@brainervirus/workit-cli 8.43.2 → 8.44.0

package/dist/index.js

@@ -97,7 +97,7 @@ import os from "node:os";
 import path from "node:path";
 var diagnosticLogger, setDiagnosticLogger = (logger) => {
   diagnosticLogger = logger;
-}, getDiagnosticLogger = () => diagnosticLogger, PRESETS, mergePreset = (preset, input = {}, current = {
+}, getDiagnosticLogger = () => diagnosticLogger, UPDATES_MODES, isUpdatesMode = (value) => UPDATES_MODES.includes(value), PRESETS, mergePreset = (preset, input = {}, current = {
   branchPolicy: { preset, allowed: [], protected: [] }
 }) => {
   const defs = PRESETS[preset];
@@ -137,7 +137,11 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
         copyFileSync(src, dest);
     } catch (err) {
       migrationFailed = true;
-      diagnosticLogger?.warn(EVENT.migration, { from: src, ok: false, ...errorDetail(err) });
+      diagnosticLogger?.warn(EVENT.migration, {
+        from: src,
+        ok: false,
+        ...errorDetail(err)
+      });
       console.warn(`[workit] config migration: a file could not be copied to ${dir}; it will be retried on the next run`);
     }
   }
@@ -157,10 +161,18 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return { status: "malformed", path: file, error: `${file} is not valid JSON` };
+    return {
+      status: "malformed",
+      path: file,
+      error: `${file} is not valid JSON`
+    };
   }
   if (!isConfigObject(parsed)) {
-    return { status: "malformed", path: file, error: `${file} is not a JSON object` };
+    return {
+      status: "malformed",
+      path: file,
+      error: `${file} is not a JSON object`
+    };
   }
   const input = parsed;
   const locale = LOCALE_RE.test(String(input.locale ?? "")) ? input.locale : DEFAULTS.locale;
@@ -176,7 +188,8 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
     commitPolicy: {
       preset: commitPreset,
       ...typeof input.commitPolicy?.pattern === "string" ? { pattern: input.commitPolicy.pattern } : {}
-    }
+    },
+    ...isUpdatesMode(input.updates) ? { updates: input.updates } : {}
   };
   if (!Object.hasOwn(PRESETS, input.branchPolicy?.preset))
     unchosenBranchPolicy.add(config);
@@ -224,6 +237,7 @@ var diagnosticLogger, setDiagnosticLogger = (logger) => {
 };
 var init_config = __esm(() => {
   init_boundary();
+  UPDATES_MODES = ["prompt", "auto", "off"];
   PRESETS = {
     gitflow: {
       allowed: ["feature/*", "bugfix/*", "hotfix/*", "release/*"],
@@ -9417,7 +9431,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.43.2",
+    version: "8.44.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -9455,13 +9469,13 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-cursor": "^8.43.2",
+      "@brainervirus/workit-cursor": "^8.44.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
     },
     devDependencies: {
-      "@brainervirus/workit-core": "^8.43.2"
+      "@brainervirus/workit-core": "^8.44.0"
     },
     engines: {
       node: ">=24"
@@ -67459,6 +67473,60 @@ var init_hook_runs = __esm(() => {
   init_heavy_words();
 });
 
