@brainervirus/workit-cli 8.39.3 → 8.40.0

package/dist/index.js

@@ -9317,7 +9317,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.39.3",
+    version: "8.40.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9355,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.39.3",
+      "@brainervirus/workit-cursor": "^8.40.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.39.3"
+      "@brainervirus/workit-core": "^8.40.0"
     },
     engines: {
       node: ">=24"
@@ -21305,7 +21305,10 @@ async function payloadValue(raw, deps) {
   }
   try {
     const value = JSON.parse(source);
-    return isObject7(value) ? { ok: true, value } : { ok: false, result: failure2("invalid_input", "payload must be a JSON object") };
+    return isObject7(value) ? { ok: true, value } : {
+      ok: false,
+      result: failure2("invalid_input", "payload must be a JSON object")
+    };
   } catch (error) {
     return {
       ok: false,
@@ -21500,7 +21503,11 @@ function laneOf(root) {
   } catch {
     verification = DEFAULT_VERIFICATION;
   }
-  const lane = branchLane(root, { head: null, workingTree: true, judgment: currentJudgment(root) });
+  const lane = branchLane(root, {
+    head: null,
+    workingTree: true,
+    judgment: currentJudgment(root)
+  });
   return {
     lane: lane.lane,
     reasons: lane.reasons,
@@ -21574,7 +21581,69 @@ function printHuman(result, deps, handoff = false) {
       write(stream, `policy gap: ${gap.reason}`);
   }
 }
+function runFindingList(argv, deps) {
+  let json = false;
+  let branch;
+  let status;
+  const fail = (message) => {
+    if (json)
+      jsonResult(outOf(deps), usage(message));
+    else
+      write(errOf(deps), `${message}
+usage: ${FINDING_LIST_USAGE}`);
+    return 2;
+  };
+  for (let i = 0;i < argv.length; i += 1) {
+    const eq = argv[i].startsWith("--") ? argv[i].indexOf("=") : -1;
+    const token = eq > 0 ? argv[i].slice(0, eq) : argv[i];
+    if (token === "--json")
+      json = true;
+    else if (token === "--branch" || token === "--status") {
+      const value = eq > 0 ? argv[i].slice(eq + 1) : argv[++i];
+      if (value === undefined || !value.trim())
+        return fail(`${token} requires a value`);
+      if (token === "--branch")
+        branch = value;
+      else
+        status = value;
+    } else
+      return fail(`unknown argument: ${argv[i]}`);
+  }
+  if (status !== undefined && status !== "open" && status !== "resolved")
+    return fail(`--status is open or resolved (got ${status})`);
+  const store = new TaskStore(workspaceRootFor(deps));
+  const index = store.listTaskIndex();
+  const tasks = store.listTasks();
+  const result = !index.ok ? index : !tasks.ok ? tasks : success(null, null, null);
+  if (!result.ok || !index.ok || !tasks.ok) {
+    if (json)
+      jsonResult(outOf(deps), result);
+    else
+      printHuman(result, deps);
+    return 1;
+  }
+  const keys = new Map(index.data.map((entry) => [entry.id, entry.key]));
+  const rows = tasks.data.filter((task) => branch === undefined || keys.get(task.id) === branch).flatMap((task) => task.findings.filter((item) => status === undefined || item.data.disposition === "open" === (status === "open")).map((item) => ({
+    id: item.id,
+    taskId: task.id,
+    branch: keys.get(task.id) ?? null,
+    disposition: item.data.disposition,
+    recordedAt: item.recordedAt,
+    claim: item.data.claim
+  })));
+  const total = tasks.data.reduce((sum, task) => sum + task.findings.length, 0);
+  if (json)
+    jsonResult(outOf(deps), success(null, null, { findings: rows, total }));
+  else if (!rows.length)
+    write(outOf(deps), total ? `no findings match the filters (${total} finding${total === 1 ? "" : "s"} in all; drop --branch/--status to list them)` : "no findings recorded (record one: workit finding record --payload '{…}'); ledger rows hold verdicts and rulings, not findings");
+  else
+    for (const row of rows)
+      write(outOf(deps), `${row.id} ${row.disposition}${row.branch ? ` [${row.branch}]` : ""} (task ${row.taskId}) ${row.claim}`);
+  return 0;
+}
 async function runTaskCommand(argv, deps = {}) {
+  if (argv[0] === "finding" && argv[1] === "list")
+    return runFindingList(argv.slice(2), deps);
   const parsed = await parseTaskArgs(argv, deps);
