@brainervirus/workit-cli 8.37.4 → 8.38.1

package/dist/index.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.37.4",
+    version: "8.38.1",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.37.4",
+      "@brainervirus/workit-cursor": "^8.38.1",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.37.4"
+      "@brainervirus/workit-core": "^8.38.1"
     },
     engines: {
       node: ">=24"
@@ -68218,7 +68218,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       if (!state)
         continue;
       problems.push(`Cursor registers the Workit plugin at ${entry}, but that directory is ${state}`);
-      fixes.push("Run `workit init` and select Cursor to install the plugin files");
+      fixes.push("Run `workit upgrade --hosts=cursor` to reinstall the Cursor plugin files");
     }
   }
   for (const install of codexWorkitInstalls(res)) {
@@ -69643,9 +69643,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return `${host}: ${seen.join(", ")}`;
   });
   return { id: "hook_runs", status: "pass", detail: parts.join("; ") };
-}, RUN_CHECKS, INSTALLER_REQUIRED, runDoctor = (options = {}) => {
+}, RUN_CHECKS, UPGRADE_CHECKS, INSTALLER_REQUIRED, runDoctor = (options = {}) => {
   const res = resolve(options);
-  const raw = RUN_CHECKS.map((fn) => fn(res));
+  const raw = (options.only === "upgrade" ? RUN_CHECKS.filter((fn) => UPGRADE_CHECKS.has(fn)) : RUN_CHECKS).map((fn) => fn(res));
   const checks = res.installer ? raw.map((c) => c.status === "fail" && !INSTALLER_REQUIRED.has(c.id) ? {
     ...c,
     status: "warn",
@@ -69743,6 +69743,20 @@ var init_doctor = __esm(() => {
     checkGrantRules("codex", "codex_grant_rules"),
     checkGrantRules("cursor", "cursor_grant_rules")
   ];
+  UPGRADE_CHECKS = new Set([
+    checkVersions,
+    checkCodexPin,
+    checkCodexAgents,
+    checkPiExtension,
+    checkOpencodeVersion,
+    checkClaudePlugin,
+    checkAssets,
+    checkLauncher,
+    checkPluginFiles,
+    checkStalePin,
+    checkStaleInstall,
+    ...RUN_CHECKS.slice(-6)
+  ]);
   INSTALLER_REQUIRED = new Set([
     "runtime",
     "assets",
@@ -74829,6 +74843,7 @@ import {
   mkdtempSync as mkdtempSync3,
   rmSync as rmSync8,
   readFileSync as readFileSync21,
+  readdirSync as readdirSync12,
   mkdirSync as mkdirSync11,
   copyFileSync as copyFileSync6,
   chmodSync as chmodSync2,
@@ -74846,6 +74861,7 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
   const plan = {
     ok: true,
     blocked: [],
+    failed: [],
     skipped: [],
     entries: [],
     configDigests: {},
@@ -74861,7 +74877,7 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
     paths.opencodeConfig + "c",
     path44.join(home, ".cursor/settings.json"),
     path44.join(home, ".cursor/mcp.json"),
-    path44.join(home, ".cursor/plugins/local/workit/package.json"),
+    path44.join(paths.cursorRoot, "package.json"),
     paths.codexConfig,
     paths.piSettings
   ])
@@ -74874,93 +74890,150 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
         file: state.config.file,
         description: "Remove ignored Workit trustedPaths; native host permissions remain unchanged"
       });
-    const installedSources = sources(paths, run, hosts);
-    if (installedSources.some((source) => source.host === "opencode")) {
-      const scratch = mkdtempSync3(path44.join(os16.tmpdir(), "workit-upgrade-opencode-"));
-      let probe;
-      try {
-        probe = runner({
-          ...deps,
-          env: {
-            ...deps.env,
-            XDG_DATA_HOME: path44.join(scratch, "data"),
-            XDG_STATE_HOME: path44.join(scratch, "state"),
-            XDG_CACHE_HOME: path44.join(scratch, "cache")
-          }
-        })("opencode", ["--version"]);
-      } finally {
-        rmSync8(scratch, { recursive: true, force: true });
-      }
-      const installed = probe.status === 0 ? probe.stdout.match(/\d+\.\d+\.\d+/)?.[0] : undefined;
-      if (installed && !versionAtLeast(installed, SUPPORT_MATRIX.opencode.minimum))
-        (plan.warnings ??= []).push(`opencode ${installed}: ${OPENCODE_V1_FIX}`);
+  } catch (error) {
+    plan.blocked.push(errorText(error));
+  }
+  const installedSources = sources(paths, run, hosts, plan.failed);
+  let opencodeHelp;
+  if (installedSources.some((source) => source.host === "opencode")) {
+    const probe = opencodeProbe(deps, ["--version"]);
+    const installed = probe.status === 0 ? probe.stdout.match(/\d+\.\d+\.\d+/)?.[0] : undefined;
+    if (installed && !versionAtLeast(installed, SUPPORT_MATRIX.opencode.minimum))
+      (plan.warnings ??= []).push(`opencode ${installed}: ${OPENCODE_V1_FIX}`);
+  }
+  for (const host of ["opencode", "pi"]) {
+    if (new Set(installedSources.filter((source) => source.host === host).map((source) => source.selector)).size > 1)
+      plan.failed.push({
+        host,
+        status: "failed",
+        reason: "conflicting Workit registrations; reconcile them in the native host before upgrading"
+      });
+  }
+  const conflicted = new Set(plan.failed.map((entry) => entry.host));
+  for (const source of installedSources.filter((candidate, index, list) => !conflicted.has(candidate.host) && list.findIndex((entry) => entry.host === candidate.host && entry.selector === candidate.selector) === index)) {
+    if (source.kind === "pinned" || source.kind === "local") {
+      plan.skipped.push({
+        host: source.host,
+        reason: `${source.kind} source preserved; change its source explicitly to upgrade`
+      });
+      continue;
     }
-    for (const host of ["opencode", "pi"]) {
-      if (new Set(installedSources.filter((source) => source.host === host).map((source) => source.selector)).size > 1)
-        plan.blocked.push(`${host}: conflicting Workit registrations; reconcile them in the native host before upgrading`);
+    if (source.host === "claude-code") {
+      const [market] = source.selector.split("@").slice(1);
+      plan.entries.push({
+        host: "claude-code",
+        selector: source.selector,
+        latest: "",
+        installedVersion: source.installedVersion,
+        commands: [
+          {
+            command: "claude",
+            args: ["plugin", "marketplace", "update", market ?? "workit"]
+          },
+          { command: "claude", args: ["plugin", "update", source.selector] }
+        ],
+        fix: `claude plugin marketplace update ${market ?? "workit"} && claude plugin update ${source.selector}`
+      });
+      continue;
     }
-    for (const source of installedSources.filter((candidate, index, list) => list.findIndex((entry) => entry.host === candidate.host && entry.selector === candidate.selector) === index)) {
-      if (source.kind !== "floating") {
-        plan.skipped.push({
-          host: source.host,
-          reason: `${source.kind} source preserved; change its source explicitly to upgrade`
-        });
-        continue;
-      }
-      if (source.host === "opencode") {
+    if (source.host === "opencode") {
+      opencodeHelp ??= opencodeProbe(deps, ["plugin", "--help"]).stdout;
+      if (!/^\s*(?:opencode\s+plugin\s+)?update\b/m.test(opencodeHelp)) {
         plan.skipped.push({
-          host: source.host,
-          reason: "OpenCode server plugin preserved: scoped native updates are unavailable in qualified 2.0.21; Workit never updates unrelated plugins"
+          host: "opencode",
+          reason: "this OpenCode has no `opencode plugin update`; upgrade OpenCode, then run the fix. Workit never updates unrelated plugins",
+          fix: OPENCODE_UPDATE
         });
         continue;
       }
-      const latest = run("npm", ["view", `@brainervirus/workit-${source.host}`, "version"]);
-      if (latest.status !== 0 || !/^\d+\.\d+\.\d+$/.test(latest.stdout.trim())) {
-        plan.blocked.push(`${source.host}: registry version unavailable; existing installation preserved`);
-        continue;
-      }
-      if (source.installedVersion && versionAtLeast(source.installedVersion, latest.stdout.trim())) {
-        plan.skipped.push({
-          host: source.host,
-          reason: `already current (${source.installedVersion})`
-        });
-        continue;
-      }
-      const commands = source.host === "pi" ? [{ command: "pi", args: ["update", "--extension", source.selector] }] : source.host === "codex" ? [{ command: "codex", args: ["plugin", "add", "workit@workflow-toolkit", "--json"] }] : planHostInstall("cursor", {
-        home,
-        env: deps.env,
-        cwd: home,
-        packageVersion: latest.stdout.trim(),
-        targetDir: path44.join(home, ".cursor/plugins/local/workit")
-      });
       plan.entries.push({
-        host: source.host,
+        host: "opencode",
         selector: source.selector,
-        latest: latest.stdout.trim(),
-        commands
+        latest: "",
+        commands: [{ command: "opencode", args: ["plugin", "update", OPENCODE_PACKAGE] }],
+        fix: OPENCODE_UPDATE
       });
+      continue;
     }
-  } catch (error) {
-    plan.blocked.push(error instanceof Error ? error.message : "installed source could not be read");
+    const latest = registryVersion(run, `@brainervirus/workit-${source.host}`);
+    if (!latest) {
+      plan.failed.push({
+        host: source.host,
+        status: "failed",
+        reason: "registry version unavailable; existing installation preserved",
+        fix: fixFor(source.host, source.selector)
+      });
+      continue;
+    }
+    if (source.installedVersion && versionAtLeast(source.installedVersion, latest)) {
+      plan.skipped.push({
+        host: source.host,
+        reason: `already current (${source.installedVersion})`
+      });
+      continue;
+    }
+    const commands = source.host === "pi" ? [{ command: "pi", args: ["update", "--extension", source.selector] }] : source.host === "codex" ? [
+      {
+        command: "codex",
+        args: ["plugin", "marketplace", "upgrade", CODEX_MARKETPLACE]
+      },
+      {
+        command: "codex",
+        args: ["plugin", "add", `workit@${CODEX_MARKETPLACE}`, "--json"]
+      }
+    ] : planHostInstall("cursor", {
+      home,
+      env: deps.env,
+      cwd: home,
+      packageVersion: latest,
+      targetDir: paths.cursorRoot
+    });
+    plan.entries.push({
+      host: source.host,
+      selector: source.selector,
+      latest,
+      commands,
+      installedVersion: source.installedVersion,
+      ...source.kind === "repair" ? { repair: true } : {},
+      fix: fixFor(source.host, source.selector)
+    });
   }
-  plan.ok = plan.blocked.length === 0;
+  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
   return plan;
 }
 function applyUpgrade(plan, deps = {}) {
-  if (!plan.ok)
-    return { ok: false, error: plan.blocked.join("; ") };
+  const hosts = [...plan.failed];
+  const done = (backup) => {
+    const failures = hosts.filter((entry) => entry.status === "failed");
+    return {
+      ok: failures.length === 0,
+      ...backup ? { backup } : {},
+      ...failures.length ? {
+        error: failures.map((entry) => `${entry.host}: ${entry.reason}`).join("; ")
+      } : {},
+      hosts
+    };
+  };
+  for (const skipped of plan.skipped)
+    hosts.push({
+      host: skipped.host,
+      status: skipped.reason.startsWith("already current") ? "current" : "skipped",
