@brainervirus/workit-cli 8.22.3 → 8.23.0

package/dist/index.js

@@ -9050,7 +9050,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.22.3",
+    version: "8.23.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9088,13 +9088,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.22.3",
+      "@brainervirus/workit-cursor": "^8.23.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.22.3"
+      "@brainervirus/workit-core": "^8.23.0"
     },
     engines: {
       node: ">=24"
@@ -82928,10 +82928,176 @@ var init_stack2 = __esm(() => {
   METHODS3 = new Set(["squash", "merge", "rebase"]);
 });
 
+// packages/workit-core/src/core/live-session.ts
+import { spawnSync as spawnSync27 } from "node:child_process";
+var LIVE_SESSION_TTL_MS, liveProbe, PIDS;
+var init_live_session = __esm(() => {
+  init_paths();
+  init_logger();
+  init_store_lock();
+  LIVE_SESSION_TTL_MS = 15 * 60000;
+  liveProbe = {
+    platform: process.platform,
+    run: (args) => spawnSync27("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
+    start: (pid) => processStartOf(pid)
+  };
+  PIDS = new Map;
+});
+
+// packages/workit-core/src/hooks/write-gate.ts
+import path55 from "node:path";
+var CASE_INSENSITIVE, PREFIXES2, SCRIPT_SHELLS, cache3, MUTATING_GIT, DRY_N, MUTATING_WORKIT_GIT, CD2, PUSHD2, POPD2, UNKNOWN_DIR;
+var init_write_gate = __esm(() => {
+  init_task_store();
+  init_derive();
+  init_task_evaluation();
+  init_live_session();
+  init_logger();
+  init_workspaces();
+  init_ledger();
+  init_raw_git();
+  init_shell_words();
+  CASE_INSENSITIVE = process.platform === "darwin" || process.platform === "win32";
+  PREFIXES2 = new Set(["sudo", "command", "env", "nohup", "time", "exec", "xargs", "busybox"]);
+  SCRIPT_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+  cache3 = new Map;
+  MUTATING_GIT = new Set([
+    "add",
+    "am",
+    "apply",
+    "checkout",
+    "cherry-pick",
+    "clean",
+    "commit",
+    "merge",
+    "mv",
+    "pull",
+    "rebase",
+    "reset",
+    "restore",
+    "revert",
+    "rm",
+    "stash",
+    "switch"
+  ]);
+  DRY_N = new Set(["add", "clean", "rm", "mv"]);
+  MUTATING_WORKIT_GIT = new Set(["commit", "branch"]);
+  CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
+  PUSHD2 = new Set(["pushd", "push-location"]);
+  POPD2 = new Set(["popd", "pop-location"]);
+  UNKNOWN_DIR = path55.resolve(path55.parse(process.cwd()).root, ".workit-unknown-dir");
+});
+
+// packages/workit-core/src/hooks/worktree-confine.ts
+var FANOUT_TOKEN_FILE = "workit-fanout-token", CASE_INSENSITIVE2, MUTATING_REMOTE;
+var init_worktree_confine = __esm(() => {
+  init_logger();
+  init_ledger();
+  init_raw_git();
+  init_write_gate();
+  CASE_INSENSITIVE2 = process.platform === "darwin" || process.platform === "win32";
+  MUTATING_REMOTE = new Set([
+    "add",
+    "remove",
+    "rm",
+    "rename",
+    "set-url",
+    "set-head",
+    "set-branches",
+    "prune"
+  ]);
+});
+
+// packages/workit-core/src/worktree-deps.ts
+import fs31 from "node:fs";
+import path56 from "node:path";
+function moduleDirs(main) {
+  const out = [];
+  const walk = (relative, depth) => {
+    let entries;
+    try {
+      entries = fs31.readdirSync(path56.join(main, relative), { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory())
+        continue;
+      const child = path56.join(relative, entry.name);
+      if (entry.name === MODULES)
+        out.push(child);
+      else if (depth < MAX_DEPTH2 && !entry.name.startsWith("."))
