@brainervirus/workit-cli 8.29.1 → 8.30.0

package/dist/index.js

@@ -6428,11 +6428,12 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
       };
     }
   }
+  const document2 = parsed;
   return {
     status: "valid",
     path: file,
-    entries: validated.data.workspaces ?? [],
-    document: parsed
+    entries: document2.workspaces ?? [],
+    document: document2
   };
 }, readWorkspacesResult = (dir = configDir()) => {
   const file = path2.join(dir, "workspaces.json");
@@ -6570,7 +6571,40 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     return glob;
   const real = realpathOf(prefix.replace(/\/+$/, "") || "/");
   return real + (prefix.endsWith("/") ? "/" : "") + rest;
-}, globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length, selectWorkspaceMatch = (matches, cwd, workspaceName) => {
+}, globSpecificity = (glob) => glob.replaceAll("\\", "/").split("/").filter((segment) => segment.length > 0 && !/[*?[\]{]/.test(segment)).length, globRoot = (glob) => {
+  const normalized = glob.replaceAll("\\", "/");
+  const wild = /[*?[\]{]/.exec(normalized);
+  const prefix = wild ? normalized.slice(0, wild.index) : normalized;
+  return prefix.replace(/\/+$/u, "") || "/";
+}, literalPrefixes = (glob) => {
+  const normalized = glob.replaceAll("\\", "/");
+  const prefixOf = (value) => {
+    const wild = /[*?[\]{]/.exec(value);
+    return wild ? value.slice(0, wild.index) : value;
+  };
+  return [
+    ...new Set([prefixOf(normalized), prefixOf(canonicalGlob(normalized).replaceAll("\\", "/"))])
+  ];
+}, globsMayOverlap = (a, b) => literalPrefixes(a).some((pa) => literalPrefixes(b).some((pb) => pa.startsWith(pb) || pb.startsWith(pa))), overlappingEntries = (glob, entries) => entries.filter((entry) => globsMayOverlap(entry.glob, glob)), workspaceOverlaps = (entries) => {
+  const out = [];
+  for (const [i, a] of entries.entries())
+    for (const b of entries.slice(i + 1)) {
+      const aInB = matchWorkspace(b.glob, globRoot(a.glob));
+      const bInA = matchWorkspace(a.glob, globRoot(b.glob));
+      if (!aInB && !bInA)
+        continue;
+      const [inner, outer] = aInB && !bInA ? [a, b] : bInA && !aInB ? [b, a] : globSpecificity(a.glob) >= globSpecificity(b.glob) ? [a, b] : [b, a];
+      const si = globSpecificity(inner.glob);
+      const so = globSpecificity(outer.glob);
+      out.push({
+        inner: inner.name,
+        outer: outer.name,
+        at: globRoot(inner.glob),
+        winner: si === so ? null : si > so ? inner.name : outer.name
+      });
+    }
+  return out;
+}, workspaceMatches = (cwd, entries) => matchingEntries(cwd, entries), selectWorkspaceMatch = (matches, cwd, workspaceName) => {
   if (workspaceName !== undefined) {
     const named = matches.filter((entry) => entry.name === workspaceName);
     if (named.length === 1)
@@ -9251,7 +9285,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.29.1",
+    version: "8.30.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9289,13 +9323,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.29.1",
+      "@brainervirus/workit-cursor": "^8.30.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.29.1"
+      "@brainervirus/workit-core": "^8.30.0"
     },
     engines: {
       node: ">=24"
@@ -9660,6 +9694,27 @@ function effectiveEndpoint(endpoint, context) {
     return { endpoint: "green", reason: missing("merge") };
   return { endpoint };
 }
+function endpointMismatch(view) {
+  const { defaultEndpoint: endpoint } = view;
+  const ws = view.workspace ?? "<workspace>";
+  const explicit = (kind) => view.configured.includes(kind) && view.grants[kind] !== false;
+  if (explicit("merge") && endpoint !== "merged")
+    return `merge granted, but endpoint ${endpoint} stops at ${STOPS[endpoint]}; to land on green: workit grant set ${ws} defaultEndpoint=merged (your terminal)`;
+  if (explicit("pr") && endpoint === "commit")
+    return `pr granted, but endpoint commit stops at the local commit; to open PRs: workit grant set ${ws} defaultEndpoint=pr (your terminal)`;
+  return null;
+}
+function entryMismatch(entry) {
+  if (!entry)
+    return null;
+  const { grants } = configuredGrants(entry);
+  return endpointMismatch({
+    workspace: entry.name ?? null,
+    grants: { ...DEFAULT_GRANTS, ...grants },
+    configured: GRANT_KINDS.filter((kind) => grants[kind] !== undefined),
+    defaultEndpoint: endpointOf(entry).endpoint
+  });
+}
 function endpointView(entry, context) {
   const { raw, endpoint, issue } = endpointOf(entry);
   const effective = effectiveEndpoint(endpoint, context);
@@ -9876,7 +9931,7 @@ var accountHome = () => {
 }, grantsHome, grantsDir = () => path11.join(grantsHome.resolve(), ".config", "workit"), grantsOverride = () => {
   const configured = path11.resolve(resolveConfigDir());
   return configured === path11.resolve(grantsDir()) ? null : `the config directory is redirected to ${configured} (WORKFLOW_TOOLKIT_CONFIG, WORKFLOW_TOOLKIT_CONFIG_DIR or XDG_CONFIG_HOME); grants are read only from ${path11.join(grantsDir(), "workspaces.json")}, so the D4 defaults apply`;
-}, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINTS, DEFAULT_ENDPOINT = "commit", isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value), raisesEndpoint = (current, next) => DEFAULT_ENDPOINTS.indexOf(next) > DEFAULT_ENDPOINTS.indexOf(current), VERIFICATION_MODES, DEFAULT_VERIFICATION = "proportional", verificationOf = (entry) => {
+}, GRANT_KINDS, DEFAULT_GRANTS, DEFAULT_ENDPOINTS, DEFAULT_ENDPOINT = "commit", isDefaultEndpoint = (value) => typeof value === "string" && DEFAULT_ENDPOINTS.includes(value), raisesEndpoint = (current, next) => DEFAULT_ENDPOINTS.indexOf(next) > DEFAULT_ENDPOINTS.indexOf(current), STOPS, VERIFICATION_MODES, DEFAULT_VERIFICATION = "proportional", verificationOf = (entry) => {
   const value = entry?.verification;
   return VERIFICATION_MODES.includes(value) ? value : DEFAULT_VERIFICATION;
 }, isGrantKind = (value) => typeof value === "string" && GRANT_KINDS.includes(value), isGrantValue = (value) => value === true || value === false || value === "verified", normalized = (kind, value) => value === "verified" && kind !== "merge" ? true : value, fromAutoApprove = (value) => {
@@ -9909,6 +9964,12 @@ var init_autonomy = __esm(() => {
     rerun: true
   });
   DEFAULT_ENDPOINTS = ["commit", "pr", "green", "merged"];
+  STOPS = {
+    commit: "the local commit",
+    pr: "the PR",
+    green: "a green PR",
+    merged: "the merge"
+  };
   VERIFICATION_MODES = [
     "proportional",
     "self",
@@ -15376,9 +15437,18 @@ function liftStop(context, input) {
   }
   return { ok: true, value: cleared };
 }
+function trackedDirty(cwd) {
+  const status = gitRun2(cwd, ["status", "--porcelain", "--untracked-files=no"]);
+  return status.ok ? status.stdout.trim().length > 0 : null;
+}
+function untrackedFiles2(cwd) {
+  const listed = gitRun2(cwd, ["ls-files", "--others", "--exclude-standard"]);
+  return listed.ok ? listed.stdout.split(`
+`).filter(Boolean) : [];
+}
 function dirtyElsewhere(cwd, branch, head) {
   if (headSha(cwd) === head)
-    return worktreeTree(cwd)?.dirty !== false;
+    return trackedDirty(cwd) !== false;
   const list = git4(cwd, ["worktree", "list", "--porcelain"]);
   let worktree = null;
   for (const line of (list ?? "").split(`
@@ -15386,7 +15456,7 @@ function dirtyElsewhere(cwd, branch, head) {
     if (line.startsWith("worktree "))
       worktree = line.slice("worktree ".length);
     else if (line === `branch refs/heads/${branch}` && worktree) {
-      const status = gitRun2(worktree, ["status", "--porcelain", "--untracked-files=normal"]);
+      const status = gitRun2(worktree, ["status", "--porcelain", "--untracked-files=no"]);
       return status.ok && status.stdout.trim().length > 0;
     }
   }
@@ -15413,8 +15483,9 @@ function recordVerdict(context, input) {
   const key = codeKey(context.cwd, { branch, base: context.base });
   if (!key.head)
     return err("not_found", `branch "${branch}" has no commit to judge`);
-  if (key.dirty === true || key.dirty === null && dirtyElsewhere(context.cwd, branch, key.head))
-    return err("blocked", `dirty_worktree: ${branch} has uncommitted changes, so its head is not what was judged`, "commit or stash the changes, re-check, then record the verdict");
+  const dirty = key.dirty === null ? dirtyElsewhere(context.cwd, branch, key.head) : trackedDirty(context.cwd) !== false;
+  if (dirty)
+    return err("blocked", `dirty_worktree: ${branch} has uncommitted changes to tracked files, so its head is not what was judged`, "commit or stash the changes, re-check, then record the verdict");
   const session = context.actor.session;
   const selfReason = input.self === true ? "flag" : session && input.derivedFrom !== null ? null : "no_session";
   const self2 = selfReason !== null;
@@ -15440,9 +15511,14 @@ function recordVerdict(context, input) {
     selfReason,
     sessionSource: context.sessionSource ?? "env",
     ...context.sessionBound === true ? { sessionBound: true } : {},
-    evidenceRefs: input.evidenceRefs ?? []
+    evidenceRefs: input.evidenceRefs ?? [],
+    ...untrackedField(context.cwd)
   }, { now: context.now });
 }
+function untrackedField(cwd) {
+  const files = untrackedFiles2(cwd);
+  return files.length ? { untracked: files.slice(0, MAX_UNTRACKED_LISTED), untrackedCount: files.length } : {};
+}
 function recordHandoff(context, input) {
   return appendRow(context.cwd, { ...common(context, noteKey(context)), type: "handoff", note: input.note, next: input.next }, { now: context.now });
 }
@@ -15783,7 +15859,7 @@ ${body}`), TAIL_BYTES, lastLine = (fd, size) => {
 }, required2 = (value, flag) => {
   const text = value?.trim();
   return text ? { ok: true, value: text } : err("invalid_input", `${flag} is required`);
-}, fromLead = (row, leads) => leads === null || row.actor.session !== null && leads.includes(row.actor.session), isDelegateSession = (session) => session !== null && (/-w-[a-z0-9._-]+(?:\+try\d)?$/u.test(session) || /-v\d+$/u.test(session) || session.includes(":")), stopOrderText = (note) => `STOP: start nothing new, stop every process you started (dev servers, browsers, watchers), commit only finished work, and report to the lead now${note ? ` (${note})` : ""}`, OBSERVED_ONLY, MAX_DIRTY_PATHS = 10, dirtyState = (cwd) => {
+}, fromLead = (row, leads) => leads === null || row.actor.session !== null && leads.includes(row.actor.session), isDelegateSession = (session) => session !== null && (/-w-[a-z0-9._-]+(?:\+try\d)?$/u.test(session) || /-v\d+$/u.test(session) || session.includes(":")), stopOrderText = (note) => `STOP: start nothing new, stop every process you started (dev servers, browsers, watchers), commit only finished work, and report to the lead now${note ? ` (${note})` : ""}`, MAX_UNTRACKED_LISTED = 20, OBSERVED_ONLY, MAX_DIRTY_PATHS = 10, dirtyState = (cwd) => {
   const run = gitRun2(cwd, ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], GIT_TIMEOUTS.worktree);
   if (!run.ok)
     return { dirty: false, files: 0, paths: [] };
@@ -68429,6 +68505,24 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return [];
   }
 }, checkWorkspaceMismatch = (res) => {
+  const check = checkWorkspaceMatch(res);
+  const result = readWorkspacesResult(res.configDir);
+  if (result.status !== "valid")
+    return check;
+  const overlaps = workspaceOverlaps(result.entries);
+  if (overlaps.length === 0)
+    return check;
+  const lines = overlaps.map((overlap) => overlap.winner ? `overlap: ${overlap.inner} inside ${overlap.outer}, ${overlap.winner} wins at ${overlap.at}` : `overlap: ${overlap.inner} and ${overlap.outer} tie at ${overlap.at} (ambiguous)`);
+  const ties = overlaps.filter((overlap) => !overlap.winner);
+  return {
+    ...check,
+    detail: [check.detail, ...lines].join("; "),
+    ...ties.length && check.status === "pass" ? {
+      status: "warn",
+      fix: `Make one glob more specific than the other in ${result.path} (workit workspace list shows the effective entry)`
+    } : {}
+  };
+}, checkWorkspaceMatch = (res) => {
   const result = readWorkspacesResult(res.configDir);
   const file = result.path;
   if (result.status === "missing" || result.status === "valid" && result.entries.length === 0)
@@ -68902,6 +68996,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     status: "pass",
     detail: "no hook passed its deadline in the last day"
   };
+}, checkGrantEndpoint = (res) => {
+  let line = null;
+  try {
+    line = entryMismatch(resolveWorkspaceFrom(res.cwd, res.configDir));
+  } catch {}
+  return line ? {
+    id: "grant_endpoint",
+    status: "warn",
+    detail: line.split("; ")[0],
+    fix: line.split("; ")[1]
+  } : { id: "grant_endpoint", status: "pass", detail: "grants and default endpoint agree" };
 }, checkChecksConfig = (res) => {
   const root = checkRoot(res.cwd);
   const current = existsSync16(path38.join(root, CHECKS_FILE));
@@ -69195,6 +69300,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return report;
 };
 var init_doctor = __esm(() => {
+  init_autonomy();
   init_support_matrix();
   init_store_lock();
   init_runtime_identity();
@@ -69250,6 +69356,7 @@ var init_doctor = __esm(() => {
     checkLogWritable,
     checkHeavyScope,
     checkHookDeadline,
+    checkGrantEndpoint,
     checkChecksConfig,
     checkHostPermissions("claude-code", "claude_permissions"),
     checkHostPermissions("codex", "codex_permissions"),
@@ -75853,7 +75960,8 @@ function show(argv, io) {
       return emit(io, fail2("not_found", `no workspace named "${named[0]}" in ${listed.path}`));
     return emit(io, ok2({ path: listed.path, defaults: DEFAULT_GRANTS, workspaces: rows }), () => rows.flatMap((entry) => [
       `${entry.name} (${entry.glob})`,
-      ...describe2(entry.grants, entry.configured, entry, entry.verification)
+      ...describe2(entry.grants, entry.configured, entry, entry.verification),
+      ...endpointMismatch({ ...entry, workspace: entry.name }) ? [`note: ${endpointMismatch({ ...entry, workspace: entry.name })}`] : []
     ]));
   }
   let autonomy;
@@ -75874,6 +75982,7 @@ function show(argv, io) {
     ...tierModelIssues.map((issue) => `note: ${issue}`),
     data.workspace ? `workspace ${data.workspace} (${data.source === "default" ? "D4 defaults" : `from ${data.source}`})` : "no workspace matches this checkout: D4 defaults apply",
     ...describe2(data.grants, data.configured, data, data.verification),
+    ...endpointMismatch(data) ? [`note: ${endpointMismatch(data)}`] : [],
     ...describeReleaseTracks(tracks).map((line) => `  ${line}`),
     "raising a grant needs the user: workit grant set <workspace> <kind>=<value>"
   ]);
@@ -75933,7 +76042,9 @@ async function change(verb, argv, io, deps) {
     const command = `workit grant ${verb} ${workspace} ${specs.join(" ")}`;
     const agent = agentMarker(io.env);
     if (!deps.interactive() || agent)
-      return emit(io, fail2("blocked", `grant_raise_refused: raising ${raised.map(({ kind }) => kind).join(", ")} needs the user at an interactive terminal${agent ? ` (this shell belongs to an agent: ${agent} is set)` : ""}; grants are never raised headless`, { unblock: `ask the user to run, in their own terminal: ${command}` }));
+      return emit(io, fail2("blocked", `grant_raise_refused: raising ${raised.map(({ kind }) => kind).join(", ")} needs the user at an interactive terminal${agent ? ` (this shell belongs to an agent: ${agent} is set)` : ""}; grants are never raised headless`, {
+        unblock: `ask the user to run, in a terminal outside the agent host (not Claude Code's \`!\` prefix or an agent shell): ${command}`
+      }));
     const answer = await askOrCancel(io, () => deps.ask(`Raise ${raised.map(({ kind, value }) => `${kind}=${value}`).join(", ")} for workspace "${workspace}"? An agent there may then do this without asking. Type the workspace name to confirm: `));
     if (answer === null)
