("blocked", refusal.error, "commit from the session this shell really is: never set WORKIT_SESSION_ID by hand for a commit (unset it, or use the id the host put in this shell)");
+  }
   const changeRequired = !input.amend && !input.allowEmpty;
   const emptyAmend = previous !== null && git5(cwd, ["rev-parse", "--verify", "-q", `${previous}^{tree}`]).stdout.trim() === git5(cwd, ["rev-parse", "--verify", "-q", `${previous}~1^{tree}`]).stdout.trim();
   const args = ["commit", "--no-edit"];
@@ -74853,7 +75189,7 @@ ${run.stdout}`;
   } : { ok: false, lease: false, error: gitError(run) };
 }
 var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
-  const result = spawnSync18("git", args, {
+  const result = spawnSync19("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
@@ -74898,6 +75234,7 @@ var init_ops = __esm(() => {
   init_vcs_config();
   init_workspaces();
   init_redact();
+  init_host_session();
   init_ledger();
   init_rev();
   COMMIT_TIMEOUT_MS = 10 * 60000;
@@ -75386,7 +75723,7 @@ var init_report = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-ops.ts
-import { spawnSync as spawnSync19 } from "node:child_process";
+import { spawnSync as spawnSync20 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
   if (!base.startsWith("-"))
@@ -75394,7 +75731,7 @@ function fillFromCommits(cwd, resolved, base) {
   const from = resolveRef(cwd, tracking) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return failure3("not_found", `base ${base} is not available locally`, `git fetch ${resolved.baseRemote} ${base}`);
-  const log = spawnSync19("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
+  const log = spawnSync20("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -75591,7 +75928,7 @@ function squashCommitList(cwd, resolved, base, head) {
   const from = resolveRef(cwd, `refs/remotes/${resolved.baseRemote}/${base}`) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return "";
-  const log = spawnSync19("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
+  const log = spawnSync20("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -75664,7 +76001,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     if (reason)
       return refuse(`protected_branch: --delete-branch would delete ${branch}, which ${reason}; workit never deletes it`, `workit pr merge${input.pr ? ` --pr ${doc.number}` : ""} --method ${input.method}  # without --delete-branch`, { reason: "protected_branch" });
   }
-  const ledger = readLedger(cwd);
+  const ledger = readLedger(cwd, { integrity: true });
   if (!ledger.ok)
     return ledger;
   const check = checkVerdicts(cwd, branch, ledger.value.rows);
@@ -75696,18 +76033,54 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     unverified = { reason, recorded: String(recorded.value.id) };
   } else if (check.head !== head)
     return refuse(`head_mismatch: the verdict check reads ${branch} at ${check.head?.slice(0, 12) ?? "(missing)"} but ${label} is at ${head.slice(0, 12)}`, `git fetch && git switch ${branch} && git merge --ff-only @{u}  # then re-verify that head`, { reason: "head_mismatch", verdict: summary });
+  else if (!covered && check.accepted.reasons.includes("ledger_tampered"))
+    return refuse(`ledger_tampered: a ledger row was edited, removed or moved, so no verdict for ${label} is accepted until it is repaired`, tamperedUnblock(cwd), { reason: "ledger_tampered", verdict: summary });
   else if (!covered)
     return refuse(`NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)} (${check.accepted.reasons.join(", ")})`, `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${grant.allowUnverified ? `; or, only if the user asks to merge unverified: workit pr merge --unverified --reason "<why>"` : ""}`, { reason: "needs_verdict", verdict: summary });
   const squashMessage = squashMessageFor(cwd, resolved, input, doc);
   if (squashMessage && !squashMessage.ok)
     return squashMessage;
+  const intent = appendObserved(cwd, {
+    type: "pr.merge.intent",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...unverified ? { unverified: unverified.recorded } : {},
+    grant: grant.source
+  });
+  if (!intent.ok)
