@brainervirus/workit-cli 8.6.0 → 8.7.0

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "8.6.0",
+    version: "8.7.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -103,9 +103,9 @@ var init_package = __esm(() => {
     },
     dependencies: {
       "@babel/parser": "7.29.9",
-      "@brainervirus/workit-core": "^8.6.0",
-      "@brainervirus/workit-cursor": "^8.6.0",
-      "@brainervirus/workit-opencode": "^8.6.0",
+      "@brainervirus/workit-core": "^8.7.0",
+      "@brainervirus/workit-cursor": "^8.7.0",
+      "@brainervirus/workit-opencode": "^8.7.0",
       "@inkjs/ui": "2.0.0",
       ink: "7.1.1",
       react: "19.2.8"
@@ -15016,7 +15016,9 @@ function clearStanding(context, input) {
     target: input.target
   }, { now: context.now });
 }
-function dirtyElsewhere(cwd, branch) {
+function dirtyElsewhere(cwd, branch, head) {
+  if (headSha(cwd) === head)
+    return worktreeTree(cwd)?.dirty !== false;
   const list = git4(cwd, ["worktree", "list", "--porcelain"]);
   let worktree = null;
   for (const line of (list ?? "").split(`
@@ -15051,7 +15053,7 @@ function recordVerdict(context, input) {
   const key = codeKey(context.cwd, { branch, base: context.base });
   if (!key.head)
     return err("not_found", `branch "${branch}" has no commit to judge`);
-  if (key.dirty === true || key.dirty === null && dirtyElsewhere(context.cwd, branch))
+  if (key.dirty === true || key.dirty === null && dirtyElsewhere(context.cwd, branch, key.head))
     return err("blocked", `dirty_worktree: ${branch} has uncommitted changes, so its head is not what was judged`, "commit or stash the changes, re-check, then record the verdict");
   const session = context.actor.session;
   const selfReason = input.self === true ? "flag" : session && input.derivedFrom !== null ? null : "no_session";
@@ -63930,11 +63932,13 @@ var init_skill_manifests = __esm(() => {
 
 // packages/workit-cli/src/admin/doctor.ts
 import { spawnSync as spawnSync13 } from "node:child_process";
+import { createHash as createHash13 } from "node:crypto";
 import {
   existsSync as existsSync13,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync5,
   mkdtempSync,
+  readdirSync as readdirSync7,
   readFileSync as readFileSync13,
   readlinkSync as readlinkSync2,
   rmSync as rmSync2,
@@ -63975,8 +63979,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     cursorMcp: options.cursorMcp ?? path30.join(home, ".cursor", "mcp.json"),
     cursorPluginDir: options.cursorPluginDir ?? path30.join(home, ".cursor", "plugins", "local", "workit"),
     cursorHeartbeatDir: options.stateDir ?? (env.WORKFLOW_TOOLKIT_STATE || resolveStateDir()),
+    codexHome: options.codexHome,
+    piAgentDir: options.piAgentDir,
     env,
-    installer: options.installer ?? false
+    installer: options.installer ?? false,
+    cliVersion: options.cliVersion ?? null
   };
 }, readJson = (p) => {
   try {
@@ -64197,6 +64204,368 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
     detail: `codex CLI ${installed} differs from the qualified ${qualified}`,
     fix: `Reinstall the qualified Codex CLI ${qualified} or record fresh qualification evidence`
   };
+}, readTomlTables = (file) => {
+  const tables = new Map;
+  let text;
+  try {
+    text = readFileSync13(file, "utf8");
+  } catch {
+    return tables;
+  }
+  const unquote = (raw) => {
+    const s = raw.trim();
+    if (s.startsWith('"')) {
+      try {
+        return JSON.parse(s);
+      } catch {
+        return s.slice(1, -1);
+      }
+    }
+    return s.startsWith("'") ? s.slice(1, -1) : s;
+  };
+  const SEGMENT = /\s*("(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_-]+)\s*(?:\.|$)/y;
+  let current = {};
+  tables.set("", current);
+  for (const line of text.split(/\r?\n/)) {
+    const header = /^\s*\[([^[\]]+)\]\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      const parts = [];
+      SEGMENT.lastIndex = 0;
+      let match;
+      while (SEGMENT.lastIndex < header[1].length && (match = SEGMENT.exec(header[1])))
+        parts.push(unquote(match[1]));
+      const key = parts.join("\x00");
+      current = tables.get(key) ?? {};
+      tables.set(key, current);
+      continue;
+    }
+    const pair = /^\s*("(?:[^"\\]|\\.)*"|[A-Za-z0-9_-]+)\s*=\s*(.+?)\s*$/.exec(line);
+    if (!pair)
+      continue;
