@brainervirus/workit-cli 8.40.1 → 8.40.4

package/dist/index.js

@@ -6389,7 +6389,7 @@ var init_zod = __esm(() => {
 // packages/workit-core/src/core/workspaces.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync } from "node:fs";
 import path2 from "node:path";
 function workspaceDefaultTarget(cwd, globalDefault) {
   const ws = resolveRuntimeWorkspaceVcs(cwd);
@@ -6531,10 +6531,17 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     };
   }
   return { ok: true };
-}, WorkspaceConfigError, mainCheckouts, mainCheckoutOf = (cwd) => {
-  const cached = mainCheckouts.get(cwd);
+}, WorkspaceConfigError, probes, probeCheckout = (cwd) => {
+  const cached = probes.get(cwd);
   if (cached !== undefined)
     return cached;
+  let dir = path2.resolve(cwd);
+  while (!existsSync2(path2.join(dir, ".git"))) {
+    const up = path2.dirname(dir);
+    if (up === dir)
+      return null;
+    dir = up;
+  }
   const env = { ...process.env };
   for (const name of ["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE"])
     delete env[name];
@@ -6548,15 +6555,43 @@ var nonBlank, branchPreset, commitPreset, workspaceBranchPolicySchema, workspace
     });
     return run.status === 0 ? run.stdout : null;
   };
+  const failed = Error(`git could not tell what checkout ${cwd} is`);
+  const [gitDir, common, superproject] = (git([
+    "rev-parse",
+    "--path-format=absolute",
+    "--git-dir",
+    "--git-common-dir",
+    "--show-superproject-working-tree"
+  ]) ?? "").trim().split(/\r?\n/u);
+  if (!gitDir || !common)
+    return failed;
   let main = null;
-  const dirs = git(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]);
-  const [gitDir, common] = (dirs ?? "").trim().split(/\r?\n/u);
-  if (gitDir && common && path2.resolve(gitDir) !== path2.resolve(common)) {
-    const listed = /^worktree (.+)$/mu.exec(git(["worktree", "list", "--porcelain"]) ?? "")?.[1];
-    main = listed?.trim() || (path2.basename(common) === ".git" ? path2.dirname(common) : common);
-  }
-  mainCheckouts.set(cwd, main);
-  return main;
+  if (path2.resolve(gitDir) !== path2.resolve(common)) {
+    const list = git(["worktree", "list", "--porcelain"]);
+    if (list === null)
+      return failed;
+    main = /^worktree (.+)$/mu.exec(list)?.[1]?.trim() || (path2.basename(common) === ".git" ? path2.dirname(common) : common);
+  }
+  const probe = { main, superproject: superproject || null };
+  probes.set(cwd, probe);
+  return probe;
+}, mainCheckoutOf = (cwd) => {
+  const probe = probeCheckout(cwd);
+  return probe instanceof Error ? null : probe?.main ?? null;
+}, checkoutsAbove = (cwd, seen = new Set) => {
+  const probe = probeCheckout(cwd);
+  if (probe instanceof Error)
+    return probe;
+  const out = [];
+  for (const above of [probe?.main, probe?.superproject])
+    if (above && !seen.has(above)) {
+      seen.add(above);
+      const rest = checkoutsAbove(above, seen);
+      if (rest instanceof Error)
+        return rest;
+      out.push(above, ...rest);
+    }
+  return out;
 }, matchingEntries = (cwd, entries) => {
   const match = (where) => {
     const targets = [where, realpathOf(where)].map((value) => value.replaceAll("\\", "/"));
@@ -6999,7 +7034,7 @@ var init_workspaces = __esm(() => {
   WorkspaceConfigError = class WorkspaceConfigError extends Error {
     name = "WorkspaceConfigError";
   };
-  mainCheckouts = new Map;
+  probes = new Map;
   runtimeWorkspaceIndexSchema = object({
     workspaces: array(object({ name: nonBlank, glob: nonBlank }).passthrough()).optional()
   }).passthrough();
@@ -9317,7 +9352,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.40.1",
+    version: "8.40.4",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9355,13 +9390,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.40.1",
+      "@brainervirus/workit-cursor": "^8.40.4",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.40.1"
+      "@brainervirus/workit-core": "^8.40.4"
     },
     engines: {
       node: ">=24"
@@ -9700,7 +9735,7 @@ function writeFileAtomic(file, content, mode) {
 var init_safe_write = () => {};
 
 // packages/workit-core/src/autonomy.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync2 } from "node:fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync3 } from "node:fs";
 import os4 from "node:os";
 import path11 from "node:path";
 function endpointOf(entry) {
@@ -9726,7 +9761,7 @@ function effectiveEndpoint(endpoint, context) {
   if (context.configured.length > 0 && !context.accountConfigured)
     return {
       endpoint: "commit",
-      reason: `vcs.account missing; set vcs.account for workspace "${context.workspace ?? "?"}" in ~/.config/workit/workspaces.json`
+      reason: `vcs.account missing; ${accountHint(context.workspace)}`
     };
   if (endpoint === "merged" && context.grants.merge === false)
     return { endpoint: "green", reason: missing("merge") };
@@ -9779,34 +9814,20 @@ function configuredGrants(entry) {
   const legacy = fromAutoApprove(record.autoApprove);
   return legacy ? { grants: legacy, source: "autoApprove" } : { grants: {}, source: "default" };
 }
-function resolveAutonomy(cwd) {
-  const override = grantsOverride();
-  if (override)
-    return {
-      workspace: null,
-      grants: { ...DEFAULT_GRANTS },
-      configured: [],
-      source: "default",
-      accountConfigured: false,
-      defaultEndpoint: DEFAULT_ENDPOINT,
-      configuredEndpoint: null,
-      effectiveEndpoint: DEFAULT_ENDPOINT,
-      verification: DEFAULT_VERIFICATION,
-      note: override
-    };
-  const workspace = resolveWorkspaceFrom(cwd, grantsDir(), process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
+function autonomyOf(workspace) {
   const { grants, source } = configuredGrants(workspace);
   const full = { ...DEFAULT_GRANTS, ...grants };
   const configured = GRANT_KINDS.filter((kind) => grants[kind] !== undefined);
   const accountConfigured = Boolean(workspace?.vcs?.account);
+  const name = workspace?.name ?? null;
   return {
-    workspace: workspace?.name ?? null,
+    workspace: name,
     grants: full,
     configured,
     source,
     accountConfigured,
     ...endpointView(workspace, {
-      workspace: workspace?.name ?? null,
+      workspace: name,
       grants: full,
       configured,
       accountConfigured
@@ -9814,6 +9835,63 @@ function resolveAutonomy(cwd) {
     verification: verificationOf(workspace)
   };
 }
+function capAt(named, where, by, why, main = false) {
+  let folder = null;
+  let none = "";
+  try {
+    if (where instanceof Error)
+      throw where;
+    folder = autonomyOf(resolveWorkspaceFrom(where, grantsDir()));
+  } catch (error) {
+    none = error.message;
+  }
+  if (!main && folder?.workspace === named.workspace)
+    return named;
+  const nothing = !folder || folder.configured.length > 0 && !folder.accountConfigured;
+  const grants = { ...named.grants };
+  const unblocks = { ...named.unblocks };
+  const lowered = [];
+  for (const kind of GRANT_KINDS) {
+    const floor = !nothing && folder.grants[kind];
+    if (!raises(kind, floor, grants[kind]))
+      continue;
+    grants[kind] = floor;
+    unblocks[kind] = folder ? nothing ? accountHint(folder.workspace) : grantHint(folder.workspace, kind) : `ask the user to fix: ${none}`;
+    lowered.push(kind);
+  }
+  const ceiling = !nothing && folder.effectiveEndpoint || DEFAULT_ENDPOINT;
+  const endpoint = raisesEndpoint(ceiling, named.effectiveEndpoint);
+  if (endpoint)
+    lowered.push("defaultEndpoint");
+  const strict = folder?.verification ?? "independent";
+  const looser = VERIFICATION_MODES.indexOf(named.verification) < VERIFICATION_MODES.indexOf(strict);
+  if (looser)
+    lowered.push("verification");
+  if (lowered.length === 0)
+    return named;
+  const note = `${by}: ${lowered.join(", ")} capped at ${folder ? `workspace ${folder.workspace}` : `nothing (${none})`}; ${why}`;
+  return {
+    ...named,
+    grants,
+    unblocks,
+    ...endpoint ? { effectiveEndpoint: ceiling, endpointReason: undefined } : {},
+    verification: looser ? strict : named.verification,
+    note: named.note ? `${named.note}; ${note}` : note
+  };
+}
+function resolveAutonomy(cwd) {
+  const override = grantsOverride();
+  if (override)
+    return { ...autonomyOf(null), note: override };
+  const name = process.env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined;
+  let autonomy = autonomyOf(resolveWorkspaceFrom(cwd, grantsDir(), name));
+  if (name)
+    autonomy = capAt(autonomy, cwd, `WORKFLOW_WORKSPACE_NAME=${name}`, "a name never raises grants");
+  const above = checkoutsAbove(cwd);
+  for (const where of above instanceof Error ? [above] : above)
+    autonomy = capAt(autonomy, where, where instanceof Error ? "git" : `checkout ${where}`, "a worktree or submodule never exceeds it", true);
+  return autonomy;
+}
 function requireGrant(cwd, kind, options = {}) {
   let autonomy;
   try {
@@ -9837,7 +9915,7 @@ function requireGrant(cwd, kind, options = {}) {