+        walk(child, depth + 1);
+    }
+  };
+  walk("", 0);
+  return out;
+}
+function linkEntry(main, worktree, source, target) {
+  const stat = fs31.lstatSync(source);
+  if (stat.isSymbolicLink()) {
+    const link = fs31.readlinkSync(source);
+    const outside = path56.isAbsolute(link) && within(link, main) && !path56.relative(main, link).split(path56.sep).includes(MODULES);
+    const to = outside ? path56.join(worktree, path56.relative(main, link)) : link;
+    fs31.symlinkSync(to, target, process.platform === "win32" ? "junction" : undefined);
+    return;
+  }
+  fs31.symlinkSync(source, target, process.platform === "win32" ? stat.isDirectory() ? "junction" : "file" : undefined);
+}
+function mirror(main, worktree, source, target, top) {
+  fs31.mkdirSync(target);
+  let count = 0;
+  for (const entry of fs31.readdirSync(source, { withFileTypes: true })) {
+    const from = path56.join(source, entry.name);
+    const to = path56.join(target, entry.name);
+    if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin"))
+      count += mirror(main, worktree, from, to, false);
+    else {
+      linkEntry(main, worktree, from, to);
+      count += 1;
+    }
+  }
+  return count;
+}
+function linkWorktreeDependencies(main, worktree) {
+  const started = performance.now();
+  const notes = [];
+  const dirs = [];
+  let entries = 0;
+  for (const relative of moduleDirs(main)) {
+    const target = path56.join(worktree, relative);
+    if (!fs31.existsSync(path56.dirname(target)) || fs31.existsSync(target))
+      continue;
+    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path56.sep).join("/")}/`]).ok) {
+      notes.push(`${relative.split(path56.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
+      continue;
+    }
+    try {
+      entries += mirror(main, worktree, path56.join(main, relative), target, true);
+      dirs.push(relative.split(path56.sep).join("/"));
+    } catch (error) {
+      fs31.rmSync(target, { recursive: true, force: true });
+      notes.push(`could not link ${relative} from ${main} (${error.message}); install dependencies in the worktree yourself`);
+    }
+  }
+  if (dirs.length === 0)
+    return { linked: null, notes };
+  const ms = Math.round(performance.now() - started);
+  notes.push(`linked ${dirs.join(", ")} from ${main} (${entries} entries, ${ms} ms): workspace packages resolve to this worktree, installed packages are shared`);
+  return { linked: { from: main, dirs, entries, ms }, notes };
+}
+var MODULES = "node_modules", MAX_DEPTH2 = 2, within = (child, parent) => {
+  const relative = path56.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path56.isAbsolute(relative);
+};
+var init_worktree_deps = __esm(() => {
+  init_fanout();
+});
+
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
-import fs31 from "node:fs";
-import path55 from "node:path";
+import fs32 from "node:fs";
+import path57 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -82991,7 +83157,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs31.readFileSync(path55.join(file, TOKEN_FILE), "utf8").trim() || null;
+    token = fs32.readFileSync(path57.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -82999,7 +83165,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path55.basename(file),
+      id: path57.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -83015,7 +83181,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes5(16).toString("hex");
   try {
-    fs31.writeFileSync(path55.join(admin.path, TOKEN_FILE), `${token}
+    fs32.writeFileSync(path57.join(admin.path, FANOUT_TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -83030,25 +83196,25 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path55.join(common, "info", "exclude");
+  const file = path57.join(common, "info", "exclude");
   let text = "";
   try {
-    text = fs31.readFileSync(file, "utf8");
+    text = fs32.readFileSync(file, "utf8");
   } catch {
     text = "";
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs31.mkdirSync(path55.dirname(file), { recursive: true });
-  fs31.appendFileSync(file, `${text && !text.endsWith(`
+  fs32.mkdirSync(path57.dirname(file), { recursive: true });
+  fs32.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
 ${EXCLUDE_LINE}
 `);
 }
 function ensureScratch(worktree) {
-  const scratch = path55.join(worktree, SCRATCH_DIR);
-  fs31.mkdirSync(scratch, { recursive: true });
+  const scratch = path57.join(worktree, SCRATCH_DIR);
+  fs32.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
 function createSliceWorktree(cwd, plan, input) {
@@ -83075,6 +83241,7 @@ function createSliceWorktree(cwd, plan, input) {