+    return refuse(`intent_unrecorded: the merge intent for ${label} could not be recorded (${intent.error}); nothing was merged`, "fix the ledger (workit ledger check), then merge again", { reason: "intent_unrecorded" });
+  const intentId = String(intent.value.id);
   const merged = resolved.forge.merge(doc.number, {
     sha: head,
     method: input.method,
     ...squashMessage ? { squashMessage: squashMessage.data } : {}
   });
   if (!merged.ok)
-    return merged;
+    return {
+      ...merged,
+      error: `${merged.error} (merge intent ${intentId} is recorded: if the forge merged anyway, workit pr status reads it)`
+    };
+  const row = appendObserved(cwd, {
+    type: "pr.merged",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    mergeSha: merged.data.mergeSha,
+    method: input.method,
+    verdictId: verdict.verdictId,
+    ...unverified ? { unverified: unverified.recorded } : {},
+    grant: grant.source,
+    intent: intentId,
+    verified: false
+  });
+  const recorded = row.ok ? { id: String(row.value.id) } : { error: row.error };
   let state = "open";
   for (const delay of [0, ...VERIFY_DELAYS_MS]) {
     if (delay)
@@ -75722,9 +76095,21 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return {
       ok: false,
       code: "failed",
-      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}`,
-      unblock: `workit verify-delivery merged --pr ${doc.number}`
+      error: `merge_unverified: the forge accepted the merge of ${label} but still reports it ${state}${"id" in recorded ? `; recorded as pr.merged ${recorded.id} (verified: false)` : `; the pr.merged row could not be written (${recorded.error})`}`,
+      unblock: `workit verify-delivery merged --pr ${doc.number}`,
+      recorded
     };
+  const confirmation = "id" in recorded ? appendObserved(cwd, {
+    type: "pr.merge.verified",
+    actor: input.actor,
+    branch,
+    head,
+    pr: doc.number,
+    base: doc.base,
+    merged: recorded.id,
+    mergeSha: merged.data.mergeSha
+  }) : null;
+  const confirmed = confirmation === null ? { error: "no pr.merged row to confirm" } : confirmation.ok ? { id: String(confirmation.value.id) } : { error: confirmation.error };
   let deletedBranch = false;
   if (input.deleteBranch) {
     const deleted = deleteRemoteBranch(cwd, resolved.remote, branch, head);
@@ -75732,19 +76117,6 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     deletedBranch = deleted.ok || gone && gone.ok && gone.sha === null ? true : { error: deleted.error };
   }
   const mergeBack = mergeBackFor(cwd, doc.base, branch);
-  const row = appendObserved(cwd, {
-    type: "pr.merged",
-    actor: input.actor,
-    branch,
-    head,
-    pr: doc.number,
-    base: doc.base,
-    mergeSha: merged.data.mergeSha,
-    method: input.method,
-    verdictId: verdict.verdictId,
-    ...unverified ? { unverified: unverified.recorded } : {},
-    grant: grant.source
-  });
   return {
     ok: true,
     data: {
@@ -75759,7 +76131,8 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
       unverified,
       grant: { source: grant.source },
       deletedBranch,
-      recorded: row.ok ? { id: String(row.value.id) } : { error: row.error },
+      recorded,
+      confirmed,
       mergeBack: mergeBack.branches,
       mergeBackTrack: mergeBack.track
     }
@@ -75817,8 +76190,8 @@ var init_pr_ops = __esm(() => {
 });
 
 // packages/workit-core/src/stack.ts
-import { spawnSync as spawnSync20 } from "node:child_process";
-import { createHash as createHash17, randomBytes as randomBytes3 } from "node:crypto";
+import { spawnSync as spawnSync21 } from "node:child_process";
+import { createHash as createHash17, randomBytes as randomBytes4 } from "node:crypto";
 import fs22 from "node:fs";
 import path44 from "node:path";
 function worktreeOf(cwd, branch) {
@@ -75864,7 +76237,7 @@ function gitRestack(cwd, input) {
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
     fs22.mkdirSync(scratch, { recursive: true });
-    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes3(4).toString("hex")}`);
+    dir = path44.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -76073,13 +76446,13 @@ function takeLock(lock) {
     pid: process.pid,
     processStart: processStartOf(process.pid),
     host: localLockHost(),