       kind,
       reason: "grant_required",
       error: `grant_required: ${kind} is not granted for ${workspace ? `workspace "${workspace}"` : "this checkout (no workspace matches it)"}${configured ? "" : " (the default ceiling stops at verified, ready)"}${autonomy.note ? `; ${autonomy.note}` : ""}`,
-      unblock: workspace ? grantHint(workspace, kind) : "ask the user to add a workspace for this checkout (workit init → Workspaces), then: workit grant set <workspace> " + `${kind}=${suggested(kind)}`,
+      unblock: autonomy.unblocks?.[kind] ?? (workspace ? grantHint(workspace, kind) : "ask the user to add a workspace for this checkout (workit init → Workspaces), then: workit grant set <workspace> " + `${kind}=${suggested(kind)}`),
       workspace
     };
   if (autonomy.configured.length > 0 && !autonomy.accountConfigured && options.forge !== false && kind !== "release")
@@ -9846,7 +9924,7 @@ function requireGrant(cwd, kind, options = {}) {
       kind,
       reason: "account_required",
       error: `account_required: workspace "${workspace ?? "?"}" has autonomy grants but no vcs.account, so the credential cannot be checked`,
-      unblock: `set vcs.account for workspace "${workspace ?? "?"}" in ~/.config/workit/workspaces.json`,
+      unblock: accountHint(workspace),
       workspace
     };
   return {
@@ -9903,7 +9981,7 @@ function writeGrants(workspaceName, changes, dir = grantsDir(), endpoint, verifi
     return { ok: false, code: "failed", error: `${current.path} changed; retry` };
   let backup = null;
   try {
-    if (existsSync2(current.path)) {
+    if (existsSync3(current.path)) {
       backup = `${current.path}.bak`;
       copyFileSync2(current.path, backup);
     }
@@ -9984,7 +10062,7 @@ var accountHome = () => {
     else if (item === "merge")
       grants.merge = "verified";
   return Object.keys(grants).length > 0 ? grants : null;
-}, accountOf = (entry) => entry?.vcs?.account, suggested = (kind) => kind === "merge" ? "verified" : "true", grantHint = (workspace, kind) => `ask the user to run, in their own terminal: workit grant set ${workspace ?? "<workspace>"} ${kind}=${suggested(kind)}`, raises = (kind, current, next) => {
+}, accountOf = (entry) => entry?.vcs?.account, suggested = (kind) => kind === "merge" ? "verified" : "true", accountHint = (workspace) => `set vcs.account for workspace "${workspace ?? "?"}" in ~/.config/workit/workspaces.json`, grantHint = (workspace, kind) => `ask the user to run, in their own terminal: workit grant set ${workspace ?? "<workspace>"} ${kind}=${suggested(kind)}`, raises = (kind, current, next) => {
   const rank = (value) => value === true ? 2 : value === "verified" ? 1 : 0;
   return rank(normalized(kind, next)) > rank(normalized(kind, current));
 };
@@ -10642,21 +10720,21 @@ var init_file_lock = __esm(() => {
 });
 
 // packages/workit-core/src/core/package-root.ts
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import path14 from "node:path";
 import { fileURLToPath } from "node:url";
 var packageRoot = () => {
   let dir = path14.dirname(fileURLToPath(import.meta.url));
   while (true) {
     const parent = path14.dirname(dir);
-    if (existsSync3(path14.join(dir, "package.json")) || parent === dir)
+    if (existsSync4(path14.join(dir, "package.json")) || parent === dir)
       return dir;
     dir = parent;
   }
 }, assetRoot = () => {
   const root = packageRoot();
   const assets = path14.join(root, "assets");
-  return existsSync3(assets) ? assets : root;
+  return existsSync4(assets) ? assets : root;
 };
 var init_package_root = () => {};
 
@@ -14263,7 +14341,7 @@ var init_substance = __esm(() => {
 });
 
 // packages/workit-core/src/core/policy/lane.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "node:fs";
 import path18 from "node:path";
 function kindOf(file) {
   if (file.binary)
@@ -14477,7 +14555,7 @@ function branchLane(cwd, options) {
 }
 function untrackedRiskPathsWarning(cwd) {
   const root = worktreeTop(cwd);
-  if (!root || !existsSync5(path18.join(root, RISK_PATHS_FILE)))
+  if (!root || !existsSync6(path18.join(root, RISK_PATHS_FILE)))
     return null;
   return isTracked(root, RISK_PATHS_FILE) ? null : `${RISK_PATHS_FILE} is not committed: it does not apply until it is committed on the base branch`;
 }
@@ -16095,7 +16173,7 @@ var init_ledger = __esm(() => {
 });
 
 // packages/workit-core/src/core/policy/derive.ts
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import path21 from "node:path";
 function deriveRequirements(judgment, scope, constraints, verification = "self") {
   const out = [];
@@ -16250,7 +16328,7 @@ var RULES, derived2 = (spec) => ({
     decisionIds: []
   };
 }, planRecorded = (task, root) => {
-  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync6(path21.resolve(root, ref.path)));
+  const cited = (latestJudgment(task)?.refs ?? []).find((ref) => ref.kind === "external" || ref.kind === "file" && existsSync7(path21.resolve(root, ref.path)));
   if (cited)
     return {
       met: true,
@@ -18967,8 +19045,97 @@ var init_policy_resolver = __esm(() => {
   init_derive();
 });
 
-// packages/workit-core/src/core/task-engine.ts
+// packages/workit-core/src/core/task-view.ts
 import { realpathSync as realpathSync4 } from "node:fs";
+function contextRootError(store, context) {
+  try {
+    realpathSync4(context.root);
+    const root = checkoutRootOf(context.root);
+    if (root !== store.root && !sameDirectoryIdentity(root, store.root))
+      return failure2("invalid_input", "operation context root does not match the task store root");
+  } catch {
+    return failure2("invalid_input", "operation context root cannot be resolved");
+  }
+  return success(null, null, null);
+}
+function helperEntry(task, context, requireSession = false, requireActive = false) {
+  const workerId = context.workerId ?? null;
+  if (workerId === null)
+    return failure2("permission_denied", "operation is lead-only");
+  const worker = task.workers.find((entry) => entry.id === workerId);
+  if (!worker)
+    return failure2("permission_denied", "worker is not assigned to this task");
+  if (worker.data.session && !sameSession2(worker.data.session, context))
+    return failure2("permission_denied", "worker session does not match the caller");
+  if (requireSession && (!worker.data.session || !sameSession2(worker.data.session, context)))
+    return failure2("permission_denied", "worker session has not been observed");
+  if (requireActive && worker.data.state !== "running")
+    return failure2("permission_denied", "worker is not active");
+  return success(null, null, worker);
+}
+function helperTaskGuard(task, context, allowRead = false) {
+  if ((context.workerId ?? null) === null)
+    return success(null, null, null);
+  const worker = helperEntry(task, context);
+  if (!worker.ok)
+    return worker;
+  return allowRead ? success(null, null, null) : failure2("permission_denied", "helpers cannot control task lifecycle or scope");
+}
+function taskView(store, context, task, capture = true, freshness = treeFreshness(store.root)) {
+  const workspace = store.readWorkspace();
+  if (!workspace.ok)
+    return workspace;
+  if (!workspace.data)
+    return failure2("not_found", "workspace not found");
+  const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
+  const current = historical ? success(null, null, historical) : capture ? captureCandidate(store.root, task.intent.data.scope, environment()) : success(null, null, task.candidates.at(-1) ?? null);
+  if (!current.ok)
+    return current;
+  const evaluationWorkspace = workspace.data;
+  const tree = freshness;
+  const requirements = evaluateRequirements(task, evaluationWorkspace, context.capabilities, current.data, store.root, context.caller, tree);
+  return success(task.revision, workspace.data.revision, {
+    task,
+    workspace: evaluationWorkspace,
+    capabilities: context.capabilities,
+    requirements,
+    evidence: evaluateEvidence(task, current.data, tree)
+  });
+}
+function compactContext(store, context, taskId, freshness, origin = null) {
+  const root = contextRootError(store, context);
+  if (!root.ok)
+    return root;
+  const base = origin && store.readStoreTask(origin.taskId);
+  const inherited = base?.ok && base.data ? {
+    origin: origin.origin,
+    taskId: base.data.id,
+    decisions: base.data.decisions.filter((entry) => entry.data.revoked === null)
+  } : null;
+  if (taskId === null)
+    return success(null, null, inherited?.decisions.length ? compactTaskContext(null, inherited) : "");
+  const task = store.readTask(taskId);
+  if (!task.ok)
+    return task;
+  const helper = helperTaskGuard(task.data, context, true);
+  if (!helper.ok)
+    return helper;
+  const view = taskView(store, context, task.data, false, freshness ?? signalFreshness(store.root));
+  if (!view.ok)
+    return view;
+  return success(view.revision, view.workspaceRevision, compactTaskContext(view.data, inherited));