     if (!createdRow(cwd, plan, slice, target))
       return fanoutFail("blocked", `${target} is a worktree that workit fanout worktree create did not make for slice ${slice.id}`, `remove it yourself (git worktree remove ${target}) once you know what it holds`);
     excludeScratch(cwd);
+    const deps = linkWorktreeDependencies(mainCheckout(cwd), target);
     return {
       ok: true,
       data: {
@@ -83083,7 +83250,11 @@ function createSliceWorktree(cwd, plan, input) {
         head: existing.head ?? "",
         mode: resolveRef(cwd, localRef) ? "resume" : "new",
         created: false,
-        notes: ["the worktree already exists; nothing was changed"]
+        dependencies: deps.linked,
+        notes: [
+          deps.linked ? "the worktree already exists; only its missing dependencies were linked" : "the worktree already exists; nothing was changed",
+          ...deps.notes
+        ]
       }
     };
   }
@@ -83092,8 +83263,8 @@ function createSliceWorktree(cwd, plan, input) {
     return fanoutFail("blocked", `${slice.branch} is checked out at ${elsewhere.path}: never two live workers on one branch`, `stop that worker, then workit fanout worktree release ${slice.id} (or git worktree remove ${elsewhere.path})`);
   let dirExisted = false;
   try {
-    const stat = fs31.statSync(target);
-    if (!stat.isDirectory() || fs31.readdirSync(target).length > 0)
+    const stat = fs32.statSync(target);
+    if (!stat.isDirectory() || fs32.readdirSync(target).length > 0)
       return fanoutFail("blocked", `${target} exists and is ${stat.isDirectory() ? "not empty" : "not a directory"} (not a worktree of this repository)`, `move it away, or set slice ${slice.id}'s worktree to another path`);
     dirExisted = true;
   } catch (error) {
@@ -83133,6 +83304,8 @@ function createSliceWorktree(cwd, plan, input) {
   }
   excludeScratch(cwd);
   const scratch = ensureScratch(target);
+  const deps = linkWorktreeDependencies(mainCheckout(cwd), target);
+  notes.push(...deps.notes);
   const head = gitRun4(target, ["rev-parse", "HEAD"]).stdout.trim();
   const baseSha = mode === "new" ? head : null;
   const admin = markAdminDir(target);
@@ -83152,7 +83325,10 @@ function createSliceWorktree(cwd, plan, input) {
     ...admin ? { adminId: admin.id, adminIno: admin.ino, adminToken: admin.token } : {},
     ...baseSha ? { baseSha } : {}
   });
-  return { ok: true, data: { ...base, scratch, head, mode, created: true, notes } };
+  return {
+    ok: true,
+    data: { ...base, scratch, head, mode, created: true, dependencies: deps.linked, notes }
+  };
 }
 function releaseSliceWorktree(cwd, plan, input) {
   const found = findSlice(plan, input.slice);
@@ -83175,7 +83351,7 @@ function releaseSliceWorktree(cwd, plan, input) {
     notes: []
   };
   if (index < 0) {
-    if (fs31.existsSync(target))
+    if (fs32.existsSync(target))
       return fanoutFail("blocked", `${target} is not a worktree of this repository; nothing was removed`, "remove it yourself once you know what it holds");
     out.notes.push(`no worktree at ${target}; nothing to release`);
     return { ok: true, data: out };
@@ -83237,7 +83413,7 @@ function releaseSliceWorktree(cwd, plan, input) {
 `)[0]}`, entry.locked ? `git worktree unlock ${entry.path}, then release again` : undefined, { ...out });
   out.removed = true;
   if (made.dirExisted === true)
-    fs31.mkdirSync(entry.path, { recursive: true });
+    fs32.mkdirSync(entry.path, { recursive: true });
   if (out.unpushed)
     out.notes.push(`${slice.branch} is kept with ${out.unpushed} commit(s) not on the remote`);
   return { ok: true, data: out };
@@ -83265,42 +83441,44 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path55.join(worktree, SCRATCH_DIR);
+  const scratch = path57.join(worktree, SCRATCH_DIR);
   let stat;
   try {
-    stat = fs31.lstatSync(scratch);
+    stat = fs32.lstatSync(scratch);
   } catch {
     return;
   }
   if (stat.isSymbolicLink() || !stat.isDirectory())
-    fs31.unlinkSync(scratch);
+    fs32.unlinkSync(scratch);
   else
-    fs31.rmSync(scratch, { recursive: true, force: true, maxRetries: 2 });
+    fs32.rmSync(scratch, { recursive: true, force: true, maxRetries: 2 });
 }
 var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000, canonical2 = (target) => {
   try {
-    return fs31.realpathSync.native(target);
+    return fs32.realpathSync.native(target);
   } catch {
-    return path55.resolve(target);
+    return path57.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside3 = (child, parent) => {