+// packages/workit-cli/src/update-settings.ts
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync17, renameSync as renameSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import os11 from "node:os";
+import path38 from "node:path";
+var workitConfigDir = (env) => env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path38.join(env.XDG_CONFIG_HOME || path38.join(env.HOME ?? os11.homedir(), ".config"), "workit"), cacheFile = (env, dir = stateDir(env)) => path38.join(dir, "update-check.json"), readUpdateCache = (env, dir) => {
+  try {
+    const data = JSON.parse(readFileSync17(cacheFile(env, dir), "utf8"));
+    return isConfigObject(data) ? data : {};
+  } catch {
+    return {};
+  }
+}, writeUpdateCache = (env, cache) => {
+  try {
+    const file = cacheFile(env);
+    mkdirSync7(path38.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    writeFileSync9(temp, JSON.stringify(cache) + `
+`, "utf8");
+    renameSync4(temp, file);
+  } catch {}
+}, configFile = (env, dir = workitConfigDir(env)) => path38.join(dir, "config.json"), readUpdatesMode = (env, dir) => {
+  try {
+    const data = JSON.parse(readFileSync17(configFile(env, dir), "utf8"));
+    return isConfigObject(data) && isUpdatesMode(data.updates) ? data.updates : "prompt";
+  } catch {
+    return "prompt";
+  }
+}, writeUpdatesMode = (env, mode) => {
+  const file = configFile(env);
+  let data = {};
+  try {
+    const raw = readFileSync17(file, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!isConfigObject(parsed))
+      return `${file} is not a JSON object`;
+    data = parsed;
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      return `${file} is not valid JSON`;
+  }
+  try {
+    mkdirSync7(path38.dirname(file), { recursive: true });
+    writeFileSync9(file, JSON.stringify({ ...data, updates: mode }, null, 2) + `
+`, "utf8");
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : `cannot write ${file}`;
+  }
+};
+var init_update_settings = __esm(() => {
+  init_heavy_words();
+  init_config();
+});
+
 // packages/workit-core/src/hooks/delivery-verbs.ts
 var WORKIT_ALLOWED_VERBS, ALLOWED;
 var init_delivery_verbs = __esm(() => {
@@ -67488,14 +67556,14 @@ import {
   copyFileSync as copyFileSync4,
   existsSync as existsSync16,
   readdirSync as readdirSync9,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync17,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync18,
   realpathSync as realpathSync8,
   rmSync as rmSync3,
   statSync as statSync5
 } from "node:fs";
-import os11 from "node:os";
-import path38 from "node:path";
+import os12 from "node:os";
+import path39 from "node:path";
 function mergeClaudeSettings(settings, shell, skip = {}) {
   const config = clone4(settings);
   const owned = emptyOwned();
@@ -67615,7 +67683,7 @@ function planHostPermissions(options) {
         plan.blocked.push(`${target.file} is not a JSON object; left untouched`);
         continue;
       }
-      const shellWanted = host === "claude-code" && options.shell !== false && path38.basename(paths.env.SHELL ?? "") === "zsh";
+      const shellWanted = host === "claude-code" && options.shell !== false && path39.basename(paths.env.SHELL ?? "") === "zsh";
       const bash = shellWanted ? options.bash === undefined ? findBash(paths.env) : options.bash : null;
       const merged = host === "claude-code" ? mergeClaudeSettings(parsed, bash, skip) : mergeCursorCliConfig(parsed, skip);
       if (merged.error) {
@@ -67715,11 +67783,11 @@ function applyHostPermissions(plan, options = {}) {
     try {
       const target = change.before === null ? change.file : realpathSync8(change.file);
       if (change.before !== null) {
-        const backups = path38.join(paths.stateDir, "host-permissions-backup");
-        mkdirSync7(backups, { recursive: true, mode: 448 });
-        copyFileSync4(target, path38.join(backups, `${new Date().toISOString().replaceAll(":", "-")}-${change.host}-${path38.basename(change.file)}`));
+        const backups = path39.join(paths.stateDir, "host-permissions-backup");
+        mkdirSync8(backups, { recursive: true, mode: 448 });
+        copyFileSync4(target, path39.join(backups, `${new Date().toISOString().replaceAll(":", "-")}-${change.host}-${path39.basename(change.file)}`));
       }
-      mkdirSync7(path38.dirname(target), { recursive: true });
+      mkdirSync8(path39.dirname(target), { recursive: true });
       writeFileAtomic(target, change.after);
       const previous = record.hosts[change.host];
       record.hosts[change.host] = {
@@ -67782,19 +67850,19 @@ function permissionCoverage(host, commands, options = {}) {
   const cwd = options.cwd ?? process.cwd();
   let missing;
   if (host === "codex") {
-    const patterns = codexAllowPatterns(path38.dirname(target.file));
+    const patterns = codexAllowPatterns(path39.dirname(target.file));
     missing = commands.filter((command) => {
       const words = command.split(" ");
       return !patterns.some((p) => p.every((word, i) => words[i] === word));
     });
   } else if (host === "cursor") {
-    const rules = [target.file, path38.join(cwd, ".cursor", "cli.json")].flatMap((file) => stringList(valueFrom(readRecord(file), "permissions", "allow")));
+    const rules = [target.file, path39.join(cwd, ".cursor", "cli.json")].flatMap((file) => stringList(valueFrom(readRecord(file), "permissions", "allow")));
     missing = commands.filter((command) => !rules.some((rule) => cursorRuleMatches(rule, command)));
   } else {
     const files = [
       target.file,
-      path38.join(cwd, ".claude", "settings.json"),
-      path38.join(cwd, ".claude", "settings.local.json")
+      path39.join(cwd, ".claude", "settings.json"),
+      path39.join(cwd, ".claude", "settings.local.json")
     ].map(readRecord);
     const rules = files.flatMap((file) => stringList(valueFrom(file, "permissions", "allow")));
     missing = commands.filter((command) => !rules.some((rule) => claudeRuleMatches(rule, command)));
@@ -67896,7 +67964,7 @@ ${[...rules, ...lease, grant].join(`
   };
 }, resolvePaths = (options) => {
   const env = options.env ?? process.env;
-  const home = options.home ?? env.HOME ?? os11.homedir();
+  const home = options.home ?? env.HOME ?? os12.homedir();
   return {
     home,
     env,
@@ -67906,25 +67974,25 @@ ${[...rules, ...lease, grant].join(`
   const { home, env } = resolvePaths(options);
   if (host === "claude-code") {
     const dir = claudeConfigDir(home, env);
-    return { file: path38.join(dir, "settings.json"), hostDir: dir };
+    return { file: path39.join(dir, "settings.json"), hostDir: dir };
   }
   if (host === "codex") {
-    const dir = env.CODEX_HOME || path38.join(home, ".codex");
-    return { file: path38.join(dir, "rules", "workit.rules"), hostDir: dir };
+    const dir = env.CODEX_HOME || path39.join(home, ".codex");
+    return { file: path39.join(dir, "rules", "workit.rules"), hostDir: dir };
   }
-  const dir = path38.join(home, ".cursor");
-  return { file: path38.join(dir, "cli-config.json"), hostDir: dir };
+  const dir = path39.join(home, ".cursor");
+  return { file: path39.join(dir, "cli-config.json"), hostDir: dir };
 }, AGENT_SESSION_VARS, agentSessionVar = (env) => AGENT_SESSION_VARS.find((name) => (env[name] ?? "") !== "") ?? null, RECORD_FILE = "host-permissions.json", readOwnership = (options = {}) => {
   const { stateDir } = resolvePaths(options);
   try {
-    const value = JSON.parse(readFileSync17(path38.join(stateDir, RECORD_FILE), "utf8"));
+    const value = JSON.parse(readFileSync18(path39.join(stateDir, RECORD_FILE), "utf8"));
     if (isRecord5(value) && isRecord5(value.hosts))
       return { version: 1, hosts: value.hosts };
   } catch {}
   return { version: 1, hosts: {} };
 }, writeOwnership = (record, stateDir) => {
-  mkdirSync7(stateDir, { recursive: true });
-  writeFileAtomic(path38.join(stateDir, RECORD_FILE), JSON.stringify(record, null, 2) + `
+  mkdirSync8(stateDir, { recursive: true });
+  writeFileAtomic(path39.join(stateDir, RECORD_FILE), JSON.stringify(record, null, 2) + `
 `, 384);
 }, unionLists = (a, b) => {
   const lists = { ...a };
@@ -67946,14 +68014,14 @@ ${[...rules, ...lease, grant].join(`
   writeOwnership(record, paths.stateDir);
 }, readText4 = (file) => {
   try {
-    return readFileSync17(file, "utf8");
+    return readFileSync18(file, "utf8");
   } catch {
     return null;
   }
 }, findBash = (env) => {
-  const dirs = ["/usr/bin", "/bin", ...(env.PATH ?? "").split(path38.delimiter).filter(Boolean)];
+  const dirs = ["/usr/bin", "/bin", ...(env.PATH ?? "").split(path39.delimiter).filter(Boolean)];
   for (const dir of dirs) {
-    const candidate = path38.join(dir, "bash");
+    const candidate = path39.join(dir, "bash");
     try {
       if (statSync5(candidate).isFile())
         return candidate;
@@ -67962,7 +68030,7 @@ ${[...rules, ...lease, grant].join(`
   return null;
 }, setupCommand = (hosts) => `workit setup --hosts=${hosts.join(",")}`, removeCodexRules = (file, options = {}) => {
   const expected = permissionTarget("codex", options).file;
-  if (path38.resolve(file) !== path38.resolve(expected) || !existsSync16(expected))
+  if (path39.resolve(file) !== path39.resolve(expected) || !existsSync16(expected))
     return false;
   rmSync3(expected);
   return true;
@@ -68004,7 +68072,7 @@ ${[...rules, ...lease, grant].join(`
     return patterns;
   }
   for (const name of names)
-    for (const m of (readText4(path38.join(dir, name)) ?? "").matchAll(/pattern\s*=\s*(\[[^\]]*\])\s*,\s*decision\s*=\s*"allow"/gu))
+    for (const m of (readText4(path39.join(dir, name)) ?? "").matchAll(/pattern\s*=\s*(\[[^\]]*\])\s*,\s*decision\s*=\s*"allow"/gu))
       try {
         const words = JSON.parse(m[1]);
         if (Array.isArray(words))
@@ -68105,25 +68173,25 @@ import { createHash as createHash14 } from "node:crypto";
 import {
   existsSync as existsSync17,
   lstatSync as lstatSync6,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   mkdtempSync,
   readdirSync as readdirSync10,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   readlinkSync as readlinkSync2,
-  renameSync as renameSync4,
+  renameSync as renameSync5,
   rmSync as rmSync4,
   statSync as statSync6,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync9
+  writeFileSync as writeFileSync10
 } from "node:fs";
-import os12 from "node:os";
-import path39 from "node:path";
+import os13 from "node:os";
+import path40 from "node:path";
 var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
-  let dir = path39.resolve(cwd);
+  let dir = path40.resolve(cwd);
   while (true) {
-    if (existsSync17(path39.join(dir, "packages", "workit-core", "package.json")))
+    if (existsSync17(path40.join(dir, "packages", "workit-core", "package.json")))
       return dir;
-    const parent = path39.dirname(dir);
+    const parent = path40.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -68148,12 +68216,13 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return found;
 }, listClaudeProcesses = () => listProcessesMatching((args) => /^(\S*\/)?claude(\s|$)/.test(args)), listCodexProcesses = () => listProcessesMatching((args) => /^(\S*\/)?codex(\.js)?(\s|$)|^(\S*\/)?node(js)?\s+(\S+\s+)*?\S*\/codex(\.js)?(\s|$)/.test(args) && !/\bdaemon\s+pid-update-loop\b/.test(args)), resolve = (options) => {
   const env = options.env ?? process.env;
-  const home = options.home ?? env.HOME ?? os12.homedir();
-  const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path39.join(home, ".config", "workit");
-  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path39.join(home, ".local", "state", "workit");
+  const home = options.home ?? env.HOME ?? os13.homedir();
+  const configDir = options.configDir ?? env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path40.join(home, ".config", "workit");
+  const stateDir = options.stateDir ?? env.WORKFLOW_TOOLKIT_STATE ?? path40.join(home, ".local", "state", "workit");
   const cwd = options.cwd ?? process.cwd();
   const dev = options.dev?.trim() || env.WORKFLOW_TOOLKIT_DEV?.trim() || findDevFromCwd(cwd);
   return {
+    explicitDirs: { config: options.configDir, state: options.stateDir },
     host: options.host ?? "cli",
     home,
     configDir,
@@ -68161,11 +68230,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     cwd,
     workspaceRoot: options.workspaceRoot ?? env.WORKFLOW_WORKSPACE_ROOT ?? cwd,
     dev,
-    opencodeConfig: options.opencodeConfig ?? path39.join(home, ".config", "opencode", "opencode.json"),
+    opencodeConfig: options.opencodeConfig ?? path40.join(home, ".config", "opencode", "opencode.json"),
     opencodePackageCacheDir: options.opencodePackageCacheDir ?? null,
-    cursorSettings: options.cursorSettings ?? path39.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path39.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path39.join(home, ".cursor", "plugins", "local", "workit"),
+    cursorSettings: options.cursorSettings ?? path40.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path40.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path40.join(home, ".cursor", "plugins", "local", "workit"),
     cursorHeartbeatDir: options.stateDir ?? (env.WORKFLOW_TOOLKIT_STATE || resolveStateDir()),
     hookStateDir: options.stateDir ?? (env.WORKFLOW_TOOLKIT_STATE || resolveStateDir()),
     codexHome: options.codexHome,
@@ -68179,14 +68248,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, readJson = (p) => {
   try {
-    const parsed = JSON.parse(readFileSync18(p, "utf8"));
+    const parsed = JSON.parse(readFileSync19(p, "utf8"));
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }, parsesAsConfigObject = (p) => {
   try {
-    return isConfigObject(JSON.parse(readFileSync18(p, "utf8")));
+    return isConfigObject(JSON.parse(readFileSync19(p, "utf8")));
   } catch {
     return false;
   }
@@ -68196,12 +68265,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     ...new Set(entries.filter((entry) => typeof entry === "string" && isWorkitPlugin(entry)))
   ];
 }, commandOnPath = (name, env) => findOnPath(process.platform === "win32" ? [name, `${name}.exe`] : [name], env) !== null, pathextNames = (name, env) => process.platform === "win32" ? (env.PATHEXT ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map((ext) => `${name}${ext.toLowerCase()}`) : [name], findOnPath = (names, env) => {
-  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path39.delimiter);
+  const dirs = (env.PATH ?? process.env.PATH ?? "").split(path40.delimiter);
   for (const dir of dirs) {
     if (!dir)
       continue;
     for (const candidateName of names) {
-      const candidate = path39.join(dir, candidateName);
+      const candidate = path40.join(dir, candidateName);
       try {
         const st = statSync6(candidate);
         if (process.platform !== "win32" && (st.mode & 73) === 0)
@@ -68230,7 +68299,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (env.BUN && existsSync17(env.BUN))
     return env.BUN;
   for (const candidate of [
-    path39.join(env.HOME || os12.homedir(), ".bun/bin/bun"),
+    path40.join(env.HOME || os13.homedir(), ".bun/bin/bun"),
     "/usr/local/bin/bun",
     "/usr/bin/bun"
   ]) {
@@ -68285,7 +68354,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: "installed package, not a dev checkout — version parity applies to checkouts only"
     };
   }
-  const corePkg = readJson(path39.join(res.dev, "packages/workit-core/package.json"));
+  const corePkg = readJson(path40.join(res.dev, "packages/workit-core/package.json"));
   if (!corePkg) {
     return {
       id: "versions",
@@ -68295,7 +68364,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const refs = new Set;
   for (const name of ["workit-opencode", "workit-cursor", "workit-cli"]) {
-    const pkg = readJson(path39.join(res.dev, "packages", name, "package.json"));
+    const pkg = readJson(path40.join(res.dev, "packages", name, "package.json"));
     const dep = pkg?.dependencies?.["@brainervirus/workit-core"] ?? pkg?.devDependencies?.["@brainervirus/workit-core"];
     if (typeof dep === "string")
       refs.add(dep);
@@ -68311,7 +68380,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (refs.size > 1) {
     problems.push(`adapters pin different core versions: ${[...refs].join(", ")}`);
   }
-  const opencodePkg = readJson(path39.join(res.dev, "packages/workit-opencode/package.json"));
+  const opencodePkg = readJson(path40.join(res.dev, "packages/workit-opencode/package.json"));
   const sdk = opencodePkg?.dependencies?.["@opencode/plugin"] ?? opencodePkg?.devDependencies?.["@opencode/plugin"];
   const sdkVersion = typeof sdk === "string" ? (sdk.match(/^\d+(?:\.\d+){0,2}/) ?? [])[0] : null;
   if (sdkVersion && !semverAtLeast(sdkVersion, SUPPORT_MATRIX.opencode.minimum)) {
@@ -68338,14 +68407,14 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "opencode CLI not on PATH — skipping version check"
     };
-  const scratch = mkdtempSync(path39.join(os12.tmpdir(), "workit-doctor-opencode-"));
+  const scratch = mkdtempSync(path40.join(os13.tmpdir(), "workit-doctor-opencode-"));
   let raw;
   try {
     raw = versionOf("opencode", {
       ...res.env,
-      XDG_DATA_HOME: path39.join(scratch, "data"),
-      XDG_STATE_HOME: path39.join(scratch, "state"),
-      XDG_CACHE_HOME: path39.join(scratch, "cache")
+      XDG_DATA_HOME: path40.join(scratch, "data"),
+      XDG_STATE_HOME: path40.join(scratch, "state"),
+      XDG_CACHE_HOME: path40.join(scratch, "cache")
     }, 5000);
   } finally {
     rmSync4(scratch, { recursive: true, force: true });
@@ -68409,7 +68478,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const tables = new Map;
   let text;
   try {
-    text = readFileSync18(file, "utf8");
+    text = readFileSync19(file, "utf8");
   } catch {
     return tables;
   }
@@ -68447,19 +68516,19 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     current[unquote(pair[1])] = value === "true" ? true : value === "false" ? false : unquote(value);
   }
   return tables;
-}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path39.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
+}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path40.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
   const codexHome = codexHomeOf(res);
-  const configFile = path39.join(codexHome, "config.toml");
+  const configFile = path40.join(codexHome, "config.toml");
   const installs = [];
   for (const [key, table] of readTomlTables(configFile)) {
     const [kind, id, ...rest] = key.split("\x00");
     if (kind !== "plugins" || rest.length > 0 || !id?.startsWith("workit@") || table.enabled === false)
       continue;
     const marketplace = id.slice("workit@".length);
-    const dir = path39.join(codexHome, "plugins", "cache", marketplace, "workit");
+    const dir = path40.join(codexHome, "plugins", "cache", marketplace, "workit");
     let versions = [];
     try {
-      versions = readdirSync10(dir).filter((v) => existsSync17(path39.join(dir, v, ".codex-plugin")));
+      versions = readdirSync10(dir).filter((v) => existsSync17(path40.join(dir, v, ".codex-plugin")));
     } catch {
       versions = [];
     }
@@ -68467,7 +68536,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     installs.push({
       id,
       marketplace,
-      root: version ? path39.join(dir, version) : null,
+      root: version ? path40.join(dir, version) : null,
       version,
       configFile
     });
@@ -68489,7 +68558,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
   return `sha256:${createHash14("sha256").update(JSON.stringify(body)).digest("hex")}`;
 }, codexHookTrust = (install, tables) => {
-  const hooks = install.root ? readJson(path39.join(install.root, "hooks", "hooks.json"))?.hooks : null;
+  const hooks = install.root ? readJson(path40.join(install.root, "hooks", "hooks.json"))?.hooks : null;
   if (!hooks || typeof hooks !== "object")
     return null;
   const result = [];
@@ -68562,25 +68631,25 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "no Workit Codex plugin enabled — skipping"
     };
-  const agentsDir = path39.join(codexHomeOf(res), "agents");
+  const agentsDir = path40.join(codexHomeOf(res), "agents");
   const problems = [];
   const fixes = [];
   const installed = [];
   for (const install of installs) {
-    const source = install.root ? path39.join(install.root, "agents") : null;
+    const source = install.root ? path40.join(install.root, "agents") : null;
     const files = source && existsSync17(source) ? readdirSync10(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
     if (files.length === 0) {
       problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
       fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
       continue;
     }
-    const install_fix = `node ${JSON.stringify(path39.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
-    const pluginVersion = readJson(path39.join(install.root, "package.json"))?.version;
+    const install_fix = `node ${JSON.stringify(path40.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
+    const pluginVersion = readJson(path40.join(install.root, "package.json"))?.version;
     const version = typeof pluginVersion === "string" ? pluginVersion.match(SEMVER)?.[0] ?? null : null;
     let stale = false;
     for (const file of files) {
-      const dest = path39.join(agentsDir, file);
-      const want = stampCodexAgent(readFileSync18(path39.join(source, file), "utf8"), version);
+      const dest = path40.join(agentsDir, file);
+      const want = stampCodexAgent(readFileSync19(path40.join(source, file), "utf8"), version);
       let link = false;
       try {
         link = lstatSync6(dest).isSymbolicLink();
@@ -68594,7 +68663,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       }
       let have = null;
       try {
-        have = readFileSync18(dest, "utf8");
+        have = readFileSync19(dest, "utf8");
       } catch {
         have = null;
       }
@@ -68633,7 +68702,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const env = res.env.PI_CODING_AGENT_DIR;
   if (env)
     return env === "~" ? res.home : env.replace(/^~(?=\/|\\)/, res.home);
-  return path39.join(res.home, ".pi", "agent");
+  return path40.join(res.home, ".pi", "agent");
 }, npmSpecName = (spec) => {
   const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
   return at > 0 ? { name: spec.slice(0, at), pinned: true } : { name: spec, pinned: false };
@@ -68641,12 +68710,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const scopes = [
     {
       scope: "project",
-      settingsFile: path39.join(res.cwd, ".pi", "settings.json"),
-      base: path39.join(res.cwd, ".pi")
+      settingsFile: path40.join(res.cwd, ".pi", "settings.json"),
+      base: path40.join(res.cwd, ".pi")
     },
     {
       scope: "user",
-      settingsFile: path39.join(agentDir, "settings.json"),
+      settingsFile: path40.join(agentDir, "settings.json"),
       base: agentDir
     }
   ];
@@ -68663,7 +68732,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         const spec = npmSpecName(source.slice(4).trim());
         if (spec.name !== PI_PACKAGE)
           continue;
-        const root = path39.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
+        const root = path40.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
         return {
           scope,
           settingsFile,
@@ -68675,8 +68744,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       }
       if (/^(git:|https?:|ssh:|git@)/.test(source))
         continue;
-      const local = path39.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
-      if (readJson(path39.join(local, "package.json"))?.name === PI_PACKAGE)
+      const local = path40.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
+      if (readJson(path40.join(local, "package.json"))?.name === PI_PACKAGE)
         return { scope, settingsFile, source, filter, root: local, npm: null };
     }
   }
@@ -68687,7 +68756,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const list = patterns.filter((p) => typeof p === "string");
   if (list.length === 0)
     return false;
-  const name = path39.posix.basename(file);
+  const name = path40.posix.basename(file);
   const matches = (p) => {
     const re = globToRegExp3(p);
     return re.test(file) || re.test(name);
@@ -68716,12 +68785,12 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return {
       id: "pi_extension",
       status: "warn",
-      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path39.join(agentDir, "settings.json")} or ${path39.join(res.cwd, ".pi", "settings.json")}`,
+      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path40.join(agentDir, "settings.json")} or ${path40.join(res.cwd, ".pi", "settings.json")}`,
       fix: installCmd("user")
     };
   const where = `${entry.source} (${entry.scope}, ${entry.settingsFile})`;
   const rebuild = `cd ${JSON.stringify(entry.root)} && bun run build`;
-  const pkg = readJson(path39.join(entry.root, "package.json"));
+  const pkg = readJson(path40.join(entry.root, "package.json"));
   if (!pkg)
     return {
       id: "pi_extension",
@@ -68730,7 +68799,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: entry.npm ? installCmd(entry.scope, entry.source) : `restore ${entry.root}, then ${rebuild}`
     };
   const declared = Array.isArray(pkg.pi?.extensions) ? pkg.pi.extensions.some((e) => typeof e === "string" && e.replace(/^\.\//, "") === PI_EXTENSION) : false;
-  if (!declared || !existsSync17(path39.join(entry.root, PI_EXTENSION)))
+  if (!declared || !existsSync17(path40.join(entry.root, PI_EXTENSION)))
     return {
       id: "pi_extension",
       status: "warn",
@@ -68783,21 +68852,21 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `Workit Pi extension ${version ?? "?"} from ${where} loads ${PI_EXTENSION}`
   };
 }, assetPathsFor = (host, dev) => {
-  const pkg = path39.join(dev, "packages", `workit-${host}`);
+  const pkg = path40.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode": {
-      const packaged = path39.join(pkg, "assets", "skills");
-      const root = existsSync17(packaged) ? packaged : path39.join(dev, "packages", "workit-core", "skills");
-      return WORKIT_METHOD_SKILLS.map((skill) => path39.join(root, skill, "SKILL.md"));
+      const packaged = path40.join(pkg, "assets", "skills");
+      const root = existsSync17(packaged) ? packaged : path40.join(dev, "packages", "workit-core", "skills");
+      return WORKIT_METHOD_SKILLS.map((skill) => path40.join(root, skill, "SKILL.md"));
     }
     case "cursor":
       return [
-        path39.join(pkg, "assets", "templates", "workit-contract.md"),
-        path39.join(pkg, "mcp.json"),
-        path39.join(pkg, ".cursor-plugin")
+        path40.join(pkg, "assets", "templates", "workit-contract.md"),
+        path40.join(pkg, "mcp.json"),
+        path40.join(pkg, ".cursor-plugin")
       ];
     case "cli":
-      return [path39.join(pkg, "assets", "templates", "spec-template.md")];
+      return [path40.join(pkg, "assets", "templates", "spec-template.md")];
   }
 }, hostsFor = (host) => host === "cli" ? ["opencode", "cursor", "cli"] : [host], checkAssets = (res) => {
   const dev = res.dev;
@@ -68828,22 +68897,22 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     fix: "Reinstall or rebuild the workit package (missing assets under packages/workit-<host>)"
   };
 }, launcherSlotsFor = (host, dev) => {
-  const pkg = path39.join(dev, "packages", `workit-${host}`);
+  const pkg = path40.join(dev, "packages", `workit-${host}`);
   switch (host) {
     case "opencode":
-      return [[path39.join(pkg, "src", "plugin.ts"), path39.join(pkg, "dist", "plugin.js")]];
+      return [[path40.join(pkg, "src", "plugin.ts"), path40.join(pkg, "dist", "plugin.js")]];
     case "cursor":
       return [
-        [path39.join(pkg, "dist", "mcp-server.js")],
-        [path39.join(pkg, "dist", "cursor-session-start.js")]
+        [path40.join(pkg, "dist", "mcp-server.js")],
+        [path40.join(pkg, "dist", "cursor-session-start.js")]
       ];
     case "cli":
-      return [[path39.join(pkg, "src", "index.tsx"), path39.join(pkg, "dist", "index.js")]];
+      return [[path40.join(pkg, "src", "index.tsx"), path40.join(pkg, "dist", "index.js")]];
   }
 }, validNodeEntry = (entry, runtime, env) => {
   try {
     const stat = statSync6(entry);
-    if (!stat.isFile() || stat.size === 0 || !readFileSync18(entry, "utf8").startsWith(`#!/usr/bin/env node
+    if (!stat.isFile() || stat.size === 0 || !readFileSync19(entry, "utf8").startsWith(`#!/usr/bin/env node
 `)) {
       return false;
     }
@@ -68865,7 +68934,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (typeof command !== "string" || !Array.isArray(args) || typeof args[0] !== "string") {
     return "invalid";
   }
-  const executable = path39.basename(command).toLowerCase();
+  const executable = path40.basename(command).toLowerCase();
   const canonical = cursorMcpServerEntry("").args;
   if (executable === "npx" || executable === "npx.exe" || executable === "npx.cmd") {
     if (args.length !== canonical.length || args.some((a, i) => a !== canonical[i]))
@@ -68877,10 +68946,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return {
     kind: "node",
     runtime: command,
-    entry: path39.isAbsolute(args[0]) ? args[0] : path39.resolve(path39.dirname(res.cursorMcp), args[0])
+    entry: path40.isAbsolute(args[0]) ? args[0] : path40.resolve(path40.dirname(res.cursorMcp), args[0])
   };
 }, canonicalCursorHook, isCanonicalCursorHook = (command, res) => command === canonicalCursorHook || command === cursorHooksEntry(res.cursorPluginDir).command, registeredCursorHook = (res) => {
-  const hooksFile = path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path40.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   if (!existsSync17(hooksFile))
     return "invalid";
   const config = readJson(hooksFile);
@@ -68898,9 +68967,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   if (!m)
     return false;
   const entry = m[1].trim();
-  if (!path39.isAbsolute(entry))
+  if (!path40.isAbsolute(entry))
     return false;
-  if (path39.resolve(entry) !== path39.resolve(path39.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
+  if (path40.resolve(entry) !== path40.resolve(path40.join(res.cursorPluginDir, "dist", "cursor-session-start.js"))) {
     return false;
   }
   return validNodeEntry(entry, "node", res.env);
@@ -68909,7 +68978,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const hosts = hostsFor(res.host);
   const registered = hosts.includes("cursor") ? registeredCursorLauncher(res) : null;
   const runtime = registered && registered !== "invalid" && registered.kind === "node" ? registered.runtime : "node";
-  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path39.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
+  const missing = hosts.includes("cursor") ? ["dist/mcp-server.js", "dist/cursor-session-start.js"].map((rel) => path40.join(res.cursorPluginDir, rel)).filter((p) => !validNodeEntry(p, runtime, res.env)).map((p) => `cursor: ${p}`) : [];
   if (hosts.includes("cursor")) {
     if (registered === "invalid") {
       missing.push(`cursor: canonical workit MCP launcher in ${res.cursorMcp}`);
@@ -68918,9 +68987,9 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     }
     const hook = registeredCursorHook(res);
     if (hook === "invalid") {
-      missing.push(`cursor: canonical session-start hook in ${path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
+      missing.push(`cursor: canonical session-start hook in ${path40.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")}`);
     } else if (hook !== null && !isCanonicalCursorHook(hook, res) && !validLocalDistHook(hook, res)) {
-      missing.push(`cursor: canonical session-start hook in ${path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
+      missing.push(`cursor: canonical session-start hook in ${path40.join(res.cursorPluginDir, "hooks", "hooks-cursor.json")} (registered ${hook})`);
     }
   }
   if (dev) {
@@ -68956,7 +69025,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       const normal = entry.replaceAll("\\", "/").replace(/\/+$/, "");
       if (!normal.endsWith("local/workit") && !normal.endsWith("local/workflow-toolkit"))
         continue;
-      const dir = entry.startsWith("~") ? path39.join(res.home, entry.slice(1)) : entry;
+      const dir = entry.startsWith("~") ? path40.join(res.home, entry.slice(1)) : entry;
       let state = null;
       try {
         state = readdirSync10(dir).length === 0 ? "empty" : null;
@@ -69000,7 +69069,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "no Cursor plugin install — hook launcher not inspected"
     };
-  const launcher = path39.join(res.cursorPluginDir, "hooks", "launch.mjs");
+  const launcher = path40.join(res.cursorPluginDir, "hooks", "launch.mjs");
   if (!existsSync17(launcher))
     return {
       id: "cursor_hook",
@@ -69008,7 +69077,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `cursor hook launcher mode: missing — ${launcher} is absent (an install from before the pinned launcher)`,
       fix: CURSOR_HOOK_FIX
     };
-  const hooksFile = path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path40.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   const registered = readJson(hooksFile);
   const sessionCommand = registered?.hooks?.sessionStart?.[0]?.command;
   const offLauncher = [
@@ -69079,10 +69148,10 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   }
 }, silentCursorHooks = (res) => {
-  const session = mtimeMs(path39.join(res.cursorHeartbeatDir, "cursor-session-last-start"));
+  const session = mtimeMs(path40.join(res.cursorHeartbeatDir, "cursor-session-last-start"));
   if (session === null || Date.now() - session < SILENT_HOOK_GRACE_MS)
     return null;
-  const hook = mtimeMs(path39.join(res.cursorHeartbeatDir, "cursor-hook-last-run"));
+  const hook = mtimeMs(path40.join(res.cursorHeartbeatDir, "cursor-hook-last-run"));
   if (hook !== null && hook >= session)
     return null;
   return `Cursor started the Workit MCP server at ${new Date(session).toISOString()} but no Workit hook has run since${hook === null ? " (none ever)" : ""} — if the agent ran in that window, Cursor is not running the plugin hooks and Workit enforcement is off`;
@@ -69186,7 +69255,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return { id: "stale_pin", status: "pass", detail: "opencode pin resolves" };
 }, pluginMcpSelectors = (res) => {
-  const p = path39.join(res.cursorPluginDir, "mcp.json");
+  const p = path40.join(res.cursorPluginDir, "mcp.json");
   if (!existsSync17(p))
     return null;
   const cfg = readJson(p);
@@ -69220,19 +69289,19 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   }
 }, installedPluginVersion = (res) => {
-  const pkg = readJson(path39.join(res.cursorPluginDir, "package.json"));
+  const pkg = readJson(path40.join(res.cursorPluginDir, "package.json"));
   return typeof pkg?.version === "string" && pkg.version ? pkg.version : null;
 }, installedOpenCodeCache = (res) => {
   if (res.opencodePackageCacheDir !== null) {
-    const pkg = readJson(path39.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
+    const pkg = readJson(path40.join(res.opencodePackageCacheDir, "node_modules", "@brainervirus", "workit-opencode", "package.json"));
     return typeof pkg?.version === "string" && pkg.version ? { version: pkg.version, dir: res.opencodePackageCacheDir } : null;
   }
   const found = openCodeInstalledPlugin(res.home, res.env);
   if (!found)
     return null;
-  let dir = path39.dirname(path39.dirname(path39.dirname(found.root)));
-  if (path39.basename(dir) !== "workit-opencode@latest")
-    dir = path39.dirname(dir);
+  let dir = path40.dirname(path40.dirname(path40.dirname(found.root)));
+  if (path40.basename(dir) !== "workit-opencode@latest")
+    dir = path40.dirname(dir);
   return { version: found.version, dir };
 }, checkOpenCodePackageCache = (res) => {
   if (!existsSync17(res.opencodeConfig)) {
@@ -69336,7 +69405,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       fix: "Re-run install-cursor-plugin.sh — it rewrites the workit MCP entry to the canonical @latest selector"
     };
   }
-  const hooksFile = path39.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
+  const hooksFile = path40.join(res.cursorPluginDir, "hooks", "hooks-cursor.json");
   const hookCmd = readJson(hooksFile)?.hooks?.sessionStart?.[0]?.command ?? null;
   const canonicalHook = canonicalCursorHook;
   const staleHook = hookCmd !== null && !isCanonicalCursorHook(hookCmd, res) && !hookCmd.startsWith("node ") && hookCmd.includes("@brainervirus/workit-cursor@");
@@ -69358,7 +69427,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     };
   }
   const installed = installedPluginVersion(res);
-  const source = res.dev ? readJson(path39.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path39.join(packageRoot(), "package.json"))?.version ?? null;
+  const source = res.dev ? readJson(path40.join(res.dev, "packages/workit-cursor/package.json"))?.version ?? null : readJson(path40.join(packageRoot(), "package.json"))?.version ?? null;
   const localDist = mcpSelectors === null && hookCmd !== null && !isCanonicalCursorHook(hookCmd, res) && hookCmd.startsWith("node ");
   if (localDist && installed !== null && source !== null && !semverAtLeast(installed, source)) {
     return {
@@ -69370,7 +69439,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   if (localDist && installed !== null && source !== null && res.dev) {
     const entry = /^node\s+(.+)$/.exec((hookCmd ?? "").trim())?.[1]?.trim() ?? "";
-    const sourceBundle = entry && path39.isAbsolute(entry) ? path39.join(res.dev, "packages", "workit-cursor", "dist", path39.basename(entry)) : "";
+    const sourceBundle = entry && path40.isAbsolute(entry) ? path40.join(res.dev, "packages", "workit-cursor", "dist", path40.basename(entry)) : "";
     if (entry && sourceBundle) {
       const installedHash = bundleHashOfFile(entry);
       const sourceHash = bundleHashOfFile(sourceBundle);
@@ -69378,7 +69447,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
         return {
           id: "stale_install",
           status: "fail",
-          detail: `stale_install: installed workit-cursor ${installed} runs different bytes than the current runtime build (${path39.basename(entry)} hash mismatch)`,
+          detail: `stale_install: installed workit-cursor ${installed} runs different bytes than the current runtime build (${path40.basename(entry)} hash mismatch)`,
           fix: "Re-run install-cursor-plugin.sh — it refreshes the plugin directory with the current build"
         };
       }
@@ -69478,7 +69547,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, checkMalformedConfig = (res) => {
   const files = [];
   for (const name of ["config.json", "youtrack.json", "vcs.json", "workspaces.json"]) {
-    const p = path39.join(res.configDir, name);
+    const p = path40.join(res.configDir, name);
     if (existsSync17(p))
       files.push(p);
   }
@@ -69699,17 +69768,17 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   return { ...installSessionHook(res.cwd, res.env), workspace: workspace.name };
 }, isPlaceholder = (p) => {
   try {
-    return readFileSync18(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
+    return readFileSync19(p, "utf8").trim() === TOKEN_PLACEHOLDER2;
   } catch {
     return false;
   }
 }, checkCredentialMetadata = (res) => {
   const tokenPaths = [];
-  const youtrackJson = readJson(path39.join(res.configDir, "youtrack.json"));
+  const youtrackJson = readJson(path40.join(res.configDir, "youtrack.json"));
   if (youtrackJson) {
-    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path39.join(res.configDir, "youtrack.token"));
-  } else if (existsSync17(path39.join(res.configDir, "youtrack.token"))) {
-    tokenPaths.push(path39.join(res.configDir, "youtrack.token"));
+    tokenPaths.push(typeof youtrackJson.tokenFile === "string" ? youtrackJson.tokenFile : path40.join(res.configDir, "youtrack.token"));
+  } else if (existsSync17(path40.join(res.configDir, "youtrack.token"))) {
+    tokenPaths.push(path40.join(res.configDir, "youtrack.token"));
   }
   if (tokenPaths.length === 0) {
     return {
@@ -69720,7 +69789,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   const problems = [];
   for (const raw of tokenPaths) {
-    const p = path39.isAbsolute(raw) ? raw : path39.resolve(res.configDir, raw);
+    const p = path40.isAbsolute(raw) ? raw : path40.resolve(res.configDir, raw);
     if (!existsSync17(p)) {
       problems.push(`${p} is missing`);
       continue;
@@ -69843,7 +69912,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "no GitHub remote configured"
     };
-  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path39.join(res.configDir, "vcs.json"));
+  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path40.join(res.configDir, "vcs.json"));
   const workspace = workspaceProviderForIdentity(res.cwd, res.configDir, res.env);
   if (workspace.error)
     return {
@@ -69879,7 +69948,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "pass",
       detail: "no GitLab remote configured"
     };
-  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path39.join(res.configDir, "vcs.json"));
+  const vcsJson = readJson(res.env.WORKFLOW_VCS_CONFIG ?? path40.join(res.configDir, "vcs.json"));
   const workspace = workspaceProviderForIdentity(res.cwd, res.configDir, res.env);
   if (workspace.error)
     return {
@@ -69909,11 +69978,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     { surface: "SSH", login: probes.sshLogin(remoteHost) }
   ]);
 }, checkLogWritable = (res) => {
-  const logsDir = path39.join(res.stateDir, "logs");
-  const probe = path39.join(logsDir, "doctor-probe.tmp");
+  const logsDir = path40.join(res.stateDir, "logs");
+  const probe = path40.join(logsDir, "doctor-probe.tmp");
   try {
-    mkdirSync8(logsDir, { recursive: true, mode: 448 });
-    writeFileSync9(probe, `{"probe":true}
+    mkdirSync9(logsDir, { recursive: true, mode: 448 });
+    writeFileSync10(probe, `{"probe":true}
 `, { mode: 384 });
     return {
       id: "log_writable",
@@ -69992,7 +70061,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   const counts = { skip: 0, late: 0 };
   let text = "";
   try {
-    text = readFileSync18(path39.join(stateDir, HOOK_SKIPS_FILE), "utf8");
+    text = readFileSync19(path40.join(stateDir, HOOK_SKIPS_FILE), "utf8");
   } catch {
     return counts;
   }
@@ -70010,7 +70079,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   }
   return counts;
 }, checkHookDeadline = (res) => {
-  const file = path39.join(res.hookStateDir, HOOK_SKIPS_FILE);
+  const file = path40.join(res.hookStateDir, HOOK_SKIPS_FILE);
   const { skip, late } = countHookSkips(res.hookStateDir, Date.now() - DAY_MS);
   const lateText = late > 0 ? `; ${late} answered past it in full` : "";
   if (skip > 0)
@@ -70048,8 +70117,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, checkChecksConfig = (res) => {
   const root = checkRoot(res.cwd);
-  const current = existsSync17(path39.join(root, CHECKS_FILE));
-  const legacy = existsSync17(path39.join(root, LEGACY_CHECKS_FILE));
+  const current = existsSync17(path40.join(root, CHECKS_FILE));
+  const legacy = existsSync17(path40.join(root, LEGACY_CHECKS_FILE));
   if (!legacy)
     return {
       id: "checks_config",
@@ -70064,8 +70133,8 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
   };
 }, fixChecksConfig = (options = {}) => {
   const root = checkRoot(resolve(options).cwd);
-  const from = path39.join(root, LEGACY_CHECKS_FILE);
-  const to = path39.join(root, CHECKS_FILE);
+  const from = path40.join(root, LEGACY_CHECKS_FILE);
+  const to = path40.join(root, CHECKS_FILE);
   if (!existsSync17(from))
     return { action: "none", detail: `no ${LEGACY_CHECKS_FILE} at ${root}` };
   if (existsSync17(to))
@@ -70074,7 +70143,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       detail: `${CHECKS_FILE} already exists; ${LEGACY_CHECKS_FILE} left in place`
     };
   ensureWorkitDir(root);
-  renameSync4(from, to);
+  renameSync5(from, to);
   return { action: "moved", detail: `${LEGACY_CHECKS_FILE} -> ${CHECKS_FILE}` };
 }, CLAUDE_PLUGIN_PACKAGE = "@brainervirus/workit-claude-code", versionBehind = (version, latest) => version !== latest && semverAtLeast(latest, version), checkClaudePlugin = (res) => {
   const installs = claudeWorkitInstalls(res.home, res.env, res.cwd);
@@ -70125,7 +70194,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
       status: "info",
       detail: "no Workit Claude Code plugin install recorded — skipping"
     };
-  const registry = readJson(path39.join(claudeConfigDir(res.home, res.env), "plugins", "installed_plugins.json"));
+  const registry = readJson(path40.join(claudeConfigDir(res.home, res.env), "plugins", "installed_plugins.json"));
   const recorded = (install) => {
     const entries = registry?.plugins?.[install.id];
     const entry = Array.isArray(entries) ? entries.find((e) => e?.installPath === install.installPath) : null;
@@ -70218,7 +70287,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, HOOK_ISSUED_MARKER = "workit-issued-sessions/3", hookRecordsIssued = (root) => {
   let files;
   try {
-    files = readdirSync10(path39.join(root, "dist")).filter((f) => f.endsWith(".js"));
+    files = readdirSync10(path40.join(root, "dist")).filter((f) => f.endsWith(".js"));
   } catch {
     return null;
   }
@@ -70226,7 +70295,7 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     return null;
   return files.some((file) => {
     try {
-      return readFileSync18(path39.join(root, "dist", file), "utf8").includes(HOOK_ISSUED_MARKER);
+      return readFileSync19(path40.join(root, "dist", file), "utf8").includes(HOOK_ISSUED_MARKER);
     } catch {
       return false;
     }
@@ -70408,6 +70477,16 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `${host} rules in ${coverage.file} do not cover ${shown}${coverage.missing.length > 4 ? ", …" : ""}${existsSync17(coverage.file) ? "" : ` (${coverage.file} does not exist yet; \`workit setup\` writes it)`}: agents get a prompt (or an auto-mode denial) on verbs the workspace grants`,
     fix: `workit setup --hosts=${host}`
   };
+}, checkUpdates = (res) => {
+  const mode = readUpdatesMode(res.env, res.explicitDirs.config);
+  const cache = readUpdateCache(res.env, res.explicitDirs.state);
+  const checked = cache.checkedAt === undefined ? "" : ` (checked ${ago(Math.max(0, Date.now() - cache.checkedAt))})`;
+  const latest = cache.latest ? `latest CLI ${cache.latest}${checked}` : "no latest CLI version cached yet";
+  return {
+    id: "updates",
+    status: "info",
+    detail: `updates: ${mode}; ${latest}${cache.skipped ? `; ${cache.skipped} skipped` : ""}`
+  };
 }, ago = (ms) => {
   const minutes = Math.max(0, Math.round(ms / 60000));
   if (minutes < 1)
@@ -70487,6 +70566,7 @@ var init_doctor = __esm(() => {
   init_skill_manifests();
   init_session_hook();
   init_hook_runs();
+  init_update_settings();
   init_host_permissions();
   OPENCODE_V1_FIX = `OpenCode < ${SUPPORT_MATRIX.opencode.minimum} cannot load Workit (V2 plugin API only): upgrade OpenCode to ${SUPPORT_MATRIX.opencode.minimum}+`;
   AGENT_MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
@@ -70530,6 +70610,7 @@ var init_doctor = __esm(() => {
     checkGrantEndpoint,
     checkHookRuns,
     checkChecksConfig,
+    checkUpdates,
     checkHostPermissions("claude-code", "claude_permissions"),
     checkHostPermissions("codex", "codex_permissions"),
     checkHostPermissions("cursor", "cursor_permissions"),
@@ -70569,19 +70650,19 @@ import {
   cpSync as cpSync4,
   existsSync as existsSync18,
   lstatSync as lstatSync7,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync11,
   realpathSync as realpathSync9,
-  renameSync as renameSync5,
+  renameSync as renameSync6,
   rmSync as rmSync5,
   statSync as statSync7,
-  writeFileSync as writeFileSync10
+  writeFileSync as writeFileSync11
 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import os13 from "node:os";
-import path40 from "node:path";
+import os14 from "node:os";
+import path41 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
 function parseList(raw) {
   return raw.split(",").map((s) => s.trim()).filter(Boolean);
@@ -70626,7 +70707,7 @@ function buildSetupPreview(values, opts = {}) {
     const current = readConfigFromDir(state.configDir);
     mutations.push({
       type: "merge-json",
-      path: path40.join(state.configDir, "config.json"),
+      path: path41.join(state.configDir, "config.json"),
       value: {
         locale: values.locale,
         localeOptions: current.localeOptions,
@@ -70652,17 +70733,17 @@ function buildSetupPreview(values, opts = {}) {
       if (blocked.length === 0) {
         mutations.push({
           type: "update-workspaces",
-          path: path40.join(state.configDir, "workspaces.json"),
+          path: path41.join(state.configDir, "workspaces.json"),
           entries: values.workspaces,
           expectedRevision: diskWorkspaceResult.revision
         });
       }
     }
     if (values.baseUrl.trim()) {
-      const ytPath = path40.join(state.configDir, "youtrack.json");
+      const ytPath = path41.join(state.configDir, "youtrack.json");
       const ytExisting = readConfigRecord(ytPath);
       const ytConfigured = configuredTokenPath(ytExisting, "tokenFile");
-      const tokenPath = resolveTokenPath(ytConfigured, path40.join(state.configDir, "youtrack.token"), values.tokenPaths?.youtrack);
+      const tokenPath = resolveTokenPath(ytConfigured, path41.join(state.configDir, "youtrack.token"), values.tokenPaths?.youtrack);
       const draft = youtrackDraft(values, tokenPath);
       if (ytConfigured !== null && tokenPath !== ytConfigured) {
         delete draft.tokenFile;
@@ -70690,7 +70771,7 @@ function buildSetupPreview(values, opts = {}) {
         });
     }
     if (values.vcsProvider !== "skip") {
-      const vcsPath = path40.join(state.configDir, "vcs.json");
+      const vcsPath = path41.join(state.configDir, "vcs.json");
       mutations.push({
         type: "merge-json",
         path: vcsPath,
@@ -70719,7 +70800,7 @@ function buildSetupPreview(values, opts = {}) {
             mutations.push({
               type: "install-host",
               platform: "cursor",
-              path: path40.join(paths.home, ".cursor", "plugins", "local", ".workit-package-bootstrap"),
+              path: path41.join(paths.home, ".cursor", "plugins", "local", ".workit-package-bootstrap"),
               commands
             });
           }
@@ -70732,7 +70813,7 @@ function buildSetupPreview(values, opts = {}) {
             mutations.push({
               type: "install-host",
               platform,
-              path: platform === "claude-code" ? claudeInstallRecord(paths.home, env) : platform === "codex" ? path40.join(env.CODEX_HOME ?? path40.join(paths.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : path40.join(env.PI_CODING_AGENT_DIR ?? path40.join(paths.home, ".pi", "agent"), "settings.json"),
+              path: platform === "claude-code" ? claudeInstallRecord(paths.home, env) : platform === "codex" ? path41.join(env.CODEX_HOME ?? path41.join(paths.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : path41.join(env.PI_CODING_AGENT_DIR ?? path41.join(paths.home, ".pi", "agent"), "settings.json"),
               commands
             });
           }
@@ -70744,8 +70825,8 @@ function buildSetupPreview(values, opts = {}) {
       projectRefused = target.refused;
     if (target?.ok) {
       const root = target.root;
-      const gitignorePath = path40.join(root, ".gitignore");
-      const existing = existsSync18(gitignorePath) ? readFileSync19(gitignorePath, "utf8") : "";
+      const gitignorePath = path41.join(root, ".gitignore");
+      const existing = existsSync18(gitignorePath) ? readFileSync20(gitignorePath, "utf8") : "";
       const existingLines = new Set(existing.split(`
 `).map((l) => l.trim()).filter(Boolean));
       const entries = GITIGNORE_ENTRIES.filter((e) => e.trim() !== "" && !existingLines.has(e.trim()));
@@ -70782,10 +70863,10 @@ function deepMerge(base, patch) {
   return out;
 }
 function applyMutation(m) {
-  const dir = path40.dirname(m.path);
+  const dir = path41.dirname(m.path);
   switch (m.type) {
     case "create-file": {
-      mkdirSync9(dir, { recursive: true });
+      mkdirSync10(dir, { recursive: true });
       const res = writeFileExclusive(m.path, m.content, m.mode);
       return res === "created" ? { platform: "core", file: m.path, status: "Installed" } : {
         platform: "core",
@@ -70808,8 +70889,8 @@ function applyMutation(m) {
       if (existing.kind === "record" && JSON.stringify(existing.value) === JSON.stringify(merged)) {
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
       }
-      mkdirSync9(dir, { recursive: true });
-      writeFileSync10(m.path, JSON.stringify(merged, null, 2) + `
+      mkdirSync10(dir, { recursive: true });
+      writeFileSync11(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -70850,10 +70931,10 @@ function applyMutation(m) {
 `;
       if (prev === next)
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
-      mkdirSync9(dir, { recursive: true });
+      mkdirSync10(dir, { recursive: true });
       const tmp = `${m.path}.${process.pid}.tmp`;
       try {
-        writeFileSync10(tmp, next, "utf8");
+        writeFileSync11(tmp, next, "utf8");
         if (workspacesRevision(readFileSafe(m.path)) !== m.expectedRevision) {
           rmSync5(tmp, { force: true });
           return {
@@ -70863,7 +70944,7 @@ function applyMutation(m) {
             detail: "workspace config changed while applying the preview; rebuild and review it"
           };
         }
-        renameSync5(tmp, m.path);
+        renameSync6(tmp, m.path);
       } catch (error) {
         rmSync5(tmp, { force: true });
         return {
@@ -70888,11 +70969,11 @@ function applyMutation(m) {
           detail: "all entries already present"
         };
       }
-      mkdirSync9(dir, { recursive: true });
+      mkdirSync10(dir, { recursive: true });
       const separator = existing && !existing.endsWith(`
 `) ? `
 ` : "";
-      writeFileSync10(m.path, existing + separator + (existing ? `
+      writeFileSync11(m.path, existing + separator + (existing ? `
 ` : "") + add.join(`
 `) + `
 `, "utf8");
@@ -70931,8 +71012,8 @@ function applyMutation(m) {
           detail: "already configured"
         };
       }
-      mkdirSync9(path40.dirname(m.path), { recursive: true });
-      writeFileSync10(m.path, JSON.stringify(merged, null, 2) + `
+      mkdirSync10(path41.dirname(m.path), { recursive: true });
+      writeFileSync11(m.path, JSON.stringify(merged, null, 2) + `
 `, "utf8");
       return existing.kind === "record" ? { platform: "core", file: m.path, status: "Configured" } : { platform: "core", file: m.path, status: "Installed" };
     }
@@ -70940,11 +71021,11 @@ function applyMutation(m) {
 }
 function adapterRoot(platform, res, preferInstalledAdapter = false) {
   const candidates = [];
-  const stagedCursor = path40.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap", "node_modules", "@brainervirus", "workit-cursor");
+  const stagedCursor = path41.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap", "node_modules", "@brainervirus", "workit-cursor");
   if (platform === "cursor" && preferInstalledAdapter)
     candidates.push(stagedCursor);
   if (res.dev) {
-    candidates.push(path40.join(res.dev, "packages", `workit-${platform}`));
+    candidates.push(path41.join(res.dev, "packages", `workit-${platform}`));
   } else {
     candidates.push(...nodeResolvedAdapters(platform));
     if (platform === "cursor")
@@ -70954,10 +71035,10 @@ function adapterRoot(platform, res, preferInstalledAdapter = false) {
       if (cached)
         candidates.push(cached.root);
     }
-    let dir = path40.resolve(res.cwd);
+    let dir = path41.resolve(res.cwd);
     while (true) {
-      candidates.push(path40.join(dir, "packages", `workit-${platform}`));
-      const parent = path40.dirname(dir);
+      candidates.push(path41.join(dir, "packages", `workit-${platform}`));
+      const parent = path41.dirname(dir);
       if (parent === dir)
         break;
       dir = parent;
@@ -70979,7 +71060,7 @@ function applyOpenCode(root, res) {
       detail: "workit-opencode package has no loadable plugin entry (src/plugin.ts or dist/plugin.js)"
     };
   }
-  mkdirSync9(path40.dirname(res.opencodeConfig), { recursive: true });
+  mkdirSync10(path41.dirname(res.opencodeConfig), { recursive: true });
   const existing = readExisting(res.opencodeConfig);
   if (existing.kind === "malformed") {
     return {
@@ -71004,7 +71085,7 @@ function applyOpenCode(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync10(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
+  writeFileSync11(res.opencodeConfig, JSON.stringify(merged.config, null, 2) + `
 `, "utf8");
   return existing.kind === "record" ? {
     platform: "opencode",
@@ -71020,31 +71101,31 @@ function applyOpenCode(root, res) {
 }
 function copyPluginDir(src, dest) {
   const realSrc = realpathSync9(src);
-  const marker = path40.join(dest, ".workit-root");
+  const marker = path41.join(dest, ".workit-root");
   const destIsLink = existsSync18(dest) && lstatSync7(dest).isSymbolicLink();
   const synced = !destIsLink && readFileSafe(marker)?.trim() === realSrc && samePluginContent(realSrc, dest, dest);
   if (synced)
     return "Skipped";
   const hadDir = existsSync18(dest);
   const rules = preservedCursorRules(realSrc, dest);
-  const parent = path40.dirname(dest);
-  mkdirSync9(parent, { recursive: true });
-  const swap = mkdtempSync2(path40.join(parent, `.${path40.basename(dest)}.swap-`));
-  const stage = path40.join(swap, "stage");
-  const backup = path40.join(swap, "backup");
+  const parent = path41.dirname(dest);
+  mkdirSync10(parent, { recursive: true });
+  const swap = mkdtempSync2(path41.join(parent, `.${path41.basename(dest)}.swap-`));
+  const stage = path41.join(swap, "stage");
+  const backup = path41.join(swap, "backup");
   try {
     cpSync4(realSrc, stage, {
       recursive: true,
-      filter: (entry) => !path40.relative(realSrc, entry).split(path40.sep).includes("node_modules")
+      filter: (entry) => !path41.relative(realSrc, entry).split(path41.sep).includes("node_modules")
     });
-    const stagedHooks = path40.join(stage, CURSOR_HOOKS_FILE);
+    const stagedHooks = path41.join(stage, CURSOR_HOOKS_FILE);
     if (existsSync18(stagedHooks))
-      writeFileSync10(stagedHooks, localizedCursorHooks(readFileSync19(stagedHooks), dest));
+      writeFileSync11(stagedHooks, localizedCursorHooks(readFileSync20(stagedHooks), dest));
     for (const [name, content] of rules) {
-      mkdirSync9(path40.join(stage, "rules"), { recursive: true });
-      writeFileSync10(path40.join(stage, "rules", name), content);
+      mkdirSync10(path41.join(stage, "rules"), { recursive: true });
+      writeFileSync11(path41.join(stage, "rules", name), content);
     }
-    writeFileSync10(path40.join(stage, ".workit-root"), realSrc + `
+    writeFileSync11(path41.join(stage, ".workit-root"), realSrc + `
 `, "utf8");
     if (!samePluginContent(realSrc, stage, dest))
       throw new Error("staged adapter content is incomplete");
@@ -71052,12 +71133,12 @@ function copyPluginDir(src, dest) {
       throw new Error("staged adapter resolved to a symlink — refusing fragile cache install");
     }
     if (hadDir)
-      renameSync5(dest, backup);
+      renameSync6(dest, backup);
     try {
-      renameSync5(stage, dest);
+      renameSync6(stage, dest);
     } catch (error) {
       if (hadDir && !existsSync18(dest))
-        renameSync5(backup, dest);
+        renameSync6(backup, dest);
       throw error;
     }
     rmSync5(backup, { recursive: true, force: true });
@@ -71067,7 +71148,7 @@ function copyPluginDir(src, dest) {
   return hadDir ? "Configured" : "Installed";
 }
 function applyCursorSettings(root, res) {
-  mkdirSync9(path40.dirname(res.cursorSettings), { recursive: true });
+  mkdirSync10(path41.dirname(res.cursorSettings), { recursive: true });
   const settingsExisting = readExisting(res.cursorSettings);
   if (settingsExisting.kind === "malformed") {
     return {
@@ -71086,7 +71167,7 @@ function applyCursorSettings(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync10(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
+  writeFileSync11(res.cursorSettings, JSON.stringify(settings.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -71095,7 +71176,7 @@ function applyCursorSettings(root, res) {
   };
 }
 function applyCursorMcp(root, res) {
-  mkdirSync9(path40.dirname(res.cursorMcp), { recursive: true });
+  mkdirSync10(path41.dirname(res.cursorMcp), { recursive: true });
   const mcpExisting = readExisting(res.cursorMcp);
   if (mcpExisting.kind === "malformed") {
     return {
@@ -71125,7 +71206,7 @@ function applyCursorMcp(root, res) {
       detail: "already registered"
     };
   }
-  writeFileSync10(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
+  writeFileSync11(res.cursorMcp, JSON.stringify(mcp.config, null, 2) + `
 `, "utf8");
   return {
     platform: "cursor",
@@ -71201,7 +71282,7 @@ function applySetupPreview(preview, options = {}) {
   let cursorCopyOk = false;
   for (const mutation of preview.mutations) {
     if (mutation.type === "install-host") {
-      const expectedPath = mutation.platform === "cursor" ? path40.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap") : mutation.platform === "codex" ? path40.join(res.env.CODEX_HOME ?? path40.join(res.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : mutation.platform === "pi" ? path40.join(res.env.PI_CODING_AGENT_DIR ?? path40.join(res.home, ".pi", "agent"), "settings.json") : mutation.platform === "claude-code" ? claudeInstallRecord(res.home, res.env) : "";
+      const expectedPath = mutation.platform === "cursor" ? path41.join(res.home, ".cursor", "plugins", "local", ".workit-package-bootstrap") : mutation.platform === "codex" ? path41.join(res.env.CODEX_HOME ?? path41.join(res.home, ".codex"), "plugins", "cache", "workflow-toolkit", "workit") : mutation.platform === "pi" ? path41.join(res.env.PI_CODING_AGENT_DIR ?? path41.join(res.home, ".pi", "agent"), "settings.json") : mutation.platform === "claude-code" ? claudeInstallRecord(res.home, res.env) : "";
       if (mutation.path !== expectedPath) {
         entries.push({
           platform: mutation.platform,
@@ -71313,7 +71394,7 @@ function applySetupPreview(preview, options = {}) {
   if (preview.projectRefused) {
     entries.push({
       platform: "core",
-      file: path40.resolve(res.cwd),
+      file: path41.resolve(res.cwd),
       status: "Skipped",
       detail: preview.projectRefused
     });
@@ -71394,28 +71475,28 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return configured ?? fallback;
 }, readConfigRecord = (file) => {
   try {
-    const value = JSON.parse(readFileSync19(file, "utf8"));
+    const value = JSON.parse(readFileSync20(file, "utf8"));
     return isRecord6(value) ? value : null;
   } catch {
     return null;
   }
-}, claudeInstallRecord = (home, env) => path40.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json"), resolveSetupPaths = (options, resolvedConfigDir) => {
+}, claudeInstallRecord = (home, env) => path41.join(claudeConfigDir(home, env), "plugins", "installed_plugins.json"), resolveSetupPaths = (options, resolvedConfigDir) => {
   const env = options.env ?? process.env;
-  const home = options.home ?? env.HOME ?? os13.homedir();
+  const home = options.home ?? env.HOME ?? os14.homedir();
   return {
     home,
     configDir: resolvedConfigDir,
     cwd: options.cwd ?? process.cwd(),
     env,
-    opencodeConfig: options.opencodeConfig ?? path40.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path40.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path40.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path40.join(home, ".cursor", "plugins", "local", "workit")
+    opencodeConfig: options.opencodeConfig ?? path41.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path41.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path41.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path41.join(home, ".cursor", "plugins", "local", "workit")
   };
 }, isRecord6 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readExisting = (p) => {
   let raw;
   try {
-    raw = readFileSync19(p, "utf8");
+    raw = readFileSync20(p, "utf8");
   } catch {
     if (existsSync18(p))
       return { kind: "malformed", error: `${p} is not readable` };
@@ -71432,7 +71513,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   return { kind: "malformed", error: `${p} is not a JSON object` };
 }, readFileSafe = (p) => {
   try {
-    return readFileSync19(p, "utf8");
+    return readFileSync20(p, "utf8");
   } catch {
     return null;
   }
@@ -71447,15 +71528,15 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, isAdapter = (root, platform) => {
   try {
-    const pkg = JSON.parse(readFileSync19(path40.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync20(path41.join(root, "package.json"), "utf8"));
     return pkg.name === `@brainervirus/workit-${platform}`;
   } catch {
     return false;
   }
 }, nodeResolvedAdapters = (platform) => {
   const name = `@brainervirus/workit-${platform}`;
-  const require2 = createRequire2(path40.join(packageRoot(), "package.json"));
-  return (require2.resolve.paths(name) ?? []).map((dir) => path40.join(dir, name));
+  const require2 = createRequire2(path41.join(packageRoot(), "package.json"));
+  return (require2.resolve.paths(name) ?? []).map((dir) => path41.join(dir, name));
 }, realRoot = (root) => {
   try {
     return realpathSync9(root);
@@ -71471,7 +71552,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   if (!isDevOpenCodeAdapterRoot(root, opts.dev))
     return OPENCODE_NPM_PIN;
   for (const rel of ["src/plugin.ts", "dist/plugin.js"]) {
-    const entry = path40.join(root, rel);
+    const entry = path41.join(root, rel);
     if (existsSync18(entry))
       return `file://${entry}`;
   }
@@ -71489,22 +71570,22 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
     for (const entry of readdirSync11(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
-      const source = path40.join(src, entry.name);
-      const installed = path40.join(dest, entry.name);
-      const rel = path40.join(relative, entry.name);
+      const source = path41.join(src, entry.name);
+      const installed = path41.join(dest, entry.name);
+      const rel = path41.join(relative, entry.name);
       if (entry.isDirectory()) {
         if (!statSync7(installed).isDirectory() || !samePluginContent(source, installed, pluginDir, rel))
           return false;
       } else {
-        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync19(source), pluginDir) : readFileSync19(source);
-        if (!expected.equals(readFileSync19(installed)))
+        const expected = rel === CURSOR_HOOKS_FILE ? localizedCursorHooks(readFileSync20(source), pluginDir) : readFileSync20(source);
+        if (!expected.equals(readFileSync20(installed)))
           return false;
       }
     }
     for (const entry of readdirSync11(dest, { withFileTypes: true })) {
-      if (existsSync18(path40.join(src, entry.name)))
+      if (existsSync18(path41.join(src, entry.name)))
         continue;
-      const rel = path40.join(relative, entry.name);
+      const rel = path41.join(relative, entry.name);
       if (rel === ".workit-root")
         continue;
       if (relative === "rules" && entry.isFile() && entry.name.endsWith(".mdc"))
@@ -71517,32 +71598,32 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, preservedCursorRules = (src, dest) => {
   const preserved = new Map;
-  const sourceRules = path40.join(src, "rules");
-  const installedRules = path40.join(dest, "rules");
+  const sourceRules = path41.join(src, "rules");
+  const installedRules = path41.join(dest, "rules");
   try {
     for (const entry of readdirSync11(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
-      if (existsSync18(path40.join(sourceRules, entry.name)))
+      if (existsSync18(path41.join(sourceRules, entry.name)))
         continue;
-      preserved.set(entry.name, readFileSync19(path40.join(installedRules, entry.name)));
+      preserved.set(entry.name, readFileSync20(path41.join(installedRules, entry.name)));
     }
   } catch {}
   return preserved;
 }, removeLegacyCursorDir = (res) => {
-  const legacy = path40.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
+  const legacy = path41.join(res.home, ".cursor", "plugins", "local", "workflow-toolkit");
   if (legacy === res.cursorPluginDir || !existsSync18(legacy))
     return;
-  const legacyRules = path40.join(legacy, "rules");
+  const legacyRules = path41.join(legacy, "rules");
   if (existsSync18(legacyRules)) {
     try {
-      mkdirSync9(path40.join(res.cursorPluginDir, "rules"), { recursive: true });
+      mkdirSync10(path41.join(res.cursorPluginDir, "rules"), { recursive: true });
       for (const entry of readdirSync11(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
-        const target = path40.join(res.cursorPluginDir, "rules", entry.name);
+        const target = path41.join(res.cursorPluginDir, "rules", entry.name);
         if (!existsSync18(target))
-          copyFileSync5(path40.join(legacyRules, entry.name), target);
+          copyFileSync5(path41.join(legacyRules, entry.name), target);
       }
     } catch {}
   }
@@ -71576,16 +71657,16 @@ var init_setup = __esm(() => {
     { envKey: "WORKFLOW_GITHUB_HOST", affects: "vcs.json github.host" }
   ];
   SETUP_OVERRIDES = [...YT_OVERRIDES, ...VCS_OVERRIDES];
-  CURSOR_HOOKS_FILE = path40.join("hooks", "hooks-cursor.json");
+  CURSOR_HOOKS_FILE = path41.join("hooks", "hooks-cursor.json");
 });
 