+      reason: skipped.reason,
+      ...skipped.fix ? { fix: skipped.fix } : {}
+    });
+  if (plan.blocked.length)
+    return { ok: false, error: plan.blocked.join("; "), hosts };
   if (!plan.entries.length && !plan.migrations.length && !plan.cli)
-    return { ok: true };
+    return done();
   for (const [file, expected] of Object.entries(plan.configDigests))
     if (digest2(file) !== expected)
-      return { ok: false, error: `configuration changed; preview again: ${file}` };
-  const { home, env, configDir } = upgradePaths(deps);
-  const active = new Set(deps.activeHosts?.() ?? runningHosts(deps));
-  if (plan.entries.some((entry) => active.has(entry.host)))
-    return {
-      ok: false,
-      error: "Stop the selected running hosts before upgrading their loaded plugins"
-    };
+      return {
+        ok: false,
+        error: `configuration changed; preview again: ${file}`,
+        hosts
+      };
+  const paths = upgradePaths(deps);
+  const { home, configDir } = paths;
   const backup = path44.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
   mkdirSync11(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
@@ -74975,151 +75048,163 @@ function applyUpgrade(plan, deps = {}) {
       return {
         ok: false,
         backup,
-        error: "Unknown configuration migration; upgrade the CLI before applying"
+        error: "Unknown configuration migration; upgrade the CLI before applying",
+        hosts
       };
     delete value.trustedPaths;
     writeFileAtomic(migration.file, JSON.stringify(value, null, 2) + `
 `, 384);
   }
   const run = runner(deps);
-  const cursorRoot = path44.join(home, ".cursor/plugins/local/workit");
-  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync20(cursorRoot))
-    cpSync5(cursorRoot, path44.join(backup, "cursor-package"), { recursive: true });
+  let cursorBackupError = null;
+  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync20(paths.cursorRoot))
+    try {
+      cpSync5(paths.cursorRoot, path44.join(backup, "cursor-package"), { recursive: true });
+    } catch (error) {
+      cursorBackupError = `could not back up the Cursor plugin: ${errorText(error)}`;
+    }
+  const listed = plan.entries.length ? listProcesses(deps) : [];
+  const running = (listed ?? []).flatMap((entry) => classifyProcess(entry) ?? []);
   for (const entry of plan.entries) {
-    if (entry.host === "opencode")
-      return {
-        ok: false,
-        backup,
-        error: "Scoped OpenCode server-plugin updates are unsupported; registration preserved"
-      };
-    if (entry.host === "cursor") {
-      const preview = {
-        ok: true,
-        blocked: [],
-        preserved: [],
-        overrides: [],
-        platforms: ["cursor"],
-        state: readSetupState(configDir),
-        mutations: [
-          {
-            type: "install-host",
-            platform: "cursor",
-            path: path44.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
-            commands: entry.commands.map((command) => ({
-              ...command,
-              purpose: command.purpose ?? "Upgrade Cursor"
-            }))
-          },
-          {
-            type: "install-adapter",
-            platform: "cursor",
-            path: path44.join(home, ".cursor/plugins/local/workit")
-          }
-        ]
-      };
-      const result = applySetupPreview(preview, {
-        home,
-        env,
-        cwd: home,
-        preferInstalledAdapter: true,
-        runHostCommand: (command) => {
-          const outcome = run(command.command, command.args);
-          return { exitCode: outcome.status ?? 1, stdout: outcome.stdout, stderr: "" };
-        }
+    if (entry.host === "cursor" && cursorBackupError) {
+      hosts.push({ host: "cursor", status: "failed", reason: cursorBackupError, fix: entry.fix });
+      continue;
+    }
+    if (!LIVE_HOSTS.has(entry.host)) {
+      if (listed === null) {
+        hosts.push({
+          host: entry.host,
+          status: "skipped",
+          reason: `running processes could not be listed; close ${entry.host} and rerun`,
+          fix: `workit upgrade --hosts=${entry.host}`
+        });
+        continue;
+      }
+      const sessions = running.filter((proc) => proc.host === entry.host && proc.kind === "session");
+      if (sessions.length) {
+        hosts.push({
+          host: entry.host,
+          status: "skipped",
+          reason: `close ${entry.host} (${sessions.map(describe2).join("; ")}), then rerun`,
+          fix: `workit upgrade --hosts=${entry.host}`
+        });
+        continue;
+      }
+    }
+    const daemons = running.filter((proc) => proc.host === "codex" && proc.kind === "daemon");
+    const stopDaemon = entry.host === "codex" && daemons.length > 0;
+    if (stopDaemon && run("codex", ["app-server", "daemon", "stop"]).status !== 0) {
+      hosts.push({
+        host: "codex",
+        status: "failed",
+        reason: `could not stop the Codex app-server daemon (${daemons.map(describe2).join("; ")})`,
+        fix: "codex app-server daemon stop && workit upgrade --hosts=codex"
       });
-      const pkg = object2(path44.join(home, ".cursor/plugins/local/workit/package.json"));
-      if (!result.ok || pkg?.version !== entry.latest)
-        return {
-          ok: false,
-          backup,
-          error: "Cursor update did not verify the requested package version; inspect the installer before retrying"
-        };
       continue;
     }
-    for (const command of entry.commands)
-      if (run(command.command, command.args).status !== 0)
-        return {
-          ok: false,
-          backup,
-          error: `${entry.host}: update failed; inspect the native host before retrying`
+    let outcome;
+    try {
+      outcome = applyEntry(entry, { run, paths, configDir });
+      if (entry.host === "codex" && outcome.status === "updated") {
+        const agents = refreshCodexAgents(run, paths.codexHome);
+        if (!agents.ok)
+          outcome = {
+            ...outcome,
+            status: "failed",
+            reason: `${outcome.reason}; ${agents.note}`,
+            fix: agents.fix
+          };
+        else if (agents.note)
+          outcome = { ...outcome, reason: `${outcome.reason}; ${agents.note}` };
+      }
+    } catch (error) {
+      outcome = {
+        host: entry.host,
+        status: "failed",
+        reason: errorText(error),
+        fix: entry.fix
+      };
+    }
+    if (stopDaemon) {
+      const started = run("codex", ["app-server", "daemon", "start"]).status === 0;
+      outcome = started ? {
+        ...outcome,
+        reason: `${outcome.reason}; app-server daemon stopped and started again`
+      } : {
+        ...outcome,
+        status: "failed",
+        reason: `${outcome.reason}; the app-server daemon did not start again`,
+        fix: "codex app-server daemon start"
+      };
+    }
+    if (entry.host === "opencode") {
+      const servers = running.filter((proc) => proc.host === "opencode" && proc.kind === "daemon");
+      if (servers.length && outcome.status === "updated")
+        outcome = {
+          ...outcome,
+          reason: `${outcome.reason}; restart opencode serve (${servers.map(describe2).join("; ")}) to load it`
         };
-    const verify = entry.host === "codex" ? run("codex", ["plugin", "list", "--json"]) : run("pi", ["list"]);
-    if (verify.status !== 0)
-      return { ok: false, backup, error: `${entry.host}: update verification failed` };
-    if (entry.host === "codex") {
-      let installed = [];
-      try {
-        installed = JSON.parse(verify.stdout).installed ?? [];
-      } catch {}
-      if (!installed.some((plugin) => plugin.name === "workit" && plugin.marketplaceName === "workflow-toolkit" && plugin.version === entry.latest))
-        return { ok: false, backup, error: "Codex did not report the requested Workit version" };
-    }
-    if (entry.host === "pi" && piInstalledVersion(verify.stdout, entry.selector) !== entry.latest)
-      return { ok: false, backup, error: "Pi did not report the requested Workit package version" };
-  }
-  if (plan.cli) {
-    const currentRoot = run("npm", ["root", "--global"]);
-    if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== plan.cli.root)
-      return { ok: false, backup, error: "Global npm location changed; preview again" };
-    const cliBackup = path44.join(backup, "cli-package");
-    cpSync5(path44.join(plan.cli.root, "@brainervirus/workit-cli"), cliBackup, { recursive: true });
-    if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${plan.cli.latest}`]).status !== 0)
-      return {
+    }
+    hosts.push(outcome);
+  }
+  if (hosts.some((entry) => entry.host === "codex" && entry.status === "current")) {
+    let agents;
+    try {
+      agents = refreshCodexAgents(run, paths.codexHome);
+    } catch (error) {
+      agents = {
         ok: false,
-        backup,
-        error: `CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path44.join(cliBackup, "dist/index.js")}`
+        note: `agent refresh failed: ${errorText(error)}`,
+        fix: "workit upgrade --hosts=codex"
       };
-    const installed = object2(path44.join(plan.cli.root, "@brainervirus/workit-cli/package.json"));
-    if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== plan.cli.latest)
-      return {
-        ok: false,
-        backup,
-        error: `CLI update did not verify the requested version; preserved package at ${cliBackup}`
+    }
+    const index = hosts.findIndex((entry) => entry.host === "codex" && entry.status === "current");
+    if (!agents.ok)
+      hosts[index] = {
+        ...hosts[index],
+        status: "failed",
+        reason: agents.note,
+        fix: agents.fix
+      };
+    else if (agents.note)
+      hosts[index] = {
+        ...hosts[index],
+        reason: `${hosts[index].reason}; ${agents.note}`
       };
   }
-  return { ok: true, backup };
+  if (plan.cli)
+    try {
+      hosts.push(applyCli(plan.cli, run, backup));
+    } catch (error) {
+      hosts.push({ host: "cli", status: "failed", reason: errorText(error), fix: CLI_FIX });
+    }
+  return done(backup);
 }
 async function runUpgradeCommand(argv, deps = {}) {
   const out = deps.out ?? process.stdout;
   const flags = new Set(argv);
-  const unknown = argv.filter((arg) => !["--apply", "--confirm", "--json", "--cli", "--preview"].includes(arg) && !arg.startsWith("--hosts="));
+  const unknown = argv.filter((arg) => !["--apply", "--confirm", "--json", "--cli", "--preview", "--yes"].includes(arg) && !arg.startsWith("--hosts="));
   const hostFlag = argv.find((arg) => arg.startsWith("--hosts="))?.slice(8);
   const raw = hostFlag === "none" ? [] : hostFlag?.split(",") ?? HOSTS2;
-  if (unknown.length || raw.some((host) => !HOSTS2.includes(host)) || flags.has("--preview") && flags.has("--apply")) {
-    out.write(`Usage: workit upgrade [--hosts=opencode,cursor,codex,pi|none] [--cli] [--preview | --apply --confirm] [--json]
+  if (unknown.length || raw.some((host) => !HOSTS2.includes(host)) || flags.has("--preview") && (flags.has("--apply") || flags.has("--yes"))) {
+    out.write(USAGE3);
+    return 2;
+  }
+  if (flags.has("--apply") && !flags.has("--confirm")) {
+    out.write(`Apply requires --confirm after reviewing the upgrade preview.
