@brainervirus/workit-cli 8.33.0 → 8.35.0

package/dist/index.js

@@ -9286,7 +9286,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.33.0",
+    version: "8.35.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9324,13 +9324,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.33.0",
+      "@brainervirus/workit-cursor": "^8.35.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.33.0"
+      "@brainervirus/workit-core": "^8.35.0"
     },
     engines: {
       node: ">=24"
@@ -66607,6 +66607,35 @@ var init_heavy_words = __esm(() => {
   HEAVY_WORDS = new Set(("npm npx pnpm pnpx yarn bun bunx deno corepack make gmake docker podman nerdctl " + "python python3 py uv poetry pdm pipenv hatch rye bundle rake nx " + "jest vitest mocha ava tap karma jasmine nyc c8 tsc vue-tsc svelte-check eslint stylelint " + "tslint webpack webpack-cli rollup parcel tsup vite next nuxt nuxi astro ng react-scripts " + "playwright cypress wdio testcafe turbo lerna sonar-scanner sonarless sonarless-mcp go " + "golangci-lint gotestsum staticcheck cargo mvn mvnw gradle gradlew ant sbt bazel bazelisk " + "buck2 dotnet msbuild pytest py.test tox nox mypy pyright pylint coverage maturin pip pip3 " + "rspec rails phpunit pest phpstan psalm composer mix swift xcodebuild flutter dart pod cmake " + "ninja meson ctest scons docker-compose buildah earthly").split(" "));
 });
 
+// packages/workit-core/src/hooks/hook-runs.ts
+import { mkdirSync as mkdirSync6, readdirSync as readdirSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "node:fs";
+import path37 from "node:path";
+var HOOK_RUNS_DIR = "hook-runs", readHookRuns = (dir) => {
+  const runs = [];
+  let names = [];
+  try {
+    names = readdirSync8(path37.join(dir, HOOK_RUNS_DIR));
+  } catch {
+    return runs;
+  }
+  for (const name of names) {
+    try {
+      const row = JSON.parse(readFileSync15(path37.join(dir, HOOK_RUNS_DIR, name), "utf8"));
+      if (typeof row.host === "string" && typeof row.event === "string" && typeof row.at === "string" && typeof row.count === "number")
+        runs.push({
+          host: row.host,
+          event: row.event,
+          at: row.at,
+          count: row.count
+        });
+    } catch {}
+  }
+  return runs;
+};
+var init_hook_runs = __esm(() => {
+  init_heavy_words();
+});
+
 // packages/workit-core/src/hooks/delivery-verbs.ts
 var WORKIT_ALLOWED_VERBS, ALLOWED;
 var init_delivery_verbs = __esm(() => {
@@ -66635,14 +66664,15 @@ var init_delivery_verbs = __esm(() => {
 import {
   copyFileSync as copyFileSync4,
   existsSync as existsSync15,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync15,
+  readdirSync as readdirSync9,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync16,
   realpathSync as realpathSync7,
   rmSync as rmSync3,
   statSync as statSync5
 } from "node:fs";
 import os11 from "node:os";
-import path37 from "node:path";
+import path38 from "node:path";
 function mergeClaudeSettings(settings, shell, skip = {}) {
   const config = clone4(settings);
   const owned = emptyOwned();
@@ -66652,7 +66682,11 @@ function mergeClaudeSettings(settings, shell, skip = {}) {
   if (shell) {
     const env = objectAt(config, ["env"], owned);
     if (!env)
-      return { config: settings, owned: emptyOwned(), error: "env is not an object" };
+      return {
+        config: settings,
+        owned: emptyOwned(),
+        error: "env is not an object"
+      };
     if (env.CLAUDE_CODE_SHELL === undefined) {
       env.CLAUDE_CODE_SHELL = shell;
       owned.env.CLAUDE_CODE_SHELL = shell;
@@ -66758,7 +66792,7 @@ function planHostPermissions(options) {
         plan.blocked.push(`${target.file} is not a JSON object; left untouched`);
         continue;
       }
-      const shellWanted = host === "claude-code" && options.shell !== false && path37.basename(paths.env.SHELL ?? "") === "zsh";
+      const shellWanted = host === "claude-code" && options.shell !== false && path38.basename(paths.env.SHELL ?? "") === "zsh";
       const bash = shellWanted ? options.bash === undefined ? findBash(paths.env) : options.bash : null;
       const merged = host === "claude-code" ? mergeClaudeSettings(parsed, bash, skip) : mergeCursorCliConfig(parsed, skip);
       if (merged.error) {
@@ -66858,11 +66892,11 @@ function applyHostPermissions(plan, options = {}) {
     try {
       const target = change.before === null ? change.file : realpathSync7(change.file);
       if (change.before !== null) {
-        const backups = path37.join(paths.stateDir, "host-permissions-backup");
-        mkdirSync6(backups, { recursive: true, mode: 448 });
-        copyFileSync4(target, path37.join(backups, `${new Date().toISOString().replaceAll(":", "-")}-${change.host}-${path37.basename(change.file)}`));
+        const backups = path38.join(paths.stateDir, "host-permissions-backup");
+        mkdirSync7(backups, { recursive: true, mode: 448 });
+        copyFileSync4(target, path38.join(backups, `${new Date().toISOString().replaceAll(":", "-")}-${change.host}-${path38.basename(change.file)}`));
       }
-      mkdirSync6(path37.dirname(target), { recursive: true });
+      mkdirSync7(path38.dirname(target), { recursive: true });
       writeFileAtomic(target, change.after);
       const previous = record.hosts[change.host];
       record.hosts[change.host] = {
@@ -66892,7 +66926,10 @@ function permissionHealth(host, options = {}) {
   if (host === "codex") {
     if (text === null)
       return { state: "absent" };
-    return text === codexRulesText() ? { state: "ok" } : { state: "drift", detail: `${target.file} differs from this Workit version's rules` };
+    return text === codexRulesText() ? { state: "ok" } : {
+      state: "drift",
+      detail: `${target.file} differs from this Workit version's rules`
+    };
   }
   if (text === null)
     return { state: "absent" };
@@ -66915,7 +66952,37 @@ function permissionHealth(host, options = {}) {
     detail: `${target.file} lacks ${missing.length} Workit entr${missing.length === 1 ? "y" : "ies"} (${missing[0]}${missing.length > 1 ? ", …" : ""})`
   };
 }
-var PERMISSION_HOSTS, CLAUDE_ALLOW, CLAUDE_ASK, AUTO_MODE_ENVIRONMENT = "Org-specific CLIs: workit — the user's delivery CLI. Its push, pr merge, release and PR-thread verbs run only under per-workspace grants and non-author verdicts the user configured in ~/.config/workit, outside the agent's reach.", AUTO_MODE_ALLOW = "Workit-gated delivery: `workit pr merge`, `workit git push --force-with-lease` on the session's own branch, `workit release` and `workit pr reply/resolve` on the session's repo are authorized by the user's standing Workit grants; not Merge Without Review, Git Destructive or External System Writes. Does NOT cover `--unverified`, `--admin` or any bypass flag.", DEFAULTS2 = "$defaults", CHECK_NAMES, LOCK_VERBS, LEASE_PREFIXES, CURSOR_ALLOW, CODEX_HEADER, codexRulesText = () => {
+function permissionCoverage(host, commands, options = {}) {
+  const target = permissionTarget(host, options);
+  if (!existsSync15(target.hostDir))
+    return { state: "no-host" };
+  const cwd = options.cwd ?? process.cwd();
+  let missing;
+  if (host === "codex") {
+    const patterns = codexAllowPatterns(path38.dirname(target.file));
+    missing = commands.filter((command) => {
+      const words = command.split(" ");
+      return !patterns.some((p) => p.every((word, i) => words[i] === word));
+    });
+  } else if (host === "cursor") {
+    const rules = [target.file, path38.join(cwd, ".cursor", "cli.json")].flatMap((file) => stringList(valueFrom(readRecord(file), "permissions", "allow")));
+    missing = commands.filter((command) => !rules.some((rule) => cursorRuleMatches(rule, command)));
+  } else {
+    const files = [
+      target.file,
+      path38.join(cwd, ".claude", "settings.json"),
+      path38.join(cwd, ".claude", "settings.local.json")
+    ].map(readRecord);
+    const rules = files.flatMap((file) => stringList(valueFrom(file, "permissions", "allow")));
+    missing = commands.filter((command) => !rules.some((rule) => claudeRuleMatches(rule, command)));
+    const delivery = commands.some((command) => !LEASE_COMMANDS.includes(command));
+    const auto = files.flatMap((file) => stringList(valueFrom(file, "autoMode", "allow")));
+    if (delivery && !auto.some((line) => /\bworkit\b/iu.test(line)))
+      missing.push("autoMode.allow line naming workit");
+  }
+  return missing.length === 0 ? { state: "ok" } : { state: "missing", file: target.file, missing };
+}
+var PERMISSION_HOSTS, CHECK_NAMES, LOCK_VERBS, LEASE_PREFIXES, CLAUDE_ALLOW, CLAUDE_ASK, AUTO_MODE_ENVIRONMENT = "Org-specific CLIs: workit — the user's delivery CLI. Its push, pr merge, release and PR-thread verbs run only under per-workspace grants and non-author verdicts the user configured in ~/.config/workit, outside the agent's reach.", AUTO_MODE_ALLOW = "Workit-gated delivery: `workit pr merge`, `workit git push --force-with-lease` on the session's own branch, `workit release` and `workit pr reply/resolve` on the session's repo are authorized by the user's standing Workit grants; not Merge Without Review, Git Destructive or External System Writes. Does NOT cover `--unverified`, `--admin` or any bypass flag.", DEFAULTS2 = "$defaults", CURSOR_ALLOW, CODEX_HEADER, codexRulesText = () => {
   const rules = [...WORKIT_ALLOWED_VERBS, "--version"].map((verb) => {
     const examples = verb === "git" ? `
     match = [["workit", "git", "push", "--cwd", "/w"]],
@@ -67007,30 +67074,34 @@ ${[...rules, ...lease, grant].join(`
 }, resolvePaths = (options) => {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? os11.homedir();
-  return { home, env, stateDir: options.stateDir ?? stateDir({ ...env, HOME: home }) };
+  return {
+    home,
+    env,
+    stateDir: options.stateDir ?? stateDir({ ...env, HOME: home })
+  };
 }, permissionTarget = (host, options = {}) => {
   const { home, env } = resolvePaths(options);
   if (host === "claude-code") {
     const dir = claudeConfigDir(home, env);
-    return { file: path37.join(dir, "settings.json"), hostDir: dir };
+    return { file: path38.join(dir, "settings.json"), hostDir: dir };
   }
   if (host === "codex") {
-    const dir = env.CODEX_HOME || path37.join(home, ".codex");
-    return { file: path37.join(dir, "rules", "workit.rules"), hostDir: dir };
+    const dir = env.CODEX_HOME || path38.join(home, ".codex");
+    return { file: path38.join(dir, "rules", "workit.rules"), hostDir: dir };
   }
-  const dir = path37.join(home, ".cursor");
-  return { file: path37.join(dir, "cli-config.json"), hostDir: dir };
+  const dir = path38.join(home, ".cursor");
+  return { file: path38.join(dir, "cli-config.json"), hostDir: dir };
 }, AGENT_SESSION_VARS, agentSessionVar = (env) => AGENT_SESSION_VARS.find((name) => (env[name] ?? "") !== "") ?? null, RECORD_FILE = "host-permissions.json", readOwnership = (options = {}) => {
   const { stateDir } = resolvePaths(options);
   try {
-    const value = JSON.parse(readFileSync15(path37.join(stateDir, RECORD_FILE), "utf8"));
+    const value = JSON.parse(readFileSync16(path38.join(stateDir, RECORD_FILE), "utf8"));
     if (isRecord5(value) && isRecord5(value.hosts))
       return { version: 1, hosts: value.hosts };
   } catch {}
   return { version: 1, hosts: {} };
 }, writeOwnership = (record, stateDir) => {
-  mkdirSync6(stateDir, { recursive: true });
-  writeFileAtomic(path37.join(stateDir, RECORD_FILE), JSON.stringify(record, null, 2) + `
+  mkdirSync7(stateDir, { recursive: true });
+  writeFileAtomic(path38.join(stateDir, RECORD_FILE), JSON.stringify(record, null, 2) + `
 `, 384);
 }, unionLists = (a, b) => {
   const lists = { ...a };
@@ -67052,14 +67123,14 @@ ${[...rules, ...lease, grant].join(`
   writeOwnership(record, paths.stateDir);
 }, readText4 = (file) => {
   try {
-    return readFileSync15(file, "utf8");
+    return readFileSync16(file, "utf8");
   } catch {
     return null;
   }
 }, findBash = (env) => {
-  const dirs = ["/usr/bin", "/bin", ...(env.PATH ?? "").split(path37.delimiter).filter(Boolean)];
+  const dirs = ["/usr/bin", "/bin", ...(env.PATH ?? "").split(path38.delimiter).filter(Boolean)];
   for (const dir of dirs) {
-    const candidate = path37.join(dir, "bash");
+    const candidate = path38.join(dir, "bash");
     try {
       if (statSync5(candidate).isFile())
         return candidate;
@@ -67068,10 +67139,60 @@ ${[...rules, ...lease, grant].join(`
   return null;
 }, setupCommand = (hosts) => `workit setup --hosts=${hosts.join(",")}`, removeCodexRules = (file, options = {}) => {
   const expected = permissionTarget("codex", options).file;
-  if (path37.resolve(file) !== path37.resolve(expected) || !existsSync15(expected))
+  if (path38.resolve(file) !== path38.resolve(expected) || !existsSync15(expected))
     return false;
   rmSync3(expected);
   return true;
+}, GRANT_COMMANDS, LEASE_COMMANDS, grantedCommands = (kinds) => [
+  ...kinds.flatMap((kind) => GRANT_COMMANDS[kind] ?? []),
+  ...LEASE_COMMANDS
+], claudeRuleMatches = (rule, command) => {
+  const body = /^Bash\((.*)\)$/u.exec(rule)?.[1];
+  if (rule === "Bash" || body === "*" || body === "")
+    return true;
+  if (body === undefined)
+    return false;
+  if (body.endsWith(":*") && !body.slice(0, -2).includes("*")) {
+    const prefix = body.slice(0, -2);
+    return command === prefix || command.startsWith(`${prefix} `);
+  }
+  const escaped = body.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/gu, "\\$&")).join(".*");
+  const pattern = body.endsWith(" *") ? escaped.replace(/ \.\*$/u, "(?: .*)?") : escaped;
+  return new RegExp(`^${pattern}$`, "u").test(command);
+}, cursorRuleMatches = (rule, command) => {
+  const full = /^Shell\((.*)\)$/u.exec(rule)?.[1];
+  return full !== undefined && (command === full || command.startsWith(`${full} `));
+}, stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [], readRecord = (file) => {
+  const text = readText4(file);
+  if (text === null)
+    return null;
+  try {
+    const value = JSON.parse(text);
+    return isRecord5(value) ? value : null;
+  } catch {
+    return null;
+  }
+}, codexAllowPatterns = (dir) => {
+  const patterns = [];
+  let names = [];
+  try {
+    names = readdirSync9(dir).filter((name) => name.endsWith(".rules"));
+  } catch {
+    return patterns;
+  }
+  for (const name of names)
+    for (const m of (readText4(path38.join(dir, name)) ?? "").matchAll(/pattern\s*=\s*(\[[^\]]*\])\s*,\s*decision\s*=\s*"allow"/gu))
+      try {
+        const words = JSON.parse(m[1]);
+        if (Array.isArray(words))
+          patterns.push(words.map(String));
+      } catch {}
+  return patterns;
+}, valueFrom = (root, ...keys) => {
+  let node = root;
+  for (const key of keys)
+    node = isRecord5(node) ? node[key] : undefined;
+  return node;
 };
 var init_host_permissions = __esm(() => {
   init_heavy_words();
@@ -67083,20 +67204,21 @@ var init_host_permissions = __esm(() => {
     "codex",
     "cursor"
   ]);
+  CHECK_NAMES = ["test", "lint", "typecheck", "build", "format", "docs"];
+  LOCK_VERBS = ["status", "wait"];
+  LEASE_PREFIXES = [
+    ...CHECK_NAMES.map((name) => ["check", name]),
+    ...LOCK_VERBS.map((verb) => ["lock", verb])
+  ];
   CLAUDE_ALLOW = [
     ...WORKIT_ALLOWED_VERBS.map((verb) => `Bash(workit ${verb} *)`),
+    ...LEASE_PREFIXES.map((rest) => `Bash(workit ${rest.join(" ")} *)`),
     "Bash(workit --version)"
   ];
   CLAUDE_ASK = [
     "Bash(workit * --unverified*)",
     "Bash(workit * --overwrite-unintegrated*)"
   ];
-  CHECK_NAMES = ["test", "lint", "typecheck", "build", "format", "docs"];
-  LOCK_VERBS = ["status", "wait"];
-  LEASE_PREFIXES = [
-    ...CHECK_NAMES.map((name) => ["check", name]),
-    ...LOCK_VERBS.map((verb) => ["lock", verb])
-  ];
   CURSOR_ALLOW = [
     ...WORKIT_ALLOWED_VERBS.map((verb) => `Shell(workit ${verb})`),
     ...LEASE_PREFIXES.map((rest) => `Shell(workit ${rest.join(" ")})`),
@@ -67115,7 +67237,11 @@ var init_host_permissions = __esm(() => {
       created: [],
       env: {}
     },
-    cursor: { lists: { "permissions.allow": [...CURSOR_ALLOW] }, created: [], env: {} }
+    cursor: {
+      lists: { "permissions.allow": [...CURSOR_ALLOW] },
+      created: [],
+      env: {}
+    }
   };
   PRIOR_ENTRIES = {
     "claude-code": {},
@@ -67142,6 +67268,12 @@ var init_host_permissions = __esm(() => {
     "PI_SESSION_ID",
     "CURSOR_AGENT"
   ];
+  GRANT_COMMANDS = {
+    push: ["workit git push"],
+    pr: ["workit pr create"],
+    merge: ["workit pr merge"]
+  };
+  LEASE_COMMANDS = LEASE_PREFIXES.map((rest) => `workit ${rest.join(" ")}`);
 });
 