+    const value = pair[2].replace(/\s+#[^"']*$/, "");
+    current[unquote(pair[1])] = value === "true" ? true : value === "false" ? false : unquote(value);
+  }
+  return tables;
+}, codexHomeOf = (res) => res.codexHome ?? (res.env.CODEX_HOME || path30.join(res.home, ".codex")), codexWorkitInstalls = (res) => {
+  const codexHome = codexHomeOf(res);
+  const configFile = path30.join(codexHome, "config.toml");
+  const installs = [];
+  for (const [key, table] of readTomlTables(configFile)) {
+    const [kind, id, ...rest] = key.split("\x00");
+    if (kind !== "plugins" || rest.length > 0 || !id?.startsWith("workit@") || table.enabled === false)
+      continue;
+    const marketplace = id.slice("workit@".length);
+    const dir = path30.join(codexHome, "plugins", "cache", marketplace, "workit");
+    let versions = [];
+    try {
+      versions = readdirSync7(dir).filter((v) => existsSync13(path30.join(dir, v, ".codex-plugin")));
+    } catch {
+      versions = [];
+    }
+    const version = versions.reduce((best, v) => best && semverAtLeast(best, v) ? best : v, null);
+    installs.push({
+      id,
+      marketplace,
+      root: version ? path30.join(dir, version) : null,
+      version,
+      configFile
+    });
+  }
+  return installs;
+}, snakeEvent = (event) => event.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase(), codexHookHash = (event, matcher, handler) => {
+  if (handler.type !== "command" || typeof handler.command !== "string" || Object.keys(handler).some((k) => !["type", "command", "timeout", "async"].includes(k)))
+    return null;
+  const hook = {
+    async: handler.async ?? false,
+    command: handler.command,
+    timeout: handler.timeout ?? 600,
+    type: "command"
+  };
+  const body = {
+    event_name: snakeEvent(event),
+    hooks: [hook],
+    ...typeof matcher === "string" ? { matcher } : {}
+  };
+  return `sha256:${createHash13("sha256").update(JSON.stringify(body)).digest("hex")}`;
+}, codexHookTrust = (install, tables) => {
+  const hooks = install.root ? readJson(path30.join(install.root, "hooks", "hooks.json"))?.hooks : null;
+  if (!hooks || typeof hooks !== "object")
+    return null;
+  const result = [];
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups))
+      continue;
+    groups.forEach((group, g) => {
+      const handlers = Array.isArray(group?.hooks) ? group.hooks : [];
+      handlers.forEach((handler, h) => {
+        const key = `${install.id}:hooks/hooks.json:${snakeEvent(event)}:${g}:${h}`;
+        const hash = codexHookHash(event, group?.matcher, handler ?? {});
+        const state = tables.get(["hooks", "state", key].join("\x00"));
+        const trusted = typeof state?.trusted_hash === "string" ? state.trusted_hash : null;
+        result.push({
+          key,
+          hash,
+          state: state?.enabled === false ? "disabled" : trusted === null ? "untrusted" : hash !== null && trusted !== hash ? "modified" : "trusted"
+        });
+      });
+    });
+  }
+  return result;
+}, checkCodexHooks = (res) => {
+  const installs = codexWorkitInstalls(res);
+  if (installs.length === 0)
+    return {
+      id: "codex_hooks",
+      status: "pass",
+      detail: "no Workit Codex plugin enabled — skipping"
+    };
+  const tables = readTomlTables(installs[0].configFile);
+  const problems = [];
+  const toTrust = [];
+  let reinstall;
+  let total = 0;
+  for (const install of installs) {
+    const trust = codexHookTrust(install, tables);
+    if (!trust) {
+      problems.push(`${install.id}: no installed hooks/hooks.json`);
+      reinstall ??= `codex plugin remove ${install.id} && codex plugin add ${install.id}`;
+      continue;
+    }
+    total += trust.length;
+    for (const state of ["untrusted", "modified", "disabled"]) {
+      const hit = trust.filter((t) => t.state === state);
+      if (hit.length > 0)
+        problems.push(`${install.id}: ${hit.length} of ${trust.length} hooks ${state === "modified" ? "changed since trusted" : state} (${hit.map((t) => t.key.split(":")[2]).join(", ")})`);
+    }
+    toTrust.push(...trust.filter((t) => t.state !== "trusted"));
+  }
+  if (problems.length === 0)
+    return {
+      id: "codex_hooks",
+      status: "pass",
+      detail: `${total} Workit Codex plugin hooks trusted (${installs.map((i) => `${i.id} ${i.version ?? "?"}`).join(", ")})`