+}
+var environment = () => [], sameSession2 = (value, context) => typeof value === "object" && value !== null && value.kind === "host" && value.host === context.caller.host && value.handle === context.caller.actor;
+var init_task_view = __esm(() => {
+  init_task_contract();
+  init_paths();
+  init_task_store();
+  init_task_context();
+  init_task_evaluation();
+});
+
+// packages/workit-core/src/core/task-engine.ts
+import { realpathSync as realpathSync5 } from "node:fs";
 
 class WorkitCore {
   store;
@@ -18982,15 +19149,7 @@ class WorkitCore {
     return this.context.workerId !== null && this.context.workerId !== undefined;
   }
   contextRootError() {
-    try {
-      realpathSync4(this.context.root);
-      const root = checkoutRootOf(this.context.root);
-      if (root !== this.store.root && !sameDirectoryIdentity(root, this.store.root))
-        return failure2("invalid_input", "operation context root does not match the task store root");
-    } catch {
-      return failure2("invalid_input", "operation context root cannot be resolved");
-    }
-    return success(null, null, null);
+    return contextRootError(this.store, this.context);
   }
   fillRevisions(input, task, workspace) {
     if (input.expectedRevision === undefined && task)
@@ -19038,27 +19197,10 @@ class WorkitCore {
     return success(null, null, { ...request, taskId: found.data.task.id });
   }
   helperEntry(task, requireSession = false, requireActive = false) {
-    const workerId = this.context.workerId ?? null;
-    if (workerId === null)
-      return failure2("permission_denied", "operation is lead-only");
-    const worker = task.workers.find((entry) => entry.id === workerId);
-    if (!worker)
-      return failure2("permission_denied", "worker is not assigned to this task");
-    if (worker.data.session && !sameSession2(worker.data.session, this.context))
-      return failure2("permission_denied", "worker session does not match the caller");
-    if (requireSession && (!worker.data.session || !sameSession2(worker.data.session, this.context)))
-      return failure2("permission_denied", "worker session has not been observed");
-    if (requireActive && worker.data.state !== "running")
-      return failure2("permission_denied", "worker is not active");
-    return success(null, null, worker);
+    return helperEntry(task, this.context, requireSession, requireActive);
   }
   helperTaskGuard(task, allowRead = false) {
-    if ((this.context.workerId ?? null) === null)
-      return success(null, null, null);
-    const worker = this.helperEntry(task);
-    if (!worker.ok)
-      return worker;
-    return allowRead ? success(null, null, null) : failure2("permission_denied", "helpers cannot control task lifecycle or scope");
+    return helperTaskGuard(task, this.context, allowRead);
   }
   activeWorkerBlocker(task) {
     if (task.workers.some((entry) => workerBlocksTransition("close", entry.data.state)))
@@ -19968,48 +20110,10 @@ class WorkitCore {
     });
   }
   compactContext(taskId, freshness, origin = null) {
-    const root = this.contextRootError();
-    if (!root.ok)
-      return root;
-    const base = origin && this.store.readStoreTask(origin.taskId);
-    const inherited = base?.ok && base.data ? {
-      origin: origin.origin,
-      taskId: base.data.id,
-      decisions: base.data.decisions.filter((entry) => entry.data.revoked === null)
-    } : null;
-    if (taskId === null)
-      return success(null, null, inherited?.decisions.length ? compactTaskContext(null, inherited) : "");
-    const task = this.store.readTask(taskId);
-    if (!task.ok)
-      return task;
-    const helper = this.helperTaskGuard(task.data, true);
-    if (!helper.ok)
-      return helper;
-    const view = this.view(task.data, false, freshness ?? signalFreshness(this.store.root));
-    if (!view.ok)
-      return view;
-    return success(view.revision, view.workspaceRevision, compactTaskContext(view.data, inherited));
+    return compactContext(this.store, this.context, taskId, freshness, origin);
   }
-  view(task, capture = true, freshness = treeFreshness(this.store.root)) {
-    const workspace = this.store.readWorkspace();
-    if (!workspace.ok)
-      return workspace;
-    if (!workspace.data)
-      return failure2("not_found", "workspace not found");
-    const historical = task.status === "closed" ? task.candidates.at(-1) : undefined;
-    const current = historical ? success(null, null, historical) : capture ? captureCandidate(this.store.root, task.intent.data.scope, environment()) : success(null, null, task.candidates.at(-1) ?? null);
-    if (!current.ok)
-      return current;
-    const evaluationWorkspace = workspace.data;
-    const tree = freshness;
-    const requirements = evaluateRequirements(task, evaluationWorkspace, this.context.capabilities, current.data, this.store.root, this.context.caller, tree);
-    return success(task.revision, workspace.data.revision, {
-      task,
-      workspace: evaluationWorkspace,
-      capabilities: this.context.capabilities,
-      requirements,
-      evidence: evaluateEvidence(task, current.data, tree)
-    });
+  view(task, capture = true, freshness) {
+    return taskView(this.store, this.context, task, capture, freshness);
   }
   reconcileResume(view, observations = []) {
     const root = this.contextRootError();
@@ -20020,7 +20124,7 @@ class WorkitCore {
     if (view.task.workspaceId !== view.workspace.id)
       return failure2("invalid_input", "task and workspace bindings are invalid");
     try {
-      if (realpathSync4(view.workspace.root) !== this.store.root)
+      if (realpathSync5(view.workspace.root) !== this.store.root)
         return failure2("invalid_input", "task view root does not match the task store");
     } catch {
       return failure2("invalid_input", "task view root cannot be resolved");
@@ -20280,7 +20384,7 @@ var MAX_JUDGED_REFS = 5, workspaceVerification = (root) => {
   host: context.caller.host,
   session: { kind: "host", host: context.caller.host, handle: context.caller.actor },
   workerId: context.workerId ?? null
-}), environment = () => [], sameSession2 = (value, context) => typeof value === "object" && value !== null && value.kind === "host" && value.host === context.caller.host && value.handle === context.caller.actor, verifiedWorkers, sameValue = (left, right) => {
+}), verifiedWorkers, sameValue = (left, right) => {
   try {
     return canonicalJson(left) === canonicalJson(right);
   } catch {
@@ -20599,8 +20703,7 @@ var init_task_engine = __esm(() => {
   init_ledger();
   init_rev();
   init_autonomy();
-  init_task_store();
-  init_paths();
+  init_task_view();
   init_store_lock();
   init_task_context();
   init_workers();
@@ -21242,18 +21345,18 @@ var init_context_read = __esm(() => {
 });
 
 // packages/workit-core/src/core.ts
-import { existsSync as existsSync8, realpathSync as realpathSync5 } from "node:fs";
+import { existsSync as existsSync9, realpathSync as realpathSync6 } from "node:fs";
 import path26 from "node:path";
 function resolveInside(root, candidate) {
-  const base = realpathSync5(root);
+  const base = realpathSync6(root);
   const target = path26.resolve(base, candidate);
   if (target !== base && !target.startsWith(base + path26.sep)) {
     throw new Error("path must stay inside repository root");
   }
   let ancestor = target;
-  while (!existsSync8(ancestor))
+  while (!existsSync9(ancestor))
     ancestor = path26.dirname(ancestor);
-  const canonicalAncestor = realpathSync5(ancestor);
+  const canonicalAncestor = realpathSync6(ancestor);
   if (canonicalAncestor !== base && !canonicalAncestor.startsWith(base + path26.sep)) {
     throw new Error("path must stay inside repository root");
   }
@@ -65487,10 +65590,10 @@ var init_changelog = __esm(() => {
 
 // packages/workit-core/src/core/hygiene.ts
 import { spawnSync as spawnSync12 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync11, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync11, readdirSync as readdirSync5, writeFileSync as writeFileSync5 } from "node:fs";
 import path29 from "node:path";
 var repoRoot2, templatesDir = () => path29.join(repoRoot2, "templates", "hygiene"), packageJson = (root) => {
-  if (!existsSync10(path29.join(root, "package.json")))
+  if (!existsSync11(path29.join(root, "package.json")))
     return null;
   try {
     return JSON.parse(readFileSync11(path29.join(root, "package.json"), "utf8"));
@@ -65498,7 +65601,7 @@ var repoRoot2, templatesDir = () => path29.join(repoRoot2, "templates", "hygiene
     return null;
   }
 }, isOpenSource = (root) => {
-  if (existsSync10(path29.join(root, "LICENSE")))
+  if (existsSync11(path29.join(root, "LICENSE")))
     return true;
   const pkg = packageJson(root);
   if (pkg && !pkg.private)
@@ -65525,7 +65628,7 @@ var repoRoot2, templatesDir = () => path29.join(repoRoot2, "templates", "hygiene
     return { ok: true, root: path29.resolve(root) };