 // packages/workit-cli/src/admin/doctor.ts
@@ -67150,31 +67282,34 @@ import { createHash as createHash14 } from "node:crypto";
 import {
   existsSync as existsSync16,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   mkdtempSync,
-  readdirSync as readdirSync8,
-  readFileSync as readFileSync16,
+  readdirSync as readdirSync10,
+  readFileSync as readFileSync17,
   readlinkSync as readlinkSync2,
   renameSync as renameSync4,
   rmSync as rmSync4,
   statSync as statSync6,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
 import os12 from "node:os";
-import path38 from "node:path";
+import path39 from "node:path";
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
-  let dir = path38.resolve(cwd);
+  let dir = path39.resolve(cwd);
   while (true) {
-    if (existsSync16(path38.join(dir, "packages", "workit-core", "package.json")))
+    if (existsSync16(path39.join(dir, "packages", "workit-core", "package.json")))
       return dir;
-    const parent = path38.dirname(dir);
+    const parent = path39.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
   }
 }, listClaudeProcesses = () => {
-  const r = spawnSync16("ps", ["-eo", "pid=,lstart=,args="], { encoding: "utf8", timeout: 5000 });
+  const r = spawnSync16("ps", ["-eo", "pid=,lstart=,args="], {
+    encoding: "utf8",
+    timeout: 5000
+  });
   if (r.status !== 0 || typeof r.stdout !== "string")
     return null;
   const found = [];
@@ -67191,8 +67326,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, resolve = (options) => {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? os12.homedir();
-  const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path38.join(home, ".config", "workit");
-  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path38.join(home, ".local", "state", "workit");
+  const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path39.join(home, ".config", "workit");
+  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path39.join(home, ".local", "state", "workit");
   const cwd = options.cwd ?? process.cwd();
   const dev = options.dev?.trim() || env.WORKFLOW_TOOLKIT_DEV?.trim() || findDevFromCwd(cwd);
   return {
@@ -67203,11 +67338,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     cwd,
     workspaceRoot: options.workspaceRoot ?? env.WORKFLOW_WORKSPACE_ROOT ?? cwd,
     dev,
-    opencodeConfig: options.opencodeConfig ?? path38.join(home, ".config", "opencode", "opencode.json"),
+    opencodeConfig: options.opencodeConfig ?? path39.join(home, ".config", "opencode", "opencode.json"),
     opencodePackageCacheDir: options.opencodePackageCacheDir ?? null,
-    cursorSettings: options.cursorSettings ?? path38.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path38.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path38.join(home, ".cursor", "plugins", "local", "workit"),
+    cursorSettings: options.cursorSettings ?? path39.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path39.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path39.join(home, ".cursor", "plugins", "local", "workit"),
     cursorHeartbeatDir: options.stateDir ?? (env.WORKFLOW_TOOLKIT_STATE || resolveStateDir()),
     hookStateDir: options.stateDir ?? (env.WORKFLOW_TOOLKIT_STATE || resolveStateDir()),
     codexHome: options.codexHome,
@@ -67220,14 +67355,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, readJson = (p) => {
   try {
-    const parsed = JSON.parse(readFileSync16(p, "utf8"));
+    const parsed = JSON.parse(readFileSync17(p, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }, parsesAsConfigObject = (p) => {
   try {
-    return isConfigObject(JSON.parse(readFileSync16(p, "utf8")));
+    return isConfigObject(JSON.parse(readFileSync17(p, "utf8")));
   } catch {
     return false;
   }
@@ -67237,12 +67372,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     ...new Set(entries.filter((entry) => typeof entry === "string" && isWorkitPlugin(entry)))
   ];
 }, commandOnPath = (name, env) => findOnPath(process.platform === "win32" ? [name, `${name}.exe`] : [name], env) !== null, pathextNames = (name, env) => process.platform === "win32" ? (env.PATHEXT ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map((ext) => `${name}${ext.toLowerCase()}`) : [name], findOnPath = (names, env) => {
-  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path38.delimiter);
+  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path39.delimiter);
   for (const dir of dirs) {
     if (!dir)
       continue;
     for (const candidateName of names) {
-      const candidate = path38.join(dir, candidateName);
+      const candidate = path39.join(dir, candidateName);
       try {
         const st = statSync6(candidate);
         if (process.platform !== "win32" && (st.mode & 73) === 0)
@@ -67271,7 +67406,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (env.BUN && existsSync16(env.BUN))
     return env.BUN;
   for (const candidate of [
-    path38.join(env.HOME || os12.homedir(), ".bun/bin/bun"),
+    path39.join(env.HOME || os12.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
@@ -67326,7 +67461,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "installed package, not a dev checkout — version parity applies to checkouts only"
     };
   }
-  const corePkg = readJson(path38.join(res.dev, "packages/workit-core/package.json"));
+  const corePkg = readJson(path39.join(res.dev, "packages/workit-core/package.json"));
   if (!corePkg) {
     return {
       id: "versions",
@@ -67336,7 +67471,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
-    const pkg = readJson(path38.join(res.dev, "packages", name, "package.json"));
+    const pkg = readJson(path39.join(res.dev, "packages", name, "package.json"));
     const dep = pkg?.dependencies?.["@brainervirus/workit-core"] ?? pkg?.devDependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
@@ -67352,7 +67487,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (refs.size > 1) {
     problems.push(`adapters pin different core versions: ${[...refs].join(", ")}`);
   }
-  const opencodePkg = readJson(path38.join(res.dev, "packages/workit-opencode/package.json"));
+  const opencodePkg = readJson(path39.join(res.dev, "packages/workit-opencode/package.json"));
   const sdk = opencodePkg?.dependencies?.["@opencode/plugin"] ?? opencodePkg?.devDependencies?.["@opencode/plugin"];
   const sdkVersion = typeof sdk === "string" ? (sdk.match(/^\d+(?:\.\d+){0,2}/) ?? [])[0] : null;
   if (sdkVersion && !semverAtLeast(sdkVersion, SUPPORT_MATRIX.opencode.minimum)) {
@@ -67379,14 +67514,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "opencode CLI not on PATH — skipping version check"
     };
-  const scratch = mkdtempSync(path38.join(os12.tmpdir(), "workit-doctor-opencode-"));
+  const scratch = mkdtempSync(path39.join(os12.tmpdir(), "workit-doctor-opencode-"));
   let raw;
   try {
     raw = versionOf("opencode", {
       ...res.env,
-      XDG_DATA_HOME: path38.join(scratch, "data"),
-      XDG_STATE_HOME: path38.join(scratch, "state"),
-      XDG_CACHE_HOME: path38.join(scratch, "cache")
+      XDG_DATA_HOME: path39.join(scratch, "data"),
+      XDG_STATE_HOME: path39.join(scratch, "state"),
+      XDG_CACHE_HOME: path39.join(scratch, "cache")
     }, 5000);
   } finally {
     rmSync4(scratch, { recursive: true, force: true });
@@ -67450,7 +67585,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const tables = new Map;
   let text;
   try {
-    text = readFileSync16(file, "utf8");
+    text = readFileSync17(file, "utf8");
   } catch {
     return tables;
   }
@@ -67488,19 +67623,19 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     current[unquote(pair[1])] = value === "true" ? true : value === "false" ? false : unquote(value);
   }
   return tables;
-}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path38.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
+}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path39.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
   const codexHome = codexHomeOf(res);
-  const configFile = path38.join(codexHome, "config.toml");
+  const configFile = path39.join(codexHome, "config.toml");
   const installs = [];
   for (const [key, table] of readTomlTables(configFile)) {
     const [kind, id, ...rest] = key.split("\x00");
     if (kind !== "plugins" || rest.length > 0 || !id?.startsWith("workit@") || table.enabled === false)
       continue;
     const marketplace = id.slice("workit@".length);
-    const dir = path38.join(codexHome, "plugins", "cache", marketplace, "workit");
+    const dir = path39.join(codexHome, "plugins", "cache", marketplace, "workit");
     let versions = [];
     try {
-      versions = readdirSync8(dir).filter((v) => existsSync16(path38.join(dir, v, ".codex-plugin")));
+      versions = readdirSync10(dir).filter((v) => existsSync16(path39.join(dir, v, ".codex-plugin")));
     } catch {
       versions = [];
     }
@@ -67508,7 +67643,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     installs.push({
       id,
       marketplace,
-      root: version ? path38.join(dir, version) : null,
+      root: version ? path39.join(dir, version) : null,
       version,
       configFile
     });
@@ -67530,7 +67665,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
   return `sha256:${createHash14("sha256").update(JSON.stringify(body)).digest("hex")}`;
 }, codexHookTrust = (install, tables) => {
-  const hooks = install.root ? readJson(path38.join(install.root, "hooks", "hooks.json"))?.hooks : null;
+  const hooks = install.root ? readJson(path39.join(install.root, "hooks", "hooks.json"))?.hooks : null;
   if (!hooks || typeof hooks !== "object")
     return null;
   const result = [];
@@ -67603,25 +67738,25 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "no Workit Codex plugin enabled — skipping"
     };
-  const agentsDir = path38.join(codexHomeOf(res), "agents");
+  const agentsDir = path39.join(codexHomeOf(res), "agents");
   const problems = [];
   const fixes = [];
   const installed = [];
   for (const install of installs) {
-    const source = install.root ? path38.join(install.root, "agents") : null;
-    const files = source && existsSync16(source) ? readdirSync8(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
+    const source = install.root ? path39.join(install.root, "agents") : null;
+    const files = source && existsSync16(source) ? readdirSync10(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
     if (files.length === 0) {
       problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
       fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
       continue;
     }
-    const install_fix = `node ${JSON.stringify(path38.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
-    const pluginVersion = readJson(path38.join(install.root, "package.json"))?.version;
+    const install_fix = `node ${JSON.stringify(path39.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
+    const pluginVersion = readJson(path39.join(install.root, "package.json"))?.version;
     const version = typeof pluginVersion === "string" ? pluginVersion.match(SEMVER)?.[0] ?? null : null;
     let stale = false;
     for (const file of files) {
-      const dest = path38.join(agentsDir, file);
-      const want = stampCodexAgent(readFileSync16(path38.join(source, file), "utf8"), version);
+      const dest = path39.join(agentsDir, file);
+      const want = stampCodexAgent(readFileSync17(path39.join(source, file), "utf8"), version);
       let link = false;
       try {
         link = lstatSync5(dest).isSymbolicLink();
@@ -67635,7 +67770,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       }
       let have = null;
       try {
-        have = readFileSync16(dest, "utf8");
+        have = readFileSync17(dest, "utf8");
       } catch {
         have = null;
       }
@@ -67674,7 +67809,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const env = res.env.PI_CODING_AGENT_DIR;
   if (env)
     return env === "~" ? res.home : env.replace(/^~(?=\/|\\)/, res.home);
-  return path38.join(res.home, ".pi", "agent");
+  return path39.join(res.home, ".pi", "agent");
 }, npmSpecName = (spec) => {
   const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
   return at > 0 ? { name: spec.slice(0, at), pinned: true } : { name: spec, pinned: false };
@@ -67682,10 +67817,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const scopes = [
     {
       scope: "project",
-      settingsFile: path38.join(res.cwd, ".pi", "settings.json"),
-      base: path38.join(res.cwd, ".pi")
+      settingsFile: path39.join(res.cwd, ".pi", "settings.json"),
+      base: path39.join(res.cwd, ".pi")
     },
-    { scope: "user", settingsFile: path38.join(agentDir, "settings.json"), base: agentDir }
+    {
+      scope: "user",
+      settingsFile: path39.join(agentDir, "settings.json"),
+      base: agentDir
+    }
   ];
   for (const { scope, settingsFile, base } of scopes) {
     const packages = readJson(settingsFile)?.packages;
@@ -67700,13 +67839,20 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         const spec = npmSpecName(source.slice(4).trim());
         if (spec.name !== PI_PACKAGE)
           continue;
-        const root = path38.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
-        return { scope, settingsFile, source, filter, root, npm: { pinned: spec.pinned } };
+        const root = path39.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
+        return {
+          scope,
+          settingsFile,
+          source,
+          filter,
+          root,
+          npm: { pinned: spec.pinned }
+        };
       }
       if (/^(git:|https?:|ssh:|git@)/.test(source))
         continue;
-      const local = path38.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
-      if (readJson(path38.join(local, "package.json"))?.name === PI_PACKAGE)
+      const local = path39.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
+      if (readJson(path39.join(local, "package.json"))?.name === PI_PACKAGE)
         return { scope, settingsFile, source, filter, root: local, npm: null };
     }
   }
@@ -67717,7 +67863,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const list = patterns.filter((p) => typeof p === "string");
   if (list.length === 0)
     return false;
-  const name = path38.posix.basename(file);
+  const name = path39.posix.basename(file);
   const matches = (p) => {
     const re = globToRegExp3(p);
     return re.test(file) || re.test(name);
@@ -67735,19 +67881,23 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, checkPiExtension = (res) => {
   const agentDir = piAgentDirOf(res);
   if (!existsSync16(agentDir) && !commandOnPath("pi", res.env))
-    return { id: "pi_extension", status: "pass", detail: "Pi not installed — skipping" };
+    return {
+      id: "pi_extension",
+      status: "pass",
+      detail: "Pi not installed — skipping"
+    };
   const installCmd = (scope, spec = `npm:${PI_PACKAGE}`) => `pi install ${spec}${scope === "project" ? " -l" : ""}`;
   const entry = findPiEntry(res, agentDir);
   if (!entry)
     return {
       id: "pi_extension",
       status: "warn",
-      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path38.join(agentDir, "settings.json")} or ${path38.join(res.cwd, ".pi", "settings.json")}`,
+      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path39.join(agentDir, "settings.json")} or ${path39.join(res.cwd, ".pi", "settings.json")}`,
       fix: installCmd("user")
     };
   const where = `${entry.source} (${entry.scope}, ${entry.settingsFile})`;
   const rebuild = `cd ${JSON.stringify(entry.root)} && bun run build`;
-  const pkg = readJson(path38.join(entry.root, "package.json"));
+  const pkg = readJson(path39.join(entry.root, "package.json"));
   if (!pkg)
     return {
       id: "pi_extension",
@@ -67756,7 +67906,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: entry.npm ? installCmd(entry.scope, entry.source) : `restore ${entry.root}, then ${rebuild}`
     };
   const declared = Array.isArray(pkg.pi?.extensions) ? pkg.pi.extensions.some((e) => typeof e === "string" && e.replace(/^\.\//, "") === PI_EXTENSION) : false;
-  if (!declared || !existsSync16(path38.join(entry.root, PI_EXTENSION)))
+  if (!declared || !existsSync16(path39.join(entry.root, PI_EXTENSION)))
     return {
       id: "pi_extension",
       status: "warn",
@@ -67809,21 +67959,21 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `Workit Pi extension ${version ?? "?"} from ${where} loads ${PI_EXTENSION}`
   };
 }, assetPathsFor = (host, dev) => {
-  const pkg = path38.join(dev, "packages", `workit-${host}`);
+  const pkg = path39.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode": {
-      const packaged = path38.join(pkg, "assets", "skills");
-      const root = existsSync16(packaged) ? packaged : path38.join(dev, "packages", "workit-core", "skills");
-      return WORKIT_METHOD_SKILLS.map((skill) => path38.join(root, skill, "SKILL.md"));
+      const packaged = path39.join(pkg, "assets", "skills");
+      const root = existsSync16(packaged) ? packaged : path39.join(dev, "packages", "workit-core", "skills");
+      return WORKIT_METHOD_SKILLS.map((skill) => path39.join(root, skill, "SKILL.md"));
     }
     case "cursor":
       return [
-        path38.join(pkg, "assets", "templates", "workit-contract.md"),
-        path38.join(pkg, "mcp.json"),
-        path38.join(pkg, ".cursor-plugin")
+        path39.join(pkg, "assets", "templates", "workit-contract.md"),
+        path39.join(pkg, "mcp.json"),
+        path39.join(pkg, ".cursor-plugin")
       ];
     case "cli":
-      return [path38.join(pkg, "assets", "templates", "spec-template.md")];
+      return [path39.join(pkg, "assets", "templates", "spec-template.md")];
   }
 }, hostsFor = (host) => host === "cli" ? ["opencode", "cursor", "cli"] : [host], checkAssets = (res) => {
   const dev = res.dev;
@@ -67854,22 +68004,22 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Reinstall or rebuild the workit package (missing assets under packages/workit-<host>)"
   };
 }, launcherSlotsFor = (host, dev) => {
-  const pkg = path38.join(dev, "packages", `workit-${host}`);
+  const pkg = path39.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
-      return [[path38.join(pkg, "src", "plugin.ts"), path38.join(pkg, "dist", "plugin.js")]];
+      return [[path39.join(pkg, "src", "plugin.ts"), path39.join(pkg, "dist", "plugin.js")]];
     case "cursor":
       return [
-        [path38.join(pkg, "dist", "mcp-server.js")],
-        [path38.join(pkg, "dist", "cursor-session-start.js")]
+        [path39.join(pkg, "dist", "mcp-server.js")],
+        [path39.join(pkg, "dist", "cursor-session-start.js")]
       ];
     case "cli":
-      return [[path38.join(pkg, "src", "index.tsx"), path38.join(pkg, "dist", "index.js")]];
+      return [[path39.join(pkg, "src", "index.tsx"), path39.join(pkg, "dist", "index.js")]];
   }
 }, validNodeEntry = (entry, runtime, env) => {
   try {
     const stat = statSync6(entry);
-    if (!stat.isFile() || stat.size === 0 || !readFileSync16(entry, "utf8").startsWith(`#!/usr/bin/env node
+    if (!stat.isFile() || stat.size === 0 || !readFileSync17(entry, "utf8").startsWith(`#!/usr/bin/env node
 `)) {
       return false;
     }
@@ -67891,7 +68041,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (typeof command !== "string" || !Array.isArray(args) || typeof args[0] !== "string") {
     return "invalid";
   }
-  const executable = path38.basename(command).toLowerCase();
+  const executable = path39.basename(command).toLowerCase();
   const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))
@@ -67903,10 +68053,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return {
     kind: "node",
     runtime: command,
-    entry: path38.isAbsolute(args[0]) ? args[0] : path38.resolve(path38.dirname(res.cursorMcp), args[0])
+    entry: path39.isAbsolute(args[0]) ? args[0] : path39.resolve(path39.dirname(res.cursorMcp), args[0])
   };
 }, canonicalCursorHook, isCanonicalCursorHook = (command, res) => command === canonicalCursorHook || command === cursorHooksEntry(res.cursorPluginDir).command, registeredCursorHook = (res) => {
-  const hooksFile = path38.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   if (!existsSync16(hooksFile))
     return "invalid";
   const config = readJson(hooksFile);
@@ -67924,9 +68074,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!m)
     return false;
   const entry = m[1].trim();
-  if (!path38.isAbsolute(entry))
+  if (!path39.isAbsolute(entry))
     return false;
-  if (path38.resolve(entry) !== path38.resolve(path38.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
+  if (path39.resolve(entry) !== path39.resolve(path39.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
     return false;
   }
   return validNodeEntry(entry, "node", res.env);
@@ -67935,7 +68085,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const hosts = hostsFor(res.host);
   const registered = hosts.includes("cursor") ? registeredCursorLauncher(res) : null;
   const runtime = registered && registered !== "invalid" && registered.kind === "node" ? registered.runtime : "node";
-  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path38.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
+  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path39.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
   if (hosts.includes("cursor")) {
     if (registered === "invalid") {
       missing.push(`cursor: canonical workit MCP launcher in ${res.cursorMcp}`);
@@ -67944,9 +68094,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
     const hook = registeredCursorHook(res);
     if (hook === "invalid") {
-      missing.push(`cursor: canonical session-start hook in ${path38.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
+      missing.push(`cursor: canonical session-start hook in ${path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
     } else if (hook !== null && !isCanonicalCursorHook(hook, res) && !validLocalDistHook(hook, res)) {
-      missing.push(`cursor: canonical session-start hook in ${path38.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
+      missing.push(`cursor: canonical session-start hook in ${path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
     }
   }
   if (dev) {
@@ -67982,10 +68132,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       const normal = entry.replaceAll("\\", "/").replace(/\/+$/, "");
       if (!normal.endsWith("local/workit") && !normal.endsWith("local/workflow-toolkit"))
         continue;
-      const dir = entry.startsWith("~") ? path38.join(res.home, entry.slice(1)) : entry;
+      const dir = entry.startsWith("~") ? path39.join(res.home, entry.slice(1)) : entry;
       let state = null;
       try {
-        state = readdirSync8(dir).length === 0 ? "empty" : null;
+        state = readdirSync10(dir).length === 0 ? "empty" : null;
       } catch {
         state = "missing";
       }
@@ -68007,17 +68157,26 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "no registered Workit host plugin is missing its files"
     };
-  return { id: "plugin_files", status: "warn", detail: problems.join("; "), fix: fixes.join("; ") };
+  return {
+    id: "plugin_files",
+    status: "warn",
+    detail: problems.join("; "),
+    fix: fixes.join("; ")
+  };
 }, CURSOR_HOOK_FIX = "Run `workit init` and select Cursor to install the bundled hook", checkCursorHook = (res) => {
   if (!hostsFor(res.host).includes("cursor"))
-    return { id: "cursor_hook", status: "pass", detail: "cursor hook not inspected on this host" };
+    return {
+      id: "cursor_hook",
+      status: "pass",
+      detail: "cursor hook not inspected on this host"
+    };
   if (!existsSync16(res.cursorPluginDir))
     return {
       id: "cursor_hook",
       status: "pass",
       detail: "no Cursor plugin install — hook launcher not inspected"
     };
-  const launcher = path38.join(res.cursorPluginDir, "hooks", "launch.mjs");
+  const launcher = path39.join(res.cursorPluginDir, "hooks", "launch.mjs");
   if (!existsSync16(launcher))
     return {
       id: "cursor_hook",
@@ -68025,7 +68184,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `cursor hook launcher mode: missing — ${launcher} is absent (an install from before the pinned launcher)`,
       fix: CURSOR_HOOK_FIX
     };
-  const hooksFile = path38.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   const registered = readJson(hooksFile);
   const sessionCommand = registered?.hooks?.sessionStart?.[0]?.command;
   const offLauncher = [
@@ -68084,7 +68243,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `${label}; probe ${ms} ms; ${silent}`,
       fix: "Open a Cursor agent chat, then re-run `workit doctor`; if this persists, re-run `workit init` with Cursor (it writes absolute hook paths)"
     };
-  return { id: "cursor_hook", status: "pass", detail: `${label}; probe ${ms} ms` };
+  return {
+    id: "cursor_hook",
+    status: "pass",
+    detail: `${label}; probe ${ms} ms`
+  };
 }, SILENT_HOOK_GRACE_MS, mtimeMs = (file) => {
   try {
     return statSync6(file).mtimeMs;
@@ -68092,10 +68255,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   }
 }, silentCursorHooks = (res) => {
-  const session = mtimeMs(path38.join(res.cursorHeartbeatDir, "cursor-session-last-start"));
+  const session = mtimeMs(path39.join(res.cursorHeartbeatDir, "cursor-session-last-start"));
   if (session === null || Date.now() - session < SILENT_HOOK_GRACE_MS)
     return null;
-  const hook = mtimeMs(path38.join(res.cursorHeartbeatDir, "cursor-hook-last-run"));
+  const hook = mtimeMs(path39.join(res.cursorHeartbeatDir, "cursor-hook-last-run"));
   if (hook !== null && hook >= session)
     return null;
   return `Cursor started the Workit MCP server at ${new Date(session).toISOString()} but no Workit hook has run since${hook === null ? " (none ever)" : ""} — if the agent ran in that window, Cursor is not running the plugin hooks and Workit enforcement is off`;
@@ -68191,7 +68354,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return { id: "stale_pin", status: "pass", detail: "opencode pin resolves" };
 }, pluginMcpSelectors = (res) => {
-  const p = path38.join(res.cursorPluginDir, "mcp.json");
+  const p = path39.join(res.cursorPluginDir, "mcp.json");
   if (!existsSync16(p))
     return null;
   const cfg = readJson(p);
@@ -68225,19 +68388,19 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   }
 }, installedPluginVersion = (res) => {
-  const pkg = readJson(path38.join(res.cursorPluginDir, "package.json"));
+  const pkg = readJson(path39.join(res.cursorPluginDir, "package.json"));
   return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
 }, installedOpenCodeCache = (res) => {
   if (res.opencodePackageCacheDir !== null) {
-    const pkg = readJson(path38.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
+    const pkg = readJson(path39.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
     return typeof pkg?.version === "string" && pkg.version ? { version: pkg.version, dir: res.opencodePackageCacheDir } : null;
   }
   const found = openCodeInstalledPlugin(res.home, res.env);
   if (!found)
     return null;
-  let dir = path38.dirname(path38.dirname(path38.dirname(found.root)));
-  if (path38.basename(dir) !== "workit-opencode@latest")
-    dir = path38.dirname(dir);
+  let dir = path39.dirname(path39.dirname(path39.dirname(found.root)));
+  if (path39.basename(dir) !== "workit-opencode@latest")
+    dir = path39.dirname(dir);
   return { version: found.version, dir };
 }, checkOpenCodePackageCache = (res) => {
   if (!existsSync16(res.opencodeConfig)) {
@@ -68341,7 +68504,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh — it rewrites the workit MCP entry to the canonical @latest selector"
     };
   }
-  const hooksFile = path38.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   const hookCmd = readJson(hooksFile)?.hooks?.sessionStart?.[0]?.command ?? null;
   const canonicalHook = canonicalCursorHook;
   const staleHook = hookCmd !== null && !isCanonicalCursorHook(hookCmd, res) && !hookCmd.startsWith("node ") && hookCmd.includes("@brainervirus/workit-cursor@");
@@ -68363,7 +68526,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     };
   }
   const installed = installedPluginVersion(res);
-  const source = res.dev ? readJson(path38.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path38.join(packageRoot(), "package.json"))?.version ?? null;
+  const source = res.dev ? readJson(path39.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path39.join(packageRoot(), "package.json"))?.version ?? null;
   const localDist = mcpSelectors === null && hookCmd !== null && !isCanonicalCursorHook(hookCmd, res) && hookCmd.startsWith("node ");
   if (localDist && installed !== null && source !== null && !semverAtLeast(installed, source)) {
     return {
@@ -68375,7 +68538,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   if (localDist && installed !== null && source !== null && res.dev) {
     const entry = /^node\s+(.+)$/.exec((hookCmd ?? "").trim())?.[1]?.trim() ?? "";
-    const sourceBundle = entry && path38.isAbsolute(entry) ? path38.join(res.dev, "packages", "workit-cursor", "dist", path38.basename(entry)) : "";
+    const sourceBundle = entry && path39.isAbsolute(entry) ? path39.join(res.dev, "packages", "workit-cursor", "dist", path39.basename(entry)) : "";
     if (entry && sourceBundle) {
       const installedHash = bundleHashOfFile(entry);
       const sourceHash = bundleHashOfFile(sourceBundle);
@@ -68383,7 +68546,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         return {
           id: "stale_install",
           status: "fail",
-          detail: `stale_install: installed workit-cursor ${installed} runs different bytes than the current runtime build (${path38.basename(entry)} hash mismatch)`,
+          detail: `stale_install: installed workit-cursor ${installed} runs different bytes than the current runtime build (${path39.basename(entry)} hash mismatch)`,
           fix: "Re-run install-cursor-plugin.sh — it refreshes the plugin directory with the current build"
         };
       }
@@ -68483,7 +68646,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, checkMalformedConfig = (res) => {
   const files = [];
   for (const name of ["config.json", "youtrack.json", "vcs.json", "workspaces.json"]) {
-    const p = path38.join(res.configDir, name);
+    const p = path39.join(res.configDir, name);
     if (existsSync16(p))
       files.push(p);
   }
@@ -68608,7 +68771,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const slot = `${SESSION_HOOK_NAME} hook`;
   switch (hook.state) {
     case "not_git":
-      return { status: "pass", detail: `not inside a git work tree — skipping the ${slot}` };
+      return {
+        status: "pass",
+        detail: `not inside a git work tree — skipping the ${slot}`
+      };
     case "installed":
       return {
         status: "pass",
@@ -68701,17 +68867,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return { ...installSessionHook(res.cwd, res.env), workspace: workspace.name };
 }, isPlaceholder = (p) => {
   try {
-    return readFileSync16(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
+    return readFileSync17(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
   } catch {
     return false;
   }
 }, checkCredentialMetadata = (res) => {
   const tokenPaths = [];
-  const youtrackJson = readJson(path38.join(res.configDir, "youtrack.json"));
+  const youtrackJson = readJson(path39.join(res.configDir, "youtrack.json"));
   if (youtrackJson) {
-    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path38.join(res.configDir, "youtrack.token"));
-  } else if (existsSync16(path38.join(res.configDir, "youtrack.token"))) {
-    tokenPaths.push(path38.join(res.configDir, "youtrack.token"));
+    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path39.join(res.configDir, "youtrack.token"));
+  } else if (existsSync16(path39.join(res.configDir, "youtrack.token"))) {
+    tokenPaths.push(path39.join(res.configDir, "youtrack.token"));
   }
   if (tokenPaths.length === 0) {
     return {
@@ -68722,7 +68888,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const problems = [];
   for (const raw of tokenPaths) {
-    const p = path38.isAbsolute(raw) ? raw : path38.resolve(res.configDir, raw);
+    const p = path39.isAbsolute(raw) ? raw : path39.resolve(res.configDir, raw);
     if (!existsSync16(p)) {
       problems.push(`${p} is missing`);
       continue;
@@ -68802,7 +68968,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   },
   ghLogin: (e) => {
     try {
-      const out = spawnSync16("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8", env: e });
+      const out = spawnSync16("gh", ["api", "user", "--jq", ".login"], {
+        encoding: "utf8",
+        env: e
+      });
       const login = (out.stdout ?? "").trim();
       return out.status === 0 && login ? login : null;
     } catch {
@@ -68837,8 +69006,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }), checkGithubIdentity = (res, probes = defaultIdentityProbes(res.env)) => {
   const remoteHost = githubHostFromRemote(probes.origin(res.cwd) ?? "");
   if (!remoteHost)
-    return { id: "github_identity", status: "pass", detail: "no GitHub remote configured" };
-  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path38.join(res.configDir, "vcs.json"));
+    return {
+      id: "github_identity",
+      status: "pass",
+      detail: "no GitHub remote configured"
+    };
+  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path39.join(res.configDir, "vcs.json"));
   const workspace = workspaceProviderForIdentity(res.cwd, res.configDir, res.env);
   if (workspace.error)
     return {
@@ -68849,7 +69022,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     };
   const provider = identityProvider(remoteHost, vcsJson, workspace.provider);
   if (provider !== "github")
-    return { id: "github_identity", status: "pass", detail: "no GitHub remote configured" };
+    return {
+      id: "github_identity",
+      status: "pass",
+      detail: "no GitHub remote configured"
+    };
   const cliHost = String(vcsJson?.github?.host ?? "github.com").toLowerCase();
   const cliLogin = probes.ghLogin({ ...res.env, GH_HOST: cliHost });
   if (!cliLogin)
@@ -68865,8 +69042,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, checkGitLabIdentity = (res, probes = defaultIdentityProbes(res.env)) => {
   const remoteHost = githubHostFromRemote(probes.origin(res.cwd) ?? "");
   if (!remoteHost)
-    return { id: "gitlab_identity", status: "pass", detail: "no GitLab remote configured" };
-  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path38.join(res.configDir, "vcs.json"));
+    return {
+      id: "gitlab_identity",
+      status: "pass",
+      detail: "no GitLab remote configured"
+    };
+  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path39.join(res.configDir, "vcs.json"));