+    };
+  const disabled = toTrust.some((t) => t.state === "disabled");
+  const fix = reinstall ?? `Start \`codex\`, run \`/hooks\` and ${disabled ? "enable and " : ""}trust the workit hooks (or pick "Trust all and continue" when Codex asks you to review hooks at startup)`;
+  return {
+    id: "codex_hooks",
+    status: "warn",
+    detail: `Codex skips untrusted plugin hooks — ${problems.join("; ")}`,
+    fix
+  };
+}, CODEX_AGENT_MARKER = "# Generated by Workit", AGENT_MARKER_VERSION, agentMarkerVersion = (text) => AGENT_MARKER_VERSION.exec(text)?.[1] ?? null, stampCodexAgent = (content, version) => version && content.startsWith(CODEX_AGENT_MARKER) && !agentMarkerVersion(content) ? `${CODEX_AGENT_MARKER} ${version}${content.slice(CODEX_AGENT_MARKER.length)}` : content, checkCodexAgents = (res) => {
+  const installs = codexWorkitInstalls(res);
+  if (installs.length === 0)
+    return {
+      id: "codex_agents",
+      status: "pass",
+      detail: "no Workit Codex plugin enabled — skipping"
+    };
+  const agentsDir = path30.join(codexHomeOf(res), "agents");
+  const problems = [];
+  const fixes = [];
+  const installed = [];
+  for (const install of installs) {
+    const source = install.root ? path30.join(install.root, "agents") : null;
+    const files = source && existsSync13(source) ? readdirSync7(source).filter((f) => f.endsWith(".toml")).toSorted() : [];
+    if (files.length === 0) {
+      problems.push(`${install.id} ${install.version ?? "?"} bundles no agents`);
+      fixes.push(`codex plugin remove ${install.id} && codex plugin add ${install.id}`);
+      continue;
+    }
+    const install_fix = `node ${JSON.stringify(path30.join(install.root, "dist", "launch-mcp.js"))} --install-agents, then start a new Codex session`;
+    const pluginVersion = readJson(path30.join(install.root, "package.json"))?.version;
+    const version = typeof pluginVersion === "string" ? pluginVersion.match(SEMVER)?.[0] ?? null : null;
+    let stale = false;
+    for (const file of files) {
+      const dest = path30.join(agentsDir, file);
+      const want = stampCodexAgent(readFileSync13(path30.join(source, file), "utf8"), version);
+      let link = false;
+      try {
+        link = lstatSync4(dest).isSymbolicLink();
+      } catch {
+        link = false;
+      }
+      if (link) {
+        problems.push(`${dest} is a symlink (the plugin never writes through one)`);
+        fixes.push(`replace the symlink ${dest} with a file or remove it, then run ${install_fix}`);
+        continue;
+      }
+      let have = null;
+      try {
+        have = readFileSync13(dest, "utf8");
+      } catch {
+        have = null;
+      }
+      const written = have === null ? null : agentMarkerVersion(have);
+      const newer = written !== null && version !== null && versionBehind(version, written);
+      if (have === want || newer) {
+        installed.push(file.replace(/\.toml$/, ""));
+        continue;
+      }
+      if (have !== null && !have.startsWith(CODEX_AGENT_MARKER)) {
+        problems.push(`${dest} is a user agent that shadows ${install.id}'s ${file}`);
+        fixes.push(`rename or remove ${dest}, then run ${install_fix}`);
+        continue;
+      }
+      problems.push(`${dest} ${have === null ? "missing" : "outdated"}`);
+      stale = true;
+    }
+    if (stale)
+      fixes.push(install_fix);
+  }
+  if (problems.length === 0)
+    return {
+      id: "codex_agents",
+      status: "pass",
+      detail: `Codex agents ${installed.join(", ")} installed in ${agentsDir}`
+    };
+  return {
+    id: "codex_agents",
+    status: "warn",
+    detail: problems.join("; "),
+    fix: [...new Set(fixes)].join("; ")
+  };
+}, PI_PACKAGE = "@brainervirus/workit-pi", PI_EXTENSION = "dist/workit.js", piAgentDirOf = (res) => {
+  if (res.piAgentDir)
+    return res.piAgentDir;
+  const env = res.env.PI_CODING_AGENT_DIR;
+  if (env)
+    return env === "~" ? res.home : env.replace(/^~(?=\/|\\)/, res.home);
+  return path30.join(res.home, ".pi", "agent");
+}, npmSpecName = (spec) => {
+  const at = spec.indexOf("@", spec.startsWith("@") ? 1 : 0);
+  return at > 0 ? { name: spec.slice(0, at), pinned: true } : { name: spec, pinned: false };
+}, findPiEntry = (res, agentDir) => {
+  const scopes = [
+    {
+      scope: "project",