 `);
     return 2;
   }
+  const legacy = flags.has("--apply");
+  const json = flags.has("--json") || legacy;
+  const run = runner(deps);
   const plan = previewUpgrade(raw, deps);
-  if (flags.has("--cli")) {
-    const run = runner(deps);
-    const root = run("npm", ["root", "--global"]);
-    if (root.status !== 0 || !path44.isAbsolute(root.stdout.trim())) {
-      plan.blocked.push("Global npm location could not be verified");
-    } else {
-      const packageFile = path44.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
-      const pkg = object2(packageFile);
-      if (pkg?.name !== "@brainervirus/workit-cli" || lstatSync7(path44.dirname(packageFile)).isSymbolicLink()) {
-        plan.skipped.push({
-          host: "cli",
-          reason: "No managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
-        });
-      } else {
-        const latest = run("npm", ["view", "@brainervirus/workit-cli", "version"]);
-        if (latest.status !== 0 || !/^\d+\.\d+\.\d+$/.test(latest.stdout.trim()))
-          plan.blocked.push("CLI registry version unavailable; existing installation preserved");
-        else if (!versionAtLeast(pkg.version, latest.stdout.trim())) {
-          plan.cli = { latest: latest.stdout.trim(), root: root.stdout.trim() };
-          plan.configDigests[packageFile] = digest2(packageFile);
-        } else
-          plan.skipped.push({ host: "cli", reason: `already current (${pkg.version})` });
-      }
-    }
-    plan.ok = plan.blocked.length === 0;
-  }
+  if (hostFlag === undefined || flags.has("--cli"))
+    planCli(plan, run);
+  plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
   const { home, env } = upgradePaths(deps);
   const permissions = planHostPermissions({
-    hosts: hostFlag === undefined ? [...raw, "claude-code"] : raw,
+    hosts: raw,
     refreshOnly: true,
     shell: false,
     home,
@@ -75133,43 +75218,88 @@ async function runUpgradeCommand(argv, deps = {}) {
     })),
     ...permissions.refused ? { refused: permissions.refused } : {}
   };
-  if (!flags.has("--apply")) {
-    out.write(JSON.stringify(permissions.changes.length ? { ...plan, permissions: permissionPreview } : plan, null, 2) + `
+  const withPermissions = (value) => permissions.changes.length ? { ...value, permissions: permissionPreview } : value;
+  const applyCommand = `workit upgrade ${[...hostFlag === undefined ? [] : [`--hosts=${hostFlag}`], ...flags.has("--cli") ? ["--cli"] : [], "--yes"].join(" ")}`;
+  const nothingChanged = `preview only; nothing changed. Apply with: ${applyCommand}
+`;
+  if (json && !legacy && !flags.has("--yes")) {
+    out.write(JSON.stringify(withPermissions(plan), null, 2) + `
 `);
-    return plan.ok ? 0 : 1;
+    return plan.blocked.length ? 1 : 0;
   }
-  if (!flags.has("--confirm")) {
-    out.write(`Apply requires --confirm after reviewing the upgrade preview.
+  if (!json)
+    out.write(summary(plan, permissions.changes));
+  if (flags.has("--preview")) {
+    out.write(nothingChanged);
+    return plan.blocked.length ? 1 : 0;
+  }
+  if (plan.blocked.length) {
+    out.write(`Upgrade blocked: ${plan.blocked.join("; ")}
+Nothing changed.
 `);
-    return 2;
+    return 1;
   }
-  for (const warning of plan.warnings ?? [])
-    out.write(`warning: ${warning}
+  const work = plan.entries.length + plan.migrations.length + (plan.cli ? 1 : 0) + permissions.changes.length;
+  if (work > 0 && !flags.has("--yes") && !legacy) {
+    const confirmed = await (deps.confirm ?? ((q) => askConfirm(q, out)))("Apply this upgrade? [y/N] ");
+    if (!confirmed) {
+      out.write(nothingChanged);
+      return 0;
+    }
+  }
+  if (json)
+    for (const warning of plan.warnings ?? [])
+      out.write(`warning: ${warning}
 `);
   const result = applyUpgrade(plan, deps);
-  if (!result.ok || permissions.changes.length === 0) {
-    out.write(JSON.stringify(result, null, 2) + `
-`);
-    return result.ok ? 0 : 1;
+  let permissionsOk = true;
+  let written;
+  if (permissions.changes.length && !permissions.refused && !result.error?.startsWith("configuration changed")) {
+    written = applyHostPermissions(permissions, { home, env });
+    permissionsOk = written.every((entry) => entry.status === "written");
+    for (const entry of written)
+      result.hosts.push({
+        host: entry.host,
+        status: entry.status === "written" ? "updated" : "failed",
+        reason: `permission block ${entry.status === "written" ? "refreshed" : entry.status} in ${entry.file}`,
+        ...entry.status === "written" ? {} : { fix: `workit setup --hosts=${entry.host}` }
+      });
   }
-  if (permissions.refused) {
-    out.write(JSON.stringify({ ...result, permissions: permissionPreview }, null, 2) + `
+  const failed = !result.ok || !permissionsOk;
+  const cliVersion = result.hosts.some((h) => h.host === "cli" && h.status === "updated") ? plan.cli.latest : package_default.version;
+  const report = (deps.doctor ?? ((version) => runDoctor({ home, env, cliVersion: version, only: "upgrade" })))(cliVersion);
+  const left = report.checks.filter((check) => check.status === "warn" || check.status === "fail");
+  if (json) {
+    out.write(JSON.stringify({
+      ...result,
+      ok: !failed,
+      ...written ? { permissions: { changes: permissionPreview.changes, written } } : permissions.refused ? { permissions: permissionPreview } : {},
+      doctor: { clean: left.length === 0, left }
+    }, null, 2) + `
 `);
-    return 0;
+    return failed ? 1 : 0;
   }
-  const written = applyHostPermissions(permissions, { home, env });
-  const permissionsOk = written.every((entry) => entry.status === "written");
-  out.write(JSON.stringify({
-    ...result,
-    ok: permissionsOk,
-    permissions: { changes: permissionPreview.changes, written }
-  }, null, 2) + `
+  if (result.error && result.hosts.every((h) => h.status !== "failed"))
+    out.write(`Upgrade stopped: ${result.error}
+`);
+  out.write(table(result.hosts));
+  if (permissions.refused)
+    out.write(`permissions: not refreshed: ${permissions.refused}
+`);
+  if (result.backup)
+    out.write(`Backup: ${result.backup}
 `);
-  return permissionsOk ? 0 : 1;
+  out.write(left.length === 0 ? `Verified: workit doctor is clean for versions, assets, agents and permissions.
+` : `Left after upgrade (workit doctor):
+${left.map((check) => `  ${check.id}: ${check.detail}${check.fix ? `
+    fix: ${check.fix}` : ""}`).join(`
+`)}
+`);
+  return failed ? 1 : 0;
 }
 async function runLaunchCommand(argv, deps = {}) {
   const [host, ...args] = argv;
-  if (!HOSTS2.includes(host)) {
+  if (!LAUNCH_HOSTS.includes(host)) {
     (deps.out ?? process.stdout).write(`Usage: workit launch <opencode|cursor|codex|pi> [--auto-upgrade] [-- host arguments]
 `);
     return 2;
@@ -75190,9 +75320,10 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (auto) {
     const plan = previewUpgrade([host], deps);
+    const reasons = [...plan.blocked, ...plan.failed.map((entry) => entry.reason)];
     if (plan.ok) {
       for (const skipped of plan.skipped)
-        (deps.out ?? process.stderr).write(`${skipped.host}: ${skipped.reason}
+        (deps.out ?? process.stderr).write(`${skipped.host}: ${skipped.reason}${skipped.fix ? ` (run: ${skipped.fix})` : ""}
 `);
       const result = applyUpgrade(plan, deps);
       if (!result.ok) {
@@ -75200,11 +75331,11 @@ async function runLaunchCommand(argv, deps = {}) {
 `);
         return 1;
       }
-    } else if (plan.blocked.every((reason) => reason.includes("registry version unavailable"))) {
-      (deps.out ?? process.stderr).write(`Upgrade unavailable: ${plan.blocked.join("; ")}. Starting the unchanged host.
+    } else if (plan.blocked.length === 0 && reasons.every((reason) => reason.includes("registry version unavailable"))) {
+      (deps.out ?? process.stderr).write(`Upgrade unavailable: ${reasons.join("; ")}. Starting the unchanged host.