-  const relative = path55.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path55.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path55.isAbsolute(slice.worktree) ? slice.worktree : path55.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, TOKEN_FILE = "workit-fanout-token", worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
+  const relative = path57.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path57.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path57.isAbsolute(slice.worktree) ? slice.worktree : path57.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, worktreeFailed = (stderr) => fanoutFail("failed", `git worktree add failed: ${stderr.trim().split(`
 `)[0] || "unknown error"}`);
 var init_fanout_worktree = __esm(() => {
   init_ops();
   init_rev();
   init_ledger();
+  init_worktree_confine();
+  init_worktree_deps();
   init_fanout();
   SLOW = GIT_TIMEOUTS.worktree;
   EXCLUDE_LINE = `/${SCRATCH_DIR}/`;
   worktreeDeps = {
-    stat: (file) => fs31.statSync(file, { bigint: true })
+    stat: (file) => fs32.statSync(file, { bigint: true })
   };
 });
 
@@ -83378,8 +83556,9 @@ function renderBrief(cwd, plan, input) {
     ...REPORT,
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
+    exists ? `WORKTREE: ${planned}  (made by \`workit fanout worktree create ${slice.id}\`; yours alone)` : `WORKTREE: ${planned}  (not made yet: the lead runs \`workit fanout worktree create ${slice.id}\` before spawning, then renders this brief again)`,
     ...identityLines(identity, minted),
-    ...rules(identity, mode, branch, slice.base)
+    ...rules(mode, branch, slice.base, exists ? planned : null)
   ];
   return {
     ok: true,
@@ -83412,25 +83591,25 @@ var DEFAULT_TIMEBOX = "30 minutes", REPORT, identityOf = (host) => {
 }, identityLines = (identity, session) => {
   if (identity === "issued")
     return [
-      "  Session: your env already has WORKIT_SESSION_ID (the lead's id; SubagentStart issues ids only to verifiers and reviewers). Use it as is, in your Workit-Session trailer and workit commands; never export or hand-mint one."
+      "  Session: your env already has WORKIT_SESSION_ID (the lead's id; SubagentStart issues ids only to verifiers and reviewers). Use it as is: workit commands read it and `workit git commit` adds the Workit-Session trailer; never export or hand-mint one."
     ];
   if (identity === "derived")
     return [
       "  Session: your host already sets WORKIT_SESSION_ID in your shell; export nothing and never hand-mint one."
     ];
   return [`  export WORKIT_SESSION_ID=${session}`];
-}, rules = (identity, mode, branch, base) => {
-  const plain = identity === "issued";
+}, rules = (mode, branch, base, worktree) => {
+  const workit = worktree ? `workit --cwd ${worktree}` : "workit";
   let first = `  1. First command: \`workit git branch ${branch} --base ${base}\` (your worktree may start on another name).`;
-  if (mode === "resume")
+  if (worktree)
+    first = `  1. Work only in WORKTREE, already on ${branch}${mode === "resume" ? " at its head" : ""}: edit files under it and run each git and check command against it, one verb per call (\`${workit} git commit …\`, \`${workit} check <name>\`), never \`cd … &&\` chains or \`$VAR\` paths. An implementer's change outside it is denied.`;
+  else if (mode === "resume")
     first = `  1. First command: \`git switch ${branch}\`, then continue from its head.`;
-  else if (plain)
-    first = `  1. First command: \`git fetch origin && git switch -c ${branch} origin/${base}\` (plain git: worktree isolation refuses every \`workit git\` form).`;
   return [
     "RULES:",
     first,
     '  2. Decide ambiguities yourself: `workit ledger ruling "<what>" --why "<why>" --cost-if-wrong "<cost>"`; stop only for an irreversible, security-sensitive or out-of-worktree action.',
-    plain ? '  3. Commit with plain `git commit -m <msg> --trailer "Workit-Session: <the WORKIT_SESSION_ID in your env>" --trailer "<your host attribution trailer>" -- <paths in SCOPE>`; push only if this brief says so.' : "  3. Commit with `workit git commit -m <msg> -- <paths in SCOPE>`; push only if this brief says so.",
+    `  3. Commit with \`${workit} git commit -m <msg> -- <paths in SCOPE>\`; push only if this brief says so.`,
     "  4. Never record a verdict on your own work.",
     "  5. Run tests, lint, typecheck and builds only through `workit check` (a named check, or `workit check --heavy -- <cmd>`): one machine-wide lease queues every agent, so never a hand-made flock; `workit lock status` shows who holds it.",
     "  6. A failed review gets one fix round and one recheck. Still failing: stop and report the open finding, never a third round (the lead spawns a decider). A product choice is the user's: report it, do not decide it."