   if (!parsed.ok) {
     if (parsed.json)
@@ -21587,7 +21656,9 @@ async function runTaskCommand(argv, deps = {}) {
   const store = new TaskStore(root);
   try {
     const now = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-    closeDeliveredTasks(store, now, { cached: parsed.parsed.action !== "list" });
+    closeDeliveredTasks(store, now, {
+      cached: parsed.parsed.action !== "list"
+    });
   } catch {}
   const core = new WorkitCore(store, contextFor(root, parsed.parsed.actor !== undefined ? { ...deps, actor: parsed.parsed.actor } : deps));
   let result;
@@ -21678,7 +21749,7 @@ var TASK_FAMILIES, workspaceRootFor = (deps = {}) => {
   capabilities: deps.capabilities ?? [],
   constraints: deps.constraints ?? [],
   now: deps.now ?? (() => new Date().toISOString())
-});
+}), FINDING_LIST_USAGE = "workit finding list [--branch <b>] [--status open|resolved] [--json]";
 var init_task = __esm(() => {
   init_check_config();
   init_autonomy();
@@ -21695,7 +21766,7 @@ var init_task = __esm(() => {
     task: ["start", "list", "inspect", "revise", "progress", "pause", "resume", "close"],
     policy: ["assess", "preview", "explain"],
     evidence: ["record"],
-    finding: ["record", "resolve"],
+    finding: ["record", "resolve", "list"],
     decision: ["record", "revoke"],
     worker: ["assign", "report", "cancel"],
     state: ["export", "import"]
@@ -76963,6 +77034,7 @@ var init_uninstall2 = __esm(() => {
 // packages/workit-cli/src/verbs/grant.ts
 var exports_grant = {};
 __export(exports_grant, {
+  agentMarker: () => agentMarker,
   run: () => run10,
   runGrant: () => runGrant
 });
@@ -77301,7 +77373,90 @@ function set2(argv, io) {
     `${name}: ${changes.map((change) => change.path.join(".")).join(", ")} updated in ${written(data.path, data.backup)}`
   ]);
 }
-async function runWorkspace(argv, io) {
+async function rm(argv, io, deps) {
+  const [name, extra] = argv;
+  if (!name)
+    return usage3(io, "rm needs <name>");
+  if (extra)
+    return usage3(io, `unexpected argument ${extra}`);
+  const current = load(io);
+  if (typeof current === "number")
+    return current;
+  const entries = entriesOf(current);
+  const removed = entries.find((entry) => entry.name === name);
+  if (!removed)
+    return emit(io, fail2("not_found", `no workspace named "${name}" in ${current.path}`));
+  const remaining = entries.filter((entry) => entry !== removed);
+  if (remaining.length === 0)
+    return emit(io, fail2("blocked", `"${name}" is the last workspace in ${current.path}: it holds your vcs, policies and grants, and without it every folder falls back to the defaults; workspace rm does not remove it`, {
+      unblock: `add the workspace that should replace it first (workit workspace add <name> --glob <g> --from ${name}), or edit ${current.path} in your own editor`
+    }));
+  const before = deliveredCeilingOf(removed);
+  const defaults = ceilingOf({});
+  const nothing = {
+    grants: Object.fromEntries(GRANT_KINDS.map((kind) => [kind, false])),
+    endpoint: DEFAULT_ENDPOINT,
+    verification: STRICTNESS[0]
+  };
+  const specificity = globSpecificity(removed.glob);
+  const raised = [
+    { taker: "defaults", kinds: raisedKinds(before, defaults), reason: "no entry matches" },
+    ...remaining.map((entry) => ({
+      taker: entry.name,
+      kinds: raisedKinds(before, ceilingOf(entry)),
+      reason: "may match a folder it covered"
+    })),
+    ...remaining.filter((entry) => globSpecificity(entry.glob) === specificity).map((entry) => ({
+      taker: entry.name,
+      kinds: raisedKinds(nothing, ceilingOf(entry)),
+      reason: "equally specific: a folder both matched was ambiguous, with nothing granted"
+    }))
+  ].filter((raise) => raise.kinds.length > 0);
+  if (raised.length > 0) {
+    const kinds = [...new Set(raised.flatMap((raise) => raise.kinds))];
+    const detail = raised.map((raise) => `${raise.taker} (${raise.reason}): ${raise.kinds.join(", ")}`).join("; ");
+    const agent = agentMarker(io.env);
+    if (!deps.interactive() || agent)
+      return emit(io, fail2("blocked", `grant_raise_refused: removing "${name}" may raise ${kinds.join(", ")} for the folders it covered (${detail}); that needs the user at an interactive terminal${agent ? ` (this shell belongs to an agent: ${agent} is set)` : ""}; grants are never raised headless`, {