-    nonce: randomBytes3(8).toString("hex")
+    nonce: randomBytes4(8).toString("hex")
   };
   fs22.writeFileSync(path44.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
-  const tomb = `${lock}.reap-${randomBytes3(6).toString("hex")}`;
+  const tomb = `${lock}.reap-${randomBytes4(6).toString("hex")}`;
   try {
     fs22.renameSync(lock, tomb);
   } catch {
@@ -76100,7 +76473,7 @@ function releaseLock(lock, owner) {
   const { raw } = readOwner(lock);
   if (raw !== JSON.stringify(owner))
     return;
-  const tomb = `${lock}.release-${randomBytes3(6).toString("hex")}`;
+  const tomb = `${lock}.release-${randomBytes4(6).toString("hex")}`;
   try {
     fs22.renameSync(lock, tomb);
     fs22.rmSync(tomb, { recursive: true, force: true });
@@ -76330,7 +76703,7 @@ function commitKeys(cwd, range) {
   const patches = new Map;
   const diff = gitRun3(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
   if (diff.ok && diff.stdout.trim()) {
-    const ids = spawnSync20("git", ["patch-id", "--stable"], {
+    const ids = spawnSync21("git", ["patch-id", "--stable"], {
       cwd,
       input: diff.stdout,
       encoding: "utf8",
@@ -76423,7 +76796,7 @@ function stackStatus(ctx, stack) {
   const mismatch = repoMismatch(ctx, stack);
   if (mismatch)
     return mismatch;
-  const ledger = readLedger(ctx.cwd);
+  const ledger = readLedger(ctx.cwd, { integrity: true });
   if (!ledger.ok)
     return stackFail(ledger.code, ledger.error, ledger.unblock);
   const remote = remoteFor(ctx.cwd, ctx.resolved, stack.trunk);
@@ -76847,7 +77220,7 @@ async function landStack(ctx, stack, options) {
     absorb(synced.data);
   }
   const ledgerRows = () => {
-    const ledger = readLedger(ctx.cwd);
+    const ledger = readLedger(ctx.cwd, { integrity: true });
     return ledger.ok ? ledger.value.rows : [];
   };
   const simulated = new Set;
@@ -76954,7 +77327,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
 }), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync20("git", args, {
+  const run = spawnSync21("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -77035,7 +77408,7 @@ var init_stack = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-edit.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 function openPr(cwd, resolved, pr) {
   const grant = requireGrant(cwd, "pr");
   if (!grant.allowed)
@@ -77200,7 +77573,7 @@ function replyToThread(cwd, resolved, input) {
   });
 }
 var label = (resolved, number) => `${resolved.forge.kind === "github" ? "PR #" : "MR !"}${number}`, git6 = (cwd, args) => {
-  const run = spawnSync21("git", args, {
+  const run = spawnSync22("git", args, {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -77220,7 +77593,7 @@ var init_pr_edit = __esm(() => {
 });
 
 // packages/workit-core/src/forge/exec.ts
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 import fs23 from "node:fs";
 import path45 from "node:path";
 function findExecutable(bin, env) {
@@ -77255,7 +77628,7 @@ function systemRunner(kind, apiHost, env = process.env) {
     if (!exe)
       return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
     const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
-    const result = spawnSync22(exe, [...args], {
+    const result = spawnSync23(exe, [...args], {
       encoding: "utf8",
       env: { ...childEnv, ...token },
       maxBuffer: MAX_BUFFER2,
@@ -78255,6 +78628,14 @@ function resolveCredential(workspace, derived, run, scope) {
     const explicit = typeof workspaceHost === "string" && workspaceHost.trim().toLowerCase().replace(/^https?:\/\//u, "").replace(/\/.*$/u, "") === apiHost;
     if (derived.via === "host_name" && !explicit)
       return failure3("blocked", `token_host_unverified: push host ${derived.host} only looks like ${kind}; workspace ${workspace?.name ?? "?"} vcs.tokenFile is not sent to it`, `if ${apiHost} is your ${kind} server, set ${kind}.host in ~/.config/workit/vcs.json (or vcs.host for the workspace); otherwise fix the push remote`);
+    if (process.platform !== "win32") {
+      let mode = 0;
+      try {
+        mode = fs24.statSync(tokenFile.trim()).mode;
+      } catch {}
+      if ((mode & 63) !== 0)