 // packages/workit-core/src/core/workspace-branch-policy.ts
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync20, renameSync as renameSync6, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "node:fs";
-import path41 from "node:path";
+import { mkdirSync as mkdirSync11, readFileSync as readFileSync21, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "node:fs";
+import path42 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 function applyWorkspaceBranchPolicy(opts) {
   const { workspace_root, env = process.env } = opts;
-  const dir = path41.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
+  const dir = path42.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
   const {
     status,
     path: wsPath,
@@ -71597,7 +71678,7 @@ function applyWorkspaceBranchPolicy(opts) {
   if (status === "malformed" || status === "invalid")
     return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
-  const name = String(env.WORKFLOW_BP_NAME ?? path41.basename(workspace_root));
+  const name = String(env.WORKFLOW_BP_NAME ?? path42.basename(workspace_root));
   const integration = env.WORKFLOW_BP_INTEGRATION ?? detection.integration;
   const policy = {
     preset: detection.preset,
@@ -71646,10 +71727,10 @@ function applyWorkspaceBranchPolicy(opts) {
       ok: false,
       error: `workspaces.json changed while applying the branch policy: ${wsPath}`
     };
-  mkdirSync10(path41.dirname(wsPath), { recursive: true });
+  mkdirSync11(path42.dirname(wsPath), { recursive: true });
   const tmp = `${wsPath}.${process.pid}.tmp`;
   try {
-    writeFileSync11(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
+    writeFileSync12(tmp, JSON.stringify({ ...document2, workspaces: next }, null, 2) + `
 `, "utf8");
     if (workspacesRevision(readFileSafe2(wsPath)) !== revision) {
       rmSync6(tmp, { force: true });
@@ -71658,7 +71739,7 @@ function applyWorkspaceBranchPolicy(opts) {
         error: `workspaces.json changed while applying the branch policy: ${wsPath}`
       };
     }
-    renameSync6(tmp, wsPath);
+    renameSync7(tmp, wsPath);
   } catch (error) {
     try {
       rmSync6(tmp, { force: true });
@@ -71678,7 +71759,7 @@ function applyWorkspaceBranchPolicy(opts) {
 }
 var readFileSafe2 = (p) => {
   try {
-    return readFileSync20(p, "utf8");
+    return readFileSync21(p, "utf8");
   } catch {
     return null;
   }
@@ -71931,7 +72012,7 @@ var init_logic = __esm(() => {
 
 // packages/workit-cli/src/wizard-state.ts
 import { existsSync as existsSync19, statSync as statSync8 } from "node:fs";
-import path42 from "node:path";
+import path43 from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "node:util";
 function resolveBasePath(values, env = process.env) {
   return env.WORKFLOW_WORKSPACE_ROOT?.trim() || values.basePath.trim();
@@ -72458,8 +72539,8 @@ var NEXT, PREV, skipsCustomBranch = (screen, preset) => (screen === "branchAllow
   const p = value.trim();
   if (!p)
     return "workspace root path is required";
-  return !path42.isAbsolute(p) || !isDirectory(p) ? `invalid workspace root "${p}" — enter an existing absolute directory` : null;
-}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync19(path42.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
+  return !path43.isAbsolute(p) || !isDirectory(p) ? `invalid workspace root "${p}" — enter an existing absolute directory` : null;
+}, skipsBranchPolicy = (screen, basePath) => (screen === "branchPolicy" || screen === "branchPolicyDevelop") && !existsSync19(path43.join(basePath, ".git")), decodeBranchPreset = (value, fallback) => value === "gitflow" || value === "github-flow" || value === "trunk-based" || value === "custom" ? value : fallback, decodeVcsProvider = (value, fallback) => value === "gitlab" || value === "github" || value === "skip" ? value : fallback, decodeIssueTracker = (value, fallback) => value === "youtrack" || value === "github" || value === "gitlab" || value === "none" ? value : fallback, GITHUB_ISSUES, withGithubIssues = (draft, tracker) => tracker === "github" ? { ...draft, issues: { ...GITHUB_ISSUES } } : draft;
 var init_wizard_state = __esm(() => {
   init_config();
   init_workspaces();
@@ -72518,9 +72599,9 @@ var init_wizard_state = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/uninstall.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21, realpathSync as realpathSync10, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "node:fs";
-import os14 from "node:os";
-import path43 from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync22, realpathSync as realpathSync10, rmSync as rmSync7, writeFileSync as writeFileSync13 } from "node:fs";
+import os15 from "node:os";
+import path44 from "node:path";
 function cleanCursorSettings(settings, pluginDir) {
   const next = { ...settings };
   let changed = false;
@@ -72667,7 +72748,7 @@ function planUninstall(paths = {}) {
       }
     ] : []
   };
-  const home = paths.home ?? paths.env?.HOME ?? os14.homedir();
+  const home = paths.home ?? paths.env?.HOME ?? os15.homedir();
   const claudeInstalls = claudeWorkitInstalls(home, paths.env ?? process.env, paths.cwd ?? process.cwd());
   const claude = {
     host: "claude-code",
@@ -72693,7 +72774,7 @@ function planUninstall(paths = {}) {
     plan.actions.push({
       kind: "edit-json-remove",
       path: file,
-      detail: `remove Workit's permission block from ${path43.basename(file)}`
+      detail: `remove Workit's permission block from ${path44.basename(file)}`
     });
   }
   if (existsSync20(res.codexRules))
@@ -72727,8 +72808,8 @@ function applyUninstall(plan, paths = {}) {
         status = outcome.status;
         detail = outcome.detail;
       } else if (action.kind === "remove-dir") {
-        const resolved = path43.resolve(action.path);
-        const allowed = canonicalRemoveDirAllowed(resolved, res) || resolved === path43.resolve(res.codexPluginDir) && path43.basename(resolved) === "workit" && path43.basename(path43.dirname(resolved)) === "plugins";
+        const resolved = path44.resolve(action.path);
+        const allowed = canonicalRemoveDirAllowed(resolved, res) || resolved === path44.resolve(res.codexPluginDir) && path44.basename(resolved) === "workit" && path44.basename(path44.dirname(resolved)) === "plugins";
         if (!allowed) {
           status = "failed";
           detail = `refusing to remove non-canonical plugin directory: ${resolved}`;
@@ -72764,23 +72845,23 @@ function applyUninstall(plan, paths = {}) {
   return { ok: entries.every((e) => e.status !== "failed"), entries };
 }
 var resolveUninstallPaths = (options = {}) => {
-  const home = options.home ?? options.env?.HOME ?? os14.homedir();
+  const home = options.home ?? options.env?.HOME ?? os15.homedir();
   const permissionPaths = { home, env: options.env ?? process.env };
   return {
     claudeSettings: permissionTarget("claude-code", permissionPaths).file,
     cursorCliConfig: permissionTarget("cursor", permissionPaths).file,
     codexRules: permissionTarget("codex", permissionPaths).file,
-    opencodeConfig: options.opencodeConfig ?? path43.join(home, ".config", "opencode", "opencode.json"),
-    cursorSettings: options.cursorSettings ?? path43.join(home, ".cursor", "settings.json"),
-    cursorMcp: options.cursorMcp ?? path43.join(home, ".cursor", "mcp.json"),
-    cursorPluginDir: options.cursorPluginDir ?? path43.join(home, ".cursor", "plugins", "local", "workit"),
-    codexPluginDir: path43.join(home, ".codex", "plugins", "workit"),
-    piConfig: path43.join(home, ".pi", "config.json")
+    opencodeConfig: options.opencodeConfig ?? path44.join(home, ".config", "opencode", "opencode.json"),
+    cursorSettings: options.cursorSettings ?? path44.join(home, ".cursor", "settings.json"),
+    cursorMcp: options.cursorMcp ?? path44.join(home, ".cursor", "mcp.json"),
+    cursorPluginDir: options.cursorPluginDir ?? path44.join(home, ".cursor", "plugins", "local", "workit"),
+    codexPluginDir: path44.join(home, ".codex", "plugins", "workit"),
+    piConfig: path44.join(home, ".pi", "config.json")
   };
 }, isRecord7 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), readJsonRecord = (file) => {
   let raw;
   try {
-    raw = readFileSync21(file, "utf8");
+    raw = readFileSync22(file, "utf8");
   } catch {
     if (existsSync20(file))
       return { kind: "malformed", error: `${file} is not readable` };
@@ -72793,12 +72874,12 @@ var resolveUninstallPaths = (options = {}) => {
     return { kind: "malformed", error: `${file} is not valid JSON` };
   }
 }, stripTrailingSep = (p) => {
-  const j = path43.join(p);
-  return path43.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
+  const j = path44.join(p);
+  return path44.dirname(j) === j ? j : j.replace(/[\\/]+$/, "");
 }, CURSOR_LEGACY_IDENTITIES, permissionPathsOf = (paths) => {
   const env = paths.env ?? process.env;
   return {
-    home: paths.home ?? env.HOME ?? os14.homedir(),
+    home: paths.home ?? env.HOME ?? os15.homedir(),
     env,
     ...paths.stateDir ? { stateDir: paths.stateDir } : {}
   };
@@ -72821,8 +72902,8 @@ var resolveUninstallPaths = (options = {}) => {
     return cleanPiConfig;
   return null;
 }, canonicalRemoveDirAllowed = (actionPath, res) => {
-  const expected = path43.resolve(res.cursorPluginDir);
-  if (!(actionPath === expected && path43.basename(expected) === "workit" && path43.basename(path43.dirname(expected)) === "local" && path43.basename(path43.dirname(path43.dirname(expected))) === "plugins")) {
+  const expected = path44.resolve(res.cursorPluginDir);
+  if (!(actionPath === expected && path44.basename(expected) === "workit" && path44.basename(path44.dirname(expected)) === "local" && path44.basename(path44.dirname(path44.dirname(expected))) === "plugins")) {
     return false;
   }
   try {
@@ -72845,7 +72926,7 @@ var resolveUninstallPaths = (options = {}) => {
 `;
   let current;
   try {
-    current = readFileSync21(target, "utf8");
+    current = readFileSync22(target, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -72856,7 +72937,7 @@ var resolveUninstallPaths = (options = {}) => {
     return { status: "skipped", detail: "already clean" };
   }
   try {
-    writeFileSync12(target, serialized, "utf8");
+    writeFileSync13(target, serialized, "utf8");
   } catch (error) {
     return {
       status: "failed",
@@ -72872,9 +72953,9 @@ var resolveUninstallPaths = (options = {}) => {
       status: "failed",
       detail: `refusing unreviewed host command: ${action.args.join(" ")}`
     };
-  const home = paths.home ?? paths.env?.HOME ?? os14.homedir();
+  const home = paths.home ?? paths.env?.HOME ?? os15.homedir();
   const env = paths.env ?? process.env;
-  const recorded = claudeWorkitInstalls(home, env, action.cwd).some((install) => install.id === id && install.scope === scope && (install.projectPath === null ? action.cwd === null : path43.resolve(install.projectPath) === path43.resolve(action.cwd ?? "")));
+  const recorded = claudeWorkitInstalls(home, env, action.cwd).some((install) => install.id === id && install.scope === scope && (install.projectPath === null ? action.cwd === null : path44.resolve(install.projectPath) === path44.resolve(action.cwd ?? "")));
   if (!recorded)
     return { status: "skipped", detail: `${id} (${scope} scope) is no longer installed` };
   const executable = findHostExecutable("claude", { home, env });
@@ -72898,7 +72979,7 @@ var init_uninstall = __esm(() => {
 });
 