+        unblock: `ask the user to run, in a terminal outside the agent host (not Claude Code's \`!\` prefix or an agent shell): workit workspace rm ${name}`
+      }));
+    const answer = await askOrCancel(io, () => deps.ask(`Removing workspace "${name}" may raise ${kinds.join(", ")} for the folders it covered (${detail}). An agent there may then do more without asking. Type the workspace name to confirm: `));
+    if (answer === null)
+      return cancelled(io);
+    if (answer.trim() !== name)
+      return emit(io, fail2("blocked", "workspace removal not confirmed; nothing was written"));
+  }
+  const result = save(current, remaining);
+  if (!result.ok)
+    return emit(io, fail2("invalid_input", result.error));
+  const at = globRoot(removed.glob);
+  let covers;
+  try {
+    covers = { at, workspace: resolveWorkspaceFromEntries(at, remaining)?.name ?? null };
+  } catch (error) {
+    covers = { at, workspace: null, error: error instanceof Error ? error.message : String(error) };
+  }
+  const coveringCeiling = ceilingOf(remaining.find((entry) => entry.name === covers.workspace));
+  return emit(io, ok2({
+    path: result.path,
+    backup: result.backup,
+    removed,
+    covers: {
+      ...covers,
+      grants: coveringCeiling.grants,
+      defaultEndpoint: coveringCeiling.endpoint,
+      verification: coveringCeiling.verification
+    },
+    takers: overlappingEntries(removed.glob, remaining).map((entry) => entry.name),
+    raises: raised
+  }), (data) => [
+    `${name} (${removed.glob}) removed from ${written(data.path, data.backup)}`,
+    data.covers.error ? `  ${data.covers.at}: ${data.covers.error}` : `  ${data.covers.at} is now ${data.covers.workspace ? `workspace ${data.covers.workspace}` : "under the defaults (no workspace)"}: ${GRANT_KINDS.map((kind) => `${kind}=${String(data.covers.grants[kind])}`).join(" ")}; default endpoint ${data.covers.defaultEndpoint}; verification ${data.covers.verification}`,
+    ...data.takers.length ? [`  entries whose globs may cover its other folders: ${data.takers.join(", ")}`] : [],
+    "  workit workspace list --cwd <folder> shows which entry applies to a folder"
+  ]);
+}
+async function runWorkspace(argv, io, deps = defaultDeps2) {
   const [sub, ...rest] = argv.filter((arg) => arg !== "--json" && arg !== "--");
   if (sub === undefined || sub === "list")
     return list2(rest, io);
@@ -77309,13 +77464,25 @@ async function runWorkspace(argv, io) {
     return add2(rest, io);
   if (sub === "set")
     return set2(rest, io);
+  if (sub === "rm")
+    return rm(rest, io, deps);
   return usage3(io, `unknown subcommand "${sub}"`);
 }
-var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>…", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
+var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <parent>] | workspace set <name> <key>=<value>… | workspace rm <name>", INHERITED_KEYS, GRANT_KEYS, SCOPE_KEYS, SETTABLE_KEYS, SEGMENT, UNSAFE_SEGMENTS, ceilingOf = (entry) => ({
   grants: { ...DEFAULT_GRANTS, ...configuredGrants(entry).grants },
   endpoint: isDefaultEndpoint(entry?.defaultEndpoint) ? entry.defaultEndpoint : DEFAULT_ENDPOINT,
   verification: verificationOf(entry)
-}), STRICTNESS, looser = (current, next) => STRICTNESS.indexOf(next) > STRICTNESS.indexOf(current), shadowedCeiling = (shadowed) => {
+}), deliveredCeilingOf = (entry) => {
+  const ceiling = ceilingOf(entry);
+  const account = entry.vcs?.account;
+  if (Object.keys(configuredGrants(entry).grants).length === 0 || account)
+    return ceiling;
+  return {
+    grants: Object.fromEntries(GRANT_KINDS.map((kind) => [kind, false])),
+    endpoint: DEFAULT_ENDPOINT,
+    verification: ceiling.verification
+  };
+}, STRICTNESS, looser = (current, next) => STRICTNESS.indexOf(next) > STRICTNESS.indexOf(current), shadowedCeiling = (shadowed) => {
   if (shadowed.length === 0)
     return null;
   const ceilings = shadowed.map(ceilingOf);
@@ -77335,7 +77502,11 @@ var USAGE5 = "workit workspace list | workspace add <name> --glob <g> [--from <p
     ...Object.keys(autonomy).length ? { autonomy } : {},