   const workspace = workspaceProviderForIdentity(res.cwd, res.configDir, res.env);
   if (workspace.error)
     return {
@@ -68877,7 +69058,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     };
   const provider = identityProvider(remoteHost, vcsJson, workspace.provider);
   if (provider !== "gitlab")
-    return { id: "gitlab_identity", status: "pass", detail: "no GitLab remote configured" };
+    return {
+      id: "gitlab_identity",
+      status: "pass",
+      detail: "no GitLab remote configured"
+    };
   const cliHost = String(vcsJson?.gitlab?.host ?? "gitlab.com").toLowerCase();
   const cliLogin = probes.glabLogin?.({ ...res.env, GITLAB_HOST: cliHost }) ?? null;
   if (!cliLogin)
@@ -68892,11 +69077,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     { surface: "SSH", login: probes.sshLogin(remoteHost) }
   ]);
 }, checkLogWritable = (res) => {
-  const logsDir = path38.join(res.stateDir, "logs");
-  const probe = path38.join(logsDir, "doctor-probe.tmp");
+  const logsDir = path39.join(res.stateDir, "logs");
+  const probe = path39.join(logsDir, "doctor-probe.tmp");
   try {
-    mkdirSync7(logsDir, { recursive: true, mode: 448 });
-    writeFileSync7(probe, `{"probe":true}
+    mkdirSync8(logsDir, { recursive: true, mode: 448 });
+    writeFileSync8(probe, `{"probe":true}
 `, { mode: 384 });
     return {
       id: "log_writable",
@@ -68926,7 +69111,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix
     };
   if (lock.state === "absent")
-    return { id: "workspace_lock", status: "pass", detail: "no metadata lock held" };
+    return {
+      id: "workspace_lock",
+      status: "pass",
+      detail: "no metadata lock held"
+    };
   if (lock.state === "stale")
     return {
       id: "workspace_lock",
@@ -68971,7 +69160,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const counts = { skip: 0, late: 0 };
   let text = "";
   try {
-    text = readFileSync16(path38.join(stateDir, HOOK_SKIPS_FILE), "utf8");
+    text = readFileSync17(path39.join(stateDir, HOOK_SKIPS_FILE), "utf8");
   } catch {
     return counts;
   }
@@ -68989,7 +69178,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return counts;
 }, checkHookDeadline = (res) => {
-  const file = path38.join(res.hookStateDir, HOOK_SKIPS_FILE);
+  const file = path39.join(res.hookStateDir, HOOK_SKIPS_FILE);
   const { skip, late } = countHookSkips(res.hookStateDir, Date.now() - DAY_MS);
   const lateText = late > 0 ? `; ${late} answered past it in full` : "";
   if (skip > 0)
@@ -69020,11 +69209,15 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     status: "warn",
     detail: line.split("; ")[0],
     fix: line.split("; ")[1]
-  } : { id: "grant_endpoint", status: "pass", detail: "grants and default endpoint agree" };
+  } : {
+    id: "grant_endpoint",
+    status: "pass",
+    detail: "grants and default endpoint agree"
+  };
 }, checkChecksConfig = (res) => {
   const root = checkRoot(res.cwd);
-  const current = existsSync16(path38.join(root, CHECKS_FILE));
-  const legacy = existsSync16(path38.join(root, LEGACY_CHECKS_FILE));
+  const current = existsSync16(path39.join(root, CHECKS_FILE));
+  const legacy = existsSync16(path39.join(root, LEGACY_CHECKS_FILE));
   if (!legacy)
     return {
       id: "checks_config",
@@ -69039,8 +69232,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, fixChecksConfig = (options = {}) => {
   const root = checkRoot(resolve(options).cwd);
-  const from = path38.join(root, LEGACY_CHECKS_FILE);
-  const to = path38.join(root, CHECKS_FILE);
+  const from = path39.join(root, LEGACY_CHECKS_FILE);
+  const to = path39.join(root, CHECKS_FILE);
   if (!existsSync16(from))
     return { action: "none", detail: `no ${LEGACY_CHECKS_FILE} at ${root}` };
   if (existsSync16(to))
@@ -69100,7 +69293,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "info",
       detail: "no Workit Claude Code plugin install recorded — skipping"
     };
-  const registry = readJson(path38.join(claudeConfigDir(res.home, res.env), "plugins", "installed_plugins.json"));
+  const registry = readJson(path39.join(claudeConfigDir(res.home, res.env), "plugins", "installed_plugins.json"));
   const recorded = (install) => {
     const entries = registry?.plugins?.[install.id];
     const entry = Array.isArray(entries) ? entries.find((e) => e?.installPath === install.installPath) : null;
@@ -69150,7 +69343,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, HOOK_ISSUED_MARKER = "workit-issued-sessions/3", hookRecordsIssued = (root) => {
   let files;
   try {
-    files = readdirSync8(path38.join(root, "dist")).filter((f) => f.endsWith(".js"));
+    files = readdirSync10(path39.join(root, "dist")).filter((f) => f.endsWith(".js"));
   } catch {
     return null;
   }
@@ -69158,7 +69351,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   return files.some((file) => {
     try {
-      return readFileSync16(path38.join(root, "dist", file), "utf8").includes(HOOK_ISSUED_MARKER);
+      return readFileSync17(path39.join(root, "dist", file), "utf8").includes(HOOK_ISSUED_MARKER);
     } catch {
       return false;
     }
@@ -69214,7 +69407,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     env,
     timeout: WORKIT_PROBE_TIMEOUT_MS,
     shell: true
-  }) : spawnSync16(bin, ["--version"], { encoding: "utf8", env, timeout: WORKIT_PROBE_TIMEOUT_MS });
+  }) : spawnSync16(bin, ["--version"], {
+    encoding: "utf8",
+    env,
+    timeout: WORKIT_PROBE_TIMEOUT_MS
+  });
   const timedOut = r.error !== undefined && "code" in r.error && r.error.code === "ETIMEDOUT";
   const version = r.status === 0 ? (r.stdout ?? "").match(SEMVER)?.[0] ?? null : null;
   const probe = { version: timedOut ? null : version, timedOut };
@@ -69227,14 +69424,22 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       version: i.version
     })),
     { label: "Cursor plugin", version: installedPluginVersion(res) },
-    { label: "OpenCode plugin", version: installedOpenCodeCache(res)?.version ?? null }
+    {
+      label: "OpenCode plugin",
+      version: installedOpenCodeCache(res)?.version ?? null
+    }
   ].filter((p) => p.version !== null);
   const newest = plugins.reduce((best, p) => best && semverAtLeast(best.version, p.version) ? best : p, null);
   const target = newest?.version ?? "latest";
   const fix = `npm i -g ${CLI_PACKAGE}@${target} (or run it without a global install: npx -y ${CLI_PACKAGE}@${target} <command>)`;
   const bin = findOnPath(pathextNames("workit", res.env), res.env);
   if (!bin) {
-    return { id: "workit_on_path", status: "warn", detail: "no workit on PATH", fix };
+    return {
+      id: "workit_on_path",
+      status: "warn",
+      detail: "no workit on PATH",
+      fix
+    };
   }
   const { version, timedOut } = workitVersionAt(bin, res.env);
   if (!version) {
@@ -69269,7 +69474,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const file = permissionTarget(host, paths).file;
   switch (health.state) {
     case "no-host":
-      return { id, status: "info", detail: `${host} not found; no permission block needed` };
+      return {
+        id,
+        status: "info",
+        detail: `${host} not found; no permission block needed`
+      };
     case "absent":
       return {
         id,
@@ -69277,10 +69486,79 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         detail: `no Workit permission block in ${file} (optional: \`${fix}\` lets agents run Workit's delivery verbs without a prompt)`
       };
     case "ok":
-      return { id, status: "pass", detail: `Workit's permission block is current in ${file}` };
+      return {
+        id,
+        status: "pass",
+        detail: `Workit's permission block is current in ${file}`
+      };
     default:
       return { id, status: "warn", detail: health.detail, fix };
   }
+}, checkGrantRules = (host, id) => (res) => {
+  const paths = {
+    home: res.home,
+    env: res.codexHome ? { ...res.env, CODEX_HOME: res.codexHome } : res.env,
+    stateDir: res.stateDir,
+    cwd: res.cwd
+  };
+  let entry = null;
+  try {
+    entry = resolveWorkspaceFrom(res.cwd, res.configDir);
+  } catch {}
+  if (!entry)
+    return {
+      id,
+      status: "info",
+      detail: "no Workit workspace here; no grants to cover"
+    };
+  const { grants } = configuredGrants(entry);
+  const granted = ["push", "pr", "merge"].filter((kind) => kind === "merge" ? Boolean(grants.merge) : grants[kind] !== false);
+  const coverage = permissionCoverage(host, grantedCommands(granted), paths);
+  if (coverage.state === "no-host")
+    return {
+      id,
+      status: "info",
+      detail: `${host} not found; no rules to check`
+    };
+  if (coverage.state === "ok")
+    return {
+      id,
+      status: "pass",
+      detail: `${host} rules cover the granted Workit verbs (${granted.join(", ") || "none"}) and the check and lock verbs`
+    };
+  const shown = coverage.missing.slice(0, 4).join(", ");
+  return {
+    id,
+    status: "warn",
+    detail: `${host} rules in ${coverage.file} do not cover ${shown}${coverage.missing.length > 4 ? ", …" : ""}${existsSync16(coverage.file) ? "" : ` (${coverage.file} does not exist yet; \`workit setup\` writes it)`}: agents get a prompt (or an auto-mode denial) on verbs the workspace grants`,
+    fix: `workit setup --hosts=${host}`
+  };
+}, ago = (ms) => {
+  const minutes = Math.max(0, Math.round(ms / 60000));
+  if (minutes < 1)
+    return "just now";
+  if (minutes < 60)
+    return `${minutes} min ago`;
+  const hours = Math.round(minutes / 60);
+  return hours < 48 ? `${hours} h ago` : `${Math.round(hours / 24)} d ago`;
+}, checkHookRuns = (res) => {
+  const runs = readHookRuns(res.hookStateDir).filter((run) => run.event === "PreToolUse" || run.event === "SessionStart");
+  if (runs.length === 0)
+    return {
+      id: "hook_runs",
+      status: "info",
+      detail: "no host hook run recorded yet (counted from this Workit version on; Claude Code launcher fast-path answers and Codex PostToolUse are not counted; start an agent session, then re-run `workit doctor`)"
+    };
+  const now = Date.now();
+  const hosts = [...new Set(runs.map((run) => run.host))].toSorted();
+  const parts = hosts.map((host) => {
+    const seen = ["SessionStart", "PreToolUse"].map((event) => {
+      const run = runs.find((r) => r.host === host && r.event === event);
+      return `${event} ${run ? `${ago(now - Date.parse(run.at))} (${run.count})` : "never"}`;
+    });
+    return `${host}: ${seen.join(", ")}`;
+  });
+  return { id: "hook_runs", status: "pass", detail: parts.join("; ") };
 }, RUN_CHECKS, INSTALLER_REQUIRED, runDoctor = (options = {}) => {
   const res = resolve(options);
   const raw = RUN_CHECKS.map((fn) => fn(res));
@@ -69332,6 +69610,7 @@ var init_doctor = __esm(() => {
   init_host_install();
   init_skill_manifests();
   init_session_hook();
+  init_hook_runs();
   init_host_permissions();
   OPENCODE_V1_FIX = `OpenCode < ${SUPPORT_MATRIX.opencode.minimum} cannot load Workit 3 (V2 plugin API only): upgrade OpenCode to ${SUPPORT_MATRIX.opencode.minimum}+, or stay on Workit 2.x by pinning "@brainervirus/workit-opencode@2" in the opencode.json "plugin" array`;
   AGENT_MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
@@ -69371,10 +69650,14 @@ var init_doctor = __esm(() => {
     checkHeavyScope,
     checkHookDeadline,
     checkGrantEndpoint,
+    checkHookRuns,
     checkChecksConfig,
     checkHostPermissions("claude-code", "claude_permissions"),
     checkHostPermissions("codex", "codex_permissions"),
-    checkHostPermissions("cursor", "cursor_permissions")
+    checkHostPermissions("cursor", "cursor_permissions"),
+    checkGrantRules("claude-code", "claude_grant_rules"),
+    checkGrantRules("codex", "codex_grant_rules"),
+    checkGrantRules("cursor", "cursor_grant_rules")
   ];
   INSTALLER_REQUIRED = new Set([
     "runtime",
@@ -69394,19 +69677,19 @@ import {
   cpSync as cpSync4,
   existsSync as existsSync17,
   lstatSync as lstatSync6,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync17,
-  readdirSync as readdirSync9,
+  readFileSync as readFileSync18,
+  readdirSync as readdirSync11,
   realpathSync as realpathSync8,
   renameSync as renameSync5,
   rmSync as rmSync5,
   statSync as statSync7,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync9
 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import os13 from "node:os";
-import path39 from "node:path";
+import path40 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
 function parseList(raw) {
   return raw.split(",").map((s) => s.trim()).filter(Boolean);
@@ -69451,7 +69734,7 @@ function buildSetupPreview(values, opts = {}) {
     const current = readConfigFromDir(state.configDir);
     mutations.push({
       type: "merge-json",
-      path: path39.join(state.configDir, "config.json"),
+      path: path40.join(state.configDir, "config.json"),
       value: {
         locale: values.locale,
         localeOptions: current.localeOptions,
@@ -69477,17 +69760,17 @@ function buildSetupPreview(values, opts = {}) {
       if (blocked.length === 0) {
         mutations.push({
           type: "update-workspaces",
-          path: path39.join(state.configDir, "workspaces.json"),
+          path: path40.join(state.configDir, "workspaces.json"),
           entries: values.workspaces,
           expectedRevision: diskWorkspaceResult.revision
         });
       }
     }
     if (values.baseUrl.trim()) {
-      const ytPath = path39.join(state.configDir, "youtrack.json");
+      const ytPath = path40.join(state.configDir, "youtrack.json");
       const ytExisting = readConfigRecord(ytPath);
       const ytConfigured = configuredTokenPath(ytExisting, "tokenFile");
-      const tokenPath = resolveTokenPath(ytConfigured, path39.join(state.configDir, "youtrack.token"), values.tokenPaths?.youtrack);
+      const tokenPath = resolveTokenPath(ytConfigured, path40.join(state.configDir, "youtrack.token"), values.tokenPaths?.youtrack);
       const draft = youtrackDraft(values, tokenPath);
       if (ytConfigured !== null && tokenPath !== ytConfigured) {
         delete draft.tokenFile;
@@ -69515,7 +69798,7 @@ function buildSetupPreview(values, opts = {}) {
         });
     }
     if (values.vcsProvider !== "skip") {
-      const vcsPath = path39.join(state.configDir, "vcs.json");
+      const vcsPath = path40.join(state.configDir, "vcs.json");
       mutations.push({
         type: "merge-json",
         path: vcsPath,
@@ -69544,7 +69827,7 @@ function buildSetupPreview(values, opts = {}) {
             mutations.push({
               type: "install-host",
               platform: "cursor",
-              path: path39.join(paths.home, ".cursor", "plugins", "local", ".workit-package-bootstrap"),
+              path: path40.join(paths.home, ".cursor", "plugins", "local", ".workit-package-bootstrap"),
               commands
             });
           }
@@ -69557,7 +69840,7 @@ function buildSetupPreview(values, opts = {}) {
             mutations.push({
               type: "install-host",
               platform,
-              path: platform === "claude-code" ? claudeInstallRecord(paths.home, env) : platform === "codex" ? path39.join(env.CODEX_HOME ?? path39.join(paths.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : path39.join(env.PI_CODING_AGENT_DIR ?? path39.join(paths.home, ".pi", "agent"), "settings.json"),
+              path: platform === "claude-code" ? claudeInstallRecord(paths.home, env) : platform === "codex" ? path40.join(env.CODEX_HOME ?? path40.join(paths.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : path40.join(env.PI_CODING_AGENT_DIR ?? path40.join(paths.home, ".pi", "agent"), "settings.json"),
               commands
             });
           }
@@ -69569,8 +69852,8 @@ function buildSetupPreview(values, opts = {}) {
       projectRefused = target.refused;
     if (target?.ok) {
       const root = target.root;
-      const gitignorePath = path39.join(root, ".gitignore");
-      const existing = existsSync17(gitignorePath) ? readFileSync17(gitignorePath, "utf8") : "";
+      const gitignorePath = path40.join(root, ".gitignore");
+      const existing = existsSync17(gitignorePath) ? readFileSync18(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
       const entries = GITIGNORE_ENTRIES.filter((e) => e.trim() !== "" && !existingLines.has(e.trim()));
@@ -69607,10 +69890,10 @@ function deepMerge(base, patch) {
   return out;
 }
 function applyMutation(m) {
-  const dir = path39.dirname(m.path);
+  const dir = path40.dirname(m.path);
   switch (m.type) {
     case "create-file": {
-      mkdirSync8(dir, { recursive: true });
+      mkdirSync9(dir, { recursive: true });
       const res = writeFileExclusive(m.path, m.content, m.mode);
       return res === "created" ? { platform: "core", file: m.path, status: "Installed" } : {
         platform: "core",
@@ -69633,8 +69916,8 @@ function applyMutation(m) {
       if (existing.kind === "record" && JSON.stringify(existing.value) === JSON.stringify(merged)) {
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
       }
-      mkdirSync8(dir, { recursive: true });
-      writeFileSync8(m.path, JSON.stringify(merged, null, 2) + `
+      mkdirSync9(dir, { recursive: true });
+      writeFileSync9(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -69675,10 +69958,10 @@ function applyMutation(m) {
 `;
       if (prev === next)
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
-      mkdirSync8(dir, { recursive: true });
+      mkdirSync9(dir, { recursive: true });
       const tmp = `${m.path}.${process.pid}.tmp`;
       try {
-        writeFileSync8(tmp, next, "utf8");
+        writeFileSync9(tmp, next, "utf8");
         if (workspacesRevision(readFileSafe(m.path)) !== m.expectedRevision) {
           rmSync5(tmp, { force: true });
           return {
@@ -69713,11 +69996,11 @@ function applyMutation(m) {
           detail: "all entries already present"
         };
       }
-      mkdirSync8(dir, { recursive: true });
+      mkdirSync9(dir, { recursive: true });
       const separator = existing && !existing.endsWith(`
 `) ? `
 ` : "";
-      writeFileSync8(m.path, existing + separator + (existing ? `
+      writeFileSync9(m.path, existing + separator + (existing ? `
 ` : "") + add.join(`
 `) + `
 `, "utf8");
@@ -69756,8 +70039,8 @@ function applyMutation(m) {
           detail: "already configured"
         };
       }
-      mkdirSync8(path39.dirname(m.path), { recursive: true });
-      writeFileSync8(m.path, JSON.stringify(merged, null, 2) + `
+      mkdirSync9(path40.dirname(m.path), { recursive: true });
+      writeFileSync9(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -69765,11 +70048,11 @@ function applyMutation(m) {
 }
 function adapterRoot(platform, res, preferInstalledAdapter = false) {
   const candidates = [];
-  const stagedCursor = path39.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap", "node_modules", "@brainervirus", "workit-cursor");
+  const stagedCursor = path40.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap", "node_modules", "@brainervirus", "workit-cursor");
   if (platform === "cursor" && preferInstalledAdapter)
     candidates.push(stagedCursor);
   if (res.dev) {
-    candidates.push(path39.join(res.dev, "packages", `workit-${platform}`));
+    candidates.push(path40.join(res.dev, "packages", `workit-${platform}`));
   } else {
     candidates.push(...nodeResolvedAdapters(platform));
     if (platform === "cursor")
@@ -69779,10 +70062,10 @@ function adapterRoot(platform, res, preferInstalledAdapter = false) {
       if (cached)
         candidates.push(cached.root);
     }
-    let dir = path39.resolve(res.cwd);
+    let dir = path40.resolve(res.cwd);
     while (true) {
-      candidates.push(path39.join(dir, "packages", `workit-${platform}`));
-      const parent = path39.dirname(dir);
+      candidates.push(path40.join(dir, "packages", `workit-${platform}`));
+      const parent = path40.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -69804,7 +70087,7 @@ function applyOpenCode(root, res) {
       detail: "workit-opencode package has no loadable plugin entry (src/plugin.ts or dist/plugin.js)"
     };
   }
-  mkdirSync8(path39.dirname(res.opencodeConfig), { recursive: true });
+  mkdirSync9(path40.dirname(res.opencodeConfig), { recursive: true });
   const existing = readExisting(res.opencodeConfig);
   if (existing.kind === "malformed") {
     return {
@@ -69833,7 +70116,7 @@ function applyOpenCode(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync8(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
+  writeFileSync9(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
 `, "utf8");
   return existing.kind === "record" ? {
     platform: "opencode",
@@ -69849,31 +70132,31 @@ function applyOpenCode(root, res) {
 }
 function copyPluginDir(src, dest) {
   const realSrc = realpathSync8(src);
-  const marker = path39.join(dest, ".workit-root");
+  const marker = path40.join(dest, ".workit-root");
   const destIsLink = existsSync17(dest) && lstatSync6(dest).isSymbolicLink();
   const synced = !destIsLink && readFileSafe(marker)?.trim() === realSrc && samePluginContent(realSrc, dest, dest);
   if (synced)
     return "Skipped";
   const hadDir = existsSync17(dest);
   const rules = preservedCursorRules(realSrc, dest);
-  const parent = path39.dirname(dest);
-  mkdirSync8(parent, { recursive: true });
-  const swap = mkdtempSync2(path39.join(parent, `.${path39.basename(dest)}.swap-`));
-  const stage = path39.join(swap, "stage");
-  const backup = path39.join(swap, "backup");
+  const parent = path40.dirname(dest);
+  mkdirSync9(parent, { recursive: true });
+  const swap = mkdtempSync2(path40.join(parent, `.${path40.basename(dest)}.swap-`));
+  const stage = path40.join(swap, "stage");
+  const backup = path40.join(swap, "backup");
   try {
     cpSync4(realSrc, stage, {
       recursive: true,
-      filter: (entry) => !path39.relative(realSrc, entry).split(path39.sep).includes("node_modules")
+      filter: (entry) => !path40.relative(realSrc, entry).split(path40.sep).includes("node_modules")
     });
-    const stagedHooks = path39.join(stage, CURSOR_HOOKS_FILE);
+    const stagedHooks = path40.join(stage, CURSOR_HOOKS_FILE);
     if (existsSync17(stagedHooks))
-      writeFileSync8(stagedHooks, localizedCursorHooks(readFileSync17(stagedHooks), dest));
+      writeFileSync9(stagedHooks, localizedCursorHooks(readFileSync18(stagedHooks), dest));
     for (const [name, content] of rules) {
-      mkdirSync8(path39.join(stage, "rules"), { recursive: true });
-      writeFileSync8(path39.join(stage, "rules", name), content);
+      mkdirSync9(path40.join(stage, "rules"), { recursive: true });
+      writeFileSync9(path40.join(stage, "rules", name), content);
     }
-    writeFileSync8(path39.join(stage, ".workit-root"), realSrc + `
+    writeFileSync9(path40.join(stage, ".workit-root"), realSrc + `
 `, "utf8");
     if (!samePluginContent(realSrc, stage, dest))
       throw new Error("staged adapter content is incomplete");
@@ -69896,7 +70179,7 @@ function copyPluginDir(src, dest) {
   return hadDir ? "Configured" : "Installed";
 }
 function applyCursorSettings(root, res) {
-  mkdirSync8(path39.dirname(res.cursorSettings), { recursive: true });
+  mkdirSync9(path40.dirname(res.cursorSettings), { recursive: true });
   const settingsExisting = readExisting(res.cursorSettings);
   if (settingsExisting.kind === "malformed") {
     return {
@@ -69915,7 +70198,7 @@ function applyCursorSettings(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync8(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
+  writeFileSync9(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -69924,7 +70207,7 @@ function applyCursorSettings(root, res) {
   };
 }
 function applyCursorMcp(root, res) {
-  mkdirSync8(path39.dirname(res.cursorMcp), { recursive: true });
+  mkdirSync9(path40.dirname(res.cursorMcp), { recursive: true });
   const mcpExisting = readExisting(res.cursorMcp);
   if (mcpExisting.kind === "malformed") {
     return {
@@ -69954,7 +70237,7 @@ function applyCursorMcp(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync8(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
+  writeFileSync9(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -70030,7 +70313,7 @@ function applySetupPreview(preview, options = {}) {
   let cursorCopyOk = false;
   for (const mutation of preview.mutations) {
     if (mutation.type === "install-host") {
-      const expectedPath = mutation.platform === "cursor" ? path39.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap") : mutation.platform === "codex" ? path39.join(res.env.CODEX_HOME ?? path39.join(res.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : mutation.platform === "pi" ? path39.join(res.env.PI_CODING_AGENT_DIR ?? path39.join(res.home, ".pi", "agent"), "settings.json") : mutation.platform === "claude-code" ? claudeInstallRecord(res.home, res.env) : "";
+      const expectedPath = mutation.platform === "cursor" ? path40.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap") : mutation.platform === "codex" ? path40.join(res.env.CODEX_HOME ?? path40.join(res.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : mutation.platform === "pi" ? path40.join(res.env.PI_CODING_AGENT_DIR ?? path40.join(res.home, ".pi", "agent"), "settings.json") : mutation.platform === "claude-code" ? claudeInstallRecord(res.home, res.env) : "";
       if (mutation.path !== expectedPath) {
         entries.push({
           platform: mutation.platform,
@@ -70142,7 +70425,7 @@ function applySetupPreview(preview, options = {}) {
   if (preview.projectRefused) {
     entries.push({
       platform: "core",
-      file: path39.resolve(res.cwd),
+      file: path40.resolve(res.cwd),
       status: "Skipped",
       detail: preview.projectRefused
     });
@@ -70223,12 +70506,12 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return configured ?? fallback;
 }, readConfigRecord = (file) => {
   try {
-    const value = JSON.parse(readFileSync17(file, "utf8"));
+    const value = JSON.parse(readFileSync18(file, "utf8"));
     return isRecord6(value) ? value : null;
   } catch {
     return null;
   }
-}, claudeInstallRecord = (home, env) => path39.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json"), resolveSetupPaths = (options, resolvedConfigDir) => {
+}, claudeInstallRecord = (home, env) => path40.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json"), resolveSetupPaths = (options, resolvedConfigDir) => {
   const env = options.env ?? process.env;
   const home = options.home ?? env.HOME ?? os13.homedir();
   return {
@@ -70236,15 +70519,15 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     configDir: resolvedConfigDir,
     cwd: options.cwd ?? process.cwd(),
     env,
-    opencodeConfig: options.opencodeConfig ?? path39.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path39.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path39.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path39.join(home, ".cursor", "plugins", "local", "workit")
+    opencodeConfig: options.opencodeConfig ?? path40.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path40.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path40.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path40.join(home, ".cursor", "plugins", "local", "workit")
   };
 }, isRecord6 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readExisting = (p) => {
   let raw;
   try {
-    raw = readFileSync17(p, "utf8");
+    raw = readFileSync18(p, "utf8");
   } catch {
     if (existsSync17(p))
       return { kind: "malformed", error: `${p} is not readable` };
@@ -70261,7 +70544,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return { kind: "malformed", error: `${p} is not a JSON object` };
 }, readFileSafe = (p) => {
   try {
-    return readFileSync17(p, "utf8");
+    return readFileSync18(p, "utf8");
   } catch {
     return null;
   }
@@ -70276,15 +70559,15 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, isAdapter = (root, platform) => {
   try {
-    const pkg = JSON.parse(readFileSync17(path39.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync18(path40.join(root, "package.json"), "utf8"));
     return pkg.name === `@brainervirus/workit-${platform}`;
   } catch {
     return false;
   }
 }, nodeResolvedAdapters = (platform) => {
   const name = `@brainervirus/workit-${platform}`;
-  const require2 = createRequire2(path39.join(packageRoot(), "package.json"));
-  return (require2.resolve.paths(name) ?? []).map((dir) => path39.join(dir, name));
+  const require2 = createRequire2(path40.join(packageRoot(), "package.json"));
+  return (require2.resolve.paths(name) ?? []).map((dir) => path40.join(dir, name));
 }, realRoot = (root) => {
   try {
     return realpathSync8(root);
@@ -70300,7 +70583,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   if (!isDevOpenCodeAdapterRoot(root, opts.dev))
     return OPENCODE_NPM_PIN;
   for (const rel of ["src/plugin.ts", "dist/plugin.js"]) {
-    const entry = path39.join(root, rel);
+    const entry = path40.join(root, rel);
     if (existsSync17(entry))
       return `file://${entry}`;
   }
@@ -70315,25 +70598,25 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, samePluginContent = (src, dest, pluginDir, relative = "") => {
   try {
-    for (const entry of readdirSync9(src, { withFileTypes: true })) {
+    for (const entry of readdirSync11(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
-      const source = path39.join(src, entry.name);
-      const installed = path39.join(dest, entry.name);
-      const rel = path39.join(relative, entry.name);
+      const source = path40.join(src, entry.name);
+      const installed = path40.join(dest, entry.name);
+      const rel = path40.join(relative, entry.name);
       if (entry.isDirectory()) {
         if (!statSync7(installed).isDirectory() || !samePluginContent(source, installed, pluginDir, rel))
           return false;
       } else {
-        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync17(source), pluginDir) : readFileSync17(source);
-        if (!expected.equals(readFileSync17(installed)))
+        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync18(source), pluginDir) : readFileSync18(source);
+        if (!expected.equals(readFileSync18(installed)))
           return false;
       }
     }
-    for (const entry of readdirSync9(dest, { withFileTypes: true })) {
-      if (existsSync17(path39.join(src, entry.name)))
+    for (const entry of readdirSync11(dest, { withFileTypes: true })) {
+      if (existsSync17(path40.join(src, entry.name)))
         continue;
-      const rel = path39.join(relative, entry.name);
+      const rel = path40.join(relative, entry.name);
       if (rel === ".workit-root")
         continue;
       if (relative === "rules" && entry.isFile() && entry.name.endsWith(".mdc"))
@@ -70346,32 +70629,32 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, preservedCursorRules = (src, dest) => {
   const preserved = new Map;
-  const sourceRules = path39.join(src, "rules");
-  const installedRules = path39.join(dest, "rules");
+  const sourceRules = path40.join(src, "rules");
+  const installedRules = path40.join(dest, "rules");
   try {
-    for (const entry of readdirSync9(installedRules, { withFileTypes: true })) {
+    for (const entry of readdirSync11(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
-      if (existsSync17(path39.join(sourceRules, entry.name)))
+      if (existsSync17(path40.join(sourceRules, entry.name)))
         continue;
-      preserved.set(entry.name, readFileSync17(path39.join(installedRules, entry.name)));
+      preserved.set(entry.name, readFileSync18(path40.join(installedRules, entry.name)));
     }
   } catch {}
   return preserved;
 }, removeLegacyCursorDir = (res) => {
-  const legacy = path39.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
+  const legacy = path40.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
   if (legacy === res.cursorPluginDir || !existsSync17(legacy))
     return;
-  const legacyRules = path39.join(legacy, "rules");
+  const legacyRules = path40.join(legacy, "rules");
   if (existsSync17(legacyRules)) {
     try {
-      mkdirSync8(path39.join(res.cursorPluginDir, "rules"), { recursive: true });
-      for (const entry of readdirSync9(legacyRules, { withFileTypes: true })) {
+      mkdirSync9(path40.join(res.cursorPluginDir, "rules"), { recursive: true });
+      for (const entry of readdirSync11(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
-        const target = path39.join(res.cursorPluginDir, "rules", entry.name);
+        const target = path40.join(res.cursorPluginDir, "rules", entry.name);
         if (!existsSync17(target))
-          copyFileSync5(path39.join(legacyRules, entry.name), target);
+          copyFileSync5(path40.join(legacyRules, entry.name), target);
       }
     } catch {}
   }
@@ -70405,16 +70688,16 @@ var init_setup = __esm(() => {
     { envKey: "WORKFLOW_GITHUB_HOST", affects: "vcs.json github.host" }
   ];
   SETUP_OVERRIDES = [...YT_OVERRIDES, ...VCS_OVERRIDES];
-  CURSOR_HOOKS_FILE = path39.join("hooks", "hooks-cursor.json");
+  CURSOR_HOOKS_FILE = path40.join("hooks", "hooks-cursor.json");
 });
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync18, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "node:fs";
-import path40 from "node:path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync19, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync10 } from "node:fs";
+import path41 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path40.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path41.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const {
     status,
     path: wsPath,
@@ -70426,7 +70709,7 @@ function applyWorkspaceBranchPolicy(opts) {
   if (status === "malformed" || status === "invalid")
     return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path40.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path41.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -70475,10 +70758,10 @@ function applyWorkspaceBranchPolicy(opts) {
       ok: false,
       error: `workspaces.json changed while applying the branch policy: ${wsPath}`
     };
-  mkdirSync9(path40.dirname(wsPath), { recursive: true });
+  mkdirSync10(path41.dirname(wsPath), { recursive: true });
   const tmp = `${wsPath}.${process.pid}.tmp`;
   try {
-    writeFileSync9(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
+    writeFileSync10(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
 `, "utf8");
     if (workspacesRevision(readFileSafe2(wsPath)) !== revision) {
       rmSync6(tmp, { force: true });
@@ -70507,7 +70790,7 @@ function applyWorkspaceBranchPolicy(opts) {
 }
 var readFileSafe2 = (p) => {
   try {
-    return readFileSync18(p, "utf8");
+    return readFileSync19(p, "utf8");
   } catch {
     return null;
   }
@@ -70760,7 +71043,7 @@ var init_logic = __esm(() => {
 