   let children = [];
   try {
-    children = readdirSync5(start, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync10(path29.join(start, entry.name, ".git"))).map((entry) => path29.join(start, entry.name)).toSorted();
+    children = readdirSync5(start, { withFileTypes: true }).filter((entry) => entry.isDirectory() && existsSync11(path29.join(start, entry.name, ".git"))).map((entry) => path29.join(start, entry.name)).toSorted();
   } catch {
     children = [];
   }
@@ -65541,10 +65644,10 @@ var repoRoot2, templatesDir = () => path29.join(repoRoot2, "templates", "hygiene
     files.push("LICENSE", "CONTRIBUTING.md");
   const planned = [];
   for (const file of files) {
-    if (existsSync10(path29.join(root, file)))
+    if (existsSync11(path29.join(root, file)))
       continue;
     const tpl = path29.join(templatesDir(), file);
-    if (!existsSync10(tpl))
+    if (!existsSync11(tpl))
       continue;
     const content = readFileSync11(tpl, "utf8").replace(/<PROJECT>/g, path29.basename(root)).replace(/<YEAR>/g, String(new Date().getFullYear())).replace(/<HOLDER>\s*/g, licenseHolder(root));
     planned.push({ path: path29.join(root, file), content });
@@ -65558,7 +65661,7 @@ var init_hygiene = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/setup-state.ts
-import { existsSync as existsSync11, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "node:fs";
 import path30 from "node:path";
 var classifySetupFile = (dir, name) => {
   const file = path30.join(dir, name);
@@ -65566,7 +65669,7 @@ var classifySetupFile = (dir, name) => {
   try {
     raw = readFileSync12(file, "utf8");
   } catch {
-    if (existsSync11(file)) {
+    if (existsSync12(file)) {
       return { file, status: "malformed", error: `${file} is not readable` };
     }
     return { file, status: "missing" };
@@ -66004,10 +66107,10 @@ import { spawnSync as spawnSync14 } from "node:child_process";
 import {
   accessSync,
   constants as constants2,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   readFileSync as readFileSync13,
   readdirSync as readdirSync6,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   statSync as statSync2
 } from "node:fs";
 import os9 from "node:os";
@@ -66027,7 +66130,7 @@ function hostCommand(name, args, options = {}) {
   }
   return { command: executable, args, cwd: options.cwd, purpose: `${name} CLI` };
 }
-function resolveWindowsShimEntry(contents, shim, exists = existsSync12) {
+function resolveWindowsShimEntry(contents, shim, exists = existsSync13) {
   const root = path33.win32.dirname(shim);
   const matches = contents.matchAll(/(["']?)([^\r\n"']*node_modules[\\/][^\r\n"']+?\.js)\1/gi);
   for (const match of matches) {
@@ -66070,7 +66173,7 @@ function findHostExecutable(name, options = {}) {
   }
   return null;
 }
-function installedHostApp(host, home, env = process.env, platform = process.platform, exists = existsSync12) {
+function installedHostApp(host, home, env = process.env, platform = process.platform, exists = existsSync13) {
   const candidates = [];
   const pathApi = platform === "win32" ? path33.win32 : path33;
   if (platform === "darwin") {
@@ -66227,7 +66330,7 @@ ${result.stdout}
 ${result.stderr}`;
     if (command.packageRoot && command.packageTarget) {
       try {
-        if (!existsSync12(command.packageRoot)) {
+        if (!existsSync13(command.packageRoot)) {
           return {
             ok: false,
             results: [
@@ -66447,7 +66550,7 @@ var resolveWindowsShimScript = (shim) => {
   return found;
 }, isClaudeWorkitInstalled = (home, env = process.env, cwd = process.cwd()) => claudeWorkitInstalls(home, env, cwd).length > 0, findNpmCli = (npm) => {
   try {
-    const resolved = realpathSync6(npm);
+    const resolved = realpathSync7(npm);
     if (path33.basename(resolved) === "npm-cli.js")
       return resolved;
   } catch {}
@@ -66457,7 +66560,7 @@ var resolveWindowsShimScript = (shim) => {
     path33.join(dir, "..", "node_modules", "npm", "bin", "npm-cli.js"),
     path33.join(dir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
   ];
-  return candidates.find((candidate) => existsSync12(candidate)) ?? null;
+  return candidates.find((candidate) => existsSync13(candidate)) ?? null;
 };
 var init_host_install = __esm(() => {
   CLAUDE_PLUGIN_ID = `workit@${CLAUDE_MARKETPLACE_NAME}`;
@@ -66465,9 +66568,9 @@ var init_host_install = __esm(() => {
 });
 
 // packages/workit-core/src/core/skill-manifests.ts
-import { cpSync as cpSync3, existsSync as existsSync13, readFileSync as readFileSync14, readdirSync as readdirSync7, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { cpSync as cpSync3, existsSync as existsSync14, readFileSync as readFileSync14, readdirSync as readdirSync7, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import path34 from "node:path";
-var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync13(root) ? readdirSync7(root).filter((name) => existsSync13(path34.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
+var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync14(root) ? readdirSync7(root).filter((name) => existsSync14(path34.join(root, name, "SKILL.md"))).toSorted() : [], validateSkillManifests = (root, expected, label) => {
   const actual = skillManifestNames(root);
   const missing = expected.filter((name) => !actual.includes(name));
   const extra = actual.filter((name) => !expected.includes(name));
@@ -66513,7 +66616,7 @@ var init_skill_manifests = __esm(() => {
 import { spawnSync as spawnSync15 } from "node:child_process";
 import {
   chmodSync,
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync15,
@@ -66525,7 +66628,7 @@ import {
 import path35 from "node:path";
 function inspectSessionHook(cwd, env = process.env) {
   const none = { hooksDir: null, hookPath: null, helperPath: null, helperCurrent: false };
-  if (!existsSync14(cwd))
+  if (!existsSync15(cwd))
     return { state: "not_git", ...none };
   const top = run2(cwd, ["rev-parse", "--show-toplevel"], env);
   if (!top.ok || !top.out)
@@ -66730,7 +66833,7 @@ exit 0
   } catch {
     return false;
   }
-}, LEFTHOOK_CONFIGS, lefthookConfig = (top) => LEFTHOOK_CONFIGS.map((name) => path35.join(top, name)).find((file) => existsSync14(file)) ?? null, isComment = (line) => /^\s*#/.test(line), COMMAND_SH, DIRECT_CALL, VAR_CALL, runsHelperText = (text) => {
+}, LEFTHOOK_CONFIGS, lefthookConfig = (top) => LEFTHOOK_CONFIGS.map((name) => path35.join(top, name)).find((file) => existsSync15(file)) ?? null, isComment = (line) => /^\s*#/.test(line), COMMAND_SH, DIRECT_CALL, VAR_CALL, runsHelperText = (text) => {
   const lines = text.split(/\r?\n/).filter((line) => !isComment(line));
   const assigned = lines.some((line) => /(?:^|[\s;])h=/.test(line) && line.includes(HELPER_REF));
   return lines.some((line) => DIRECT_CALL.test(line) || assigned && VAR_CALL.test(line));
@@ -66782,7 +66885,7 @@ exit 0
   if (text === null || !runsHelperText(text))
     return false;
   return input.owner === "husky" && target !== input.hookPath || isExecutable(target);
-}, isHuskyV9 = (text, hooksDir) => /\$\(dirname (?:-- )?"\$0"\)\/h"/.test(text) && existsSync14(path35.join(hooksDir, "h")), ownerOf = (text, hooksDir, top) => {
+}, isHuskyV9 = (text, hooksDir) => /\$\(dirname (?:-- )?"\$0"\)\/h"/.test(text) && existsSync15(path35.join(hooksDir, "h")), ownerOf = (text, hooksDir, top) => {
   if (text.includes("husky.sh") || isHuskyV9(text, hooksDir))
     return "husky";
   if (/lefthook/i.test(text) || lefthookConfig(top))
@@ -66941,11 +67044,11 @@ var init_delivery_verbs = __esm(() => {
 // packages/workit-cli/src/admin/host-permissions.ts
 import {
   copyFileSync as copyFileSync4,
-  existsSync as existsSync15,
+  existsSync as existsSync16,
   readdirSync as readdirSync9,
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync17,
-  realpathSync as realpathSync7,
+  realpathSync as realpathSync8,
   rmSync as rmSync3,
   statSync as statSync5
 } from "node:fs";
@@ -67045,7 +67148,7 @@ function planHostPermissions(options) {
     if (!PERMISSION_HOSTS.has(host))
       continue;
     const target = permissionTarget(host, paths);
-    if (!existsSync15(target.hostDir)) {
+    if (!existsSync16(target.hostDir)) {
       plan.notes.push(`${host}: not installed (${target.hostDir} is missing); nothing written`);
       continue;
     }
@@ -67168,7 +67271,7 @@ function applyHostPermissions(plan, options = {}) {
       continue;
     }
     try {
-      const target = change.before === null ? change.file : realpathSync7(change.file);
+      const target = change.before === null ? change.file : realpathSync8(change.file);
       if (change.before !== null) {
         const backups = path38.join(paths.stateDir, "host-permissions-backup");
         mkdirSync7(backups, { recursive: true, mode: 448 });
@@ -67198,7 +67301,7 @@ function applyHostPermissions(plan, options = {}) {
 }
 function permissionHealth(host, options = {}) {
   const target = permissionTarget(host, options);