     ...looser(shadowed.verification, DEFAULT_VERIFICATION) ? { verification: shadowed.verification } : {}
   };
-}, usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
+}, defaultDeps2, raisedKinds = (before, after) => [
+  ...GRANT_KINDS.filter((kind) => raises(kind, before.grants[kind], after.grants[kind])),
+  ...raisesEndpoint(before.endpoint, after.endpoint) ? ["defaultEndpoint"] : [],
+  ...looser(before.verification, after.verification) ? ["verification"] : []
+], usage3 = (io, message) => emit(io, fail2("invalid_input", `${message}
 usage: ${USAGE5}`)), load = (io) => {
   const current = readWorkspacesResult();
   if (current.status === "malformed" || current.status === "invalid")
@@ -77384,6 +77555,8 @@ var init_workspace = __esm(() => {
   init_safe_write();
   init_workspaces();
   init_output();
+  init_prompt();
+  init_grant();
   INHERITED_KEYS = [
     "vcs",
     "issues",
@@ -77415,6 +77588,10 @@ var init_workspace = __esm(() => {
   SEGMENT = /^[A-Za-z0-9_-]+$/u;
   UNSAFE_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);
   STRICTNESS = ["independent", "self", "proportional"];
+  defaultDeps2 = {
+    interactive: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
+    ask: (question) => askLine(question)
+  };
 });
 
 // packages/workit-core/src/core/heavy-rules.ts
@@ -86747,10 +86924,124 @@ var init_forge_common = __esm(() => {
 // packages/workit-cli/src/verbs/pr.ts
 var exports_pr = {};
 __export(exports_pr, {
+  checkPrTitle: () => checkPrTitle,
   run: () => run15
 });
-import { readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync26, readFileSync as readFileSync27 } from "node:fs";
 import path66 from "node:path";
+function titleRules(cwd) {
+  let root;
+  try {
+    root = checkRoot(cwd);
+  } catch {
+    return { rules: null, note: null };
+  }
+  let text = null;
+  let name = "";
+  for (const candidate of COMMITLINT_FILES) {
+    const full = path66.join(root, candidate);
+    if (!existsSync26(full))
+      continue;
+    text = readFileSync27(full, "utf8");
+    name = candidate;
+    break;
+  }
+  if (text === null) {
+    try {
+      const pkg = JSON.parse(readFileSync27(path66.join(root, "package.json"), "utf8"));
+      if (pkg.commitlint === undefined)
+        return { rules: null, note: null };
+      text = JSON.stringify(pkg.commitlint);
+    } catch {
+      return { rules: null, note: null };
+    }
+  }
+  if (/\.[cm]?[jt]s$/u.test(name))
+    return UNCHECKED("JS/TS");
+  let config;
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+      return UNCHECKED("not a plain JSON object");
+    config = parsed;
+  } catch {
+    return UNCHECKED(/\.ya?ml$|^\.commitlintrc$/u.test(name) ? "YAML" : "unreadable");
+  }
+  if (config.ignores !== undefined)
+    return UNCHECKED("using custom ignores");
+  const extend = config.extends === undefined ? [] : [config.extends].flat();
+  const known = (entry) => typeof entry === "string" && /^(@commitlint\/)?config-conventional$/u.test(entry);
+  if (!extend.every(known))
+    return UNCHECKED("extending a shareable config");
+  const rules = {
+    types: null,
+    maxHeader: null,
+    format: 0,
+    defaultIgnores: config.defaultIgnores !== false
+  };
+  if (extend.length) {
+    rules.types = { level: 2, values: CONVENTIONAL_TYPES };
+    rules.maxHeader = { level: 2, value: 100 };
+    rules.format = 2;
+  }
+  const own = config.rules ?? {};
+  const types = readRule(own, "type-enum");
+  if (types === "off")
+    rules.types = null;
+  else if (types && Array.isArray(types.value))
+    rules.types = { level: types.level, values: types.value.map(String) };
+  const max = readRule(own, "header-max-length");
+  if (max === "off")
+    rules.maxHeader = null;
+  else if (max && typeof max.value === "number")
+    rules.maxHeader = { level: max.level, value: max.value };
+  for (const rule of ["type-empty", "subject-empty"]) {
+    const read = readRule(own, rule);
+    if (read === "off")
+      rules.format = 0;
+    else if (read)
+      rules.format = Math.max(rules.format, read.level);
+  }
+  return { rules, note: null };
+}
+function checkPrTitle(cwd, title) {
+  const { rules, note } = titleRules(cwd);
+  if (!rules)
+    return { error: null, notes: note ? [note] : [] };
+  const header = title.split(`