+      settingsFile: path30.join(res.cwd, ".pi", "settings.json"),
+      base: path30.join(res.cwd, ".pi")
+    },
+    { scope: "user", settingsFile: path30.join(agentDir, "settings.json"), base: agentDir }
+  ];
+  for (const { scope, settingsFile, base } of scopes) {
+    const packages = readJson(settingsFile)?.packages;
+    if (!Array.isArray(packages))
+      continue;
+    for (const entry of packages) {
+      const source = typeof entry === "string" ? entry : typeof entry?.source === "string" ? entry.source : null;
+      if (!source)
+        continue;
+      const filter = typeof entry === "object" ? entry : null;
+      if (source.startsWith("npm:")) {
+        const spec = npmSpecName(source.slice(4).trim());
+        if (spec.name !== PI_PACKAGE)
+          continue;
+        const root = path30.join(base, "npm", "node_modules", ...PI_PACKAGE.split("/"));
+        return { scope, settingsFile, source, filter, root, npm: { pinned: spec.pinned } };
+      }
+      if (/^(git:|https?:|ssh:|git@)/.test(source))
+        continue;
+      const local = path30.resolve(base, source.replace(/^~(?=\/|\\)/, res.home));
+      if (readJson(path30.join(local, "package.json"))?.name === PI_PACKAGE)
+        return { scope, settingsFile, source, filter, root: local, npm: null };
+    }
+  }
+  return null;
+}, globToRegExp3 = (pattern) => new RegExp(`^${pattern.replace(/^\.\//, "").replace(/[.+^${}()|[\]\\]/g, "\\$&").split(/\*\*\/?/).map((part) => part.replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]")).join(".*")}$`), piFilterKeeps = (patterns, file) => {
+  if (!Array.isArray(patterns))
+    return true;
+  const list = patterns.filter((p) => typeof p === "string");
+  if (list.length === 0)
+    return false;
+  const name = path30.posix.basename(file);
+  const matches = (p) => {
+    const re = globToRegExp3(p);
+    return re.test(file) || re.test(name);
+  };
+  const exact = (p) => p.replace(/^\.\//, "") === file;
+  const includes = list.filter((p) => !/^[!+-]/.test(p));
+  let kept = includes.length === 0 || includes.some(matches);
+  if (list.some((p) => p.startsWith("!") && matches(p.slice(1))))
+    kept = false;
+  if (list.some((p) => p.startsWith("+") && exact(p.slice(1))))
+    kept = true;
+  if (list.some((p) => p.startsWith("-") && exact(p.slice(1))))
+    kept = false;
+  return kept;
+}, checkPiExtension = (res) => {
+  const agentDir = piAgentDirOf(res);
+  if (!existsSync13(agentDir) && !commandOnPath("pi", res.env))
+    return { id: "pi_extension", status: "pass", detail: "Pi not installed — skipping" };
+  const installCmd = (scope, spec = `npm:${PI_PACKAGE}`) => `pi install ${spec}${scope === "project" ? " -l" : ""}`;
+  const entry = findPiEntry(res, agentDir);
+  if (!entry)
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension missing: no ${PI_PACKAGE} entry in ${path30.join(agentDir, "settings.json")} or ${path30.join(res.cwd, ".pi", "settings.json")}`,
+      fix: installCmd("user")
+    };
+  const where = `${entry.source} (${entry.scope}, ${entry.settingsFile})`;
+  const rebuild = `cd ${JSON.stringify(entry.root)} && bun run build`;
+  const pkg = readJson(path30.join(entry.root, "package.json"));
+  if (!pkg)
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension missing: ${where} is listed but not installed at ${entry.root}`,
+      fix: entry.npm ? installCmd(entry.scope, entry.source) : `restore ${entry.root}, then ${rebuild}`
+    };
+  const declared = Array.isArray(pkg.pi?.extensions) ? pkg.pi.extensions.some((e) => typeof e === "string" && e.replace(/^\.\//, "") === PI_EXTENSION) : false;
+  if (!declared || !existsSync13(path30.join(entry.root, PI_EXTENSION)))
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension not loading: ${entry.root} ${declared ? `has no ${PI_EXTENSION}` : `does not declare ${PI_EXTENSION} in its pi manifest`}`,
+      fix: entry.npm ? `pi remove ${entry.source}${entry.scope === "project" ? " -l" : ""} && ${installCmd(entry.scope, entry.source)}` : rebuild
+    };
+  const filter = entry.filter?.extensions;
+  if (!piFilterKeeps(filter, PI_EXTENSION))
+    return {
+      id: "pi_extension",
+      status: "warn",
+      detail: `Workit Pi extension not loading: the ${PI_PACKAGE} entry in ${entry.settingsFile} filters out ${PI_EXTENSION} (extensions: ${JSON.stringify(filter)})`,