       return cancelled(io);
@@ -76003,6 +76114,288 @@ var init_grant = __esm(() => {
   };
 });
 
+// packages/workit-cli/src/verbs/workspace.ts
+var exports_workspace = {};
+__export(exports_workspace, {
+  INHERITED_KEYS: () => INHERITED_KEYS,
+  run: () => run11,
+  runWorkspace: () => runWorkspace
+});
+import { copyFileSync as copyFileSync7, existsSync as existsSync21 } from "node:fs";
+function list2(argv, io) {
+  if (argv.length)
+    return usage3(io, `unexpected argument ${argv[0]}`);
+  const current = load(io);
+  if (typeof current === "number")
+    return current;
+  const entries = entriesOf(current);
+  const matches = workspaceMatches(io.cwd, entries);
+  let effective = null;
+  let reason;
+  try {
+    effective = resolveWorkspaceFromEntries(io.cwd, entries)?.name ?? null;
+    reason = matches.length === 0 ? "no glob matches this directory: the defaults apply" : matches.length === 1 ? "the only glob that matches" : `the most specific of ${matches.length} matching globs (${matches.map((entry) => `${entry.name}: ${globSpecificity(entry.glob)} literal segments`).join(", ")})`;
+  } catch (error) {
+    reason = error instanceof WorkspaceConfigError ? error.message : String(error);
+  }
+  const rows = entries.map((entry) => ({
+    name: entry.name,
+    glob: entry.glob,
+    keys: Object.keys(entry).filter((key) => key !== "name" && key !== "glob")
+  }));
+  return emit(io, ok2({
+    path: current.path,
+    workspaces: rows,
+    cwd: io.cwd,
+    effective,
+    matches: matches.map((entry) => entry.name),
+    reason
+  }), (data) => [
+    ...data.workspaces.length ? [] : [`no workspaces in ${data.path}`],
+    ...data.workspaces.map((row) => `${row.name === data.effective ? "*" : " "} ${row.name} (${row.glob})${row.keys.length ? `: ${row.keys.join(", ")}` : ""}`),
+    `${data.cwd}: ${data.effective ? `workspace ${data.effective}` : "no workspace"} (${data.reason})`
+  ]);
+}
+function add2(argv, io) {
+  const positional = argv.filter((arg, index) => !arg.startsWith("--") && !["--glob", "--from"].includes(argv[index - 1] ?? ""));
+  const [name, extra] = positional;
+  if (!name)
+    return usage3(io, "add needs <name>");
+  if (extra)
+    return usage3(io, `unexpected argument ${extra}`);
+  const glob = flagValue(argv, "--glob");
+  if (!glob)
+    return usage3(io, "add needs --glob <glob>");
+  const checked = validateWorkspaceGlob(glob);
+  if (!checked.ok)
+    return emit(io, fail2("invalid_input", checked.error));
+  const from = flagValue(argv, "--from");
+  if (from === null)
+    return usage3(io, "--from needs <parent>");
+  const current = load(io);
+  if (typeof current === "number")
+    return current;
+  const entries = entriesOf(current);
+  if (entries.some((entry) => entry.name === name))
+    return emit(io, fail2("invalid_input", `a workspace named "${name}" already exists in ${current.path}`, {
+      unblock: `workit workspace set ${name} <key>=<value>`
+    }));
+  const parent = from === undefined ? undefined : entries.find((entry) => entry.name === from);
+  if (from !== undefined && !parent)
+    return emit(io, fail2("not_found", `no workspace named "${from}" in ${current.path}`));
+  const inherited = parent ? Object.fromEntries(INHERITED_KEYS.filter((key) => parent[key] !== undefined).map((key) => [
+    key,
+    structuredClone(parent[key])
+  ])) : {};
+  const shadowed = overlappingEntries(glob, entries);
+  const entry = {
+    name,
+    glob,
+    ...inherited,
+    ...clampToShadowed(shadowedCeiling(entries))
+  };
+  const result = save(current, [...entries, entry]);
+  if (!result.ok)
+    return emit(io, fail2("invalid_input", result.error));
+  const ceiling = ceilingOf(entry);
+  return emit(io, ok2({
+    path: result.path,
+    backup: result.backup,
+    workspace: entry,
+    inherited: Object.keys(inherited),
+    shadows: shadowed.map((item) => item.name),
+    grants: ceiling.grants,
+    defaultEndpoint: ceiling.endpoint,
+    verification: ceiling.verification
+  }), (data) => [
+    `${name} (${glob}) added to ${written(data.path, data.backup)}`,
+    ...data.inherited.length ? [`  from ${from}: ${data.inherited.join(", ")}`] : [],
+    ...data.shadows.length ? [`  overlaps: ${data.shadows.join(", ")}`] : [],
+    `  grants start at the strictest level of every workspace and the defaults:`,
+    `  grants: ${GRANT_KINDS.map((kind) => `${kind}=${String(data.grants[kind])}`).join(" ")}; default endpoint ${data.defaultEndpoint}; verification ${data.verification}`,
+    `  raising a grant needs the user, in their own terminal: workit grant set ${name} <kind>=<value>`
+  ]);
+}
+function set2(argv, io) {
+  const [name, ...specs] = argv;
+  if (!name || specs.length === 0)
+    return usage3(io, "set needs <name> and <key>=<value>");
+  const grantSpecs = [];
+  const changes = [];
+  for (const spec of specs) {
+    const eq = spec.indexOf("=");
+    if (eq <= 0)
+      return usage3(io, `${spec}: expected <key>=<value>`);
+    const key = spec.slice(0, eq);
+    const keyPath = key.split(".");
+    if (keyPath.some((part) => !SEGMENT.test(part) || UNSAFE_SEGMENTS.has(part)))
+      return usage3(io, `${spec}: each key segment is letters, digits, _ or -`);
+    if (GRANT_KEYS.has(keyPath[0])) {
+      grantSpecs.push(spec);
+      continue;
+    }
+    if (SCOPE_KEYS.has(keyPath[0]))
+      return emit(io, fail2("blocked", `${keyPath[0]} decides where the entry's grants apply; workspace set does not change it`, {
+        unblock: `ask the user to edit ${keyPath[0]} of "${name}" in their own editor, or add a new entry: workit workspace add <name> --glob <g> --from ${name}`
+      }));
+    if (!SETTABLE_KEYS.has(keyPath[0]))
+      return usage3(io, `${spec}: unknown key ${keyPath[0]} (settable: ${[...SETTABLE_KEYS].join(", ")})`);
+    changes.push({ path: keyPath, value: parseSetValue(spec.slice(eq + 1)) });
+  }
+  if (grantSpecs.length)
+    return emit(io, fail2("blocked", `workspace set does not change grants, defaultEndpoint or verification (${grantSpecs.join(", ")})`, {
+      unblock: `ask the user to run, in their own terminal outside the agent host: workit grant set ${name} ${grantSpecs.join(" ")}`
+    }));
+  const current = load(io);
+  if (typeof current === "number")
+    return current;
+  const entries = structuredClone(entriesOf(current));
+  const entry = entries.find((item) => item.name === name);
+  if (!entry)
+    return emit(io, fail2("not_found", `no workspace named "${name}" in ${current.path}`));
+  const credential = changes.find((change) => change.path[0] === "vcs");
+  if (credential && (configuredGrants(entry).source !== "default" || entry.defaultEndpoint !== undefined))
+    return emit(io, fail2("blocked", `${name} has grants of its own; its vcs decides the account they act through, so workspace set does not change it`, {
+      unblock: `ask the user to change ${credential.path.join(".")} of "${name}" in their own editor, or to unset the grants first (workit grant unset ${name} …)`
+    }));
+  for (const change of changes) {
+    let target = entry;
+    for (const part of change.path.slice(0, -1)) {
+      const next = target[part];
+      if (next === undefined || next === null)
+        target[part] = {};
+      else if (typeof next !== "object" || Array.isArray(next))
+        return usage3(io, `${change.path.join(".")}: ${part} is not an object`);
+      target = target[part];
+    }
+    const last = change.path[change.path.length - 1];
+    if (change.value === null)
+      delete target[last];
+    else
+      target[last] = change.value;
+  }
+  const result = save(current, entries);
+  if (!result.ok)
+    return emit(io, fail2("invalid_input", result.error));
+  return emit(io, ok2({ path: result.path, backup: result.backup, workspace: entry }), (data) => [
+    `${name}: ${changes.map((change) => change.path.join(".")).join(", ")} updated in ${written(data.path, data.backup)}`
+  ]);
+}
+async function runWorkspace(argv, io) {
+  const [sub, ...rest] = argv.filter((arg) => arg !== "--json" && arg !== "--");
+  if (sub === undefined || sub === "list")
+    return list2(rest, io);
+  if (sub === "add")
+    return add2(rest, io);
+  if (sub === "set")
+    return set2(rest, io);
+  return usage3(io, `unknown subcommand "${sub}"`);
+}
+var USAGE4 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>…", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
+  grants: { ...DEFAULT_GRANTS, ...configuredGrants(entry).grants },
+  endpoint: isDefaultEndpoint(entry?.defaultEndpoint) ? entry.defaultEndpoint : DEFAULT_ENDPOINT,
+  verification: verificationOf(entry)
+}), STRICTNESS, looser = (current, next) => STRICTNESS.indexOf(next) > STRICTNESS.indexOf(current), shadowedCeiling = (shadowed) => {
+  if (shadowed.length === 0)
+    return null;
+  const ceilings = shadowed.map(ceilingOf);
+  const grants = { ...DEFAULT_GRANTS };
+  for (const kind of GRANT_KINDS)
+    grants[kind] = ceilings.map((ceiling) => ceiling.grants[kind]).reduce((low, value) => raises(kind, value, low) ? value : low);
+  return {
+    grants,
+    endpoint: ceilings.map((ceiling) => ceiling.endpoint).reduce((low, value) => raisesEndpoint(value, low) ? value : low),
+    verification: ceilings.map((ceiling) => ceiling.verification).reduce((strict, value) => looser(value, strict) ? value : strict)
+  };
+}, clampToShadowed = (shadowed) => {
+  if (!shadowed)
+    return {};
+  const autonomy = Object.fromEntries(GRANT_KINDS.filter((kind) => raises(kind, shadowed.grants[kind], DEFAULT_GRANTS[kind])).map((kind) => [kind, shadowed.grants[kind]]));
+  return {
+    ...Object.keys(autonomy).length ? { autonomy } : {},
+    ...looser(shadowed.verification, DEFAULT_VERIFICATION) ? { verification: shadowed.verification } : {}
+  };
+}, usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
+usage: ${USAGE4}`)), load = (io) => {
+  const current = readWorkspacesResult();
+  if (current.status === "malformed" || current.status === "invalid")
+    return emit(io, fail2("invalid_input", current.error ?? `${current.path} is invalid`));
+  return current;
+}, entriesOf = (current) => current.entries, save = (current, entries) => {
+  const document2 = { ...current.document, workspaces: entries };
+  const validated = validateWorkspacesDocument(document2, current.path);
+  if (validated.status !== "valid")
+    return { ok: false, error: validated.error ?? "invalid workspaces.json" };
+  const latest = readWorkspacesResult();
+  if (latest.revision !== current.revision)
+    return { ok: false, error: `${current.path} changed; retry` };
+  let backup = null;
+  try {
+    if (existsSync21(current.path)) {
+      backup = `${current.path}.bak`;
+      copyFileSync7(current.path, backup);
+    }
+    writeFileAtomic(current.path, `${JSON.stringify(document2, null, 2)}
+`);
+  } catch (error) {
+    return {
+      ok: false,
+      error: `failed to write ${current.path}: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  return { ok: true, path: current.path, backup };
+}, written = (path, backup) => `${path}${backup ? ` (previous copy: ${backup})` : ""}`, flagValue = (argv, flag) => {
+  const index = argv.findIndex((arg) => arg === flag || arg.startsWith(`${flag}=`));
+  if (index < 0)
+    return;
+  const arg = argv[index];
+  if (arg.includes("="))
+    return arg.slice(flag.length + 1);
+  return argv[index + 1] ?? null;
+}, parseSetValue = (raw) => {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}, run11 = (argv, io) => runWorkspace(argv, io);
+var init_workspace = __esm(() => {
+  init_autonomy();
+  init_safe_write();
+  init_workspaces();
+  init_output();
+  INHERITED_KEYS = [
+    "vcs",
+    "issues",
+    "branchPolicy",
+    "commitPolicy",
+    "trailers",
+    "youtrack",
+    "models"
+  ];
+  GRANT_KEYS = new Set(["autonomy", "autoApprove", "defaultEndpoint", "verification"]);
+  SCOPE_KEYS = new Set(["name", "glob"]);
+  SETTABLE_KEYS = new Set([
+    "vcs",
+    "issues",
+    "branchPolicy",
+    "commitPolicy",
+    "trailers",
+    "liveSessionGuard",
+    "youtrack",
+    "models",
+    "fanout",
+    "delegation",
+    "defaultProfile",
+    "profiles",
+    "releaseTracks",
+    "resources"
+  ]);
+  SEGMENT = /^[A-Za-z0-9_-]+$/u;
+  UNSAFE_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);
+  STRICTNESS = ["independent", "self", "proportional"];
+});
+
 // packages/workit-core/src/core/heavy-rules.ts
 import fs22 from "node:fs";
 import path46 from "node:path";
@@ -76876,7 +77269,7 @@ __export(exports_check, {
   OUTPUT_LINES: () => OUTPUT_LINES,
   boundedOutput: () => boundedOutput,
   hostToolWaitCapMs: () => hostToolWaitCapMs,
-  run: () => run11,
+  run: () => run12,
   workspaceResources: () => workspaceResources
 });
 import os20 from "node:os";
@@ -77160,10 +77553,10 @@ async function prepareHeavy(io, settings, label, runCwd, timeoutMs) {
     env
   };
 }
-async function run11(argv, io) {
+async function run12(argv, io) {
   const options = parse6(argv);
   if (options instanceof Error)
-    return emit(io, fail2("invalid_input", options.message, { unblock: USAGE4 }));
+    return emit(io, fail2("invalid_input", options.message, { unblock: USAGE5 }));
   const config = loadCheckConfig(io.cwd);
   if (config.note)
     io.stderr(`note: ${config.note}
@@ -77174,7 +77567,7 @@ async function run11(argv, io) {
   let name = options.name;
   if (options.command === null) {
     if (options.positionals.length !== 1 || options.name || options.shell)
-      return emit(io, fail2("invalid_input", "pass a check name, or a command after --", { unblock: USAGE4 }));
+      return emit(io, fail2("invalid_input", "pass a check name, or a command after --", { unblock: USAGE5 }));
     name = options.positionals[0];
     if (config.error)
       return emit(io, fail2("invalid_input", `check config is invalid: ${config.error}`));
@@ -77189,11 +77582,11 @@ async function run11(argv, io) {
   } else {
     if (options.positionals.length)
       return emit(io, fail2("invalid_input", `unexpected argument ${options.positionals[0]} before --`, {
-        unblock: USAGE4
+        unblock: USAGE5
       }));
     command = options.command;
     if (!command.length)
-      return emit(io, fail2("invalid_input", "no command after --", { unblock: USAGE4 }));
+      return emit(io, fail2("invalid_input", "no command after --", { unblock: USAGE5 }));
     if (options.shell && command.length !== 1)
       return emit(io, fail2("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
@@ -77372,7 +77765,7 @@ async function run11(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE4 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path49.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, HOST_TOOL_WAIT_CAP_MS = 1e5;
+var USAGE5 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path49.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, HOST_TOOL_WAIT_CAP_MS = 1e5;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -77395,7 +77788,7 @@ var init_check = __esm(() => {
 // packages/workit-cli/src/verbs/lock.ts
 var exports_lock = {};
 __export(exports_lock, {
-  run: () => run12
+  run: () => run13
 });
 import fs25 from "node:fs";
 import path50 from "node:path";
@@ -77466,7 +77859,7 @@ async function runHeavy(args, io) {
       unblock: "workit lock run [--shell] [--wait <s>] [--timeout <s>] -- <cmd…>"
     }));
   const check = await Promise.resolve().then(() => (init_check(), {}));
-  return run11([`--heavy`, ...head, ...args.slice(split)], io);
+  return run12([`--heavy`, ...head, ...args.slice(split)], io);
 }
 function readPatterns(file) {
   try {
@@ -77537,7 +77930,7 @@ async function heavy(args, io) {
     unblock: "workit lock heavy list|add <pattern>|remove <pattern>|test -- <cmd…>"
   }));
 }
-async function run12(argv, io) {
+async function run13(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "status")