+`, 1)[0] ?? "";
+  if (rules.defaultIgnores && DEFAULT_IGNORES.some((pattern) => pattern.test(title)))
+    return { error: null, notes: [] };
+  const problems = [];
+  const parsed = /^(\w*)(?:\((.*)\))?!?: (.*)$/u.exec(header);
+  if (rules.format && (!parsed || !parsed[1] || !parsed[3]?.trim()))
+    problems.push({
+      level: rules.format,
+      message: `PR title ${JSON.stringify(header)} is not a Conventional Commit "<type>(<scope>): <subject>" (commitlint type-empty/subject-empty); the squash-merge title is the commit and CI lints it`
+    });
+  else if (parsed && rules.types && !rules.types.values.includes(parsed[1]))
+    problems.push({
+      level: rules.types.level,
+      message: `PR title type "${parsed[1]}" is not allowed (commitlint type-enum: ${rules.types.values.join(", ")})`
+    });
+  if (rules.maxHeader && header.length > rules.maxHeader.value)
+    problems.push({
+      level: rules.maxHeader.level,
+      message: `PR title is ${header.length} characters, over the ${rules.maxHeader.value} allowed (commitlint header-max-length); shorten it by ${header.length - rules.maxHeader.value}`
+    });
+  const refused = problems.filter((problem) => problem.level >= 2);
+  return {
+    error: refused.length ? refused.map((problem) => problem.message).join("; ") : null,
+    notes: problems.filter((problem) => problem.level < 2).map((p) => `warning: ${p.message}`)
+  };
+}
+function refuseTitle(io, title, line) {
+  const checked = checkPrTitle(io.cwd, title);
+  for (const note of checked.notes)
+    io.stderr(`${note}
+`);
+  return checked.error ? usage4(io, checked.error, line) : null;
+}
 function readBodyFile(io, file) {
   try {
     return {
@@ -86920,6 +87211,9 @@ async function create4(argv, io) {
   }
   if (!base)
     return usage4(io, "no default target branch is configured; pass --base <b>", CREATE_USAGE);
+  const given = flags.values.title ? refuseTitle(io, flags.values.title, CREATE_USAGE) : null;
+  if (given !== null)
+    return given;
   const connected = connect(io, branch);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -86931,6 +87225,11 @@ async function create4(argv, io) {
     title ||= filled.data.title;
     body ??= filled.data.body;
   }
+  if (!flags.values.title) {
+    const filled = refuseTitle(io, title, CREATE_USAGE);
+    if (filled !== null)
+      return filled;
+  }
   const forge = connected.data.forge;
   const planned = planIssueLinks(io.cwd, {
     issues: flags.lists.issue ?? [],
@@ -87149,6 +87448,11 @@ async function edit(argv, io) {
       return usage4(io, read, EDIT_USAGE);
     body = read.body;
   }
+  if (flags.values.title !== undefined) {
+    const edited = refuseTitle(io, flags.values.title, EDIT_USAGE);
+    if (edited !== null)
+      return edited;
+  }
   const connected = connect(io);
   if (!connected.ok)
     return forgeFail(io, connected);
@@ -87251,7 +87555,19 @@ async function run15(argv, io) {
     return reply(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown pr subcommand "${sub}"` : "missing pr subcommand", USAGE9);
 }
-var STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE9 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, mergedOnLine = (verdict) => {
+var CONVENTIONAL_TYPES, COMMITLINT_FILES, DEFAULT_IGNORES, UNCHECKED = (what) => ({
+  rules: null,
+  note: `commitlint config is ${what}; title not pre-checked, CI checks it`
+}), readRule = (rules, name) => {
+  const rule = rules[name];
+  if (rule === undefined)
+    return null;
+  if (!Array.isArray(rule) || typeof rule[0] !== "number")
+    return "off";
+  if (rule[0] === 0 || rule[1] === "never")
+    return "off";
+  return { level: rule[0], value: rule[2] };