 // packages/workit-cli/src/wizard-state.ts
 import { existsSync as existsSync18, statSync as statSync8 } from "node:fs";
-import path41 from "node:path";
+import path42 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "node:util";
 function resolveBasePath(values, env = process.env) {
   return env.WORKFLOW_WORKSPACE_ROOT?.trim() || values.basePath.trim();
@@ -71287,8 +71570,8 @@ var NEXT, PREV, skipsCustomBranch = (screen, preset) => (screen === "branchAllow
   const p = value.trim();
   if (!p)
     return "workspace root path is required";
-  return !path41.isAbsolute(p) || !isDirectory(p) ? `invalid workspace root "${p}" — enter an existing absolute directory` : null;
-}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync18(path41.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
+  return !path42.isAbsolute(p) || !isDirectory(p) ? `invalid workspace root "${p}" — enter an existing absolute directory` : null;
+}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync18(path42.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
 var init_wizard_state = __esm(() => {
   init_config();
   init_workspaces();
@@ -71347,9 +71630,9 @@ var init_wizard_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/uninstall.ts
-import { existsSync as existsSync19, readFileSync as readFileSync19, realpathSync as realpathSync9, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync20, realpathSync as realpathSync9, rmSync as rmSync7, writeFileSync as writeFileSync11 } from "node:fs";
 import os14 from "node:os";
-import path42 from "node:path";
+import path43 from "node:path";
 function cleanCursorSettings(settings, pluginDir) {
   const next = { ...settings };
   let changed = false;
@@ -71522,7 +71805,7 @@ function planUninstall(paths = {}) {
     plan.actions.push({
       kind: "edit-json-remove",
       path: file,
-      detail: `remove Workit's permission block from ${path42.basename(file)}`
+      detail: `remove Workit's permission block from ${path43.basename(file)}`
     });
   }
   if (existsSync19(res.codexRules))
@@ -71556,8 +71839,8 @@ function applyUninstall(plan, paths = {}) {
         status = outcome.status;
         detail = outcome.detail;
       } else if (action.kind === "remove-dir") {
-        const resolved = path42.resolve(action.path);
-        const allowed = canonicalRemoveDirAllowed(resolved, res) || resolved === path42.resolve(res.codexPluginDir) && path42.basename(resolved) === "workit" && path42.basename(path42.dirname(resolved)) === "plugins";
+        const resolved = path43.resolve(action.path);
+        const allowed = canonicalRemoveDirAllowed(resolved, res) || resolved === path43.resolve(res.codexPluginDir) && path43.basename(resolved) === "workit" && path43.basename(path43.dirname(resolved)) === "plugins";
         if (!allowed) {
           status = "failed";
           detail = `refusing to remove non-canonical plugin directory: ${resolved}`;
@@ -71599,17 +71882,17 @@ var resolveUninstallPaths = (options = {}) => {
     claudeSettings: permissionTarget("claude-code", permissionPaths).file,
     cursorCliConfig: permissionTarget("cursor", permissionPaths).file,
     codexRules: permissionTarget("codex", permissionPaths).file,
-    opencodeConfig: options.opencodeConfig ?? path42.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path42.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path42.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path42.join(home, ".cursor", "plugins", "local", "workit"),
-    codexPluginDir: path42.join(home, ".codex", "plugins", "workit"),
-    piConfig: path42.join(home, ".pi", "config.json")
+    opencodeConfig: options.opencodeConfig ?? path43.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path43.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path43.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path43.join(home, ".cursor", "plugins", "local", "workit"),
+    codexPluginDir: path43.join(home, ".codex", "plugins", "workit"),
+    piConfig: path43.join(home, ".pi", "config.json")
   };
 }, isRecord7 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readJsonRecord = (file) => {
   let raw;
   try {
-    raw = readFileSync19(file, "utf8");
+    raw = readFileSync20(file, "utf8");
   } catch {
     if (existsSync19(file))
       return { kind: "malformed", error: `${file} is not readable` };
@@ -71622,8 +71905,8 @@ var resolveUninstallPaths = (options = {}) => {
     return { kind: "malformed", error: `${file} is not valid JSON` };
   }
 }, stripTrailingSep = (p) => {
-  const j = path42.join(p);
-  return path42.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
+  const j = path43.join(p);
+  return path43.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
 }, CURSOR_LEGACY_IDENTITIES, permissionPathsOf = (paths) => {
   const env = paths.env ?? process.env;
   return {
@@ -71650,8 +71933,8 @@ var resolveUninstallPaths = (options = {}) => {
     return cleanPiConfig;
   return null;
 }, canonicalRemoveDirAllowed = (actionPath, res) => {
-  const expected = path42.resolve(res.cursorPluginDir);
-  if (!(actionPath === expected && path42.basename(expected) === "workit" && path42.basename(path42.dirname(expected)) === "local" && path42.basename(path42.dirname(path42.dirname(expected))) === "plugins")) {
+  const expected = path43.resolve(res.cursorPluginDir);
+  if (!(actionPath === expected && path43.basename(expected) === "workit" && path43.basename(path43.dirname(expected)) === "local" && path43.basename(path43.dirname(path43.dirname(expected))) === "plugins")) {
     return false;
   }
   try {
@@ -71674,7 +71957,7 @@ var resolveUninstallPaths = (options = {}) => {
 `;
   let current;
   try {
-    current = readFileSync19(target, "utf8");
+    current = readFileSync20(target, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -71685,7 +71968,7 @@ var resolveUninstallPaths = (options = {}) => {
     return { status: "skipped", detail: "already clean" };
   }
   try {
-    writeFileSync10(target, serialized, "utf8");
+    writeFileSync11(target, serialized, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -71703,7 +71986,7 @@ var resolveUninstallPaths = (options = {}) => {
     };
   const home = paths.home ?? paths.env?.HOME ?? os14.homedir();
   const env = paths.env ?? process.env;
-  const recorded = claudeWorkitInstalls(home, env, action.cwd).some((install) => install.id === id && install.scope === scope && (install.projectPath === null ? action.cwd === null : path42.resolve(install.projectPath) === path42.resolve(action.cwd ?? "")));
+  const recorded = claudeWorkitInstalls(home, env, action.cwd).some((install) => install.id === id && install.scope === scope && (install.projectPath === null ? action.cwd === null : path43.resolve(install.projectPath) === path43.resolve(action.cwd ?? "")));
   if (!recorded)
     return { status: "skipped", detail: `${id} (${scope} scope) is no longer installed` };
   const executable = findHostExecutable("claude", { home, env });
@@ -74465,14 +74748,14 @@ import {
   existsSync as existsSync20,
   mkdtempSync as mkdtempSync3,
   rmSync as rmSync8,
-  readFileSync as readFileSync20,
-  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync21,
+  mkdirSync as mkdirSync11,
   copyFileSync as copyFileSync6,
   chmodSync as chmodSync2,
   cpSync as cpSync5,
   lstatSync as lstatSync7
 } from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 import os16 from "node:os";
 import { createHash as createHash15 } from "node:crypto";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
@@ -74496,9 +74779,9 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
   for (const file of [
     paths.opencodeConfig,
     paths.opencodeConfig + "c",
-    path43.join(home, ".cursor/settings.json"),
-    path43.join(home, ".cursor/mcp.json"),
-    path43.join(home, ".cursor/plugins/local/workit/package.json"),
+    path44.join(home, ".cursor/settings.json"),
+    path44.join(home, ".cursor/mcp.json"),
+    path44.join(home, ".cursor/plugins/local/workit/package.json"),
     paths.codexConfig,
     paths.piSettings
   ])
@@ -74513,16 +74796,16 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
       });
     const installedSources = sources(paths, run, hosts);
     if (installedSources.some((source) => source.host === "opencode")) {
-      const scratch = mkdtempSync3(path43.join(os16.tmpdir(), "workit-upgrade-opencode-"));
+      const scratch = mkdtempSync3(path44.join(os16.tmpdir(), "workit-upgrade-opencode-"));
       let probe;
       try {
         probe = runner({
           ...deps,
           env: {
             ...deps.env,
-            XDG_DATA_HOME: path43.join(scratch, "data"),
-            XDG_STATE_HOME: path43.join(scratch, "state"),
-            XDG_CACHE_HOME: path43.join(scratch, "cache")
+            XDG_DATA_HOME: path44.join(scratch, "data"),
+            XDG_STATE_HOME: path44.join(scratch, "state"),
+            XDG_CACHE_HOME: path44.join(scratch, "cache")
           }
         })("opencode", ["--version"]);
       } finally {
@@ -74568,7 +74851,7 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
         env: deps.env,
         cwd: home,
         packageVersion: latest.stdout.trim(),
-        targetDir: path43.join(home, ".cursor/plugins/local/workit")
+        targetDir: path44.join(home, ".cursor/plugins/local/workit")
       });
       plan.entries.push({
         host: source.host,
@@ -74598,11 +74881,11 @@ function applyUpgrade(plan, deps = {}) {
       ok: false,
       error: "Stop the selected running hosts before upgrading their loaded plugins"
     };
-  const backup = path43.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
-  mkdirSync10(backup, { recursive: true, mode: 448 });
+  const backup = path44.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
+  mkdirSync11(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
     if (existsSync20(file)) {
-      const target = path43.join(backup, createHash15("sha256").update(file).digest("hex").slice(0, 12) + "-" + path43.basename(file));
+      const target = path44.join(backup, createHash15("sha256").update(file).digest("hex").slice(0, 12) + "-" + path44.basename(file));
       copyFileSync6(file, target);
       chmodSync2(target, 384);
     }
@@ -74619,9 +74902,9 @@ function applyUpgrade(plan, deps = {}) {
 `, 384);
   }
   const run = runner(deps);
-  const cursorRoot = path43.join(home, ".cursor/plugins/local/workit");
+  const cursorRoot = path44.join(home, ".cursor/plugins/local/workit");
   if (plan.entries.some((entry) => entry.host === "cursor") && existsSync20(cursorRoot))
-    cpSync5(cursorRoot, path43.join(backup, "cursor-package"), { recursive: true });
+    cpSync5(cursorRoot, path44.join(backup, "cursor-package"), { recursive: true });
   for (const entry of plan.entries) {
     if (entry.host === "opencode")
       return {
@@ -74641,7 +74924,7 @@ function applyUpgrade(plan, deps = {}) {
           {
             type: "install-host",
             platform: "cursor",
-            path: path43.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
+            path: path44.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
             commands: entry.commands.map((command) => ({
               ...command,
               purpose: command.purpose ?? "Upgrade Cursor"
@@ -74650,7 +74933,7 @@ function applyUpgrade(plan, deps = {}) {
           {
             type: "install-adapter",
             platform: "cursor",
-            path: path43.join(home, ".cursor/plugins/local/workit")
+            path: path44.join(home, ".cursor/plugins/local/workit")
           }
         ]
       };
@@ -74664,7 +74947,7 @@ function applyUpgrade(plan, deps = {}) {
           return { exitCode: outcome.status ?? 1, stdout: outcome.stdout, stderr: "" };
         }
       });
-      const pkg = object2(path43.join(home, ".cursor/plugins/local/workit/package.json"));
+      const pkg = object2(path44.join(home, ".cursor/plugins/local/workit/package.json"));
       if (!result.ok || pkg?.version !== entry.latest)
         return {
           ok: false,
@@ -74698,15 +74981,15 @@ function applyUpgrade(plan, deps = {}) {
     const currentRoot = run("npm", ["root", "--global"]);
     if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== plan.cli.root)
       return { ok: false, backup, error: "Global npm location changed; preview again" };
-    const cliBackup = path43.join(backup, "cli-package");
-    cpSync5(path43.join(plan.cli.root, "@brainervirus/workit-cli"), cliBackup, { recursive: true });
+    const cliBackup = path44.join(backup, "cli-package");
+    cpSync5(path44.join(plan.cli.root, "@brainervirus/workit-cli"), cliBackup, { recursive: true });
     if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${plan.cli.latest}`]).status !== 0)
       return {
         ok: false,
         backup,
-        error: `CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path43.join(cliBackup, "dist/index.js")}`
+        error: `CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path44.join(cliBackup, "dist/index.js")}`
       };
-    const installed = object2(path43.join(plan.cli.root, "@brainervirus/workit-cli/package.json"));
+    const installed = object2(path44.join(plan.cli.root, "@brainervirus/workit-cli/package.json"));
     if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== plan.cli.latest)
       return {
         ok: false,
@@ -74731,12 +75014,12 @@ async function runUpgradeCommand(argv, deps = {}) {
   if (flags.has("--cli")) {
     const run = runner(deps);
     const root = run("npm", ["root", "--global"]);
-    if (root.status !== 0 || !path43.isAbsolute(root.stdout.trim())) {
+    if (root.status !== 0 || !path44.isAbsolute(root.stdout.trim())) {
       plan.blocked.push("Global npm location could not be verified");
     } else {
-      const packageFile = path43.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
+      const packageFile = path44.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
       const pkg = object2(packageFile);
-      if (pkg?.name !== "@brainervirus/workit-cli" || lstatSync7(path43.dirname(packageFile)).isSymbolicLink()) {
+      if (pkg?.name !== "@brainervirus/workit-cli" || lstatSync7(path44.dirname(packageFile)).isSymbolicLink()) {
         plan.skipped.push({
           host: "cli",
           reason: "No managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
@@ -74859,37 +75142,37 @@ var HOSTS2, upgradePaths = (deps) => {
     ...process.env,
     ...deps.home || deps.env?.HOME ? {
       HOME: home,
-      CODEX_HOME: path43.join(home, ".codex"),
-      PI_CODING_AGENT_DIR: path43.join(home, ".pi/agent"),
-      XDG_CONFIG_HOME: path43.join(home, ".config"),
+      CODEX_HOME: path44.join(home, ".codex"),
+      PI_CODING_AGENT_DIR: path44.join(home, ".pi/agent"),
+      XDG_CONFIG_HOME: path44.join(home, ".config"),
       WORKFLOW_TOOLKIT_CONFIG: undefined,
       WORKFLOW_TOOLKIT_CONFIG_DIR: undefined
     } : {},
     ...deps.env,
     HOME: home
   };
-  const xdg = env.XDG_CONFIG_HOME || path43.join(home, ".config");
+  const xdg = env.XDG_CONFIG_HOME || path44.join(home, ".config");
   return {
     home,
     env,
-    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path43.join(xdg, "workit"),
-    opencodeConfig: path43.join(xdg, "opencode/opencode.json"),
-    piSettings: path43.join(env.PI_CODING_AGENT_DIR ?? path43.join(home, ".pi/agent"), "settings.json"),
-    codexConfig: path43.join(env.CODEX_HOME ?? path43.join(home, ".codex"), "config.toml")
+    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path44.join(xdg, "workit"),
+    opencodeConfig: path44.join(xdg, "opencode/opencode.json"),
+    piSettings: path44.join(env.PI_CODING_AGENT_DIR ?? path44.join(home, ".pi/agent"), "settings.json"),
+    codexConfig: path44.join(env.CODEX_HOME ?? path44.join(home, ".codex"), "config.toml")
   };
 }, object2 = (file) => {
   if (!existsSync20(file))
     return null;
   let data;
   try {
-    data = JSON.parse(readFileSync20(file, "utf8"));
+    data = JSON.parse(readFileSync21(file, "utf8"));
   } catch {
     throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
   }
   if (!data || typeof data !== "object" || Array.isArray(data))
     throw new Error(`${file} is not a configuration object`);
   return data;
-}, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync20(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+}, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync21(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
   try {
@@ -74915,9 +75198,9 @@ var HOSTS2, upgradePaths = (deps) => {
   for (const pin of plugins)
     if (typeof pin === "string" && isWorkitPlugin(pin))
       result.push(classify("opencode", pin));
-  const cursor = hosts.includes("cursor") ? object2(path43.join(home, ".cursor/plugins/local/workit/package.json")) : null;
+  const cursor = hosts.includes("cursor") ? object2(path44.join(home, ".cursor/plugins/local/workit/package.json")) : null;
   if (cursor?.name === "@brainervirus/workit-cursor") {
-    const mcp = object2(path43.join(home, ".cursor/mcp.json"));
+    const mcp = object2(path44.join(home, ".cursor/mcp.json"));
     const args = mcp?.mcpServers?.workit?.args ?? [];
     const selector = args.find((arg) => typeof arg === "string" && arg.startsWith("--package="));
     result.push(classify("cursor", typeof selector === "string" ? selector.slice(10) : "local"));
@@ -74930,7 +75213,7 @@ var HOSTS2, upgradePaths = (deps) => {
     if (typeof source !== "string")
       continue;
     const npm = /^(?:npm:)?@brainervirus\/workit-pi(?:@[^/]+)?$/.test(source);
-    const local = path43.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path43.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
+    const local = path44.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path44.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
     if (npm || local)
       result.push(classify("pi", source));
   }
@@ -74977,9 +75260,9 @@ var HOSTS2, upgradePaths = (deps) => {
 }, piInstalledVersion = (listing, selector) => {
   const lines = listing.split(/\r?\n/).map((line) => line.trim());
   const index = lines.indexOf(selector);
-  if (index < 0 || !lines[index + 1] || !path43.isAbsolute(lines[index + 1]))
+  if (index < 0 || !lines[index + 1] || !path44.isAbsolute(lines[index + 1]))
     return;
-  const pkg = object2(path43.join(lines[index + 1], "package.json"));
+  const pkg = object2(path44.join(lines[index + 1], "package.json"));
   return pkg?.name === "@brainervirus/workit-pi" ? pkg.version : undefined;
 }, versionAtLeast = (installed, latest) => {
   if (!/^\d+\.\d+\.\d+$/.test(installed))
@@ -75033,7 +75316,7 @@ var init_launch = __esm(() => {
 // packages/workit-core/src/knowledge.ts
 import { spawnSync as spawnSync18 } from "node:child_process";
 import fs20 from "node:fs";
-import path44 from "node:path";
+import path45 from "node:path";
 function lintKnowledge(root) {
   const seen = new Set;
   const unreadable = [];
@@ -75137,7 +75420,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   const end = lines.indexOf("---", 1);
   return end === -1 ? lines : [...lines.slice(0, end + 1).map(() => ""), ...lines.slice(end + 1)];
 }, read = (root, file) => {
-  const full = path44.join(root, file);
+  const full = path45.join(root, file);
   try {
     fs20.lstatSync(full);
   } catch {
@@ -75178,7 +75461,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   }
 }, brokenLinks = (root, doc, tracked) => {
   const findings = [];
-  const base = path44.dirname(path44.join(root, doc.file));
+  const base = path45.dirname(path45.join(root, doc.file));
   const missing = (target, line, how) => findings.push({
     rule: "broken-link",
     file: doc.file,
@@ -75197,7 +75480,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
       const local = localTarget(target);
       if (!local)
         continue;
-      const resolved = local.startsWith("/") ? path44.join(root, local) : path44.resolve(base, local);
+      const resolved = local.startsWith("/") ? path45.join(root, local) : path45.resolve(base, local);
       if (!exists2(resolved))
         missing(target, index + 1, "link");
     }
@@ -75207,9 +75490,9 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
         continue;
       const relative = /^\.\.?\//.test(candidate);
       const first = candidate.split("/")[0];
-      if (!relative && !(tracked ? tracked.has(first) : exists2(path44.join(root, first))))
+      if (!relative && !(tracked ? tracked.has(first) : exists2(path45.join(root, first))))
         continue;
-      const resolved = relative ? path44.resolve(base, candidate) : path44.join(root, candidate);
+      const resolved = relative ? path45.resolve(base, candidate) : path45.join(root, candidate);
       if (!exists2(resolved))
         missing(span, index + 1, "pointer");
     }
@@ -75535,7 +75818,7 @@ import { spawn, spawnSync as spawnSync19 } from "node:child_process";
 import { createHash as createHash16 } from "node:crypto";
 import fs21 from "node:fs";
 import os17 from "node:os";
-import path45 from "node:path";
+import path46 from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function tailLines(text, lines = TAIL_LINES) {
   const all = text.replace(/\r\n?/gu, `
@@ -75655,7 +75938,7 @@ function planSpawn(argv, options) {
     return { file: argv[0], args: [], verbatim: false, shell: true };
   if (options.platform !== "win32")
     return { file: argv[0], args: argv.slice(1), verbatim: false, shell: false };
-  const win = path45.win32;
+  const win = path46.win32;
   const isFile = options.isFile ?? ((file) => {
     try {
       return fs21.statSync(file).isFile();
@@ -75817,10 +76100,10 @@ function runCheckCommand(argv, options) {
 function storeLog(storeRoot, log) {
   const digest = logDigest(log);
   const ref = `blobs/logs/${digest.slice("sha256:".length)}.log`;
-  const file = path45.join(storeRoot, ref);
+  const file = path46.join(storeRoot, ref);
   try {
     if (!fs21.existsSync(file)) {
-      fs21.mkdirSync(path45.dirname(file), { recursive: true });
+      fs21.mkdirSync(path46.dirname(file), { recursive: true });
       const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
       fs21.writeFileSync(temp, log, { mode: 384 });
       fs21.renameSync(temp, file);
@@ -75833,7 +76116,7 @@ function storeLog(storeRoot, log) {
 function pruneCheckLogs(storeRoot, options = {}) {
   const limits = { ...LOG_RETENTION, ...options.retention };
   const now = options.now ?? Date.now();
-  const dir = path45.join(storeRoot, "blobs", "logs");
+  const dir = path46.join(storeRoot, "blobs", "logs");
   const report = { removed: 0, removedBytes: 0, kept: 0 };
   let names;
   try {
@@ -75843,7 +76126,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   const files = names.flatMap((name) => {
     try {
-      const stat = fs21.statSync(path45.join(dir, name));
+      const stat = fs21.statSync(path46.join(dir, name));
       return stat.isFile() ? [{ name, size: stat.size, mtimeMs: stat.mtimeMs }] : [];
     } catch {
       return [];
@@ -75862,7 +76145,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
       continue;
     if (!options.dryRun)
       try {
-        fs21.rmSync(path45.join(dir, file.name), { force: true });
+        fs21.rmSync(path46.join(dir, file.name), { force: true });
       } catch {
         continue;
       }
@@ -76413,12 +76696,12 @@ var init_workspace = __esm(() => {
 