+      fix: `remove the "extensions" filter from the ${PI_PACKAGE} entry in ${entry.settingsFile}, or enable the extension with \`pi config${entry.scope === "project" ? " -l" : ""}\``
+    };
+  const version = typeof pkg.version === "string" ? pkg.version : null;
+  const cli = res.cliVersion;
+  if (version && cli && versionBehind(version, cli)) {
+    if (!entry.npm)
+      return {
+        id: "pi_extension",
+        status: "pass",
+        detail: `Workit Pi extension ${version} from local checkout ${where} loads ${PI_EXTENSION} (older than workit ${cli}; a checkout is not compared with the registry)`
+      };
+    const latest = registryLatestVersion(res, PI_PACKAGE);
+    const registryProbed = latest !== null && !res.env.WORKIT_DOCTOR_STALE_REGISTRY_VERSION;
+    if (!latest)
+      return {
+        id: "pi_extension",
+        status: "pass",
+        detail: `Workit Pi extension ${version} from ${where} loads ${PI_EXTENSION}; registry unreachable, so whether a version newer than ${version} is published is unknown (workit ${cli})`
+      };
+    if (versionBehind(version, latest))
+      return {
+        id: "pi_extension",
+        status: "warn",
+        detail: `Workit Pi extension stale: ${PI_PACKAGE} ${version} from ${where} is older than workit ${cli} (published ${latest})`,
+        fix: entry.npm.pinned ? installCmd(entry.scope, `npm:${PI_PACKAGE}@${latest}`) : `pi update npm:${PI_PACKAGE}`,
+        registryProbed
+      };
+    return {
+      id: "pi_extension",
+      status: "pass",
+      detail: `Workit Pi extension ${version} from ${where} is the newest published (workit ${cli})`,
+      registryProbed
+    };
+  }
+  return {
+    id: "pi_extension",
+    status: "pass",
+    detail: `Workit Pi extension ${version ?? "?"} from ${where} loads ${PI_EXTENSION}`
+  };
 }, assetPathsFor = (host, dev) => {
   const pkg = path30.join(dev, "packages", `workit-${host}`);
   switch (host) {
@@ -65304,6 +65673,7 @@ var init_doctor = __esm(() => {
   init_host_install();
   init_skill_manifests();
   OPENCODE_V1_FIX = `OpenCode < ${SUPPORT_MATRIX.opencode.minimum} cannot load Workit 3 (V2 plugin API only): upgrade OpenCode to ${SUPPORT_MATRIX.opencode.minimum}+, or stay on Workit 2.x by pinning "@brainervirus/workit-opencode@2" in the opencode.json "plugin" array`;
+  AGENT_MARKER_VERSION = /^# Generated by Workit (\d+\.\d+\.\d+)\b/;
   canonicalCursorHook = cursorHooksEntry().command;
   SILENT_HOOK_GRACE_MS = 2 * 60000;
   SEMVER = /\d+\.\d+\.\d+/;
@@ -65312,6 +65682,9 @@ var init_doctor = __esm(() => {
     checkRuntime,
     checkVersions,
     checkCodexPin,
+    checkCodexHooks,
+    checkCodexAgents,
+    checkPiExtension,
     checkOpencodeVersion,
     checkClaudePlugin,
     checkWorkitOnPath,
@@ -65351,7 +65724,7 @@ import {
   mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync14,
-  readdirSync as readdirSync7,
+  readdirSync as readdirSync8,
   realpathSync as realpathSync7,
   renameSync as renameSync3,
   rmSync as rmSync3,
@@ -66237,7 +66610,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   }
 }, samePluginContent = (src, dest, pluginDir, relative = "") => {
   try {
-    for (const entry of readdirSync7(src, { withFileTypes: true })) {
+    for (const entry of readdirSync8(src, { withFileTypes: true })) {
       if (entry.name === "node_modules")
         continue;
       const source = path31.join(src, entry.name);
@@ -66252,7 +66625,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
           return false;
       }
     }
-    for (const entry of readdirSync7(dest, { withFileTypes: true })) {
+    for (const entry of readdirSync8(dest, { withFileTypes: true })) {
       if (existsSync14(path31.join(src, entry.name)))
         continue;
       const rel = path31.join(relative, entry.name);
@@ -66271,7 +66644,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   const sourceRules = path31.join(src, "rules");
   const installedRules = path31.join(dest, "rules");
   try {
-    for (const entry of readdirSync7(installedRules, { withFileTypes: true })) {
+    for (const entry of readdirSync8(installedRules, { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".mdc"))
         continue;
       if (existsSync14(path31.join(sourceRules, entry.name)))