@@ -83449,7 +83628,7 @@ var init_fanout_brief = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-landed.ts
-import { spawnSync as spawnSync27 } from "node:child_process";
+import { spawnSync as spawnSync28 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
     return { forge: null, down: () => null };
@@ -83540,7 +83719,7 @@ function trunkPatchIds(ctx, fork) {
     "--"
   ]);
   if (log.ok && log.stdout.trim()) {
-    const run = spawnSync27("git", ["patch-id", "--stable"], {
+    const run = spawnSync28("git", ["patch-id", "--stable"], {
       cwd: ctx.cwd,
       input: log.stdout,
       encoding: "utf8",
@@ -84114,8 +84293,8 @@ var exports_fanout = {};
 __export(exports_fanout, {
   run: () => run18
 });
-import fs32 from "node:fs";
-import path56 from "node:path";
+import fs33 from "node:fs";
+import path58 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -84176,10 +84355,10 @@ function plan2(argv, io) {
     return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path56.resolve(io.cwd, flags.positionals[0]);
+  const file = path58.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
-    raw = JSON.parse(fs32.readFileSync(file, "utf8"));
+    raw = JSON.parse(fs33.readFileSync(file, "utf8"));
   } catch (error) {
     return usage3(io, `cannot read ${file} as JSON: ${error.message}`, PLAN_USAGE2);
   }
@@ -99710,7 +99889,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path57 from "node:path";
+import path59 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -100203,12 +100382,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path57.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path59.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path57.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path59.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -100596,11 +100775,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync28 } from "node:child_process";
+import { spawnSync as spawnSync29 } from "node:child_process";
 import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync23, statSync as statSync8 } from "node:fs";
-import path58 from "node:path";
+import path60 from "node:path";
 function git7(cwd, args) {
-  const run = spawnSync28("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -100611,7 +100790,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync10(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path58.join(dir, entry.name);
+    const full = path60.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -100623,7 +100802,7 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path58.resolve(cwd, input);
+    const full = path60.resolve(cwd, input);
     if (!existsSync20(full))
       missing.push(input);
     else if (statSync8(full).isDirectory())
@@ -100660,11 +100839,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path58.join(root, file), lines);
+    changed.set(path60.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path58.join(root, file), "all");
+    changed.set(path60.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -100726,7 +100905,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path58.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path60.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -100756,7 +100935,7 @@ import {
   copyFileSync as copyFileSync6
 } from "node:fs";
 import os18 from "node:os";
-import path59 from "node:path";
+import path61 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -100829,7 +101008,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path59.posix.join(path59.posix.dirname(file), spec)) === target)
+        if (stripExt(path61.posix.join(path61.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -100849,12 +101028,12 @@ function removeStaleCopies(tmp = os18.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path59.join(tmp, name);
+    const dir = path61.join(tmp, name);
     try {
       const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync24(path59.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync24(path61.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -100871,8 +101050,8 @@ function removeStaleCopies(tmp = os18.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync10(target, { recursive: true });
   for (const entry of readdirSync11(origin, { withFileTypes: true })) {
-    const from = path59.join(origin, entry.name);
-    const to = path59.join(target, entry.name);
+    const from = path61.join(origin, entry.name);
+    const to = path61.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -100888,9 +101067,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path59.relative(repo, real);
-      if (!relative.startsWith("..") && !path59.isAbsolute(relative) && !relative.split(path59.sep).includes("node_modules")) {
-        symlinkSync(path59.join(copy, relative), to, "junction");
+      const relative = path61.relative(repo, real);
+      if (!relative.startsWith("..") && !path61.isAbsolute(relative) && !relative.split(path61.sep).includes("node_modules")) {
+        symlinkSync(path61.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -100906,7 +101085,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync9(repo);
   if (real && inside4(realRepo, real)) {
-    symlinkSync(path59.relative(path59.dirname(to), path59.join(tree, path59.relative(realRepo, real))), to);
+    symlinkSync(path61.relative(path61.dirname(to), path61.join(tree, path61.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync9(real).isFile())
@@ -100915,10 +101094,10 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path59.join(copy, file);
+  const target = path61.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside4(realpathSync9(copy), realpathSync9(path59.dirname(target))))
+    if (!stat.isFile() || !inside4(realpathSync9(copy), realpathSync9(path61.dirname(target))))