 `);
     } else {
-      (deps.out ?? process.stderr).write(`Upgrade blocked: ${plan.blocked.join("; ")}
+      (deps.out ?? process.stderr).write(`Upgrade blocked: ${reasons.join("; ")}
 `);
       return 1;
     }
@@ -75216,13 +75347,14 @@ async function runLaunchCommand(argv, deps = {}) {
     env
   }).status ?? 1;
 }
-var HOSTS2, upgradePaths = (deps) => {
+var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-opencode", OPENCODE_UPDATE, CODEX_MARKETPLACE = "workflow-toolkit", CLI_FIX = "npm install --global @brainervirus/workit-cli@latest", fixFor = (host, selector = "") => host === "pi" ? `pi update --extension ${selector || "npm:@brainervirus/workit-pi"}` : host === "codex" ? `codex plugin marketplace upgrade ${CODEX_MARKETPLACE} && codex plugin add workit@${CODEX_MARKETPLACE}` : host === "claude-code" ? "claude plugin marketplace update workit && claude plugin update workit@workit" : host === "opencode" ? OPENCODE_UPDATE : host === "cursor" ? "workit upgrade --hosts=cursor" : CLI_FIX, upgradePaths = (deps) => {
   const home = deps.home ?? deps.env?.HOME ?? os16.homedir();
   const env = {
     ...process.env,
     ...deps.home || deps.env?.HOME ? {
       HOME: home,
       CODEX_HOME: path44.join(home, ".codex"),
+      CLAUDE_CONFIG_DIR: path44.join(home, ".claude"),
       PI_CODING_AGENT_DIR: path44.join(home, ".pi/agent"),
       XDG_CONFIG_HOME: path44.join(home, ".config"),
       WORKFLOW_TOOLKIT_CONFIG: undefined,
@@ -75232,13 +75364,16 @@ var HOSTS2, upgradePaths = (deps) => {
     HOME: home
   };
   const xdg = env.XDG_CONFIG_HOME || path44.join(home, ".config");
+  const codexHome = env.CODEX_HOME ?? path44.join(home, ".codex");
   return {
     home,
     env,
     configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path44.join(xdg, "workit"),
     opencodeConfig: path44.join(xdg, "opencode/opencode.json"),
     piSettings: path44.join(env.PI_CODING_AGENT_DIR ?? path44.join(home, ".pi/agent"), "settings.json"),
-    codexConfig: path44.join(env.CODEX_HOME ?? path44.join(home, ".codex"), "config.toml")
+    codexHome,
+    codexConfig: path44.join(codexHome, "config.toml"),
+    cursorRoot: path44.join(home, ".cursor/plugins/local/workit")
   };
 }, object2 = (file) => {
   if (!existsSync20(file))
@@ -75252,6 +75387,12 @@ var HOSTS2, upgradePaths = (deps) => {
   if (!data || typeof data !== "object" || Array.isArray(data))
     throw new Error(`${file} is not a configuration object`);
   return data;
+}, objectOrNull = (file) => {
+  try {
+    return object2(file);
+  } catch {
+    return null;
+  }
 }, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync21(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
@@ -75266,48 +75407,85 @@ var HOSTS2, upgradePaths = (deps) => {
   host,
   selector,
   kind: selector === `@brainervirus/workit-${host}` || selector === `@brainervirus/workit-${host}@latest` || selector === `npm:@brainervirus/workit-${host}` || selector === `npm:@brainervirus/workit-${host}@latest` ? "floating" : new RegExp(`^(?:npm:)?@brainervirus/workit-${host}@[^/]+$`).test(selector) ? "pinned" : "local"
-}), sources = (paths, run, hosts) => {
-  const { home, opencodeConfig, piSettings } = paths;
+}), errorText = (error) => error instanceof Error ? error.message : "installed source could not be read", sources = (paths, run, hosts, failed) => {
+  const { home } = paths;
   const result = [];
-  if (hosts.includes("opencode") && existsSync20(opencodeConfig + "c"))
-    throw new Error("OpenCode JSONC config is present; inspect effective native configuration before updating");
-  const oc = hosts.includes("opencode") ? object2(opencodeConfig) : null;
-  if (oc && [oc.plugins, oc.plugin].some((value) => value !== undefined && !Array.isArray(value)))
-    throw new Error("OpenCode plugin registrations must be arrays");
-  const plugins = [...oc?.plugins ?? [], ...oc?.plugin ?? []];
-  for (const pin of plugins)
-    if (typeof pin === "string" && isWorkitPlugin(pin))
-      result.push(classify("opencode", pin));
-  const cursor = hosts.includes("cursor") ? object2(path44.join(home, ".cursor/plugins/local/workit/package.json")) : null;
-  if (cursor?.name === "@brainervirus/workit-cursor") {
-    const mcp = object2(path44.join(home, ".cursor/mcp.json"));
-    const args = mcp?.mcpServers?.workit?.args ?? [];
-    const selector = args.find((arg) => typeof arg === "string" && arg.startsWith("--package="));
-    result.push(classify("cursor", typeof selector === "string" ? selector.slice(10) : "local"));
-  }
-  const pi = hosts.includes("pi") ? object2(piSettings) : null;
-  if (pi?.packages !== undefined && !Array.isArray(pi.packages))
-    throw new Error("Pi package registrations must be an array");
-  for (const entry of pi?.packages ?? []) {
-    const source = typeof entry === "string" ? entry : entry?.source;
-    if (typeof source !== "string")
-      continue;
-    const npm = /^(?:npm:)?@brainervirus\/workit-pi(?:@[^/]+)?$/.test(source);
-    const local = path44.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path44.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
-    if (npm || local)
-      result.push(classify("pi", source));
-  }
-  const listing = hosts.includes("codex") ? run("codex", ["plugin", "list", "--json"]) : { status: 1, stdout: "" };
-  if (hosts.includes("codex") && listing.status !== 0) {
-    let available = false;
+  const guard = (host, read) => {
+    if (!hosts.includes(host))
+      return;
     try {
-      hostCommand("codex", [], { home, env: paths.env });
-      available = true;
-    } catch {}
-    if (available || existsSync20(paths.codexConfig))
-      throw new Error("Codex plugin inventory failed; inspect the native host before upgrading");
-  }
-  if (listing.status === 0) {
+      read();
+    } catch (error) {
+      failed.push({
+        host,
+        status: "failed",
+        reason: errorText(error),
+        fix: fixFor(host)
+      });
+    }
+  };
+  guard("opencode", () => {
+    if (existsSync20(paths.opencodeConfig + "c"))
+      throw new Error("OpenCode JSONC config is present; inspect effective native configuration before updating");
+    const oc = object2(paths.opencodeConfig);
+    if (oc && [oc.plugins, oc.plugin].some((value) => value !== undefined && !Array.isArray(value)))
+      throw new Error("OpenCode plugin registrations must be arrays");
+    for (const pin of [...oc?.plugins ?? [], ...oc?.plugin ?? []])
+      if (typeof pin === "string" && isWorkitPlugin(pin))
+        result.push(classify("opencode", pin));
+  });
+  guard("cursor", () => {
+    const cursor = objectOrNull(path44.join(paths.cursorRoot, "package.json"));
+    const mcp = objectOrNull(path44.join(home, ".cursor/mcp.json"));
+    const args = mcp?.mcpServers?.workit?.args ?? [];
+    const arg = args.find((value) => typeof value === "string" && value.startsWith("--package="));
+    const selector = typeof arg === "string" ? arg.slice(10) : "local";
+    if (cursor?.name === "@brainervirus/workit-cursor") {
+      result.push({
+        ...classify("cursor", selector),
+        installedVersion: cursor.version
+      });
+      return;
+    }
+    const settings = objectOrNull(path44.join(home, ".cursor/settings.json"));
+    const dirs = Array.isArray(settings?.plugin_dirs) ? settings.plugin_dirs : [];
+    const registered = mcp?.mcpServers?.workit !== undefined || dirs.some((dir) => String(dir).replaceAll("\\", "/").replace(/\/+$/, "").endsWith("local/workit"));
+    if (registered)
+      result.push({ host: "cursor", selector, kind: "repair" });
+  });
+  guard("pi", () => {
+    const pi = object2(paths.piSettings);
+    if (pi?.packages !== undefined && !Array.isArray(pi.packages))
+      throw new Error("Pi package registrations must be an array");
+    for (const entry of pi?.packages ?? []) {
+      const source = typeof entry === "string" ? entry : entry?.source;
+      if (typeof source !== "string")
+        continue;
+      const npm = /^(?:npm:)?@brainervirus\/workit-pi(?:@[^/]+)?$/.test(source);
+      const local = path44.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path44.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
+      if (!npm && !local)
+        continue;
+      const found = classify("pi", source);
+      if (found.kind === "floating") {
+        const inventory = run("pi", ["list"]);
+        if (inventory.status === 0)
+          found.installedVersion = piInstalledVersion(inventory.stdout, source);
+      }
+      result.push(found);
+    }
+  });
+  guard("codex", () => {
+    const listing = run("codex", ["plugin", "list", "--json"]);
+    if (listing.status !== 0) {
+      let available = false;
+      try {
+        hostCommand("codex", [], { home, env: paths.env });
+        available = true;
+      } catch {}
+      if (available || existsSync20(paths.codexConfig))
+        throw new Error("Codex plugin inventory failed; inspect the native host before upgrading");
+      return;
+    }
     let installed;
     try {
       installed = JSON.parse(listing.stdout).installed ?? [];
@@ -75320,30 +75498,30 @@ var HOSTS2, upgradePaths = (deps) => {
       if (plugin.name !== "workit")
         continue;
       const source = plugin.source;
-      const npm = plugin.marketplaceName === "workflow-toolkit" && source?.source === "npm" && source?.package === "@brainervirus/workit-codex";
+      const npm = plugin.marketplaceName === CODEX_MARKETPLACE && source?.source === "npm" && source?.package === "@brainervirus/workit-codex";
       result.push({
         ...classify("codex", npm ? `${source.package}${source.version ? `@${source.version}` : ""}` : "local"),
         installedVersion: plugin.version
       });
     }
-  }
-  for (const source of result) {
-    if (source.host === "cursor")
-      source.installedVersion = cursor?.version;
-    if (source.host === "pi" && source.kind === "floating") {
-      const inventory = run("pi", ["list"]);
-      if (inventory.status === 0)
-        source.installedVersion = piInstalledVersion(inventory.stdout, source.selector);
-    }
-  }
+  });
+  guard("claude-code", () => {
+    for (const install of claudeWorkitInstalls(home, paths.env, null))
+      result.push({
+        host: "claude-code",
+        selector: install.id,
+        kind: "floating",
+        installedVersion: install.version ?? undefined
+      });
+  });
   return result;
 }, piInstalledVersion = (listing, selector) => {
   const lines = listing.split(/\r?\n/).map((line) => line.trim());
   const index = lines.indexOf(selector);
   if (index < 0 || !lines[index + 1] || !path44.isAbsolute(lines[index + 1]))
     return;
-  const pkg = object2(path44.join(lines[index + 1], "package.json"));
-  return pkg?.name === "@brainervirus/workit-pi" ? pkg.version : undefined;
+  const found = objectOrNull(path44.join(lines[index + 1], "package.json"));
+  return found?.name === "@brainervirus/workit-pi" ? found.version : undefined;
 }, versionAtLeast = (installed, latest) => {
   if (!/^\d+\.\d+\.\d+$/.test(installed))
     return false;
@@ -75354,14 +75532,273 @@ var HOSTS2, upgradePaths = (deps) => {
       return current[index] > target[index];
   }
   return true;
-}, runningHosts = (deps) => {
+}, opencodeProbe = (deps, args) => {