@@ -66288,7 +66661,7 @@ var TOKEN_PLACEHOLDER3 = "YOUR_TOKEN_HERE", YT_OVERRIDES, VCS_OVERRIDES, SETUP_O
   if (existsSync14(legacyRules)) {
     try {
       mkdirSync6(path31.join(res.cursorPluginDir, "rules"), { recursive: true });
-      for (const entry of readdirSync7(legacyRules, { withFileTypes: true })) {
+      for (const entry of readdirSync8(legacyRules, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(".mdc"))
           continue;
         const target = path31.join(res.cursorPluginDir, "rules", entry.name);
@@ -70080,7 +70453,7 @@ import {
 } from "node:fs";
 import path35 from "node:path";
 import os12 from "node:os";
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 function previewUpgrade(hosts = HOSTS2, deps = {}) {
   const paths = upgradePaths(deps);
   const { home, configDir } = paths;
@@ -70208,7 +70581,7 @@ function applyUpgrade(plan, deps = {}) {
   mkdirSync8(backup, { recursive: true, mode: 448 });
   for (const file of Object.keys(plan.configDigests))
     if (existsSync17(file)) {
-      const target = path35.join(backup, createHash13("sha256").update(file).digest("hex").slice(0, 12) + "-" + path35.basename(file));
+      const target = path35.join(backup, createHash14("sha256").update(file).digest("hex").slice(0, 12) + "-" + path35.basename(file));
       copyFileSync5(file, target);
       chmodSync(target, 384);
     }
@@ -70463,7 +70836,7 @@ var HOSTS2, upgradePaths = (deps) => {
   if (!data || typeof data !== "object" || Array.isArray(data))
     throw new Error(`${file} is not a configuration object`);
   return data;
-}, digest2 = (file) => existsSync17(file) ? createHash13("sha256").update(readFileSync17(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
+}, digest2 = (file) => existsSync17(file) ? createHash14("sha256").update(readFileSync17(file)).digest("hex") : "missing", runner = (deps) => deps.run ?? ((command, args) => {
   const { home, env } = upgradePaths(deps);
   let step;
   try {
@@ -70949,7 +71322,12 @@ async function run5(argv, io) {
     }
     fixLock = clearStaleMetadataLock(root, { force });
   }
-  const report = runDoctor({ host: "cli", cwd: io.cwd, workspaceRoot: root });
+  const report = runDoctor({
+    host: "cli",
+    cwd: io.cwd,
+    workspaceRoot: root,
+    cliVersion: package_default.version
+  });
   let knowledge = null;
   try {
     knowledge = lintKnowledge(root);
@@ -70982,7 +71360,9 @@ async function run5(argv, io) {
     io.stdout(`${mark} ${check.id} — ${check.detail}
 `);
     if (check.fix)
-      io.stdout(`     fix: ${check.fix}
+      io.stdout(`     fix: ${check.fix.replaceAll(`
+`, `
+          `)}
 `);
   }
   io.stdout(`${knowledgeLine}
@@ -70992,6 +71372,7 @@ async function run5(argv, io) {
   return report.exitCode;
 }
 var init_doctor2 = __esm(() => {
+  init_package();
   init_doctor();
   init_knowledge();
   init_store_lock();
@@ -71105,7 +71486,7 @@ var init_redact = __esm(() => {
 
 // packages/workit-core/src/checks.ts
 import { spawn, spawnSync as spawnSync16 } from "node:child_process";
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 import fs18 from "node:fs";
 import os13 from "node:os";
 import path37 from "node:path";
@@ -71439,7 +71820,7 @@ function pruneCheckLogs(storeRoot, options = {}) {
   }
   return report;
 }
-var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash14("sha256").update(log).digest("hex")}`, LOG_RETENTION;
+var MAX_LOG_BYTES, TAIL_LINES = 80, MAX_LINE_CHARS = 400, redactLog = (text) => redactText(text), PEM_BEGIN, PEM_END, BATCH_BYTES, MAX_PENDING, PEM_BODY, MAX_KEY_LINES = 4096, MAX_KEY_BYTES, CMD_META, DRAIN_MS = 250, FORWARDED_SIGNALS, logDigest = (log) => `sha256:${createHash15("sha256").update(log).digest("hex")}`, LOG_RETENTION;
 var init_checks3 = __esm(() => {
   init_redact();
   MAX_LOG_BYTES = 2 * 1024 * 1024;
@@ -72429,6 +72810,23 @@ function patchEquivalent(cwd, branch, tip) {
 `).filter(Boolean) : [];
   return lines.length > 0 && lines.every((line) => line.startsWith("-"));
 }
+function resolveExpectPrefix(prefix, tips, label) {
+  const known = [...new Set(tips.filter((tip) => typeof tip === "string"))];
+  if (!SHA_PREFIX.test(prefix))
+    return {
+      ok: false,
+      code: "invalid_input",
+      error: "--expect must be a commit sha (full, or an abbreviation of at least 7 hex digits)"
+    };
+  const matches = known.filter((tip) => tip.startsWith(prefix));