 // packages/workit-core/src/core/heavy-rules.ts
 import fs22 from "node:fs";
-import path46 from "node:path";
+import path47 from "node:path";
 function gitTop(cwd) {
-  for (let dir = path46.resolve(cwd);; dir = path46.dirname(dir)) {
-    if (fs22.existsSync(path46.join(dir, ".git")))
+  for (let dir = path47.resolve(cwd);; dir = path47.dirname(dir)) {
+    if (fs22.existsSync(path47.join(dir, ".git")))
       return dir;
-    if (path46.dirname(dir) === dir)
+    if (path47.dirname(dir) === dir)
       return null;
   }
 }
@@ -76460,18 +76743,18 @@ var init_heavy_rules = () => {};
 // packages/workit-core/src/core/heavy.ts
 import fs23 from "node:fs";
 import os18 from "node:os";
-import path47 from "node:path";
+import path48 from "node:path";
 function stateDir2(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path47.join(env.XDG_STATE_HOME, "workit");
+    return path48.join(env.XDG_STATE_HOME, "workit");
   const home = env.HOME || os18.homedir();
   if (platform === "darwin")
-    return path47.join(home, "Library", "Application Support", "workit");
+    return path48.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path47.join(env.LOCALAPPDATA ?? path47.join(home, "AppData", "Local"), "workit");
-  return path47.join(home, ".local", "state", "workit");
+    return path48.join(env.LOCALAPPDATA ?? path48.join(home, "AppData", "Local"), "workit");
+  return path48.join(home, ".local", "state", "workit");
 }
 function positional(words, from, values = PM_VALUES) {
   let index = from;
@@ -76608,10 +76891,10 @@ function parsePattern(pattern) {
 }
 function machinePatterns(env) {
   const value = readJson2(heavyCommandsFile(env));
-  return isRecord8(value) ? stringList(value.patterns) : [];
+  return isRecord8(value) ? stringList2(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path47.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path48.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -76690,13 +76973,13 @@ function leaseRewrite(command) {
     return null;
   return `${prefix}workit check --heavy -- ${rest}`;
 }
-var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path47.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
+var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path48.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
   try {
     return JSON.parse(fs23.readFileSync(file, "utf8"));
   } catch {
     return;
   }
-}, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), stringList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [], linesOf = (command, dialect) => {
+}, isRecord8 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), stringList2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [], linesOf = (command, dialect) => {
   try {
     return commandLines(command, dialect);
   } catch {
@@ -76837,7 +77120,7 @@ var init_heavy = __esm(() => {
 import { randomUUID as randomUUID5 } from "node:crypto";
 import fs24 from "node:fs";
 import os19 from "node:os";
-import path48 from "node:path";
+import path49 from "node:path";
 function memoryValue(value, host) {
   const text = typeof value === "number" ? String(value) : typeof value === "string" ? value : "";
   const percent = PERCENT.exec(text.trim());
@@ -77018,7 +77301,7 @@ function tryOnce(options, record, reclaimed) {
   const text = `${JSON.stringify(record)}
 `;
   for (let slot = 0;slot < options.slots; slot += 1) {
-    const file = path48.join(options.dir, `slot-${slot}.json`);
+    const file = path49.join(options.dir, `slot-${slot}.json`);
     for (let attempt = 0;attempt < 2; attempt += 1) {
       try {
         const fd = fs24.openSync(file, "wx", 384);
@@ -77143,7 +77426,7 @@ function heldLease(dir, id, options = {}) {
   for (const name of names) {
     if (!/^slot-\d+\.json$/u.test(name))
       continue;
-    const lease = parseLease(readText5(path48.join(dir, name)));
+    const lease = parseLease(readText5(path49.join(dir, name)));
     if (lease?.id === id && !staleReason(lease, options.probe) && (options.ancestor ?? isAncestor)(lease.pid))
       return lease;
   }
@@ -77198,10 +77481,10 @@ async function runScoped(run, wrapper, sinks) {
 }
 function firstNotice(env, session, key, now = Date.now()) {
   const id = (session ?? `ppid-${process.ppid}`).replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 120);
-  const dir = path48.join(stateDir2(env), "notices");
+  const dir = path49.join(stateDir2(env), "notices");
   try {
     fs24.mkdirSync(dir, { recursive: true, mode: 448 });
-    fs24.writeFileSync(path48.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
+    fs24.writeFileSync(path49.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
 `, {
       flag: "wx",
       mode: 384
@@ -77211,7 +77494,7 @@ function firstNotice(env, session, key, now = Date.now()) {
   }
   try {
     for (const name of fs24.readdirSync(dir)) {
-      const file = path48.join(dir, name);
+      const file = path49.join(dir, name);
       if (now - fs24.statSync(file).mtimeMs > NOTICE_TTL_MS)
         fs24.rmSync(file, { force: true });
     }
@@ -77221,7 +77504,7 @@ function firstNotice(env, session, key, now = Date.now()) {
 function leaseSlots(dir, slots, probe = {}) {
   const states = [];
   for (let slot = 0;slot < slots; slot += 1) {
-    const lease = parseLease(readText5(path48.join(dir, `slot-${slot}.json`)));
+    const lease = parseLease(readText5(path49.join(dir, `slot-${slot}.json`)));
     states.push({
       slot,
       holder: lease ? holderOf(lease) : null,
@@ -77233,7 +77516,7 @@ function leaseSlots(dir, slots, probe = {}) {
 var DEFAULT_HEAVY_CHECKS, DEFAULT_SLOTS = 1, DEFAULT_WAIT_S = 600, DEFAULT_MEMORY_SHARE = 0.4, DEFAULT_CPU_SHARE = 0.7, MAX_SLOTS = 64, UNREADABLE_TTL_MS = 30000, GUARD_TTL_MS = 30000, hostShape = () => ({
   totalMemBytes: os19.totalmem(),
   cpus: Math.max(1, os19.availableParallelism?.() ?? os19.cpus().length)
-}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path48.join(stateDir2(env), "leases"), readText5 = (file) => {
+}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path49.join(stateDir2(env), "leases"), readText5 = (file) => {
   try {
     return fs24.readFileSync(file, "utf8");
   } catch {
@@ -77288,7 +77571,7 @@ __export(exports_check, {
   workspaceResources: () => workspaceResources
 });
 import os20 from "node:os";
-import path49 from "node:path";
+import path50 from "node:path";
 function parse6(argv) {
   const split = argv.indexOf("--");
   const head = split >= 0 ? argv.slice(0, split) : [...argv];
@@ -77486,7 +77769,7 @@ function hostToolWaitCapMs(env) {
 }
 async function workspaceResources(io) {
   const env = io.env;
-  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path49.join(env.XDG_CONFIG_HOME || path49.join(env.HOME || os20.homedir(), ".config"), "workit");
+  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path50.join(env.XDG_CONFIG_HOME || path50.join(env.HOME || os20.homedir(), ".config"), "workit");
   try {
     await Promise.resolve().then(() => init_workspaces());
     const workspace = resolveWorkspaceFrom(io.cwd, dir, env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
@@ -77605,7 +77888,7 @@ async function run12(argv, io) {
     if (options.shell && command.length !== 1)
       return emit(io, fail2("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
-  const relCwd = posix(path49.relative(top, runCwd));
+  const relCwd = posix(path50.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
   const shadowed = !configured && name !== null ? config.checks.find((item) => item.name === name) : undefined;
   if (shadowed)
@@ -77667,7 +77950,7 @@ async function run12(argv, io) {
   const modifiedWorktree = key.tree !== null && treeAfter !== key.tree;
   const store = storeRoot(io.cwd);
   const blob = store.ok ? storeLog(store.value.root, result.log) : null;
-  const logPath = store.ok && blob ? path49.join(store.value.root, blob.ref) : null;
+  const logPath = store.ok && blob ? path50.join(store.value.root, blob.ref) : null;
   const tail = tailLines(result.log, TAIL_LINES);
   const passed = result.exitCode === 0 && !result.timedOut;
   const bounded = boundedArgv(command);
@@ -77780,7 +78063,7 @@ async function run12(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE5 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path49.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, HOST_TOOL_WAIT_CAP_MS = 1e5;
+var USAGE5 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path50.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, HOST_TOOL_WAIT_CAP_MS = 1e5;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -77806,7 +78089,7 @@ __export(exports_lock, {
   run: () => run13
 });
 import fs25 from "node:fs";
-import path50 from "node:path";
+import path51 from "node:path";
 async function settingsFor(io) {
   const workspace = await workspaceResources(io);
   const config = loadCheckConfig(io.cwd);
@@ -77888,7 +78171,7 @@ function readPatterns(file) {
   return { patterns: [] };
 }
 function writePatterns(file, value) {
-  fs25.mkdirSync(path50.dirname(file), { recursive: true, mode: 448 });
+  fs25.mkdirSync(path51.dirname(file), { recursive: true, mode: 448 });
   const temp = `${file}.${process.pid}.tmp`;
   fs25.writeFileSync(temp, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -77974,9 +78257,9 @@ var exports_models = {};
 __export(exports_models, {
   run: () => run14
 });
-import { existsSync as existsSync22, readdirSync as readdirSync10, readFileSync as readFileSync21, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync12, readFileSync as readFileSync22, statSync as statSync9 } from "node:fs";
 import os21 from "node:os";
-import path51 from "node:path";
+import path52 from "node:path";
 async function run14(argv, io) {
   const [sub, ...args] = argv.filter((arg) => arg !== "--json");
   if (sub !== "show")
@@ -78037,7 +78320,7 @@ var USAGE7 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
   const found = new Set;
   let text = "";
   try {
-    text = readFileSync21(file, "utf8");
+    text = readFileSync22(file, "utf8");
   } catch {
     return found;
   }
@@ -78051,24 +78334,24 @@ var USAGE7 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
       } catch {}
   return found;
 }, matches3 = (ran, configured) => ran.toLowerCase().includes(configured.toLowerCase()), usageReport = (cwd, env, days) => {
-  const projects = path51.join(env.CLAUDE_CONFIG_DIR || path51.join(env.HOME || os21.homedir(), ".claude"), "projects");
+  const projects = path52.join(env.CLAUDE_CONFIG_DIR || path52.join(env.HOME || os21.homedir(), ".claude"), "projects");
   const since = Date.now() - days * 86400000;
   const types = {};
   let agents = 0;
   const dirs = (dir) => {
     try {
-      return readdirSync10(dir).map((name) => path51.join(dir, name));
+      return readdirSync12(dir).map((name) => path52.join(dir, name));
     } catch {
       return [];
     }
   };
   for (const project of dirs(projects))
     for (const session of dirs(project))
-      for (const meta of dirs(path51.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
+      for (const meta of dirs(path52.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
         try {
           if (statSync9(meta).mtimeMs < since)
             continue;
-          const agentType = JSON.parse(readFileSync21(meta, "utf8")).agentType;
+          const agentType = JSON.parse(readFileSync22(meta, "utf8")).agentType;
           const transcript = meta.replace(/\.meta\.json$/, ".jsonl");
           if (typeof agentType !== "string" || !existsSync22(transcript))
             continue;
@@ -78209,8 +78492,8 @@ var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock)
 