+  const scratch = mkdtempSync3(path44.join(os16.tmpdir(), "workit-upgrade-opencode-"));
+  try {
+    return runner({
+      ...deps,
+      env: {
+        ...deps.env,
+        XDG_DATA_HOME: path44.join(scratch, "data"),
+        XDG_STATE_HOME: path44.join(scratch, "state"),
+        XDG_CACHE_HOME: path44.join(scratch, "cache")
+      }
+    })("opencode", args);
+  } finally {
+    rmSync8(scratch, { recursive: true, force: true });
+  }
+}, registryVersion = (run, name) => {
+  const latest = run("npm", ["view", name, "version"]);
+  const version = latest.stdout.trim();
+  return latest.status === 0 && /^\d+\.\d+\.\d+$/.test(version) ? version : undefined;
+}, PROCESS_HOSTS, classifyProcess = (proc) => {
+  if (proc.state.startsWith("Z") || proc.args.includes("<defunct>"))
+    return null;
+  const argv0 = proc.args.trim().split(/\s+/)[0] ?? "";
+  const name = path44.basename(argv0.replaceAll("\\", "/")).replace(/^\[|\]$/g, "").replace(/\.exe$/i, "").toLowerCase();
+  const host = PROCESS_HOSTS[name];
+  if (!host)
+    return null;
+  if (host === "codex" && /\bapp-server\b/.test(proc.args))
+    return /\bdaemon\s+pid-update-loop\b/.test(proc.args) ? null : { ...proc, host, kind: "daemon" };
+  if (host === "opencode" && /\bserve\b/.test(proc.args))
+    return { ...proc, host, kind: "daemon" };
+  return { ...proc, host, kind: "session" };
+}, listProcesses = (deps) => {
+  if (deps.processes)
+    return deps.processes();
+  if (deps.activeHosts)
+    return deps.activeHosts().map((host) => ({ pid: 0, state: "S", args: host }));
   const run = runner(deps);
-  const list = process.platform === "win32" ? run("tasklist", ["/fo", "csv", "/nh"]) : run("ps", ["-eo", "comm="]);
+  if (process.platform === "win32") {
+    const list = run("tasklist", ["/fo", "csv", "/nh"]);
+    if (list.status !== 0)
+      return null;
+    return list.stdout.split(/\r?\n/).flatMap((line) => {
+      const [image, pid] = line.split('","').map((cell) => cell.replaceAll('"', ""));
+      return image && /^\d+$/.test(pid ?? "") ? [{ pid: Number(pid), state: "R", args: image }] : [];
+    });
+  }
+  const list = run("ps", ["-eo", "pid=,stat=,args="]);
   if (list.status !== 0)
-    return HOSTS2;
-  return HOSTS2.filter((host) => new RegExp(`(?:^|[\\/",\\s])${host}(?:\\.exe)?(?:[",\\s]|$)`, "im").test(list.stdout));
-};
+    return null;
+  return list.stdout.split(/\r?\n/).flatMap((line) => {
+    const match = /^\s*(\d+)\s+(\S+)\s+(.+)$/.exec(line);
+    return match ? [{ pid: Number(match[1]), state: match[2], args: match[3] }] : [];
+  });
+}, describe2 = (proc) => `pid ${proc.pid}: ${proc.args.length > 120 ? `${proc.args.slice(0, 117)}...` : proc.args}`, codexPluginRoot = (codexHome) => {
+  const dir = path44.join(codexHome, "plugins", "cache", CODEX_MARKETPLACE, "workit");
+  let versions = [];
+  try {
+    versions = readdirSync12(dir).filter((version) => /^\d+\.\d+\.\d+$/.test(version));
+  } catch {
+    return null;
+  }
+  const newest = versions.reduce((best, version) => best && versionAtLeast(best, version) ? best : version, null);
+  return newest ? path44.join(dir, newest) : null;
+}, applyEntry = (entry, context) => {
+  const { run, paths, configDir } = context;
+  const { home, env } = paths;
+  const fail = (reason) => ({
+    host: entry.host,
+    status: "failed",
+    reason,
+    fix: entry.fix
+  });
+  if (entry.host === "cursor") {
+    const preview = {
+      ok: true,
+      blocked: [],
+      preserved: [],
+      overrides: [],
+      platforms: ["cursor"],
+      state: readSetupState(configDir),
+      mutations: [
+        {
+          type: "install-host",
+          platform: "cursor",
+          path: path44.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
+          commands: entry.commands.map((command) => ({
+            ...command,
+            purpose: command.purpose ?? "Upgrade Cursor"
+          }))
+        },
+        { type: "install-adapter", platform: "cursor", path: paths.cursorRoot }
+      ]
+    };
+    const result = applySetupPreview(preview, {
+      home,
+      env,
+      cwd: home,
+      preferInstalledAdapter: true,
+      runHostCommand: (command) => {
+        const outcome = run(command.command, command.args);
+        return {
+          exitCode: outcome.status ?? 1,
+          stdout: outcome.stdout,
+          stderr: ""
+        };
+      }
+    });
+    const installed = objectOrNull(path44.join(paths.cursorRoot, "package.json"));
+    if (!result.ok || installed?.version !== entry.latest)
+      return fail("Cursor install did not verify the requested package version; inspect the installer before retrying");
+    return {
+      host: "cursor",
+      status: "updated",
+      reason: entry.repair ? `reinstalled missing plugin files (${entry.latest})` : `${entry.installedVersion ?? "?"} -> ${entry.latest}`
+    };
+  }
+  for (const command of entry.commands)
+    if (run(command.command, command.args).status !== 0)
+      return fail(`\`${command.command} ${command.args.join(" ")}\` failed`);
+  if (entry.host === "opencode")
+    return {
+      host: "opencode",
+      status: "updated",
+      reason: "scoped update ran; OpenCode V2 loads it live"
+    };
+  if (entry.host === "claude-code") {
+    const after = claudeWorkitInstalls(home, env, null).find((install) => install.id === entry.selector)?.version;
+    return after && after === entry.installedVersion ? {
+      host: "claude-code",
+      status: "current",
+      reason: `already current (${after})`
+    } : {
+      host: "claude-code",
+      status: "updated",
+      reason: `${entry.installedVersion ?? "?"} -> ${after ?? "?"}; new sessions load it`
+    };
+  }
+  const verify = entry.host === "codex" ? run("codex", ["plugin", "list", "--json"]) : run("pi", ["list"]);
+  if (verify.status !== 0)
+    return fail("update verification failed");
+  if (entry.host === "codex") {
+    let installed = [];
+    try {
+      installed = JSON.parse(verify.stdout).installed ?? [];
+    } catch {}
+    if (!installed.some((plugin) => plugin.name === "workit" && plugin.marketplaceName === CODEX_MARKETPLACE && plugin.version === entry.latest))
+      return fail("Codex did not report the requested Workit version");
+  }
+  if (entry.host === "pi" && piInstalledVersion(verify.stdout, entry.selector) !== entry.latest)
+    return fail("Pi did not report the requested Workit package version");
+  return {
+    host: entry.host,
+    status: "updated",
+    reason: `${entry.installedVersion ?? "?"} -> ${entry.latest}`
+  };
+}, refreshCodexAgents = (run, codexHome) => {
+  const root = codexPluginRoot(codexHome);
+  const launcher = root && path44.join(root, "dist", "launch-mcp.js");
+  if (!launcher || !existsSync20(launcher))
+    return { ok: true, note: "" };
+  const fix = `node ${JSON.stringify(launcher)} --install-agents`;
+  return run("node", [launcher, "--install-agents"]).status === 0 ? { ok: true, note: "agents refreshed" } : { ok: false, note: "agent refresh failed", fix };
+}, applyCli = (cli, run, backup) => {
+  const fail = (reason) => ({
+    host: "cli",
+    status: "failed",
+    reason,
+    fix: CLI_FIX
+  });
+  const currentRoot = run("npm", ["root", "--global"]);
+  if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== cli.root)
+    return fail("Global npm location changed; preview again");
+  const cliBackup = path44.join(backup, "cli-package");
+  cpSync5(path44.join(cli.root, "@brainervirus/workit-cli"), cliBackup, {
+    recursive: true
+  });
+  if (run("npm", ["install", "--global", `@brainervirus/workit-cli@${cli.latest}`]).status !== 0)
+    return fail(`CLI update failed; preserved package at ${cliBackup}; use npm to repair or run node ${path44.join(cliBackup, "dist/index.js")}`);
+  const installed = objectOrNull(path44.join(cli.root, "@brainervirus/workit-cli/package.json"));
+  if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== cli.latest)
+    return fail(`CLI update did not verify the requested version; preserved package at ${cliBackup}`);
+  return {
+    host: "cli",
+    status: "updated",
+    reason: `${cli.installed} -> ${cli.latest}`
+  };
+}, planCli = (plan, run) => {
+  const root = run("npm", ["root", "--global"]);
+  if (root.status !== 0 || !path44.isAbsolute(root.stdout.trim())) {
+    plan.skipped.push({
+      host: "cli",
+      reason: "global npm location could not be verified",
+      fix: CLI_FIX
+    });
+    return;
+  }
+  const packageFile = path44.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
+  const installed = objectOrNull(packageFile);
+  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync7(path44.dirname(packageFile)).isSymbolicLink()) {
+    plan.skipped.push({
+      host: "cli",
+      reason: "no managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
+    });
+    return;
+  }
+  const latest = registryVersion(run, "@brainervirus/workit-cli");
+  if (!latest)
+    plan.failed.push({
+      host: "cli",
+      status: "failed",
+      reason: "CLI registry version unavailable; existing installation preserved",
+      fix: CLI_FIX
+    });
+  else if (!versionAtLeast(installed.version, latest)) {
+    plan.cli = {
+      latest,
+      root: root.stdout.trim(),
+      installed: installed.version
+    };
+    plan.configDigests[packageFile] = digest2(packageFile);
+  } else
+    plan.skipped.push({
+      host: "cli",
+      reason: `already current (${installed.version})`
+    });
+}, pad2 = (text) => text.padEnd(12), summary = (plan, permissions) => {
+  const lines = ["Workit upgrade plan:"];
+  if (plan.cli)
+    lines.push(`  ${pad2("cli")}update ${plan.cli.installed} -> ${plan.cli.latest}`);
+  for (const entry of plan.entries) {
+    const what = entry.repair ? `reinstall missing plugin files (${entry.latest})` : entry.latest ? `update ${entry.installedVersion ?? "?"} -> ${entry.latest}` : `update (${entry.commands.map((c) => `${c.command} ${c.args.join(" ")}`).join(" && ")})`;
+    lines.push(`  ${pad2(entry.host)}${what}`);
+  }
+  for (const skipped of plan.skipped)
+    lines.push(`  ${pad2(skipped.host)}${skipped.reason.startsWith("already current") ? "" : "skip: "}${skipped.reason}${skipped.fix ? ` (run: ${skipped.fix})` : ""}`);
+  for (const failed of plan.failed)
+    lines.push(`  ${pad2(failed.host)}cannot upgrade: ${failed.reason}${failed.fix ? ` (run: ${failed.fix})` : ""}`);
+  for (const migration of plan.migrations)
+    lines.push(`  ${pad2("config")}${migration.description}`);
+  for (const change of permissions)
+    lines.push(`  ${pad2("permissions")}refresh the ${change.host} block in ${change.file}`);
+  for (const blocked of plan.blocked)
+    lines.push(`  blocked: ${blocked}`);
+  for (const warning of plan.warnings ?? [])
+    lines.push(`  warning: ${warning}`);
+  return lines.join(`
+`) + `
+`;
+}, LABEL, table = (hosts) => [
+  "Result:",
+  ...hosts.map((entry) => `  ${pad2(entry.host)}${LABEL[entry.status].padEnd(16)}${entry.reason}${entry.fix && entry.status !== "updated" && entry.status !== "current" ? `
+  ${pad2("")}${"".padEnd(16)}fix: ${entry.fix}` : ""}`)
+].join(`
+`) + `
+`, askConfirm = async (question, out) => {
+  if (!process.stdin.isTTY) {
+    out.write(`Not a terminal: rerun with --yes to apply.