+        return failure3("blocked", `workspace ${workspace?.name ?? "?"} vcs.tokenFile is readable by group or other (mode ${(mode & 511).toString(8).padStart(4, "0")})`, `chmod 600 ${tokenFile.trim()}`);
+    }
     let token = "";
     try {
       token = fs24.readFileSync(tokenFile.trim(), "utf8").trim();
@@ -78678,17 +79059,20 @@ async function status(argv, io) {
   });
 }
 function verdictBlock(cwd, branch, doc) {
-  const ledger = readLedger(cwd);
+  const ledger = readLedger(cwd, { integrity: true });
   if (!ledger.ok)
     return null;
   const check = checkVerdicts(cwd, branch, ledger.value.rows);
   let landed = null;
   if (doc.state === "merged") {
-    const row = ledger.value.rows.findLast((candidate) => candidate.type === "pr.merged" && candidate.observer === "workit_cli" && candidate.pr === doc.number && candidate.base === doc.base);
+    const mine = (type) => ledger.value.rows.findLast((candidate) => candidate.type === type && candidate.observer === "workit_cli" && candidate.integrity !== "unverified" && candidate.pr === doc.number && candidate.base === doc.base);
+    const merged = mine("pr.merged");
+    const row = merged ?? mine("pr.merge.intent");
     landed = row ? {
       head: typeof row.head === "string" ? row.head : null,
       verdictId: typeof row.verdictId === "string" ? row.verdictId : null,
-      unverified: row.unverified !== undefined && row.unverified !== null
+      unverified: row.unverified !== undefined && row.unverified !== null,
+      ...merged ? {} : { intentOnly: true }
     } : "untracked";
   }
   return {
@@ -78859,7 +79243,7 @@ async function merge3(argv, io) {
   if (!result.ok)
     return emit(io, fail(result.code, result.error, {
       unblock: result.unblock,
-      data: "refusal" in result && result.refusal ? result.refusal : {}
+      data: "refusal" in result && result.refusal ? result.refusal : ("recorded" in result) && result.recorded ? { recorded: result.recorded } : {}
     }));
   return emit(io, ok(result.data), (data) => [
     `merged ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number} (${data.method}) at head ${data.head.slice(0, 12)}${data.mergeSha ? ` -> ${data.mergeSha.slice(0, 12)}` : ""}`,
@@ -78868,7 +79252,8 @@ async function merge3(argv, io) {
       `merge back: ${data.base} is the ${data.mergeBackTrack} production branch; bring it into ${data.mergeBack.join(", ")}`
     ] : [],
     ...data.deletedBranch === true ? [`deleted ${data.branch}`] : typeof data.deletedBranch === "object" ? [`branch not deleted: ${data.deletedBranch.error}`] : [],
-    ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
+    ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : [],
+    ..."error" in data.confirmed && !("error" in data.recorded) ? [`ledger: merge not confirmed in the ledger (${data.confirmed.error})`] : []
   ]);
 }
 async function ready(argv, io) {
@@ -79018,7 +79403,7 @@ async function run11(argv, io) {
     return reply(rest, io);
   return usage3(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE4);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}`, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE4 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, METHODS2;
 var init_pr = __esm(() => {
   init_pr_body();
   init_pr_edit();
@@ -79543,7 +79928,7 @@ var init_git2 = __esm(() => {
 });
 
 // packages/workit-core/src/forge/verify.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
   const out = { ...report, delivered };
@@ -79756,7 +80141,7 @@ var NPM_NAME, SEMVER2, SAFE_ARG, systemNpm = (args) => {
   };
   const found = process.platform === "win32" ? findExecutable("npm.cmd", process.env) : null;
   const npmCmd = found && !/["%!^]/u.test(found) ? `"${found}"` : "npm.cmd";
-  const result = process.platform === "win32" ? spawnSync23(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync23("npm", [...args], options);
+  const result = process.platform === "win32" ? spawnSync24(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync24("npm", [...args], options);
   return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }, short3 = (sha) => sha ? sha.slice(0, 12) : "(absent)", npmView = (stdout) => {
   try {
@@ -80765,7 +81150,7 @@ var init_stack2 = __esm(() => {
 });
 
 // packages/workit-core/src/fanout.ts