-  if (!existsSync15(target.hostDir))
+  if (!existsSync16(target.hostDir))
     return { state: "no-host" };
   const text = readText4(target.file);
   if (host === "codex") {
@@ -67232,7 +67335,7 @@ function permissionHealth(host, options = {}) {
 }
 function permissionCoverage(host, commands, options = {}) {
   const target = permissionTarget(host, options);
-  if (!existsSync15(target.hostDir))
+  if (!existsSync16(target.hostDir))
     return { state: "no-host" };
   const cwd = options.cwd ?? process.cwd();
   let missing;
@@ -67417,7 +67520,7 @@ ${[...rules, ...lease, grant].join(`
   return null;
 }, setupCommand = (hosts) => `workit setup --hosts=${hosts.join(",")}`, removeCodexRules = (file, options = {}) => {
   const expected = permissionTarget("codex", options).file;
-  if (path38.resolve(file) !== path38.resolve(expected) || !existsSync15(expected))
+  if (path38.resolve(file) !== path38.resolve(expected) || !existsSync16(expected))
     return false;
   rmSync3(expected);
   return true;
@@ -67558,7 +67661,7 @@ var init_host_permissions = __esm(() => {
 import { spawnSync as spawnSync16 } from "node:child_process";
 import { createHash as createHash14 } from "node:crypto";
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   lstatSync as lstatSync5,
   mkdirSync as mkdirSync8,
   mkdtempSync,
@@ -67576,7 +67679,7 @@ import path39 from "node:path";
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   let dir = path39.resolve(cwd);
   while (true) {
-    if (existsSync16(path39.join(dir, "packages", "workit-core", "package.json")))
+    if (existsSync17(path39.join(dir, "packages", "workit-core", "package.json")))
       return dir;
     const parent = path39.dirname(dir);
     if (parent === dir)
@@ -67681,14 +67784,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return true;
 }, resolveBun = (env) => {
-  if (env.BUN && existsSync16(env.BUN))
+  if (env.BUN && existsSync17(env.BUN))
     return env.BUN;
   for (const candidate of [
     path39.join(env.HOME || os12.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
-    if (existsSync16(candidate))
+    if (existsSync17(candidate))
       return candidate;
   }
   return commandOnPath("bun", env) ? "bun" : null;
@@ -67913,7 +68016,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     const dir = path39.join(codexHome, "plugins", "cache", marketplace, "workit");
     let versions = [];
     try {
-      versions = readdirSync10(dir).filter((v) => existsSync16(path39.join(dir, v, ".codex-plugin")));
+      versions = readdirSync10(dir).filter((v) => existsSync17(path39.join(dir, v, ".codex-plugin")));
     } catch {
       versions = [];
     }
@@ -68022,7 +68125,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const installed = [];
   for (const install of installs) {
     const source = install.root ? path39.join(install.root, "agents") : null;
-    const files = source && existsSync16(source) ? readdirSync10(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
+    const files = source && existsSync17(source) ? readdirSync10(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
     if (files.length === 0) {
       problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
       fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
@@ -68158,7 +68261,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return kept;
 }, checkPiExtension = (res) => {
   const agentDir = piAgentDirOf(res);
-  if (!existsSync16(agentDir) && !commandOnPath("pi", res.env))
+  if (!existsSync17(agentDir) && !commandOnPath("pi", res.env))
     return {
       id: "pi_extension",
       status: "pass",
@@ -68184,7 +68287,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: entry.npm ? installCmd(entry.scope, entry.source) : `restore ${entry.root}, then ${rebuild}`
     };
   const declared = Array.isArray(pkg.pi?.extensions) ? pkg.pi.extensions.some((e) => typeof e === "string" && e.replace(/^\.\//, "") === PI_EXTENSION) : false;
-  if (!declared || !existsSync16(path39.join(entry.root, PI_EXTENSION)))
+  if (!declared || !existsSync17(path39.join(entry.root, PI_EXTENSION)))
     return {
       id: "pi_extension",
       status: "warn",
@@ -68241,7 +68344,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   switch (host) {
     case "opencode": {
       const packaged = path39.join(pkg, "assets", "skills");
-      const root = existsSync16(packaged) ? packaged : path39.join(dev, "packages", "workit-core", "skills");
+      const root = existsSync17(packaged) ? packaged : path39.join(dev, "packages", "workit-core", "skills");
       return WORKIT_METHOD_SKILLS.map((skill) => path39.join(root, skill, "SKILL.md"));
     }
     case "cursor":
@@ -68255,7 +68358,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
 }, hostsFor = (host) => host === "cli" ? ["opencode", "cursor", "cli"] : [host], checkAssets = (res) => {
   const dev = res.dev;
-  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync16(p)).map((p) => `${h}: ${p}`)) : [];
+  const missing = dev ? hostsFor(res.host).flatMap((h) => assetPathsFor(h, dev).filter((p) => !existsSync17(p)).map((p) => `${h}: ${p}`)) : [];
   if (res.host === "cursor" || res.host === "cli") {
     const cursorError = validateCursorSkills(res.cursorPluginDir, WORKIT_METHOD_SKILLS);
     if (cursorError)
@@ -68306,7 +68409,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return false;
   }
 }, registeredCursorLauncher = (res) => {
-  if (!existsSync16(res.cursorMcp))
+  if (!existsSync17(res.cursorMcp))
     return "invalid";
   const config = readJson(res.cursorMcp);
   if (!config)
@@ -68335,7 +68438,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, canonicalCursorHook, isCanonicalCursorHook = (command, res) => command === canonicalCursorHook || command === cursorHooksEntry(res.cursorPluginDir).command, registeredCursorHook = (res) => {
   const hooksFile = path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
-  if (!existsSync16(hooksFile))
+  if (!existsSync17(hooksFile))
     return "invalid";
   const config = readJson(hooksFile);
   if (!config)
@@ -68378,7 +68481,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
   }
   if (dev) {
-    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync16(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
+    missing.push(...hosts.filter((h) => h !== "cursor").flatMap((h) => launcherSlotsFor(h, dev).filter((slot) => !slot.some((p) => existsSync17(p))).map((slot) => `${h}: ${slot.join(" or ")}`)));
   }
   if (missing.length > 0) {
     return {
@@ -68404,7 +68507,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const problems = [];
   const fixes = [];
   if (hostsFor(res.host).includes("cursor")) {
-    const settings = existsSync16(res.cursorSettings) ? readJson(res.cursorSettings) : null;
+    const settings = existsSync17(res.cursorSettings) ? readJson(res.cursorSettings) : null;
     const dirs = Array.isArray(settings?.plugin_dirs) ? settings.plugin_dirs : [];
     for (const entry of dirs.map(String)) {
       const normal = entry.replaceAll("\\", "/").replace(/\/+$/, "");
@@ -68448,14 +68551,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "cursor hook not inspected on this host"
     };
-  if (!existsSync16(res.cursorPluginDir))
+  if (!existsSync17(res.cursorPluginDir))
     return {
       id: "cursor_hook",
       status: "pass",
       detail: "no Cursor plugin install — hook launcher not inspected"
     };
   const launcher = path39.join(res.cursorPluginDir, "hooks", "launch.mjs");
-  if (!existsSync16(launcher))
+  if (!existsSync17(launcher))
     return {
       id: "cursor_hook",
       status: "warn",
@@ -68577,7 +68680,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return "fragile-cache";
   if (entry.startsWith("file:")) {
     const target = entry.replace(/^file:\/\//, "").replace(/^file:/, "");
-    return existsSync16(target) ? "ok" : "missing-file";
+    return existsSync17(target) ? "ok" : "missing-file";
   }
   return "ok";
 }, checkStalePin = (res) => {
@@ -68588,7 +68691,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "opencode pin not inspected on the cursor host"
     };
   }
-  if (!existsSync16(res.opencodeConfig)) {
+  if (!existsSync17(res.opencodeConfig)) {
     return {
       id: "stale_pin",
       status: "pass",
@@ -68641,7 +68744,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return { id: "stale_pin", status: "pass", detail: "opencode pin resolves" };
 }, pluginMcpSelectors = (res) => {
   const p = path39.join(res.cursorPluginDir, "mcp.json");
-  if (!existsSync16(p))
+  if (!existsSync17(p))
     return null;
   const cfg = readJson(p);
   const server = cfg?.mcpServers?.workit;
@@ -68689,7 +68792,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     dir = path39.dirname(dir);
   return { version: found.version, dir };
 }, checkOpenCodePackageCache = (res) => {
-  if (!existsSync16(res.opencodeConfig)) {
+  if (!existsSync17(res.opencodeConfig)) {
     return {