     return status(io);
@@ -77547,9 +77940,9 @@ async function run12(argv, io) {
     return runHeavy(rest, io);
   if (sub === "heavy")
     return heavy(rest, io);
-  return emit(io, fail2("invalid_input", `unknown lock subcommand ${sub ?? "(none)"}`, { unblock: USAGE5 }));
+  return emit(io, fail2("invalid_input", `unknown lock subcommand ${sub ?? "(none)"}`, { unblock: USAGE6 }));
 }
-var USAGE5 = "workit lock status | wait [--timeout <s>] | run [--shell] [--wait <s>] [--timeout <s>] -- <cmd…> | heavy list|add|remove|test", held = (slots) => slots.filter((slot) => slot.holder && !slot.stale), sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), commandText = (args) => {
+var USAGE6 = "workit lock status | wait [--timeout <s>] | run [--shell] [--wait <s>] [--timeout <s>] -- <cmd…> | heavy list|add|remove|test", held = (slots) => slots.filter((slot) => slot.holder && !slot.stale), sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), commandText = (args) => {
   const split = args.indexOf("--");
   return (split < 0 ? args : args.slice(split + 1)).join(" ").trim();
 };
@@ -77564,15 +77957,15 @@ var init_lock = __esm(() => {
 // packages/workit-cli/src/verbs/models.ts
 var exports_models = {};
 __export(exports_models, {
-  run: () => run13
+  run: () => run14
 });
-import { existsSync as existsSync21, readdirSync as readdirSync10, readFileSync as readFileSync21, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync10, readFileSync as readFileSync21, statSync as statSync9 } from "node:fs";
 import os21 from "node:os";
 import path51 from "node:path";
-async function run13(argv, io) {
+async function run14(argv, io) {
   const [sub, ...args] = argv.filter((arg) => arg !== "--json");
   if (sub !== "show")
-    return emit(io, fail2("invalid_input", `usage: ${USAGE6}`, { unblock: "workit help models" }));
+    return emit(io, fail2("invalid_input", `usage: ${USAGE7}`, { unblock: "workit help models" }));
   const role = flag3(args, "--role");
   const tier = flag3(args, "--tier");
   const hostFlag = flag3(args, "--host");
@@ -77619,7 +78012,7 @@ async function run13(argv, io) {
     ...(data.issues ?? []).map((issue) => `note: ${issue}`)
   ]);
 }
-var USAGE6 = "workit models show [--role <role>] [--tier <tier>] [--host <host>] [--report [--days <n>]] [--json]", flag3 = (argv, name) => {
+var USAGE7 = "workit models show [--role <role>] [--tier <tier>] [--host <host>] [--report [--days <n>]] [--json]", flag3 = (argv, name) => {
   const at = argv.findIndex((arg) => arg === name || arg.startsWith(`${name}=`));
   if (at < 0)
     return null;
@@ -77662,7 +78055,7 @@ var USAGE6 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
             continue;
           const agentType = JSON.parse(readFileSync21(meta, "utf8")).agentType;
           const transcript = meta.replace(/\.meta\.json$/, ".jsonl");
-          if (typeof agentType !== "string" || !existsSync21(transcript))
+          if (typeof agentType !== "string" || !existsSync22(transcript))
             continue;
           const ran = modelsOf(transcript);
           if (!ran.size)
@@ -77801,7 +78194,7 @@ var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock)
 
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync22 } from "node:fs";
 import path52 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
@@ -77819,11 +78212,11 @@ function operationInProgress(cwd) {
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
-    if (!marker || !existsSync22(marker))
+    if (!marker || !existsSync23(marker))
       continue;
-    if (index === 1 && existsSync22(path52.join(marker, "applying")))
+    if (index === 1 && existsSync23(path52.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync22(path52.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync23(path52.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
         headName = readFileSync22(path52.join(marker, "head-name"), "utf8").trim();
@@ -78154,7 +78547,7 @@ function gitCommit(cwd, input) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync22(path52.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync23(path52.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -78182,9 +78575,13 @@ function gitCommit(cwd, input) {
     timeoutMs: COMMIT_TIMEOUT_MS,
     env: { ...input.env ?? process.env, WORKIT_TRAILERS: trailersOn ? "on" : "off" }
   });
-  if (!committed.ok)
+  if (!committed.ok) {
+    const output = gitOutput(committed);
+    const refusal = hookRefusal(output);
     return failure3("failed", `git commit failed (a hook or git refused it):
-${gitOutput(committed)}`);
+${output}${refusal ? `
+${refusal}` : ""}`);
+  }
   const sha = headSha(cwd);
   if (!sha)
     return failure3("failed", "the commit did not resolve");
@@ -78641,6 +79038,14 @@ var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}
   const lines = redactText(`${run.stderr}
 ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trim()).filter((value) => value && !value.startsWith("hint:"));
   return lines.slice(-max).join(" / ").slice(0, 400) || "git failed";
+}, hookRefusal = (output) => {
+  const match = /✖\s+(.*?)\s*\[([\w-]+)\]/u.exec(output);
+  if (!match)
+    return null;
+  const [, text, rule] = match;
+  const limit = /(?:longer|shorter|exceed\w*|more|less|than)\D*?(\d+)/iu.exec(text)?.[1];
+  const got = /(?:current length is|got|is)\s+(\d+)/iu.exec(text)?.[1];
+  return `commit refused by commit-msg hook: ${rule}${limit ? ` ${limit}` : ""}${got ? ` (got ${got})` : ""}${limit || got ? "" : ` (${text})`}`;
 }, OUTPUT_LINES2 = 200, OUTPUT_LINE_CHARS = 1000, gitOutput = (run) => {
   const lines = redactText(`${run.stderr}
 ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((value) => value.trim() && !value.trimStart().startsWith("hint:")).map((value) => value.length > OUTPUT_LINE_CHARS ? `${value.slice(0, OUTPUT_LINE_CHARS)}…` : value);
@@ -79157,6 +79562,8 @@ function waitVerdict(doc, options) {
     };
   if (checks === "pending")
     return { state: "waiting", reason: "checks_pending" };
+  if (doc.checks.pending.length > 0)
+    return { state: "waiting", reason: "checks_pending" };
   if (checks === "passing")
     return { state: "ready", reason: "checks_passing" };
   const ciRequired = doc.checks.missingRequired === null || doc.mergeState === "ci_must_pass" || doc.mergeState === "ci_still_running";
@@ -81365,7 +81772,35 @@ function ancestors(slices) {
   }
   return out;
 }
-function analyzeOverlap(plan, candidates) {
+function regeneratedFiles(root, tracked) {
+  const found = new Map;
+  let scripts;
+  try {
+    const manifest = JSON.parse(fs29.readFileSync(path56.join(root, "package.json"), "utf8"));
+    scripts = manifest.scripts ?? {};
+  } catch {
+    return found;
+  }
+  const runner = fs29.existsSync(path56.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path56.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path56.join(root, "yarn.lock")) ? "yarn run" : "npm run";
+  const outputs = tracked.filter((file) => !CODE.test(file));
+  for (const [name, command] of Object.entries(scripts)) {
+    if (!name.startsWith("write:") || typeof command !== "string")
+      continue;
+    for (const file of command.match(/[\w./-]+\.[cm]?[jt]s\b/gu) ?? []) {
+      let source;
+      try {
+        source = fs29.readFileSync(path56.join(root, file), "utf8");
+      } catch {
+        continue;
+      }
+      for (const output of outputs)
+        if (!found.has(output) && source.includes(output))
+          found.set(output, `${runner} ${name}`);
+    }
+  }
+  return found;
+}
+function analyzeOverlap(plan, candidates, regenerated = new Map) {
   const shared = [...DEFAULT_SHARED, ...plan.shared];
   const before = ancestors(plan.slices);
   const related = (a, b) => Boolean(before.get(a)?.has(b) || before.get(b)?.has(a));
@@ -81386,6 +81821,11 @@ function analyzeOverlap(plan, candidates) {
       overlaps.push({ path: file, slices: ids, resolution: "owner", owner: owners[0].id });
       continue;
     }
+    const writer = spellings.map((spelling) => regenerated.get(spelling)).find(Boolean);
+    if (writer) {
+      overlaps.push({ path: file, slices: ids, resolution: "regenerated", writer });
+      continue;
+    }
     if (owners.length === 0 && matching.every((a, i) => matching.slice(i + 1).every((b) => related(a.id, b.id)))) {
       overlaps.push({ path: file, slices: ids, resolution: "serialized" });
       continue;
@@ -81668,7 +82108,7 @@ function planFanout(cwd, input, now = new Date) {
   const ref = trunkRef(cwd, plan.trunk);
   const tracked = ref ? nulList2(gitRun4(cwd, ["ls-tree", "-r", "-z", "--name-only", ref]).stdout) : [];
   const samples = plan.slices.flatMap((slice) => [...slice.scope, ...slice.owns].flatMap(scopeSamples));
-  const { overlaps, conflicts } = analyzeOverlap(plan, [...tracked, ...samples]);
+  const { overlaps, conflicts } = analyzeOverlap(plan, [...tracked, ...samples], regeneratedFiles(mainCheckout(cwd), tracked));
   if (conflicts.length)
     return fanoutFail("blocked", `${conflicts.length} file-scope overlap${conflicts.length === 1 ? "" : "s"} between slices: ${conflicts[0].slices.join(" and ")} on ${conflicts[0].paths[0]}${conflicts[0].paths.length > 1 ? ` (+${conflicts[0].paths.length - 1})` : ""}`, conflicts[0].suggestion.text, { name: plan.name, conflicts, overlaps });
   const trunkCase = caseIndex(tracked);
@@ -81738,6 +82178,9 @@ function planFanout(cwd, input, now = new Date) {
     if (wave.length > IN_FLIGHT_CAP)
       notes.push(`wave ${index + 1} has ${wave.length} slices; keep 4-${IN_FLIGHT_CAP} in flight and queue the rest`);
   });
+  for (const overlap of overlaps)
+    if (overlap.writer)
+      notes.push(`${overlap.path} is regenerated at fan-in: slices leave it uncommitted, and the lead runs \`${overlap.writer}\` after each rebase`);
   for (const slice of plan.slices)
     if (slice.dependsOn.length > 1 && slice.base === plan.trunk)
       notes.push(`slice ${slice.id} depends on ${slice.dependsOn.join(", ")}: start it from ${plan.trunk} after they land`);
@@ -81779,7 +82222,7 @@ var FANOUT_VERSION = 1, TIERS, REASONS, FAN_IN_MODES, fanoutFail = (code, error,
   if (Array.isArray(value) && value.every((item) => typeof item === "string"))
     return value;
   return null;
-}, ID, quoteList = (items) => items.map((item) => `"${item}"`).join(", "), ownerSuggestion = (slice, paths) => ({
+}, ID, CODE, quoteList = (items) => items.map((item) => `"${item}"`).join(", "), ownerSuggestion = (slice, paths) => ({
   kind: "owner",
   slice,
   paths,
@@ -81829,6 +82272,7 @@ var init_fanout = __esm(() => {
   compiled = new Map;
   PLACEHOLDER3 = /^(?:<[^>]*>|tbd|todo|fixme|\?+|\.\.\.|…)$/iu;
   ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+  CODE = /\.(?:[cm]?[jt]sx?)$/u;
 });
 
 // packages/workit-core/src/forge/exec.ts
@@ -83628,6 +84072,17 @@ function unverifiedFlag(flags) {
     return "--unverified needs --reason <why the user asked for it>";
   return reason.length > MAX_REASON ? `--reason is capped at ${MAX_REASON} characters` : { reason };
 }
+function selector(flags) {
+  const pr = positiveInt(flags.values.pr, "--pr");
+  if (typeof pr === "string")
+    return pr;
+  const branch = flags.values.branch ?? flags.values.head ?? null;
+  if (flags.values.branch !== undefined && flags.values.head !== undefined)
+    return "pass --branch or --head, not both";
+  if (pr && branch)
+    return "pass --pr or --branch, not both";
+  return { pr, branch };
+}
 function positiveInt(value, flag) {
   if (value === undefined)
     return null;
@@ -83714,7 +84169,7 @@ function renderStatus(doc) {
   lines.push(`next: ${doc.next}`);
   return lines;
 }
-var forgeDeps, MAX_REASON = 500, usage3 = (io, message, line) => emit(io, fail2("invalid_input", message, { unblock: line })), forgeFail = (io, result, data) => emit(io, fail2(result.code, result.error, { data, unblock: result.unblock })), CONNECT_BUDGET_MS = 15000, pushIdentity = (io, branch) => checkPushIdentity(io.cwd, {
+var forgeDeps, MAX_REASON = 500, usage4 = (io, message, line) => emit(io, fail2("invalid_input", message, { unblock: line })), forgeFail = (io, result, data) => emit(io, fail2(result.code, result.error, { data, unblock: result.unblock })), CONNECT_BUDGET_MS = 15000, pushIdentity = (io, branch) => checkPushIdentity(io.cwd, {
   branch,
   env: io.env,
   runner: forgeDeps.runner,
@@ -83737,7 +84192,7 @@ var init_forge_common = __esm(() => {
 // packages/workit-cli/src/verbs/pr.ts
 var exports_pr = {};
 __export(exports_pr, {
-  run: () => run14
+  run: () => run15
 });
 import { readFileSync as readFileSync24 } from "node:fs";
 import path58 from "node:path";
@@ -83753,25 +84208,24 @@ function readBodyFile(io, file) {
 async function status2(argv, io) {
   const flags = parseFlags(argv, { pr: "value", branch: "value", "log-lines": "value" });
   if (typeof flags === "string")
-    return usage3(io, flags, STATUS_USAGE);
+    return usage4(io, flags, STATUS_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE);
-  const pr = positiveInt(flags.values.pr, "--pr");
-  if (typeof pr === "string")
-    return usage3(io, pr, STATUS_USAGE);
-  if (pr && flags.values.branch)
-    return usage3(io, "pass --pr or --branch, not both", STATUS_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE);
+  const picked = selector(flags);
+  if (typeof picked === "string")
+    return usage4(io, picked, STATUS_USAGE);
+  const { pr, branch: pickedBranch } = picked;
   const logLines = flags.values["log-lines"] === "0" ? 0 : positiveInt(flags.values["log-lines"], "--log-lines");
   if (typeof logLines === "string")
-    return usage3(io, logLines, STATUS_USAGE);
+    return usage4(io, logLines, STATUS_USAGE);
   if (logLines !== null && logLines > 500)
-    return usage3(io, "--log-lines is capped at 500", STATUS_USAGE);
-  const connected = connect(io, flags.values.branch);
+    return usage4(io, "--log-lines is capped at 500", STATUS_USAGE);
+  const connected = connect(io, pickedBranch);
   if (!connected.ok)
     return forgeFail(io, connected);
   const report = prStatusReport(io.cwd, connected.data, {
     pr,
-    branch: flags.values.branch ?? null,
+    branch: pickedBranch,
     logLines: logLines ?? 60,
     identity: connected.data.identity,
     actor: actorFromEnv(io.env)
@@ -83863,23 +84317,23 @@ async function create4(argv, io) {
     refs: "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, CREATE_USAGE);
+    return usage4(io, flags, CREATE_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, CREATE_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, CREATE_USAGE);
   const fill = flags.booleans.has("fill");
   if (!fill && !flags.values.title)
-    return usage3(io, "pass --title <t> or --fill", CREATE_USAGE);
+    return usage4(io, "pass --title <t> or --fill", CREATE_USAGE);
   if (flags.values.body !== undefined && flags.values["body-file"] !== undefined)
-    return usage3(io, "pass --body or --body-file, not both", CREATE_USAGE);
+    return usage4(io, "pass --body or --body-file, not both", CREATE_USAGE);
   let body = flags.values.body ?? null;
   if (flags.values["body-file"] !== undefined) {
     const read = readBodyFile(io, flags.values["body-file"]);
     if (typeof read === "string")
-      return usage3(io, read, CREATE_USAGE);
+      return usage4(io, read, CREATE_USAGE);
     body = read.body;
   }
   if (flags.values.base !== undefined && flags.values.track !== undefined)
-    return usage3(io, "pass --base or --track, not both (--track picks the base for you)", CREATE_USAGE);
+    return usage4(io, "pass --base or --track, not both (--track picks the base for you)", CREATE_USAGE);
   let base = flags.values.base ?? null;
   const branch = currentBranch(io.cwd);
   const kind = branchKindOf(branch);
@@ -83910,7 +84364,7 @@ async function create4(argv, io) {
       base = route.target;
   }
   if (!base)