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync22 } from "node:fs";
-import path52 from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync23 } from "node:fs";
+import path53 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
     ["rebase-merge", "rebase"],
@@ -78223,18 +78506,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path52.resolve(cwd, line.trim()));
+`).map((line) => path53.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
     if (!marker || !existsSync23(marker))
       continue;
-    if (index === 1 && existsSync23(path52.join(marker, "applying")))
+    if (index === 1 && existsSync23(path53.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync23(path52.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync23(path53.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync22(path52.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync23(path53.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -78562,7 +78845,7 @@ function gitCommit(cwd, input) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync23(path52.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync23(path53.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -79101,12 +79384,12 @@ var init_ops = __esm(() => {
 
 // packages/workit-core/src/verdict-cover.ts
 import fs26 from "node:fs";
-import path53 from "node:path";
+import path54 from "node:path";
 function chainsAbove(cwd, branch) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return [];
-  const dir = path53.join(root.value.root, "stacks");
+  const dir = path54.join(root.value.root, "stacks");
   let names = [];
   try {
     names = fs26.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -79117,7 +79400,7 @@ function chainsAbove(cwd, branch) {
   for (const name of names.toSorted()) {
     let parsed;
     try {
-      parsed = JSON.parse(fs26.readFileSync(path53.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs26.readFileSync(path54.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -79212,10 +79495,10 @@ var init_pr_lane = __esm(() => {
 