       id: "stale_install",
       status: "pass",
@@ -68764,7 +68867,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "cursor plugin not inspected on this host"
     };
   }
-  if (existsSync16(res.cursorPluginDir) && lstatSync5(res.cursorPluginDir).isSymbolicLink()) {
+  if (existsSync17(res.cursorPluginDir) && lstatSync5(res.cursorPluginDir).isSymbolicLink()) {
     let target = "";
     try {
       target = readlinkSync2(res.cursorPluginDir);
@@ -68802,7 +68905,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh — it rewrites the sessionStart hook to the canonical pinned launcher"
     };
   }
-  const hookDrift = existsSync16(hooksFile) ? cursorHookDrift(readJson(hooksFile), res.cursorPluginDir) : [];
+  const hookDrift = existsSync17(hooksFile) ? cursorHookDrift(readJson(hooksFile), res.cursorPluginDir) : [];
   if (hookDrift.length > 0) {
     return {
       id: "stale_install",
@@ -68886,13 +68989,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const problems = [];
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync16(res.opencodeConfig)) {
+  if (opencodeHost && existsSync17(res.opencodeConfig)) {
     const cfg = readJson(res.opencodeConfig);
     const entries = pluginEntries(cfg);
     if (entries.length > 1)
       problems.push(`opencode registers ${entries.length} workit plugin entries`);
   }
-  if (cursorHost && existsSync16(res.cursorSettings)) {
+  if (cursorHost && existsSync17(res.cursorSettings)) {
     const settings = readJson(res.cursorSettings);
     const enabled = settings?.enabled_plugins;
     if (enabled && typeof enabled === "object") {
@@ -68907,7 +69010,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     if (dirs.length > 1)
       problems.push(`cursor plugin_dirs has ${dirs.length} workit entries`);
   }
-  if (cursorHost && existsSync16(res.cursorMcp)) {
+  if (cursorHost && existsSync17(res.cursorMcp)) {
     const mcp = readJson(res.cursorMcp);
     const servers = mcp?.mcpServers ?? {};
     if (servers && typeof servers === "object") {
@@ -68933,16 +69036,16 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const files = [];
   for (const name of ["config.json", "youtrack.json", "vcs.json", "workspaces.json"]) {
     const p = path39.join(res.configDir, name);
-    if (existsSync16(p))
+    if (existsSync17(p))
       files.push(p);
   }
   const opencodeHost = res.host !== "cursor";
   const cursorHost = res.host !== "opencode";
-  if (opencodeHost && existsSync16(res.opencodeConfig))
+  if (opencodeHost && existsSync17(res.opencodeConfig))
     files.push(res.opencodeConfig);
-  if (cursorHost && existsSync16(res.cursorSettings))
+  if (cursorHost && existsSync17(res.cursorSettings))
     files.push(res.cursorSettings);
-  if (cursorHost && existsSync16(res.cursorMcp))
+  if (cursorHost && existsSync17(res.cursorMcp))
     files.push(res.cursorMcp);
   const bad = files.filter((p) => !parsesAsConfigObject(p));
   if (bad.length === 0)
@@ -69162,7 +69265,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const youtrackJson = readJson(path39.join(res.configDir, "youtrack.json"));
   if (youtrackJson) {
     tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path39.join(res.configDir, "youtrack.token"));
-  } else if (existsSync16(path39.join(res.configDir, "youtrack.token"))) {
+  } else if (existsSync17(path39.join(res.configDir, "youtrack.token"))) {
     tokenPaths.push(path39.join(res.configDir, "youtrack.token"));
   }
   if (tokenPaths.length === 0) {
@@ -69175,7 +69278,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const problems = [];
   for (const raw of tokenPaths) {
     const p = path39.isAbsolute(raw) ? raw : path39.resolve(res.configDir, raw);
-    if (!existsSync16(p)) {
+    if (!existsSync17(p)) {
       problems.push(`${p} is missing`);
       continue;
     }
@@ -69502,8 +69605,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, checkChecksConfig = (res) => {
   const root = checkRoot(res.cwd);
-  const current = existsSync16(path39.join(root, CHECKS_FILE));
-  const legacy = existsSync16(path39.join(root, LEGACY_CHECKS_FILE));
+  const current = existsSync17(path39.join(root, CHECKS_FILE));
+  const legacy = existsSync17(path39.join(root, LEGACY_CHECKS_FILE));
   if (!legacy)
     return {
       id: "checks_config",
@@ -69520,9 +69623,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const root = checkRoot(resolve(options).cwd);
   const from = path39.join(root, LEGACY_CHECKS_FILE);
   const to = path39.join(root, CHECKS_FILE);
-  if (!existsSync16(from))
+  if (!existsSync17(from))
     return { action: "none", detail: `no ${LEGACY_CHECKS_FILE} at ${root}` };
-  if (existsSync16(to))
+  if (existsSync17(to))
     return {
       action: "skipped",
       detail: `${CHECKS_FILE} already exists; ${LEGACY_CHECKS_FILE} left in place`
@@ -69816,7 +69919,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return {
     id,
     status: "warn",
-    detail: `${host} rules in ${coverage.file} do not cover ${shown}${coverage.missing.length > 4 ? ", …" : ""}${existsSync16(coverage.file) ? "" : ` (${coverage.file} does not exist yet; \`workit setup\` writes it)`}: agents get a prompt (or an auto-mode denial) on verbs the workspace grants`,
+    detail: `${host} rules in ${coverage.file} do not cover ${shown}${coverage.missing.length > 4 ? ", …" : ""}${existsSync17(coverage.file) ? "" : ` (${coverage.file} does not exist yet; \`workit setup\` writes it)`}: agents get a prompt (or an auto-mode denial) on verbs the workspace grants`,
     fix: `workit setup --hosts=${host}`
   };
 }, ago = (ms) => {
@@ -69977,13 +70080,13 @@ var init_doctor = __esm(() => {
 import {
   copyFileSync as copyFileSync5,
   cpSync as cpSync4,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   lstatSync as lstatSync6,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync19,
   readdirSync as readdirSync11,
-  realpathSync as realpathSync8,
+  realpathSync as realpathSync9,
   renameSync as renameSync5,
   rmSync as rmSync5,
   statSync as statSync7,
@@ -70088,7 +70191,7 @@ function buildSetupPreview(values, opts = {}) {
         path: ytPath,
         value: draft
       });
-      if (existsSync17(tokenPath))
+      if (existsSync18(tokenPath))
         preserved.push(tokenPath);
       else
         mutations.push({
@@ -70155,7 +70258,7 @@ function buildSetupPreview(values, opts = {}) {
     if (target?.ok) {
       const root = target.root;
       const gitignorePath = path40.join(root, ".gitignore");
-      const existing = existsSync17(gitignorePath) ? readFileSync19(gitignorePath, "utf8") : "";
+      const existing = existsSync18(gitignorePath) ? readFileSync19(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
       const entries = GITIGNORE_ENTRIES.filter((e) => e.trim() !== "" && !existingLines.has(e.trim()));
@@ -70429,13 +70532,13 @@ function applyOpenCode(root, res) {
   };
 }
 function copyPluginDir(src, dest) {
-  const realSrc = realpathSync8(src);
+  const realSrc = realpathSync9(src);
   const marker = path40.join(dest, ".workit-root");
-  const destIsLink = existsSync17(dest) && lstatSync6(dest).isSymbolicLink();
+  const destIsLink = existsSync18(dest) && lstatSync6(dest).isSymbolicLink();
   const synced = !destIsLink && readFileSafe(marker)?.trim() === realSrc && samePluginContent(realSrc, dest, dest);
   if (synced)
     return "Skipped";
-  const hadDir = existsSync17(dest);
+  const hadDir = existsSync18(dest);
   const rules = preservedCursorRules(realSrc, dest);
   const parent = path40.dirname(dest);
   mkdirSync9(parent, { recursive: true });
@@ -70448,7 +70551,7 @@ function copyPluginDir(src, dest) {
       filter: (entry) => !path40.relative(realSrc, entry).split(path40.sep).includes("node_modules")
     });
     const stagedHooks = path40.join(stage, CURSOR_HOOKS_FILE);
-    if (existsSync17(stagedHooks))
+    if (existsSync18(stagedHooks))
       writeFileSync10(stagedHooks, localizedCursorHooks(readFileSync19(stagedHooks), dest));
     for (const [name, content] of rules) {
       mkdirSync9(path40.join(stage, "rules"), { recursive: true });
@@ -70466,7 +70569,7 @@ function copyPluginDir(src, dest) {
     try {
       renameSync5(stage, dest);
     } catch (error) {
-      if (hadDir && !existsSync17(dest))
+      if (hadDir && !existsSync18(dest))
         renameSync5(backup, dest);
       throw error;
     }
@@ -70544,9 +70647,9 @@ function applyCursorMcp(root, res) {
   };
 }
 function verifyPlatform(platform, res) {
-  if (platform === "opencode" && !existsSync17(res.opencodeConfig))
+  if (platform === "opencode" && !existsSync18(res.opencodeConfig))
     return null;
-  if (platform === "cursor" && !existsSync17(res.cursorSettings) && !existsSync17(res.cursorMcp)) {
+  if (platform === "cursor" && !existsSync18(res.cursorSettings) && !existsSync18(res.cursorMcp)) {
     return null;
   }
   return runDoctor({
@@ -70827,7 +70930,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   try {