+}, STATUS_USAGE = "workit pr status [--pr <n> | --branch <b>] [--log-lines 60] [--json]", CREATE_USAGE = "workit pr create [--base <b> | --track <t>] (--title <t> [--body <text> | --body-file <f|->] | --fill) [--issue <#n|ID|url>]… [--refs] [--label <l>]… [--reviewer <login>]… [--draft] [--json]", MERGE_USAGE = "workit pr merge [--pr <n>] [--squash|--merge|--rebase | --method squash|merge|rebase] [--subject <s>] [--body <b> | --body-file <f|->] [--delete-branch | --keep-branch] [--unverified --reason <why>] [--base-red-ok --reason <why>] [--json]", READY_USAGE = "workit pr ready [--pr <n>] [--undo] [--json]", EDIT_USAGE = "workit pr edit [--pr <n>] [--title <t>] [--body-file <f|->] [--add-label <l>]… [--remove-label <l>]… [--add-reviewer <login>]… [--base <b>] [--json]", THREADS_USAGE = "workit pr threads [--pr <n>] [--json]", REPLY_USAGE = "workit pr reply [--pr <n>] --thread <id> [--body-file <f|->] [--resolve] [--json]", USAGE9 = "workit pr status|create|merge|ready|edit|threads|reply ... (workit help pr)", prLabel = (kind, number) => `${kind === "github" ? "PR #" : "MR !"}${number}`, NEED_TEXT, mergedVerdictLine = (landed) => landed === "untracked" ? "merged outside workit (no merge record)" : landed.unverified ? `merged unverified at ${(landed.head ?? "?").slice(0, 12)} (recorded bypass)` : landed.lane === "none" && !landed.verdictId ? `merged at ${(landed.head ?? "?").slice(0, 12)} with no verdict (lane none)` : landed.review === "self-reviewed" ? `merged self-reviewed (lane self) with the author's verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}` : `merged with accepted verdict ${landed.verdictId ?? "?"} at ${(landed.head ?? "?").slice(0, 12)}${landed.intentOnly ? " (merge intent recorded; the merge call itself failed)" : ""}`, mergedOnLine = (verdict) => {
   if (verdict.review === "self-reviewed")
     return `self-reviewed (lane ${verdict.lane}): the author's verdict ${verdict.verdictId ?? "?"}; no independent verdict accepted for that head`;
   if (!verdict.verdictId)
@@ -87275,8 +87591,48 @@ var init_pr = __esm(() => {
   init_lane();
   init_pr_lane();
   init_vcs_config();
+  init_check_config();
   init_output();
   init_forge_common();
+  CONVENTIONAL_TYPES = [
+    "build",
+    "chore",
+    "ci",
+    "docs",
+    "feat",
+    "fix",
+    "perf",
+    "refactor",
+    "revert",
+    "style",
+    "test"
+  ];
+  COMMITLINT_FILES = [
+    ".commitlintrc.json",
+    ".commitlintrc",
+    ".commitlintrc.yaml",
+    ".commitlintrc.yml",
+    ".commitlintrc.js",
+    ".commitlintrc.cjs",
+    ".commitlintrc.mjs",
+    ".commitlintrc.ts",
+    "commitlint.config.js",
+    "commitlint.config.cjs",
+    "commitlint.config.mjs",
+    "commitlint.config.ts"
+  ];
+  DEFAULT_IGNORES = [
+    /^((Merge pull request)|(Merge (.*?) into (.*?)|(Merge branch (.*?)))(?:\r?\n)*$)/m,
+    /^(Merge tag (.*?))(?:\r?\n)*$/m,
+    /^(R|r)evert (.*)/,
+    /^(R|r)eapply (.*)/,
+    /^(amend|fixup|squash)!/,
+    /^(Merged (.*?)(in|into) (.*)|Merged PR (.*): (.*))/,
+    /^Merge remote-tracking branch(\s*)(.*)/,
+    /^Automatic merge(.*)/,
+    /^Auto-merged (.*?) into (.*)/,
+    /^(chore(\([^)]+\))?:\s*)?v?\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?\s*$/
+  ];
   NEED_TEXT = {
     none: "no verdict",
     self: "the author's own --self verdict (or an independent one)",
@@ -87733,10 +88089,10 @@ async function push(argv, io) {
   });
   if (typeof flags === "string")
     return usage4(io, flags, PUSH_USAGE);
-  const release = flags.lists.release;
+  const release = flags.lists.release?.flatMap((value) => value.split(",").map((name) => name.trim()).filter(Boolean));
   if (release) {
     if (flags.booleans.size || flags.values.expect !== undefined || flags.positionals.length)
-      return usage4(io, "--release takes only ref names (repeat it: --release main --release v1.2.0)", PUSH_USAGE);
+      return usage4(io, "--release takes only ref names (a comma list or a repeated flag: --release main,v1.2.0)", PUSH_USAGE);
     return releasePush(release, io);
   }
   if (flags.positionals.length)
@@ -87838,7 +88194,7 @@ async function run17(argv, io) {
     return trailers(rest, io);
   return usage4(io, sub && !sub.startsWith("-") ? `unknown git subcommand "${sub}"` : "missing git subcommand", USAGE10);
 }
-var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…] [--json]", USAGE10 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES, READ_ONLY;
+var BRANCH_USAGE = "workit git branch <name> | --kind feature|bugfix|release|hotfix --slug <s>  [--base <b>] [--track <t>] [--carry] [--json]", COMMIT_USAGE = "workit git commit -m|--message <msg>… | -F|--file <file|-> [--trailer <key: value>]… [--amend [--no-edit]] [--allow-empty] [-a|--all | [--] <paths…>] [--json]", PUSH_USAGE = "workit git push [--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>[,…]] [--json]", USAGE10 = "workit git branch|commit|push|trailers ... (workit help git)", short2 = (sha) => sha ? sha.slice(0, 12) : "(none)", COMMIT_SWITCHES, READ_ONLY;