+  if (matches.length === 1)
+    return { ok: true, sha: matches[0] };
+  return {
+    ok: false,
+    code: "invalid_input",
+    error: matches.length > 1 ? `--expect ${prefix} is ambiguous for ${label}; choose one of: ${matches.join(", ")}` : `--expect ${prefix} matches no known tip of ${label}${known.length ? `; known: ${known.join(", ")}` : ""}; pass the full sha`
+  };
+}
 function executePush(cwd, plan, input) {
   const before = remoteRefTip(cwd, plan.rawUrl, `refs/heads/${plan.branch}`);
   if (!before.ok)
@@ -72439,10 +72837,15 @@ function executePush(cwd, plan, input) {
     const args = ["push", "--porcelain", "--no-follow-tags", "--recurse-submodules=no"];
     if (input.forceWithLease) {
       const explicit = input.expect !== undefined && input.expect !== null;
-      if (explicit && !SHA.test(input.expect))
-        return failure3("invalid_input", "--expect must be a full commit sha");
+      let expectSha = input.expect ?? null;
+      if (explicit && !SHA.test(expectSha)) {
+        const resolved = resolveExpectPrefix(expectSha, [before.sha, recordedRemoteTip(cwd, plan)], `${plan.remote}/${plan.branch}`);
+        if (!resolved.ok)
+          return failure3(resolved.code, resolved.error);
+        expectSha = resolved.sha;
+      }
       const integrate = `git fetch ${plan.remote} ${plan.branch} && git rebase ${plan.remote}/${plan.branch}  # or merge it; then: workit git push`;
-      const recorded = explicit ? input.expect : recordedRemoteTip(cwd, plan);
+      const recorded = explicit ? expectSha : recordedRemoteTip(cwd, plan);
       if (recorded === undefined && before.sha !== null)
         return failure3("blocked", `lease_unknown: workit has no recorded push of ${plan.branch}, so it cannot tell whose commits ${plan.remote}/${plan.branch} (${before.sha.slice(0, 12)}) holds`, `${integrate}  # or, after reviewing that tip: workit git push --force-with-lease --expect <sha you reviewed> (--overwrite-unintegrated only to drop commits you never had)`);
       const expected = recorded ?? null;
@@ -72574,7 +72977,7 @@ ${run.stdout ?? ""}`).split(/\r?\n/u).map((value) => value.trimEnd()).filter((va
     ...lines.slice(-half)
   ].join(`
 `);
-}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA;
+}, validRefName = (cwd, name) => !name.startsWith("-") && git5(cwd, ["check-ref-format", "--branch", name]).ok, nulList = (text) => text.split("\x00").filter(Boolean), SESSION_SAFE, TRAILER_CONFIG, nothingToCommit = (what) => failure3("failed", `nothing_to_commit: ${what}`, "workit git commit --allow-empty -m '<msg>'  # only to record an empty commit on purpose"), SHA, SHA_PREFIX;
 var init_ops = __esm(() => {
   init_branch();
   init_commit_flavors();
@@ -72588,6 +72991,7 @@ var init_ops = __esm(() => {
   SESSION_SAFE = /^[\w.:@/+-]{1,128}$/u;
   TRAILER_CONFIG = ["-c", "trailer.separators=:", "-c", "trailer.where=end"];
   SHA = /^[0-9a-f]{40,64}$/u;
+  SHA_PREFIX = /^[0-9a-f]{7,39}$/u;
 });
 
 // packages/workit-core/src/forge/reruns.ts
@@ -73401,7 +73805,7 @@ var init_pr_ops = __esm(() => {
 
 // packages/workit-core/src/stack.ts
 import { spawnSync as spawnSync19 } from "node:child_process";
-import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash16, randomBytes as randomBytes3 } from "node:crypto";
 import fs20 from "node:fs";
 import path41 from "node:path";
 function worktreeOf(cwd, branch) {
@@ -74568,7 +74972,7 @@ var STACK_VERSION = 1, stackFail = (code, error, unblock, data) => ({
   return dir.ok ? path41.join(dir.data, "worktrees") : null;
 }, firstLine = (run) => (`${run.stderr}
 ${run.stdout}`.split(`
-`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash15("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
+`).find((line) => line.trim()) ?? "git failed").trim().slice(0, 300), stackFileName = (name) => `${name.replace(/[^A-Za-z0-9._-]+/gu, "_").replace(/^[._]+/u, "").slice(0, 48).toLowerCase()}-${createHash16("sha256").update(name).digest("hex").slice(0, 12)}.json`, fileFor, validName = (name) => {
   if (name.length === 0 || name.length > 200)
     return false;
   for (let index = 0;index < name.length; index += 1) {
@@ -76894,8 +77298,8 @@ async function push(argv, io) {
   const expect = flags.values.expect ?? null;
   if ((expect !== null || flags.booleans.has("overwrite-unintegrated")) && !flags.booleans.has("force-with-lease"))