-    return usage3(io, "no default target branch is configured; pass --base <b>", CREATE_USAGE);
+    return usage4(io, "no default target branch is configured; pass --base <b>", CREATE_USAGE);
   const connected = connect(io, branch);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -83930,7 +84384,7 @@ async function create4(argv, io) {
     forge: { kind: forge.kind, repo: forge.repo, host: forge.apiHost }
   });
   if (!planned.ok)
-    return usage3(io, planned.error, CREATE_USAGE);
+    return usage4(io, planned.error, CREATE_USAGE);
   const links = planned.data.links;
   const actor = actorFromEnv(io.env);
   const result = await createPullRequest(io.cwd, connected.data, {
@@ -83973,9 +84427,17 @@ async function create4(argv, io) {
     ...issueLines(links, opened, linked, backlinks, data.number),
     ...planned.data.warnings.map((warning) => `note: ${warning}`),
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : [],
-    `next: ${data.next}`
+    `next: ${data.next}${endpointNote(io.cwd)}`
   ]);
 }
+function endpointNote(cwd) {
+  try {
+    const line = endpointMismatch(resolveAutonomy(cwd));
+    return line ? `; ${line}` : "";
+  } catch {
+    return "";
+  }
+}
 function issueLines(links, opened, linked, backlinks, number) {
   if (links.length === 0)
     return [];
@@ -83994,6 +84456,9 @@ async function merge3(argv, io) {
   const flags = parseFlags(argv, {
     pr: "value",
     method: "value",
+    squash: "boolean",
+    merge: "boolean",
+    rebase: "boolean",
     "delete-branch": "boolean",
     unverified: "boolean",
     reason: "value",
@@ -84002,33 +84467,37 @@ async function merge3(argv, io) {
     "body-file": "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, MERGE_USAGE);
+    return usage4(io, flags, MERGE_USAGE);
   const unverified = unverifiedFlag(flags);
   if (typeof unverified === "string")
-    return usage3(io, unverified, MERGE_USAGE);
+    return usage4(io, unverified, MERGE_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, MERGE_USAGE);
-  const pr = positiveInt(flags.values.pr, "--pr");
-  if (typeof pr === "string")
-    return usage3(io, pr, MERGE_USAGE);
-  const method = flags.values.method ?? "squash";
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, MERGE_USAGE);
+  const picked = selector(flags);
+  if (typeof picked === "string")
+    return usage4(io, picked, MERGE_USAGE);
+  const { pr } = picked;
+  const aliases = ["squash", "merge", "rebase"].filter((name) => flags.booleans.has(name));
+  if (aliases.length > 1 || aliases.length === 1 && flags.values.method !== undefined)
+    return usage4(io, "pass one of --squash, --merge, --rebase or --method", MERGE_USAGE);
+  const method = aliases[0] ?? flags.values.method ?? "squash";
   if (!METHODS2.has(method))
-    return usage3(io, "--method must be squash, merge or rebase", MERGE_USAGE);
+    return usage4(io, "--method must be squash, merge or rebase", MERGE_USAGE);
   const { subject } = flags.values;
   if (flags.values.body !== undefined && flags.values["body-file"] !== undefined)
-    return usage3(io, "pass --body or --body-file, not both", MERGE_USAGE);
+    return usage4(io, "pass --body or --body-file, not both", MERGE_USAGE);
   let body = flags.values.body;
   if (flags.values["body-file"] !== undefined) {
     const read = readBodyFile(io, flags.values["body-file"]);
     if (typeof read === "string")
-      return usage3(io, read, MERGE_USAGE);
+      return usage4(io, read, MERGE_USAGE);
     body = read.body;
   }
   if ((subject !== undefined || body !== undefined) && method !== "squash")
-    return usage3(io, "--subject and --body set a squash message; use --method squash", MERGE_USAGE);
+    return usage4(io, "--subject and --body set a squash message; use --method squash", MERGE_USAGE);
   if (subject !== undefined && (!subject.trim() || subject.includes(`
 `)))
-    return usage3(io, "--subject must be one non-empty line", MERGE_USAGE);
+    return usage4(io, "--subject must be one non-empty line", MERGE_USAGE);
   const connected = connect(io);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -84060,12 +84529,13 @@ async function merge3(argv, io) {
 async function ready(argv, io) {
   const flags = parseFlags(argv, { pr: "value", undo: "boolean" });
   if (typeof flags === "string")
-    return usage3(io, flags, READY_USAGE);
+    return usage4(io, flags, READY_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, READY_USAGE);
-  const pr = positiveInt(flags.values.pr, "--pr");
-  if (typeof pr === "string")
-    return usage3(io, pr, READY_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, READY_USAGE);
+  const picked = selector(flags);
+  if (typeof picked === "string")
+    return usage4(io, picked, READY_USAGE);
+  const { pr } = picked;
   const connected = connect(io);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -84091,17 +84561,18 @@ async function edit(argv, io) {
     "add-reviewer": "list"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, EDIT_USAGE);
+    return usage4(io, flags, EDIT_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, EDIT_USAGE);
-  const pr = positiveInt(flags.values.pr, "--pr");
-  if (typeof pr === "string")
-    return usage3(io, pr, EDIT_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, EDIT_USAGE);
+  const picked = selector(flags);
+  if (typeof picked === "string")
+    return usage4(io, picked, EDIT_USAGE);
+  const { pr } = picked;
   let body;
   if (flags.values["body-file"] !== undefined) {
     const read = readBodyFile(io, flags.values["body-file"]);
     if (typeof read === "string")
-      return usage3(io, read, EDIT_USAGE);
+      return usage4(io, read, EDIT_USAGE);
     body = read.body;
   }
   const connected = connect(io);
@@ -84119,7 +84590,7 @@ async function edit(argv, io) {
     }
   });
   if (!result.ok)
-    return result.code === "invalid_input" ? usage3(io, result.error, EDIT_USAGE) : forgeFail(io, result);
+    return result.code === "invalid_input" ? usage4(io, result.error, EDIT_USAGE) : forgeFail(io, result);
   const kind = connected.data.forge.kind;
   return emit(io, ok2(result.data), (data) => [
     `edited ${prLabel(kind, data.number)} (${data.changed.join(", ")}): ${data.title} -> ${data.base}  ${data.url}`
@@ -84128,12 +84599,13 @@ async function edit(argv, io) {
 async function threads(argv, io) {
   const flags = parseFlags(argv, { pr: "value" });
   if (typeof flags === "string")
-    return usage3(io, flags, THREADS_USAGE);
+    return usage4(io, flags, THREADS_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, THREADS_USAGE);
-  const pr = positiveInt(flags.values.pr, "--pr");
-  if (typeof pr === "string")
-    return usage3(io, pr, THREADS_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, THREADS_USAGE);
+  const picked = selector(flags);
+  if (typeof picked === "string")
+    return usage4(io, picked, THREADS_USAGE);
+  const { pr } = picked;
   const connected = connect(io);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -84154,20 +84626,21 @@ async function reply(argv, io) {
     resolve: "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, REPLY_USAGE);
+    return usage4(io, flags, REPLY_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, REPLY_USAGE);
-  const pr = positiveInt(flags.values.pr, "--pr");
-  if (typeof pr === "string")
-    return usage3(io, pr, REPLY_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, REPLY_USAGE);
+  const picked = selector(flags);
+  if (typeof picked === "string")
+    return usage4(io, picked, REPLY_USAGE);
+  const { pr } = picked;
   const thread = flags.values.thread;
   if (!thread)
-    return usage3(io, "--thread <id> is required (workit pr threads)", REPLY_USAGE);
+    return usage4(io, "--thread <id> is required (workit pr threads)", REPLY_USAGE);
   let body = null;
   if (flags.values["body-file"] !== undefined) {
     const read = readBodyFile(io, flags.values["body-file"]);
     if (typeof read === "string")
-      return usage3(io, read, REPLY_USAGE);
+      return usage4(io, read, REPLY_USAGE);
     body = read.body;
   }
   const connected = connect(io);
@@ -84180,13 +84653,13 @@ async function reply(argv, io) {
     resolve: flags.booleans.has("resolve")
   });
   if (!result.ok)
-    return result.code === "invalid_input" ? usage3(io, result.error, REPLY_USAGE) : forgeFail(io, result);
+    return result.code === "invalid_input" ? usage4(io, result.error, REPLY_USAGE) : forgeFail(io, result);
   const kind = connected.data.forge.kind;
   return emit(io, ok2(result.data), (data) => [
     `${[data.replied ? "replied to" : null, data.resolved ? "resolved" : null].filter(Boolean).join(" and ")} thread ${data.thread} on ${prLabel(kind, data.number)}${data.replyUrl ? `  ${data.replyUrl}` : ""}`
   ]);
 }
-async function run14(argv, io) {
+async function run15(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "status")
     return status2(rest, io);
@@ -84202,10 +84675,11 @@ async function run14(argv, io) {
     return threads(rest, io);
   if (sub === "reply")
     return reply(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE7);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE8);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE7 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE8 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
 var init_pr = __esm(() => {
+  init_autonomy();
   init_issue_link();
   init_pr_edit();
   init_pr_ops();
@@ -84230,7 +84704,7 @@ var init_pr = __esm(() => {
 // packages/workit-cli/src/verbs/ci.ts
 var exports_ci = {};
 __export(exports_ci, {
-  run: () => run15
+  run: () => run16
 });
 async function wait2(argv, io) {
   const flags = parseFlags(argv, {
@@ -84241,23 +84715,23 @@ async function wait2(argv, io) {
     interval: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, WAIT_USAGE);
+    return usage4(io, flags, WAIT_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, WAIT_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, WAIT_USAGE);
   const pr = positiveInt(flags.values.pr, "--pr");
   if (typeof pr === "string")
-    return usage3(io, pr, WAIT_USAGE);
+    return usage4(io, pr, WAIT_USAGE);
   const timeoutMs = parseDuration2(flags.values.timeout ?? "20m");
   const intervalMs = parseDuration2(flags.values.interval ?? "30s");
   if (timeoutMs === null || timeoutMs > 6 * 3600000)
-    return usage3(io, "--timeout must be a duration up to 6h (20m, 90s)", WAIT_USAGE);
+    return usage4(io, "--timeout must be a duration up to 6h (20m, 90s)", WAIT_USAGE);
   if (intervalMs === null || intervalMs < 1000 || intervalMs > 600000)
-    return usage3(io, "--interval must be between 1s and 10m", WAIT_USAGE);
+    return usage4(io, "--interval must be between 1s and 10m", WAIT_USAGE);
   if (pr && flags.values.branch)
-    return usage3(io, "pass --pr or --branch, not both", WAIT_USAGE);
+    return usage4(io, "pass --pr or --branch, not both", WAIT_USAGE);
   const head = flags.values.head ?? null;
   if (head !== null && !/^[0-9a-f]{7,64}$/u.test(head))
-    return usage3(io, "--head must be a commit sha (7-64 hex chars)", WAIT_USAGE);
+    return usage4(io, "--head must be a commit sha (7-64 hex chars)", WAIT_USAGE);
   const started = forgeDeps.now();
   const deadline = started + timeoutMs;
   const connected = connect(io, flags.values.branch, {
@@ -84314,7 +84788,8 @@ async function wait2(argv, io) {
     return forgeFail(io, built);
   const doc = built.data;
   const data = {
-    state: verdict.state,
+    state: verdict.state === "waiting" ? "in_progress" : verdict.state,
+    ...verdict.state === "failed" && doc.checks.pending.length > 0 ? { failFast: true, stillRunning: doc.checks.pending } : {},
     reason: verdict.reason,
     polls,
     elapsedMs,
@@ -84352,20 +84827,20 @@ async function rerun(argv, io) {
     force: "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, RERUN_USAGE);
+    return usage4(io, flags, RERUN_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, RERUN_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, RERUN_USAGE);
   const pr = positiveInt(flags.values.pr, "--pr");
   if (typeof pr === "string")
-    return usage3(io, pr, RERUN_USAGE);
+    return usage4(io, pr, RERUN_USAGE);
   const names = flags.lists.check ?? [];
   if (pr && flags.values.branch)
-    return usage3(io, "pass --pr or --branch, not both", RERUN_USAGE);
+    return usage4(io, "pass --pr or --branch, not both", RERUN_USAGE);
   if (names.length && flags.booleans.has("failed"))
-    return usage3(io, "pass --check or --failed, not both", RERUN_USAGE);
+    return usage4(io, "pass --check or --failed, not both", RERUN_USAGE);
   const reason = flags.values.reason;
   if (reason !== "flake" && reason !== "infra")
-    return usage3(io, "--reason flake|infra is required: rerun only what you judged a flake or an infrastructure failure", RERUN_USAGE);
+    return usage4(io, "--reason flake|infra is required: rerun only what you judged a flake or an infrastructure failure", RERUN_USAGE);
   const connected = connect(io, flags.values.branch);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -84402,16 +84877,16 @@ async function rerun(argv, io) {
 async function logs(argv, io) {
   const flags = parseFlags(argv, { pr: "value", branch: "value", failed: "boolean" });
   if (typeof flags === "string")
-    return usage3(io, flags, LOGS_USAGE);
+    return usage4(io, flags, LOGS_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, LOGS_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, LOGS_USAGE);
   if (!flags.booleans.has("failed"))
-    return usage3(io, "pass --failed: only the failing steps' tails are printed", LOGS_USAGE);
+    return usage4(io, "pass --failed: only the failing steps' tails are printed", LOGS_USAGE);
   const pr = positiveInt(flags.values.pr, "--pr");
   if (typeof pr === "string")
-    return usage3(io, pr, LOGS_USAGE);
+    return usage4(io, pr, LOGS_USAGE);
   if (pr && flags.values.branch)
-    return usage3(io, "pass --pr or --branch, not both", LOGS_USAGE);
+    return usage4(io, "pass --pr or --branch, not both", LOGS_USAGE);
   const connected = connect(io, flags.values.branch);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -84446,7 +84921,7 @@ async function logs(argv, io) {
     ])
   ] : [`PR #${data.pr} head ${data.head.slice(0, 7)}: no failing checks`]);
 }
-async function run15(argv, io) {
+async function run16(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "wait")
     return wait2(rest, io);
@@ -84454,7 +84929,7 @@ async function run15(argv, io) {
     return rerun(rest, io);
   if (sub === "logs")
     return logs(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown ci subcommand "${sub}"` : "missing ci subcommand", `${WAIT_USAGE}
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown ci subcommand "${sub}"` : "missing ci subcommand", `${WAIT_USAGE}
        ${RERUN_USAGE}
        ${LOGS_USAGE}`);
 }
@@ -84497,7 +84972,7 @@ var init_implicit_task = __esm(() => {
 // packages/workit-cli/src/verbs/git.ts
 var exports_git = {};
 __export(exports_git, {
-  run: () => run16
+  run: () => run17
 });
 import { readFileSync as readFileSync25 } from "node:fs";
 import path59 from "node:path";
@@ -84521,18 +84996,18 @@ async function branch(argv, io) {
     carry: "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, BRANCH_USAGE);
+    return usage4(io, flags, BRANCH_USAGE);
   const { kind, slug } = flags.values;
   if (flags.positionals.length > 1)
-    return usage3(io, `unexpected argument ${flags.positionals[1]}`, BRANCH_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[1]}`, BRANCH_USAGE);
   if (kind === undefined !== (slug === undefined))
-    return usage3(io, "--kind and --slug go together", BRANCH_USAGE);
+    return usage4(io, "--kind and --slug go together", BRANCH_USAGE);
   if (kind !== undefined && !BRANCH_KINDS.includes(kind))