 // packages/workit-cli/src/admin/detect-hosts.ts
-import os15 from "node:os";
+import os16 from "node:os";
 function preselectedPlatforms(detection) {
   return WIZARD_HOSTS.filter((host) => detection[host].detected);
 }
@@ -72913,7 +72994,7 @@ function emptyDetection() {
 }
 function detectHosts(options = {}) {
   const env = options.env ?? process.env;
-  const home = options.home ?? env.HOME ?? os15.homedir();
+  const home = options.home ?? env.HOME ?? os16.homedir();
   const plan = planUninstall({ ...options, home, env });
   const configuredByHost = new Map(plan.hosts.map((h) => [h.host, h.installed]));
   const found = emptyDetection();
@@ -75113,7 +75194,7 @@ var init_diagnostics = __esm(() => {
 
 // packages/workit-cli/src/progress.ts
 import { spawn } from "node:child_process";
-import path44 from "node:path";
+import path45 from "node:path";
 function createProgress(options = {}) {
   const env = options.env ?? process.env;
   const mode = terminalMode({ ...options, env });
@@ -75226,7 +75307,7 @@ function createProgress(options = {}) {
 var FRAMES, FRAME_MS, CLEAR = "\r\x1B[2K", TICKER_SOURCE, defaultTicker = (label, began, stream) => {
   if (stream !== process.stderr)
     return;
-  if (!/^(?:node|nodejs|bun)(?:\.exe)?$/i.test(path44.basename(process.execPath)))
+  if (!/^(?:node|nodejs|bun)(?:\.exe)?$/i.test(path45.basename(process.execPath)))
     return;
   try {
     const child = spawn(process.execPath, ["-e", TICKER_SOURCE], {
@@ -75531,6 +75612,13 @@ var init_init = __esm(() => {
 });
 
 // packages/workit-cli/src/prompt.ts
+var exports_prompt = {};
+__export(exports_prompt, {
+  askLine: () => askLine,
+  askOrCancel: () => askOrCancel,
+  cancelled: () => cancelled,
+  isPromptAbort: () => isPromptAbort
+});
 import { createInterface } from "node:readline/promises";
 async function askLine(question, output = process.stdout) {
   const prompt = createInterface({ input: process.stdin, output });
@@ -75674,9 +75762,9 @@ var init_setup2 = __esm(() => {
 
 // packages/workit-cli/src/upgrade/shared.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync22 } from "node:fs";
-import path45 from "node:path";
-import os16 from "node:os";
+import { existsSync as existsSync21, readFileSync as readFileSync23 } from "node:fs";
+import path46 from "node:path";
+import os17 from "node:os";
 import { createHash as createHash15 } from "node:crypto";
 function errorText(error) {
   return error instanceof Error ? error.message : "installed source could not be read";
@@ -75685,39 +75773,39 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
   const tail = stderrTail(result.stderr);
   return `\`${command.command} ${command.args.join(" ")}\` failed${tail ? `: ${tail}` : ""}`;
 }, fixFor = (host, selector = "") => host === "pi" ? `pi update --extension ${selector || "npm:@brainervirus/workit-pi"}` : host === "codex" ? `codex plugin marketplace upgrade ${CODEX_MARKETPLACE} && codex plugin add workit@${CODEX_MARKETPLACE}` : host === "claude-code" ? "claude plugin marketplace update workit && claude plugin update workit@workit" : host === "opencode" ? OPENCODE_UPDATE : host === "cursor" ? "workit upgrade --hosts=cursor" : CLI_FIX, upgradePaths = (deps) => {
-  const home = deps.home ?? deps.env?.HOME ?? os16.homedir();
+  const home = deps.home ?? deps.env?.HOME ?? os17.homedir();
   const env = {
     ...process.env,
     ...deps.home || deps.env?.HOME ? {
       HOME: home,
-      CODEX_HOME: path45.join(home, ".codex"),
-      CLAUDE_CONFIG_DIR: path45.join(home, ".claude"),
-      PI_CODING_AGENT_DIR: path45.join(home, ".pi/agent"),
-      XDG_CONFIG_HOME: path45.join(home, ".config"),
+      CODEX_HOME: path46.join(home, ".codex"),
+      CLAUDE_CONFIG_DIR: path46.join(home, ".claude"),
+      PI_CODING_AGENT_DIR: path46.join(home, ".pi/agent"),
+      XDG_CONFIG_HOME: path46.join(home, ".config"),
       WORKFLOW_TOOLKIT_CONFIG: undefined,
       WORKFLOW_TOOLKIT_CONFIG_DIR: undefined
     } : {},
     ...deps.env,
     HOME: home
   };
-  const xdg = env.XDG_CONFIG_HOME || path45.join(home, ".config");
-  const codexHome = env.CODEX_HOME ?? path45.join(home, ".codex");
+  const xdg = env.XDG_CONFIG_HOME || path46.join(home, ".config");
+  const codexHome = env.CODEX_HOME ?? path46.join(home, ".codex");
   return {
     home,
     env,
-    configDir: env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path45.join(xdg, "workit"),
-    opencodeConfig: path45.join(xdg, "opencode/opencode.json"),
-    piSettings: path45.join(env.PI_CODING_AGENT_DIR ?? path45.join(home, ".pi/agent"), "settings.json"),
+    configDir: workitConfigDir(env),
+    opencodeConfig: path46.join(xdg, "opencode/opencode.json"),
+    piSettings: path46.join(env.PI_CODING_AGENT_DIR ?? path46.join(home, ".pi/agent"), "settings.json"),
     codexHome,
-    codexConfig: path45.join(codexHome, "config.toml"),
-    cursorRoot: path45.join(home, ".cursor/plugins/local/workit")
+    codexConfig: path46.join(codexHome, "config.toml"),
+    cursorRoot: path46.join(home, ".cursor/plugins/local/workit")
   };
 }, object2 = (file) => {
   if (!existsSync21(file))
     return null;
   let data;
   try {
-    data = JSON.parse(readFileSync22(file, "utf8"));
+    data = JSON.parse(readFileSync23(file, "utf8"));
   } catch {
     throw new Error(`${file} is not valid JSON; use the native host to inspect JSONC settings`);
   }
@@ -75730,7 +75818,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
   } catch {
     return null;
   }
-}, digest2 = (file) => existsSync21(file) ? createHash15("sha256").update(readFileSync22(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+}, digest2 = (file) => existsSync21(file) ? createHash15("sha256").update(readFileSync23(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
   try {
@@ -75761,10 +75849,10 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
         stderr: `Cannot safely execute batch shim ${step.command}`
       });
     const childEnv = { ...process.env, ...env, HOME: home };
-    childEnv.CODEX_HOME = env.CODEX_HOME ?? path45.join(home, ".codex");
-    childEnv.PI_CODING_AGENT_DIR = env.PI_CODING_AGENT_DIR ?? path45.join(home, ".pi", "agent");
-    childEnv.CLAUDE_CONFIG_DIR = env.CLAUDE_CONFIG_DIR ?? path45.join(home, ".claude");
-    childEnv.XDG_CONFIG_HOME = env.XDG_CONFIG_HOME ?? path45.join(home, ".config");
+    childEnv.CODEX_HOME = env.CODEX_HOME ?? path46.join(home, ".codex");
+    childEnv.PI_CODING_AGENT_DIR = env.PI_CODING_AGENT_DIR ?? path46.join(home, ".pi", "agent");
+    childEnv.CLAUDE_CONFIG_DIR = env.CLAUDE_CONFIG_DIR ?? path46.join(home, ".claude");
+    childEnv.XDG_CONFIG_HOME = env.XDG_CONFIG_HOME ?? path46.join(home, ".config");
     return new Promise((resolve) => {
       let stdout = "";
       let stderr = "";
@@ -75807,9 +75895,9 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
 }, piInstalledVersion = (listing, selector) => {
   const lines = listing.split(/\r?\n/).map((line) => line.trim());
   const index = lines.indexOf(selector);
-  if (index < 0 || !lines[index + 1] || !path45.isAbsolute(lines[index + 1]))
+  if (index < 0 || !lines[index + 1] || !path46.isAbsolute(lines[index + 1]))
     return;
-  const found = objectOrNull(path45.join(lines[index + 1], "package.json"));
+  const found = objectOrNull(path46.join(lines[index + 1], "package.json"));
   return found?.name === "@brainervirus/workit-pi" ? found.version : undefined;
 }, versionAtLeast = (installed, latest) => {
   if (!/^\d+\.\d+\.\d+$/.test(installed))
@@ -75828,6 +75916,7 @@ var LAUNCH_HOSTS, HOSTS2, LIVE_HOSTS, OPENCODE_PACKAGE = "@brainervirus/workit-o
 };
 var init_shared = __esm(() => {
   init_host_install();
+  init_update_settings();
   LAUNCH_HOSTS = ["opencode", "cursor", "codex", "pi"];
   HOSTS2 = [...LAUNCH_HOSTS, "claude-code"];
   LIVE_HOSTS = new Set(["opencode", "claude-code"]);
@@ -75835,12 +75924,12 @@ var init_shared = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade/processes.ts
-import path46 from "node:path";
+import path47 from "node:path";
 var PROCESS_HOSTS, SCRIPT_RUNTIMES, classifyProcess = (proc) => {
   if (proc.state.startsWith("Z") || proc.args.includes("<defunct>"))
     return null;
   const argv0 = proc.args.trim().split(/\s+/)[0] ?? "";
-  const baseName = (value) => path46.basename(value.replaceAll("\\", "/")).replace(/^\[|\]$/g, "").replace(/\.exe$/i, "").toLowerCase();
+  const baseName = (value) => path47.basename(value.replaceAll("\\", "/")).replace(/^\[|\]$/g, "").replace(/\.exe$/i, "").toLowerCase();
   let host = PROCESS_HOSTS[baseName(argv0)];
   if (!host && SCRIPT_RUNTIMES.has(baseName(argv0))) {
     const script = proc.args.trim().split(/\s+/).slice(1).find((arg) => !arg.startsWith("-"));
@@ -75890,8 +75979,8 @@ var init_processes = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade/apply.ts
-import { existsSync as existsSync22, readdirSync as readdirSync12, mkdirSync as mkdirSync11, copyFileSync as copyFileSync6, chmodSync as chmodSync2, cpSync as cpSync5 } from "node:fs";
-import path47 from "node:path";
+import { existsSync as existsSync22, readdirSync as readdirSync12, mkdirSync as mkdirSync12, copyFileSync as copyFileSync6, chmodSync as chmodSync2, cpSync as cpSync5 } from "node:fs";
+import path48 from "node:path";
 import { createHash as createHash16 } from "node:crypto";
 async function applyUpgrade(plan, deps = {}) {
   const hosts = [...plan.failed];
@@ -75926,11 +76015,11 @@ async function applyUpgrade(plan, deps = {}) {
       };
   const paths = upgradePaths(deps);
   const { home, configDir } = paths;
-  const backup = path47.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
-  mkdirSync11(backup, { recursive: true, mode: 448 });
+  const backup = path48.join(home, ".local/state/workit/upgrades", new Date().toISOString().replaceAll(":", "-"));
+  mkdirSync12(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
     if (existsSync22(file)) {
-      const target = path47.join(backup, createHash16("sha256").update(file).digest("hex").slice(0, 12) + "-" + path47.basename(file));
+      const target = path48.join(backup, createHash16("sha256").update(file).digest("hex").slice(0, 12) + "-" + path48.basename(file));
       copyFileSync6(file, target);
       chmodSync2(target, 384);
     }
@@ -75953,7 +76042,7 @@ async function applyUpgrade(plan, deps = {}) {
   let cursorBackupError = null;
   if (plan.entries.some((entry) => entry.host === "cursor") && existsSync22(paths.cursorRoot))
     try {
-      cpSync5(paths.cursorRoot, path47.join(backup, "cursor-package"), {
+      cpSync5(paths.cursorRoot, path48.join(backup, "cursor-package"), {
         recursive: true
       });
     } catch (error) {
@@ -76101,7 +76190,7 @@ var briefDetail = (detail) => {
   const lines = detail.split(/\r?\n/).filter((line) => line.trim());
   return (lines.length > 6 ? [lines[0], ...lines.slice(-5)] : lines).join(" | ");
 }, codexPluginRoot = (codexHome) => {
-  const dir = path47.join(codexHome, "plugins", "cache", CODEX_MARKETPLACE, "workit");
+  const dir = path48.join(codexHome, "plugins", "cache", CODEX_MARKETPLACE, "workit");
   let versions = [];
   try {
     versions = readdirSync12(dir).filter((version) => /^\d+\.\d+\.\d+$/.test(version));
@@ -76109,7 +76198,7 @@ var briefDetail = (detail) => {
     return null;
   }
   const newest = versions.reduce((best, version) => best && versionAtLeast(best, version) ? best : version, null);
-  return newest ? path47.join(dir, newest) : null;
+  return newest ? path48.join(dir, newest) : null;
 }, opencodeVersion = async (run) => {
   const listing = await run("opencode", ["plugin", "list"]);
   if (listing.status !== 0)
@@ -76156,8 +76245,8 @@ ${result.stderr}`;
       if (result.exitCode !== 0)
         break;
     }
-    const cursorSettings = path47.join(home, ".cursor", "settings.json");
-    const cursorMcp = path47.join(home, ".cursor", "mcp.json");
+    const cursorSettings = path48.join(home, ".cursor", "settings.json");
+    const cursorMcp = path48.join(home, ".cursor", "mcp.json");
     const preview = {
       ok: true,
       blocked: [],
@@ -76169,7 +76258,7 @@ ${result.stderr}`;
         {
           type: "install-host",
           platform: "cursor",
-          path: path47.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
+          path: path48.join(home, ".cursor/plugins/local/.workit-package-bootstrap"),
           commands
         },
         { type: "install-adapter", platform: "cursor", path: paths.cursorRoot },
@@ -76188,7 +76277,7 @@ ${result.stderr}`;
         stderr: "command did not run"
       }
     });
-    const installed = objectOrNull(path47.join(paths.cursorRoot, "package.json"));
+    const installed = objectOrNull(path48.join(paths.cursorRoot, "package.json"));
     const problems = result.entries.filter((one) => one.status === "Failed").map((one) => one.detail ?? `${one.file} failed`);
     if (problems.length)
       return fail(`Cursor install failed: ${problems.map(briefDetail).join("; ")}`);
@@ -76258,7 +76347,7 @@ ${result.stderr}`;
   };
 }, refreshCodexAgents = async (run, codexHome) => {
   const root = codexPluginRoot(codexHome);
-  const launcher = root && path47.join(root, "dist", "launch-mcp.js");
+  const launcher = root && path48.join(root, "dist", "launch-mcp.js");
   if (!launcher || !existsSync22(launcher))
     return { ok: true, note: "" };
   const fix = `node ${JSON.stringify(launcher)} --install-agents`;
@@ -76278,8 +76367,8 @@ ${result.stderr}`;
   const currentRoot = await run("npm", ["root", "--global"]);
   if (currentRoot.status !== 0 || currentRoot.stdout.trim() !== cli.root)
     return fail("Global npm location changed; preview again");
-  const cliBackup = path47.join(backup, "cli-package");
-  cpSync5(path47.join(cli.root, "@brainervirus/workit-cli"), cliBackup, {
+  const cliBackup = path48.join(backup, "cli-package");
+  cpSync5(path48.join(cli.root, "@brainervirus/workit-cli"), cliBackup, {
     recursive: true
   });
   const install = await run("npm", [
@@ -76288,8 +76377,8 @@ ${result.stderr}`;
     `@brainervirus/workit-cli@${cli.latest}`
   ]);
   if (install.status !== 0)
-    return fail(`CLI update failed${stderrTail(install.stderr) ? ` (${stderrTail(install.stderr)})` : ""}; preserved package at ${cliBackup}; use npm to repair or run node ${path47.join(cliBackup, "dist/index.js")}`);
-  const installed = objectOrNull(path47.join(cli.root, "@brainervirus/workit-cli/package.json"));
+    return fail(`CLI update failed${stderrTail(install.stderr) ? ` (${stderrTail(install.stderr)})` : ""}; preserved package at ${cliBackup}; use npm to repair or run node ${path48.join(cliBackup, "dist/index.js")}`);
+  const installed = objectOrNull(path48.join(cli.root, "@brainervirus/workit-cli/package.json"));
   if (installed?.name !== "@brainervirus/workit-cli" || installed.version !== cli.latest)
     return fail(`CLI update did not verify the requested version; preserved package at ${cliBackup}`);
   return {
@@ -76308,10 +76397,171 @@ var init_apply = __esm(() => {
   init_shared();
 });
 