+`);
+    return false;
+  }
+  await Promise.resolve().then(() => init_prompt());
+  return /^y(?:es)?$/i.test((await askLine(question)).trim());
+}, USAGE3 = `Usage: workit upgrade [--hosts=opencode,cursor,codex,pi,claude-code|none] [--cli] [--preview | --yes | --apply --confirm] [--json]
+`;
 var init_upgrade = __esm(() => {
+  init_package();
   init_registration();
   init_setup_state();
   init_host_install();
@@ -75370,7 +75807,23 @@ var init_upgrade = __esm(() => {
   init_support_matrix();
   init_safe_write();
   init_host_permissions();
-  HOSTS2 = ["opencode", "cursor", "codex", "pi"];
+  LAUNCH_HOSTS = ["opencode", "cursor", "codex", "pi"];
+  HOSTS2 = [...LAUNCH_HOSTS, "claude-code"];
+  LIVE_HOSTS = new Set(["opencode", "claude-code"]);
+  OPENCODE_UPDATE = `opencode plugin update ${OPENCODE_PACKAGE}`;
+  PROCESS_HOSTS = {
+    claude: "claude-code",
+    codex: "codex",
+    cursor: "cursor",
+    opencode: "opencode",
+    pi: "pi"
+  };
+  LABEL = {
+    updated: "updated",
+    current: "already current",
+    skipped: "skipped",
+    failed: "FAILED"
+  };
 });
 
 // packages/workit-cli/src/verbs/upgrade.ts
@@ -76337,7 +76790,7 @@ function show(argv, io) {
       return emit(io, fail2("not_found", `no workspace named "${named[0]}" in ${listed.path}`));
     return emit(io, ok2({ path: listed.path, defaults: DEFAULT_GRANTS, workspaces: rows }), () => rows.flatMap((entry) => [
       `${entry.name} (${entry.glob})`,
-      ...describe2(entry.grants, entry.configured, entry, entry.verification),
+      ...describe3(entry.grants, entry.configured, entry, entry.verification),
       ...endpointMismatch({ ...entry, workspace: entry.name }) ? [`note: ${endpointMismatch({ ...entry, workspace: entry.name })}`] : []
     ]));
   }
@@ -76358,7 +76811,7 @@ function show(argv, io) {
     ...data.note ? [`note: ${data.note}`] : [],
     ...tierModelIssues.map((issue) => `note: ${issue}`),
     data.workspace ? `workspace ${data.workspace} (${data.source === "default" ? "D4 defaults" : `from ${data.source}`})` : "no workspace matches this checkout: D4 defaults apply",
-    ...describe2(data.grants, data.configured, data, data.verification),
+    ...describe3(data.grants, data.configured, data, data.verification),
     ...endpointMismatch(data) ? [`note: ${endpointMismatch(data)}`] : [],
     ...describeReleaseTracks(tracks).map((line) => `  ${line}`),
     "raising a grant needs the user: workit grant set <workspace> <kind>=<value>"
@@ -76433,7 +76886,7 @@ async function change(verb, argv, io, deps) {
     return emit(io, fail2(written.code, written.error));
   return emit(io, ok2(written), (data) => [
     `${data.workspace}: grants updated in ${data.path}${data.backup ? ` (previous copy: ${data.backup})` : ""}`,
-    ...describe2(data.grants, data.configured, data, data.verification)
+    ...describe3(data.grants, data.configured, data, data.verification)
   ]);
 }
 async function runGrant(argv, io, deps = defaultDeps) {
@@ -76447,13 +76900,13 @@ async function runGrant(argv, io, deps = defaultDeps) {
     return change(sub, rest, io, deps);
   return usage2(io, `unknown subcommand "${sub}"`);
 }
-var USAGE3 = "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr|green|merged] [verification=proportional|self|independent] | grant unset <workspace> <kind>…  (kinds: push, pr, merge, release, rerun, defaultEndpoint, verification)", AGENT_ENV, agentMarker = (env) => AGENT_ENV.find((name) => env[name]) ?? Object.keys(env).find((name) => name.startsWith("CODEX_") && env[name]), defaultDeps, parseValue = (raw) => raw === "true" || raw === "yes" || raw === "on" ? true : raw === "false" || raw === "no" || raw === "off" ? false : raw === "verified" ? "verified" : null, STOPS_AT, endpointLabel = (view) => view.effectiveEndpoint === view.defaultEndpoint ? view.defaultEndpoint : `${view.defaultEndpoint} (effective: ${view.effectiveEndpoint}${view.endpointReason ? `, ${view.endpointReason}` : ""})`, VERIFICATION_STRICTNESS, VERIFICATION_TEXT, describe2 = (grants, configured, endpoint, verification) => [
+var USAGE4 = "workit grant show [<workspace>] [--all] | grant set <workspace> <kind>=<true|false|verified>… [defaultEndpoint=commit|pr|green|merged] [verification=proportional|self|independent] | grant unset <workspace> <kind>…  (kinds: push, pr, merge, release, rerun, defaultEndpoint, verification)", AGENT_ENV, agentMarker = (env) => AGENT_ENV.find((name) => env[name]) ?? Object.keys(env).find((name) => name.startsWith("CODEX_") && env[name]), defaultDeps, parseValue = (raw) => raw === "true" || raw === "yes" || raw === "on" ? true : raw === "false" || raw === "no" || raw === "off" ? false : raw === "verified" ? "verified" : null, STOPS_AT, endpointLabel = (view) => view.effectiveEndpoint === view.defaultEndpoint ? view.defaultEndpoint : `${view.defaultEndpoint} (effective: ${view.effectiveEndpoint}${view.endpointReason ? `, ${view.endpointReason}` : ""})`, VERIFICATION_STRICTNESS, VERIFICATION_TEXT, describe3 = (grants, configured, endpoint, verification) => [
   ...GRANT_KINDS.map((kind) => `  ${kind.padEnd(8)}${String(grants[kind]).padEnd(10)}${configured.includes(kind) ? "configured" : "default"}${kind === "release" ? " (workit git push --release: git-flow main and develop, landed release tags)" : ""}`),
   `  default endpoint: ${endpointLabel(endpoint)} (an unnamed request stops at ${STOPS_AT[endpoint.effectiveEndpoint]})`,
   ...endpoint.endpointIssue ? [`  note: ${endpoint.endpointIssue}`] : [],
   `  verification: ${verification} (${VERIFICATION_TEXT[verification]})`
 ], usage2 = (io, message) => emit(io, fail2("invalid_input", `${message}
-usage: ${USAGE3}`)), run10 = (argv, io) => runGrant(argv, io);
+usage: ${USAGE4}`)), run10 = (argv, io) => runGrant(argv, io);
 var init_grant = __esm(() => {
   init_autonomy();
   init_release_tracks();
@@ -76668,7 +77121,7 @@ async function runWorkspace(argv, io) {
     return set2(rest, io);
   return usage3(io, `unknown subcommand "${sub}"`);
 }
-var USAGE4 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>…", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
+var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>…", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
   grants: { ...DEFAULT_GRANTS, ...configuredGrants(entry).grants },
   endpoint: isDefaultEndpoint(entry?.defaultEndpoint) ? entry.defaultEndpoint : DEFAULT_ENDPOINT,
   verification: verificationOf(entry)
@@ -76693,7 +77146,7 @@ var USAGE4 = "workit workspace list | workspace add <name> --glob <g> [--from <p
     ...looser(shadowed.verification, DEFAULT_VERIFICATION) ? { verification: shadowed.verification } : {}
   };
 }, usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
-usage: ${USAGE4}`)), load = (io) => {
+usage: ${USAGE5}`)), load = (io) => {
   const current = readWorkspacesResult();
   if (current.status === "malformed" || current.status === "invalid")
     return emit(io, fail2("invalid_input", current.error ?? `${current.path} is invalid`));
@@ -77939,7 +78392,7 @@ async function prepareHeavy(io, settings, label, runCwd, timeoutMs) {
 async function run12(argv, io) {
   const options = parse6(argv);
   if (options instanceof Error)
-    return emit(io, fail2("invalid_input", options.message, { unblock: USAGE5 }));
+    return emit(io, fail2("invalid_input", options.message, { unblock: USAGE6 }));
   const config = loadCheckConfig(io.cwd);
   if (config.note)
     io.stderr(`note: ${config.note}
@@ -77950,7 +78403,7 @@ async function run12(argv, io) {
   let name = options.name;
   if (options.command === null) {
     if (options.positionals.length !== 1 || options.name || options.shell)
-      return emit(io, fail2("invalid_input", "pass a check name, or a command after --", { unblock: USAGE5 }));
+      return emit(io, fail2("invalid_input", "pass a check name, or a command after --", { unblock: USAGE6 }));
     name = options.positionals[0];
     if (config.error)
       return emit(io, fail2("invalid_input", `check config is invalid: ${config.error}`));
@@ -77965,11 +78418,11 @@ async function run12(argv, io) {
   } else {
     if (options.positionals.length)
       return emit(io, fail2("invalid_input", `unexpected argument ${options.positionals[0]} before --`, {
-        unblock: USAGE5
+        unblock: USAGE6
       }));
     command = options.command;
     if (!command.length)
-      return emit(io, fail2("invalid_input", "no command after --", { unblock: USAGE5 }));
+      return emit(io, fail2("invalid_input", "no command after --", { unblock: USAGE6 }));
     if (options.shell && command.length !== 1)
       return emit(io, fail2("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
@@ -78150,7 +78603,7 @@ async function run12(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE5 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path50.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, HOST_TOOL_WAIT_CAP_MS = 1e5;
+var USAGE6 = 'workit check <name> [--full] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <s>] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path50.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, HOST_TOOL_WAIT_CAP_MS = 1e5;
 var init_check = __esm(() => {
   init_check_config();
   init_checks3();
@@ -78328,9 +78781,9 @@ async function run13(argv, io) {
     return runHeavy(rest, io);
   if (sub === "heavy")
     return heavy(rest, io);
-  return emit(io, fail2("invalid_input", `unknown lock subcommand ${sub ?? "(none)"}`, { unblock: USAGE6 }));
+  return emit(io, fail2("invalid_input", `unknown lock subcommand ${sub ?? "(none)"}`, { unblock: USAGE7 }));
 }
-var USAGE6 = "workit lock status | wait [--timeout <s>] | run [--shell] [--wait <s>] [--timeout <s>] -- <cmd…> | heavy list|add|remove|test", held = (slots) => slots.filter((slot) => slot.holder && !slot.stale), sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), commandText = (args) => {
+var USAGE7 = "workit lock status | wait [--timeout <s>] | run [--shell] [--wait <s>] [--timeout <s>] -- <cmd…> | heavy list|add|remove|test", held = (slots) => slots.filter((slot) => slot.holder && !slot.stale), sleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), commandText = (args) => {
   const split = args.indexOf("--");
   return (split < 0 ? args : args.slice(split + 1)).join(" ").trim();
 };
@@ -78347,13 +78800,13 @@ var exports_models = {};
 __export(exports_models, {
   run: () => run14
 });
-import { existsSync as existsSync22, readdirSync as readdirSync12, readFileSync as readFileSync22, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync13, readFileSync as readFileSync22, statSync as statSync9 } from "node:fs";
 import os21 from "node:os";
 import path52 from "node:path";
 async function run14(argv, io) {
   const [sub, ...args] = argv.filter((arg) => arg !== "--json");
   if (sub !== "show")
-    return emit(io, fail2("invalid_input", `usage: ${USAGE7}`, { unblock: "workit help models" }));
+    return emit(io, fail2("invalid_input", `usage: ${USAGE8}`, { unblock: "workit help models" }));
   const role = flag3(args, "--role");
   const tier = flag3(args, "--tier");
   const hostFlag = flag3(args, "--host");
@@ -78400,7 +78853,7 @@ async function run14(argv, io) {
     ...(data.issues ?? []).map((issue) => `note: ${issue}`)
   ]);
 }
-var USAGE7 = "workit models show [--role <role>] [--tier <tier>] [--host <host>] [--report [--days <n>]] [--json]", flag3 = (argv, name) => {
+var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>] [--report [--days <n>]] [--json]", flag3 = (argv, name) => {
   const at = argv.findIndex((arg) => arg === name || arg.startsWith(`${name}=`));
   if (at < 0)
     return null;
@@ -78430,7 +78883,7 @@ var USAGE7 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
   let agents = 0;
   const dirs = (dir) => {
     try {
-      return readdirSync12(dir).map((name) => path52.join(dir, name));