-    return usage3(io, `--kind must be ${BRANCH_KINDS.join(", ")}; ${kindHint(io.cwd, kind)}`, BRANCH_USAGE);
+    return usage4(io, `--kind must be ${BRANCH_KINDS.join(", ")}; ${kindHint(io.cwd, kind)}`, BRANCH_USAGE);
   if (kind !== undefined && flags.positionals.length)
-    return usage3(io, "pass a name or --kind/--slug, not both", BRANCH_USAGE);
+    return usage4(io, "pass a name or --kind/--slug, not both", BRANCH_USAGE);
   if (kind === undefined && !flags.positionals[0])
-    return usage3(io, "missing branch name", BRANCH_USAGE);
+    return usage4(io, "missing branch name", BRANCH_USAGE);
   const result = gitBranch(io.cwd, {
     ...kind !== undefined ? { kind, slug } : { name: flags.positionals[0] },
     base: flags.values.base ?? null,
@@ -84614,21 +85089,21 @@ function commitMessage(parsed, io) {
 async function commit(argv, io) {
   const parsed = parseCommit(argv);
   if (typeof parsed === "string")
-    return usage3(io, parsed, COMMIT_USAGE);
+    return usage4(io, parsed, COMMIT_USAGE);
   if (parsed.all && parsed.paths.length)
-    return usage3(io, "pass --all or paths, not both", COMMIT_USAGE);
+    return usage4(io, "pass --all or paths, not both", COMMIT_USAGE);
   if (parsed.noEdit && !parsed.amend)
-    return usage3(io, "--no-edit only applies with --amend", COMMIT_USAGE);
+    return usage4(io, "--no-edit only applies with --amend", COMMIT_USAGE);
   const given = parsed.messages.length + parsed.files.length > 0;
   if (parsed.noEdit && given)
-    return usage3(io, "--no-edit keeps the message; drop -m/-F or --no-edit", COMMIT_USAGE);
+    return usage4(io, "--no-edit keeps the message; drop -m/-F or --no-edit", COMMIT_USAGE);
   if (!given && !parsed.noEdit)
-    return usage3(io, parsed.amend ? "--amend needs -m/-F or --no-edit" : "missing -m <msg> or -F <file>", COMMIT_USAGE);
+    return usage4(io, parsed.amend ? "--amend needs -m/-F or --no-edit" : "missing -m <msg> or -F <file>", COMMIT_USAGE);
   const message = given ? commitMessage(parsed, io) : null;
   if (message !== null && typeof message !== "string")
-    return usage3(io, message.error, COMMIT_USAGE);
+    return usage4(io, message.error, COMMIT_USAGE);
   if (message !== null && !message.trim())
-    return usage3(io, "the commit message is empty", COMMIT_USAGE);
+    return usage4(io, "the commit message is empty", COMMIT_USAGE);
   const result = gitCommit(io.cwd, {
     message,
     all: parsed.all,
@@ -84653,7 +85128,7 @@ async function commit(argv, io) {
 }
 async function push(argv, io) {
   if (argv.includes("--force") || argv.includes("-f"))
-    return usage3(io, "workit never force-pushes blindly; use --force-with-lease (the lease is the tip workit last recorded)", PUSH_USAGE);
+    return usage4(io, "workit never force-pushes blindly; use --force-with-lease (the lease is the tip workit last recorded)", PUSH_USAGE);
   const normalized = argv.map((arg) => arg === "-u" ? "--set-upstream" : arg);
   const flags = parseFlags(normalized, {
     "set-upstream": "boolean",
@@ -84663,20 +85138,20 @@ async function push(argv, io) {
     release: "list"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, PUSH_USAGE);
+    return usage4(io, flags, PUSH_USAGE);
   const release = flags.lists.release;
   if (release) {
     if (flags.booleans.size || flags.values.expect !== undefined || flags.positionals.length)
-      return usage3(io, "--release takes only ref names (repeat it: --release main --release v1.2.0)", PUSH_USAGE);
+      return usage4(io, "--release takes only ref names (repeat it: --release main --release v1.2.0)", PUSH_USAGE);
     return releasePush(release, io);
   }
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]} (workit pushes the current branch)`, PUSH_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]} (workit pushes the current branch)`, PUSH_USAGE);
   const expect = flags.values.expect ?? null;
   if ((expect !== null || flags.booleans.has("overwrite-unintegrated")) && !flags.booleans.has("force-with-lease"))
-    return usage3(io, "--expect and --overwrite-unintegrated only apply with --force-with-lease", PUSH_USAGE);
+    return usage4(io, "--expect and --overwrite-unintegrated only apply with --force-with-lease", PUSH_USAGE);
   if (expect !== null && !/^[0-9a-f]{7,64}$/u.test(expect))
-    return usage3(io, "--expect must be a commit sha (at least 7 hex digits)", PUSH_USAGE);
+    return usage4(io, "--expect must be a commit sha (at least 7 hex digits)", PUSH_USAGE);
   const plan = pushPreflight(io.cwd);
   if (!plan.ok)
     return forgeFail(io, plan);
@@ -84711,7 +85186,7 @@ async function push(argv, io) {
 `);
   const envelope = ok2({ ...result.data, identity: checked });
   return emit(io, warnings.length ? { ...envelope, warnings } : envelope, (data) => [
-    data.pushed ? `pushed ${data.branch} ${short2(data.previous)} -> ${short2(data.sha)} to ${data.remote}${data.forced ? " (force-with-lease)" : ""}; remote tip verified` : `${data.remote}/${data.branch} is already at ${short2(data.sha)}; remote tip verified`,
+    data.pushed ? `pushed ${data.branch} ${short2(data.previous)} -> ${short2(data.sha)} to ${data.remote}${data.forced ? " (force-with-lease)" : ""}; remote tip verified` : `nothing to push: ${data.remote}/${data.branch} is already at ${short2(data.sha)}`,
     ...data.upstream ? [`upstream: ${data.remote}/${data.branch}`] : []
   ]);
 }
@@ -84744,19 +85219,21 @@ async function releasePush(names, io) {
   if (!result.ok)
     return forgeFail(io, result);
   return emit(io, ok2({ ...result.data, identity: checked }), (data) => [
-    ...data.refs.map((ref) => ref.pushed ? `pushed ${ref.name} ${short2(ref.previous)} -> ${short2(ref.sha)} to ${data.remote}; remote tip verified` : `${data.remote} ${ref.name} is already at ${short2(ref.sha)}; remote tip verified`),
+    ...data.refs.map((ref) => ref.pushed ? `pushed ${ref.name} ${short2(ref.previous)} -> ${short2(ref.sha)} to ${data.remote}; remote tip verified` : `nothing to push: ${data.remote} ${ref.name} is already at ${short2(ref.sha)}`),
     ..."error" in data.recorded ? [`ledger: not recorded (${data.recorded.error})`] : []
   ]);
 }
 function trailers(argv, io) {
   const extra = argv.find((arg) => arg !== "--json");
   if (extra !== undefined)
-    return usage3(io, `unexpected argument ${extra}`, "workit git trailers");
+    return usage4(io, `unexpected argument ${extra}`, "workit git trailers");
   const state = workspaceTrailers(io.cwd);
   return emit(io, ok2(state), (data) => data.enabled ? "on" : "off");
 }
-async function run16(argv, io) {
+async function run17(argv, io) {
   const [sub, ...rest] = argv;
+  if (sub !== undefined && READ_ONLY.has(sub))
+    return usage4(io, `workit git has no ${sub}`, `read-only git is fine raw: \`git -C ${io.cwd} ${sub}\``);
   if (sub === "branch")
     return branch(rest, io);
   if (sub === "commit")
@@ -84765,9 +85242,9 @@ async function run16(argv, io) {
     return push(rest, io);
   if (sub === "trailers")
     return trailers(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE8);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE9);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE8 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES;
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE9 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES, READ_ONLY;
 var init_git2 = __esm(() => {
   init_autonomy();
   init_branch();
@@ -84784,6 +85261,7 @@ var init_git2 = __esm(() => {
     "--no-edit": "noEdit",
     "--allow-empty": "allowEmpty"
   };
+  READ_ONLY = new Set(["status", "diff", "log", "fetch", "show", "blame"]);
 });
 
 // packages/workit-core/src/forge/verify.ts
@@ -85448,7 +85926,7 @@ var init_release = __esm(() => {
 // packages/workit-cli/src/verbs/release.ts
 var exports_release = {};
 __export(exports_release, {
-  run: () => run17
+  run: () => run18
 });
 async function subVerb(load, argv, io) {
   let out = "";
@@ -85469,9 +85947,9 @@ async function subVerb(load, argv, io) {
 async function start(argv, io) {
   const flags = parseFlags(argv, { hotfix: "boolean", track: "value" });
   if (typeof flags === "string")
-    return usage3(io, flags, START_USAGE);
+    return usage4(io, flags, START_USAGE);
   if (flags.positionals.length !== 1)
-    return usage3(io, flags.positionals.length ? "pass one version" : "missing <version>", START_USAGE);
+    return usage4(io, flags.positionals.length ? "pass one version" : "missing <version>", START_USAGE);
   const result = releaseStart(io.cwd, {
     version: flags.positionals[0],
     hotfix: flags.booleans.has("hotfix"),
@@ -85524,9 +86002,9 @@ async function releasePr(io, plan, dryRun) {
 async function finish2(argv, io) {
   const flags = parseFlags(argv, { track: "value", "dry-run": "boolean" });
   if (typeof flags === "string")
-    return usage3(io, flags, FINISH_USAGE);
+    return usage4(io, flags, FINISH_USAGE);
   if (flags.positionals.length > 1)
-    return usage3(io, `unexpected argument ${flags.positionals[1]}`, FINISH_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[1]}`, FINISH_USAGE);
   const dryRun = flags.booleans.has("dry-run");
   const planned = planReleaseFinish(io.cwd, {
     version: flags.positionals[0] ?? null,
@@ -85636,9 +86114,9 @@ async function finish2(argv, io) {
 async function publish(argv, io) {
   const flags = parseFlags(argv, {});
   if (typeof flags === "string")
-    return usage3(io, flags, PUBLISH_USAGE);
+    return usage4(io, flags, PUBLISH_USAGE);
   if (flags.positionals.length > 1)
-    return usage3(io, `unexpected argument ${flags.positionals[1]}`, PUBLISH_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[1]}`, PUBLISH_USAGE);
   const located = releaseToPublish(io.cwd, flags.positionals[0] ?? null);
   if (!located.ok)
     return forgeFail(io, located);
@@ -85671,7 +86149,7 @@ async function publish(argv, io) {
     `published ${data.branch} (${short4(data.sha)}) to ${data.remote}; remote tip verified`
   ]);
 }
-async function run17(argv, io) {
+async function run18(argv, io) {
   const [sub, ...rest] = argv;
   if (sub === "start")
     return start(rest, io);
@@ -85679,9 +86157,9 @@ async function run17(argv, io) {
     return finish2(rest, io);
   if (sub === "publish")
     return publish(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown release subcommand "${sub}"` : "missing release subcommand", USAGE9);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown release subcommand "${sub}"` : "missing release subcommand", USAGE10);
 }
-var START_USAGE = "workit release start <version> [--hotfix] [--track <t>] [--json]", FINISH_USAGE = "workit release finish [<version>] [--track <t>] [--dry-run] [--json]", PUBLISH_USAGE = "workit release publish [<version>] [--json]", USAGE9 = "workit release start|finish|publish ... (workit help release)", short4 = (sha) => sha ? sha.slice(0, 12) : "(none)", blocked = (io, grant) => emit(io, fail2("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } })), isLocalRemote = (cwd, remote) => {
+var START_USAGE = "workit release start <version> [--hotfix] [--track <t>] [--json]", FINISH_USAGE = "workit release finish [<version>] [--track <t>] [--dry-run] [--json]", PUBLISH_USAGE = "workit release publish [<version>] [--json]", USAGE10 = "workit release start|finish|publish ... (workit help release)", short4 = (sha) => sha ? sha.slice(0, 12) : "(none)", blocked = (io, grant) => emit(io, fail2("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } })), isLocalRemote = (cwd, remote) => {
   const url = remote ? pushUrl(cwd, remote) : null;
   return !url || parseRemoteUrl(url)?.protocol === "file";
 }, stepsOf = (plan) => [
@@ -85713,9 +86191,9 @@ var init_release2 = __esm(() => {
 // packages/workit-cli/src/verbs/verify-delivery.ts
 var exports_verify_delivery = {};
 __export(exports_verify_delivery, {
-  run: () => run18
+  run: () => run19
 });
-async function run18(argv, io) {
+async function run19(argv, io) {
   const flags = parseFlags(argv, {
     expect: "value",
     branch: "value",
@@ -85725,31 +86203,31 @@ async function run18(argv, io) {
     package: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE10);
+    return usage4(io, flags, USAGE11);
   if (flags.positionals.length > 1)
-    return usage3(io, `unexpected argument ${flags.positionals[1]}`, USAGE10);
+    return usage4(io, `unexpected argument ${flags.positionals[1]}`, USAGE11);
   const named = flags.positionals[0];
   if (named !== undefined && !ENDPOINTS[named])
-    return usage3(io, `unknown endpoint "${named}"`, USAGE10);
+    return usage4(io, `unknown endpoint "${named}"`, USAGE11);
   if (flags.values.expect !== undefined && !ENDPOINTS[flags.values.expect])
-    return usage3(io, "--expect must be pushed, pr, merged or released", USAGE10);
+    return usage4(io, "--expect must be pushed, pr, merged or released", USAGE11);
   if (named && flags.values.expect && ENDPOINTS[named] !== ENDPOINTS[flags.values.expect])
-    return usage3(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE10);
+    return usage4(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE11);
   const expect = ENDPOINTS[named ?? ""] ?? ENDPOINTS[flags.values.expect ?? ""] ?? (flags.values.tag || flags.values.package ? "released" : flags.values.pr ? "pr" : "pushed");
   const pr = positiveInt(flags.values.pr, "--pr");
   if (typeof pr === "string")
-    return usage3(io, pr, USAGE10);
+    return usage4(io, pr, USAGE11);
   if (pr && flags.values.branch)
-    return usage3(io, "pass --pr or --branch, not both", USAGE10);
+    return usage4(io, "pass --pr or --branch, not both", USAGE11);
   const sha = flags.values.sha ?? null;
   if (sha !== null && !/^[0-9a-f]{7,64}$/u.test(sha))
-    return usage3(io, "--sha must be a commit sha (7-64 hex chars)", USAGE10);
+    return usage4(io, "--sha must be a commit sha (7-64 hex chars)", USAGE11);
   const actor = actorFromEnv(io.env);
   const branch = flags.values.branch ?? null;
   let result;
   if (expect === "pushed") {
     if (pr)
-      return usage3(io, "push is checked by --branch, not --pr", USAGE10);
+      return usage4(io, "push is checked by --branch, not --pr", USAGE11);
     result = verifyPushed(io.cwd, { branch, sha, actor });
   } else if (expect === "released") {
     result = verifyReleased(io.cwd, { tag: flags.values.tag ?? null, pkg: flags.values.package ?? null, sha, actor }, forgeDeps.npm);
@@ -85774,7 +86252,7 @@ async function run18(argv, io) {
     unblock: expect === "pushed" ? "workit git push" : expect === "pr" ? "workit git push && workit pr create --fill" : expect === "merged" ? "workit pr status  # then workit pr merge when READY and granted" : "check the release workflow; the tag/package is not published"
   }));
 }
-var USAGE10 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
+var USAGE11 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
   `${report.expect}: ${report.delivered ? "delivered" : "NOT delivered"}${report.branch ? ` (${report.branch}${report.sha ? ` @ ${report.sha.slice(0, 12)}` : ""})` : ""}${report.pr ? ` #${report.pr}` : ""}`,
   ...report.observations.map((entry) => `  ${entry.ok ? "ok" : "x "} ${entry.kind}: expected ${entry.expected ?? "-"}, observed ${entry.observed ?? "(none)"}${entry.note ? ` — ${entry.note}` : ""}`)
 ];
@@ -85797,12 +86275,12 @@ var init_verify_delivery = __esm(() => {
 // packages/workit-cli/src/verbs/stack.ts
 var exports_stack = {};
 __export(exports_stack, {
-  run: () => run19
+  run: () => run20
 });
 async function plan(argv, io) {
   const flags = parseFlags(argv, { name: "value", trunk: "value", track: "value" });
   if (typeof flags === "string")
-    return usage3(io, flags, PLAN_USAGE);
+    return usage4(io, flags, PLAN_USAGE);
   const name = flags.values.name ?? null;
   const existingByName = name ? readStack(io.cwd, name) : null;
   if (existingByName && !existingByName.ok)
@@ -85815,7 +86293,7 @@ async function plan(argv, io) {