+// packages/workit-cli/src/update-check.ts
+var exports_update_check = {};
+__export(exports_update_check, {
+  CLI_PACKAGE: () => CLI_PACKAGE2,
+  launchUpdateCheck: () => launchUpdateCheck,
+  readUpdateCache: () => readUpdateCache,
+  readUpdatesMode: () => readUpdatesMode,
+  refreshUpdateCache: () => refreshUpdateCache,
+  writeUpdateCache: () => writeUpdateCache,
+  writeUpdatesMode: () => writeUpdatesMode
+});
+import { spawn as spawn3, spawnSync as spawnSync17 } from "node:child_process";
+import { readFileSync as readFileSync24 } from "node:fs";
+import path49 from "node:path";
+async function launchUpdateCheck(context, deps) {
+  if (!interactiveLaunch(context, deps))
+    return;
+  const mode = readUpdatesMode(deps.env);
+  if (mode === "off")
+    return;
+  const now = (deps.now ?? Date.now)();
+  const cache = readUpdateCache(deps.env);
+  if (cache.checkedAt === undefined || now - cache.checkedAt >= UPDATE_TTL_MS) {
+    writeUpdateCache(deps.env, { ...cache, checkedAt: now });
+    (deps.refresh ?? (() => startRefresh(deps.env)))();
+  }
+  const installed = deps.installed ?? package_default.version;
+  const latest = cache.latest;
+  if (!latest || versionAtLeast(installed, latest))
+    return;
+  if (cache.snoozedAt !== undefined && now - cache.snoozedAt < UPDATE_TTL_MS)
+    return;
+  const style = createStyle({ stream: deps.stderr, env: deps.env });
+  if (mode === "prompt") {
+    if (cache.skipped === latest)
+      return;
+    let answer;
+    try {
+      answer = await (deps.ask ?? defaultAsk)(`${style.bold("Workit update available:")} ${installed} -> ${style.ok(latest)}  ${style.command("[u]")}pgrade now / ${style.command("[s]")}kip for now / ${style.command("[n]")}ever for this version: `);
+    } catch (error) {
+      if (!isPromptAbort(error))
+        return;
+      deps.write(`
+Cancelled.
+`);
+      return CANCELLED_EXIT2;
+    }
+    const choice = answer.trim().toLowerCase();
+    if (choice === "n" || choice === "never") {
+      writeUpdateCache(deps.env, {
+        ...readUpdateCache(deps.env),
+        skipped: latest
+      });
+      return;
+    }
+    if (choice !== "u" && choice !== "upgrade") {
+      writeUpdateCache(deps.env, {
+        ...readUpdateCache(deps.env),
+        snoozedAt: now
+      });
+      return;
+    }
+  } else {
+    deps.write(`${style.bold("Workit update:")} upgrading ${installed} -> ${latest} (CLI and host plugins; updates=auto)
+`);
+  }
+  writeUpdateCache(deps.env, { ...readUpdateCache(deps.env), snoozedAt: now });
+  const outcome = await (deps.upgrade ?? defaultUpgrade)();
+  if (outcome.code !== 0 && outcome.failed.length)
+    deps.write(`${style.warn("Upgrade incomplete:")} ${outcome.failed.map((row) => `${row.host} failed${row.fix ? ` (fix: ${row.fix})` : ""}`).join("; ")}
+`);
+  const onDisk = (deps.cliOnDisk ?? defaultCliOnDisk)();
+  if (!onDisk || onDisk === installed) {
+    if (outcome.code !== 0)
+      deps.write(`${style.warn("Upgrade did not finish;")} running your command with ${installed}.
+`);
+    return;
+  }
+  return (deps.reexec ?? defaultReexec)(context.argv);
+}
+var CLI_PACKAGE2 = "@brainervirus/workit-cli", UPDATE_TTL_MS, QUIET_ENV = "WORKIT_UPDATE_CHECK", REFRESH_ENV = "WORKIT_UPDATE_REFRESH", AGENT_VARIABLES, AGENT_PREFIXES, PROFILE_VARIABLES, agentHostMarker = (env) => Object.keys(env).find((key) => env[key] !== undefined && !PROFILE_VARIABLES.has(key) && (AGENT_VARIABLES.has(key) || AGENT_PREFIXES.some((prefix) => key.startsWith(prefix)))), SILENT_COMMANDS, interactiveLaunch = (context, deps) => !SILENT_COMMANDS.has(context.command) && deps.env[QUIET_ENV] !== "0" && deps.stdin.isTTY === true && deps.stdout.isTTY === true && deps.stderr.isTTY === true && terminalMode({ stream: deps.stderr, env: deps.env, json: context.json }) !== "off" && agentHostMarker(deps.env) === undefined, CANCELLED_EXIT2 = 130, defaultCliOnDisk = () => {
+  const script = process.argv[1];
+  if (!script)
+    return;
+  let dir = path49.dirname(script);
+  for (let depth = 0;depth < 4; depth += 1, dir = path49.dirname(dir)) {
+    try {
+      const found = JSON.parse(readFileSync24(path49.join(dir, "package.json"), "utf8"));
+      if (found.name === CLI_PACKAGE2 && typeof found.version === "string")
+        return found.version;
+    } catch {}
+  }
+  return;
+}, defaultAsk = async (question) => (await Promise.resolve().then(() => (init_prompt(), exports_prompt))).askLine(question, process.stderr), defaultUpgrade = async () => {
+  const failed = [];
+  const code = await (await Promise.resolve().then(() => (init_upgrade(), exports_upgrade))).runUpgradeCommand(["--yes"], {
+    out: process.stderr,
+    onResult: (hosts) => {
+      for (const row of hosts)
+        if (row.status === "failed")
+          failed.push({ host: row.host, fix: row.fix });
+    }
+  });
+  return { code, failed };
+}, defaultReexec = (argv) => {
+  const script = process.argv[1];
+  if (!script)
+    return;
+  const result = spawnSync17(process.execPath, [script, ...argv], {
+    stdio: "inherit",
+    env: { ...process.env, [QUIET_ENV]: "0" }
+  });
+  return result.error ? undefined : result.status ?? 1;
+}, startRefresh = (env) => {
+  const script = process.argv[1];
+  if (!script)
+    return;
+  try {
+    spawn3(process.execPath, [script], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+      env: { ...env, [REFRESH_ENV]: "1", [QUIET_ENV]: "0" }
+    }).unref();
+  } catch {}
+}, refreshUpdateCache = (env, options = {}) => {
+  let latest;
+  try {
+    latest = registryVersion(options.run ?? runner({ env }), CLI_PACKAGE2);
+  } catch {
+    latest = undefined;
+  }
+  const cache = readUpdateCache(env);
+  writeUpdateCache(env, {
+    ...cache,
+    checkedAt: (options.now ?? Date.now)(),
+    ...latest ? { latest } : {}
+  });
+};
+var init_update_check = __esm(() => {
+  init_package();
+  init_prompt();
+  init_style();
+  init_shared();
+  init_update_settings();
+  UPDATE_TTL_MS = 24 * 60 * 60 * 1000;
+  AGENT_VARIABLES = new Set(["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT"]);
+  AGENT_PREFIXES = ["CODEX_", "OPENCODE", "CURSOR_", "PI_"];
+  PROFILE_VARIABLES = new Set(["CODEX_HOME", "PI_CODING_AGENT_DIR"]);
+  SILENT_COMMANDS = new Set([
+    undefined,
+    "upgrade",
+    "help",
+    "--help",
+    "-h",
+    "version",
+    "--version",
+    "-v"
+  ]);
+});
+
 // packages/workit-cli/src/upgrade/plan.ts
-import { existsSync as existsSync23, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync8, readFileSync as readFileSync23 } from "node:fs";
-import path48 from "node:path";
-import os17 from "node:os";
+import { existsSync as existsSync23, mkdtempSync as mkdtempSync3, rmSync as rmSync8, lstatSync as lstatSync8, readFileSync as readFileSync25 } from "node:fs";
+import path50 from "node:path";
+import os18 from "node:os";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
   const paths = upgradePaths(deps);
   const { home, configDir } = paths;
@@ -76334,9 +76584,9 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
   for (const file of [
     paths.opencodeConfig,
     paths.opencodeConfig + "c",
-    path48.join(home, ".cursor/settings.json"),
-    path48.join(home, ".cursor/mcp.json"),
-    path48.join(paths.cursorRoot, "package.json"),
+    path50.join(home, ".cursor/settings.json"),
+    path50.join(home, ".cursor/mcp.json"),
+    path50.join(paths.cursorRoot, "package.json"),
     paths.codexConfig,
     paths.piSettings
   ])
@@ -76463,7 +76713,7 @@ function previewUpgrade(hosts = HOSTS2, deps = {}) {
 var codexRegistered = (configFile) => {
   let text;
   try {
-    text = readFileSync23(configFile, "utf8");
+    text = readFileSync25(configFile, "utf8");
   } catch {
     return false;
   }
@@ -76506,8 +76756,8 @@ var codexRegistered = (configFile) => {
         result.push(classify("opencode", pin));
   });
   guard("cursor", () => {
-    const cursor = objectOrNull(path48.join(paths.cursorRoot, "package.json"));
-    const mcp = objectOrNull(path48.join(home, ".cursor/mcp.json"));
+    const cursor = objectOrNull(path50.join(paths.cursorRoot, "package.json"));
+    const mcp = objectOrNull(path50.join(home, ".cursor/mcp.json"));
     const args = mcp?.mcpServers?.workit?.args ?? [];
     const arg = args.find((value) => typeof value === "string" && value.startsWith("--package="));
     const selector = typeof arg === "string" ? arg.slice(10) : "local";
@@ -76518,7 +76768,7 @@ var codexRegistered = (configFile) => {
       });
       return;
     }
-    const settings = objectOrNull(path48.join(home, ".cursor/settings.json"));
+    const settings = objectOrNull(path50.join(home, ".cursor/settings.json"));
     const dirs = Array.isArray(settings?.plugin_dirs) ? settings.plugin_dirs : [];
     const registered = mcp?.mcpServers?.workit !== undefined || dirs.some((dir) => String(dir).replaceAll("\\", "/").replace(/\/+$/, "").endsWith("local/workit"));
     if (registered)
@@ -76533,7 +76783,7 @@ var codexRegistered = (configFile) => {
       if (typeof source !== "string")
         continue;
       const npm = /^(?:npm:)?@brainervirus\/workit-pi(?:@[^/]+)?$/.test(source);
-      const local = path48.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path48.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
+      const local = path50.isAbsolute(source) && source.replaceAll("\\", "/").endsWith("/packages/workit-pi") && object2(path50.join(source, "package.json"))?.name === "@brainervirus/workit-pi";
       if (!npm && !local)
         continue;
       const found = classify("pi", source);
@@ -76593,15 +76843,15 @@ var codexRegistered = (configFile) => {
   });
   return result;
 }, opencodeProbe = (deps, args) => {
-  const scratch = mkdtempSync3(path48.join(os17.tmpdir(), "workit-upgrade-opencode-"));
+  const scratch = mkdtempSync3(path50.join(os18.tmpdir(), "workit-upgrade-opencode-"));
   try {
     return runner({
       ...deps,
       env: {
         ...deps.env,
-        XDG_DATA_HOME: path48.join(scratch, "data"),
-        XDG_STATE_HOME: path48.join(scratch, "state"),
-        XDG_CACHE_HOME: path48.join(scratch, "cache")
+        XDG_DATA_HOME: path50.join(scratch, "data"),
+        XDG_STATE_HOME: path50.join(scratch, "state"),
+        XDG_CACHE_HOME: path50.join(scratch, "cache")
       }
     })("opencode", args);
   } finally {
@@ -76609,7 +76859,7 @@ var codexRegistered = (configFile) => {
   }
 }, planCli = (plan, run) => {
   const root = run("npm", ["root", "--global"]);
-  if (root.status !== 0 || !path48.isAbsolute(root.stdout.trim())) {
+  if (root.status !== 0 || !path50.isAbsolute(root.stdout.trim())) {
     plan.skipped.push({
       host: "cli",
       reason: "global npm location could not be verified",
@@ -76617,9 +76867,9 @@ var codexRegistered = (configFile) => {
     });
     return;
   }
-  const packageFile = path48.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
+  const packageFile = path50.join(root.stdout.trim(), "@brainervirus/workit-cli/package.json");
   const installed = objectOrNull(packageFile);
-  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync8(path48.dirname(packageFile)).isSymbolicLink()) {
+  if (installed?.name !== "@brainervirus/workit-cli" || lstatSync8(path50.dirname(packageFile)).isSymbolicLink()) {
     plan.skipped.push({
       host: "cli",
       reason: "no managed global CLI install (local links preserved); use npx @brainervirus/workit-cli@latest"
@@ -76656,6 +76906,132 @@ var init_plan = __esm(() => {
   init_shared();
 });
 
+// packages/workit-cli/src/upgrade/check.ts
+import path51 from "node:path";
+function runUpdateCheck(json, deps) {
+  const out = deps.out ?? process.stdout;
+  const paths = upgradePaths(deps);
+  const run = runner(deps);
+  const latest = (name) => registryVersion(run, name);
+  const cliLatest = latest(CLI_PACKAGE2);
+  if (cliLatest)
+    writeUpdateCache(paths.env, {
+      ...readUpdateCache(paths.env),
+      checkedAt: Date.now(),
+      latest: cliLatest
+    });
+  const components = [
+    {
+      component: "cli",
+      package: CLI_PACKAGE2,
+      installed: package_default.version,
+      latest: cliLatest ?? null,
+      status: statusOf(package_default.version, cliLatest)
+    }
+  ];
+  const failed = [];
+  const installed = sources(paths, run, HOSTS2, failed);
+  const unreadableBy = new Map(failed.map((entry) => [entry.host, entry]));
+  const versionBy = new Map;
+  for (const source of installed)
+    if (!versionBy.has(source.host) || source.installedVersion)
+      versionBy.set(source.host, versionBy.get(source.host) ?? source.installedVersion);
+  for (const host of HOSTS2) {
+    const name = `@brainervirus/workit-${host}`;
+    const unreadable = unreadableBy.get(host);
+    if (unreadable) {
+      components.push({
+        component: host,
+        package: name,
+        installed: null,
+        latest: null,
+        status: "unreadable",
+        reason: unreadable.reason
+      });
+      continue;
+    }
+    if (!versionBy.has(host))
+      continue;
+    const version = versionBy.get(host);
+    const newest = latest(name);
+    components.push({
+      component: host,
+      package: name,
+      installed: version ?? null,
+      latest: newest ?? null,
+      status: statusOf(version, newest)
+    });
+  }
+  const pending = components.some((entry) => entry.status === "update" || entry.status === "unknown");
+  const updates = readUpdatesMode(paths.env);
+  if (json) {
+    out.write(JSON.stringify({ updates, components, apply: pending ? APPLY : null }, null, 2) + `
+`);
+    return 0;
+  }
+  const style = createStyle({
+    stream: out === process.stdout ? process.stdout : undefined,
+    env: paths.env
+  });
+  const width = Math.max(...components.map((entry) => entry.component.length));
+  const rows = components.map((entry) => {
+    const label = LABEL[entry.status];
+    const paint = entry.status === "current" ? style.ok : entry.status === "update" ? style.warn : style.dim;
+    return `  ${entry.component.padEnd(width)}  ${entry.installed ?? "-"} -> ${entry.latest ?? "?"}  ${paint(label)}${entry.reason ? ` (${entry.reason})` : ""}
+`;
+  });
+  out.write(`${style.bold("Workit versions")} (updates: ${updates}; change with ${style.command(`workit upgrade --set-updates=${UPDATES_MODES.join("|")}`)})
+${rows.join("")}`);
+  const unchecked = components.filter((entry) => entry.status === "unavailable");
+  if (unchecked.length)
+    out.write(`${style.warn("Could not check: registry unavailable")} for ${unchecked.map((entry) => entry.component).join(", ")}
+`);
+  if (pending)
+    out.write(`Apply with: ${style.command(APPLY)} (upgrades the CLI and every host plugin together)
+`);
+  else if (!unchecked.length)
+    out.write(`${style.ok("Everything is current.")}
+`);
+  out.write(`${style.dim("check only; nothing changed.")}
+`);
+  return 0;
+}
+function runSetUpdates(value, deps) {
+  const out = deps.out ?? process.stdout;
+  if (!isUpdatesMode(value)) {
+    out.write(SET_USAGE);
+    return 2;
+  }
+  const { env, configDir } = upgradePaths(deps);
+  const error = writeUpdatesMode(env, value);
+  if (error) {
+    out.write(`updates not changed: ${error}
+`);
+    return 1;
+  }
+  out.write(`updates: ${value} (saved in ${path51.join(configDir, "config.json")})
+`);
+  return 0;
+}
+var APPLY = "workit upgrade --yes", SET_USAGE, statusOf = (installed, latest) => !latest ? "unavailable" : !installed ? "unknown" : versionAtLeast(installed, latest) ? "current" : "update", LABEL;
+var init_check = __esm(() => {
+  init_config();
+  init_package();
+  init_style();
+  init_update_check();
+  init_plan();
+  init_shared();
+  SET_USAGE = `Usage: workit upgrade --set-updates=${UPDATES_MODES.join("|")}
+`;
+  LABEL = {
+    current: "current",
+    update: "update available",
+    unknown: "installed version unknown",
+    unavailable: "registry unavailable",
+    unreadable: "could not be read"
+  };
+});
+
 // packages/workit-cli/src/upgrade/report.ts
 var pad2 = (text) => text.padEnd(12), PLAIN, summary = (plan, permissions, style = PLAIN) => {
   const host = (name) => `  ${style.bold(pad2(name))}`;
@@ -76683,8 +77059,8 @@ var pad2 = (text) => text.padEnd(12), PLAIN, summary = (plan, permissions, style
   return lines.join(`
 `) + `
 `;
-}, LABEL, reasonFor = (entry) => {
-  const label = LABEL[entry.status];
+}, LABEL2, reasonFor = (entry) => {
+  const label = LABEL2[entry.status];
   const head = entry.reason.slice(0, label.length);
   return entry.status !== "failed" && head.toLowerCase() === label.toLowerCase() && !/^[a-z]/i.test(entry.reason[label.length] ?? "") ? entry.reason.slice(label.length).replace(/^[\s:;,-]+/, "") : entry.reason;
 }, PAINT, table = (hosts, style = PLAIN) => [
@@ -76692,7 +77068,7 @@ var pad2 = (text) => text.padEnd(12), PLAIN, summary = (plan, permissions, style
   ...hosts.map((entry) => {
     const paint = style[PAINT[entry.status]];
     const reason = reasonFor(entry);
-    return `  ${style.bold(pad2(entry.host))}${paint(LABEL[entry.status])}${" ".repeat(16 - LABEL[entry.status].length)}${entry.status === "current" ? style.dim(reason) : reason}${entry.fix && entry.status !== "updated" && entry.status !== "current" ? `
+    return `  ${style.bold(pad2(entry.host))}${paint(LABEL2[entry.status])}${" ".repeat(16 - LABEL2[entry.status].length)}${entry.status === "current" ? style.dim(reason) : reason}${entry.fix && entry.status !== "updated" && entry.status !== "current" ? `
   ${pad2("")}${"".padEnd(16)}fix: ${style.command(entry.fix)}` : ""}`;
   })
 ].join(`
@@ -76709,7 +77085,7 @@ var pad2 = (text) => text.padEnd(12), PLAIN, summary = (plan, permissions, style
 var init_report = __esm(() => {
   init_style();
   PLAIN = createStyle({ json: true });
-  LABEL = {
+  LABEL2 = {
     updated: "updated",
     current: "already current",
     skipped: "skipped",
@@ -76724,9 +77100,23 @@ var init_report = __esm(() => {
 });
 
 // packages/workit-cli/src/upgrade.ts
-import { spawnSync as spawnSync17 } from "node:child_process";
+var exports_upgrade = {};
+__export(exports_upgrade, {
+  runLaunchCommand: () => runLaunchCommand,
+  runUpgradeCommand: () => runUpgradeCommand
+});
+import { spawnSync as spawnSync18 } from "node:child_process";
 async function runUpgradeCommand(argv, deps = {}) {
   const out = deps.out ?? process.stdout;
+  const setting = argv.find((arg) => arg.startsWith("--set-updates="));
+  if (argv.includes("--check") || setting) {
+    const extra = argv.filter((arg) => arg !== "--check" && arg !== "--json" && arg !== setting);
+    if (extra.length || setting && argv.length > 1) {
+      out.write(USAGE3);
+      return 2;
+    }
+    return setting ? runSetUpdates(setting.slice("--set-updates=".length), deps) : runUpdateCheck(argv.includes("--json"), deps);
+  }
   const flags = new Set(argv);
   const unknown = argv.filter((arg) => !["--apply", "--confirm", "--json", "--cli", "--preview", "--yes"].includes(arg) && !arg.startsWith("--hosts="));
   const hostFlag = argv.find((arg) => arg.startsWith("--hosts="))?.slice(8);
@@ -76753,7 +77143,7 @@ async function runUpgradeCommand(argv, deps = {}) {
   plan.ok = plan.blocked.length === 0 && plan.failed.length === 0;
   const { home, env } = upgradePaths(deps);
   const style = createStyle({
-    stream: out === process.stdout ? process.stdout : undefined,
+    stream: out === process.stdout ? process.stdout : out === process.stderr ? process.stderr : undefined,
     env,
     json
   });
@@ -76819,6 +77209,7 @@ Nothing changed.
         ...entry.status === "written" ? {} : { fix: `workit setup --hosts=${entry.host}` }
       });
   }
+  deps.onResult?.(result.hosts);
   const failed = !result.ok || !permissionsOk;
   const cliVersion = result.hosts.some((h) => h.host === "cli" && h.status === "updated") ? plan.cli.latest : package_default.version;
   const report = progress.runSync("Checking the result with workit doctor", () => (deps.doctor ?? ((version) => runDoctor({ home, env, cliVersion: version, only: "upgrade" })))(cliVersion));
@@ -76896,12 +77287,14 @@ async function runLaunchCommand(argv, deps = {}) {
   }
   if (deps.run)
     return deps.run(host, hostArgs).status ?? 1;
-  return spawnSync17(launch.command, launch.args, {
+  return spawnSync18(launch.command, launch.args, {
     stdio: "inherit",
     env
   }).status ?? 1;
 }
 var USAGE3 = `Usage: workit upgrade [--hosts=opencode,cursor,codex,pi,claude-code|none] [--cli] [--preview | --yes | --apply --confirm] [--json]
+       workit upgrade --check [--json]
+       workit upgrade --set-updates=prompt|auto|off
 `;
 var init_upgrade = __esm(() => {
   init_package();
@@ -76911,6 +77304,7 @@ var init_upgrade = __esm(() => {
   init_progress();
   init_style();
   init_apply();
+  init_check();
   init_plan();
   init_report();
   init_shared();
@@ -76920,8 +77314,8 @@ var init_upgrade = __esm(() => {
 });
 
 // packages/workit-cli/src/verbs/upgrade.ts
-var exports_upgrade = {};
-__export(exports_upgrade, {
+var exports_upgrade2 = {};
+__export(exports_upgrade2, {
   run: () => run5
 });
 var run5 = (argv) => runUpgradeCommand(argv);
@@ -76940,9 +77334,9 @@ var init_launch = __esm(() => {
 });
 
 // packages/workit-core/src/knowledge.ts
-import { spawnSync as spawnSync18 } from "node:child_process";
+import { spawnSync as spawnSync19 } from "node:child_process";
 import fs20 from "node:fs";
-import path49 from "node:path";
+import path52 from "node:path";
 function lintKnowledge(root) {
   const seen = new Set;
   const unreadable = [];
@@ -77046,7 +77440,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   const end = lines.indexOf("---", 1);
   return end === -1 ? lines : [...lines.slice(0, end + 1).map(() => ""), ...lines.slice(end + 1)];
 }, read = (root, file) => {
-  const full = path49.join(root, file);
+  const full = path52.join(root, file);
   try {
     fs20.lstatSync(full);
   } catch {
@@ -77061,7 +77455,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
     return "unreadable";
   }
 }, trackedTopLevel = (root) => {
-  const run = spawnSync18("git", ["ls-files", "-z", "--cached"], {
+  const run = spawnSync19("git", ["ls-files", "-z", "--cached"], {
     cwd: root,
     encoding: "utf8",
     maxBuffer: 256 * 1024 * 1024,
@@ -77087,7 +77481,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
   }
 }, brokenLinks = (root, doc, tracked) => {
   const findings = [];
-  const base = path49.dirname(path49.join(root, doc.file));
+  const base = path52.dirname(path52.join(root, doc.file));
   const missing = (target, line, how) => findings.push({
     rule: "broken-link",
     file: doc.file,
@@ -77106,7 +77500,7 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
       const local = localTarget(target);
       if (!local)
         continue;
-      const resolved = local.startsWith("/") ? path49.join(root, local) : path49.resolve(base, local);
+      const resolved = local.startsWith("/") ? path52.join(root, local) : path52.resolve(base, local);
       if (!exists2(resolved))
         missing(target, index + 1, "link");
     }
@@ -77116,9 +77510,9 @@ var AGENTS_BYTE_BUDGET, STEERING_FILES, NEED_BASED_FILES, STANDARDS_FILE = "CODI
         continue;
       const relative = /^\.\.?\//.test(candidate);
       const first = candidate.split("/")[0];
-      if (!relative && !(tracked ? tracked.has(first) : exists2(path49.join(root, first))))
+      if (!relative && !(tracked ? tracked.has(first) : exists2(path52.join(root, first))))
         continue;
-      const resolved = relative ? path49.resolve(base, candidate) : path49.join(root, candidate);
+      const resolved = relative ? path52.resolve(base, candidate) : path52.join(root, candidate);
       if (!exists2(resolved))
         missing(span, index + 1, "pointer");
     }
@@ -77484,11 +77878,11 @@ var init_redact = __esm(() => {
 });
 
 // packages/workit-core/src/checks.ts
-import { spawn as spawn3, spawnSync as spawnSync19 } from "node:child_process";
+import { spawn as spawn4, spawnSync as spawnSync20 } from "node:child_process";
 import { createHash as createHash17 } from "node:crypto";
 import fs21 from "node:fs";
-import os18 from "node:os";
-import path50 from "node:path";
+import os19 from "node:os";
+import path53 from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function tailLines(text, lines = TAIL_LINES) {
   const all = text.replace(/\r\n?/gu, `
@@ -77608,7 +78002,7 @@ function planSpawn(argv, options) {
     return { file: argv[0], args: [], verbatim: false, shell: true };
   if (options.platform !== "win32")
     return { file: argv[0], args: argv.slice(1), verbatim: false, shell: false };
-  const win = path50.win32;
+  const win = path53.win32;
   const isFile = options.isFile ?? ((file) => {
     try {
       return fs21.statSync(file).isFile();
@@ -77666,7 +78060,7 @@ function runCheckCommand(argv, options) {
       if (!child?.pid)
         return;
       if (windows)
-        spawnSync19("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        spawnSync20("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
           stdio: "ignore",
           windowsHide: true
         });
@@ -77693,7 +78087,7 @@ function runCheckCommand(argv, options) {
 `);
       redactor.end();
       resolve({
-        exitCode: spawnError ? 127 : code !== null ? code : 128 + (signal ? os18.constants.signals[signal] ?? 1 : 1),
+        exitCode: spawnError ? 127 : code !== null ? code : 128 + (signal ? os19.constants.signals[signal] ?? 1 : 1),
         signal: signal ?? null,
         timedOut,
         durationMs: Date.now() - started,
@@ -77713,7 +78107,7 @@ function runCheckCommand(argv, options) {
       shell: plan.shell
     };
     try {
-      child = spawn3(plan.file, plan.args, spawnOptions);
+      child = spawn4(plan.file, plan.args, spawnOptions);
     } catch (error) {
       finish(null, null, error.code ?? error.message);
       return;
@@ -77770,10 +78164,10 @@ function runCheckCommand(argv, options) {
 function storeLog(storeRoot, log) {
   const digest = logDigest(log);
   const ref = `blobs/logs/${digest.slice("sha256:".length)}.log`;
-  const file = path50.join(storeRoot, ref);
+  const file = path53.join(storeRoot, ref);
   try {
     if (!fs21.existsSync(file)) {
-      fs21.mkdirSync(path50.dirname(file), { recursive: true });
+      fs21.mkdirSync(path53.dirname(file), { recursive: true });
       const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
       fs21.writeFileSync(temp, log, { mode: 384 });
       fs21.renameSync(temp, file);
@@ -77786,7 +78180,7 @@ function storeLog(storeRoot, log) {
 function pruneCheckLogs(storeRoot, options = {}) {
   const limits = { ...LOG_RETENTION, ...options.retention };
   const now = options.now ?? Date.now();
-  const dir = path50.join(storeRoot, "blobs", "logs");
+  const dir = path53.join(storeRoot, "blobs", "logs");
   const report = { removed: 0, removedBytes: 0, kept: 0 };
   let names;
   try {
@@ -77796,7 +78190,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   const files = names.flatMap((name) => {
     try {
-      const stat = fs21.statSync(path50.join(dir, name));
+      const stat = fs21.statSync(path53.join(dir, name));
       return stat.isFile() ? [{ name, size: stat.size, mtimeMs: stat.mtimeMs }] : [];
     } catch {
       return [];
@@ -77815,7 +78209,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
       continue;
     if (!options.dryRun)
       try {
-        fs21.rmSync(path50.join(dir, file.name), { force: true });
+        fs21.rmSync(path53.join(dir, file.name), { force: true });
       } catch {
         continue;
       }
@@ -78468,12 +78862,12 @@ var init_workspace = __esm(() => {
 
 // packages/workit-core/src/core/heavy-rules.ts
 import fs22 from "node:fs";
-import path51 from "node:path";
+import path54 from "node:path";
 function gitTop(cwd) {
-  for (let dir = path51.resolve(cwd);; dir = path51.dirname(dir)) {
-    if (fs22.existsSync(path51.join(dir, ".git")))
+  for (let dir = path54.resolve(cwd);; dir = path54.dirname(dir)) {
+    if (fs22.existsSync(path54.join(dir, ".git")))
       return dir;
-    if (path51.dirname(dir) === dir)
+    if (path54.dirname(dir) === dir)
       return null;
   }
 }
@@ -78514,19 +78908,19 @@ var init_heavy_rules = () => {};
 