     raw = readFileSync19(p, "utf8");
   } catch {
-    if (existsSync17(p))
+    if (existsSync18(p))
       return { kind: "malformed", error: `${p} is not readable` };
     return { kind: "missing" };
   }
@@ -70868,7 +70971,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return (require2.resolve.paths(name) ?? []).map((dir) => path40.join(dir, name));
 }, realRoot = (root) => {
   try {
-    return realpathSync8(root);
+    return realpathSync9(root);
   } catch {
     return root;
   }
@@ -70882,7 +70985,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     return OPENCODE_NPM_PIN;
   for (const rel of ["src/plugin.ts", "dist/plugin.js"]) {
     const entry = path40.join(root, rel);
-    if (existsSync17(entry))
+    if (existsSync18(entry))
       return `file://${entry}`;
   }
   return null;
@@ -70912,7 +71015,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
       }
     }
     for (const entry of readdirSync11(dest, { withFileTypes: true })) {
-      if (existsSync17(path40.join(src, entry.name)))
+      if (existsSync18(path40.join(src, entry.name)))
         continue;
       const rel = path40.join(relative, entry.name);
       if (rel === ".workit-root")
@@ -70933,7 +71036,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     for (const entry of readdirSync11(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
-      if (existsSync17(path40.join(sourceRules, entry.name)))
+      if (existsSync18(path40.join(sourceRules, entry.name)))
         continue;
       preserved.set(entry.name, readFileSync19(path40.join(installedRules, entry.name)));
     }
@@ -70941,17 +71044,17 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return preserved;
 }, removeLegacyCursorDir = (res) => {
   const legacy = path40.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
-  if (legacy === res.cursorPluginDir || !existsSync17(legacy))
+  if (legacy === res.cursorPluginDir || !existsSync18(legacy))
     return;
   const legacyRules = path40.join(legacy, "rules");
-  if (existsSync17(legacyRules)) {
+  if (existsSync18(legacyRules)) {
     try {
       mkdirSync9(path40.join(res.cursorPluginDir, "rules"), { recursive: true });
       for (const entry of readdirSync11(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
         const target = path40.join(res.cursorPluginDir, "rules", entry.name);
-        if (!existsSync17(target))
+        if (!existsSync18(target))
           copyFileSync5(path40.join(legacyRules, entry.name), target);
       }
     } catch {}
@@ -71340,7 +71443,7 @@ var init_logic = __esm(() => {
 });
 
 // packages/workit-cli/src/wizard-state.ts
-import { existsSync as existsSync18, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync19, statSync as statSync8 } from "node:fs";
 import path42 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "node:util";
 function resolveBasePath(values, env = process.env) {
@@ -71869,7 +71972,7 @@ var NEXT, PREV, skipsCustomBranch = (screen, preset) => (screen === "branchAllow
   if (!p)
     return "workspace root path is required";
   return !path42.isAbsolute(p) || !isDirectory(p) ? `invalid workspace root "${p}" — enter an existing absolute directory` : null;
-}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync18(path42.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
+}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync19(path42.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
 var init_wizard_state = __esm(() => {
   init_config();
   init_workspaces();
@@ -71928,7 +72031,7 @@ var init_wizard_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/uninstall.ts
-import { existsSync as existsSync19, readFileSync as readFileSync21, realpathSync as realpathSync9, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "node:fs";
 import os14 from "node:os";
 import path43 from "node:path";
 function cleanCursorSettings(settings, pluginDir) {
@@ -72030,7 +72133,7 @@ function planUninstall(paths = {}) {
   const mcpExisting = readJsonRecord(res.cursorMcp);
   const settingsDirty = settingsExisting.kind === "malformed" || settingsExisting.kind === "record" && cleanCursorSettings(settingsExisting.value, res.cursorPluginDir).changed;
   const mcpDirty = mcpExisting.kind === "malformed" || mcpExisting.kind === "record" && cleanCursorMcp(mcpExisting.value).changed;
-  const dirExists = existsSync19(res.cursorPluginDir);
+  const dirExists = existsSync20(res.cursorPluginDir);
   const actions = [];
   if (settingsDirty) {
     actions.push({
@@ -72058,7 +72161,7 @@ function planUninstall(paths = {}) {
     installed: settingsDirty || mcpDirty || dirExists,
     actions
   };
-  const codexInstalled = existsSync19(res.codexPluginDir);
+  const codexInstalled = existsSync20(res.codexPluginDir);
   const codex = {
     host: "codex",
     installed: codexInstalled,
@@ -72106,7 +72209,7 @@ function planUninstall(paths = {}) {
       detail: `remove Workit's permission block from ${path43.basename(file)}`
     });
   }
-  if (existsSync19(res.codexRules))
+  if (existsSync20(res.codexRules))
     codex.actions.push({
       kind: "remove-file",
       path: res.codexRules,
@@ -72142,7 +72245,7 @@ function applyUninstall(plan, paths = {}) {
         if (!allowed) {
           status = "failed";
           detail = `refusing to remove non-canonical plugin directory: ${resolved}`;
-        } else if (!existsSync19(resolved)) {
+        } else if (!existsSync20(resolved)) {
           status = "skipped";
           detail = "directory already absent";
         } else {
@@ -72192,7 +72295,7 @@ var resolveUninstallPaths = (options = {}) => {
   try {
     raw = readFileSync21(file, "utf8");
   } catch {
-    if (existsSync19(file))
+    if (existsSync20(file))
       return { kind: "malformed", error: `${file} is not readable` };
     return { kind: "missing" };
   }
@@ -72236,7 +72339,7 @@ var resolveUninstallPaths = (options = {}) => {
     return false;
   }
   try {
-    return realpathSync9(actionPath) === realpathSync9(expected);
+    return realpathSync10(actionPath) === realpathSync10(expected);
   } catch {
     return true;
   }
@@ -75041,7 +75144,7 @@ var init_setup2 = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade/shared.ts
-import { existsSync as existsSync20, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync22 } from "node:fs";
 import path44 from "node:path";
 import os16 from "node:os";
 import { createHash as createHash15 } from "node:crypto";
@@ -75074,7 +75177,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
     cursorRoot: path44.join(home, ".cursor/plugins/local/workit")
   };
 }, object2 = (file) => {
-  if (!existsSync20(file))
+  if (!existsSync21(file))
     return null;
   let data;
   try {
@@ -75091,7 +75194,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
   } catch {
     return null;
   }
-}, digest2 = (file) => existsSync20(file) ? createHash15("sha256").update(readFileSync22(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+}, digest2 = (file) => existsSync21(file) ? createHash15("sha256").update(readFileSync22(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
   try {
@@ -75187,7 +75290,7 @@ var init_processes = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade/apply.ts
-import { existsSync as existsSync21, readdirSync as readdirSync12, mkdirSync as mkdirSync11, copyFileSync as copyFileSync6, chmodSync as chmodSync2, cpSync as cpSync5 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync12, mkdirSync as mkdirSync11, copyFileSync as copyFileSync6, chmodSync as chmodSync2, cpSync as cpSync5 } from "node:fs";
 import path46 from "node:path";
 import { createHash as createHash16 } from "node:crypto";
 function applyUpgrade(plan, deps = {}) {
@@ -75226,7 +75329,7 @@ function applyUpgrade(plan, deps = {}) {
   const backup = path46.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
   mkdirSync11(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
-    if (existsSync21(file)) {
+    if (existsSync22(file)) {
       const target = path46.join(backup, createHash16("sha256").update(file).digest("hex").slice(0, 12) + "-" + path46.basename(file));
       copyFileSync6(file, target);
       chmodSync2(target, 384);
@@ -75246,7 +75349,7 @@ function applyUpgrade(plan, deps = {}) {
   }
   const run = runner(deps);
   let cursorBackupError = null;
-  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync21(paths.cursorRoot))
+  if (plan.entries.some((entry) => entry.host === "cursor") && existsSync22(paths.cursorRoot))
     try {
       cpSync5(paths.cursorRoot, path46.join(backup, "cursor-package"), {
         recursive: true
@@ -75513,7 +75616,7 @@ var codexPluginRoot = (codexHome) => {
 }, refreshCodexAgents = (run, codexHome) => {
   const root = codexPluginRoot(codexHome);
   const launcher = root && path46.join(root, "dist", "launch-mcp.js");
-  if (!launcher || !existsSync21(launcher))
+  if (!launcher || !existsSync22(launcher))
     return { ok: true, note: "" };