 // packages/workit-core/src/forge/reruns.ts
 import fs27 from "node:fs";
-import path54 from "node:path";
+import path55 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path54.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path55.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -79250,7 +79533,7 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs27.mkdirSync(path54.dirname(file), { recursive: true });
+    fs27.mkdirSync(path55.dirname(file), { recursive: true });
     fs27.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
@@ -79263,7 +79546,7 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs27.mkdirSync(path54.dirname(lock), { recursive: true });
+  fs27.mkdirSync(path55.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
@@ -79952,6 +80235,22 @@ function implicitDeleteSkip(cwd, resolved, doc, branch) {
     return `open PR ${children.data.map((n) => `#${n}`).join(", ")} targets ${branch} (a stack)`;
   return null;
 }
+function baseCiState(cwd, resolved, base) {
+  if (!isProtectedTarget(cwd, base))
+    return { ok: true, note: null };
+  const read = resolved.forge.branchChecks(base);
+  if (!read.ok)
+    return { ok: true, note: `base ${base} CI not read (${read.error}); merging anyway` };
+  const { requiredKnown } = read.data;
+  const failing = read.data.checks.filter((check) => check.state === "failing" && (requiredKnown ? check.required === true : check.required !== false && check.conclusion === "failure"));
+  if (failing.length)
+    return { ok: false, failing, sha: read.data.sha, requiredKnown };
+  const pending = read.data.checks.filter((check) => check.state === "pending");
+  return {
+    ok: true,
+    note: pending.length ? `base ${base} CI is still running (${pending.map((check) => check.name).join(", ")}); merging without waiting` : null
+  };
+}
 async function mergePullRequest(cwd, resolved, input, sleep) {
   const grant = requireGrant(cwd, "merge");
   if (!grant.allowed)
@@ -79961,6 +80260,9 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     return failure3("invalid_input", "--unverified needs --reason <why the user asked for it>");
   if (bypass && !grant.allowUnverified)
     return refuse(`unverified_refused: workspace ${grant.workspace ? `"${grant.workspace}"` : "(none)"} grants merge: "verified", which never merges without an accepted independent verdict`, "a non-author session verifies the head (workit-review), then merge without --unverified", { reason: "unverified_refused" });
+  const baseRed = input.baseRedOk ?? null;
+  if (baseRed && !baseRed.reason.trim())
+    return failure3("invalid_input", "--base-red-ok needs --reason <why merging onto a red base is fine>");
   const number = selectPr(cwd, resolved, { pr: input.pr });
   if (!number.ok)
     return number;
@@ -80045,6 +80347,15 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     const lane = gate.verification === "proportional" ? `, ${laneLabel(gate)}` : "";
     return refuse(gate.need === "self" ? `NEEDS_VERDICT: ${label} has no verdict for ${head.slice(0, 12)}${lane}: the author's own --self verdict is enough (${check.accepted.reasons.join(", ")})` : `NEEDS_VERDICT: ${label} has no accepted independent verdict for ${head.slice(0, 12)}${lane} (${check.accepted.reasons.join(", ")})`, gate.need === "self" ? `after an observed passing \`workit check test\`, the author runs: workit ledger verdict tests-verified --self --how "<what you ran>" --branch ${branch} (or a verifier records one)${bypassHint}` : `an independent session verifies the head and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${branch}${bypassHint}`, { reason: "needs_verdict", verdict: summary });
   }
+  const baseCi = baseCiState(cwd, resolved, doc.base);
+  let baseRedOverride = null;
+  if (!baseCi.ok) {
+    const names = baseCi.failing.map((failed) => failed.name).join(", ");
+    const url = baseCi.failing.find((failed) => failed.url)?.url ?? null;
+    if (!baseRed)
+      return refuse(`base_red: ${doc.base} at ${baseCi.sha?.slice(0, 12) ?? "its head"} has failing CI (${names}${baseCi.requiredKnown ? "" : "; the required checks could not be read, so every failed check counts"})${url ? `: ${url}` : ""}; merging ${label} onto it would land on a red base`, `fix ${doc.base} first, or, if the user accepts it: workit pr merge${input.pr ? ` --pr ${doc.number}` : ""} --base-red-ok --reason "<why>"`, { reason: "base_red", blockers: baseCi.failing.map((failed) => failed.name) });
+    baseRedOverride = baseRed;
+  }
   const squashMessage = squashMessageFor(cwd, resolved, input, doc);
   if (squashMessage && !squashMessage.ok)
     return squashMessage;
@@ -80060,6 +80371,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     review: verdict.review,
     lane: verdict.lane,
     ...unverified ? { unverified: unverified.recorded } : {},
+    ...baseRedOverride ? { baseRedOk: baseRedOverride.reason } : {},
     grant: grant.source
   });
   if (!intent.ok)
@@ -80088,6 +80400,7 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
     review: verdict.review,
     lane: verdict.lane,
     ...unverified ? { unverified: unverified.recorded } : {},
+    ...baseRedOverride ? { baseRedOk: baseRedOverride.reason } : {},
     grant: grant.source,
     intent: intentId,
     verified: false
@@ -80144,6 +80457,10 @@ async function mergePullRequest(cwd, resolved, input, sleep) {
       mergeSha: merged.data.mergeSha,
       verdict,
       unverified,
+      baseCi: {
+        note: baseRedOverride ? `base ${doc.base} CI is red; merged anyway (--base-red-ok: ${baseRedOverride.reason})` : baseCi.ok ? baseCi.note : null,
+        override: baseRedOverride
+      },
       grant: { source: grant.source },
       deletedBranch,
       recorded,
@@ -80210,7 +80527,7 @@ var init_pr_ops = __esm(() => {
 import { spawnSync as spawnSync22 } from "node:child_process";
 import { createHash as createHash17, randomBytes as randomBytes4 } from "node:crypto";
 import fs28 from "node:fs";
-import path55 from "node:path";
+import path56 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -80254,7 +80571,7 @@ function gitRestack(cwd, input) {
     if (!scratch)
       return { ok: false, conflict: false, worktree: cwd, error: "no store root" };
     fs28.mkdirSync(scratch, { recursive: true });
-    dir = path55.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    dir = path56.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return { ok: false, conflict: false, worktree: cwd, error: firstLine(added) };
@@ -80295,7 +80612,7 @@ function pruneScratch(cwd) {
   if (!scratch || !fs28.existsSync(scratch))
     return;
   for (const name of fs28.readdirSync(scratch)) {
-    const dir = path55.join(scratch, name);
+    const dir = path56.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -80305,7 +80622,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path55.join(root.value.root, "stacks") };
+  return { ok: true, data: path56.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
   if (!isRecord12(raw) || !Array.isArray(raw.branches))
@@ -80357,7 +80674,7 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path55.join(dir.data, fileFor(name));
+  const file = path56.join(dir.data, fileFor(name));
   let text;
   try {
     text = fs28.readFileSync(file, "utf8");
@@ -80378,7 +80695,7 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path55.join(dir.data, fileFor(stack.name));
+  const file = path56.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
@@ -80406,7 +80723,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs28.readFileSync(path55.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs28.readFileSync(path56.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -80465,7 +80782,7 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes4(8).toString("hex")
   };
-  fs28.writeFileSync(path55.join(lock, OWNER), JSON.stringify(owner));
+  fs28.writeFileSync(path56.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
@@ -80502,7 +80819,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path55.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path56.join(dir.data, `${fileFor(name)}.lock`);
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
@@ -80532,7 +80849,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs28.utimesSync(path55.join(lock, OWNER), now, now);
+      fs28.utimesSync(path56.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -81383,7 +81700,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path55.join(dir.data, "worktrees") : null;
+  return dir.ok ? path56.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash17("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
@@ -81398,12 +81715,12 @@ ${run.stdout}`.split(`
 }, isRecord12 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs28.readFileSync(path55.join(lock, OWNER), "utf8");
+    raw = fs28.readFileSync(path56.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path55.join(lock, OWNER), lock])
+  for (const target of [path56.join(lock, OWNER), lock])
     try {
       age = Date.now() - fs28.statSync(target).mtimeMs;
       break;
@@ -81446,7 +81763,7 @@ var init_stack = __esm(() => {
 import { spawnSync as spawnSync23 } from "node:child_process";
 import { createHash as createHash18 } from "node:crypto";
 import fs29 from "node:fs";
-import path56 from "node:path";
+import path57 from "node:path";
 function expandBraces2(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -81692,7 +82009,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path56.resolve(defaults.root, optional("worktree") ?? path56.join(defaults.worktreeRoot, id)),
+      worktree: path57.resolve(defaults.root, optional("worktree") ?? path57.join(defaults.worktreeRoot, id)),
       tier,
       reason,
       dependsOn: [...new Set(dependsOn ?? [])],
@@ -81821,12 +82138,12 @@ function regeneratedFiles(root, tracked) {
   const found = new Map;
   let scripts;
   try {
-    const manifest = JSON.parse(fs29.readFileSync(path56.join(root, "package.json"), "utf8"));
+    const manifest = JSON.parse(fs29.readFileSync(path57.join(root, "package.json"), "utf8"));
     scripts = manifest.scripts ?? {};
   } catch {
     return found;
   }
-  const runner = fs29.existsSync(path56.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path56.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path56.join(root, "yarn.lock")) ? "yarn run" : "npm run";
+  const runner = fs29.existsSync(path57.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path57.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path57.join(root, "yarn.lock")) ? "yarn run" : "npm run";
   const outputs = tracked.filter((file) => !CODE.test(file));
   for (const [name, command] of Object.entries(scripts)) {
     if (!name.startsWith("write:") || typeof command !== "string")
@@ -81834,7 +82151,7 @@ function regeneratedFiles(root, tracked) {
     for (const file of command.match(/[\w./-]+\.[cm]?[jt]s\b/gu) ?? []) {
       let source;
       try {
-        source = fs29.readFileSync(path56.join(root, file), "utf8");
+        source = fs29.readFileSync(path57.join(root, file), "utf8");
       } catch {
         continue;
       }
@@ -81956,11 +82273,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path56.basename(common) === ".git" ? path56.dirname(common) : path56.resolve(cwd);
+  return common && path57.basename(common) === ".git" ? path57.dirname(common) : path57.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path56.join(path56.dirname(main), `${path56.basename(main)}-wt`);
+  return path57.join(path57.dirname(main), `${path57.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -81980,7 +82297,7 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path56.join(root.value.root, "fanouts") };
+  return { ok: true, data: path57.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord13(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -82048,7 +82365,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path56.join(dir.data, stackFileName(name));
+  const file = path57.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs29.readFileSync(file, "utf8")));
@@ -82073,7 +82390,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs29.readFileSync(path56.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs29.readFileSync(path57.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -82112,7 +82429,7 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path56.join(dir.data, stackFileName(plan.name));
+  const file = path57.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs29.mkdirSync(dir.data, { recursive: true });
@@ -82323,13 +82640,13 @@ var init_fanout = __esm(() => {
 // packages/workit-core/src/forge/exec.ts
 import { spawnSync as spawnSync24 } from "node:child_process";
 import fs30 from "node:fs";
-import path57 from "node:path";
+import path58 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path57.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path58.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path57.join(dir, `${bin}${ext}`);
+      const candidate = path58.join(dir, `${bin}${ext}`);
       try {
         const stat = fs30.statSync(candidate);
         if (stat.isFile())
@@ -82699,6 +83016,30 @@ function createGitHubForge(options) {
       };
       return success2(status);
     },
+    branchChecks(branch) {
+      const contexts = [];
+      let sha = null;
+      let cursor = null;
+      for (let page = 1;page <= maxPages; page += 1) {
+        const data = graphql(BRANCH_CHECKS_QUERY, { owner, name, ref: `refs/heads/${branch}`, contexts: cursor }, `checks on ${branch}`);
+        if (!data.ok)
+          return data;
+        const commit = data.data.repository?.object ?? null;
+        if (!commit)
+          return failure3("not_found", `branch ${branch} was not found`);
+        sha = commit.oid ?? sha;
+        const rollup = commit.statusCheckRollup;
+        if (!rollup)
+          break;
+        contexts.push(...rollup.contexts.nodes);
+        if (!rollup.contexts.pageInfo.hasNextPage)
+          break;
+        cursor = rollup.contexts.pageInfo.endCursor;
+      }
+      const required = requiredContexts(branch);
+      const checks = latestPerName(contexts.map(checkFromContext).filter((check) => check !== null)).map((check) => required ? { ...check, required: required.includes(check.context) } : check);
+      return success2({ sha, checks, requiredKnown: required !== null });
+    },
     jobLogTail(job, lines) {
       const text = apiText(runner, "gh", apiHost, ["api", `repos/${repo}/actions/jobs/${job.jobId}/logs`], `job ${job.jobId} log`, FORGE_TIMEOUTS.log);
       return text.ok ? success2(logTail(text.data, lines)) : text;
@@ -82896,7 +83237,7 @@ function createGitHubForge(options) {
     }
   };
 }
-var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
+var GITHUB_MAX_PAGES = 10, PR_FIELDS = `number url state isDraft isInMergeQueue mergeable mergeStateStatus baseRefName baseRefOid baseRef { target { oid } } headRefName headRefOid reviewDecision`, THREADS = `reviewThreads(first: 100, after: $threads) { pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 1) { nodes { author { login __typename } body url } } } }`, CONTEXTS = `contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId isRequired(pullRequestNumber: $number) checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl isRequired(pullRequestNumber: $number) } } }`, PR_STATUS_QUERY, FIND_PR_QUERY = `query($owner: String!, $name: String!, $head: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $head, first: 20, orderBy: { field: CREATED_AT, direction: DESC }) { nodes { number url state baseRefName headRefName headRefOid headRepositoryOwner { login } } } } }`, BRANCH_CHECKS_QUERY = `query($owner: String!, $name: String!, $ref: String!, $contexts: String) { repository(owner: $owner, name: $name) { object(expression: $ref) { ... on Commit { oid statusCheckRollup { contexts(first: 100, after: $contexts) { pageInfo { hasNextPage endCursor } nodes { __typename ... on CheckRun { name status conclusion detailsUrl databaseId checkSuite { workflowRun { databaseId workflow { name } } } } ... on StatusContext { context state targetUrl } } } } } } } }`, READY_MUTATION = `mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, DRAFT_MUTATION = `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, REPLY_MUTATION = `mutation($thread: ID!, $body: String!) { addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $thread, body: $body }) { comment { url } } }`, RESOLVE_MUTATION = `mutation($thread: ID!) { resolveReviewThread(input: { threadId: $thread }) { thread { isResolved } } }`, THREAD_QUERY = `query($thread: ID!) { node(id: $thread) { ... on PullRequestReviewThread { isResolved pullRequest { number } } } }`, prState = (value) => value === "MERGED" ? "merged" : value === "CLOSED" ? "closed" : "open", FAILING2, safeUrl = (value) => value ? redactText(value) : null, encodeRef = (ref) => ref.split("/").map(encodeURIComponent).join("/");
 var init_github = __esm(() => {
   init_exec();
   init_redact();
@@ -83097,6 +83438,35 @@ function createGitLabForge(options) {
       };
       return success2(status);
     },
+    branchChecks(branch) {
+      const tip = baseTip(branch);
+      if (!tip)
+        return failure3("not_found", `branch ${branch} was not found`);
+      const latest = apiJson(runner, "glab", apiHost, api(`${project}/pipelines?ref=${encodeURIComponent(branch)}&sha=${tip}&order_by=id&sort=desc&per_page=1`), `pipelines on ${branch}`);
+      if (!latest.ok)
+        return latest;
+      const pipeline = Array.isArray(latest.data) ? latest.data[0] : undefined;
+      if (!pipeline)
+        return success2({ sha: tip, checks: [], requiredKnown: true });
+      const scope = String(pipeline.project_id ?? encodeURIComponent(repo));
+      const jobs = pages(`projects/${scope}/pipelines/${pipeline.id}/jobs`, `pipeline ${pipeline.id} jobs`);
+      if (!jobs.ok)
+        return jobs;
+      const bridges = pages(`projects/${scope}/pipelines/${pipeline.id}/bridges`, `pipeline ${pipeline.id} bridges`);
+      if (!bridges.ok)
+        return bridges;
+      const checks = [
+        ...jobs.data.items.map((job) => checkFromJob(job, pipeline.id, scope)),
+        ...bridges.data.items.map((bridge) => checkFromBridge(bridge, pipeline.id, scope))
+      ];
+      if (stateOf(pipeline.status, false) === "failing" && !checks.some((check) => check.state === "failing"))
+        checks.push(pipelineCheck("failing", pipeline.status, {
+          id: pipeline.id,
+          project_id: pipeline.project_id ?? 0,
+          web_url: pipeline.web_url
+        }));
+      return success2({ sha: tip, checks, requiredKnown: true });
+    },
     jobLogTail(job, lines) {
       const scope = job.scope ?? encodeURIComponent(repo);
       const text = apiText(runner, "glab", apiHost, ["api", `projects/${scope}/jobs/${job.jobId}/trace`], `job ${job.jobId} trace`, FORGE_TIMEOUTS.log);
@@ -83839,7 +84209,7 @@ var init_live_session = __esm(() => {
 });
 
 // packages/workit-core/src/hooks/write-gate.ts
-import path58 from "node:path";
+import path59 from "node:path";
 var CASE_INSENSITIVE, PREFIXES2, SCRIPT_SHELLS, cache3, MUTATING_GIT, DRY_N, MUTATING_WORKIT_GIT, CD2, PUSHD2, POPD2, UNKNOWN_DIR;
 var init_write_gate = __esm(() => {
   init_task_store();
@@ -83879,7 +84249,7 @@ var init_write_gate = __esm(() => {
   CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
   PUSHD2 = new Set(["pushd", "push-location"]);
   POPD2 = new Set(["popd", "pop-location"]);
-  UNKNOWN_DIR = path58.resolve(path58.parse(process.cwd()).root, ".workit-unknown-dir");
+  UNKNOWN_DIR = path59.resolve(path59.parse(process.cwd()).root, ".workit-unknown-dir");
 });
 
 // packages/workit-core/src/hooks/worktree-confine.ts
@@ -83904,20 +84274,20 @@ var init_worktree_confine = __esm(() => {
 
 // packages/workit-core/src/worktree-deps.ts
 import fs31 from "node:fs";
-import path59 from "node:path";
+import path60 from "node:path";
 function moduleDirs(main) {
   const out = [];
   const walk = (relative, depth) => {
     let entries;
     try {
-      entries = fs31.readdirSync(path59.join(main, relative), { withFileTypes: true });
+      entries = fs31.readdirSync(path60.join(main, relative), { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const child = path59.join(relative, entry.name);
+      const child = path60.join(relative, entry.name);
       if (entry.name === MODULES)
         out.push(child);
       else if (depth < MAX_DEPTH2 && !entry.name.startsWith("."))
@@ -83931,8 +84301,8 @@ function linkEntry(main, worktree, source, target) {
   const stat = fs31.lstatSync(source);
   if (stat.isSymbolicLink()) {
     const link = fs31.readlinkSync(source);
-    const outside = path59.isAbsolute(link) && within(link, main) && !path59.relative(main, link).split(path59.sep).includes(MODULES);
-    const to = outside ? path59.join(worktree, path59.relative(main, link)) : link;
+    const outside = path60.isAbsolute(link) && within(link, main) && !path60.relative(main, link).split(path60.sep).includes(MODULES);
+    const to = outside ? path60.join(worktree, path60.relative(main, link)) : link;
     fs31.symlinkSync(to, target, process.platform === "win32" ? "junction" : undefined);
     return;
   }
@@ -83942,8 +84312,8 @@ function mirror(main, worktree, source, target, top) {
   fs31.mkdirSync(target);
   let count = 0;
   for (const entry of fs31.readdirSync(source, { withFileTypes: true })) {
-    const from = path59.join(source, entry.name);
-    const to = path59.join(target, entry.name);
+    const from = path60.join(source, entry.name);
+    const to = path60.join(target, entry.name);
     if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin"))
       count += mirror(main, worktree, from, to, false);
     else {
@@ -83959,16 +84329,16 @@ function linkWorktreeDependencies(main, worktree) {
   const dirs = [];
   let entries = 0;
   for (const relative of moduleDirs(main)) {
-    const target = path59.join(worktree, relative);
-    if (!fs31.existsSync(path59.dirname(target)) || fs31.existsSync(target))
+    const target = path60.join(worktree, relative);
+    if (!fs31.existsSync(path60.dirname(target)) || fs31.existsSync(target))
       continue;
-    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path59.sep).join("/")}/`]).ok) {
-      notes.push(`${relative.split(path59.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
+    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path60.sep).join("/")}/`]).ok) {
+      notes.push(`${relative.split(path60.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
       continue;
     }
     try {
-      entries += mirror(main, worktree, path59.join(main, relative), target, true);
-      dirs.push(relative.split(path59.sep).join("/"));
+      entries += mirror(main, worktree, path60.join(main, relative), target, true);
+      dirs.push(relative.split(path60.sep).join("/"));
     } catch (error) {
       fs31.rmSync(target, { recursive: true, force: true });
       notes.push(`could not link ${relative} from ${main} (${error.message}); install dependencies in the worktree yourself`);
@@ -83981,8 +84351,8 @@ function linkWorktreeDependencies(main, worktree) {
   return { linked: { from: main, dirs, entries, ms }, notes };
 }
 var MODULES = "node_modules", MAX_DEPTH2 = 2, within = (child, parent) => {
-  const relative = path59.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path59.isAbsolute(relative);
+  const relative = path60.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path60.isAbsolute(relative);
 };
 var init_worktree_deps = __esm(() => {
   init_fanout();
@@ -83991,7 +84361,7 @@ var init_worktree_deps = __esm(() => {
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
 import fs32 from "node:fs";
-import path60 from "node:path";
+import path61 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -84051,7 +84421,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs32.readFileSync(path60.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
+    token = fs32.readFileSync(path61.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -84059,7 +84429,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path60.basename(file),
+      id: path61.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -84075,7 +84445,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes5(16).toString("hex");
   try {
-    fs32.writeFileSync(path60.join(admin.path, FANOUT_TOKEN_FILE), `${token}
+    fs32.writeFileSync(path61.join(admin.path, FANOUT_TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -84090,7 +84460,7 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path60.join(common, "info", "exclude");
+  const file = path61.join(common, "info", "exclude");
   let text = "";
   try {
     text = fs32.readFileSync(file, "utf8");
@@ -84099,7 +84469,7 @@ function excludeScratch(cwd) {
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs32.mkdirSync(path60.dirname(file), { recursive: true });
+  fs32.mkdirSync(path61.dirname(file), { recursive: true });
   fs32.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
@@ -84108,13 +84478,13 @@ ${EXCLUDE_LINE}
 }
 function worktreeDependencies(main, worktree) {
   for (const [name, install] of LOCKFILES2) {
-    const ours = readBytes(path60.join(main, name));
-    const theirs = readBytes(path60.join(worktree, name));
+    const ours = readBytes(path61.join(main, name));
+    const theirs = readBytes(path61.join(worktree, name));
     if (ours === null && theirs === null)
       continue;
     if (ours !== null && theirs !== null && ours.equals(theirs))
       continue;
-    if (fs32.existsSync(path60.join(worktree, "node_modules")))
+    if (fs32.existsSync(path61.join(worktree, "node_modules")))
       break;
     const command = install(worktree);
     return {
@@ -84128,7 +84498,7 @@ function worktreeDependencies(main, worktree) {
   return { ...linkWorktreeDependencies(main, worktree), install: null };
 }
 function ensureScratch(worktree) {
-  const scratch = path60.join(worktree, SCRATCH_DIR);
+  const scratch = path61.join(worktree, SCRATCH_DIR);
   fs32.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
@@ -84367,7 +84737,7 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path60.join(worktree, SCRATCH_DIR);
+  const scratch = path61.join(worktree, SCRATCH_DIR);
   let stat;
   try {
     stat = fs32.lstatSync(scratch);
@@ -84383,16 +84753,16 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
   try {
     return fs32.realpathSync.native(target);
   } catch {
-    return path60.resolve(target);
+    return path61.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside3 = (child, parent) => {
-  const relative = path60.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path60.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path60.isAbsolute(slice.worktree) ? slice.worktree : path60.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
+  const relative = path61.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path61.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path61.isAbsolute(slice.worktree) ? slice.worktree : path61.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
   try {
     return fs32.readFileSync(file);
   } catch {
@@ -84423,7 +84793,7 @@ var init_fanout_worktree = __esm(() => {
 