 // packages/workit-core/src/core/heavy.ts
 import fs23 from "node:fs";
-import os19 from "node:os";
-import path52 from "node:path";
+import os20 from "node:os";
+import path55 from "node:path";
 function stateDir2(env, platform = process.platform) {
   if (env.WORKFLOW_TOOLKIT_STATE)
     return env.WORKFLOW_TOOLKIT_STATE;
   if (env.XDG_STATE_HOME)
-    return path52.join(env.XDG_STATE_HOME, "workit");
-  const home = env.HOME || os19.homedir();
+    return path55.join(env.XDG_STATE_HOME, "workit");
+  const home = env.HOME || os20.homedir();
   if (platform === "darwin")
-    return path52.join(home, "Library", "Application Support", "workit");
+    return path55.join(home, "Library", "Application Support", "workit");
   if (platform === "win32")
-    return path52.join(env.LOCALAPPDATA ?? path52.join(home, "AppData", "Local"), "workit");
-  return path52.join(home, ".local", "state", "workit");
+    return path55.join(env.LOCALAPPDATA ?? path55.join(home, "AppData", "Local"), "workit");
+  return path55.join(home, ".local", "state", "workit");
 }
 function positional(words, from, values = PM_VALUES) {
   let index = from;
@@ -78666,7 +79060,7 @@ function machinePatterns(env) {
   return isRecord8(value) ? stringList2(value.patterns) : [];
 }
 function repoPatterns(cwd) {
-  return repoHeavyCommands(gitTop(cwd) ?? path52.resolve(cwd));
+  return repoHeavyCommands(gitTop(cwd) ?? path55.resolve(cwd));
 }
 function heavyLines(lines, options) {
   const found = [];
@@ -78745,7 +79139,7 @@ function leaseRewrite(command) {
     return null;
   return `${prefix}workit check --heavy -- ${rest}`;
 }
-var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path52.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
+var HEAVY_COMMANDS_FILE = "heavy-commands.json", heavyCommandsFile = (env) => path55.join(stateDir2(env), HEAVY_COMMANDS_FILE), HEAVY_SCRIPT, INFO_FLAGS, WATCH_FLAG, WATCH_SCRIPT, sub = (...names) => new Set(names), TOOLS, PM_VALUES, baseName2 = (word) => (word?.split(/[\\/]/u).at(-1) ?? "").toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, ""), WORKIT, PYTHONS, NPM_INSTALL, NPM_RUN, NPM_TEST, EXEC, globWord = (word) => new RegExp(`^${word.replace(/[.+?^${}()|[\]\\]/gu, "\\$&").replaceAll("*", ".*")}$`, "u"), matches2 = (matchers, words) => matchers.length <= words.length && matchers.every((matcher, index) => index === 0 ? matcher.test(words[0]) || matcher.test(baseName2(words[0])) : matcher.test(words[index])), readJson2 = (file) => {
   try {
     return JSON.parse(fs23.readFileSync(file, "utf8"));
   } catch {
@@ -78891,8 +79285,8 @@ var init_heavy = __esm(() => {
 // packages/workit-core/src/core/resources.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import fs24 from "node:fs";
-import os20 from "node:os";
-import path53 from "node:path";
+import os21 from "node:os";
+import path56 from "node:path";
 function memoryValue(value, host) {
   const text = typeof value === "number" ? String(value) : typeof value === "string" ? value : "";
   const percent = PERCENT.exec(text.trim());
@@ -79088,7 +79482,7 @@ function tryOnce(options, record, reclaimed) {
   const text = `${JSON.stringify(record)}
 `;
   for (let slot = 0;slot < options.slots; slot += 1) {
-    const file = path53.join(options.dir, `slot-${slot}.json`);
+    const file = path56.join(options.dir, `slot-${slot}.json`);
     for (let attempt = 0;attempt < 2; attempt += 1) {
       try {
         const fd = fs24.openSync(file, "wx", 384);
@@ -79133,7 +79527,7 @@ function leaseQueue(dir, probe = {}) {
   }
   const entries = [];
   for (const name of names.filter((item) => item.endsWith(".json")).toSorted()) {
-    const file = path53.join(queueDir(dir), name);
+    const file = path56.join(queueDir(dir), name);
     const record = parseLease(readText5(file));
     if (!record)
       continue;
@@ -79149,9 +79543,9 @@ function leaseQueue(dir, probe = {}) {
 function waitersAhead(options, own) {
   let ahead = 0;
   for (const entry of leaseQueue(options.dir, options.probe)) {
-    if (path53.basename(entry.file) >= own)
+    if (path56.basename(entry.file) >= own)
       break;
-    if (!TICKET.test(path53.basename(entry.file)))
+    if (!TICKET.test(path56.basename(entry.file)))
       continue;
     if (entry.stale && reclaim(entry.file, (current) => !current || staleReason(current, options.probe) !== null))
       continue;
@@ -79163,7 +79557,7 @@ function liveHolders(options) {
   return leaseSlots(options.dir, options.slots, options.probe).filter((slot) => slot.holder && !slot.stale).map((slot) => slot.holder);
 }
 function writeTicket(file, record) {
-  fs24.mkdirSync(path53.dirname(file), { recursive: true, mode: 448 });
+  fs24.mkdirSync(path56.dirname(file), { recursive: true, mode: 448 });
   fs24.writeFileSync(file, `${JSON.stringify(record)}
 `, { mode: 384 });
 }
@@ -79208,7 +79602,7 @@ async function acquireLease(options) {
   const reclaimed = [];
   let waitedOn = [];
   const name = ticketName(started, record.id);
-  const ticket = path53.join(queueDir(options.dir), name);
+  const ticket = path56.join(queueDir(options.dir), name);
   const ticketRecord = {
     ...record,
     maxAgeMs: options.waitMs + 60000
@@ -79329,7 +79723,7 @@ function heldLease(dir, id, options = {}) {
   for (const name of names) {
     if (!/^slot-\d+\.json$/u.test(name))
       continue;
-    const lease = parseLease(readText5(path53.join(dir, name)));
+    const lease = parseLease(readText5(path56.join(dir, name)));
     if (lease?.id === id && !staleReason(lease, options.probe) && (options.ancestor ?? isAncestor)(lease.pid))
       return lease;
   }
@@ -79384,10 +79778,10 @@ async function runScoped(run, wrapper, sinks) {
 }
 function firstNotice(env, session, key, now = Date.now()) {
   const id = (session ?? `ppid-${process.ppid}`).replace(/[^A-Za-z0-9_.-]/gu, "_").slice(0, 120);
-  const dir = path53.join(stateDir2(env), "notices");
+  const dir = path56.join(stateDir2(env), "notices");
   try {
     fs24.mkdirSync(dir, { recursive: true, mode: 448 });
-    fs24.writeFileSync(path53.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
+    fs24.writeFileSync(path56.join(dir, `${key}-${id}`), `${new Date(now).toISOString()}
 `, {
       flag: "wx",
       mode: 384
@@ -79397,7 +79791,7 @@ function firstNotice(env, session, key, now = Date.now()) {
   }
   try {
     for (const name of fs24.readdirSync(dir)) {
-      const file = path53.join(dir, name);
+      const file = path56.join(dir, name);
       if (now - fs24.statSync(file).mtimeMs > NOTICE_TTL_MS)
         fs24.rmSync(file, { force: true });
     }
@@ -79407,7 +79801,7 @@ function firstNotice(env, session, key, now = Date.now()) {
 function leaseSlots(dir, slots, probe = {}) {
   const states = [];
   for (let slot = 0;slot < slots; slot += 1) {
-    const lease = parseLease(readText5(path53.join(dir, `slot-${slot}.json`)));
+    const lease = parseLease(readText5(path56.join(dir, `slot-${slot}.json`)));
     states.push({
       slot,
       holder: lease ? holderOf(lease) : null,
@@ -79417,15 +79811,15 @@ function leaseSlots(dir, slots, probe = {}) {
   return states;
 }
 var DEFAULT_HEAVY_CHECKS, DEFAULT_LIGHT_CHECKS, DEFAULT_SLOTS = 1, DEFAULT_WAIT_S = 1800, DEFAULT_MEMORY_SHARE = 0.4, DEFAULT_CPU_SHARE = 0.7, MAX_SLOTS = 64, UNREADABLE_TTL_MS = 30000, GUARD_TTL_MS = 30000, hostShape = () => ({
-  totalMemBytes: os20.totalmem(),
-  cpus: Math.max(1, os20.availableParallelism?.() ?? os20.cpus().length)
-}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path53.join(stateDir2(env), "leases"), readText5 = (file) => {
+  totalMemBytes: os21.totalmem(),
+  cpus: Math.max(1, os21.availableParallelism?.() ?? os21.cpus().length)
+}), isRecord9 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), SIZE, PERCENT, UNITS, leaseDir = (env) => path56.join(stateDir2(env), "leases"), readText5 = (file) => {
   try {
     return fs24.readFileSync(file, "utf8");
   } catch {
     return null;
   }
-}, bootId = () => readText5("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os20.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
+}, bootId = () => readText5("/proc/sys/kernel/random/boot_id")?.trim() || null, bootTime = () => Math.round((Date.now() - os21.uptime() * 1000) / 1000) * 1000, BOOT_SLACK_MS = 120000, statFields = (pid) => {
   const stat = readText5(`/proc/${pid}/stat`);
   return stat ? stat.slice(stat.lastIndexOf(")") + 2).split(" ") : null;
 }, processStart = (pid) => statFields(pid)?.[19] ?? null, pidAlive2 = (pid) => {
@@ -79450,7 +79844,7 @@ var DEFAULT_HEAVY_CHECKS, DEFAULT_LIGHT_CHECKS, DEFAULT_SLOTS = 1, DEFAULT_WAIT_
   cwd: lease.cwd,
   session: lease.session,
   startedAt: lease.startedAt
-}), realClock, queueDir = (dir) => path53.join(dir, "queue"), TICKET, ticketName = (now, id) => `${String(now).padStart(15, "0")}-${String(process.hrtime.bigint() % 10n ** 16n).padStart(16, "0")}-${id}.json`, SCOPE_START_FAILURE, NOTICE_TTL_MS;
+}), realClock, queueDir = (dir) => path56.join(dir, "queue"), TICKET, ticketName = (now, id) => `${String(now).padStart(15, "0")}-${String(process.hrtime.bigint() % 10n ** 16n).padStart(16, "0")}-${id}.json`, SCOPE_START_FAILURE, NOTICE_TTL_MS;
 var init_resources = __esm(() => {
   init_checks3();
   init_heavy();
@@ -79479,8 +79873,8 @@ __export(exports_check, {
   run: () => run12,
   workspaceResources: () => workspaceResources
 });
-import os21 from "node:os";
-import path54 from "node:path";
+import os22 from "node:os";
+import path57 from "node:path";
 function parse6(argv) {
   const split = argv.indexOf("--");
   const head = split >= 0 ? argv.slice(0, split) : [...argv];
@@ -79711,7 +80105,7 @@ ${footer}`;
 }
 async function workspaceResources(io) {
   const env = io.env;
-  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path54.join(env.XDG_CONFIG_HOME || path54.join(env.HOME || os21.homedir(), ".config"), "workit");
+  const dir = env.WORKFLOW_TOOLKIT_CONFIG ?? env.WORKFLOW_TOOLKIT_CONFIG_DIR ?? path57.join(env.XDG_CONFIG_HOME || path57.join(env.HOME || os22.homedir(), ".config"), "workit");
   try {
     await Promise.resolve().then(() => init_workspaces());
     const workspace = resolveWorkspaceFrom(io.cwd, dir, env.WORKFLOW_WORKSPACE_NAME?.trim() || undefined);
@@ -79853,7 +80247,7 @@ async function run12(argv, io) {
     if (options.shell && command.length !== 1)
       return emit(io, fail2("invalid_input", '--shell takes the command as one string: workit check --shell -- "<cmd>"'));
   }
-  const relCwd = posix(path54.relative(top, runCwd));
+  const relCwd = posix(path57.relative(top, runCwd));
   const configured = !options.shell && matchesNamedCheck(config, name, command, relCwd);
   const shadowed = !configured && name !== null ? config.checks.find((item) => item.name === name) : undefined;
   if (shadowed)
@@ -79918,7 +80312,7 @@ async function run12(argv, io) {
   const modifiedWorktree = key.tree !== null && treeAfter !== key.tree;
   const store = storeRoot(io.cwd);
   const blob = store.ok ? storeLog(store.value.root, result.log) : null;
-  const logPath = store.ok && blob ? path54.join(store.value.root, blob.ref) : null;
+  const logPath = store.ok && blob ? path57.join(store.value.root, blob.ref) : null;
   const tail = tailLines(result.log, TAIL_LINES);
   const passed = result.exitCode === 0 && !result.timedOut;
   const bounded = boundedArgv(command);
@@ -80033,8 +80427,8 @@ async function run12(argv, io) {
     return recordError.code === "busy" ? 4 : recordError.code === "invalid_input" ? 2 : 5;
   return 0;
 }
-var USAGE6 = 'workit check <name> [--full] [--wait <dur> | --no-wait] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <dur> | --no-wait] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path54.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, STDERR_TAIL_LINES = 10, STDERR_KEEP_CHARS = 65536, FAILURE_LINE, MAX_FAILURE_LINES = 15;
-var init_check = __esm(() => {
+var USAGE6 = 'workit check <name> [--full] [--wait <dur> | --no-wait] [--no-lease --reason "<why>"] | workit check [--name <n>] [--shell] [--heavy] [--full] [--wait <dur> | --no-wait] [--timeout <s>] [--task <id>] [--json] -- <cmd…>', OUTPUT_LINES = 60, MAX_UNVERIFIED_RUN_MS, RECORD_TAIL_LINES = 20, RECORD_TAIL_CHARS = 200, posix = (value) => value.split(path57.sep).join("/") || ".", ENGINE_CODES2, FINGERPRINT_VARS, ANSI_COLOR, WARNING_LINE, NO_WARNINGS, STDERR_TAIL_LINES = 10, STDERR_KEEP_CHARS = 65536, FAILURE_LINE, MAX_FAILURE_LINES = 15;
+var init_check2 = __esm(() => {
   init_check_config();
   init_checks3();
   init_rev();
@@ -80064,7 +80458,7 @@ __export(exports_lock, {
   run: () => run13
 });
 import fs25 from "node:fs";
-import path55 from "node:path";
+import path58 from "node:path";
 async function settingsFor(io) {
   const workspace = await workspaceResources(io);
   const config = loadCheckConfig(io.cwd);
@@ -80141,7 +80535,7 @@ async function runHeavy(args, io) {
     return emit(io, fail2("invalid_input", unknown ? `unexpected ${unknown}` : "no command after --", {
       unblock: "workit lock run [--shell] [--wait <dur> | --no-wait] [--timeout <s>] -- <cmd…>"
     }));
-  const check = await Promise.resolve().then(() => (init_check(), {}));
+  const check = await Promise.resolve().then(() => (init_check2(), {}));
   return run12([`--heavy`, ...head, ...args.slice(split)], io);
 }
 function readPatterns(file) {
@@ -80156,7 +80550,7 @@ function readPatterns(file) {
   return { patterns: [] };
 }
 function writePatterns(file, value) {
-  fs25.mkdirSync(path55.dirname(file), { recursive: true, mode: 448 });
+  fs25.mkdirSync(path58.dirname(file), { recursive: true, mode: 448 });
   const temp = `${file}.${process.pid}.tmp`;
   fs25.writeFileSync(temp, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -80234,7 +80628,7 @@ var init_lock = __esm(() => {
   init_heavy();
   init_resources();
   init_output();
-  init_check();
+  init_check2();
 });
 
 // packages/workit-cli/src/verbs/models.ts
@@ -80242,9 +80636,9 @@ var exports_models = {};
 __export(exports_models, {
   run: () => run14
 });
-import { existsSync as existsSync25, readdirSync as readdirSync13, readFileSync as readFileSync24, statSync as statSync9 } from "node:fs";
-import os22 from "node:os";
-import path56 from "node:path";
+import { existsSync as existsSync25, readdirSync as readdirSync13, readFileSync as readFileSync26, statSync as statSync9 } from "node:fs";
+import os23 from "node:os";
+import path59 from "node:path";
 async function run14(argv, io) {
   const [sub, ...args] = argv.filter((arg) => arg !== "--json");
   if (sub !== "show")
@@ -80305,7 +80699,7 @@ var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
   const found = new Set;
   let text = "";
   try {
-    text = readFileSync24(file, "utf8");
+    text = readFileSync26(file, "utf8");
   } catch {
     return found;
   }
@@ -80319,24 +80713,24 @@ var USAGE8 = "workit models show [--role <role>] [--tier <tier>] [--host <host>]
       } catch {}
   return found;
 }, matches3 = (ran, configured) => ran.toLowerCase().includes(configured.toLowerCase()), usageReport = (cwd, env, days) => {
-  const projects = path56.join(env.CLAUDE_CONFIG_DIR || path56.join(env.HOME || os22.homedir(), ".claude"), "projects");
+  const projects = path59.join(env.CLAUDE_CONFIG_DIR || path59.join(env.HOME || os23.homedir(), ".claude"), "projects");
   const since = Date.now() - days * 86400000;
   const types = {};
   let agents = 0;
   const dirs = (dir) => {
     try {
-      return readdirSync13(dir).map((name) => path56.join(dir, name));
+      return readdirSync13(dir).map((name) => path59.join(dir, name));
     } catch {
       return [];
     }
   };
   for (const project of dirs(projects))
     for (const session of dirs(project))
-      for (const meta of dirs(path56.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
+      for (const meta of dirs(path59.join(session, "subagents")).filter((f) => f.endsWith(".meta.json"))) {
         try {
           if (statSync9(meta).mtimeMs < since)
             continue;
-          const agentType = JSON.parse(readFileSync24(meta, "utf8")).agentType;
+          const agentType = JSON.parse(readFileSync26(meta, "utf8")).agentType;
           const transcript = meta.replace(/\.meta\.json$/, ".jsonl");
           if (typeof agentType !== "string" || !existsSync25(transcript))
             continue;
@@ -80476,9 +80870,9 @@ var init_youtrack_writes = __esm(() => {
 var success2 = (data) => ({ ok: true, data }), failure3 = (code, error, unblock) => ({ ok: false, code, error, ...unblock ? { unblock } : {} });
 
 // packages/workit-core/src/git/ops.ts
-import { spawnSync as spawnSync20 } from "node:child_process";
-import { existsSync as existsSync26, readFileSync as readFileSync25 } from "node:fs";
-import path57 from "node:path";
+import { spawnSync as spawnSync21 } from "node:child_process";
+import { existsSync as existsSync26, readFileSync as readFileSync27 } from "node:fs";
+import path60 from "node:path";
 function operationInProgress(cwd) {
   const markers = [
     ["rebase-merge", "rebase"],
@@ -80491,18 +80885,18 @@ function operationInProgress(cwd) {
   if (!run.ok)
     return null;
   const found = run.stdout.split(`
-`).map((line) => path57.resolve(cwd, line.trim()));
+`).map((line) => path60.resolve(cwd, line.trim()));
   const conflicted = () => git5(cwd, ["ls-files", "-u"]).stdout.trim() !== "";
   for (const [index, [, operation]] of markers.entries()) {
     const marker = found[index];
     if (!marker || !existsSync26(marker))
       continue;
-    if (index === 1 && existsSync26(path57.join(marker, "applying")))
+    if (index === 1 && existsSync26(path60.join(marker, "applying")))
       return { operation: "am", commitAllowed: false, branch: null };
-    if (index === 0 && existsSync26(path57.join(marker, "amend")) && !conflicted()) {
+    if (index === 0 && existsSync26(path60.join(marker, "amend")) && !conflicted()) {
       let headName = "";
       try {
-        headName = readFileSync25(path57.join(marker, "head-name"), "utf8").trim();
+        headName = readFileSync27(path60.join(marker, "head-name"), "utf8").trim();
       } catch {}
       const branch = headName.startsWith("refs/heads/") ? headName.slice("refs/heads/".length) : null;
       return { operation, commitAllowed: branch !== null, branch };
@@ -80837,7 +81231,7 @@ function gitCommit(cwd, input) {
     if (paths.some((value) => value.startsWith("-") || !value.trim()))
       return failure3("invalid_input", "paths must not be empty or start with -");
     const tracked = new Set(nulList(git5(cwd, ["ls-files", "-z", "--", ...paths]).stdout));
-    const addable = paths.filter((value) => existsSync26(path57.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
+    const addable = paths.filter((value) => existsSync26(path60.resolve(cwd, value)) || [...tracked].some((file) => file === value || file.startsWith(`${value}/`)));
     if (addable.length) {
       const added = git5(cwd, ["add", "-A", "--", ...addable]);
       if (!added.ok)
@@ -81310,7 +81704,7 @@ ${run.stdout}`;
   } : { ok: false, lease: false, error: gitError(run) };
 }
 var COMMIT_TIMEOUT_MS, PUSH_TIMEOUT_MS = 120000, git5 = (cwd, args, options = {}) => {
-  const result = spawnSync20("git", args, {
+  const result = spawnSync21("git", args, {
     cwd,
     encoding: "utf8",
     env: { ...options.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
@@ -81378,12 +81772,12 @@ var init_ops = __esm(() => {
 
 // packages/workit-core/src/verdict-cover.ts
 import fs26 from "node:fs";
-import path58 from "node:path";
+import path61 from "node:path";
 function chainsAbove(cwd, branch) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return [];
-  const dir = path58.join(root.value.root, "stacks");
+  const dir = path61.join(root.value.root, "stacks");
   let names = [];
   try {
     names = fs26.readdirSync(dir).filter((name) => name.endsWith(".json"));
@@ -81394,7 +81788,7 @@ function chainsAbove(cwd, branch) {
   for (const name of names.toSorted()) {
     let parsed;
     try {
-      parsed = JSON.parse(fs26.readFileSync(path58.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs26.readFileSync(path61.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -81550,10 +81944,10 @@ var init_check_evidence = __esm(() => {
 
 // packages/workit-core/src/forge/reruns.ts
 import fs27 from "node:fs";
-import path59 from "node:path";
+import path62 from "node:path";
 function rerunLogPath(cwd) {
   const common = gitCommonDir(cwd);
-  return common ? path59.join(common, "workit", "ci-reruns.jsonl") : null;
+  return common ? path62.join(common, "workit", "ci-reruns.jsonl") : null;
 }
 function rerunCounts(cwd, key) {
   const counts = new Map;
@@ -81588,7 +81982,7 @@ function recordReruns(cwd, rows) {
   if (!file)
     return false;
   try {
-    fs27.mkdirSync(path59.dirname(file), { recursive: true });
+    fs27.mkdirSync(path62.dirname(file), { recursive: true });
     fs27.appendFileSync(file, rows.map((row) => `${JSON.stringify(row)}
 `).join(""));
     return true;
@@ -81601,7 +81995,7 @@ function withRerunLock(cwd, fn) {
   if (!file)
     return fn();
   const lock = `${file.slice(0, -".jsonl".length)}.lock`;
-  fs27.mkdirSync(path59.dirname(lock), { recursive: true });
+  fs27.mkdirSync(path62.dirname(lock), { recursive: true });
   const until = Date.now() + LOCK_WAIT_MS2;
   for (;; ) {
     try {
@@ -82042,7 +82436,7 @@ var init_report2 = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-ops.ts
-import { spawnSync as spawnSync21 } from "node:child_process";
+import { spawnSync as spawnSync22 } from "node:child_process";
 function fillFromCommits(cwd, resolved, base) {
   const tracking = `refs/remotes/${resolved.baseRemote}/${base}`;
   if (!base.startsWith("-"))
@@ -82050,7 +82444,7 @@ function fillFromCommits(cwd, resolved, base) {
   const from = resolveRef(cwd, tracking) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return failure3("not_found", `base ${base} is not available locally`, `git fetch ${resolved.baseRemote} ${base}`);
-  const log = spawnSync21("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
+  const log = spawnSync22("git", ["log", "--reverse", "--no-merges", "--format=%s%x1f%b%x1e", `${from}..HEAD`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -82247,7 +82641,7 @@ function squashCommitList(cwd, resolved, base, head) {
   const from = resolveRef(cwd, `refs/remotes/${resolved.baseRemote}/${base}`) ?? resolveRef(cwd, `refs/heads/${base}`);
   if (!from)
     return "";
-  const log = spawnSync21("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
+  const log = spawnSync22("git", ["log", "--reverse", "--no-merges", "--format=%B%x1e", `${from}..${head}`], {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -82594,10 +82988,10 @@ var init_pr_ops = __esm(() => {
 });
 
 // packages/workit-core/src/stack.ts
-import { spawnSync as spawnSync22 } from "node:child_process";
+import { spawnSync as spawnSync23 } from "node:child_process";
 import { createHash as createHash18, randomBytes as randomBytes4 } from "node:crypto";
 import fs28 from "node:fs";
-import path60 from "node:path";
+import path63 from "node:path";
 function worktreeOf(cwd, branch) {
   const list = gitRun3(cwd, ["worktree", "list", "--porcelain"]);
   if (!list.ok)
@@ -82646,7 +83040,7 @@ function gitRestack(cwd, input) {
         error: "no store root"
       };
     fs28.mkdirSync(scratch, { recursive: true });
-    dir = path60.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
+    dir = path63.join(scratch, `${input.branch.replace(/[^A-Za-z0-9._-]+/gu, "_").slice(0, 40)}-${randomBytes4(4).toString("hex")}`);
     const added = gitRun3(cwd, ["worktree", "add", "-q", dir, input.branch], GIT_TIMEOUTS.worktree);
     if (!added.ok)
       return {
@@ -82702,7 +83096,7 @@ function pruneScratch(cwd) {
   if (!scratch || !fs28.existsSync(scratch))
     return;
   for (const name of fs28.readdirSync(scratch)) {
-    const dir = path60.join(scratch, name);
+    const dir = path63.join(scratch, name);
     if (!rebaseInProgress(dir) && !trackedDirt(dir))
       gitRun3(cwd, ["worktree", "remove", "--force", dir]);
   }
@@ -82712,7 +83106,7 @@ function stacksDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return stackFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path60.join(root.value.root, "stacks") };
+  return { ok: true, data: path63.join(root.value.root, "stacks") };
 }
 function parseStack(raw) {
   if (!isRecord12(raw) || !Array.isArray(raw.branches))
@@ -82764,7 +83158,7 @@ function readStack(cwd, name) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path60.join(dir.data, fileFor(name));
+  const file = path63.join(dir.data, fileFor(name));
   let text;
   try {
     text = fs28.readFileSync(file, "utf8");
@@ -82785,7 +83179,7 @@ function writeStack(cwd, stack, now = new Date) {
   const dir = stacksDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path60.join(dir.data, fileFor(stack.name));
+  const file = path63.join(dir.data, fileFor(stack.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
@@ -82813,7 +83207,7 @@ function listStacks(cwd) {
   for (const name of names) {
     let parsed = null;
     try {
-      parsed = parseStack(JSON.parse(fs28.readFileSync(path60.join(dir.data, name), "utf8")));
+      parsed = parseStack(JSON.parse(fs28.readFileSync(path63.join(dir.data, name), "utf8")));
     } catch {
       parsed = null;
     }
@@ -82875,7 +83269,7 @@ function takeLock(lock) {
     host: localLockHost(),
     nonce: randomBytes4(8).toString("hex")
   };
-  fs28.writeFileSync(path60.join(lock, OWNER), JSON.stringify(owner));
+  fs28.writeFileSync(path63.join(lock, OWNER), JSON.stringify(owner));
   return owner;
 }
 function reapLock(lock, observed) {
@@ -82912,7 +83306,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
     return dir;
   if (!validName(name))
     return stackFail("invalid_input", "a stack name must be 1-200 printable characters");
-  const lock = path60.join(dir.data, `${fileFor(name)}.lock`);
+  const lock = path63.join(dir.data, `${fileFor(name)}.lock`);
   try {
     fs28.mkdirSync(dir.data, { recursive: true });
   } catch (error) {
@@ -82942,7 +83336,7 @@ async function withStackLock(cwd, name, fn, waitMs = LOCK_WAIT_MS3) {
   const touch = () => {
     try {
       const now = new Date;
-      fs28.utimesSync(path60.join(lock, OWNER), now, now);
+      fs28.utimesSync(path63.join(lock, OWNER), now, now);
     } catch {}
   };
   const beat = setInterval(touch, HEARTBEAT_MS);
@@ -83130,7 +83524,7 @@ function commitKeys(cwd, range) {
   const patches = new Map;
   const diff = gitRun3(cwd, ["log", "--no-merges", "-p", "--format=commit %H", range]);
   if (diff.ok && diff.stdout.trim()) {
-    const ids = spawnSync22("git", ["patch-id", "--stable"], {
+    const ids = spawnSync23("git", ["patch-id", "--stable"], {
       cwd,
       input: diff.stdout,
       encoding: "utf8",
@@ -83883,7 +84277,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   ...unblock ? { unblock } : {},
   ...data ? { data } : {}
 }), fromForge = (result) => stackFail(result.code, result.error, result.unblock), stackDeps, gitRun3 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync22("git", args, {
+  const run = spawnSync23("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -83911,7 +84305,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return !status.ok || status.stdout.trim() !== "";
 }, scratchDir = (cwd) => {
   const dir = stacksDir(cwd);
-  return dir.ok ? path60.join(dir.data, "worktrees") : null;
+  return dir.ok ? path63.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
 `).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash18("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
@@ -83926,12 +84320,12 @@ ${run.stdout}`.split(`
 }, isRecord12 = (value) => typeof value === "object" && value !== null && !Array.isArray(value), str3 = (value) => typeof value === "string" && value ? value : null, LOCK_WAIT_MS3 = 2000, HEARTBEAT_MS = 20000, HEARTBEAT_STALE_MS, OWNERLESS_STALE_MS = 30000, OWNER = "owner", readOwner = (lock) => {
   let raw = null;
   try {
-    raw = fs28.readFileSync(path60.join(lock, OWNER), "utf8");
+    raw = fs28.readFileSync(path63.join(lock, OWNER), "utf8");
   } catch {
     raw = null;
   }
   let age = null;
-  for (const target of [path60.join(lock, OWNER), lock])
+  for (const target of [path63.join(lock, OWNER), lock])
     try {
       age = Date.now() - fs28.statSync(target).mtimeMs;
       break;
@@ -83972,10 +84366,10 @@ var init_stack = __esm(() => {
 });
 