   }
   const track = flags.values.track ?? null;
   if (track !== null && flags.values.trunk !== undefined)
-    return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE);
+    return usage4(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE);
   let trunk = flags.values.trunk ?? existing?.trunk ?? null;
   if (trunk === null || track !== null) {
     const derived = releaseTrunk(io, track, flags.positionals[0] ?? null);
@@ -85852,9 +86330,9 @@ async function plan(argv, io) {
 async function status3(argv, io) {
   const flags = parseFlags(argv, { name: "value" });
   if (typeof flags === "string")
-    return usage3(io, flags, STATUS_USAGE2);
+    return usage4(io, flags, STATUS_USAGE2);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE2);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE2);
   const selected = selectStack(io.cwd, flags.values.name ?? null);
   if (!selected.ok)
     return stackFailed(io, selected);
@@ -85878,16 +86356,16 @@ async function sync(argv, io) {
     force: "list"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, SYNC_USAGE);
+    return usage4(io, flags, SYNC_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, SYNC_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, SYNC_USAGE);
   const selected = selectStack(io.cwd, flags.values.name ?? null);
   if (!selected.ok)
     return stackFailed(io, selected);
   const force = new Set(flags.lists.force ?? []);
   const unknown = [...force].filter((branch) => !selected.data.branches.some((entry) => entry.branch === branch));
   if (unknown.length)
-    return usage3(io, `--force ${unknown[0]}: not a branch of stack ${selected.data.name}`, SYNC_USAGE);
+    return usage4(io, `--force ${unknown[0]}: not a branch of stack ${selected.data.name}`, SYNC_USAGE);
   const local = flags.booleans.has("local");
   let ctx = null;
   if (!local) {
@@ -85928,24 +86406,24 @@ async function land(argv, io) {
     reason: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, LAND_USAGE);
+    return usage4(io, flags, LAND_USAGE);
   const unverified = unverifiedFlag(flags);
   if (typeof unverified === "string")
-    return usage3(io, unverified, LAND_USAGE);
+    return usage4(io, unverified, LAND_USAGE);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, LAND_USAGE);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, LAND_USAGE);
   const max = positiveInt(flags.values.max, "--max");
   if (typeof max === "string")
-    return usage3(io, max, LAND_USAGE);
+    return usage4(io, max, LAND_USAGE);
   const method = flags.values.method ?? "squash";
   if (!METHODS3.has(method))
-    return usage3(io, "--method must be squash, merge or rebase", LAND_USAGE);
+    return usage4(io, "--method must be squash, merge or rebase", LAND_USAGE);
   const timeoutMs = parseDuration2(flags.values.timeout ?? "20m");
   const intervalMs = parseDuration2(flags.values.interval ?? "30s");
   if (timeoutMs === null || timeoutMs > 6 * 3600000)
-    return usage3(io, "--timeout must be a duration up to 6h (20m, 90s)", LAND_USAGE);
+    return usage4(io, "--timeout must be a duration up to 6h (20m, 90s)", LAND_USAGE);
   if (intervalMs === null || intervalMs < 1000 || intervalMs > 600000)
-    return usage3(io, "--interval must be between 1s and 10m", LAND_USAGE);
+    return usage4(io, "--interval must be between 1s and 10m", LAND_USAGE);
   const selected = selectStack(io.cwd, flags.values.name ?? null);
   if (!selected.ok)
     return stackFailed(io, selected);
@@ -85979,7 +86457,7 @@ async function land(argv, io) {
   unblock: ${data.stoppedAt.unblock}` : data.complete ? "stack complete" : ""
   ].filter(Boolean));
 }
-async function run19(argv, io) {
+async function run20(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan(rest, io);
@@ -85989,9 +86467,9 @@ async function run19(argv, io) {
     return sync(rest, io);
   if (sub === "land")
     return land(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE11);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE12);
 }
-var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE11 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail2(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), label3 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
+var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE12 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail2(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), label3 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
   `${data.dryRun ? "would sync" : "synced"} stack ${data.name}${data.merged.length ? `; merged: ${data.merged.map((item) => item.branch).join(", ")}` : ""}`,
   ...data.steps.map((step) => [
     `  ${step.branch} on ${step.parent}:`,
@@ -86425,7 +86903,8 @@ function createSliceWorktree(cwd, plan, input) {
     planCreatedAt: plan.createdAt,
     sliceHash: slice.hash,
     ...admin ? { adminId: admin.id, adminIno: admin.ino, adminToken: admin.token } : {},
-    ...baseSha ? { baseSha } : {}
+    ...baseSha ? { baseSha } : {},
+    ...deps.install ? { install: deps.install } : {}
   });
   return {
     ok: true,
@@ -86608,6 +87087,8 @@ var init_fanout_worktree = __esm(() => {
 
 // packages/workit-core/src/fanout-brief.ts
 import { createHash as createHash19 } from "node:crypto";
+import fs34 from "node:fs";
+import path63 from "node:path";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
   const full = `${lead}-w-${slice}${tail}`;
@@ -86631,10 +87112,12 @@ function renderBrief(cwd, plan, input) {
   if (taken)
     return fanoutFail("invalid_input", `attempt branch ${branch} is slice ${taken.id}'s branch`, "pick another --attempt number, or rename one of the branches in the plan");
   const head = branchRef(cwd, branch);
-  const mode = input.mode ?? (head ? "resume" : "new");
+  const planned = `${slicePath(cwd, slice)}${input.attempt === null ? "" : `+try${input.attempt}`}`;
+  const made = ledger.value.rows.findLast((row) => row.type === "fanout.worktree.created" && row.fanout === plan.name && row.slice === slice.id && typeof row.path === "string" && samePath(row.path, planned));
+  const fresh = Boolean(head) && made?.baseSha === head;
+  const mode = input.mode ?? (head && !fresh ? "resume" : "new");
   if (mode === "resume" && !head)
     return fanoutFail("not_found", `MODE resume needs the branch ${branch}, which does not exist here`, `workit fanout brief ${slice.id} --mode new`);
-  const planned = `${slicePath(cwd, slice)}${input.attempt === null ? "" : `+try${input.attempt}`}`;
   const exists = listWorktrees(cwd).some((entry) => samePath(entry.path, planned));
   excludeScratch(cwd);
   const scratch = exists ? `${planned}/${SCRATCH_DIR}` : SCRATCH_DIR;
@@ -86687,6 +87170,7 @@ function renderBrief(cwd, plan, input) {
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
     exists ? `WORKTREE: ${planned}  (made by \`workit fanout worktree create ${slice.id}\`; yours alone)` : `WORKTREE: ${planned}  (not made yet: the lead runs \`workit fanout worktree create ${slice.id}\` before spawning, then renders this brief again)`,
+    ...exists && typeof made?.install === "string" && !fs34.existsSync(path63.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
     ...identityLines(identity, minted),
     ...rules(mode, branch, slice.base, exists ? planned : null)
   ];
@@ -86755,7 +87239,8 @@ var init_fanout_brief = __esm(() => {
   REPORT = [
     "REPORT: branch, head SHA, files changed, each VERIFY command with its exit code,",
     "  each ACCEPTANCE line met / not met, rulings you made (`workit ledger ruling`),",
-    "  anything out of scope as a follow-up, not a diff."
+    "  anything out of scope as a follow-up, not a diff. Report heads when pushed; CI is waited on once, at the end.",
+    "  A PR body goes through `--body-file -` (stdin), never a shared scratch path."
   ];
 });
 
@@ -87423,10 +87908,10 @@ var init_fanout_status = __esm(() => {
 // packages/workit-cli/src/verbs/fanout.ts
 var exports_fanout = {};
 __export(exports_fanout, {
-  run: () => run20
+  run: () => run21
 });
-import fs34 from "node:fs";
-import path63 from "node:path";
+import fs35 from "node:fs";
+import path64 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -87469,7 +87954,7 @@ function resolveTrunk(io, raw, flag, track) {
     };
   if (named !== null && derived.trunk !== named)
     return {
-      code: usage3(io, `the plan names trunk ${named}; --track ${track} targets ${derived.trunk ?? "(none)"}`, PLAN_USAGE2)
+      code: usage4(io, `the plan names trunk ${named}; --track ${track} targets ${derived.trunk ?? "(none)"}`, PLAN_USAGE2)
     };
   return { trunk: derived.tracked || track !== null ? derived.trunk : null };
 }
@@ -87481,18 +87966,18 @@ function plan2(argv, io) {
     "take-lead": "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, PLAN_USAGE2);
+    return usage4(io, flags, PLAN_USAGE2);
   const track = flags.values.track ?? null;
   if (track !== null && flags.values.trunk !== undefined)
-    return usage3(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
+    return usage4(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
-    return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path63.resolve(io.cwd, flags.positionals[0]);
+    return usage4(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
+  const file = path64.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
-    raw = JSON.parse(fs34.readFileSync(file, "utf8"));
+    raw = JSON.parse(fs35.readFileSync(file, "utf8"));
   } catch (error) {
-    return usage3(io, `cannot read ${file} as JSON: ${error.message}`, PLAN_USAGE2);
+    return usage4(io, `cannot read ${file} as JSON: ${error.message}`, PLAN_USAGE2);
   }
   const trunk = resolveTrunk(io, raw, flags.values.trunk ?? null, track);
   if ("code" in trunk)
@@ -87513,7 +87998,7 @@ function plan2(argv, io) {
     `${data.created ? "planned" : "re-planned"} fanout ${data.name} on ${data.trunk}${data.fanIn === "integration" ? " (integration branch: one PR)" : ""}: ${data.slices.length} slice${data.slices.length === 1 ? "" : "s"}`,
     ...data.slices.map((slice) => `  ${slice.id} [${slice.tier}] ${slice.branch} <- ${slice.base}${slice.dependsOn.length ? `  after ${slice.dependsOn.join(", ")}` : ""}
       worktree ${slice.worktree}`),
-    ...data.overlaps.map((overlap) => `  shared ${overlap.path}: ${overlap.resolution === "owner" ? `owned by ${overlap.owner}` : `serialized (${overlap.slices.join(" -> ")})`}`),
+    ...data.overlaps.map((overlap) => `  shared ${overlap.path}: ${overlap.resolution === "owner" ? `owned by ${overlap.owner}` : overlap.resolution === "regenerated" ? `regenerated at fan-in (${overlap.writer})` : `serialized (${overlap.slices.join(" -> ")})`}`),
     `waves: ${data.waves.map((wave) => wave.join(", ")).join("  |  ")}`,
     `landing order: ${data.landingOrder.join(", ")}`,
     ...data.notes.map((note) => `note: ${note}`),
@@ -87523,16 +88008,16 @@ function plan2(argv, io) {
 function brief(argv, io) {
   const flags = parseFlags(argv, { name: "value", mode: "value", attempt: "value" });
   if (typeof flags === "string")
-    return usage3(io, flags, BRIEF_USAGE);
+    return usage4(io, flags, BRIEF_USAGE);
   if (flags.positionals.length !== 1)
-    return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <slice>", BRIEF_USAGE);
+    return usage4(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <slice>", BRIEF_USAGE);
   const mode = flags.values.mode ?? null;
   if (mode !== null && mode !== "new" && mode !== "resume")
-    return usage3(io, "--mode takes new or resume", BRIEF_USAGE);
+    return usage4(io, "--mode takes new or resume", BRIEF_USAGE);
   const rawAttempt = flags.values.attempt;
   const attempt = rawAttempt === undefined ? null : Number(rawAttempt);
   if (attempt !== null && !(Number.isInteger(attempt) && attempt >= 1 && attempt <= 9))
-    return usage3(io, "--attempt takes a number from 1 to 9", BRIEF_USAGE);
+    return usage4(io, "--attempt takes a number from 1 to 9", BRIEF_USAGE);
   const selected = selectFanout(io.cwd, flags.values.name ?? null, currentBranch(io.cwd));
   if (!selected.ok)
     return failed(io, selected);
@@ -87549,7 +88034,7 @@ function brief(argv, io) {
 function check2(argv, io) {
   const flags = parseFlags(argv, { name: "value", base: "value", offline: "boolean" });
   if (typeof flags === "string")
-    return usage3(io, flags, CHECK_USAGE);
+    return usage4(io, flags, CHECK_USAGE);
   const selected = selectFanout(io.cwd, flags.values.name ?? null, currentBranch(io.cwd));
   if (!selected.ok)
     return failed(io, selected);
@@ -87575,13 +88060,13 @@ function check2(argv, io) {
 function status4(argv, io) {
   const flags = parseFlags(argv, { name: "value", "stuck-after": "value", offline: "boolean" });
   if (typeof flags === "string")
-    return usage3(io, flags, STATUS_USAGE3);
+    return usage4(io, flags, STATUS_USAGE3);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE3);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, STATUS_USAGE3);
   const raw = flags.values["stuck-after"];
   const stuckAfterMs = raw === undefined ? null : parseDuration2(raw);
   if (stuckAfterMs === 0 || raw !== undefined && stuckAfterMs === null)
-    return usage3(io, "--stuck-after takes a duration such as 30m, 45m or 2h", STATUS_USAGE3);
+    return usage4(io, "--stuck-after takes a duration such as 30m, 45m or 2h", STATUS_USAGE3);
   const selected = selectFanout(io.cwd, flags.values.name ?? null, currentBranch(io.cwd));
   if (!selected.ok)
     return failed(io, selected);
@@ -87599,13 +88084,13 @@ function worktree(argv, io) {
   const [action, ...rest] = argv;
   const flags = parseFlags(rest, { name: "value", force: "boolean" });
   if (typeof flags === "string")
-    return usage3(io, flags, WORKTREE_USAGE);
+    return usage4(io, flags, WORKTREE_USAGE);
   if (action !== "create" && action !== "release")
-    return usage3(io, action ? `unknown worktree action "${action}"` : "missing create or release", WORKTREE_USAGE);
+    return usage4(io, action ? `unknown worktree action "${action}"` : "missing create or release", WORKTREE_USAGE);
   if (flags.positionals.length !== 1)
-    return usage3(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <slice>", WORKTREE_USAGE);
+    return usage4(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <slice>", WORKTREE_USAGE);
   if (action === "create" && flags.booleans.has("force"))
-    return usage3(io, "--force applies to release only", WORKTREE_USAGE);
+    return usage4(io, "--force applies to release only", WORKTREE_USAGE);
   const selected = selectFanout(io.cwd, flags.values.name ?? null, currentBranch(io.cwd));
   if (!selected.ok)
     return failed(io, selected);
@@ -87643,7 +88128,7 @@ function worktree(argv, io) {
     ...data.notes.map((note) => `note: ${note}`)
   ]);
 }
-async function run20(argv, io) {
+async function run21(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub === "plan")
     return plan2(rest, io);
@@ -87655,9 +88140,9 @@ async function run20(argv, io) {
     return status4(rest, io);
   if (sub === "worktree")
     return worktree(rest, io);
-  return usage3(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE12);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE13);
 }
-var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE12 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail2(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
+var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE13 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail2(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
   `fanout ${data.name} against ${data.trunkRef}: ${data.ready ? "ready to land" : "blocked"}`,