 var init_git2 = __esm(() => {
   init_autonomy();
   init_branch();
@@ -90128,7 +90484,13 @@ async function run22(argv, io) {
       type: values.type,
       last: last ?? 50
     });
-    return emit(io, ok2({ path: ledger.value.path, skipped: ledger.value.skipped, rows: listed }), (data) => data.rows.length ? data.rows.map((row) => {
+    const note = values.type === "finding" && listed.length === 0 ? "findings are not ledger rows; they live in the task: workit finding list [--branch <b>] [--status open|resolved]" : undefined;
+    return emit(io, ok2({
+      path: ledger.value.path,
+      skipped: ledger.value.skipped,
+      rows: listed,
+      ...note ? { note } : {}
+    }), (data) => note ? note : data.rows.length ? data.rows.map((row) => {
       const line = summarizeRow(row);
       return `#${line.seq} ${line.at} ${line.type}${line.branch ? ` [${line.branch}]` : ""}${line.labels.length ? ` (${line.labels.join(", ")})` : ""}  ${line.summary}`;
     }) : "ledger is empty");
@@ -106273,7 +106635,7 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync26, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync27, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
 import path71 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
@@ -106300,7 +106662,7 @@ function expandPaths(cwd, inputs) {
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
     const full = path71.resolve(cwd, input);
-    if (!existsSync26(full))
+    if (!existsSync27(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
       walkTests(full, files);
@@ -106416,7 +106778,7 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync27,
+  existsSync as existsSync28,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
@@ -106645,7 +107007,7 @@ function copyWorkingTree(repo) {
   }
   for (const parent of dirs) {
     const modules = path72.join(repo, parent, "node_modules");
-    if (existsSync27(modules) && !existsSync27(path72.join(tree, parent, "node_modules")))
+    if (existsSync28(modules) && !existsSync28(path72.join(tree, parent, "node_modules")))
       linkNodeModules(modules, path72.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
@@ -106695,7 +107057,7 @@ async function runMutation(options) {
     const relative = toPosix(path72.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync27(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync28(absolute))
       continue;
     try {
       candidates.push(...mutantsFor(readFileSync30(absolute, "utf8"), relative, lines));
@@ -106885,7 +107247,7 @@ var exports_test_audit = {};
 __export(exports_test_audit, {
   run: () => run23
 });
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync29 } from "node:fs";
 import path73 from "node:path";
 function parse8(argv) {
   const options = {
@@ -107009,7 +107371,7 @@ usage: ${USAGE16}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync28(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync29(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)
@@ -107457,7 +107819,11 @@ var FAMILY_ACTIONS = {
     explain: "Explain the policy in force"
   },
   evidence: { record: "Record evidence against a task's requirements" },
-  finding: { record: "Record a finding", resolve: "Resolve a finding" },
+  finding: {
+    record: "Record a finding",
+    resolve: "Resolve a finding",
+    list: "List findings with their ids [--branch <b>] [--status open|resolved]"
+  },
   decision: {
     record: "Record a task decision",
     revoke: "Revoke a task decision"
@@ -107504,7 +107870,7 @@ var familySubcommands = (name) => {
   const implicit = name === "task" ? TASK_IMPLICIT : [];
   const grammar = Object.entries(FAMILY_ACTIONS[name]).filter(([action]) => !implicit.some((entry) => entry.name === action)).map(([action, summary]) => ({
     name: action,
-    usage: name === "task" && action === "list" ? `workit task list [--status all] ${FAMILY_OPTIONS}` : name === "policy" && action !== "explain" ? `workit policy ${action} ${POLICY_JUDGE} ${FAMILY_OPTIONS}` : name === "worker" && action !== "assign" ? `workit worker ${action} [<workerId>] ${FAMILY_OPTIONS}` : `workit ${name} ${action} ${FAMILY_OPTIONS}`,