 // packages/workit-core/src/fanout.ts
-import { spawnSync as spawnSync23 } from "node:child_process";
+import { spawnSync as spawnSync24 } from "node:child_process";
 import { createHash as createHash19 } from "node:crypto";
 import fs29 from "node:fs";
-import path61 from "node:path";
+import path64 from "node:path";
 function expandBraces2(pattern, limit = 64) {
   for (let index = 0;index < pattern.length; index += 1) {
     if (pattern[index] === "\\") {
@@ -84221,7 +84615,7 @@ function parsePlan(raw, defaults, name) {
       id,
       branch,
       base: optional("base") ?? "",
-      worktree: path61.resolve(defaults.root, optional("worktree") ?? path61.join(defaults.worktreeRoot, id)),
+      worktree: path64.resolve(defaults.root, optional("worktree") ?? path64.join(defaults.worktreeRoot, id)),
       tier,
       reason,
       dependsOn: [...new Set(dependsOn ?? [])],
@@ -84350,12 +84744,12 @@ function regeneratedFiles(root, tracked) {
   const found = new Map;
   let scripts;
   try {
-    const manifest = JSON.parse(fs29.readFileSync(path61.join(root, "package.json"), "utf8"));
+    const manifest = JSON.parse(fs29.readFileSync(path64.join(root, "package.json"), "utf8"));
     scripts = manifest.scripts ?? {};
   } catch {
     return found;
   }
-  const runner = fs29.existsSync(path61.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path61.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path61.join(root, "yarn.lock")) ? "yarn run" : "npm run";
+  const runner = fs29.existsSync(path64.join(root, "bun.lock")) ? "bun run" : fs29.existsSync(path64.join(root, "pnpm-lock.yaml")) ? "pnpm run" : fs29.existsSync(path64.join(root, "yarn.lock")) ? "yarn run" : "npm run";
   const outputs = tracked.filter((file) => !CODE.test(file));
   for (const [name, command] of Object.entries(scripts)) {
     if (!name.startsWith("write:") || typeof command !== "string")
@@ -84363,7 +84757,7 @@ function regeneratedFiles(root, tracked) {
     for (const file of command.match(/[\w./-]+\.[cm]?[jt]s\b/gu) ?? []) {
       let source;
       try {
-        source = fs29.readFileSync(path61.join(root, file), "utf8");
+        source = fs29.readFileSync(path64.join(root, file), "utf8");
       } catch {
         continue;
       }
@@ -84485,11 +84879,11 @@ function defaultTrunk(cwd) {
 }
 function mainCheckout(cwd) {
   const common = gitCommonDir(cwd);
-  return common && path61.basename(common) === ".git" ? path61.dirname(common) : path61.resolve(cwd);
+  return common && path64.basename(common) === ".git" ? path64.dirname(common) : path64.resolve(cwd);
 }
 function worktreeRoot(cwd) {
   const main = mainCheckout(cwd);
-  return path61.join(path61.dirname(main), `${path61.basename(main)}-wt`);
+  return path64.join(path64.dirname(main), `${path64.basename(main)}-wt`);
 }
 function sliceHash(slice) {
   const {
@@ -84509,7 +84903,7 @@ function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
   if (!root.ok)
     return fanoutFail(root.code, root.error, root.unblock);
-  return { ok: true, data: path61.join(root.value.root, "fanouts") };
+  return { ok: true, data: path64.join(root.value.root, "fanouts") };
 }
 function parseStored(raw) {
   if (!isRecord13(raw) || typeof raw.name !== "string" || typeof raw.trunk !== "string")
@@ -84577,7 +84971,7 @@ function readFanout(cwd, name) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path61.join(dir.data, stackFileName(name));
+  const file = path64.join(dir.data, stackFileName(name));
   let parsed = null;
   try {
     parsed = parseStored(JSON.parse(fs29.readFileSync(file, "utf8")));
@@ -84602,7 +84996,7 @@ function listFanouts(cwd) {
   for (const entry of names) {
     let parsed = null;
     try {
-      parsed = parseStored(JSON.parse(fs29.readFileSync(path61.join(dir.data, entry), "utf8")));
+      parsed = parseStored(JSON.parse(fs29.readFileSync(path64.join(dir.data, entry), "utf8")));
     } catch {
       parsed = null;
     }
@@ -84641,7 +85035,7 @@ function writeFanout(cwd, plan) {
   const dir = fanoutsDir(cwd);
   if (!dir.ok)
     return dir;
-  const file = path61.join(dir.data, stackFileName(plan.name));
+  const file = path64.join(dir.data, stackFileName(plan.name));
   const temp = `${file}.${process.pid}.tmp`;
   try {
     fs29.mkdirSync(dir.data, { recursive: true });
@@ -84809,7 +85203,7 @@ var FANOUT_VERSION = 1, TIERS, REASONS, FAN_IN_MODES, fanoutFail = (code, error,
     text: edges.map((edge) => `add "${edge.dependsOn}" to "dependsOn" of slice ${edge.slice}`).join("; ")
   };
 }, gitRun4 = (cwd, args, timeoutMs = GIT_TIMEOUTS.local) => {
-  const run = spawnSync23("git", args, {
+  const run = spawnSync24("git", args, {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs,
@@ -84850,15 +85244,15 @@ var init_fanout = __esm(() => {
 });
 
 // packages/workit-core/src/forge/exec.ts
-import { spawnSync as spawnSync24 } from "node:child_process";
+import { spawnSync as spawnSync25 } from "node:child_process";
 import fs30 from "node:fs";
-import path62 from "node:path";
+import path65 from "node:path";
 function findExecutable(bin, env) {
-  const dirs = (env.PATH ?? env.Path ?? "").split(path62.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? env.Path ?? "").split(path65.delimiter).filter(Boolean);
   const exts = process.platform === "win32" ? [".exe"] : [""];
   for (const dir of dirs)
     for (const ext of exts) {
-      const candidate = path62.join(dir, `${bin}${ext}`);
+      const candidate = path65.join(dir, `${bin}${ext}`);
       try {
         const stat = fs30.statSync(candidate);
         if (stat.isFile())
@@ -84885,7 +85279,7 @@ function systemRunner(kind, apiHost, env = process.env) {
     if (!exe)
       return { status: null, stdout: "", stderr: "", timedOut: false, missing: true };
     const token = options.token ? kind === "github" ? { GH_TOKEN: options.token, GH_ENTERPRISE_TOKEN: options.token } : { GITLAB_TOKEN: options.token } : {};
-    const result = spawnSync24(exe, [...args], {
+    const result = spawnSync25(exe, [...args], {
       encoding: "utf8",
       env: { ...childEnv, ...token },
       maxBuffer: MAX_BUFFER2,
@@ -86220,7 +86614,7 @@ var init_issue_link = __esm(() => {
 });
 
 // packages/workit-core/src/forge/pr-edit.ts
-import { spawnSync as spawnSync25 } from "node:child_process";
+import { spawnSync as spawnSync26 } from "node:child_process";
 function openPr(cwd, resolved, pr) {
   const grant = requireGrant(cwd, "pr");
   if (!grant.allowed)
@@ -86385,7 +86779,7 @@ function replyToThread(cwd, resolved, input) {
   });
 }
 var label2 = (resolved, number) => `${resolved.forge.kind === "github" ? "PR #" : "MR !"}${number}`, git6 = (cwd, args) => {
-  const run = spawnSync25("git", args, {
+  const run = spawnSync26("git", args, {
     cwd,
     encoding: "utf8",
     timeout: GIT_TIMEOUTS.local,
@@ -86405,7 +86799,7 @@ var init_pr_edit = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-landed.ts
-import { spawnSync as spawnSync26 } from "node:child_process";
+import { spawnSync as spawnSync27 } from "node:child_process";
 function forgeBreaker(resolved) {
   if (!resolved)
     return { forge: null, down: () => null };
@@ -86510,7 +86904,7 @@ function trunkPatchIds(ctx, fork) {
     "--"
   ]);
   if (log.ok && log.stdout.trim()) {
-    const run = spawnSync26("git", ["patch-id", "--stable"], {
+    const run = spawnSync27("git", ["patch-id", "--stable"], {
       cwd: ctx.cwd,
       input: log.stdout,
       encoding: "utf8",
@@ -86632,7 +87026,7 @@ var init_fanout_landed = __esm(() => {
 });
 
 // packages/workit-core/src/core/live-session.ts
-import { spawnSync as spawnSync27 } from "node:child_process";
+import { spawnSync as spawnSync28 } from "node:child_process";
 var LIVE_SESSION_TTL_MS, liveProbe, PIDS;
 var init_live_session = __esm(() => {
   init_paths();
@@ -86641,14 +87035,14 @@ var init_live_session = __esm(() => {
   LIVE_SESSION_TTL_MS = 15 * 60000;
   liveProbe = {
     platform: process.platform,
-    run: (args) => spawnSync27("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
+    run: (args) => spawnSync28("ps", args, { encoding: "utf8", timeout: 2000 }).stdout ?? "",
     start: (pid) => processStartOf(pid)
   };
   PIDS = new Map;
 });
 
 // packages/workit-core/src/hooks/write-gate.ts
-import path63 from "node:path";
+import path66 from "node:path";
 var CASE_INSENSITIVE, PREFIXES2, SCRIPT_SHELLS, cache3, MUTATING_GIT, DRY_N, MUTATING_WORKIT_GIT, CD2, PUSHD2, POPD2, UNKNOWN_DIR;
 var init_write_gate = __esm(() => {
   init_task_store();
@@ -86688,7 +87082,7 @@ var init_write_gate = __esm(() => {
   CD2 = new Set(["cd", "chdir", "set-location", "sl"]);
   PUSHD2 = new Set(["pushd", "push-location"]);
   POPD2 = new Set(["popd", "pop-location"]);
-  UNKNOWN_DIR = path63.resolve(path63.parse(process.cwd()).root, ".workit-unknown-dir");
+  UNKNOWN_DIR = path66.resolve(path66.parse(process.cwd()).root, ".workit-unknown-dir");
 });
 
 // packages/workit-core/src/hooks/worktree-confine.ts
@@ -86713,20 +87107,20 @@ var init_worktree_confine = __esm(() => {
 
 // packages/workit-core/src/worktree-deps.ts
 import fs31 from "node:fs";
-import path64 from "node:path";
+import path67 from "node:path";
 function moduleDirs(main) {
   const out = [];
   const walk = (relative, depth) => {
     let entries;
     try {
-      entries = fs31.readdirSync(path64.join(main, relative), { withFileTypes: true });
+      entries = fs31.readdirSync(path67.join(main, relative), { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const child = path64.join(relative, entry.name);
+      const child = path67.join(relative, entry.name);
       if (entry.name === MODULES)
         out.push(child);
       else if (depth < MAX_DEPTH2 && !entry.name.startsWith("."))
@@ -86740,8 +87134,8 @@ function linkEntry(main, worktree, source, target) {
   const stat = fs31.lstatSync(source);
   if (stat.isSymbolicLink()) {
     const link = fs31.readlinkSync(source);
-    const outside = path64.isAbsolute(link) && within(link, main) && !path64.relative(main, link).split(path64.sep).includes(MODULES);
-    const to = outside ? path64.join(worktree, path64.relative(main, link)) : link;
+    const outside = path67.isAbsolute(link) && within(link, main) && !path67.relative(main, link).split(path67.sep).includes(MODULES);
+    const to = outside ? path67.join(worktree, path67.relative(main, link)) : link;
     fs31.symlinkSync(to, target, process.platform === "win32" ? "junction" : undefined);
     return;
   }
@@ -86751,8 +87145,8 @@ function mirror(main, worktree, source, target, top) {
   fs31.mkdirSync(target);
   let count = 0;
   for (const entry of fs31.readdirSync(source, { withFileTypes: true })) {
-    const from = path64.join(source, entry.name);
-    const to = path64.join(target, entry.name);
+    const from = path67.join(source, entry.name);
+    const to = path67.join(target, entry.name);
     if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin"))
       count += mirror(main, worktree, from, to, false);
     else {
@@ -86768,16 +87162,16 @@ function linkWorktreeDependencies(main, worktree) {
   const dirs = [];
   let entries = 0;
   for (const relative of moduleDirs(main)) {
-    const target = path64.join(worktree, relative);
-    if (!fs31.existsSync(path64.dirname(target)) || fs31.existsSync(target))
+    const target = path67.join(worktree, relative);
+    if (!fs31.existsSync(path67.dirname(target)) || fs31.existsSync(target))
       continue;
-    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path64.sep).join("/")}/`]).ok) {
-      notes.push(`${relative.split(path64.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
+    if (!gitRun4(worktree, ["check-ignore", "-q", `${relative.split(path67.sep).join("/")}/`]).ok) {
+      notes.push(`${relative.split(path67.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`);
       continue;
     }
     try {
-      entries += mirror(main, worktree, path64.join(main, relative), target, true);
-      dirs.push(relative.split(path64.sep).join("/"));
+      entries += mirror(main, worktree, path67.join(main, relative), target, true);
+      dirs.push(relative.split(path67.sep).join("/"));
     } catch (error) {
       fs31.rmSync(target, { recursive: true, force: true });
       notes.push(`could not link ${relative} from ${main} (${error.message}); install dependencies in the worktree yourself`);
@@ -86790,8 +87184,8 @@ function linkWorktreeDependencies(main, worktree) {
   return { linked: { from: main, dirs, entries, ms }, notes };
 }
 var MODULES = "node_modules", MAX_DEPTH2 = 2, within = (child, parent) => {
-  const relative = path64.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path64.isAbsolute(relative);
+  const relative = path67.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path67.isAbsolute(relative);
 };
 var init_worktree_deps = __esm(() => {
   init_fanout();
@@ -86800,7 +87194,7 @@ var init_worktree_deps = __esm(() => {
 // packages/workit-core/src/fanout-worktree.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
 import fs32 from "node:fs";
-import path65 from "node:path";
+import path68 from "node:path";
 function rowSample(lines) {
   const out = [];
   let bytes = 0;
@@ -86860,7 +87254,7 @@ function adminDir(worktree) {
   const file = dir.stdout.trim();
   let token = null;
   try {
-    token = fs32.readFileSync(path65.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
+    token = fs32.readFileSync(path68.join(file, FANOUT_TOKEN_FILE), "utf8").trim() || null;
   } catch {
     token = null;
   }
@@ -86868,7 +87262,7 @@ function adminDir(worktree) {
     const stat = worktreeDeps.stat(file);
     return {
       path: file,
-      id: path65.basename(file),
+      id: path68.basename(file),
       ino: stat.ino.toString(),
       token,
       birthMs: stat.birthtimeNs > 0n ? Number(stat.birthtimeMs) : null,
@@ -86884,7 +87278,7 @@ function markAdminDir(worktree) {
     return null;
   const token = randomBytes5(16).toString("hex");
   try {
-    fs32.writeFileSync(path65.join(admin.path, FANOUT_TOKEN_FILE), `${token}
+    fs32.writeFileSync(path68.join(admin.path, FANOUT_TOKEN_FILE), `${token}
 `);
   } catch {
     return null;
@@ -86899,7 +87293,7 @@ function excludeScratch(cwd) {
   const common = gitCommonDir(cwd);
   if (!common)
     return;
-  const file = path65.join(common, "info", "exclude");
+  const file = path68.join(common, "info", "exclude");
   let text = "";
   try {
     text = fs32.readFileSync(file, "utf8");
@@ -86908,7 +87302,7 @@ function excludeScratch(cwd) {
   }
   if (text.split(/\r?\n/u).includes(EXCLUDE_LINE))
     return;
-  fs32.mkdirSync(path65.dirname(file), { recursive: true });
+  fs32.mkdirSync(path68.dirname(file), { recursive: true });
   fs32.appendFileSync(file, `${text && !text.endsWith(`
 `) ? `
 ` : ""}# workit fanout: per-worker scratch dirs
@@ -86917,13 +87311,13 @@ ${EXCLUDE_LINE}
 }
 function worktreeDependencies(main, worktree) {
   for (const [name, install] of LOCKFILES2) {
-    const ours = readBytes(path65.join(main, name));
-    const theirs = readBytes(path65.join(worktree, name));
+    const ours = readBytes(path68.join(main, name));
+    const theirs = readBytes(path68.join(worktree, name));
     if (ours === null && theirs === null)
       continue;
     if (ours !== null && theirs !== null && ours.equals(theirs))
       continue;
-    if (fs32.existsSync(path65.join(worktree, "node_modules")))
+    if (fs32.existsSync(path68.join(worktree, "node_modules")))
       break;
     const command = install(worktree);
     return {
@@ -86935,7 +87329,7 @@ function worktreeDependencies(main, worktree) {
     };
   }
   const stale = staleBunInstall(main);
-  if (stale && !fs32.existsSync(path65.join(worktree, "node_modules"))) {
+  if (stale && !fs32.existsSync(path68.join(worktree, "node_modules"))) {
     const command = `bun install --frozen-lockfile --cwd ${worktree}`;
     return {
       linked: null,
@@ -86948,9 +87342,9 @@ function worktreeDependencies(main, worktree) {
   return { ...linkWorktreeDependencies(main, worktree), install: null };
 }
 function staleBunInstall(main) {
-  if (!fs32.existsSync(path65.join(main, "node_modules")))
+  if (!fs32.existsSync(path68.join(main, "node_modules")))
     return null;
-  const text = readBytes(path65.join(main, "bun.lock"))?.toString("utf8");
+  const text = readBytes(path68.join(main, "bun.lock"))?.toString("utf8");
   if (!text)
     return null;
   let packages;
@@ -86977,7 +87371,7 @@ function staleBunInstall(main) {
     const version = spec.slice(at + 1);
     if (name !== key || version.includes(":"))
       continue;
-    const manifest = readBytes(path65.join(main, "node_modules", key, "package.json"));
+    const manifest = readBytes(path68.join(main, "node_modules", key, "package.json"));
     if (!manifest) {
       problems.push(`${key} missing`);
       continue;
@@ -86994,7 +87388,7 @@ function staleBunInstall(main) {
   return problems.length ? problems.join("; ") : null;
 }
 function ensureScratch(worktree) {
-  const scratch = path65.join(worktree, SCRATCH_DIR);
+  const scratch = path68.join(worktree, SCRATCH_DIR);
   fs32.mkdirSync(scratch, { recursive: true });
   return scratch;
 }
@@ -87268,7 +87662,7 @@ function unpushedCount(cwd, branch) {
   return count.ok ? Number(count.stdout.trim()) : null;
 }
 function removeScratch(worktree) {
-  const scratch = path65.join(worktree, SCRATCH_DIR);
+  const scratch = path68.join(worktree, SCRATCH_DIR);
   let stat;
   try {
     stat = fs32.lstatSync(scratch);
@@ -87284,16 +87678,16 @@ var SLOW, SCRATCH_DIR = ".workit-scratch", EXCLUDE_LINE, DIRTY_ROW_BYTES = 2000,
   try {
     return fs32.realpathSync.native(target);
   } catch {
-    return path65.resolve(target);
+    return path68.resolve(target);
   }
 }, samePath = (a, b) => {
   const left = canonical2(a);
   const right = canonical2(b);
   return process.platform === "win32" || process.platform === "darwin" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }, inside3 = (child, parent) => {
-  const relative = path65.relative(canonical2(parent), canonical2(child));
-  return relative === "" || !relative.startsWith("..") && !path65.isAbsolute(relative);
-}, slicePath = (cwd, slice) => path65.isAbsolute(slice.worktree) ? slice.worktree : path65.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
+  const relative = path68.relative(canonical2(parent), canonical2(child));
+  return relative === "" || !relative.startsWith("..") && !path68.isAbsolute(relative);
+}, slicePath = (cwd, slice) => path68.isAbsolute(slice.worktree) ? slice.worktree : path68.resolve(mainCheckout(cwd), slice.worktree), CLOCK_SLACK_MS = 2000, worktreeDeps, LOCKFILES2, readBytes = (file) => {
   try {
     return fs32.readFileSync(file);
   } catch {
@@ -87325,7 +87719,7 @@ var init_fanout_worktree = __esm(() => {
 
 // packages/workit-core/src/forge/merge-cleanup.ts
 import fs33 from "node:fs";
-import path66 from "node:path";
+import path69 from "node:path";
 function cleanupMergedBranch(cwd, branch, mergedHead) {
   const out = { branchDeleted: false, worktreeRemoved: null, notes: [] };
   if (!branch || branch.startsWith("-"))
@@ -87385,13 +87779,13 @@ var SLOW2, isFanoutWorktree = (worktree) => {
   if (!dir.ok)
     return false;
   try {
-    return fs33.readFileSync(path66.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
+    return fs33.readFileSync(path69.join(dir.stdout.trim(), FANOUT_TOKEN_FILE), "utf8").trim() !== "";
   } catch {
     return false;
   }
 }, inside4 = (child, parent) => {
-  const relative = path66.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
-  return relative === "" || !relative.startsWith("..") && !path66.isAbsolute(relative);
+  const relative = path69.relative(fs33.realpathSync.native(parent), fs33.realpathSync.native(child));
+  return relative === "" || !relative.startsWith("..") && !path69.isAbsolute(relative);
 };
 var init_merge_cleanup = __esm(() => {
   init_fanout();
@@ -87672,7 +88066,7 @@ var init_duration = __esm(() => {
 });
 
 // packages/workit-cli/src/verbs/forge-common.ts
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync28 } from "node:fs";
 function parseFlags(argv, spec) {
   const parsed = { values: {}, booleans: new Set, lists: {}, positionals: [] };
   for (let index = 0;index < argv.length; index += 1) {
@@ -87830,7 +88224,7 @@ var init_forge_common = __esm(() => {
   forgeDeps = {
     runner: undefined,
     npm: undefined,
-    readStdin: () => readFileSync26(0, "utf8"),
+    readStdin: () => readFileSync28(0, "utf8"),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     now: () => Date.now()
   };
@@ -87842,8 +88236,8 @@ __export(exports_pr, {
   checkPrTitle: () => checkPrTitle,
   run: () => run15
 });
-import { existsSync as existsSync27, readFileSync as readFileSync27 } from "node:fs";
-import path67 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync29 } from "node:fs";
+import path70 from "node:path";
 function titleRules(cwd) {
   let root;
   try {
@@ -87854,16 +88248,16 @@ function titleRules(cwd) {
   let text = null;
   let name = "";
   for (const candidate of COMMITLINT_FILES) {
-    const full = path67.join(root, candidate);
+    const full = path70.join(root, candidate);
     if (!existsSync27(full))
       continue;
-    text = readFileSync27(full, "utf8");
+    text = readFileSync29(full, "utf8");
     name = candidate;
     break;
   }
   if (text === null) {
     try {
-      const pkg = JSON.parse(readFileSync27(path67.join(root, "package.json"), "utf8"));
+      const pkg = JSON.parse(readFileSync29(path70.join(root, "package.json"), "utf8"));
       if (pkg.commitlint === undefined)
         return { rules: null, note: null };
       text = JSON.stringify(pkg.commitlint);
@@ -87960,7 +88354,7 @@ function refuseTitle(io, title, line) {
 function readBodyFile(io, file) {
   try {
     return {
-      body: file === "-" ? forgeDeps.readStdin() : readFileSync27(path67.resolve(io.cwd, file), "utf8")
+      body: file === "-" ? forgeDeps.readStdin() : readFileSync29(path70.resolve(io.cwd, file), "utf8")
     };
   } catch {
     return `cannot read --body-file ${file}`;
@@ -88849,8 +89243,8 @@ var exports_git = {};
 __export(exports_git, {
   run: () => run17
 });
-import { readFileSync as readFileSync28 } from "node:fs";
-import path68 from "node:path";
+import { readFileSync as readFileSync30 } from "node:fs";
+import path71 from "node:path";
 function kindHint(cwd, kind) {
   let kinds = [...BRANCH_KINDS];
   try {
@@ -88954,7 +89348,7 @@ function commitMessage(parsed, io) {
 
 `);
   try {
-    return file === "-" ? readFileSync28(0, "utf8") : readFileSync28(path68.resolve(io.cwd, file), "utf8");
+    return file === "-" ? readFileSync30(0, "utf8") : readFileSync30(path71.resolve(io.cwd, file), "utf8");
   } catch (error) {
     return {
       error: `cannot read -F ${file}: ${error instanceof Error ? error.message : String(error)}`
@@ -89140,7 +89534,7 @@ var init_git2 = __esm(() => {
 });
 