 // packages/workit-core/src/forge/merge-cleanup.ts
 import fs33 from "node:fs";
-import path61 from "node:path";
+import path62 from "node:path";
 function cleanupMergedBranch(cwd, branch, mergedHead) {
   const out = { branchDeleted: false, worktreeRemoved: null, notes: [] };
   if (!branch || branch.startsWith("-"))
@@ -84483,13 +84853,13 @@ var SLOW2, isFanoutWorktree = (worktree) => {
   if (!dir.ok)
     return false;
   try {
-    return fs33.readFileSync(path61.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
+    return fs33.readFileSync(path62.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
   } catch {
     return false;
   }
 }, inside4 = (child, parent) => {
-  const relative = path61.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
-  return relative === "" || !relative.startsWith("..") && !path61.isAbsolute(relative);
+  const relative = path62.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
+  return relative === "" || !relative.startsWith("..") && !path62.isAbsolute(relative);
 };
 var init_merge_cleanup = __esm(() => {
   init_fanout();
@@ -84770,7 +85140,7 @@ var init_duration = __esm(() => {
 });
 
 // packages/workit-cli/src/verbs/forge-common.ts
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 function parseFlags(argv, spec) {
   const parsed = { values: {}, booleans: new Set, lists: {}, positionals: [] };
   for (let index = 0;index < argv.length; index += 1) {
@@ -84925,7 +85295,7 @@ var init_forge_common = __esm(() => {
   forgeDeps = {
     runner: undefined,
     npm: undefined,
-    readStdin: () => readFileSync23(0, "utf8"),
+    readStdin: () => readFileSync24(0, "utf8"),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     now: () => Date.now()
   };
@@ -84936,12 +85306,12 @@ var exports_pr = {};
 __export(exports_pr, {
   run: () => run15
 });
-import { readFileSync as readFileSync24 } from "node:fs";
-import path62 from "node:path";
+import { readFileSync as readFileSync25 } from "node:fs";
+import path63 from "node:path";
 function readBodyFile(io, file) {
   try {
     return {
-      body: file === "-" ? forgeDeps.readStdin() : readFileSync24(path62.resolve(io.cwd, file), "utf8")
+      body: file === "-" ? forgeDeps.readStdin() : readFileSync25(path63.resolve(io.cwd, file), "utf8")
     };
   } catch {
     return `cannot read --body-file ${file}`;
@@ -85204,6 +85574,7 @@ async function merge3(argv, io) {
     "delete-branch": "boolean",
     "keep-branch": "boolean",
     unverified: "boolean",
+    "base-red-ok": "boolean",
     reason: "value",
     subject: "value",
     body: "value",
@@ -85211,7 +85582,11 @@ async function merge3(argv, io) {
   });
   if (typeof flags === "string")
     return usage4(io, flags, MERGE_USAGE);
-  const unverified = unverifiedFlag(flags);
+  const baseRedOk = flags.booleans.has("base-red-ok");
+  const baseRedReason = flags.values.reason?.trim();
+  if (baseRedOk && !baseRedReason)
+    return usage4(io, "--base-red-ok needs --reason <why merging onto a red base is fine>", MERGE_USAGE);
+  const unverified = baseRedOk && !flags.booleans.has("unverified") ? null : unverifiedFlag(flags);
   if (typeof unverified === "string")
     return usage4(io, unverified, MERGE_USAGE);
   if (flags.positionals.length)
@@ -85253,6 +85628,7 @@ async function merge3(argv, io) {
     implicitDelete: !flags.booleans.has("keep-branch") && workspaceDeleteBranch(io.cwd),
     actor: actorFromEnv(io.env),
     ...unverified ? { unverified } : {},
+    ...baseRedOk && baseRedReason ? { baseRedOk: { reason: baseRedReason } } : {},
     ...subject !== undefined ? { subject } : {},
     ...body !== undefined ? { body } : {}
   }, forgeDeps.sleep);
@@ -85265,6 +85641,7 @@ async function merge3(argv, io) {
   return emit(io, ok2({ ...result.data, localCleanup: cleanup }), (data) => [
     `merged ${connected.data.forge.kind === "github" ? "PR #" : "MR !"}${data.number} (${data.method}) at head ${data.head.slice(0, 12)}${data.mergeSha ? ` -> ${data.mergeSha.slice(0, 12)}` : ""}`,
     data.unverified ? `UNVERIFIED: merged without a verdict (--unverified: ${data.unverified.reason}); ledger ${data.unverified.recorded}` : `verdict ${data.verdict.verdictId ?? "?"} accepted for that head${data.verdict.cover ? ` (stack verdict on ${data.verdict.cover.branch} @ ${data.verdict.cover.head.slice(0, 12)})` : data.verdict.carry ? ` (${carryLabel(data.verdict.carry)})` : ""}`,
+    ...data.baseCi.note ? [data.baseCi.note] : [],
     ...data.mergeBack.length ? [
       `merge back: ${data.base} is the ${data.mergeBackTrack} production branch; bring it into ${data.mergeBack.join(", ")}`
     ] : [],
@@ -85431,7 +85808,7 @@ async function run15(argv, io) {
     return reply(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE8);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE8 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE8 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
 var init_pr = __esm(() => {
   init_autonomy();
   init_issue_link();
@@ -85730,8 +86107,8 @@ var exports_git = {};
 __export(exports_git, {
   run: () => run17
 });
-import { readFileSync as readFileSync25 } from "node:fs";
-import path63 from "node:path";
+import { readFileSync as readFileSync26 } from "node:fs";
+import path64 from "node:path";
 function kindHint(cwd, kind) {
   let kinds = [...BRANCH_KINDS];
   try {
@@ -85835,7 +86212,7 @@ function commitMessage(parsed, io) {
 
 `);
   try {
-    return file === "-" ? readFileSync25(0, "utf8") : readFileSync25(path63.resolve(io.cwd, file), "utf8");
+    return file === "-" ? readFileSync26(0, "utf8") : readFileSync26(path64.resolve(io.cwd, file), "utf8");
   } catch (error) {
     return {
       error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
@@ -87245,7 +87622,7 @@ var init_stack2 = __esm(() => {
 // packages/workit-core/src/fanout-brief.ts
 import { createHash as createHash19 } from "node:crypto";
 import fs35 from "node:fs";
-import path64 from "node:path";
+import path65 from "node:path";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
   const full = `${lead}-w-${slice}${tail}`;
@@ -87327,7 +87704,7 @@ function renderBrief(cwd, plan, input) {
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
     exists ? `WORKTREE: ${planned}  (made by \`workit fanout worktree create ${slice.id}\`; yours alone)` : `WORKTREE: ${planned}  (not made yet: the lead runs \`workit fanout worktree create ${slice.id}\` before spawning, then renders this brief again)`,
-    ...exists && typeof made?.install === "string" && !fs35.existsSync(path64.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
+    ...exists && typeof made?.install === "string" && !fs35.existsSync(path65.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
     ...identityLines(identity, minted),
     ...rules(mode, branch, slice.base, exists ? planned : null)
   ];
@@ -88068,7 +88445,7 @@ __export(exports_fanout, {
   run: () => run21
 });
 import fs36 from "node:fs";
-import path65 from "node:path";
+import path66 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -88129,7 +88506,7 @@ function plan2(argv, io) {
     return usage4(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage4(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path65.resolve(io.cwd, flags.positionals[0]);
+  const file = path66.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
     raw = JSON.parse(fs36.readFileSync(file, "utf8"));
@@ -103670,7 +104047,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path66 from "node:path";
+import path67 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -104163,12 +104540,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path66.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path67.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path66.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path67.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -104557,8 +104934,8 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync11, readFileSync as readFileSync26, statSync as statSync10 } from "node:fs";
-import path67 from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync13, readFileSync as readFileSync27, statSync as statSync10 } from "node:fs";
+import path68 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
@@ -104568,10 +104945,10 @@ function git7(cwd, args) {
   return { ok: run.status === 0, stdout: run.stdout ?? "" };
 }
 function walkTests(dir, out) {
-  for (const entry of readdirSync11(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync13(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path67.join(dir, entry.name);
+    const full = path68.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -104583,7 +104960,7 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path67.resolve(cwd, input);
+    const full = path68.resolve(cwd, input);
     if (!existsSync24(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
@@ -104620,11 +104997,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path67.join(root, file), lines);
+    changed.set(path68.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path67.join(root, file), "all");
+    changed.set(path68.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -104637,7 +105014,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync26(file, "utf8"), file);
+      parsed = parseSource(readFileSync27(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -104686,7 +105063,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path67.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path68.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -104702,21 +105079,21 @@ import { spawn as spawn2 } from "node:child_process";
 import {
   existsSync as existsSync25,
   lstatSync as lstatSync8,
-  mkdirSync as mkdirSync11,
+  mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
-  readdirSync as readdirSync12,
-  readFileSync as readFileSync27,
+  readdirSync as readdirSync14,
+  readFileSync as readFileSync28,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync10,
   renameSync as renameSync7,
   rmSync as rmSync9,
   statSync as statSync11,
   symlinkSync,
-  writeFileSync as writeFileSync11,
+  writeFileSync as writeFileSync12,
   copyFileSync as copyFileSync8
 } from "node:fs";
 import os22 from "node:os";
-import path68 from "node:path";
+import path69 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -104789,7 +105166,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path68.posix.join(path68.posix.dirname(file), spec)) === target)
+        if (stripExt(path69.posix.join(path69.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -104801,7 +105178,7 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
-    names = readdirSync12(tmp);
+    names = readdirSync14(tmp);
   } catch {
     return 0;
   }
@@ -104809,12 +105186,12 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path68.join(tmp, name);
+    const dir = path69.join(tmp, name);
     try {
       const stat = lstatSync8(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync27(path68.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync28(path69.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -104829,16 +105206,16 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
   return removed;
 }
 function linkNodeModules(origin, target, repo, copy) {
-  mkdirSync11(target, { recursive: true });
-  for (const entry of readdirSync12(origin, { withFileTypes: true })) {
-    const from = path68.join(origin, entry.name);
-    const to = path68.join(target, entry.name);
+  mkdirSync12(target, { recursive: true });
+  for (const entry of readdirSync14(origin, { withFileTypes: true })) {
+    const from = path69.join(origin, entry.name);
+    const to = path69.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
     }
     if (entry.name.startsWith(".") && entry.name !== ".bin" && entry.isDirectory()) {
-      mkdirSync11(to, { recursive: true });
+      mkdirSync12(to, { recursive: true });
       continue;
     }
     if (entry.isSymbolicLink()) {
@@ -104848,9 +105225,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path68.relative(repo, real);
-      if (!relative.startsWith("..") && !path68.isAbsolute(relative) && !relative.split(path68.sep).includes("node_modules")) {
-        symlinkSync(path68.join(copy, relative), to, "junction");
+      const relative = path69.relative(repo, real);
+      if (!relative.startsWith("..") && !path69.isAbsolute(relative) && !relative.split(path69.sep).includes("node_modules")) {
+        symlinkSync(path69.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -104866,7 +105243,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync10(repo);
   if (real && inside5(realRepo, real)) {
-    symlinkSync(path68.relative(path68.dirname(to), path68.join(tree, path68.relative(realRepo, real))), to);
+    symlinkSync(path69.relative(path69.dirname(to), path69.join(tree, path69.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync11(real).isFile())
@@ -104875,23 +105252,23 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path68.join(copy, file);
+  const target = path69.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path68.dirname(target))))
+    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path69.dirname(target))))
       return false;
   } catch {
     return false;
   }
   const temp = `${target}.workit-mutant-${process.pid}`;
-  writeFileSync11(temp, content);
+  writeFileSync12(temp, content);
   renameSync7(temp, target);
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path68.join(os22.tmpdir(), TEMP_PREFIX));
-  writeFileSync11(path68.join(dir, PID_FILE), String(process.pid));
-  const tree = path68.join(dir, "tree");
+  const dir = mkdtempSync4(path69.join(os22.tmpdir(), TEMP_PREFIX));
+  writeFileSync12(path69.join(dir, PID_FILE), String(process.pid));
+  const tree = path69.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -104902,35 +105279,35 @@ function copyWorkingTree(repo) {
       git7(tree, ["update-ref", "--no-deref", "HEAD", head]);
     git7(tree, ["reset", "-q"]);
   } else
-    mkdirSync11(tree, { recursive: true });
+    mkdirSync12(tree, { recursive: true });
   const listed = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00");
   const dirs = new Set([""]);
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path68.join(repo, relative);
+    const from = path69.join(repo, relative);
     let stat;
     try {
       stat = lstatSync8(from);
     } catch {
       continue;
     }
-    const to = path68.join(tree, relative);
-    mkdirSync11(path68.dirname(to), { recursive: true });
+    const to = path69.join(tree, relative);
+    mkdirSync12(path69.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync8(from, to);
-    let parent = path68.dirname(relative);
+    let parent = path69.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path68.dirname(parent);
+      parent = path69.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path68.join(repo, parent, "node_modules");
-    if (existsSync25(modules) && !existsSync25(path68.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path68.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path69.join(repo, parent, "node_modules");
+    if (existsSync25(modules) && !existsSync25(path69.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path69.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
@@ -104969,20 +105346,20 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync27(path68.join(repo, file), "utf8") };
+      return { file, text: readFileSync28(path69.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path68.relative(repo, absolute));
+    const relative = toPosix(path69.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
     if (NOT_SOURCE.test(relative) || !existsSync25(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync27(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync28(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -104990,9 +105367,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path68.relative(repo, options.cwd);
+  const cwdRelative = path69.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path68.relative(cwdRelative, file));
+    const relative = toPosix(path69.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -105028,7 +105405,7 @@ async function runMutation(options) {
     return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path68.join(copy, cwdRelative);
+  const copyCwd = path69.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -105063,7 +105440,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync27(path68.join(copy, mutant.file), "utf8");
+      const original = readFileSync28(path69.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -105120,8 +105497,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside5 = (root, file) => {
-  const relative = path68.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path68.isAbsolute(relative);
+  const relative = path69.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path69.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -105170,7 +105547,7 @@ __export(exports_test_audit, {
   run: () => run23
 });
 import { existsSync as existsSync26 } from "node:fs";
-import path69 from "node:path";
+import path70 from "node:path";
 function parse8(argv) {
   const options = {
     paths: [],
@@ -105275,8 +105652,8 @@ async function run23(argv, io) {
     return emit(io, fail2("invalid_input", `${options}
 usage: ${USAGE15}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path69.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path69.relative(io.cwd, file) || file);
+  const repo = top.ok ? path70.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path70.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -105414,8 +105791,8 @@ var exports_youtrack = {};
 __export(exports_youtrack, {
   run: () => run25
 });
-import { readFileSync as readFileSync28 } from "node:fs";
-import path70 from "node:path";
+import { readFileSync as readFileSync29 } from "node:fs";
+import path71 from "node:path";
 async function run25(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -105461,7 +105838,7 @@ async function run25(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync28(path70.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync29(path71.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage4(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE17);
       }
@@ -105529,8 +105906,8 @@ var exports_changelog = {};
 __export(exports_changelog, {
   run: () => run26
 });
-import { readFileSync as readFileSync29 } from "node:fs";
-import path71 from "node:path";
+import { readFileSync as readFileSync30 } from "node:fs";
+import path72 from "node:path";
 async function run26(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -105576,7 +105953,7 @@ async function run26(argv, io) {
   ]);
 }
 var USAGE18 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync29(0, "utf8") : raw.startsWith("@") ? readFileSync29(path71.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync30(0, "utf8") : raw.startsWith("@") ? readFileSync30(path72.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -105592,7 +105969,7 @@ __export(exports_handoff, {
   run: () => run27
 });
 import fs37 from "node:fs";
-import path72 from "node:path";
+import path73 from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 function render3(brief) {
   const lines = [
@@ -105632,9 +106009,9 @@ function bounded(brief, cwd) {
   let file = null;
   if (store.ok)
     try {
-      const dir = path72.join(store.value.root, "handoff");
+      const dir = path73.join(store.value.root, "handoff");
       fs37.mkdirSync(dir, { recursive: true });
-      file = path72.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
+      file = path73.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
       fs37.writeFileSync(file, `${[...body, ...tail].join(`
 `)}
 `, { mode: 384 });
@@ -105706,7 +106083,7 @@ var init_handoff = __esm(() => {
 // packages/workit-cli/src/main.ts
 init_host_session();
 init_package();
-import path73 from "node:path";
+import path74 from "node:path";
 
 // packages/workit-cli/src/verbs/registry.ts
 var TASK_FAMILY_NAMES = [
@@ -106034,7 +106411,7 @@ var VERBS = [
       },
       {
         name: "merge",
-        usage: "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>]",
+        usage: "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>]",
         summary: "Merge when READY, verified by a non-author and granted; --subject/--body set the squash message"
       }
     ],
@@ -106612,7 +106989,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path73.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path74.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = { ...defaultIo(parsed.json), ...overrides, json: parsed.json, cwd };
   if (parsed.error)
     return emit(io, fail2("invalid_input", parsed.error));