   ...data.slices.map((slice) => slice.status === "landed" ? `  -- ${slice.id} (${slice.branch}) landed (${slice.landed?.how}${slice.landed?.pr ? ` #${slice.landed.pr}` : ""})` : `  ${slice.status === "ready" ? "ok " : "x  "}${slice.id} (${slice.branch}) ${slice.changed} file${slice.changed === 1 ? "" : "s"} · verdict ${slice.verdict.accepted ? "accepted" : slice.verdict.basis}${slice.reasons.length ? `
       ${slice.reasons.join(`
@@ -87709,7 +88194,7 @@ var init_fanout2 = __esm(() => {
 // packages/workit-cli/src/verbs/ledger.ts
 var exports_ledger = {};
 __export(exports_ledger, {
-  run: () => run21
+  run: () => run22
 });
 import { randomBytes as randomBytes6 } from "node:crypto";
 import { parseArgs } from "node:util";
@@ -87733,30 +88218,30 @@ function targetBranch(io, rows, branch, pr) {
   }
   return { ok: true, value: branch ?? null };
 }
-async function run21(argv, io) {
+async function run22(argv, io) {
   let parsed;
   try {
     parsed = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true, strict: true });
   } catch (error) {
-    return usage4(io, error.message);
+    return usage5(io, error.message);
   }
   const { values } = parsed;
   let positionals = parsed.positionals;
   if (positionals[0] === "add") {
     positionals = positionals.slice(1);
     if (!["decision", "ruling", "verdict"].includes(positionals[0] ?? ""))
-      return usage4(io, "ledger add takes decision|ruling|verdict");
+      return usage5(io, "ledger add takes decision|ruling|verdict");
   }
   const [sub, ...rest] = positionals;
   const pr = positiveInt2(values.pr, "--pr");
   if (pr instanceof Error)
-    return usage4(io, pr.message);
+    return usage5(io, pr.message);
   const last = positiveInt2(values.last, "--last");
   if (last instanceof Error)
-    return usage4(io, last.message);
+    return usage5(io, last.message);
   const text = rest.join(" ");
   if (sub === undefined)
-    return usage4(io, "missing subcommand");
+    return usage5(io, "missing subcommand");
   if (![
     "decision",
     "ruling",
@@ -87767,7 +88252,7 @@ async function run21(argv, io) {
     "check",
     "verify-integrity"
   ].includes(sub))
-    return usage4(io, `unknown ledger subcommand "${sub}"`);
+    return usage5(io, `unknown ledger subcommand "${sub}"`);
   if (sub === "standing")
     return standing(io, values, rest);
   const ledger = readLedger(io.cwd, {
@@ -87778,7 +88263,7 @@ async function run21(argv, io) {
   const { rows } = ledger.value;
   if (sub === "verify-integrity") {
     if (rest.length)
-      return usage4(io, `unexpected argument: ${rest[0]}`);
+      return usage5(io, `unexpected argument: ${rest[0]}`);
     const integrity = ledger.value.integrity ?? { chained: 0, legacy: 0, unverified: [] };
     return emit(io, ok2({
       path: ledger.value.path,
@@ -87790,7 +88275,7 @@ async function run21(argv, io) {
   }
   if (sub === "list" || sub === "show") {
     if (rest.length)
-      return usage4(io, `unexpected argument: ${rest[0]}`);
+      return usage5(io, `unexpected argument: ${rest[0]}`);
     const listed = filterRows(rows, {
       branch: values.branch,
       pr,
@@ -87805,7 +88290,7 @@ async function run21(argv, io) {
   const isRead = sub === "check" || sub === "verdict" && values.how === undefined && !VERDICT_RESULTS.includes(rest[0] ?? "");
   if (isRead) {
     if (rest.length > (sub === "verdict" ? 1 : 0))
-      return usage4(io, `unexpected argument: ${rest.at(-1)}`);
+      return usage5(io, `unexpected argument: ${rest.at(-1)}`);
     const target = targetBranch(io, rows, rest[0] ?? values.branch, pr);
     if (!target.ok)
       return failed2(io, target);
@@ -87829,7 +88314,7 @@ async function run21(argv, io) {
   }
   const acting = actorFor(io, values);
   if (acting instanceof Error)
-    return usage4(io, acting.message);
+    return usage5(io, acting.message);
   const { actor } = acting;
   const context = {
     cwd: io.cwd,
@@ -87861,7 +88346,7 @@ async function run21(argv, io) {
       refs: values.ref
     })), (row) => `recorded ruling ${row.id}`);
   if (rest.length !== 1)
-    return usage4(io, `ledger verdict takes one result: ${VERDICT_RESULTS.join("|")}`);
+    return usage5(io, `ledger verdict takes one result: ${VERDICT_RESULTS.join("|")}`);
   const claimed = values.self === true ? null : claimedSession(acting);
   const token = values.token ?? io.env.WORKIT_SESSION_TOKEN ?? null;
   const refusal = claimed === null ? null : sessionClaimRefusal(io.env, claimed, io.cwd, { token, flag: acting.source === "flag" });
@@ -87907,9 +88392,9 @@ async function standing(io, values, args) {
   if (action !== "add" && action !== "list" && action !== "clear")
     return emit(io, fail2("invalid_input", action ? `unknown standing action "${action}"` : "missing add, list or clear", { unblock: STANDING_USAGE }));
   if ((values.stop || values.clear) && action !== "add")
-    return usage4(io, `--stop and --clear go with standing add, not standing ${action}`);
+    return usage5(io, `--stop and --clear go with standing add, not standing ${action}`);
   if (values.stop && values.clear)
-    return usage4(io, "pass --stop or --clear, not both");
+    return usage5(io, "pass --stop or --clear, not both");
   const target = standingFanout(io, values);
   if (target instanceof Error)
     return emit(io, fail2("invalid_input", target.message, { unblock: STANDING_USAGE }));
@@ -87918,7 +88403,7 @@ async function standing(io, values, args) {
   const leads = target.plan ? planLeads(target.plan) : null;
   if (action === "list") {
     if (rest.length)
-      return usage4(io, `unexpected argument: ${rest[0]}`);
+      return usage5(io, `unexpected argument: ${rest[0]}`);
     const ledger = readLedger(io.cwd);
     if (!ledger.ok)
       return failed2(io, ledger);
@@ -87934,7 +88419,7 @@ async function standing(io, values, args) {
   }
   const acting = actorFor(io, values);
   if (acting instanceof Error)
-    return usage4(io, acting.message);
+    return usage5(io, acting.message);
   const context = {
     cwd: io.cwd,
     actor: acting.actor,
@@ -87946,16 +88431,16 @@ async function standing(io, values, args) {
     }));
   if (action === "add" && values.clear) {
     if (rest.length)
-      return usage4(io, `unexpected argument: ${rest[0]}`);
+      return usage5(io, `unexpected argument: ${rest[0]}`);
     return fromResult(io, liftStop(context, { fanout, lead, leads }), (rows) => `lifted the stop line for fanout ${fanout} (cleared ${rows.map((row) => row.target).join(", ")}); running workers are told on their next tool call`);
   }
   if (action === "add")
     return fromResult(io, recordStanding(context, { fanout, lead, what: rest.join(" "), stop: values.stop === true }), (row) => row.stop ? `recorded stop line ${row.id} for fanout ${fanout}; running workers stop and report on their next tool call` : `recorded standing order ${row.id} for fanout ${fanout}; running workers get it on their next tool call`);
   if (rest.length > 1)
-    return usage4(io, `unexpected argument: ${rest[1]}`);
+    return usage5(io, `unexpected argument: ${rest[1]}`);
   return fromResult(io, clearStanding(context, { fanout, lead, leads, target: rest[0] ?? null }), (row) => row.target ? `cleared standing order ${row.target} for fanout ${fanout}` : `cleared every standing order for fanout ${fanout}`);
 }
-var USAGE13 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | add --stop ["<note>"] | add --clear | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
+var USAGE14 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | add --stop ["<note>"] | add --clear | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
   const actor = actorFromEnv(io.env);
   if (values.session !== undefined && values.as !== undefined)
     return new Error("pass --session or --as, not both");
@@ -87982,7 +88467,7 @@ var USAGE13 = "workit ledger decision|ruling|verdict|standing|list|check ... (wo
     return;
   const parsed = Number(value);
   return Number.isInteger(parsed) && parsed > 0 ? parsed : new Error(`${flag} must be a positive integer`);
-}, failed2 = (io, result) => emit(io, fail2(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok2(result.value), human) : failed2(io, result), usage4 = (io, error) => emit(io, fail2("invalid_input", error, { unblock: USAGE13 })), passedTestOn = (cwd, verdict) => {
+}, failed2 = (io, result) => emit(io, fail2(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok2(result.value), human) : failed2(io, result), usage5 = (io, error) => emit(io, fail2("invalid_input", error, { unblock: USAGE14 })), passedTestOn = (cwd, verdict) => {
   const ledger = readLedger(cwd);
   return ledger.ok && ledger.value.rows.some((row) => row.type === "check" && row.observer === "workit_cli" && row.name === "test" && row.result === "passed" && row.dirty !== true && row.branch === verdict.branch && row.head === verdict.head);
 }, verdictLines = (check) => {
@@ -103028,7 +103513,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path64 from "node:path";
+import path65 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -103521,12 +104006,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path64.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path65.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path64.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path65.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -103915,8 +104400,8 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync23, readdirSync as readdirSync11, readFileSync as readFileSync26, statSync as statSync10 } from "node:fs";
-import path65 from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync11, readFileSync as readFileSync26, statSync as statSync10 } from "node:fs";
+import path66 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
@@ -103929,7 +104414,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync11(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path65.join(dir, entry.name);
+    const full = path66.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -103941,8 +104426,8 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path65.resolve(cwd, input);
-    if (!existsSync23(full))
+    const full = path66.resolve(cwd, input);
+    if (!existsSync24(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
       walkTests(full, files);
@@ -103978,11 +104463,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path65.join(root, file), lines);
+    changed.set(path66.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path65.join(root, file), "all");
+    changed.set(path66.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -104044,7 +104529,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path65.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path66.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -104058,7 +104543,7 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync24,
+  existsSync as existsSync25,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync11,
   mkdtempSync as mkdtempSync4,
@@ -104071,10 +104556,10 @@ import {
   statSync as statSync11,
   symlinkSync,
   writeFileSync as writeFileSync11,
-  copyFileSync as copyFileSync7
+  copyFileSync as copyFileSync8
 } from "node:fs";
 import os22 from "node:os";
-import path66 from "node:path";
+import path67 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -104147,7 +104632,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path66.posix.join(path66.posix.dirname(file), spec)) === target)
+        if (stripExt(path67.posix.join(path67.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -104167,12 +104652,12 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path66.join(tmp, name);
+    const dir = path67.join(tmp, name);
     try {
       const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync27(path66.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync27(path67.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -104189,8 +104674,8 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync11(target, { recursive: true });
   for (const entry of readdirSync12(origin, { withFileTypes: true })) {
-    const from = path66.join(origin, entry.name);
-    const to = path66.join(target, entry.name);
+    const from = path67.join(origin, entry.name);
+    const to = path67.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
@@ -104206,9 +104691,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path66.relative(repo, real);
-      if (!relative.startsWith("..") && !path66.isAbsolute(relative) && !relative.split(path66.sep).includes("node_modules")) {
-        symlinkSync(path66.join(copy, relative), to, "junction");
+      const relative = path67.relative(repo, real);
+      if (!relative.startsWith("..") && !path67.isAbsolute(relative) && !relative.split(path67.sep).includes("node_modules")) {
+        symlinkSync(path67.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -104224,19 +104709,19 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync10(repo);
   if (real && inside4(realRepo, real)) {
-    symlinkSync(path66.relative(path66.dirname(to), path66.join(tree, path66.relative(realRepo, real))), to);
+    symlinkSync(path67.relative(path67.dirname(to), path67.join(tree, path67.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync11(real).isFile())
-    copyFileSync7(real, to);
+    copyFileSync8(real, to);
   else
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path66.join(copy, file);
+  const target = path67.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside4(realpathSync10(copy), realpathSync10(path66.dirname(target))))
+    if (!stat.isFile() || !inside4(realpathSync10(copy), realpathSync10(path67.dirname(target))))
       return false;
   } catch {
     return false;
@@ -104247,9 +104732,9 @@ function writeInside(copy, file, content) {
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path66.join(os22.tmpdir(), TEMP_PREFIX));
-  writeFileSync11(path66.join(dir, PID_FILE), String(process.pid));
-  const tree = path66.join(dir, "tree");
+  const dir = mkdtempSync4(path67.join(os22.tmpdir(), TEMP_PREFIX));
+  writeFileSync11(path67.join(dir, PID_FILE), String(process.pid));
+  const tree = path67.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -104266,29 +104751,29 @@ function copyWorkingTree(repo) {
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path66.join(repo, relative);
+    const from = path67.join(repo, relative);
     let stat;
     try {
       stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path66.join(tree, relative);
-    mkdirSync11(path66.dirname(to), { recursive: true });
+    const to = path67.join(tree, relative);
+    mkdirSync11(path67.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
-      copyFileSync7(from, to);
-    let parent = path66.dirname(relative);
+      copyFileSync8(from, to);
+    let parent = path67.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path66.dirname(parent);
+      parent = path67.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path66.join(repo, parent, "node_modules");
-    if (existsSync24(modules) && !existsSync24(path66.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path66.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path67.join(repo, parent, "node_modules");
+    if (existsSync25(modules) && !existsSync25(path67.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path67.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -104327,17 +104812,17 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync27(path66.join(repo, file), "utf8") };
+      return { file, text: readFileSync27(path67.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path66.relative(repo, absolute));
+    const relative = toPosix(path67.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync24(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync25(absolute))
       continue;
     try {
       candidates.push(...mutantsFor(readFileSync27(absolute, "utf8"), relative, lines));
@@ -104348,9 +104833,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path66.relative(repo, options.cwd);