   const fix = `node ${JSON.stringify(launcher)} --install-agents`;
   return run("node", [launcher, "--install-agents"]).status === 0 ? { ok: true, note: "agents refreshed" } : { ok: false, note: "agent refresh failed", fix };
@@ -75552,7 +75655,7 @@ var init_apply = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade/plan.ts
-import { existsSync as existsSync22, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync7, readFileSync as readFileSync23 } from "node:fs";
+import { existsSync as existsSync23, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync7, readFileSync as readFileSync23 } from "node:fs";
 import path47 from "node:path";
 import os17 from "node:os";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
@@ -75739,7 +75842,7 @@ var codexRegistered = (configFile) => {
     }
   };
   guard("opencode", () => {
-    if (existsSync22(paths.opencodeConfig + "c"))
+    if (existsSync23(paths.opencodeConfig + "c"))
       throw new Error("OpenCode JSONC config is present; inspect effective native configuration before updating");
     const oc = object2(paths.opencodeConfig);
     if (oc && [oc.plugins, oc.plugin].some((value) => value !== undefined && !Array.isArray(value)))
@@ -75796,7 +75899,7 @@ var codexRegistered = (configFile) => {
         hostCommand("codex", [], { home, env: paths.env });
         available = true;
       } catch {}
-      if (available || existsSync22(paths.codexConfig))
+      if (available || existsSync23(paths.codexConfig))
         throw new Error("Codex plugin inventory failed; inspect the native host before upgrading");
       return;
     }
@@ -77258,7 +77361,7 @@ __export(exports_workspace, {
   run: () => run11,
   runWorkspace: () => runWorkspace
 });
-import { copyFileSync as copyFileSync7, existsSync as existsSync23 } from "node:fs";
+import { copyFileSync as copyFileSync7, existsSync as existsSync24 } from "node:fs";
 function list2(argv, io) {
   if (argv.length)
     return usage3(io, `unexpected argument ${argv[0]}`);
@@ -77567,7 +77670,7 @@ usage: ${USAGE5}`)), load = (io) => {
     return { ok: false, error: `${current.path} changed; retry` };
   let backup = null;
   try {
-    if (existsSync23(current.path)) {
+    if (existsSync24(current.path)) {
       backup = `${current.path}.bak`;
       copyFileSync7(current.path, backup);
     }
@@ -79403,7 +79506,7 @@ var exports_models = {};
 __export(exports_models, {
   run: () => run14
 });
-import { existsSync as existsSync24, readdirSync as readdirSync13, readFileSync as readFileSync24, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync25, readdirSync as readdirSync13, readFileSync as readFileSync24, statSync as statSync9 } from "node:fs";
 import os22 from "node:os";
 import path55 from "node:path";
 async function run14(argv, io) {
@@ -79499,7 +79602,7 @@ var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
             continue;
           const agentType = JSON.parse(readFileSync24(meta, "utf8")).agentType;
           const transcript = meta.replace(/\.meta\.json$/, ".jsonl");
-          if (typeof agentType !== "string" || !existsSync24(transcript))
+          if (typeof agentType !== "string" || !existsSync25(transcript))
             continue;
           const ran = modelsOf(transcript);
           if (!ran.size)
@@ -79638,7 +79741,7 @@ var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock)
 
 // packages/workit-core/src/git/ops.ts
 import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync25, readFileSync as readFileSync25 } from "node:fs";
+import { existsSync as existsSync26, readFileSync as readFileSync25 } from "node:fs";
 import path56 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
@@ -79656,11 +79759,11 @@ function operationInProgress(cwd) {
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
-    if (!marker || !existsSync25(marker))
+    if (!marker || !existsSync26(marker))
       continue;
-    if (index === 1 && existsSync25(path56.join(marker, "applying")))
+    if (index === 1 && existsSync26(path56.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync25(path56.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync26(path56.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
         headName = readFileSync25(path56.join(marker, "head-name"), "utf8").trim();
@@ -79991,7 +80094,7 @@ function gitCommit(cwd, input) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync25(path56.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync26(path56.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -86972,7 +87075,7 @@ __export(exports_pr, {
   checkPrTitle: () => checkPrTitle,
   run: () => run15
 });
-import { existsSync as existsSync26, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync27 } from "node:fs";
 import path66 from "node:path";
 function titleRules(cwd) {
   let root;
@@ -86985,7 +87088,7 @@ function titleRules(cwd) {
   let name = "";
   for (const candidate of COMMITLINT_FILES) {
     const full = path66.join(root, candidate);
-    if (!existsSync26(full))
+    if (!existsSync27(full))
       continue;
     text = readFileSync27(full, "utf8");
     name = candidate;
@@ -106680,7 +106783,7 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync27, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync28, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
 import path71 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
@@ -106707,7 +106810,7 @@ function expandPaths(cwd, inputs) {
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
     const full = path71.resolve(cwd, input);
-    if (!existsSync27(full))
+    if (!existsSync28(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
       walkTests(full, files);
@@ -106823,14 +106926,14 @@ var init_audit = __esm(() => {
 // packages/workit-cli/src/test-audit/mutate.ts
 import { spawn as spawn2 } from "node:child_process";
 import {
-  existsSync as existsSync28,
+  existsSync as existsSync29,
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync12,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync15,
   readFileSync as readFileSync30,
   readlinkSync as readlinkSync3,
-  realpathSync as realpathSync10,
+  realpathSync as realpathSync11,
   renameSync as renameSync7,
   rmSync as rmSync9,
   statSync as statSync11,
@@ -106967,7 +107070,7 @@ function linkNodeModules(origin, target, repo, copy) {
     if (entry.isSymbolicLink()) {
       let real;
       try {
-        real = realpathSync10(from);
+        real = realpathSync11(from);
       } catch {
         continue;
       }
@@ -106983,11 +107086,11 @@ function linkNodeModules(origin, target, repo, copy) {
 function copySymlink(repo, tree, from, to) {
   let real = null;
   try {
-    real = realpathSync10(from);
+    real = realpathSync11(from);
   } catch {
     real = null;
   }
-  const realRepo = realpathSync10(repo);
+  const realRepo = realpathSync11(repo);
   if (real && inside5(realRepo, real)) {
     symlinkSync(path72.relative(path72.dirname(to), path72.join(tree, path72.relative(realRepo, real))), to);
     return;
@@ -107001,7 +107104,7 @@ function writeInside(copy, file, content) {
   const target = path72.join(copy, file);
   try {
     const stat = lstatSync8(target);
-    if (!stat.isFile() || !inside5(realpathSync10(copy), realpathSync10(path72.dirname(target))))
+    if (!stat.isFile() || !inside5(realpathSync11(copy), realpathSync11(path72.dirname(target))))
       return false;
   } catch {
     return false;
@@ -107052,7 +107155,7 @@ function copyWorkingTree(repo) {
   }
   for (const parent of dirs) {
     const modules = path72.join(repo, parent, "node_modules");
-    if (existsSync28(modules) && !existsSync28(path72.join(tree, parent, "node_modules")))
+    if (existsSync29(modules) && !existsSync29(path72.join(tree, parent, "node_modules")))
       linkNodeModules(modules, path72.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
@@ -107102,7 +107205,7 @@ async function runMutation(options) {
     const relative = toPosix(path72.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
-    if (NOT_SOURCE.test(relative) || !existsSync28(absolute))
+    if (NOT_SOURCE.test(relative) || !existsSync29(absolute))
       continue;
     try {
       candidates.push(...mutantsFor(readFileSync30(absolute, "utf8"), relative, lines));
@@ -107292,7 +107395,7 @@ var exports_test_audit = {};
 __export(exports_test_audit, {
   run: () => run23
 });
-import { existsSync as existsSync29 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 import path73 from "node:path";
 function parse8(argv) {
   const options = {
@@ -107416,7 +107519,7 @@ usage: ${USAGE16}`));
   }
   let files;
   if (options.diff && changed)
-    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync29(file)).toSorted();
+    files = [...changed.keys()].filter((file) => TEST_FILE.test(toPosix(file)) && existsSync30(file)).toSorted();
   else {
     const expanded = expandPaths(io.cwd, options.paths);
     if (expanded.missing.length > 0)