+      return readdirSync13(dir).map((name) => path52.join(dir, name));
     } catch {
       return [];
     }
@@ -85969,9 +86422,9 @@ async function run15(argv, io) {
     return threads(rest, io);
   if (sub === "reply")
     return reply(rest, io);
-  return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE8);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE9);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE8 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
+var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE9 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, acceptedHow = (verdict) => verdict.cover ? `stack verdict ${verdict.cover.verdictId} on ${verdict.cover.branch} @ ${verdict.cover.head.slice(0, 12)}` : verdict.carry ? carryLabel(verdict.carry) : verdict.basis, METHODS2;
 var init_pr = __esm(() => {
   init_autonomy();
   init_issue_link();
@@ -86538,9 +86991,9 @@ async function run17(argv, io) {
     return push(rest, io);
   if (sub === "trailers")
     return trailers(rest, io);
-  return usage4(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE9);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE10);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE9 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES, READ_ONLY;
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE10 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES, READ_ONLY;
 var init_git2 = __esm(() => {
   init_autonomy();
   init_branch();
@@ -87453,9 +87906,9 @@ async function run18(argv, io) {
     return finish2(rest, io);
   if (sub === "publish")
     return publish(rest, io);
-  return usage4(io, sub && !sub.startsWith("-") ? `unknown release subcommand "${sub}"` : "missing release subcommand", USAGE10);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown release subcommand "${sub}"` : "missing release subcommand", USAGE11);
 }
-var START_USAGE = "workit release start <version> [--hotfix] [--track <t>] [--json]", FINISH_USAGE = "workit release finish [<version>] [--track <t>] [--dry-run] [--json]", PUBLISH_USAGE = "workit release publish [<version>] [--json]", USAGE10 = "workit release start|finish|publish ... (workit help release)", short4 = (sha) => sha ? sha.slice(0, 12) : "(none)", blocked = (io, grant) => emit(io, fail2("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } })), isLocalRemote = (cwd, remote) => {
+var START_USAGE = "workit release start <version> [--hotfix] [--track <t>] [--json]", FINISH_USAGE = "workit release finish [<version>] [--track <t>] [--dry-run] [--json]", PUBLISH_USAGE = "workit release publish [<version>] [--json]", USAGE11 = "workit release start|finish|publish ... (workit help release)", short4 = (sha) => sha ? sha.slice(0, 12) : "(none)", blocked = (io, grant) => emit(io, fail2("blocked", grant.error, { unblock: grant.unblock, data: { reason: grant.reason } })), isLocalRemote = (cwd, remote) => {
   const url = remote ? pushUrl(cwd, remote) : null;
   return !url || parseRemoteUrl(url)?.protocol === "file";
 }, stepsOf = (plan) => [
@@ -87499,31 +87952,31 @@ async function run19(argv, io) {
     package: "value"
   });
   if (typeof flags === "string")
-    return usage4(io, flags, USAGE11);
+    return usage4(io, flags, USAGE12);
   if (flags.positionals.length > 1)
-    return usage4(io, `unexpected argument ${flags.positionals[1]}`, USAGE11);
+    return usage4(io, `unexpected argument ${flags.positionals[1]}`, USAGE12);
   const named = flags.positionals[0];
   if (named !== undefined && !ENDPOINTS[named])
-    return usage4(io, `unknown endpoint "${named}"`, USAGE11);
+    return usage4(io, `unknown endpoint "${named}"`, USAGE12);
   if (flags.values.expect !== undefined && !ENDPOINTS[flags.values.expect])
-    return usage4(io, "--expect must be pushed, pr, merged or released", USAGE11);
+    return usage4(io, "--expect must be pushed, pr, merged or released", USAGE12);
   if (named && flags.values.expect && ENDPOINTS[named] !== ENDPOINTS[flags.values.expect])
-    return usage4(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE11);
+    return usage4(io, `${named} and --expect ${flags.values.expect} disagree`, USAGE12);
   const expect = ENDPOINTS[named ?? ""] ?? ENDPOINTS[flags.values.expect ?? ""] ?? (flags.values.tag || flags.values.package ? "released" : flags.values.pr ? "pr" : "pushed");
   const pr = positiveInt(flags.values.pr, "--pr");
   if (typeof pr === "string")
-    return usage4(io, pr, USAGE11);
+    return usage4(io, pr, USAGE12);
   if (pr && flags.values.branch)
-    return usage4(io, "pass --pr or --branch, not both", USAGE11);
+    return usage4(io, "pass --pr or --branch, not both", USAGE12);
   const sha = flags.values.sha ?? null;
   if (sha !== null && !/^[0-9a-f]{7,64}$/u.test(sha))
-    return usage4(io, "--sha must be a commit sha (7-64 hex chars)", USAGE11);
+    return usage4(io, "--sha must be a commit sha (7-64 hex chars)", USAGE12);
   const actor = actorFromEnv(io.env);
   const branch = flags.values.branch ?? null;
   let result;
   if (expect === "pushed") {
     if (pr)
-      return usage4(io, "push is checked by --branch, not --pr", USAGE11);
+      return usage4(io, "push is checked by --branch, not --pr", USAGE12);
     result = verifyPushed(io.cwd, { branch, sha, actor });
   } else if (expect === "released") {
     result = verifyReleased(io.cwd, { tag: flags.values.tag ?? null, pkg: flags.values.package ?? null, sha, actor }, forgeDeps.npm);
@@ -87548,7 +88001,7 @@ async function run19(argv, io) {
     unblock: expect === "pushed" ? "workit git push" : expect === "pr" ? "workit git push && workit pr create --fill" : expect === "merged" ? "workit pr status  # then workit pr merge when READY and granted" : "check the release workflow; the tag/package is not published"
   }));
 }
-var USAGE11 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
+var USAGE12 = "workit verify-delivery [push|pr|merge|release] [--expect pushed|pr|merged|released] [--branch <b>] [--pr <n>] [--sha <sha>] [--tag <t>] [--package <name[@version]>] [--json]", ENDPOINTS, render2 = (report) => [
   `${report.expect}: ${report.delivered ? "delivered" : "NOT delivered"}${report.branch ? ` (${report.branch}${report.sha ? ` @ ${report.sha.slice(0, 12)}` : ""})` : ""}${report.pr ? ` #${report.pr}` : ""}`,
   ...report.observations.map((entry) => `  ${entry.ok ? "ok" : "x "} ${entry.kind}: expected ${entry.expected ?? "-"}, observed ${entry.observed ?? "(none)"}${entry.note ? ` — ${entry.note}` : ""}`)
 ];
@@ -87785,9 +88238,9 @@ async function run20(argv, io) {
     return sync(rest, io);
   if (sub === "land")
     return land(rest, io);
-  return usage4(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE12);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown stack subcommand "${sub}"` : "missing stack subcommand", USAGE13);
 }
-var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE12 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail2(result.code, result.error, {
+var PLAN_USAGE = "workit stack plan [--name <n>] [--trunk <b> | --track <t>] [<bottom> … <top>] [--json]", STATUS_USAGE2 = "workit stack status [--name <n>] [--json]", SYNC_USAGE = "workit stack sync [--name <n>] [--local] [--dry-run] [--force <branch>]… [--json]", LAND_USAGE = "workit stack land [--name <n>] [--dry-run] [--max <n>] [--method squash|merge|rebase] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--timeout 20m] [--interval 30s] [--json]", USAGE13 = "workit stack plan|status|sync|land ... (workit help stack)", short5 = (sha) => sha ? sha.slice(0, 12) : "?", stackFailed = (io, result) => emit(io, fail2(result.code, result.error, {
   unblock: result.unblock,
   data: result.data ?? {}
 })), label3 = (forge, pr) => pr === null ? "no PR" : `${forge === "gitlab" ? "MR !" : "PR #"}${pr}`, renderSync = (data) => [
@@ -88866,9 +89319,9 @@ async function run21(argv, io) {
     return status4(rest, io);
   if (sub === "worktree")
     return worktree(rest, io);
-  return usage4(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE13);
+  return usage4(io, sub && !sub.startsWith("-") ? `unknown fanout subcommand "${sub}"` : "missing fanout subcommand", USAGE14);
 }
-var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE13 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail2(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
+var PLAN_USAGE2 = "workit fanout plan <plan.json> [--name <n>] [--trunk <b> | --track <t>] [--take-lead] [--json]", BRIEF_USAGE = "workit fanout brief <slice> [--name <n>] [--mode new|resume] [--attempt <n>] [--json]", CHECK_USAGE = "workit fanout check [<slice>…] [--name <n>] [--base <ref>] [--offline] [--json]", STATUS_USAGE3 = "workit fanout status [--name <n>] [--stuck-after 30m] [--offline] [--json]", WORKTREE_USAGE = "workit fanout worktree create <slice> [--name <n>] | worktree release <slice> [--name <n>] [--force] [--json]", USAGE14 = "workit fanout plan|brief|check|status|worktree ... (workit help fanout)", failed = (io, result) => emit(io, fail2(result.code, result.error, { unblock: result.unblock, data: result.data ?? {} })), renderCheck = (data) => [
   `fanout ${data.name} against ${data.trunkRef}: ${data.ready ? "ready to land" : "blocked"}`,
   ...data.slices.map((slice) => slice.status === "landed" ? `  -- ${slice.id} (${slice.branch}) landed (${slice.landed?.how}${slice.landed?.pr ? ` #${slice.landed.pr}` : ""})` : `  ${slice.status === "ready" ? "ok " : "x  "}${slice.id} (${slice.branch}) ${slice.changed} file${slice.changed === 1 ? "" : "s"} · verdict ${slice.verdict.accepted ? "accepted" : slice.verdict.basis}${slice.reasons.length ? `
       ${slice.reasons.join(`
@@ -89166,7 +89619,7 @@ async function standing(io, values, args) {
     return usage5(io, `unexpected argument: ${rest[1]}`);
   return fromResult(io, clearStanding(context, { fanout, lead, leads, target: rest[0] ?? null }), (row) => row.target ? `cleared standing order ${row.target} for fanout ${fanout}` : `cleared every standing order for fanout ${fanout}`);
 }
-var USAGE14 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | add --stop ["<note>"] | add --clear | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
+var USAGE15 = "workit ledger decision|ruling|verdict|standing|list|check ... (workit help ledger for the grammar)", STANDING_USAGE = 'workit ledger standing add "<order>" | add --stop ["<note>"] | add --clear | list | clear [<id>]  [--fanout <name>] [--json]', OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
   const actor = actorFromEnv(io.env);
   if (values.session !== undefined && values.as !== undefined)
     return new Error("pass --session or --as, not both");
@@ -89193,7 +89646,7 @@ var USAGE14 = "workit ledger decision|ruling|verdict|standing|list|check ... (wo
     return;
   const parsed = Number(value);
   return Number.isInteger(parsed) && parsed > 0 ? parsed : new Error(`${flag} must be a positive integer`);
-}, failed2 = (io, result) => emit(io, fail2(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok2(result.value), human) : failed2(io, result), usage5 = (io, error) => emit(io, fail2("invalid_input", error, { unblock: USAGE14 })), passedTestOn = (cwd, verdict) => {
+}, failed2 = (io, result) => emit(io, fail2(result.code, result.error, result.unblock ? { unblock: result.unblock } : {})), fromResult = (io, result, human) => result.ok ? emit(io, ok2(result.value), human) : failed2(io, result), usage5 = (io, error) => emit(io, fail2("invalid_input", error, { unblock: USAGE15 })), passedTestOn = (cwd, verdict) => {
   const ledger = readLedger(cwd);
   return ledger.ok && ledger.value.rows.some((row) => row.type === "check" && row.observer === "workit_cli" && row.name === "test" && row.result === "passed" && row.dirty !== true && row.branch === verdict.branch && row.head === verdict.head);
 }, verdictLines = (check) => {