+  const cwdRelative = path67.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path66.relative(cwdRelative, file));
+    const relative = toPosix(path67.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -104386,7 +104871,7 @@ async function runMutation(options) {
     return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path66.join(copy, cwdRelative);
+  const copyCwd = path67.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -104421,7 +104906,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync27(path66.join(copy, mutant.file), "utf8");
+      const original = readFileSync27(path67.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -104478,8 +104963,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside4 = (root, file) => {
-  const relative = path66.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path66.isAbsolute(relative);
+  const relative = path67.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path67.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -104525,10 +105010,10 @@ var init_mutate = __esm(() => {
 // packages/workit-cli/src/verbs/test-audit.ts
 var exports_test_audit = {};
 __export(exports_test_audit, {
-  run: () => run22
+  run: () => run23
 });
-import { existsSync as existsSync25 } from "node:fs";
-import path67 from "node:path";
+import { existsSync as existsSync26 } from "node:fs";
+import path68 from "node:path";
 function parse8(argv) {
   const options = {
     paths: [],
@@ -104627,14 +105112,14 @@ function human(data) {
   }
   return lines;
 }
-async function run22(argv, io) {
+async function run23(argv, io) {
   const options = parse8(argv);
   if (typeof options === "string")
     return emit(io, fail2("invalid_input", `${options}
-usage: ${USAGE14}`));
+usage: ${USAGE15}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path67.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path67.relative(io.cwd, file) || file);
+  const repo = top.ok ? path68.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path68.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -104651,7 +105136,7 @@ usage: ${USAGE14}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync25(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync26(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -104717,7 +105202,7 @@ usage: ${USAGE14}`));
   }
   return emit(io, ok2(data), human);
 }
-var USAGE14 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
+var USAGE15 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
 var init_test_audit = __esm(() => {
   init_audit();
   init_mutate();
@@ -104738,12 +105223,12 @@ var init_test_audit = __esm(() => {
 // packages/workit-cli/src/verbs/knowledge.ts
 var exports_knowledge = {};
 __export(exports_knowledge, {
-  run: () => run23
+  run: () => run24
 });
-async function run23(argv, io) {
+async function run24(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub !== "lint" || rest.length > 0)
-    return emit(io, fail2("invalid_input", `usage: ${USAGE15}`));
+    return emit(io, fail2("invalid_input", `usage: ${USAGE16}`));
   const report = lintKnowledge(checkRoot(io.cwd));
   if (report.unreadable.length > 0)
     return emit(io, fail2("unavailable", `knowledge lint: cannot read ${report.unreadable.join(", ")}`, {
@@ -104760,7 +105245,7 @@ async function run23(argv, io) {
 `);
   return report.findings.length === 0 ? 0 : 1;
 }
-var USAGE15 = "workit knowledge lint [--json]";
+var USAGE16 = "workit knowledge lint [--json]";
 var init_knowledge2 = __esm(() => {
   init_check_config();
   init_knowledge();
@@ -104770,14 +105255,14 @@ var init_knowledge2 = __esm(() => {
 // packages/workit-cli/src/verbs/youtrack.ts
 var exports_youtrack = {};
 __export(exports_youtrack, {
-  run: () => run24
+  run: () => run25
 });
 import { readFileSync as readFileSync28 } from "node:fs";
-import path68 from "node:path";
-async function run24(argv, io) {
+import path69 from "node:path";
+async function run25(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
-    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE16);
+    return usage4(io, `unknown subcommand "${sub ?? ""}"`, USAGE17);
   const flags = parseFlags(rest, {
     markdown: "value",
     file: "value",
@@ -104786,18 +105271,18 @@ async function run24(argv, io) {
     date: "value"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE16);
+    return usage4(io, flags, USAGE17);
   const [issueId, extra] = flags.positionals;
   if (!issueId || !ISSUE_RE2.test(issueId))
-    return usage3(io, "an issue id like ABC-123 is required", USAGE16);
+    return usage4(io, "an issue id like ABC-123 is required", USAGE17);
   if (extra !== undefined)
-    return usage3(io, `unexpected argument ${extra}`, USAGE16);
+    return usage4(io, `unexpected argument ${extra}`, USAGE17);
   const minutes = positiveInt(flags.values.minutes, "--minutes");
   if (typeof minutes === "string")
-    return usage3(io, minutes, USAGE16);
+    return usage4(io, minutes, USAGE17);
   const date = youTrackWorkDateMs(flags.values.date ?? "auto");
   if ("error" in date)
-    return usage3(io, date.error, USAGE16);
+    return usage4(io, date.error, USAGE17);
   const dateMs = date.data.dateMs;
   const markedDay = flags.values.date !== undefined && flags.values.date !== "auto" ? { dateMs } : {};
   const root = io.cwd;
@@ -104815,24 +105300,24 @@ async function run24(argv, io) {
   };
   if (sub === "note") {
     if (Boolean(flags.values.markdown) === Boolean(flags.values.file))
-      return usage3(io, "pass exactly one of --markdown or --file", USAGE16);
+      return usage4(io, "pass exactly one of --markdown or --file", USAGE17);
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync28(path68.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync28(path69.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
-        return usage3(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE16);
+        return usage4(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE17);
       }
     if (!markdown.trim())
-      return usage3(io, "the note is empty", USAGE16);
+      return usage4(io, "the note is empty", USAGE17);
     const missing = step("comment", "comments", { operation: "note", issueId, markdown }, markdown, async (text) => commentResult(await postComment(issueId, text, root))) ?? (minutes ? step("time", "workItems", { operation: "note.time", issueId, markdown, minutes, ...markedDay }, "workit update", (text) => logTimeUpdate({ issueId, minutes, text, dateMs, workspace_root: root })) : null);
     if (missing)
       return emit(io, fail2("unavailable", missing));
   } else {
     if (!minutes)
-      return usage3(io, `${sub} needs --minutes <n>`, USAGE16);
+      return usage4(io, `${sub} needs --minutes <n>`, USAGE17);
     if (sub === "meeting" && !flags.values.text)
-      return usage3(io, "meeting needs --text <what the meeting was>", USAGE16);
+      return usage4(io, "meeting needs --text <what the meeting was>", USAGE17);
     const text = flags.values.text ?? "";
     const missing = step(sub, "workItems", { operation: sub, issueId, minutes, text, ...markedDay }, text, (marked) => logTimeUpdate({ issueId, minutes, text: marked, dateMs, workspace_root: root }));
     if (missing)
@@ -104861,7 +105346,7 @@ async function run24(argv, io) {
     ...data.steps.flatMap((entry) => entry.note ? [`  note (${entry.step}): ${entry.note}`] : [])
   ]);
 }
-var USAGE16 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
+var USAGE17 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
   try {
     return { ok: true, data: unwrap(value) };
   } catch (error) {
@@ -104885,14 +105370,14 @@ var init_youtrack2 = __esm(() => {
 // packages/workit-cli/src/verbs/changelog.ts
 var exports_changelog = {};
 __export(exports_changelog, {
-  run: () => run25
+  run: () => run26
 });
 import { readFileSync as readFileSync29 } from "node:fs";
-import path69 from "node:path";
-async function run25(argv, io) {
+import path70 from "node:path";
+async function run26(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
-    return usage3(io, `unknown subcommand "${sub ?? ""}"`, USAGE17);
+    return usage4(io, `unknown subcommand "${sub ?? ""}"`, USAGE18);
   const flags = parseFlags(rest, {
     entries: "value",
     path: "value",
@@ -104900,18 +105385,18 @@ async function run25(argv, io) {
     preview: "boolean"
   });
   if (typeof flags === "string")
-    return usage3(io, flags, USAGE17);
+    return usage4(io, flags, USAGE18);
   if (flags.positionals.length)
-    return usage3(io, `unexpected argument ${flags.positionals[0]}`, USAGE17);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, USAGE18);
   const normalizeOnly = flags.booleans.has("normalize-only");
   if (!normalizeOnly && !flags.values.entries)
-    return usage3(io, "pass --entries <JSON> or --normalize-only", USAGE17);
+    return usage4(io, "pass --entries <JSON> or --normalize-only", USAGE18);
   let entries;
   if (flags.values.entries)
     try {
       entries = readEntries(flags.values.entries, io.cwd);
     } catch (error) {
-      return usage3(io, `--entries is not valid JSON: ${String(error)}`, USAGE17);
+      return usage4(io, `--entries is not valid JSON: ${String(error)}`, USAGE18);
     }
   const input = {
     entries,
@@ -104933,8 +105418,8 @@ async function run25(argv, io) {
     `changelog updated: ${String(applied.path ?? "CHANGELOG.md")}`
   ]);
 }
-var USAGE17 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync29(0, "utf8") : raw.startsWith("@") ? readFileSync29(path69.resolve(cwd, raw.slice(1)), "utf8") : raw;
+var USAGE18 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
+  const text = raw === "-" ? readFileSync29(0, "utf8") : raw.startsWith("@") ? readFileSync29(path70.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -104947,10 +105432,10 @@ var init_changelog2 = __esm(() => {
 var exports_handoff = {};
 __export(exports_handoff, {
   MAX_BRIEF_BYTES: () => MAX_BRIEF_BYTES,
-  run: () => run26
+  run: () => run27
 });
-import fs35 from "node:fs";
-import path70 from "node:path";
+import fs36 from "node:fs";
+import path71 from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 function render3(brief) {
   const lines = [
@@ -104990,10 +105475,10 @@ function bounded(brief, cwd) {
   let file = null;
   if (store.ok)
     try {
-      const dir = path70.join(store.value.root, "handoff");
-      fs35.mkdirSync(dir, { recursive: true });
-      file = path70.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
-      fs35.writeFileSync(file, `${[...body, ...tail].join(`
+      const dir = path71.join(store.value.root, "handoff");
+      fs36.mkdirSync(dir, { recursive: true });
+      file = path71.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
+      fs36.writeFileSync(file, `${[...body, ...tail].join(`
 `)}
 `, { mode: 384 });
     } catch {
@@ -105025,11 +105510,11 @@ async function resumeBrief(argv, io) {
       strict: true
     }));
   } catch (error) {
-    return emit(io, fail2("invalid_input", error.message, { unblock: USAGE18 }));
+    return emit(io, fail2("invalid_input", error.message, { unblock: USAGE19 }));
   }
   const last = values.last === undefined ? 10 : Number(values.last);
   if (!Number.isInteger(last) || last < 1)
-    return emit(io, fail2("invalid_input", "--last must be a positive integer", { unblock: USAGE18 }));
+    return emit(io, fail2("invalid_input", "--last must be a positive integer", { unblock: USAGE19 }));
   const built = buildHandoff(io.cwd, {
     last,
     note: values.note ?? null,
@@ -105047,13 +105532,13 @@ async function resumeBrief(argv, io) {
   }
   return emit(io, ok2({ ...data, recorded }), (brief) => bounded(brief, io.cwd));
 }
-async function run26(argv, io) {
+async function run27(argv, io) {
   if (!argv.some((arg) => arg === "--task" || arg.startsWith("--task=")))
     return resumeBrief(argv, io);
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
 }
-var USAGE18 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", MAX_BRIEF_BYTES = 4096, short7 = (sha) => sha ? sha.slice(0, 12) : "no commit", bytes = (lines) => Buffer.byteLength(`${lines.join(`
+var USAGE19 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", MAX_BRIEF_BYTES = 4096, short7 = (sha) => sha ? sha.slice(0, 12) : "no commit", bytes = (lines) => Buffer.byteLength(`${lines.join(`
 `)}
 `);
 var init_handoff = __esm(() => {
@@ -105064,7 +105549,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_host_session();
 init_package();
-import path71 from "node:path";
+import path72 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -105249,6 +105734,38 @@ var VERBS = [
     examples: ["workit grant show", "workit grant set my-repo push=true pr=true"],
     load: () => Promise.resolve().then(() => (init_grant(), exports_grant))
   }, { optional: true }),
+  withSubcommands({
+    name: "workspace",
+    group: "setup",
+    summary: "Edit workspace entries without the wizard; never raises a grant",
+    subcommands: [
+      {
+        name: "list",
+        usage: "workit workspace list",
+        summary: "Show every entry and the one that applies to --cwd, and why"
+      },
+      {
+        name: "add",
+        usage: "workit workspace add <name> --glob <glob> [--from <parent>]",
+        summary: "Add an entry; --from copies vcs, issues, branchPolicy, commitPolicy, trailers, youtrack and models, never grants"
+      },
+      {
+        name: "set",
+        usage: "workit workspace set <name> <key>=<value>…",
+        summary: "Change non-grant keys (dotted paths, JSON values, null removes); grants stay with workit grant set"
+      }
+    ],
+    examples: [
+      "workit workspace list",
+      "workit workspace add kit --glob '/home/me/work/libs/kit/**' --from work",
+      "workit workspace set kit branchPolicy.integration=merge"
+    ],
+    notes: [
+      "A new entry starts with no grants of its own. It starts at the strictest level of every entry and the defaults, so its folders never get more than they had. Remove an entry in your own editor. Raising a grant, defaultEndpoint or verification needs the user: workit grant set <name> <kind>=<value> in their own terminal.",
+      "Every write keeps the previous file as workspaces.json.bak. `workit doctor` lists overlapping globs and which entry wins."
+    ],
+    load: () => Promise.resolve().then(() => (init_workspace(), exports_workspace))
+  }, { optional: true }),
   ...TASK_FAMILY_NAMES.map(family2),
   {
     name: "check",
@@ -105360,7 +105877,7 @@ var VERBS = [
       },
       {
         name: "merge",
-        usage: "workit pr merge [--pr <n>] [--method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>]",
+        usage: "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch] [--unverified --reason <why>]",
         summary: "Merge when READY, verified by a non-author and granted; --subject/--body set the squash message"
       }
     ],
@@ -105794,7 +106311,9 @@ function closest(word, candidates) {
 }
 var COMMAND_HINTS = {
   status: "workit task status (this branch's task) or workit pr status (its PR); workit handoff prints the whole picture",
-  context: "workit handoff prints the branch, HEAD, dirty state, verdict and next command"
+  context: "workit handoff prints the branch, HEAD, dirty state, verdict and next command",
+  config: "workit grant show prints the workspace settings; workit doctor checks the install",
+  issue: "workit youtrack <action> handles tracker issues; gh api repos/<owner>/<repo>/issues/<n> reads a GitHub one"
 };
 function commandUnblock(command) {
   const near = closest(command, VERBS.filter((entry) => !entry.planned).map((entry) => entry.name));
@@ -105936,7 +106455,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path71.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path72.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail2("invalid_input", parsed.error));