     return usage3(io, "--expect and --overwrite-unintegrated only apply with --force-with-lease", PUSH_USAGE);
-  if (expect !== null && !/^[0-9a-f]{40,64}$/u.test(expect))
-    return usage3(io, "--expect must be a full commit sha", PUSH_USAGE);
+  if (expect !== null && !/^[0-9a-f]{7,64}$/u.test(expect))
+    return usage3(io, "--expect must be a commit sha (at least 7 hex digits)", PUSH_USAGE);
   const plan = pushPreflight(io.cwd);
   if (!plan.ok)
     return forgeFail(io, plan);
@@ -77497,7 +77901,7 @@ var init_stack2 = __esm(() => {
 
 // packages/workit-core/src/fanout.ts
 import { spawnSync as spawnSync23 } from "node:child_process";
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 import fs23 from "node:fs";
 import path45 from "node:path";
 function expandBraces(pattern, limit = 64) {
@@ -77978,7 +78382,7 @@ function sliceHash(slice) {
     context: _context,
     ...definition
   } = slice;
-  return createHash16("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
+  return createHash17("sha256").update(JSON.stringify(definition)).digest("hex").slice(0, 16);
 }
 function fanoutsDir(cwd) {
   const root = storeRoot(cwd);
@@ -78683,13 +79087,13 @@ var init_fanout_worktree = __esm(() => {
 });
 
 // packages/workit-core/src/fanout-brief.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 function workerSession(lead, slice, attempt) {
   const tail = attempt === null ? "" : `+try${attempt}`;
   const full = `${lead}-w-${slice}${tail}`;
   if (full.length <= SESSION_MAX)
     return full;
-  const digest = createHash17("sha256").update(slice).digest("hex").slice(0, 12);
+  const digest = createHash18("sha256").update(slice).digest("hex").slice(0, 12);
   return `${lead.slice(0, SESSION_MAX - 3 - digest.length - tail.length)}-w-${digest}${tail}`;
 }
 function renderBrief(cwd, plan, input) {
@@ -95875,7 +96279,7 @@ var init_rules = __esm(() => {
 
 // packages/workit-cli/src/test-audit/audit.ts
 import { spawnSync as spawnSync25 } from "node:child_process";
-import { existsSync as existsSync19, readdirSync as readdirSync8, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync19, readdirSync as readdirSync9, readFileSync as readFileSync22, statSync as statSync7 } from "node:fs";
 import path49 from "node:path";
 function git7(cwd, args) {
   const run = spawnSync25("git", ["-c", "core.quotepath=off", ...args], {
@@ -95886,7 +96290,7 @@ function git7(cwd, args) {
   return { ok: run.status === 0, stdout: run.stdout ?? "" };
 }
 function walkTests(dir, out) {
-  for (const entry of readdirSync8(dir, { withFileTypes: true })) {
+  for (const entry of readdirSync9(dir, { withFileTypes: true })) {
     if (entry.name.startsWith(".") && entry.name !== "." && entry.isDirectory())
       continue;
     const full = path49.join(dir, entry.name);
@@ -96022,7 +96426,7 @@ import {
   lstatSync as lstatSync7,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync4,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   readFileSync as readFileSync23,
   readlinkSync as readlinkSync3,
   realpathSync as realpathSync9,
@@ -96119,7 +96523,7 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
   let removed = 0;
   let names = [];
   try {
-    names = readdirSync9(tmp);
+    names = readdirSync10(tmp);
   } catch {
     return 0;
   }
@@ -96148,7 +96552,7 @@ function removeStaleCopies(tmp = os14.tmpdir()) {
 }
 function linkNodeModules(origin, target, repo, copy) {
   mkdirSync9(target, { recursive: true });
-  for (const entry of readdirSync9(origin, { withFileTypes: true })) {
+  for (const entry of readdirSync10(origin, { withFileTypes: true })) {
     const from = path50.join(origin, entry.name);
     const to = path50.join(target, entry.name);
     if (entry.name.startsWith("@") && entry.isDirectory()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "8.6.0",
+  "version": "8.7.0",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,9 +38,9 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-core": "^8.6.0",
-    "@brainervirus/workit-cursor": "^8.6.0",
-    "@brainervirus/workit-opencode": "^8.6.0",
+    "@brainervirus/workit-core": "^8.7.0",
+    "@brainervirus/workit-cursor": "^8.7.0",
+    "@brainervirus/workit-opencode": "^8.7.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"