 // packages/workit-core/src/forge/verify.ts
-import { spawnSync as spawnSync28 } from "node:child_process";
+import { spawnSync as spawnSync29 } from "node:child_process";
 function finish(cwd, report, actor) {
   const delivered = report.observations.length > 0 && report.observations.every((entry) => entry.ok);
   const out = { ...report, delivered };
@@ -89353,7 +89747,7 @@ var NPM_NAME, SEMVER2, SAFE_ARG, systemNpm = (args) => {
   };
   const found = process.platform === "win32" ? findExecutable("npm.cmd", process.env) : null;
   const npmCmd = found && !/["%!^]/u.test(found) ? `"${found}"` : "npm.cmd";
-  const result = process.platform === "win32" ? spawnSync28(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync28("npm", [...args], options);
+  const result = process.platform === "win32" ? spawnSync29(`${npmCmd} ${args.join(" ")}`, { ...options, shell: true }) : spawnSync29("npm", [...args], options);
   return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
 }, short3 = (sha) => sha ? sha.slice(0, 12) : "(absent)", npmView = (stdout) => {
   try {
@@ -90418,7 +90812,7 @@ var init_stack2 = __esm(() => {
 // packages/workit-core/src/fanout-brief.ts
 import { createHash as createHash20 } from "node:crypto";
 import fs35 from "node:fs";
-import path69 from "node:path";
+import path72 from "node:path";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
   const full = `${lead}-w-${slice}${tail}`;
@@ -90501,7 +90895,7 @@ function renderBrief(cwd, plan, input) {
     "STANDING:",
     ...standing.length ? standing.map((order) => `  - ${order.what}`) : ["  - none recorded beyond this brief"],
     exists ? `WORKTREE: ${planned}  (made by \`workit fanout worktree create ${slice.id}\`; yours alone)` : `WORKTREE: ${planned}  (not made yet: the lead runs \`workit fanout worktree create ${slice.id}\` before spawning, then renders this brief again)`,
-    ...exists && typeof made?.install === "string" && !fs35.existsSync(path69.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
+    ...exists && typeof made?.install === "string" && !fs35.existsSync(path72.join(planned, "node_modules")) ? [`INSTALL: \`${made.install}\` first: the main checkout's node_modules was not linked here`] : [],
     ...identityLines(identity, minted),
     ...rules(mode, branch, sliceBase, exists ? planned : null)
   ];
@@ -91043,7 +91437,7 @@ __export(exports_fanout, {
   run: () => run21
 });
 import fs36 from "node:fs";
-import path70 from "node:path";
+import path73 from "node:path";
 function forgeFor(io, offline) {
   if (offline)
     return { forge: null, error: "--offline" };
@@ -91104,7 +91498,7 @@ function plan2(argv, io) {
     return usage4(io, "pass --trunk or --track, not both (--track picks the trunk)", PLAN_USAGE2);
   if (flags.positionals.length !== 1)
     return usage4(io, flags.positionals.length ? `unexpected argument ${flags.positionals[1]}` : "missing <plan.json>", PLAN_USAGE2);
-  const file = path70.resolve(io.cwd, flags.positionals[0]);
+  const file = path73.resolve(io.cwd, flags.positionals[0]);
   let raw;
   try {
     raw = JSON.parse(fs36.readFileSync(file, "utf8"));
@@ -106680,7 +107074,7 @@ var init_ast = __esm(() => {
 
 // packages/workit-cli/src/test-audit/rules.ts
 import { builtinModules } from "node:module";
-import path71 from "node:path";
+import path74 from "node:path";
 function testCallee(call) {
   let callee = call.callee;
   if (callee.type === "CallExpression")
@@ -107173,12 +107567,12 @@ function checkConstantsOnly(ctx, emit) {
 }
 function checkOverMocking(ctx, emit) {
   const { program } = ctx.parsed;
-  const unit = path71.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
+  const unit = path74.basename(ctx.file).replace(/\.(?:[cm]?[jt]sx?)$/, "").replace(/\.(?:test|spec)$/, "");
   const mocked = find2(program, (node) => node.type === "CallExpression" && MODULE_MOCK.test(calleeName(node.callee) ?? "") && node.arguments[0]?.type === "StringLiteral");
   const internal = mocked.filter((call) => /^(?:\.|@\/|~\/)/.test(call.arguments[0].value));
   for (const call of mocked) {
     const spec = call.arguments[0].value;
-    const base = path71.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
+    const base = path74.basename(spec.replace(/\/index(?:\.[cm]?[jt]sx?)?$/, "")).replace(/\.(?:[cm]?[jt]sx?)$/, "");
     if (base === unit)
       emit({
         rule: "over-mocking",
@@ -107566,11 +107960,11 @@ var init_rules = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/audit.ts
-import { spawnSync as spawnSync29 } from "node:child_process";
-import { existsSync as existsSync28, readdirSync as readdirSync14, readFileSync as readFileSync29, statSync as statSync10 } from "node:fs";
-import path72 from "node:path";
+import { spawnSync as spawnSync30 } from "node:child_process";
+import { existsSync as existsSync28, readdirSync as readdirSync14, readFileSync as readFileSync31, statSync as statSync10 } from "node:fs";
+import path75 from "node:path";
 function git7(cwd, args) {
-  const run = spawnSync29("git", ["-c", "core.quotepath=off", ...args], {
+  const run = spawnSync30("git", ["-c", "core.quotepath=off", ...args], {
     cwd,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -107581,7 +107975,7 @@ function walkTests(dir, out) {
   for (const entry of readdirSync14(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
-    const full = path72.join(dir, entry.name);
+    const full = path75.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!SKIP_DIRS.has(entry.name))
         walkTests(full, out);
@@ -107593,7 +107987,7 @@ function expandPaths(cwd, inputs) {
   const files = [];
   const missing = [];
   for (const input of inputs.length > 0 ? inputs : ["."]) {
-    const full = path72.resolve(cwd, input);
+    const full = path75.resolve(cwd, input);
     if (!existsSync28(full))
       missing.push(input);
     else if (statSync10(full).isDirectory())
@@ -107630,11 +108024,11 @@ function changedLines(cwd, base) {
       for (let offset = 0;offset < count; offset += 1)
         lines.add(start + offset);
     }
-    changed.set(path72.join(root, file), lines);
+    changed.set(path75.join(root, file), lines);
   }
   const untracked = git7(root, ["ls-files", "--others", "--exclude-standard", "-z"]);
   for (const file of untracked.stdout.split("\x00").filter(Boolean))
-    changed.set(path72.join(root, file), "all");
+    changed.set(path75.join(root, file), "all");
   return changed;
 }
 function auditFiles(files, display) {
@@ -107647,7 +108041,7 @@ function auditFiles(files, display) {
     const shown = display(file);
     let parsed;
     try {
-      parsed = parseSource(readFileSync29(file, "utf8"), file);
+      parsed = parseSource(readFileSync31(file, "utf8"), file);
     } catch (error) {
       parseErrors.push({
         file: shown,
@@ -107696,7 +108090,7 @@ function auditFiles(files, display) {
     durationMs: Math.round(performance.now() - started)
   };
 }
-var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path72.sep).join("/"), SEVERITY_ORDER, ruleIds;
+var TEST_FILE, CODE_FILE, SKIP_DIRS, toPosix = (file) => file.split(path75.sep).join("/"), SEVERITY_ORDER, ruleIds;
 var init_audit = __esm(() => {
   init_ast();
   init_rules();
@@ -107708,25 +108102,25 @@ var init_audit = __esm(() => {
 });
 
 // packages/workit-cli/src/test-audit/mutate.ts
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import {
   existsSync as existsSync29,
   lstatSync as lstatSync9,
-  mkdirSync as mkdirSync12,
+  mkdirSync as mkdirSync13,
   mkdtempSync as mkdtempSync4,
   readdirSync as readdirSync15,
-  readFileSync as readFileSync30,
+  readFileSync as readFileSync32,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync11,
-  renameSync as renameSync7,
+  renameSync as renameSync8,
   rmSync as rmSync9,
   statSync as statSync11,
   symlinkSync,
-  writeFileSync as writeFileSync13,
+  writeFileSync as writeFileSync14,
   copyFileSync as copyFileSync8
 } from "node:fs";
-import os23 from "node:os";
-import path73 from "node:path";
+import os24 from "node:os";
+import path76 from "node:path";
 function mutantsFor(source, file, lines) {
   const parsed = parseSource(source, file);
   const out = [];
@@ -107799,7 +108193,7 @@ function relatedTests(source, testFiles) {
     for (const match of text.matchAll(SPECIFIER)) {
       const spec = match[1];
       if (spec.startsWith(".")) {
-        if (stripExt(path73.posix.join(path73.posix.dirname(file), spec)) === target)
+        if (stripExt(path76.posix.join(path76.posix.dirname(file), spec)) === target)
           return true;
       } else if (spec.includes("/") && stripExt(spec).split("/").slice(-2).join("/") === tail)
         return true;
@@ -107807,7 +108201,7 @@ function relatedTests(source, testFiles) {
     return false;
   }).map((entry) => entry.file);
 }
-function removeStaleCopies(tmp = os23.tmpdir()) {
+function removeStaleCopies(tmp = os24.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
@@ -107819,12 +108213,12 @@ function removeStaleCopies(tmp = os23.tmpdir()) {
   for (const name of names) {
     if (!name.startsWith(TEMP_PREFIX))
       continue;
-    const dir = path73.join(tmp, name);
+    const dir = path76.join(tmp, name);
     try {
       const stat = lstatSync9(dir);
       if (!stat.isDirectory() || uid !== undefined && stat.uid !== uid)
         continue;
-      const pid = Number(readFileSync30(path73.join(dir, PID_FILE), "utf8"));
+      const pid = Number(readFileSync32(path76.join(dir, PID_FILE), "utf8"));
       if (Number.isInteger(pid) && pid > 0 && alive(pid))
         continue;
     } catch (error) {
@@ -107839,16 +108233,16 @@ function removeStaleCopies(tmp = os23.tmpdir()) {
   return removed;
 }
 function linkNodeModules(origin, target, repo, copy) {
-  mkdirSync12(target, { recursive: true });
+  mkdirSync13(target, { recursive: true });
   for (const entry of readdirSync15(origin, { withFileTypes: true })) {
-    const from = path73.join(origin, entry.name);
-    const to = path73.join(target, entry.name);
+    const from = path76.join(origin, entry.name);
+    const to = path76.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {
       linkNodeModules(from, to, repo, copy);
       continue;
     }
     if (entry.name.startsWith(".") && entry.name !== ".bin" && entry.isDirectory()) {
-      mkdirSync12(to, { recursive: true });
+      mkdirSync13(to, { recursive: true });
       continue;
     }
     if (entry.isSymbolicLink()) {
@@ -107858,9 +108252,9 @@ function linkNodeModules(origin, target, repo, copy) {
       } catch {
         continue;
       }
-      const relative = path73.relative(repo, real);
-      if (!relative.startsWith("..") && !path73.isAbsolute(relative) && !relative.split(path73.sep).includes("node_modules")) {
-        symlinkSync(path73.join(copy, relative), to, "junction");
+      const relative = path76.relative(repo, real);
+      if (!relative.startsWith("..") && !path76.isAbsolute(relative) && !relative.split(path76.sep).includes("node_modules")) {
+        symlinkSync(path76.join(copy, relative), to, "junction");
         continue;
       }
     }
@@ -107876,7 +108270,7 @@ function copySymlink(repo, tree, from, to) {
   }
   const realRepo = realpathSync11(repo);
   if (real && inside5(realRepo, real)) {
-    symlinkSync(path73.relative(path73.dirname(to), path73.join(tree, path73.relative(realRepo, real))), to);
+    symlinkSync(path76.relative(path76.dirname(to), path76.join(tree, path76.relative(realRepo, real))), to);
     return;
   }
   if (real && statSync11(real).isFile())
@@ -107885,23 +108279,23 @@ function copySymlink(repo, tree, from, to) {
     symlinkSync(readlinkSync3(from), to);
 }
 function writeInside(copy, file, content) {
-  const target = path73.join(copy, file);
+  const target = path76.join(copy, file);
   try {
     const stat = lstatSync9(target);
-    if (!stat.isFile() || !inside5(realpathSync11(copy), realpathSync11(path73.dirname(target))))
+    if (!stat.isFile() || !inside5(realpathSync11(copy), realpathSync11(path76.dirname(target))))
       return false;
   } catch {
     return false;
   }
   const temp = `${target}.workit-mutant-${process.pid}`;
-  writeFileSync13(temp, content);
-  renameSync7(temp, target);
+  writeFileSync14(temp, content);
+  renameSync8(temp, target);
   return true;
 }
 function copyWorkingTree(repo) {
-  const dir = mkdtempSync4(path73.join(os23.tmpdir(), TEMP_PREFIX));
-  writeFileSync13(path73.join(dir, PID_FILE), String(process.pid));
-  const tree = path73.join(dir, "tree");
+  const dir = mkdtempSync4(path76.join(os24.tmpdir(), TEMP_PREFIX));
+  writeFileSync14(path76.join(dir, PID_FILE), String(process.pid));
+  const tree = path76.join(dir, "tree");
   const head = git7(repo, ["rev-parse", "--verify", "--quiet", "HEAD"]).stdout.trim();
   if (head && git7(dir, ["clone", "-q", "--shared", "--no-checkout", repo, tree]).ok) {
     const branch = git7(repo, ["symbolic-ref", "--quiet", "--short", "HEAD"]).stdout.trim();
@@ -107912,42 +108306,42 @@ function copyWorkingTree(repo) {
       git7(tree, ["update-ref", "--no-deref", "HEAD", head]);
     git7(tree, ["reset", "-q"]);
   } else
-    mkdirSync12(tree, { recursive: true });
+    mkdirSync13(tree, { recursive: true });
   const listed = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00");
   const dirs = new Set([""]);
   for (const relative of listed) {
     if (!relative)
       continue;
-    const from = path73.join(repo, relative);
+    const from = path76.join(repo, relative);
     let stat;
     try {
       stat = lstatSync9(from);
     } catch {
       continue;
     }
-    const to = path73.join(tree, relative);
-    mkdirSync12(path73.dirname(to), { recursive: true });
+    const to = path76.join(tree, relative);
+    mkdirSync13(path76.dirname(to), { recursive: true });
     if (stat.isSymbolicLink())
       copySymlink(repo, tree, from, to);
     else if (stat.isFile())
       copyFileSync8(from, to);
-    let parent = path73.dirname(relative);
+    let parent = path76.dirname(relative);
     while (parent !== "." && !dirs.has(parent)) {
       dirs.add(parent);
-      parent = path73.dirname(parent);
+      parent = path76.dirname(parent);
     }
   }
   for (const parent of dirs) {
-    const modules = path73.join(repo, parent, "node_modules");
-    if (existsSync29(modules) && !existsSync29(path73.join(tree, parent, "node_modules")))
-      linkNodeModules(modules, path73.join(tree, parent, "node_modules"), repo, tree);
+    const modules = path76.join(repo, parent, "node_modules");
+    if (existsSync29(modules) && !existsSync29(path76.join(tree, parent, "node_modules")))
+      linkNodeModules(modules, path76.join(tree, parent, "node_modules"), repo, tree);
   }
   return { dir, tree };
 }
 function runCommand(command, cwd, timeoutMs, env) {
   const started = performance.now();
   return new Promise((resolve) => {
-    const child = spawn4(command, {
+    const child = spawn5(command, {
       cwd,
       env,
       shell: true,
@@ -107979,20 +108373,20 @@ async function runMutation(options) {
   const tracked = git7(repo, ["ls-files", "-co", "--exclude-standard", "-z"]).stdout.split("\x00").filter(Boolean);
   const testFiles = tracked.filter((file) => TEST_FILE.test(file)).map((file) => {
     try {
-      return { file, text: readFileSync30(path73.join(repo, file), "utf8") };
+      return { file, text: readFileSync32(path76.join(repo, file), "utf8") };
     } catch {
       return { file, text: "" };
     }
   });
   const candidates = [];
   for (const [absolute, lines] of [...options.changed].toSorted(([a], [b]) => a.localeCompare(b))) {
-    const relative = toPosix(path73.relative(repo, absolute));
+    const relative = toPosix(path76.relative(repo, absolute));
     if (!CODE_FILE.test(relative) || TEST_FILE.test(relative) || relative.endsWith(".d.ts"))
       continue;
     if (NOT_SOURCE.test(relative) || !existsSync29(absolute))
       continue;
     try {
-      candidates.push(...mutantsFor(readFileSync30(absolute, "utf8"), relative, lines));
+      candidates.push(...mutantsFor(readFileSync32(absolute, "utf8"), relative, lines));
     } catch {}
   }
   const mutants = candidates.map((mutant, index) => ({ ...mutant, id: index + 1 }));
@@ -108000,9 +108394,9 @@ async function runMutation(options) {
   for (const mutant of mutants)
     if (!related.has(mutant.file))
       related.set(mutant.file, relatedTests(mutant.file, testFiles));
-  const cwdRelative = path73.relative(repo, options.cwd);
+  const cwdRelative = path76.relative(repo, options.cwd);
   const asArg = (file) => {
-    const relative = toPosix(path73.relative(cwdRelative, file));
+    const relative = toPosix(path76.relative(cwdRelative, file));
     return shellQuote(relative.startsWith(".") ? relative : `./${relative}`);
   };
   const commandFor = (tests) => options.command.replaceAll("{files}", () => tests.map(asArg).join(" "));
@@ -108038,7 +108432,7 @@ async function runMutation(options) {
     return finish3(options, 0, results, counts, started);
   removeStaleCopies();
   const { dir: copyDir, tree: copy } = copyWorkingTree(repo);
-  const copyCwd = path73.join(copy, cwdRelative);
+  const copyCwd = path76.join(copy, cwdRelative);
   let current = null;
   const restore = () => {
     if (current)
@@ -108073,7 +108467,7 @@ async function runMutation(options) {
         record({ ...mutant, status: "skipped", durationMs: 0, tests, reason: "budget" });
         continue;
       }
-      const original = readFileSync30(path73.join(copy, mutant.file), "utf8");
+      const original = readFileSync32(path76.join(copy, mutant.file), "utf8");
       const mutated = original.slice(0, mutant.start) + mutant.replacement + original.slice(mutant.end);
       current = { file: mutant.file, original };
       if (!writeInside(copy, mutant.file, mutated)) {
@@ -108130,8 +108524,8 @@ var NOT_SOURCE, FLIPS, isStringy = (node) => node.type === "StringLiteral" || no
     return error.code === "EPERM";
   }
 }, inside5 = (root, file) => {
-  const relative = path73.relative(root, file);
-  return relative === "" || !relative.startsWith("..") && !path73.isAbsolute(relative);
+  const relative = path76.relative(root, file);
+  return relative === "" || !relative.startsWith("..") && !path76.isAbsolute(relative);
 }, active, killTree = (child) => {
   try {
     if (child.pid && process.platform !== "win32")
@@ -108180,7 +108574,7 @@ __export(exports_test_audit, {
   run: () => run23
 });
 import { existsSync as existsSync30 } from "node:fs";
-import path74 from "node:path";
+import path77 from "node:path";
 function parse8(argv) {
   const options = {
     paths: [],
@@ -108285,8 +108679,8 @@ async function run23(argv, io) {
     return emit(io, fail2("invalid_input", `${options}
 usage: ${USAGE16}`));
   const top = git7(io.cwd, ["rev-parse", "--show-toplevel"]);
-  const repo = top.ok ? path74.resolve(top.stdout.trim()) : null;
-  const display = (file) => toPosix(path74.relative(io.cwd, file) || file);
+  const repo = top.ok ? path77.resolve(top.stdout.trim()) : null;
+  const display = (file) => toPosix(path77.relative(io.cwd, file) || file);
   let base = null;
   let changed = null;
   if (options.diff || options.mutate) {
@@ -108424,8 +108818,8 @@ var exports_youtrack = {};
 __export(exports_youtrack, {
   run: () => run25
 });
-import { readFileSync as readFileSync31 } from "node:fs";
-import path75 from "node:path";
+import { readFileSync as readFileSync33 } from "node:fs";
+import path78 from "node:path";
 async function run25(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "note" && sub !== "time" && sub !== "meeting")
@@ -108471,7 +108865,7 @@ async function run25(argv, io) {
     let markdown = flags.values.markdown ?? "";
     if (flags.values.file)
       try {
-        markdown = readFileSync31(path75.resolve(io.cwd, flags.values.file), "utf8");
+        markdown = readFileSync33(path78.resolve(io.cwd, flags.values.file), "utf8");
       } catch (error) {
         return usage4(io, `cannot read ${flags.values.file}: ${String(error)}`, USAGE18);
       }
@@ -108542,8 +108936,8 @@ var exports_changelog = {};
 __export(exports_changelog, {
   run: () => run26
 });
-import { readFileSync as readFileSync32 } from "node:fs";
-import path76 from "node:path";
+import { readFileSync as readFileSync34 } from "node:fs";
+import path79 from "node:path";
 async function run26(argv, io) {
   const [sub, ...rest] = argv;
   if (sub !== "apply")
@@ -108589,7 +108983,7 @@ async function run26(argv, io) {
   ]);
 }
 var USAGE19 = "workit changelog apply (--entries <JSON|@file|-> | --normalize-only) [--path CHANGELOG.md] [--preview]", readEntries = (raw, cwd) => {
-  const text = raw === "-" ? readFileSync32(0, "utf8") : raw.startsWith("@") ? readFileSync32(path76.resolve(cwd, raw.slice(1)), "utf8") : raw;
+  const text = raw === "-" ? readFileSync34(0, "utf8") : raw.startsWith("@") ? readFileSync34(path79.resolve(cwd, raw.slice(1)), "utf8") : raw;
   return JSON.parse(text);
 };
 var init_changelog2 = __esm(() => {
@@ -108605,7 +108999,7 @@ __export(exports_handoff, {
   run: () => run27
 });
 import fs37 from "node:fs";
-import path77 from "node:path";
+import path80 from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 function render3(brief) {
   const lines = [
@@ -108645,9 +109039,9 @@ function bounded(brief, cwd) {
   let file = null;
   if (store.ok)
     try {
-      const dir = path77.join(store.value.root, "handoff");
+      const dir = path80.join(store.value.root, "handoff");
       fs37.mkdirSync(dir, { recursive: true });
-      file = path77.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
+      file = path80.join(dir, `${(brief.branch ?? "detached").replaceAll(/[^\w.-]+/gu, "-")}.txt`);
       fs37.writeFileSync(file, `${[...body, ...tail].join(`
 `)}
 `, {
@@ -108722,7 +109116,7 @@ var init_handoff = __esm(() => {
 });
 
 // packages/workit-cli/src/main.ts
-import path78 from "node:path";
+import path81 from "node:path";
 
 // packages/workit-core/src/git/env-redirect.ts
 var GIT_REDIRECT_ENV = [
@@ -108881,9 +109275,9 @@ var VERBS = [
   {
     name: "upgrade",
     group: "setup",
-    usage: "workit upgrade [--hosts=a,b|none] [--cli] [--preview | --yes | --apply --confirm] [--json]",
-    summary: "Upgrade the CLI and every host after one confirmation, then verify with doctor",
-    load: () => Promise.resolve().then(() => (init_upgrade2(), exports_upgrade))
+    usage: "workit upgrade [--hosts=a,b|none] [--cli] [--preview | --yes | --apply --confirm | --check] [--set-updates=prompt|auto|off] [--json]",
+    summary: "Upgrade the CLI and every host after one confirmation, then verify with doctor; --check compares installed and latest versions",
+    load: () => Promise.resolve().then(() => (init_upgrade2(), exports_upgrade2))
   },
   {
     name: "launch",
@@ -108993,7 +109387,7 @@ var VERBS = [
       'workit check test --no-lease --reason "machine is idle, debugging a hang"'
     ],
     notes: LEASE_NOTES,
-    load: () => Promise.resolve().then(() => (init_check(), exports_check))
+    load: () => Promise.resolve().then(() => (init_check2(), exports_check))
   },
   withSubcommands({
     name: "lock",
@@ -109671,7 +110065,7 @@ var defaultIo = (json) => ({
 });
 async function main(argv, overrides = {}, options = {}) {
   const parsed = parseGlobals(argv);
-  const cwd = path78.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
+  const cwd = path81.resolve(overrides.cwd ?? process.cwd(), parsed.cwd ?? ".");
   const io = {
     ...defaultIo(parsed.json),
     terminals: {
@@ -109717,6 +110111,18 @@ async function main(argv, overrides = {}, options = {}) {
   const entry = findVerb(command);
   if (!entry)
     return unknown2(io, command);
+  if (!io.json && overrides.stdout === undefined && overrides.stderr === undefined && process.stdin.isTTY && process.stdout.isTTY && process.stderr.isTTY) {
+    await Promise.resolve().then(() => init_update_check());
+    const reexecuted = await launchUpdateCheck({ argv, command, json: parsed.json }, {
+      env: io.env,
+      stdin: process.stdin,
+      stdout: process.stdout,
+      stderr: process.stderr,
+      write: (text) => void process.stderr.write(text)
+    });
+    if (reexecuted !== undefined)
+      return reexecuted;
+  }
   const route = async (routed) => {
     if (wantsHelp(verbArgs)) {
       const word = firstWord(verbArgs);
@@ -109887,8 +110293,14 @@ var describe4 = (entry) => ({
   summary: entry.summary,
   ...entry.planned ? { planned: entry.planned } : {}
 });
-var unknown2 = (io, command) => emit(io, fail2("invalid_input", `unknown command "${command}"`, { unblock: commandUnblock(command) }));
+var unknown2 = (io, command) => emit(io, fail2("invalid_input", `unknown command "${command}"`, {
+  unblock: commandUnblock(command)
+}));
 if (__require.main == __require.module) {
+  if (process.env.WORKIT_UPDATE_REFRESH === "1") {
+    (await Promise.resolve().then(() => (init_update_check(), exports_update_check))).refreshUpdateCache(process.env);
+    process.exit(0);
+  }
   const code = await main(process.argv.slice(2), {}, { diagnostics: true });
   await flushStreams();
   process.exit(code);