@@ -105126,7 +105579,7 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync24, readdirSync as readdirSync13, readFileSync as readFileSync27, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync24, readdirSync as readdirSync14, readFileSync as readFileSync27, statSync as statSync10 } from "node:fs";
 import path68 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
@@ -105137,7 +105590,7 @@ function git7(cwd, args) {
   return { ok: run.status === 0, stdout: run.stdout ?? "" };
 }
 function walkTests(dir, out) {
-  for (const entry of readdirSync13(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync14(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
     const full = path68.join(dir, entry.name);
@@ -105273,7 +105726,7 @@ import {
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
-  readdirSync as readdirSync14,
+  readdirSync as readdirSync15,
   readFileSync as readFileSync28,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync10,
@@ -105370,7 +105823,7 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
-    names = readdirSync14(tmp);
+    names = readdirSync15(tmp);
   } catch {
     return 0;
   }
@@ -105399,7 +105852,7 @@ function removeStaleCopies(tmp = os22.tmpdir()) {
 }
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync12(target, { recursive: true });
-  for (const entry of readdirSync14(origin, { withFileTypes: true })) {
+  for (const entry of readdirSync15(origin, { withFileTypes: true })) {
     const from = path69.join(origin, entry.name);
     const to = path69.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
@@ -105842,7 +106295,7 @@ async function run23(argv, io) {
   const options = parse8(argv);
   if (typeof options === "string")
     return emit(io, fail2("invalid_input", `${options}
-usage: ${USAGE15}`));
+usage: ${USAGE16}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
   const repo = top.ok ? path70.resolve(top.stdout.trim()) : null;
   const display = (file) => toPosix(path70.relative(io.cwd, file) || file);
@@ -105928,7 +106381,7 @@ usage: ${USAGE15}`));
   }
   return emit(io, ok2(data), human);
 }
-var USAGE15 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
+var USAGE16 = "workit test-audit [paths…] [--diff [base]] [--rule <ids>] [--min-severity <level>] [--fail-on <level>] [--mutate [--test-cmd <cmd>] [--max-mutants <n>] [--budget <s>] [--timeout <s>]] [--json]", LEVELS, VALUE_FLAGS2, quote = (arg) => /^[\w./@:=+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, "'\\''")}'`;
 var init_test_audit = __esm(() => {
   init_audit();
   init_mutate();
@@ -105954,7 +106407,7 @@ __export(exports_knowledge, {
 async function run24(argv, io) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json");
   if (sub !== "lint" || rest.length > 0)
-    return emit(io, fail2("invalid_input", `usage: ${USAGE16}`));
+    return emit(io, fail2("invalid_input", `usage: ${USAGE17}`));
   const report = lintKnowledge(checkRoot(io.cwd));
   if (report.unreadable.length > 0)
     return emit(io, fail2("unavailable", `knowledge lint: cannot read ${report.unreadable.join(", ")}`, {
@@ -105971,7 +106424,7 @@ async function run24(argv, io) {
 `);
   return report.findings.length === 0 ? 0 : 1;
 }
-var USAGE16 = "workit knowledge lint [--json]";
+var USAGE17 = "workit knowledge lint [--json]";
 var init_knowledge2 = __esm(() => {
   init_check_config();
   init_knowledge();
@@ -105988,7 +106441,7 @@ import path71 from "node:path";
 async function run25(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
-    return usage4(io, `unknown subcommand "${sub ?? ""}"`, USAGE17);
+    return usage4(io, `unknown subcommand "${sub ?? ""}"`, USAGE18);
   const flags = parseFlags(rest, {
     markdown: "value",
     file: "value",
@@ -105997,18 +106450,18 @@ async function run25(argv, io) {
     date: "value"
   });
   if (typeof flags === "string")
-    return usage4(io, flags, USAGE17);
+    return usage4(io, flags, USAGE18);
   const [issueId, extra] = flags.positionals;
   if (!issueId || !ISSUE_RE2.test(issueId))
-    return usage4(io, "an issue id like ABC-123 is required", USAGE17);
+    return usage4(io, "an issue id like ABC-123 is required", USAGE18);
   if (extra !== undefined)
-    return usage4(io, `unexpected argument ${extra}`, USAGE17);
+    return usage4(io, `unexpected argument ${extra}`, USAGE18);
   const minutes = positiveInt(flags.values.minutes, "--minutes");
   if (typeof minutes === "string")
-    return usage4(io, minutes, USAGE17);
+    return usage4(io, minutes, USAGE18);
   const date = youTrackWorkDateMs(flags.values.date ?? "auto");
   if ("error" in date)
-    return usage4(io, date.error, USAGE17);
+    return usage4(io, date.error, USAGE18);
   const dateMs = date.data.dateMs;
   const markedDay = flags.values.date !== undefined && flags.values.date !== "auto" ? { dateMs } : {};
   const root = io.cwd;
@@ -106026,24 +106479,24 @@ async function run25(argv, io) {
   };
   if (sub === "note") {
     if (Boolean(flags.values.markdown) === Boolean(flags.values.file))
-      return usage4(io, "pass exactly one of --markdown or --file", USAGE17);
+      return usage4(io, "pass exactly one of --markdown or --file", USAGE18);
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
         markdown = readFileSync29(path71.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
-        return usage4(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE17);
+        return usage4(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE18);
       }
     if (!markdown.trim())
-      return usage4(io, "the note is empty", USAGE17);
+      return usage4(io, "the note is empty", USAGE18);
     const missing = step("comment", "comments", { operation: "note", issueId, markdown }, markdown, async (text) => commentResult(await postComment(issueId, text, root))) ?? (minutes ? step("time", "workItems", { operation: "note.time", issueId, markdown, minutes, ...markedDay }, "workit update", (text) => logTimeUpdate({ issueId, minutes, text, dateMs, workspace_root: root })) : null);
     if (missing)
       return emit(io, fail2("unavailable", missing));
   } else {
     if (!minutes)
-      return usage4(io, `${sub} needs --minutes <n>`, USAGE17);
+      return usage4(io, `${sub} needs --minutes <n>`, USAGE18);
     if (sub === "meeting" && !flags.values.text)
-      return usage4(io, "meeting needs --text <what the meeting was>", USAGE17);
+      return usage4(io, "meeting needs --text <what the meeting was>", USAGE18);
     const text = flags.values.text ?? "";
     const missing = step(sub, "workItems", { operation: sub, issueId, minutes, text, ...markedDay }, text, (marked) => logTimeUpdate({ issueId, minutes, text: marked, dateMs, workspace_root: root }));
     if (missing)
@@ -106072,7 +106525,7 @@ async function run25(argv, io) {
     ...data.steps.flatMap((entry) => entry.note ? [`  note (${entry.step}): ${entry.note}`] : [])
   ]);
 }
-var USAGE17 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
+var USAGE18 = "workit youtrack note <ISSUE> (--markdown <t> | --file <p>) [--minutes <n>] [--date auto|YYYY-MM-DD] | youtrack time <ISSUE> --minutes <n> [--text <t>] [--date …] | youtrack meeting <ISSUE> --minutes <n> --text <t> [--date …]", commentResult = (value) => {
   try {
     return { ok: true, data: unwrap(value) };
   } catch (error) {
@@ -106103,7 +106556,7 @@ import path72 from "node:path";
 async function run26(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
-    return usage4(io, `unknown subcommand "${sub ?? ""}"`, USAGE18);
+    return usage4(io, `unknown subcommand "${sub ?? ""}"`, USAGE19);
   const flags = parseFlags(rest, {
     entries: "value",
     path: "value",
@@ -106111,18 +106564,18 @@ async function run26(argv, io) {
     preview: "boolean"
   });
   if (typeof flags === "string")
-    return usage4(io, flags, USAGE18);
+    return usage4(io, flags, USAGE19);
   if (flags.positionals.length)
-    return usage4(io, `unexpected argument ${flags.positionals[0]}`, USAGE18);
+    return usage4(io, `unexpected argument ${flags.positionals[0]}`, USAGE19);
   const normalizeOnly = flags.booleans.has("normalize-only");
   if (!normalizeOnly && !flags.values.entries)
-    return usage4(io, "pass --entries <JSON> or --normalize-only", USAGE18);
+    return usage4(io, "pass --entries <JSON> or --normalize-only", USAGE19);
   let entries;
   if (flags.values.entries)
     try {
       entries = readEntries(flags.values.entries, io.cwd);
     } catch (error) {
-      return usage4(io, `--entries is not valid JSON: ${String(error)}`, USAGE18);
+      return usage4(io, `--entries is not valid JSON: ${String(error)}`, USAGE19);
     }
   const input = {
     entries,
@@ -106144,7 +106597,7 @@ async function run26(argv, io) {
     `changelog updated: ${String(applied.path ?? "CHANGELOG.md")}`
   ]);
 }
-var USAGE18 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
+var USAGE19 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
   const text = raw === "-" ? readFileSync30(0, "utf8") : raw.startsWith("@") ? readFileSync30(path72.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
@@ -106239,12 +106692,12 @@ async function resumeBrief(argv, io) {
       strict: true
     }));
   } catch (error) {
-    return emit(io, fail2("invalid_input", error.message, { unblock: USAGE19 }));
+    return emit(io, fail2("invalid_input", error.message, { unblock: USAGE20 }));
   }
   const last = values.last === undefined ? 10 : Number(values.last);
   if (!Number.isInteger(last) || last < 1)
     return emit(io, fail2("invalid_input", "--last must be a positive integer", {
-      unblock: USAGE19
+      unblock: USAGE20
     }));
   const built = buildHandoff(io.cwd, {
     last,
@@ -106269,7 +106722,7 @@ async function run27(argv, io) {
   await Promise.resolve().then(() => init_task());
   return runTaskCommand(["handoff", ...argv]);
 }
-var USAGE19 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", MAX_BRIEF_BYTES = 4096, short7 = (sha) => sha ? sha.slice(0, 12) : "no commit", bytes = (lines) => Buffer.byteLength(`${lines.join(`
+var USAGE20 = "workit handoff [--note <text>] [--next <text>] [--record] [--last <n>] [--json]", MAX_BRIEF_BYTES = 4096, short7 = (sha) => sha ? sha.slice(0, 12) : "no commit", bytes = (lines) => Buffer.byteLength(`${lines.join(`
 `)}
 `), TAIL_LINE_BYTES = 480, capLine = (line) => Buffer.byteLength(line) <= TAIL_LINE_BYTES ? line : `${Buffer.from(line).subarray(0, TAIL_LINE_BYTES).toString().replace(/\uFFFD$/u, "")}… (cut)`;
 var init_handoff = __esm(() => {
@@ -106414,8 +106867,8 @@ var VERBS = [
   {
     name: "upgrade",
     group: "setup",
-    usage: "workit upgrade [--hosts=a,b|none] [--cli] [--preview | --apply --confirm]",
-    summary: "Preview upgrades (--apply --confirm to apply)",
+    usage: "workit upgrade [--hosts=a,b|none] [--cli] [--preview | --yes | --apply --confirm] [--json]",
+    summary: "Upgrade the CLI and every host after one confirmation, then verify with doctor",
     load: () => Promise.resolve().then(() => (init_upgrade2(), exports_upgrade))
   },
   {
@@ -107224,7 +107677,7 @@ async function main(argv, overrides = {}, options = {}) {
         }));
       return help(io, subcommandHelp(entry, found));
     }
-    return emit(io, ok2({ version: package_default.version, verbs: listed().map(describe3) }), () => helpText());
+    return emit(io, ok2({ version: package_default.version, verbs: listed().map(describe4) }), () => helpText());
   }
   const entry = findVerb(command);
   if (!entry)
@@ -107359,7 +107812,7 @@ function endOfOptions(io, entry, args) {
 }
 var words2 = (args) => args.filter((arg) => !arg.startsWith("-"));
 var help = (io, doc) => emit(io, ok2(doc), (data) => data.text);
-var describe3 = (entry) => ({
+var describe4 = (entry) => ({
   name: entry.name,
   group: entry.group,
   usage: entry.usage,