+    usage: name === "task" && action === "list" ? `workit task list [--status all] ${FAMILY_OPTIONS}` : name === "finding" && action === "list" ? "workit finding list [--branch <b>] [--status open|resolved] [--json]" : name === "policy" && action !== "explain" ? `workit policy ${action} ${POLICY_JUDGE} ${FAMILY_OPTIONS}` : name === "worker" && action !== "assign" ? `workit worker ${action} [<workerId>] ${FAMILY_OPTIONS}` : `workit ${name} ${action} ${FAMILY_OPTIONS}`,
     summary
   }));
   return [...implicit, ...grammar];
@@ -107622,7 +107988,7 @@ var VERBS = [
   withSubcommands({
     name: "workspace",
     group: "setup",
-    summary: "Edit workspace entries without the wizard; never raises a grant",
+    summary: "Edit workspace entries without the wizard; a raise (rm included) needs the user at a terminal",
     subcommands: [
       {
         name: "list",
@@ -107638,15 +108004,21 @@ var VERBS = [
         name: "set",
         usage: "workit workspace set <name> <key>=<value>…",
         summary: "Change non-grant keys (dotted paths, JSON values, null removes); grants stay with workit grant set"
+      },
+      {
+        name: "rm",
+        usage: "workit workspace rm <name>",
+        summary: "Remove an entry; if another entry or the defaults could grant its folders more, the user confirms at their own terminal"
       }
     ],
     examples: [
       "workit workspace list",
       "workit workspace add kit --glob '/home/me/work/libs/kit/**' --from work",
-      "workit workspace set kit branchPolicy.integration=merge"
+      "workit workspace set kit branchPolicy.integration=merge",
+      "workit workspace rm kit"
     ],
     notes: [
-      "A new entry starts with no grants of its own. It starts at the strictest level of every entry and the defaults, so its folders never get more than they had. Remove an entry in your own editor. Raising a grant, defaultEndpoint or verification needs the user: workit grant set <name> <kind>=<value> in their own terminal.",
+      "A new entry starts with no grants of its own. It starts at the strictest level of every entry and the defaults, so its folders never get more than they had. rm counts every other entry and the defaults as a possible taker of the removed folders: when any could grant more, it is refused in an agent or headless shell and the user types the name to confirm at their own terminal; it never removes the last entry. Raising a grant, defaultEndpoint or verification needs the user: workit grant set <name> <kind>=<value> in their own terminal.",
       "Every write keeps the previous file as workspaces.json.bak. `workit doctor` lists overlapping globs and which entry wins."
     ],
     load: () => Promise.resolve().then(() => (init_workspace(), exports_workspace))
@@ -107819,7 +108191,7 @@ var VERBS = [
       {
         name: "push",
         deferredFlags: ["force"],
-        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>…]",
+        usage: "workit git push [-u|--set-upstream] [--force-with-lease [--expect <sha>] [--overwrite-unintegrated]] [--release <main|develop|v-tag>[,…]]",
         summary: "Push the current branch and verify the remote tip (never a blind --force); --release finishes a git-flow release"
       },
       {
@@ -107989,7 +108361,7 @@ var VERBS = [
         name: "list",
         aliases: ["show"],
         usage: "workit ledger list|show [--branch <b>] [--pr <n>] [--type <t>] [--last <n>]",
-        summary: "List ledger rows, newest last"
+        summary: "List ledger rows, newest last (findings live in the task: workit finding list)"
       },
       {
         name: "check",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.39.3",
+  "version": "8.40.0",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,13 +38,13 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-cursor": "^8.39.3",
+    "@brainervirus/workit-cursor": "^8.40.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"
   },
   "devDependencies": {
-    "@brainervirus/workit-core": "^8.39.3"
+    "@brainervirus/workit-core": "^8.40.0"
   },
   "engines": {
     "node": ">=24"