-import { spawnSync as spawnSync24 } from "node:child_process";
+import { spawnSync as spawnSync25 } from "node:child_process";
 import { createHash as createHash18 } from "node:crypto";
 import fs25 from "node:fs";
 import path48 from "node:path";
@@ -81538,7 +81923,7 @@ var FANOUT_VERSION = 1, TIERS, FAN_IN_MODES, fanoutFail = (code, error, unblock,
     text: edges.map((edge) => `add "${edge.dependsOn}" to "dependsOn" of slice ${edge.slice}`).join("; ")
   };
 }, gitRun4 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync24("git", args, {
+  const run = spawnSync25("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -81576,7 +81961,7 @@ var init_fanout = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-worktree.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 import fs26 from "node:fs";
 import path49 from "node:path";
 function rowSample(lines) {
@@ -81660,7 +82045,7 @@ function markAdminDir(worktree) {
   const admin = adminDir(worktree);
   if (!admin)
     return null;
-  const token = randomBytes4(16).toString("hex");
+  const token = randomBytes5(16).toString("hex");
   try {
     fs26.writeFileSync(path49.join(admin.path, TOKEN_FILE), `${token}
 `);
@@ -82085,7 +82470,7 @@ var init_fanout_brief = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-landed.ts
-import { spawnSync as spawnSync25 } from "node:child_process";
+import { spawnSync as spawnSync26 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
     return { forge: null, down: () => null };
@@ -82176,7 +82561,7 @@ function trunkPatchIds(ctx, fork) {
     "--"
   ]);
   if (log.ok && log.stdout.trim()) {
-    const run = spawnSync25("git", ["patch-id", "--stable"], {
+    const run = spawnSync26("git", ["patch-id", "--stable"], {
       cwd: ctx.cwd,
       input: log.stdout,
       encoding: "utf8",
@@ -83025,7 +83410,7 @@ var exports_ledger = {};
 __export(exports_ledger, {
   run: () => run18
 });
-import { randomBytes as randomBytes5 } from "node:crypto";
+import { randomBytes as randomBytes6 } from "node:crypto";
 import { parseArgs } from "node:util";
 function targetBranch(io, rows, branch, pr) {
   if (pr !== undefined) {
@@ -83163,10 +83548,12 @@ async function run18(argv, io) {
   if (rest.length !== 1)
     return usage4(io, `ledger verdict takes one result: ${VERDICT_RESULTS.join("|")}`);
   const claimed = values.self === true ? null : claimedSession(acting);
-  const refusal = claimed === null ? null : sessionClaimRefusal(io.env, claimed, io.cwd);
+  const token = values.token ?? io.env.WORKIT_SESSION_TOKEN ?? null;
+  const refusal = claimed === null ? null : sessionClaimRefusal(io.env, claimed, io.cwd, { token, flag: acting.source === "flag" });
   if (refusal)
     return emit(io, fail("blocked", refusal.error, { unblock: refusal.unblock }));
-  const verdict = await recorded(recordVerdict(context, {
+  const bound = claimed !== null && issuedTokenMatches(io.cwd, claimed, token);
+  const verdict = await recorded(recordVerdict({ ...context, ...bound ? { sessionBound: true } : {} }, {
     result: rest[0],
     kind: values.kind,
     how: values.how,
@@ -83182,7 +83569,12 @@ async function run18(argv, io) {
   if (shadowed)
     io.stderr(`warning: ${shadowed}
 `);
-  return fromResult(io, verdict, (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)} as ${actor.session ?? "no session"}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
+  const withGate = verdict.ok ? { ok: true, value: { ...verdict.value, gate: gateReading(io.cwd, verdict.value) } } : verdict;
+  return fromResult(io, withGate, (row) => [
+    `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)} as ${actor.session ?? "no session"}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`,
+    row.gate ? `gate: ${row.branch} ${row.gate.accepted ? `accepted (verdict ${row.gate.verdictId ?? "?"})` : `not accepted (${row.gate.reasons.join(", ")})`}` : "gate: unknown (ledger unreadable)"
+  ].join(`
+`));
 }
 function standingFanout(io, values) {
   if (values.fanout !== undefined) {
@@ -83253,7 +83645,7 @@ var USAGE10 = "workit ledger decision|ruling|verdict|standing|list|check ... (wo
       return new Error("--as takes a lowercase role, e.g. verifier");
     const prefix = (actor.session ?? actor.host).slice(0, 96);