       return false;
   } catch {
     return false;
@@ -100929,9 +101108,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path59.join(os18.tmpdir(), TEMP_PREFIX));
-  writeFileSync11(path59.join(dir, PID_FILE), String(process.pid));
-  const tree = path59.join(dir, "tree");
+  const dir = mkdtempSync4(path61.join(os18.tmpdir(), TEMP_PREFIX));
+  writeFileSync11(path61.join(dir, PID_FILE), String(process.pid));
+  const tree = path61.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -100948,29 +101127,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path59.join(repo, relative);
+    const from = path61.join(repo, relative);
     let stat;
     try {
       stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path59.join(tree, relative);
-    mkdirSync10(path59.dirname(to), { recursive: true });
+    const to = path61.join(tree, relative);
+    mkdirSync10(path61.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync6(from, to);
-    let parent = path59.dirname(relative);
+    let parent = path61.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path59.dirname(parent);
+      parent = path61.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path59.join(repo, parent, "node_modules");
-    if (existsSync21(modules) && !existsSync21(path59.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path59.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path61.join(repo, parent, "node_modules");
+    if (existsSync21(modules) && !existsSync21(path61.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path61.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -101009,14 +101188,14 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync24(path59.join(repo, file), "utf8") };
+      return { file, text: readFileSync24(path61.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path59.relative(repo, absolute));
+    const relative = toPosix(path61.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
     if (NOT_SOURCE.test(relative) || !existsSync21(absolute))
@@ -101030,9 +101209,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path59.relative(repo, options.cwd);
+  const cwdRelative = path61.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path59.relative(cwdRelative, file));
+    const relative = toPosix(path61.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -101068,7 +101247,7 @@ async function runMutation(options) {
     return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path59.join(copy, cwdRelative);
+  const copyCwd = path61.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -101103,7 +101282,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync24(path59.join(copy, mutant.file), "utf8");
+      const original = readFileSync24(path61.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -101160,8 +101339,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside4 = (root, file) => {
-  const relative = path59.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path59.isAbsolute(relative);
+  const relative = path61.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path61.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -101210,7 +101389,7 @@ __export(exports_test_audit, {
   run: () => run20
 });
 import { existsSync as existsSync22 } from "node:fs";
-import path60 from "node:path";
+import path62 from "node:path";
 function parse7(argv) {
   const options = {
     paths: [],
@@ -101315,8 +101494,8 @@ async function run20(argv, io) {
     return emit(io, fail2("invalid_input", `${options}
 usage: ${USAGE12}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path60.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path60.relative(io.cwd, file) || file);
+  const repo = top.ok ? path62.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path62.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -101455,7 +101634,7 @@ __export(exports_youtrack, {
   run: () => run22
 });
 import { readFileSync as readFileSync25 } from "node:fs";
-import path61 from "node:path";
+import path63 from "node:path";
 async function run22(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -101501,7 +101680,7 @@ async function run22(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync25(path61.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync25(path63.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE14);
       }
@@ -101570,7 +101749,7 @@ __export(exports_changelog, {
   run: () => run23
 });
 import { readFileSync as readFileSync26 } from "node:fs";
-import path62 from "node:path";
+import path64 from "node:path";
 async function run23(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -101616,7 +101795,7 @@ async function run23(argv, io) {
   ]);
 }
 var USAGE15 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path62.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync26(0, "utf8") : raw.startsWith("@") ? readFileSync26(path64.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -101713,7 +101892,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_host_session();
 init_package();
-import path63 from "node:path";
+import path65 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -102551,7 +102730,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path63.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path65.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail2("invalid_input", parsed.error));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.22.3",
+  "version": "8.23.0",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,13 +38,13 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-cursor": "^8.22.3",
+    "@brainervirus/workit-cursor": "^8.23.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.22.3"
+    "@brainervirus/workit-core": "^8.23.0"
   },
   "engines": {
     "node": ">=24"