     return {
-      actor: { ...actor, session: `${prefix}:${values.as}:${randomBytes5(4).toString("hex")}` },
+      actor: { ...actor, session: `${prefix}:${values.as}:${randomBytes6(4).toString("hex")}` },
       source: "as",
       derivedFrom: actor.session
     };
@@ -83296,7 +83688,17 @@ var USAGE10 = "workit ledger decision|ruling|verdict|standing|list|check ... (wo
 ] : [
   `${data.unverified_rows.length} unverified row(s) (not written by the workit CLI, or changed afterwards):`,
   ...data.unverified_rows.map((row) => `  #${row.seq} ${row.id} ${row.type}${row.branch ? ` [${row.branch}]` : ""}: ${row.reason}`)
-];
+], gateReading = (cwd, row) => {
+  const ledger = readLedger(cwd, { integrity: true });
+  if (!ledger.ok || !row.branch)
+    return null;
+  const { accepted } = checkVerdicts(cwd, row.branch, ledger.value.rows);
+  return {
+    accepted: accepted.accepted,
+    reasons: accepted.reasons,
+    verdictId: typeof accepted.verdict?.id === "string" ? accepted.verdict.id : null
+  };
+};
 var init_ledger2 = __esm(() => {
   init_ledger();
   init_fanout();
@@ -83320,6 +83722,7 @@ var init_ledger2 = __esm(() => {
     last: { type: "string" },
     supersedes: { type: "string" },
     session: { type: "string" },
+    token: { type: "string" },
     as: { type: "string" },
     fanout: { type: "string" },
     json: { type: "boolean" }
@@ -99175,11 +99578,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync26 } from "node:child_process";
-import { existsSync as existsSync20, readdirSync as readdirSync9, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
+import { spawnSync as spawnSync27 } from "node:child_process";
+import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
 import path52 from "node:path";
 function git7(cwd, args) {
-  const run = spawnSync26("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync27("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -99187,7 +99590,7 @@ function git7(cwd, args) {
   return { ok: run.status === 0, stdout: run.stdout ?? "" };
 }
 function walkTests(dir, out) {
-  for (const entry of readdirSync9(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync10(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
     const full = path52.join(dir, entry.name);
@@ -99323,7 +99726,7 @@ import {
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync10,
   mkdtempSync as mkdtempSync4,
-  readdirSync as readdirSync10,
+  readdirSync as readdirSync11,
   readFileSync as readFileSync24,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
@@ -99420,7 +99823,7 @@ function removeStaleCopies(tmp = os16.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
-    names = readdirSync10(tmp);
+    names = readdirSync11(tmp);
   } catch {
     return 0;
   }
@@ -99449,7 +99852,7 @@ function removeStaleCopies(tmp = os16.tmpdir()) {
 }
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync10(target, { recursive: true });
-  for (const entry of readdirSync10(origin, { withFileTypes: true })) {
+  for (const entry of readdirSync11(origin, { withFileTypes: true })) {
     const from = path53.join(origin, entry.name);
     const to = path53.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
@@ -100586,7 +100989,7 @@ function withSubcommands(entry, options = {}) {
   };
 }
 var VERIFY_OPTIONS = "[--expect pushed|pr|merged|released] [--pr <n> | --branch <b>] [--sha <sha>] [--tag <t>] [--package <name[@version]>]";
-var LEDGER_ACTOR = "[--branch <b> | --pr <n>] [--supersedes <id>] [--session <id> | --as <role>]";
+var LEDGER_ACTOR = "[--branch <b> | --pr <n>] [--supersedes <id>] [--session <id> [--token <t>] | --as <role>]";
 var VERBS = [
   {
     name: "init",
@@ -100915,7 +101318,7 @@ var VERBS = [
       },
       {
         name: "standing",
-        usage: `workit ledger standing add "<order>" | standing list | standing clear [<id>]  [--fanout <name>] [--supersedes <id>] [--session <id> | --as <role>]`,
+        usage: `workit ledger standing add "<order>" | standing list | standing clear [<id>]  [--fanout <name>] [--supersedes <id>] [--session <id> [--token <t>] | --as <role>]`,
         summary: "The lead's standing orders for a fanout's workers"
       },
       {